joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477050
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c35a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.00477450
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x6d6cd4
call fcn.00490f51
mov ecx, dword [0x5b53c8]
mov al, byte [esi]
push ecx
push ebx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x48], 1
mov byte [esp + 0x30], al
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.00474770
mov esi, 0x5b5420
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x4770f7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4770ee
cmp al, 0xff
je 0x4770ee
dec al
mov byte [ecx], al
jmp 0x4770f7
push ecx
call fcn.004b1dac
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.004adac0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], 0xffffffff
cmp eax, ebx
mov dword [esp + 0x18], esi
je 0x47713d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x477134
cmp al, 0xff
je 0x477134
dec al
mov byte [ecx], al
jmp 0x47713d
push ecx
call fcn.004b1dac
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.00490fd8
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x4a7f40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4c4c40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.0049cf52
mov eax, dword [0x680958]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.0049ce84
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004a8a60
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4a7fe7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4a7fde
cmp al, 0xff
je 0x4a7fde
dec al
mov byte [ecx], al
jmp 0x4a7fe7
push ecx
call fcn.004b1dac
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4a8018
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4a800f
cmp al, 0xff
je 0x4a800f
dec al
mov byte [ecx], al
jmp 0x4a8018
push ecx
call fcn.004b1dac
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4b44ff
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b4537
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b24e9
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b24c1
jmp 0x4b4543
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b5bf1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b5c33
call fcn.004bbb99
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4b5c33
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b5c2a
xor eax, eax
jmp 0x4b5c3b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b5c41
pop edi
pop esi
pop ebx
ret 4

Function at 0x4bc0c9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4bc0f7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4bc115
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004bc02f
jmp 0x4bc115
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4bc115
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004bc02f
test edi, edi
mov eax, edi
jne 0x4bc0ff
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x427d70
Capabilities:
Hash data using sha1

Disassembly:
mov edx, dword [esp + 4]
push edi
mov ecx, 0x17
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
pop edi
ret

Function at 0x427e50
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov edx, dword [eax + 0x10]
mov ecx, dword [eax]
mov ebp, dword [eax + 0xc]
push esi
mov esi, dword [eax + 8]
mov dword [esp + 0x18], edx
push edi
xor dl, dl
xor edi, edi
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x20], ebp
mov byte [esp + 0x13], dl
mov dword [esp + 0x24], edi
cmp edi, 0x3c
ja case.0x427e92.4
xor eax, eax
mov al, byte [edi + 0x427fec]
jmp dword [eax*4 + 0x427fd8]
mov dword [esp + 0x14], 0x5a827999
jmp case.0x427e92.4
mov dword [esp + 0x14], 0x6ed9eba1
jmp case.0x427e92.4
mov dword [esp + 0x14], 0x8f1bbcdc
jmp case.0x427e92.4
mov dword [esp + 0x14], 0xca62c1d6
mov al, dl
and al, 0xf
cmp dl, 0xf
mov byte [esp + 0x28], al
mov edi, dword [esp + 0x28]
jbe 0x427f0c
mov edx, edi
and edx, 0xff
lea eax, [edx - 8]
lea ebp, [edx - 3]
and eax, 0xf
and ebp, 0xf
mov eax, dword [ebx + eax*4]
xor eax, dword [ebx + ebp*4]
lea ebp, [edx + 2]
and ebp, 0xf
xor eax, dword [ebx + ebp*4]
mov ebp, dword [ebx + edx*4]
xor eax, ebp
mov ebp, eax
add eax, eax
shr ebp, 0x1f
or ebp, eax
mov dword [ebx + edx*4], ebp
mov ebp, dword [esp + 0x20]
mov dl, byte [esp + 0x13]
cmp dl, 0x14
jae 0x427f1f
mov eax, ecx
mov edx, esi
not eax
and eax, ebp
and edx, ecx
or eax, edx
jmp 0x427f3d
cmp dl, 0x28
jb 0x427f37
cmp dl, 0x3c
jae 0x427f37
mov eax, esi
mov edx, esi
or eax, ecx
and edx, ecx
and eax, ebp
or eax, edx
jmp 0x427f3d
mov eax, ebp
xor eax, esi
xor eax, ecx
mov edx, dword [esp + 0x18]
and edi, 0xff
mov ebx, edx
shr ebx, 0x1b
shl edx, 5
or ebx, edx
mov edx, ebx
mov ebx, dword [esp + 0x34]
add edx, dword [ebx + edi*4]
mov edi, dword [esp + 0x14]
add edx, edi
mov edi, dword [esp + 0x1c]
add edx, edi
mov edi, dword [esp + 0x24]
add eax, edx
mov edx, ecx
shl edx, 0x1e
shr ecx, 2
mov dword [esp + 0x1c], ebp
or edx, ecx
mov ecx, dword [esp + 0x18]
mov ebp, esi
mov esi, edx
mov dl, byte [esp + 0x13]
inc dl
inc edi
cmp dl, 0x50
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], eax
mov byte [esp + 0x13], dl
mov dword [esp + 0x24], edi
jb 0x427e85
mov edx, dword [esp + 0x30]
mov edi, dword [edx]
mov ebx, dword [edx + 4]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [edx], edi
mov edi, dword [edx + 8]
add edi, esi
mov esi, dword [edx + 0xc]
add ebx, ecx
mov ecx, dword [edx + 0x10]
add esi, ebp
mov dword [edx + 8], edi
mov dword [edx + 0xc], esi
pop edi
add ecx, eax
pop esi
mov dword [edx + 4], ebx
pop ebp
mov dword [edx + 0x10], ecx
pop ebx
add esp, 0x1c
ret
Function at 0x433ee0
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.00433e20
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
push esi
push 1
test eax, eax
push 0x1f0fff
je 0x433f0b
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
pop esi
ret
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.DLL_WaitForInputIdle]
pop esi
ret

Function at 0x4341f0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x80
push ebx
push ebp
push esi
push edi
push 0x1a9a4
call fcn.00433fe0
mov ebp, eax
add esp, 4
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x43429b
mov eax, dword [ebp + 0xc]
push eax
call fcn.00433fe0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4342a6
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00433fe0
mov ebx, eax
mov eax, dword [ebp]
add esp, 4
test eax, eax
je 0x434245
push eax
jmp 0x434249
mov edx, dword [ebp + 0x10]
push edx
call fcn.00433fe0
mov esi, eax
add esp, 4
mov eax, dword [esi]
test eax, eax
je 0x43428d
test eax, 0x80000000
je 0x434267
and eax, 0x7fffffff
jmp 0x434273
push eax
call fcn.00433fe0
add esp, 4
add eax, 2
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x4342ef
add esi, 4
mov dword [ebx], eax
add ebx, 4
mov eax, dword [esi]
test eax, eax
jne 0x434259
mov eax, dword [ebp + 0x24]
add ebp, 0x14
test eax, eax
jne 0x434214
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
lea eax, [esp + 0x10]
push 0x4381d0
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00433fe0
add esp, 4
lea edx, [esp + 0x10]
push eax
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0
lea eax, [esp + 0x14]
push 0x4381c0
push eax
call dword [sym.imp.USER32.DLL_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.DLL_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
lea ecx, [esp + 0x10]
push 0x4381a0
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov edx, dword [ebp + 0xc]
push edx
call fcn.00433fe0
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 4
push eax
lea eax, [esp + 0x14]
push eax
call edi
lea ecx, [esp + 0x10]
push 0x438190
push ecx
call edi
mov esi, dword [esi]
test esi, 0x80000000
jne 0x434343
push esi
call fcn.00433fe0
add esp, 4
add eax, 2
lea edx, [esp + 0x10]
push eax
push edx
call edi
push 0
lea eax, [esp + 0x14]
push 0x4381c0
push eax
call dword [sym.imp.USER32.DLL_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.DLL_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x310
mov eax, dword [0x4130cc]
xor eax, esp
mov dword [esp + 0x30c], eax
push ebp
mov ebp, dword [esp + 0x31c]
push esi
mov esi, dword [esp + 0x31c]
push 0x1ff
lea eax, [esp + 0x119]
push 0
push eax
mov dword [esp + 0x14], esi
mov byte [esp + 0x120], 0
call fcn.004028d0
push 0x7f
lea ecx, [esp + 0xa5]
push 0
push ecx
mov byte [esp + 0xac], 0
call fcn.004028d0
push 0x7f
lea edx, [esp + 0x31]
push 0
push edx
mov byte [esp + 0x38], 0
call fcn.004028d0
add esp, 0x24
test esi, esi
jne 0x401090
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x30c]
xor ecx, esp
call fcn.004028b6
add esp, 0x310
ret
push edi
push 0
call fcn.00401ad9
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], edx
call fcn.00401ab5
push eax
push 0x4101b8
lea ecx, [esp + 0xa8]
push 0x80
push ecx
call fcn.00402899
lea edi, [esp + 0x30]
add esp, 0x18
add edi, 0xffffffff
lea esp, [esp]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x4010d0
mov dx, word [0x4101b4]
lea eax, [esp + 0x98]
mov word [edi], dx
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4010f0
lea edi, [esp + 0x18]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x401102
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x18]
rep movsb byte es:[edi], byte [esi]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x401123
mov cx, word [0x4101b0]
mov dl, byte [0x4101b2]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x18]
mov edx, eax
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401146
lea edi, [esp + 0x118]
sub eax, edx
add edi, 0xffffffff
jmp 0x401160
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x401160
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, ebp
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov edi, edi
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x401180
lea edi, [esp + 0x118]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x401197
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x118]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
pop edi
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4011c0
mov ecx, dword [esp + 8]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x11c]
push 1
push edx
call fcn.00401c2f
mov ecx, dword [esp + 0x324]
add esp, 0x10
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.004028b6
add esp, 0x310
ret
Function at 0x41300e
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
mov eax, dword [esi]
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
push edi
lea ebx, [ecx + eax + 0x18]
jbe 0x4130f0
add ebx, 0x10
mov eax, dword [ebx]
test eax, eax
jne 0x41308b
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x4130db
push dword [esi + 0x34]
mov eax, dword [ebx - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push edi
push eax
call dword [esi + 0x1c]
test eax, eax
je 0x4130fa
mov edx, dword [ebx - 4]
add edx, dword [ebp - 4]
mov ecx, edi
mov dword [ebx - 8], edx
mov edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x4130db
mov ecx, dword [ebx + 4]
add ecx, eax
mov eax, dword [ebp + 0xc]
push ecx
call fcn.00412ff6
test eax, eax
je 0x4130fa
push dword [esi + 0x34]
mov eax, dword [ebx - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push dword [ebx]
push eax
call dword [esi + 0x1c]
test eax, eax
je 0x4130fa
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
add eax, dword [ebp - 4]
mov esi, dword [ebx + 4]
add esi, dword [ebp + 8]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov dword [ebx - 8], eax
mov eax, dword [esi]
movzx eax, word [eax + 6]
inc dword [ebp - 8]
add ebx, 0x28
cmp dword [ebp - 8], eax
jl 0x41303b
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x4130f3
Function at 0x41498e
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea eax, [ebp - 8]
push eax
push 0x403d30
push 1
xor ebx, ebx
push ebx
push 0x403dd0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
cmp edi, ebx
jl 0x414a41
mov eax, dword [ebp - 8]
push ebx
lea edx, [ebp - 4]
push edx
push 0x401cfc
mov dword [ebp - 4], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov edi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, ebx
jne 0x414a41
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x14]
mov esi, dword [ebp + 0xc]
jmp 0x414a3c
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
lea edx, [ebp + 0xc]
push edx
push 1
push eax
call dword [ecx + 0xc]
mov edi, eax
cmp edi, ebx
jne 0x414a40
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push esi
push 0x403d20
push ebx
push ebx
push eax
call dword [ecx + 0x20]
mov edi, eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, ebx
jl 0x414a3c
push dword [ebp + 8]
push dword [esi]
call fcn.0041491c
mov edi, eax
cmp edi, ebx
jge 0x414a40
mov eax, dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi], ebx
cmp dword [esi], ebx
je 0x4149ec
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret 8
Function at 0x4159ac
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4276d8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 8
pop ecx
push 0xf0000000
push 0x18
push 0x4036b0
xor ebx, ebx
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x3c]
mov byte [ebp - 0x30], cl
mov byte [ebp - 0x2f], 2
mov word [ebp - 0x2e], bx
mov dword [ebp - 0x2c], 0x6610
mov dword [ebp - 0x28], 0x20
lea edi, [ebp - 0x24]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x415a98
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push 0x2c
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
xor edi, edi
test eax, eax
je 0x415a8c
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push ebx
lea eax, [ebp - 0x34]
push eax
push 4
push dword [ebp + 0xc]
inc edi
mov dword [ebp - 0x34], edi
call esi
test eax, eax
jne 0x415a3b
xor edi, edi
jmp 0x415a83
push ebx
lea eax, [ebp - 0x34]
push eax
push 3
push dword [ebp + 0xc]
mov dword [ebp - 0x34], edi
call esi
test eax, eax
je 0x415a37
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x415a63
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [ebp - 0x38]
push ecx
push eax
push ebx
push edi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x415a37
push dword [ebp - 0x38]
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_int_]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004164ed
leave
ret 8
Function at 0x4164ed
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4276d8]
jne 0x4164f6
ret
jmp 0x4164fb
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x4276d8]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x429974]
test eax, eax
je 0x41651f
call eax
cmp dword [0x429978], 0
je 0x416566
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x429978]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.004164ed
add ebp, 0x2a8
leave
ret
Function at 0x416af7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
push 5
pop ecx
mov esi, 0x4040a4
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 5
pop ecx
mov esi, 0x40408c
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x404078
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [ebp + 8]
movsw word es:[edi], word [esi]
mov esi, 0x404064
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push ebx
push 0x404044
movsb byte es:[edi], byte [esi]
xor esi, esi
lea eax, [ebp - 0xc4]
push 0x64
push eax
mov dword [0x4298dc], esi
mov dword [0x4298e0], esi
mov dword [0x4298e4], esi
call fcn.00416a9f
add esp, 0x10
test eax, eax
jl 0x416c9b
lea eax, [ebp + 8]
push eax
push 0x20019
push esi
lea eax, [ebp - 0xc4]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x416ca4
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push 0x4298dc
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x60]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 4
call edi
test eax, eax
je 0x416bc5
mov dword [0x4298dc], esi
lea eax, [ebp - 4]
push eax
push 0x4298e0
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x416be6
mov dword [0x4298e0], esi
lea eax, [ebp - 4]
push eax
push 0x4298e4
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x416c07
mov dword [0x4298e4], esi
lea eax, [ebp - 4]
push eax
push 0x4298e8
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x416c2c
mov dword [0x4298e8], 0xffff0000
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4298dc], esi
jne 0x416c55
cmp dword [0x4298e0], esi
jne 0x416c65
cmp dword [0x4298e4], esi
jne 0x416c65
xor eax, eax
inc eax
jmp 0x416cd9
cmp dword [0x4298e0], esi
jne 0x416c65
cmp dword [0x4298e4], esi
je 0x416c8a
push ebx
push 0x404040
push 0x64
push 0x429878
call fcn.00416a9f
add esp, 0x10
test eax, eax
jl 0x416c9b
push esi
push ebx
call sub.rtutils.dll_TraceRegisterExW
mov dword [0x4276e0], eax
cmp dword [0x4298dc], esi
jne 0x416c9f
cmp dword [0x4276e0], 0xffffffff
jne 0x416c9f
xor eax, eax
jmp 0x416cd9
xor eax, eax
inc eax
jmp 0x416cd4
push ebx
push 0x404040
push 0x64
push 0x429878
call fcn.00416a9f
add esp, 0x10
test eax, eax
jl 0x416c9b
push esi
push ebx
call sub.rtutils.dll_TraceRegisterExW
mov ecx, eax
xor eax, eax
inc eax
cmp ecx, 0xffffffff
mov dword [0x4276e0], ecx
je 0x416cd9
mov dword [0x4298ec], eax
pop edi
pop esi
pop ebx
leave
ret 4