joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fdc4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040729f
xor ebx, ebx
cmp dword [0x41ab78], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x40fe9a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40ff7a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40ff7a
push eax
call fcn.00407231
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41ab78], eax
call esi
push eax
call fcn.00407231
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41ab7c], eax
call esi
push eax
call fcn.00407231
mov dword [0x41ab80], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00407a04
test eax, eax
pop ecx
pop ecx
je 0x40fe68
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004034bb
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x40fe9a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00407231
cmp eax, ebx
pop ecx
mov dword [0x41ab88], eax
je 0x40fe9a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407231
pop ecx
mov dword [0x41ab84], eax
mov eax, dword [0x41ab84]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x40ff1f
cmp dword [0x41ab88], ecx
je 0x40ff1f
push eax
call fcn.004072a8
push dword [0x41ab88]
mov esi, eax
call fcn.004072a8
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x40ff1f
cmp edi, ebx
je 0x40ff1f
call esi
cmp eax, ebx
je 0x40feec
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40feec
test byte [ebp - 0x18], 1
jne 0x40ff1f
lea eax, [ebp - 0x10]
push eax
call fcn.00407a3b
test eax, eax
pop ecx
je 0x40ff07
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004034bb
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x40ff16
or dword [ebp + 0x10], 0x200000
jmp 0x40ff5a
or dword [ebp + 0x10], 0x40000
jmp 0x40ff5a
mov eax, dword [0x41ab7c]
cmp eax, dword [ebp - 8]
je 0x40ff5a
push eax
call fcn.004072a8
cmp eax, ebx
pop ecx
je 0x40ff5a
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40ff5a
mov eax, dword [0x41ab80]
cmp eax, dword [ebp - 8]
je 0x40ff5a
push eax
call fcn.004072a8
cmp eax, ebx
pop ecx
je 0x40ff5a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41ab78]
call fcn.004072a8
cmp eax, ebx
pop ecx
je 0x40ff7a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ff7c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.004014da
mov ebx, eax
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, ebx
or al, 0x40
push eax
mov eax, 0x401d8d
sub eax, fcn.00401558
push eax
push fcn.00401558
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x401081
mov eax, ebx
lea edx, [ebp - 2]
call fcn.0040141a
mov eax, ebx
lea ecx, [ebx + 0x1b600]
call fcn.00401461
mov esi, ecx
mov eax, ebx
or si, 1
cdq
idiv esi
lea edx, [eax + ecx]
mov eax, ebx
mov ecx, 0x40b054
sar eax, 2
sub ecx, eax
lea ebx, [ebp - 2]
mov eax, ecx
call fcn.00401558
xor eax, eax
lea esp, [ebp + 0x82]
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x4014da
Capabilities:
Delete file
Encode data using base64 via winapi
Get common file path

Disassembly:
push ecx
push edx
enter 0x220, 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
push 0x104
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x18]
sub eax, 0x41
leave
pop edx
pop ecx
ret
Function at 0x407b88
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x805440]
jne 0x407b92
repz ret
jmp fcn.004099c6

Function at 0x4088eb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x805440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405f33
and dword [ebp - 0x14], 0
cmp dword [0x8075bc], 0
mov dword [ebp - 0x18], eax
jne 0x40899e
push 0x4022c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408a46
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4022b8
push ebx
call edi
test eax, eax
je 0x408a46
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4022a8
push ebx
mov dword [0x8075bc], eax
call edi
push eax
call esi
push 0x402294
push ebx
mov dword [0x8075c0], eax
call edi
push eax
call esi
push 0x402278
push ebx
mov dword [0x8075c4], eax
call edi
push eax
call esi
mov dword [0x8075cc], eax
test eax, eax
je 0x40899e
push 0x402260
push ebx
call edi
push eax
call esi
mov dword [0x8075c8], eax
mov eax, dword [0x8075c8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4089f7
cmp dword [0x8075cc], ecx
je 0x4089f7
push eax
call esi
push dword [0x8075cc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4089f7
test ebx, ebx
je 0x4089f7
call edi
test eax, eax
je 0x4089ee
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4089ee
test byte [ebp - 8], 1
jne 0x4089f7
or dword [ebp + 0x10], 0x200000
jmp 0x408a2a
mov eax, dword [0x8075c0]
cmp eax, dword [ebp - 0x18]
je 0x408a2a
push eax
call esi
test eax, eax
je 0x408a2a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408a2a
mov eax, dword [0x8075c4]
cmp eax, dword [ebp - 0x18]
je 0x408a2a
push eax
call esi
test eax, eax
je 0x408a2a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x8075bc]
call esi
test eax, eax
je 0x408a46
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408a48
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407b88
leave
ret
Function at 0x801850
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x6b
mov edx, 0x72
mov word [0xb8b648], ax
mov word [0xb8b64c], dx
mov ecx, 0x6e
mov edx, 0x65
xor eax, eax
push 0xb8b648
mov dword [0xb8b654], 0x320033
mov dword [0xb8b65c], 0x6c006c
mov word [0xb8b64e], cx
mov dword [0xb8b650], 0x6c0065
mov dword [0xb8b658], 0x64002e
mov word [0xb8b64a], dx
mov word [0xb8b660], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0xb8b644]
lea ecx, [esp]
push ecx
push 0x40
mov dword [0xb8b640], eax
mov eax, dword [0x80c694]
push edx
push eax
mov byte [0x80790b], 0x65
mov dword [0x807901], 0x75747269
mov word [0x807905], 0x6c61
mov byte [0x807900], 0x56
mov word [0x80790c], 0x7463
mov byte [0x80790e], 0
mov dword [0x807907], 0x746f7250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x801940
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1050
call fcn.00409140
cmp dword [0xb8b644], 0x37
jne 0x801a0c
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x402c2c
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov ecx, dword [esp]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
push 0
lea edx, [esp + 0x454]
push edx
push 0x402c48
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 8]
push edx
push 0x402c5c
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0x402c7c
push 0x402c98
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push 0
lea eax, [esp + 0x854]
push eax
push 0
push 0x402cd4
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0x402cf0
push 0x402d10
push 0x402d2c
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov ecx, dword [0xb8c638]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x80c694]
mov byte [ecx + esi], al
add esp, 0x1050
ret
Function at 0x801bd0
Capabilities:
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0xb8b644]
sub esp, 0x5cc
push ebx
push ebp
push esi
mov esi, dword [0x80c694]
shr eax, 3
push edi
test eax, eax
je 0x801da0
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
jmp 0x801c04
mov esi, dword [esp + 0x14]
cmp dword [0xb8b644], 0x1c
jne 0x801c21
lea eax, [esp + 0x34]
push eax
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov edx, dword [0x805dc0]
mov eax, dword [0x805dc4]
mov ecx, dword [0x805dc8]
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [esp + 0x24], edx
mov edx, dword [0x805dcc]
mov ebp, 0xc6ef3720
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], 0x20
mov eax, ebx
shl eax, 4
add eax, dword [esp + 0x2c]
mov esi, ebx
shr esi, 5
cmp dword [0xb8b644], 0x1b
mov dword [esp + 0x10], eax
jne 0x801c9d
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1dc]
push ecx
push 0
push 0x402b00
push 0x402b6c
push 0x402ba0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
mov eax, dword [esp + 0x10]
add esi, dword [esp + 0x28]
lea ecx, [ebx + ebp]
xor esi, ecx
xor esi, eax
sub edi, esi
mov eax, edi
shl eax, 4
mov dword [0xb8b5b4], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
add dword [esp + 0x10], eax
cmp dword [0xb8b644], 0x1be
jne 0x801ce2
lea ecx, [esp + 0x38]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, edi
shr esi, 5
add esi, dword [esp + 0x20]
cmp dword [0xb8b644], 0x979
mov dword [0xb8b5b8], 0xff6b3619
mov dword [0xb8b5bc], 0xffffffff
jne 0x801d1f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [edi + ebp]
xor esi, eax
mov eax, dword [esp + 0x10]
xor eax, esi
sub ebx, eax
add ebp, 0x61c88647
dec dword [esp + 0x18]
mov dword [esp + 0x10], eax
jne 0x801c5a
cmp dword [0xb8b644], 0x8d4
jne 0x801d57
lea edx, [esp + 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [esp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], edi
cmp dword [0xb8b644], 0x17
jne 0x801d8f
push 0
push 0
push 0
push 0x402bec
push 0x402c20
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea eax, [esp + 0x98]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
add esi, 8
dec dword [esp + 0x1c]
mov dword [esp + 0x14], esi
jne 0x801c00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5cc
ret
Function at 0x403430
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403489
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403489
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40347a
cmp esi, edx
jae 0x403489
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x403468
cmp esi, edx
jae 0x403489
cmp word [esi], 0
je 0x403489
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x407350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor al, al
push edi
xor edi, edi
test esi, esi
je 0x407417
push ebx
mov ecx, dword [ebp + 8]
mov dl, byte [edi + ecx]
xor dl, al
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
movzx ecx, cl
xor al, 0x8c
and bl, 1
movzx eax, al
cmove eax, ecx
inc edi
cmp edi, esi
jb 0x407365
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x408cc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4312d3
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x442078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x442060]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.00408bb0
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x408ea1
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.0040e240
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x435764
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408ea1
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x408d95
cmp eax, 2
jne 0x408ea1
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x408db6
test cl, 1
jne 0x408ea1
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x408dbc
jmp 0x408ea1
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x408ea1
call fcn.00403070
mov ecx, eax
test ecx, ecx
je 0x408ecc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.00406dc0
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x43576c
push eax
call fcn.00409390
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.00407350
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x408e85
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x408e26
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.00408f20
push dword [0x442068]
lea eax, [ebp - 0x74]
push dword [0x442064]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x408e62
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x408e7e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x408ea3
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x408ea1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x408eae
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040c56f
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402e50
int3
Function at 0x409080
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431308
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x442078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x442060]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.00408bb0
test eax, eax
je 0x4091a8
mov esi, dword [ebp - 0x18]
mov edi, dword [0x442060]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x409153
cmp dword [esi], 0
je 0x409146
push 0x435618
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x409113
mov eax, 1
jmp 0x409174
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40914c
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call eax
jmp 0x409174
cmp dword [esi + 4], 0
jne 0x409153
mov eax, 1
jmp 0x409174
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40919e
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x409186
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x4091ab
xor ebx, ebx
jmp 0x40924f
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x40924f
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x409208
mov ecx, dword [ebx]
test ecx, ecx
je 0x40926e
push ecx
push eax
call fcn.0041aaf1
add esp, 8
test eax, eax
je 0x409208
mov edx, dword [edi]
test edx, edx
je 0x409208
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4091e0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x435774
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x409213
lea eax, [edx + 0xd]
jmp 0x409248
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409220
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x435764
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x40925a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402e50
int3
Function at 0x40aa30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40aaa1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x40aa6f
cmp eax, 2
jne 0x40aa8b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x40aa9b
test ecx, ecx
je 0x40aa96
test cl, 1
jne 0x40aa8b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x40aa9b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x421aac
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x438948
push 0x438940
push str.FlsAlloc
push 0x1e
call fcn.00421919
mov esi, eax
add esp, 0x10
test esi, esi
je 0x421ae0
push dword [ebp + 8]
mov ecx, esi
call dword [0x4321d4]
call esi
jmp 0x421ae6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x421b2a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x438958
push 0x438950
push str.FlsGetValue
push 0x20
call fcn.00421919
mov esi, eax
add esp, 0x10
test esi, esi
je 0x421b61
push dword [ebp + 8]
mov ecx, esi
call dword [0x4321d4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x42307c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00422eed

Function at 0x423476
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040d120
mov eax, dword [0x442078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004220df
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4234b8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x423614
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004307e0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4447e0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0042446d
mov ecx, dword [esi*4 + 0x4447e0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x42360d
cmp eax, dword [edi + ecx + 0x24]
jne 0x42360d
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42360d
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0042446d
add esp, 0x14
test edx, edx
jl 0x42360d
jg 0x423583
test eax, eax
jb 0x42360d
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x42360d
jl 0x42359d
cmp dword [ebp - 0x1008], eax
ja 0x42360d
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4235bb
test ebx, ebx
je 0x4235f4
cmp ecx, edi
jae 0x4235f4
mov al, byte [ecx]
cmp al, 0xd
jne 0x4235d5
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4235e1
cmp byte [ecx + 1], 0xa
jne 0x4235e1
inc ecx
jmp 0x4235e1
movzx eax, al
movsx eax, byte [eax + 0x442308]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4235bb
cmp edx, ebx
jne 0x4235bb
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x423612
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040c56f
leave
ret