joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44a008]
jne 0x40100a
repz ret
jmp fcn.00401a7b

Function at 0x40613a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040350a
and dword [ebp - 4], 0
cmp dword [0x44c55c], 0
mov ebx, eax
jne 0x4061eb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40629c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40629c
push eax
call fcn.00403498
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44c55c], eax
call esi
push eax
call fcn.00403498
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44c560], eax
call esi
push eax
call fcn.00403498
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44c564], eax
call esi
push eax
call fcn.00403498
pop ecx
mov dword [0x44c56c], eax
test eax, eax
je 0x4061eb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403498
pop ecx
mov dword [0x44c568], eax
mov eax, dword [0x44c568]
cmp eax, ebx
je 0x406243
cmp dword [0x44c56c], ebx
je 0x406243
push eax
call fcn.00403513
push dword [0x44c56c]
mov esi, eax
call fcn.00403513
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406243
test edi, edi
je 0x406243
call esi
test eax, eax
je 0x40623a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40623a
test byte [ebp - 0xc], 1
jne 0x406243
or dword [ebp + 0x10], 0x200000
jmp 0x40627c
mov eax, dword [0x44c560]
cmp eax, ebx
je 0x40627c
push eax
call fcn.00403513
pop ecx
test eax, eax
je 0x40627c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40627c
mov eax, dword [0x44c564]
cmp eax, ebx
je 0x40627c
push eax
call fcn.00403513
pop ecx
test eax, eax
je 0x40627c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44c55c]
call fcn.00403513
pop ecx
test eax, eax
je 0x40629c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40629e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x445fa0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x44a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x80c], eax
cmp esi, 0x182
jne 0x445fda
lea ecx, [ebp - 0x82c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
jmp 0x445fea
cmp esi, 0x19f
jne 0x445fea
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor edi, edi
test esi, esi
jle 0x446095
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
jmp 0x446000
lea esi, [ebp - 0x808]
mov dword [ebp - 0x808], 0
call fcn.00445f90
mov dl, byte [ebp - 0x808]
mov eax, dword [ebp - 0x80c]
mov esi, dword [ebp + 0xc]
xor byte [eax + edi], dl
cmp esi, 0xf
jne 0x44608b
push 0
push 0
call ebx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x804]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push str.fakelukeposogizomuzofoco
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push str.tazofonodeponevizeroxisewotuk
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push 0
lea edx, [ebp - 0x404]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupRead]
inc edi
cmp edi, esi
jl 0x446000
pop ebx
pop edi
cmp esi, 0x2d
pop esi
jne 0x4460b0
mov dword [0x542248], 0xa62e7790
mov dword [0x54224c], 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x4460c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x44a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x542114]
push esi
push edi
mov edi, dword [0x541f5c]
mov esi, eax
cmp eax, 0x5dd
jne 0x4460fd
push 0
lea eax, [ebp - 0x404]
push eax
push str.tiwugowe
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov eax, dword [0x44b300]
call fcn.00445f60
cmp dword [0x542114], 0x2f
jne 0x446118
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
push edi
call fcn.00445fa0
add esp, 8
cmp dword [0x542114], 0x568
pop edi
pop esi
jne 0x44614b
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov ecx, dword [ebp - 0x408]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret
Function at 0x409f8a
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push dword [ebp + 8]
xor ebx, ebx
lea esi, [ebp - 4]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call fcn.00409e6e
mov esi, eax
cmp esi, ebx
jl 0x40a075
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
cmp edi, ebx
jne 0x409ff3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x409fe3
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x40a074
mov esi, 0x80004005
jmp 0x40a074
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp + 8], eax
cmp eax, ebx
jne 0x40a009
mov esi, 0x8007000e
jmp 0x40a074
push eax
push edi
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40a035
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x405188
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x40a058
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x40a04f
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x40a06b
mov esi, 0x80004005
jmp 0x40a06b
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
cmp dword [ebp - 4], ebx
je 0x40a082
push dword [ebp - 4]
call fcn.00409396
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40a133
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
push dword [ebp + 8]
lea esi, [ebp - 4]
call fcn.00409e6e
mov ebx, dword [ebp - 4]
mov edi, eax
test edi, edi
js 0x40a19b
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40a19b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x40a19b
cmp eax, 3
je 0x40a19b
push 4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40a19b
call esi
mov edi, eax
test edi, edi
jle 0x40a194
and edi, 0xffff
or edi, 0x80070000
test edi, edi
js 0x40a19b
mov edi, 0x80004005
test ebx, ebx
je 0x40a1a5
push ebx
call fcn.00409396
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40a9da
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor esi, esi
push esi
push esi
push dword [edi]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], esi
call fcn.0040a08a
mov dword [ebp - 4], eax
cmp eax, esi
jl 0x40ab48
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jne 0x40aa45
mov eax, 0x20000
push eax
push 8
mov dword [ebp - 0xc], eax
call esi
push eax
call ebx
mov dword [ebp - 8], eax
test eax, eax
jne 0x40aa61
mov dword [ebp - 4], 0x8007000e
jmp 0x40ab48
mov eax, dword [ebp - 0x18]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x40aad6
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
and dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
sub ecx, eax
add eax, dword [ebp - 8]
push ecx
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40aadf
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
call 0x40ab4f
mov dword [ebp - 4], eax
cmp eax, 0x8007007a
je 0x40aa16
test eax, eax
js 0x40ab2b
push dword [ebp - 0x10]
push 8
call esi
push eax
call ebx
mov dword [edi + 8], eax
test eax, eax
je 0x40aad6
mov eax, dword [ebp - 0x14]
push dword [eax + 0x20]
push 8
call esi
jge 0x40aae0
add esi, ebx
movsb byte es:[edi], byte [esi]
or al, 0xc3
mov eax, dword [esp - 4]
add eax, 2
mov dword [esp - 4], eax
mov eax, dword [esp - 8]
sub esp, 4
ret
Function at 0x40b28f
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40b232
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40b250
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40b2ae
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40b295
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40b29e
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40b2a8
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40b28a
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40b214
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40b2fb
dec eax
je 0x40b2f2
sub eax, 3
je 0x40b2e9
mov dword [ebp - 4], 0x40
jmp 0x40b318
mov dword [ebp - 4], 4
jmp 0x40b2fe
mov dword [ebp - 4], 0x20
jmp 0x40b2fe
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40b34a
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40b2ca
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040ab5b
scasb al, byte es:[edi]
xchg edi, eax
pop esp
pop ebx
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x40b356
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4163b2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
jb 0x416504
add dword [ebp + 0xc], 5
or dword [ebp - 4], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 8], ecx
lea edi, [eax + esi]
jmp 0x4163ee
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x4163f3
inc edi
cmp edi, dword [ebp - 8]
jb 0x4163e5
mov eax, edi
sub eax, esi
cmp edi, dword [ebp - 8]
jae 0x4164e4
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x416477
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x41641f
cmp cl, 0xff
jne 0x4164a6
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
sub esi, eax
sub esi, dword [ebp + 0xc]
mov ebx, esi
mov dword [ebp - 0xc], ebx
test edx, edx
je 0x4164b7
movzx esi, byte [edx + 0x404f98]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
shr ebx, cl
mov cl, bl
test cl, cl
je 0x416467
cmp cl, 0xff
jne 0x4164b4
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, dword [ebp - 0xc]
jmp 0x41643d
dec ecx
shl edx, cl
and edx, 7
je 0x41640c
movzx ecx, byte [edx + 0x404f98]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x404f90], 0
mov cl, byte [ebx + 4]
je 0x4164a3
test cl, cl
je 0x4164a3
cmp cl, 0xff
jne 0x41640c
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x4163e0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x4163e0
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x10]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret 0xc

Function at 0x417e52
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [esi + 4]
xor ebx, ebx
cmp dword [eax], ebx
jne 0x417e6c
push ebx
push ebx
push eax
call fcn.00417ce5
cmp eax, ebx
jne 0x417ec5
push edi
lea edi, [esi + 8]
cmp dword [edi], ebx
jne 0x417e80
push ebx
push ebx
push edi
call fcn.00417ce5
cmp eax, ebx
jne 0x417ec4
lea eax, [esi + 4]
call fcn.00417df7
mov eax, edi
call fcn.00417df7
mov byte [esi + 0x10], bl
cmp dword [esi + 0xc], ebx
je 0x417e9b
xor eax, eax
jmp 0x417ec4
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x417e12
push ebx
push ebx
call fcn.00423107
add esp, 0x18
mov dword [esi + 0xc], eax
cmp eax, ebx
jne 0x417e97
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x417ec4
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret

Function at 0x418ef1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x429050]
jne 0x418efb
repz ret
jmp fcn.0041a95a
Function at 0x41d28b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x429050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041a188
and dword [ebp - 0x14], 0
cmp dword [0x42aeb0], 0
mov dword [ebp - 0x18], eax
jne 0x41d33e
push 0x401fa0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41d3e6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401f94
push ebx
call edi
test eax, eax
je 0x41d3e6
mov esi, dword [fcn.004028b4]
push eax
call esi
push 0x401f84
push ebx
mov dword [0x42aeb0], eax
call edi
push eax
call esi
push 0x401f70
push ebx
mov dword [0x42aeb4], eax
call edi
push eax
call esi
push 0x401f54
push ebx
mov dword [0x42aeb8], eax
call edi
push eax
call esi
mov dword [0x42aec0], eax
test eax, eax
je 0x41d33e
push 0x401f3c
push ebx
call edi
push eax
call esi
mov dword [0x42aebc], eax
mov eax, dword [0x42aebc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.004028b0]
cmp eax, ecx
je 0x41d397
cmp dword [0x42aec0], ecx
je 0x41d397
push eax
call esi
push dword [0x42aec0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41d397
test ebx, ebx
je 0x41d397
call edi
test eax, eax
je 0x41d38e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41d38e
test byte [ebp - 8], 1
jne 0x41d397
or dword [ebp + 0x10], 0x200000
jmp 0x41d3ca
mov eax, dword [0x42aeb4]
cmp eax, dword [ebp - 0x18]
je 0x41d3ca
push eax
call esi
test eax, eax
je 0x41d3ca
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41d3ca
mov eax, dword [0x42aeb8]
cmp eax, dword [ebp - 0x18]
je 0x41d3ca
push eax
call esi
test eax, eax
je 0x41d3ca
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42aeb0]
call esi
test eax, eax
je 0x41d3e6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41d3e8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418ef1
leave
ret

Function at 0x423610
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
pop ebp
ret 4
Function at 0x1f3130
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x1f3140
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
lea esi, [esi + eax*2]
lea edi, [edi + eax*2]
cmp eax, 1
jne 0x1f3150
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1f3710
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x228
mov eax, dword [0x4116ec]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0x22c]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 4]
lea ecx, [esp + 0x14]
xor esi, esi
push ecx
mov ecx, dword [edi]
or edx, 0x2001f
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call fcn.001f36a0
mov ebp, eax
cmp ebp, esi
je 0x1f3774
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x1f376d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x1f380d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x18]
push esi
push esi
push esi
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x44]
push ecx
push esi
push edx
mov dword [esp + 0x40], 0x100
call ebx
test eax, eax
jne 0x1f37da
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.001f3710
mov ebp, eax
cmp ebp, esi
jne 0x1f375e
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push esi
push esi
push esi
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x44]
push eax
push esi
push ecx
mov dword [esp + 0x40], 0x100
call ebx
test eax, eax
je 0x1f37a0
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x1f37ef
push eax
call ebp
mov dword [esp + 0x14], esi
mov ebx, dword [esp + 0x24]
mov eax, edi
mov dword [esp + 0x18], esi
call fcn.001f3890
mov edi, eax
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x1f380b
push eax
call ebp
mov eax, edi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00338a41
add esp, 0x228
ret 4
Function at 0x1f43e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x3a2ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4116ec]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x410]
mov ebx, dword [ebp + 0x414]
xor esi, esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, esi
jne 0x1f445f
call fcn.001f2970
mov esi, eax
jmp 0x1f4554
mov eax, dword [ebp - 0x14]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
cmp ebx, esi
jne 0x1f447b
call fcn.001f2970
jmp 0x1f454b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp eax, esi
jne 0x1f4494
call fcn.001f2970
jmp 0x1f454b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea eax, [ebx + 1]
mov dword [ebp - 0x14], ebx
cmp eax, ebx
jae 0x1f44b2
mov esi, 0x8007000e
jmp 0x1f454d
xor ecx, ecx
shld ecx, eax, 1
add eax, eax
mov byte [ebp - 4], 2
cmp ecx, esi
ja 0x1f44c7
cmp eax, 0xffffffff
jbe 0x1f44d1
push 0x80070216
call fcn.001f4db0
cmp eax, 0x400
jbe 0x1f44fa
lea ecx, [ebp]
push ecx
call fcn.001f3110
jmp 0x1f4500
lea edx, [ebp + 4]
mov dword [ebp], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp]
cmp eax, esi
jne 0x1f4515
mov esi, 0x8007000e
jmp 0x1f454d
push ebx
push eax
mov eax, dword [ebp - 0x18]
push ebx
push eax
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
jne 0x1f4530
call fcn.001f2970
jmp 0x1f454b
mov edx, dword [ebp]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x418]
mov ecx, dword [ebp]
push eax
lea esi, [ebp - 0x24]
call fcn.001f4250
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x1f4564
lea eax, [ebp]
call fcn.001f30f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.00338a41
lea esp, [ebp + 0x408]
pop ebp
ret 0xc
Function at 0x1f6000
Capabilities:
Get common file path

Disassembly:
cmp dword [0x42d554], 0
jne 0x1f60b8
cmp byte [0x42d450], 0
jne 0x1f608d
push 0x42d450
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 0x104
jb 0x1f6056
push 0x104
push 0x42d450
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push 0x42d450
call fcn.0033a2d0
add esp, 8
test eax, eax
je 0x1f6056
mov byte [eax + 1], 0
mov eax, 0x42d450
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1f6060
mov ecx, dword [str._debug.log]
mov edx, dword [0x3c8ac8]
mov dword [eax], ecx
mov cx, word [0x3c8acc]
mov dword [eax + 4], edx
mov dl, byte [0x3c8ace]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
push 0x3c8ad0
push 0x42d450
call fcn.0033a19e
add esp, 8
mov dword [0x42d554], eax
test eax, eax
jne 0x1f60ab
xor al, al
ret
push 2
push 0
push eax
call fcn.0033a67f
add esp, 0xc
mov al, 1
ret