joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408ec0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bbcb8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x633ef8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
push str.SoftwareBrowserSaferMngr
push SysReAllocStringLen
mov dword [ebp - 0x1d], 0x67615065
mov word [ebp - 0x20], 0x6f48
mov dword [ebp - 0x18], 0x6c7255
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x1e], 0x6d
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x408f67
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
inc eax
push eax
call fcn.004544f0
mov ecx, dword [ebp + 8]
mov esi, eax
push dword [ecx - 0xc]
push ecx
push esi
call fcn.0058f010
push dword [ebp + 8]
call fcn.0059e3a0
add esp, 0x14
push eax
push esi
push 1
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408f89
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005892bc
mov esp, ebp
pop ebp
ret

Function at 0x4154b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bce7a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x633ef8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.0058a9e4
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x415570
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.0059051d
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x62e69c
push eax
call fcn.005906af
push edi
push esi
call fcn.0058b09f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005892bc
mov esp, ebp
pop ebp
ret 4
Function at 0x415ee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x415ef5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x415f36
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x415f32
nop word [eax + eax]
cmp esi, edx
jae 0x415f36
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x415f20
cmp esi, edx
jb 0x415f3b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x4174e0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x633ef8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push eax
call esi
push 0
push ebx
mov dword [ebp - 0x10], eax
call esi
mov ecx, dword [ebp - 0x10]
mov ebx, eax
mov eax, dword [sym.imp.USER32.dll_AttachThreadInput]
cmp edi, ecx
je 0x417532
push 1
push ecx
push edi
call eax
mov eax, dword [sym.imp.USER32.dll_AttachThreadInput]
cmp ebx, edi
je 0x41753c
push 1
push edi
push ebx
call eax
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea eax, [ebp - 8]
push 0
push eax
push 0
push 0x2000
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call esi
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0x2001
call esi
push 2
call dword [sym.imp.USER32.dll_LockSetForegroundWindow]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2001
call esi
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
cmp edi, eax
je 0x4175a9
push 0
push eax
push edi
call esi
cmp ebx, edi
je 0x4175b3
push 0
push edi
push ebx
call esi
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005892bc
mov esp, ebp
pop ebp
ret
Function at 0x4177d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bcfbf
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x633ef8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
mov dword [ebp - 0x58], 0x64107c
mov dword [0x64107c], 0
mov byte [0x641080], 0
mov dword [0x641084], 0
mov dword [0x641088], 0
mov dword [0x64108c], 0
mov dword [0x641090], 0
mov dword [0x641094], 0
call fcn.004544b9
add esp, 4
test eax, eax
jne 0x417855
call fcn.00598601
mov dword [0x641084], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [0x641084]
mov dword [eax], 0x641084
mov dword [ebp - 4], 0
mov dword [ebp - 0x54], 0x641098
mov dword [0x641098], 0
push 0
push 0
push 0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x641098], eax
test eax, eax
jne 0x4178a8
call fcn.0041a4c0
mov dword [0x64109c], 0x641098
mov byte [0x6410a0], 0
mov byte [ebp - 4], 3
call fcn.004555ae
mov ecx, eax
test ecx, ecx
jne 0x4178d2
push 0x80004005
call fcn.00416970
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [0x6410a4], eax
mov byte [ebp - 4], 4
mov word [0x6410a8], 0
call fcn.004555ae
mov ecx, eax
test ecx, ecx
jne 0x417901
push 0x80004005
call fcn.00416970
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [0x6410ac], eax
mov byte [ebp - 4], 5
lea eax, [ebp - 0x2c]
push eax
mov dword [0x6410b0], 0
mov dword [0x6410b4], 0
mov dword [ebp - 0x1e], 0x61537265
mov dword [ebp - 0x29], 0x72617774
mov word [ebp - 0x19], 0x7265
mov dword [ebp - 0x23], 0x776f7242
mov word [ebp - 0x2b], 0x666f
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x1f], 0x73
mov word [ebp - 0x25], 0x5c65
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x2c], 0x53
call fcn.0059e3a0
add esp, 4
mov ecx, 0x6410a4
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00416780
push 0x60be20
call fcn.0059e3a0
add esp, 4
mov ecx, 0x6410ac
push eax
push 0x60be20
call fcn.00416780
lea eax, [ebp - 0x50]
mov dword [ebp - 0x4b], 0x642e7465
push eax
mov word [ebp - 0x50], 0x6957
mov word [ebp - 0x46], 0x6c
mov word [ebp - 0x4d], 0x6e69
mov byte [ebp - 0x4e], 0x6e
mov byte [ebp - 0x47], 0x6c
mov dword [ebp - 0x34], 0x656c6946
mov word [ebp - 0x37], 0x6165
mov word [ebp - 0x3a], 0x7465
mov dword [ebp - 0x3f], 0x7265746e
mov byte [ebp - 0x30], 0
mov byte [ebp - 0x38], 0x52
mov byte [ebp - 0x35], 0x64
mov byte [ebp - 0x40], 0x49
mov byte [ebp - 0x3b], 0x6e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x6410b0], eax
test eax, eax
je 0x417a07
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6410b4], eax
mov eax, 0x64107c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005892bc
mov esp, ebp
pop ebp
ret 4
Function at 0x417cb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x633ef8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x64107c], 0
jne 0x417cef
lea eax, [ebp - 8]
push eax
push 0
push 0x64107c
push 0x417b60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x64107c], eax
mov byte [0x6410a8], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005892bc
mov esp, ebp
pop ebp
ret
Function at 0x418250
Capabilities:
Contain obfuscated stackstrings
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x633ef8]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push esi
lea eax, [esp + 8]
mov word [esp + 0x13], 0x4274
push eax
push ecx
mov esi, ecx
mov word [esp + 0x1e], 0x7461
mov dword [esp + 0x15], 0x65486563
mov word [esp + 0x10], 0x6553
mov word [esp + 0x13], 0x6976
mov byte [esp + 0x12], 0x72
mov byte [esp + 0x20], 0
mov word [esp + 0x19], 0x7261
mov byte [esp + 0x1d], 0x65
call fcn.00417d40
cmp eax, 1
sete bl
test bl, bl
je 0x4182cf
push str.SoftwareBSTab
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ecx
mov ecx, esi
call fcn.004176f0
mov ecx, dword [esp + 0x1c]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.005892bc
mov esp, ebp
pop ebp
ret

Function at 0x418840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bd172
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x633ef8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x224], esi
mov dword [esi], 0
call fcn.004555ae
mov ecx, eax
test ecx, ecx
jne 0x4188a1
push 0x80004005
call fcn.00416970
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x200
lea eax, [ebp - 0x210]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x220], 1
call fcn.0058f590
add esp, 0xc
mov dword [ebp - 0x214], 0x200
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4189a6
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.MachineGuid
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41897c
lea eax, [ebp - 0x21c]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4189a6
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.MachineGuid
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4189a6
lea eax, [ebp - 0x210]
push eax
call fcn.005a2e81
add esp, 4
mov ecx, esi
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00419f00
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005892bc
mov esp, ebp
pop ebp
ret 4
Function at 0x418a70
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bd1c2
mov eax, dword fs:[0]
push eax
sub esp, 0xc94
mov eax, dword [0x633ef8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0xc9c], 0
mov dword [ebp - 0xca0], edi
mov dword [edi], 0
call fcn.004555ae
mov ecx, eax
test ecx, ecx
jne 0x418ad3
push 0x80004005
call fcn.00416970
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
mov eax, 0x43
mov word [ebp - 0x54], ax
mov edx, 0x72
mov eax, 0x52
mov dword [ebp - 0xc9c], 1
mov word [ebp - 0x84], ax
mov ebx, 0x6f
mov eax, 0x4d
mov dword [ebp - 0x52], 0x720075
mov word [ebp - 0x7e], ax
mov eax, 0x65
push 0x800
mov word [ebp - 0x44], ax
lea eax, [ebp - 0xc90]
push 0
push eax
mov dword [ebp - 0x6a], 0x690057
mov dword [ebp - 0x7c], 0x630069
mov dword [ebp - 0x88], 0x410057
mov dword [ebp - 0x82], 0x5c0045
mov dword [ebp - 0x90], 0x4f0053
mov dword [ebp - 0x76], 0x73006f
mov dword [ebp - 0x72], 0x66006f
mov dword [ebp - 0x42], 0x730072
mov dword [ebp - 0x8c], 0x540046
mov dword [ebp - 0x5c], 0x4e0020
mov dword [ebp - 0x4c], 0x6e0065
mov dword [ebp - 0x3e], 0x6f0069
mov dword [ebp - 0x6e], 0x5c0074
mov dword [ebp - 0x58], 0x5c0054
mov dword [ebp - 0x48], 0x560074
mov dword [ebp - 0x60], 0x730077
mov dword [ebp - 0x66], 0x64006e
mov word [ebp - 0x4e], dx
mov word [ebp - 0x78], dx
mov dword [ebp - 0x3a], 0x6e
mov word [ebp - 0x62], bx
mov dword [ebp - 0x22], 0x64006f
mov dword [ebp - 0x1e], 0x630075
mov dword [ebp - 0x28], 0x50006c
mov dword [ebp - 0x2c], 0x610074
mov dword [ebp - 0x1a], 0x490074
mov dword [ebp - 0x30], 0x690067
mov dword [ebp - 0x16], 0x64
mov dword [ebp - 0x34], 0x690044
mov word [ebp - 0x24], dx
call fcn.0058f590
add esp, 0xc
mov dword [ebp - 0xc94], 0x800
lea eax, [ebp - 0xc98]
push eax
push 0x101
push 0
lea eax, [ebp - 0x90]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418ce7
lea eax, [ebp - 0xc94]
push eax
lea eax, [ebp - 0xc90]
push eax
push 0
push 0
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0xc98]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x418cdb
push 0x400
push eax
lea eax, [ebp - 0x490]
push eax
call fcn.0058f590
add esp, 0xc
lea eax, [ebp - 0x490]
push dword [ebp - 0xc94]
push eax
lea eax, [ebp - 0xc90]
push eax
call fcn.00418a10
lea eax, [ebp - 0x490]
push eax
call fcn.0059e3a0
add esp, 4
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x418cb2
xor eax, eax
jmp 0x418ccc
lea eax, [esi + esi]
call fcn.0058a270
mov eax, esp
lea ecx, [ebp - 0x490]
push 3
push esi
push ecx
push eax
call fcn.0041a2a0
push eax
push 0x60be54
push edi
call fcn.0041a140
add esp, 0xc
push dword [ebp - 0xc98]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
lea esp, [ebp - 0xcb0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005892bc
mov esp, ebp
pop ebp
ret 4
Function at 0x418d10
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bd212
mov eax, dword fs:[0]
push eax
sub esp, 0x638
mov eax, dword [0x633ef8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x640], 0
mov dword [ebp - 0x644], esi
mov dword [esi], 0
call fcn.004555ae
mov ecx, eax
test ecx, ecx
jne 0x418d71
push 0x80004005
call fcn.00416970
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x20a
lea eax, [ebp - 0x630]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x640], 1
call fcn.0058f590
push 0x20a
lea eax, [ebp - 0x424]
push 0
push eax
call fcn.0058f590
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x634], 0
push 0
push eax
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x638], 0
call fcn.0058f590
add esp, 0x24
lea eax, [ebp - 0x218]
push 0
push 0x25
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov word [ebp - 0x212], ax
lea eax, [ebp - 0x424]
push 0x105
push eax
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x634]
push eax
push 0x105
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x418e54
push dword [ebp - 0x634]
push 0x60bf38
push esi
call fcn.0041a140
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005892bc
mov esp, ebp
pop ebp
ret 4
Function at 0x424280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bd6d8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x633ef8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1c]
push 0x6097b3
mov dword [ebp - 0x1c], 0
call fcn.004160f0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0x4c7a6f6d
mov dword [ebp - 0x14], 0x30347a
mov esi, dword [eax - 0xc]
lea eax, [esi + 1]
push eax
call fcn.004544f0
mov edi, eax
mov byte [edi + esi], 0
push dword [ebp + 8]
push 0x609340
push edi
call fcn.0042d870
mov ecx, esi
call fcn.00436170
xor edx, edx
mov ecx, 0xc
add ecx, eax
setb dl
neg edx
or edx, ecx
push edx
call fcn.0059d17c
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x424339
test edi, edi
je 0x4243ef
push edi
call fcn.004544f9
add esp, 4
xor bl, bl
jmp 0x42442c
push 8
lea eax, [ebp - 0x18]
push eax
push ebx
call fcn.0058f010
add esp, 0xc
mov edx, 8
xor ecx, ecx
nop
mov eax, esi
shr eax, cl
add ecx, 8
mov byte [edx + ebx], al
inc edx
cmp edx, 0xc
jb 0x424350
push esi
add edx, ebx
mov ecx, edi
call fcn.00436630
add esp, 4
test eax, eax
jne 0x42438e
push ebx
call fcn.004544f9
add esp, 4
test edi, edi
je 0x4243ef
push edi
call fcn.004544f9
add esp, 4
xor bl, bl
jmp 0x42442c
add eax, 0xc
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax - 0xc]
lea eax, [esi + 1]
push eax
call fcn.004544f0
mov byte [eax + esi], 0
mov esi, eax
push dword [ebp + 0xc]
push 0x609340
push esi
call fcn.0042d870
push 0x60cf04
push esi
call fcn.0059dd61
add esp, 0x18
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x4243f3
push ebx
call fcn.004544f9
add esp, 4
test edi, edi
je 0x4243e2
push edi
call fcn.004544f9
add esp, 4
test esi, esi
je 0x4243ef
push esi
call fcn.004544f9
add esp, 4
xor bl, bl
jmp 0x42442c
push eax
push dword [ebp - 0x24]
push 1
push ebx
call fcn.0059e2d4
push dword [ebp - 0x20]
call fcn.0059de35
push ebx
call fcn.004544f9
add esp, 0x18
test edi, edi
je 0x42441d
push edi
call fcn.004544f9
add esp, 4
test esi, esi
je 0x42442a
push esi
call fcn.004544f9
add esp, 4
mov bl, 1
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp - 0x1c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42444d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42446b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x42448a
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005892bc
mov esp, ebp
pop ebp
ret 8
Function at 0x425410
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bd818
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x633ef8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
mov dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42546b
xor bl, bl
jmp 0x4254ec
push 0
push ebx
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
jns 0x42548b
push 0x80070057
call fcn.00416970
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or eax, ecx
jge 0x4254a6
push edi
mov ecx, esi
call fcn.004165b0
push 0
lea eax, [ebp - 0x14]
push eax
push edi
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esi]
mov edi, eax
test ecx, ecx
je 0x4254d0
push dword [ecx - 8]
push ecx
call fcn.0059ea3d
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x425481
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x425481
mov dword [eax - 0xc], ecx
mov eax, dword [esi]
push ebx
mov byte [ecx + eax], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
setne bl
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42550e
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005892bc
mov esp, ebp
pop ebp
ret 8

Function at 0x426a00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bd9a8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x633ef8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
lea eax, [edi + 0x924]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x426a93
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
inc eax
push eax
call fcn.004544f0
mov ecx, dword [ebp + 8]
mov esi, eax
push dword [ecx - 0xc]
push ecx
push esi
call fcn.0058f010
push dword [ebp + 8]
call fcn.0059e3a0
add esp, 0x14
push eax
push esi
push 1
push 0
lea eax, [edi + 0x93f]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x426ab5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005892bc
mov esp, ebp
pop ebp
ret 4