joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021d20
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1002cce4
call fcn.1002a133
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10021e65
cmp dword [ebp - 0x18], 1
jne 0x10021e65
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
inc eax
mov dword [ebp - 4], ebx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100126a0
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
test esi, esi
je 0x10021e65
push dword [ebp - 0x14]
push ebx
push esi
call fcn.100126a0
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax*2 - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10021e5a
cmp dword [ebp - 0x18], 1
jne 0x10021e5a
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x14], eax
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100126a0
mov dword [edi], eax
pop ecx
test eax, eax
je 0x10021e5a
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.100126a0
lea eax, [ebp - 0x20]
push eax
push 0x10032338
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x10021e3e
push ebx
call fcn.100126a0
pop ecx
test al, al
je 0x10021e3e
mov eax, dword [ebp - 0x14]
push ebx
inc eax
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x10021e5a
push dword [edi]
call fcn.1002a647
and dword [edi], 0
pop ecx
jmp 0x10021e5a
test esi, esi
je 0x10021e65
push esi
call fcn.1002a647
pop ecx
call fcn.1002a091
ret

Function at 0x100225b9
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x10032094
xor esi, esi
call fcn.100126a0
pop ecx
test eax, eax
jne 0x100225da
push 0x100320ac
call fcn.100126a0
pop ecx
test eax, eax
je 0x100225dd
xor esi, esi
inc esi
cmp byte [0x1003cde0], 0
je 0x1002260c
push edi
push esi
push str._BrowserIntegrationWin__IsLoadedInProcByAcrobat__d
mov edi, 0x1003d628
push edi
call fcn.100126a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x1002260b
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
mov eax, esi
pop esi
ret
Function at 0x100246d8
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002473d
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002473d
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x1003cde0], 0
je 0x10024738
movzx eax, bl
mov esi, 0x1003e190
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.100126a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10024738
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x1003cde0], 0
je 0x10024768
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x1003e190
push esi
call fcn.100126a0
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10024768
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, 1
pop esi
ret
Function at 0x10025de4
Capabilities:
Print debug messages

Disassembly:
push 0xac4
mov eax, 0x1002ce82
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov ebx, 0x1003e190
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xad0], eax
je 0x10025e33
push str._ACTWinBrowser__SendAcroIPCMessage
push ebx
call fcn.100126a0
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10025e33
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xac8]
call fcn.10025dc7
mov eax, dword [ebp - 0xacc]
lea edi, [ebp - 0xac8]
test eax, eax
cmovne edi, eax
test esi, esi
je 0x1002602b
cmp dword [esi + 0x400], ebx
jne 0x10025e8a
push ebx
push ebx
push ebx
push ebx
call fcn.10022610
add esp, 0x10
test eax, eax
je 0x1002602b
push dword [esi + 0x400]
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.AcroSBL
push str._s__lu__lu
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.100126a0
add esp, 0x18
test eax, eax
jle 0x1002602b
lea ecx, [ebp - 0x6bc]
call fcn.10025da7
push dword [ebp + 0x14]
lea eax, [ebp - 0x6bc]
push dword [ebp - 0xad0]
push 1
push 1
push dword [ebp + 0xc]
push eax
call fcn.100126a0
add esp, 0x18
test eax, eax
jne 0x10026002
push ebx
lea eax, [ebp - 0x218]
push eax
push 1
lea ecx, [ebp - 0x2ac]
call fcn.10029305
push dword [esi + 0x400]
lea eax, [ebp - 0x6bc]
mov dword [ebp - 4], ebx
push 0x1388
push edi
push eax
lea ecx, [ebp - 0x2ac]
call fcn.1002952a
test eax, eax
jne 0x10025f6a
cmp dword [edi + 4], eax
sete bl
cmp byte [0x1003cde0], al
je 0x10025ff5
push dword [edi + 4]
mov esi, 0x1003e190
push str._ACTWinBrowser__SendAcroIPCMessage_IPC_call_success_status___lu
push esi
call fcn.100126a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10025ff5
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x10025ff5
cmp byte [0x1003cde0], 0
mov esi, 0x1003e190
je 0x10025f95
push str.IPC_Error:_AIPC_ERR
push esi
call fcn.100126a0
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10025f95
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
push ebx
lea ecx, [ebp - 0xacc]
mov dword [ebp - 0xacc], ebx
push ecx
push 0x400
push eax
push ebx
push 0x1300
call dword [sym.imp.kernel32.dll_FormatMessageA]
cmp byte [0x1003cde0], 0
je 0x10025fe9
push dword [ebp - 0xacc]
push str._ACTWinBrowser__IPC_Error_:__s
push esi
call fcn.100126a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10025fe9
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push dword [ebp - 0xacc]
call dword [sym.imp.kernel32.dll_LocalFree]
lea ecx, [ebp - 0x2ac]
call fcn.100126a0
jmp 0x1002602b
cmp byte [0x1003cde0], bl
je 0x1002602b
push str.IPC_CreateMessage_Error:_CreateMessage_failed
mov esi, 0x1003e190
push esi
call fcn.100126a0
pop ecx
pop ecx
cmp byte [0x1003cde0], bl
je 0x1002602b
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, bl
call fcn.1002a0a6
ret
Function at 0x100277eb
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10027808
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278ec
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e5e0
push edi
call fcn.100126a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_Uns32____d
push edi
call fcn.100126a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.100126a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_Handle32____d
push edi
call fcn.100126a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_void____d
push edi
call fcn.100126a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
mov eax, esi
pop esi
ret

Function at 0x1002795e
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002cf70
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov edi, dword [ebp + 8]
je 0x1002799d
lea eax, [edi + 4]
mov esi, 0x1003e5e0
push eax
push str.ASM_Release__s
push esi
call fcn.100126a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x1002799d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
lea eax, [edi + 4]
push eax
lea ecx, [ebp - 0x28]
call fcn.10001b12
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000276d
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x100279d3
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.100126a0
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002a0a6
ret
Function at 0x100279e9
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002cf9d
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
je 0x10027a48
call fcn.100126a0
test al, al
mov edx, 0x1002ea51
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e5e0
call fcn.100126a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10027a48
push 0x1003e5e0
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.10001b12
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000276d
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.100126a0
test ebx, ebx
jne 0x10027aae
cmp byte [0x1003cde0], bl
je 0x10027b0f
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e5e0
push ebx
call fcn.100126a0
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10027b0f
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x10027b0f
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x10027ad5
cmp byte [0x1003cde0], al
je 0x10027b0f
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x10027a8f
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10027aff
cmp byte [0x1003cde0], al
je 0x10027b0f
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x10027a8f
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002a0a6
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x40915c
nop
mov ecx, 0xb022364
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x28386d7e
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40b9c1
Capabilities:
Print debug messages
Set environment variable

Disassembly:
push esi
push 0xff78
push 0x40
mov esi, ecx
call dword [0x41604c]
mov edx, dword [esi]
mov ecx, eax
call fcn.0040f304
mov edx, dword [0x41640c]
mov ecx, eax
call fcn.0040f304
mov edx, dword [0x41640c]
mov ecx, eax
call fcn.0040f304
mov edx, dword [0x41640c]
mov ecx, eax
pop esi
jmp fcn.0040f304
Function at 0x40e3a5
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
push edi
push str.ev_1m228l64
xor edi, edi
xor ebx, ebx
push edi
inc ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_k1gdvv97
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov edi, dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
test eax, eax
je 0x40e3f6
push eax
call edi
jmp 0x40e402
push str.x48k8mjz
push str.4irsxox8
call esi
xor eax, eax
push eax
push 0xbb5
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.regck6he3vc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.MTXl7u2y9fz
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40e460
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.fyat6rje
push str.puh5dcqg
call esi
jmp 0x40e466
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.WTMR_1wsefplx
push ebx
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push str.XMLpw6jtuwg
push ebx
push esi
push esi
call edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
push eax
call esi
push str.z0wa579n
push str.2yd513hc
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x150]
push eax
push str.s_1t0ftywa
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.SMPHR_ounzwve5
push ebx
push 0
push 0
call edi
xor edi, edi
push edi
push ebx
push eax
call esi
test eax, eax
je 0x40e4db
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40e4eb
push str.9vnw7620
push str.o991zomq
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 8]
mov dword [ebp - 4], edi
push eax
push 8
call dword [0x416048]
push eax
call dword [0x416128]
test eax, eax
je 0x40e57b
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push ebx
push dword [ebp - 8]
call dword [0x416030]
test eax, eax
jne 0x40e526
call dword [0x4160b8]
cmp eax, 0x7a
jne 0x40e57b
push dword [ebp - 4]
push 0x40
call dword [0x416098]
mov esi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push ebx
push dword [ebp - 8]
call dword [0x416030]
test eax, eax
je 0x40e57b
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
push dword [esi]
call dword [0x41605c]
test eax, eax
je 0x40e57b
push dword [ebp - 0xc]
push dword [0x41656c]
call dword [0x41611c]
test eax, eax
push esi
cmovne ebx, edi
call dword [0x4160e0]
mov eax, ebx
jmp 0x40e57d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e582
Capabilities:
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a0
push esi
push edi
lea eax, [ebp - 0x150]
mov dword [ebp - 4], ecx
push eax
push str.s_k8k6yj0k
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.WTMR_cobeuz6r
push 1
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x20019
push edi
push str.regcisaldul
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.MTXcefihq1y
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40e605
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.log:_am5o3ztm
call edi
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40e622
push str.9yly4xhi
push str.ajhvbjh1
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.log:_3qvj7joc
call edi
xor esi, esi
push esi
push 0xbb3
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ev_bcg4e2an
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.WTMR_cz4y4z6b
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40e679
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x40e680
push str.log:_lh5j9u08
call edi
push str.XML5wjw6qdh
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.log:_x4b22i93
call edi
lea eax, [ebp - 0xc]
push eax
push 0x20019
push esi
push str.regii7r62pg
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x3a0]
push eax
push dword [ebp - 4]
call dword [0x416020]
xor ecx, ecx
cmp eax, 0xffffffff
pop edi
setne cl
mov eax, ecx
pop esi
leave
ret
Function at 0x40ef52
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x8f2
xor esi, esi
mov dword [ebp - 8], edx
push esi
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push 0xe75
push esi
push 4
pop ebx
push ebx
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.MTX6mpfr2rs
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, eax
test esi, esi
je 0x40efd9
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push str.reglzy0cdhc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.log:_bhdxad6q
call edi
push str.log:_nhypzvci
call edi
push str.ev_7kpt1hjo
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_c8qrnxnq
push 1
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.XMLmuedx2t0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.WTMR_3fn1bhcx
push 1
push 0
call esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x40f05a
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.log:_sjbtjmjy
call edi
push str.log:_hbg248lo
call edi
sub ebx, 1
jne 0x40f05a
mov ebx, dword [ebp - 4]
push ebx
call dword [0x416090]
lea eax, [eax*2 + 0x80]
push eax
push 0x40
call dword [0x41604c]
mov ecx, dword [ebp + 8]
mov esi, eax
mov edi, dword [ebp + 0xc]
cmp ecx, edi
jge 0x40f09d
mov edx, esi
mov ax, word [ebx + ecx*2]
inc ecx
mov word [edx], ax
lea edx, [edx + 2]
cmp ecx, edi
jl 0x40f08e
xor eax, eax
mov word [esi + edi*2 + 2], ax
mov edi, dword [ebp - 8]
push esi
push dword [edi]
call dword [0x416144]
mov dword [edi], eax
test esi, esi
je 0x40f0bd
push esi
call dword [0x4160cc]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x40f12e
Capabilities:
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
push ebx
push esi
mov eax, ecx
push edi
push eax
mov dword [ebp - 4], eax
call dword [0x41619c]
push str.WTMR_p2efvo6v
push 1
xor edi, edi
mov dword [ebp - 8], eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov ebx, dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
test eax, eax
je 0x40f16d
push eax
call ebx
push str.log:_mpmw84tj
jmp 0x40f172
push str.log:_x146dw3i
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 4
pop esi
push str.trqmydsa
push str.adt4bdjm
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
sub esi, 1
jne 0x40f17b
push str.ev_dds5hijn
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x150]
push eax
push str.s_cd6bwxsa
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.SMPHR_j7al8mlp
push 1
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x40f1f2
call edi
mov esi, dword [ebp - 8]
lea eax, [esi*2 + 0x10]
push eax
push 0x40
call dword [0x41604c]
push esi
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0
push 0xfde9
call dword [0x4160b0]
lea eax, [ebp - 0x290]
push eax
push str.s_y7vc86t2
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_hwfyfx4c
push 1
push 0
call esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.regux7scgo6
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x40f26e
push eax
call ebx
push 7
pop edi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.regvklq2s9g
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub edi, 1
jne 0x40f271
push str.WTMR_a9zrwjbj
push 1
push edi
call esi
push eax
call ebx
push str.MTXpz1u1j1i
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40f2be
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call edi
push str.ev_2ouo88lk
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push 0xf3f
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
call edi
mov eax, dword [ebp - 0xc]
xor edx, edx
mov ecx, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov word [eax + ecx*2], dx
leave
ret