joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb8e762
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xbcbd1fbd
xor ebx, eax
inc dword [esp]
and al, 0
not dword [esp]
jl 0xc0cd41
pop eax
pop esp
mov dword [edx], edx
wait
add byte [ebp - 0x5ecb50d2], dh
cmp al, byte [ebx - 0x3ca13ae8]
add esi, ebp
xor al, 0x13
in eax, 0x1b
cdq
lds ecx, [eax + 0x75]
aas
push edx
mov ebx, 0xd7afaa5d
jbe 0xb8e76e
ret
add al, 0xc5
xchg byte [ebp*2 - 0x4a7243cf], cl
or dword [ebp - 0x28], edx
int1
wait
inc esi
add cl, al
cmpsd dword [esi], dword es:[edi]
mov al, byte [0x553f9cb8]
rol dword [eax - 0x30c7c3e5], 0xe8
pushal
pop ds
popfd
sbb eax, 0xf9fc461e
cmc
je 0xb8e78a
lcall 0x84c4, 0xa3e23c80
add dword [edi + 0x63], 4
hlt
and ebx, 0xff
not byte [esp + 2]
ror byte [esp], 0x45
mov ebx, dword [ebx*4 + 0xbe5780]
shr eax, 8
shl dword [esp], 0x7d
xor eax, ebx
jmp 0xbb19b2

Function at 0xc268ed
Capabilities:
Encode data using xor

Disassembly:
call fcn.0138b3f1
mov dword [edi - 0x1c485156], esi
xchg byte [edx - 0x21050c29], dl
mul dword [ebx + 0x7287c6d2]
cmp dl, byte [eax - 0x64]
mov fs, word [esi - 0x5c]
aad 0xd8
je 0xc268db
outsb dx, byte [esi]
sbb cl, bl
jge 0xc26989
adc dword [ebp + ebp*8 - 0x44], edi
enter 0xffffffffffffc0d2, 0x11
sbb al, 0xa1
and al, 0xe7
ljmp 0xf11b
movsb byte es:[edi], byte [esi]
inc edx
push es
aad 0xe5
sub eax, 0x56f4ecf5
push ds
push esi
mov dl, 0x71
jl 0xc2696d
cmc
in al, dx
hlt
std
sub dword [ebp - 0x5c5885a], eax
dec esi
rcl dword [eax + 1], 0xa3
dec ebx
mov dl, 0xfa
mov eax, dword [esi - 0x6abb96e3]
xchg ebp, eax
cwde
adc al, al
or dword [ecx + esi*2], edi
dec ecx
sti
cmp al, 0x6d
lds esi, [esi]
xchg ebx, eax
jns 0xc2696b
mov al, byte [0xfe99332f]
bound esp, qword [eax + 0x6bf7fa39]
push esi
das
xor ebx, dword [ecx + 0x39a062fe]
cli
imul dword [ebx + 0x56]
je 0xc2699a
and eax, 0xab532b3
jle 0xc269e7
jg 0xc26965
pop edi
and esi, dword cs:[ebx - 0x3d5ba5f6]
push edi
xchg edx, eax
invalid
pop edi
mov dh, byte [esi - 0x3e]
pop ds
inc ecx
mov edx, 0x69ad70c0
mov ecx, 0xf5b9af48
inc edx
or edi, dword [ecx + 0x1ceba5a1]
inc eax
fistp word [esi + 0x22731444]
in al, dx
mov ebp, 0xfb72035a
mov dl, 2
pop esi
push esp
xchg ebp, ebp
mov ecx, 0xff1181e3
imul edx, edi, 0xffffffc7
adc dword [eax + 0x6b], eax
jbe 0xc26a73
imul byte [edx]
cdq
imul ebp, esi, 0xaa398534
pop eax
int1
jnp 0xc26a25
cmp dword [edx - 0x5840ea8], ebp
adc byte [ecx - 0x716241c3], dh
aam 0x63
sub ah, ah
mov al, 0xcc
lcall 0x5500, 0xcb86257c
and esi, dword [edi - 0x71]
rol byte [edx + edx*2], 1
pop edi
mov ebx, 0x9849431a
int 0x88
xlatb
mov ch, 0x3e
push edi
add edi, esp
das
notrack call 0x3c885b
pop ds
test al, 0x76
retf
int3
Function at 0x4020b0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x808
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x4020ca
pop esi
add esp, 0x808
ret 0xc
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x40211f
mov ecx, dword [esp + 0x814]
push 0
push 0
lea eax, [esp + 0x14]
push 0x800
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x818]
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 0x814]
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x402149
mov edx, dword [esp + 0x818]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x818]
push 0
push 0
push 0
push edx
mov edx, dword [esp + 0x824]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x402159
xor eax, eax
pop esi
add esp, 0x808
ret 0xc
mov eax, 1
pop esi
add esp, 0x808
ret 0xc

Function at 0x402170
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x808
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x40218a
pop esi
add esp, 0x808
ret 0xc
mov ecx, 4
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x4021e5
mov ecx, dword [esp + 0x810]
push 0
push 0
lea eax, [esp + 0x14]
push 0x800
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x814]
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
push eax
mov eax, dword [esi + 4]
push ecx
lea edx, [esp + 0x18]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x402208
mov edx, dword [esp + 0x814]
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 8]
push edx
mov edx, dword [esp + 0x818]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x818]
neg eax
sbb eax, eax
inc eax
test ecx, ecx
je 0x40221d
mov edx, dword [esi + 8]
mov dword [ecx], edx
pop esi
add esp, 0x808
ret 0xc
Function at 0x402230
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x804
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x4022a7
mov ebx, dword [esp + 0x818]
mov eax, dword [ebx]
test eax, eax
je 0x4022a7
push eax
mov dword [esp + 0x10], 3
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
mov eax, dword [esi + 0x10]
add esp, 4
test eax, eax
je 0x4022b5
mov ecx, dword [esp + 0x814]
push 0
push 0
lea eax, [esp + 0x18]
push 0x800
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esi + 4]
push ebx
lea edx, [esp + 0x10]
push edi
push edx
lea eax, [esp + 0x1c]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4022d4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x804
ret 8
mov eax, dword [esp + 0x814]
mov ecx, dword [esi + 4]
push ebx
lea edx, [esp + 0x10]
push edi
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4022a7
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x804
ret 8

Function at 0x402330
Capabilities:
Set registry value

Disassembly:
sub esp, 0x800
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
jne 0x40234a
pop edi
add esp, 0x800
ret 0x10
mov ecx, dword [edi + 0x10]
push esi
test ecx, ecx
je 0x40239f
mov ecx, dword [esp + 0x80c]
push 0
push 0
lea eax, [esp + 0x10]
push 0x800
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [esp + 0x818]
mov eax, dword [esp + 0x810]
mov ecx, dword [esp + 0x814]
push edx
push eax
mov eax, dword [edi + 4]
push ecx
lea edx, [esp + 0x14]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4023c8
mov ecx, dword [esp + 0x818]
mov edx, dword [esp + 0x810]
push ecx
mov ecx, dword [esp + 0x818]
push edx
mov edx, dword [esp + 0x814]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 8], eax
mov eax, esi
pop esi
pop edi
add esp, 0x800
ret 0x10

Function at 0x4024e0
Capabilities:
Delete registry key

Disassembly:
mov eax, dword [ecx + 0x10]
sub esp, 0x800
test eax, eax
push esi
je 0x402525
mov ecx, dword [esp + 0x80c]
push 0
push 0
lea eax, [esp + 0xc]
push 0x800
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x808]
lea edx, [esp + 4]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40253b
mov ecx, dword [esp + 0x80c]
mov edx, dword [esp + 0x808]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, esi
pop esi
add esp, 0x800
ret 8
Function at 0x402570
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
or eax, 0xffffffff
mov edx, ecx
dec ecx
test edx, edx
je 0x4025a7
push ebx
push esi
lea esi, [ecx + 1]
mov ecx, dword [esp + 0xc]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4220b0]
xor eax, edx
inc ecx
dec esi
jne 0x402587
pop esi
pop ebx
not eax
ret

Function at 0x406bb0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
mov esi, dword [esp + 0x18]
push edi
xor edi, edi
push 0
push 0
push edi
push esi
call ebp
lea eax, [esp + 0x1c]
push 0
push eax
lea ecx, [esp + 0x18]
push 3
push ecx
push esi
call ebx
cmp dword [esp + 0x1c], 3
jne 0x406c9d
mov eax, dword [esp + 0x10]
test al, al
jne 0x406c00
test ah, ah
jne 0x406c00
cmp byte [esp + 0x12], 1
je 0x406c09
inc edi
cmp edi, 0x800
jl 0x406bc9
push 0
push 0
push edi
push esi
call ebp
lea edx, [esp + 0x1c]
push 0
push edx
lea eax, [esp + 0x18]
push 5
push eax
push esi
call ebx
cmp dword [esp + 0x1c], 5
jne 0x406c9d
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x11]
mov eax, dword [esp + 0x12]
and ecx, 0xff
shl ecx, 8
and edx, 0xff
and eax, 0xff
add ecx, edx
shl ecx, 8
add ecx, eax
mov eax, dword [esp + 0x13]
mov edx, eax
shl ecx, 8
and edx, 0xff
add ecx, edx
cmp ecx, 0x1ba
jne 0x406c9d
mov cl, ah
and cl, 0xc0
cmp cl, 0x40
jne 0x406c84
push esi
call fcn.00406d50
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov al, ah
and al, 0xf0
cmp al, 0x20
jne 0x406c9d
push esi
call fcn.00406cb0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret

Function at 0x406cb0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
xor ecx, ecx
push esi
xor eax, eax
push edi
mov dword [esp + 0x18], ecx
lea edx, [esp + 8]
mov byte [esp + 0xc], al
mov byte [esp + 0xd], al
mov byte [esp + 0x11], al
mov dword [esp + 8], eax
push eax
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x5c]
push edx
lea eax, [esp + 0x28]
push 0x22
push eax
push ecx
mov byte [esp + 0x22], 1
mov byte [esp + 0x23], 0xba
mov byte [esp + 0x24], 0x21
mov byte [esp + 0x26], 3
mov byte [esp + 0x27], 0x19
mov byte [esp + 0x28], 0x41
mov byte [esp + 0x29], 0x80
mov byte [esp + 0x2a], 0x1b
mov byte [esp + 0x2b], 0x91
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, 3
lea edi, [esp + 0x20]
lea esi, [esp + 0xc]
xor edx, edx
repe cmpsw word [esi], word es:[edi]
jne 0x406d42
mov ecx, 3
lea edi, [esp + 0x29]
lea esi, [esp + 0x15]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
mov eax, 3
je 0x406d47
mov eax, 1
pop edi
pop esi
add esp, 0x4c
ret
Function at 0x406d50
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1004
call fcn.0041ae80
mov eax, dword [esp + 0x1008]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
push esi
push edi
push 0
push 0
push 0
push eax
mov ebp, 1
mov dword [esp + 0x20], 0
call ebx
mov edi, 0xba010000
mov esi, 0xe0010000
mov eax, dword [esp + 0x1018]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x1c]
push 0x914
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x406e66
cmp eax, 0x914
jne 0x406e64
cmp dword [esp + 0x14], edi
jne 0x406e64
cmp dword [esp + 0x22], esi
jne 0x406d8b
mov eax, 0x12
cmp dword [esp + eax + 0x14], 0xb3010000
je 0x406dea
inc eax
cmp eax, 0x914
jl 0x406dd6
jmp 0x406d8b
add eax, 4
xor edx, edx
mov dl, byte [esp + eax + 0x14]
lea ecx, [esp + eax + 0x14]
xor eax, eax
mov al, byte [ecx + 1]
shl edx, 8
add eax, edx
xor edx, edx
mov dl, byte [ecx + 2]
shl eax, 8
add eax, edx
xor edx, edx
mov dl, byte [ecx + 3]
shl eax, 8
add eax, edx
mov ecx, eax
mov edx, eax
shr ecx, 8
and eax, 0xf
and ecx, 0xfff
shr edx, 0x14
cmp eax, 4
jne 0x406e47
cmp edx, 0x1e0
je 0x406e3d
cmp edx, 0x2c0
jne 0x406e64
cmp ecx, 0x1e0
je 0x406e66
jmp 0x406e64
cmp eax, 3
jne 0x406e64
cmp edx, 0x1e0
je 0x406e5c
cmp ecx, 0x2c0
jne 0x406e64
cmp ecx, 0x240
je 0x406e66
xor ebp, ebp
test ebp, ebp
mov edi, 2
je 0x406e7f
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0x1004
ret
mov ebp, dword [esp + 0x1018]
push 0
push 0
push 0
push ebp
call ebx
cmp ebp, 0xffffffff
je 0x406f4c
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x1c]
push 0x800
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x10]
test edx, edx
je 0x406f4c
lea esi, [edx - 4]
xor eax, eax
test esi, esi
jle 0x406e98
mov ecx, dword [esp + eax + 0x14]
cmp ecx, 0xb6010000
je 0x406f1d
cmp ecx, 0xb0010000
je 0x406f1d
cmp ecx, 0xb3010000
jne 0x406eec
mov ecx, edx
sub ecx, eax
cmp ecx, 0xa
jae 0x406f04
jmp 0x406efd
cmp ecx, 0xbf010000
jne 0x406efd
mov ecx, edx
sub ecx, eax
cmp ecx, 8
jae 0x406f2d
inc eax
cmp eax, esi
jl 0x406ec5
jmp 0x406e98
mov edx, dword [esp + eax + 0x1b]
xor eax, eax
and edx, 0xffffff
cmp edx, 0x10000
sete al
test eax, eax
je 0x406f4c
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
add esp, 0x1004
ret
mov cl, byte [esp + eax + 0x18]
lea eax, [esp + eax + 0x14]
cmp cl, 7
mov dl, 0xd4
jne 0x406f59
cmp byte [eax + 5], dl
jne 0x406f59
cmp byte [eax + 6], 0x50
jne 0x406f59
mov edi, 7
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret
cmp cl, 3
jne 0x406f7c
cmp byte [eax + 5], dl
jne 0x406f7c
mov cl, byte [eax + 6]
test cl, cl
jne 0x406f7c
mov edi, 6
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret
Function at 0x4079e0
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x104
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push esi
push eax
lea edx, [esp + 0xc]
push ecx
push edx
call sub.MSVCRT.dll_vsprintf
lea eax, [esp + 0x14]
add esp, 0xc
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10c]
mov ecx, dword [eax + 0x2a8]
test ecx, ecx
je 0x407a5a
add eax, 0x84
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x407a67
lea ecx, [esp + 4]
push 0
push ecx
push 0
push 1
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
add esp, 0x104
ret
lea edx, [esp + 8]
push edx
call sub.MSVCRT.dll_puts
add esp, 4
pop esi
add esp, 0x104
ret
Function at 0x408230
Capabilities:
Create service
Persist via windows service

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00407990
test eax, eax
jne 0x4082f5
push 0xf003f
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x40827b
add ebx, 0x84
push eax
push ebx
push 0x422b2c
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret
lea eax, [esp + 0xc]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 0x422b24
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
push 1
lea edi, [ebx + 0x84]
push 2
push 0x110
add ebx, 0x184
push 0xf01ff
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x4082e9
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
push edi
push 0x422b0c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call edi
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret

Function at 0x408310
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push ebp
push esi
push edi
mov ebp, ecx
call fcn.00407990
test eax, eax
jne 0x40832d
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x1c
ret
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x40835f
add ebp, 0x84
push eax
push ebp
push 0x422b2c
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret
add ebp, 0x84
push 0x10020
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x408396
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push ebp
push 0x422b6c
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret
lea eax, [esp + 0xc]
push ebx
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
test ebx, ebx
pop ebx
je 0x4083cb
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x1c
ret
push 0
push ebp
push 0x422b4c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret
Function at 0x408aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41e358
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 0
lea edi, [esi + 4]
mov dword [esi], 0x41ff78
mov dword [esp + 0xc], esi
mov dword [edi], 1
mov eax, dword [0x41ff4c]
lea ecx, [eax + esi + 0x24]
push ecx
call dword [sym.imp.ole32.dll_CoDisconnectObject]
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
mov dword [esi + 0x24], 0x41fe68
mov dword [esi + 0x28], 0x41fe40
call fcn.0040aa60
neg esi
sbb esi, esi
and esi, edi
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x409460
Capabilities:
Set registry value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esi]
inc eax
push eax
mov eax, dword [esp + 0x14]
push edi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 8

Function at 0x40b0c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
mov dword [0x4256f0], 0
dec eax
je 0x40b105
dec eax
jne 0x40b116
cmp dword [esp + 4], 5
jb 0x40b116
mov dword [0x4256f0], 2
add esp, 0x94
ret
cmp dword [esp + 4], 4
jb 0x40b116
mov dword [0x4256f0], 1
add esp, 0x94
ret

Function at 0x40d8e0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
push 0
push 0
push 0
mov esi, ecx
push edi
mov dword [esp + 0x1c], 0
call fcn.00407150
mov ecx, dword [esi + 0x1a54]
add esp, 0x10
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00407370
mov ecx, dword [esi + 0x1a54]
push eax
call fcn.00407360
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push edi
call ebx
mov ecx, dword [esi + 0x1a54]
call fcn.00407370
cmp dword [esp + 0xc], eax
je 0x40d943
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
lea ecx, [esp + 0xc]
push 0
push ecx
mov ecx, dword [esi + 0x1a48]
call fcn.00407370
mov ecx, dword [esi + 0x1a48]
push eax
call fcn.00407360
push eax
push edi
call ebx
mov ecx, dword [esi + 0x1a48]
call fcn.00407370
cmp dword [esp + 0xc], eax
je 0x40d97f
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
mov ecx, dword [esi + 0x1a4c]
lea edx, [esp + 0xc]
push 0
push edx
call fcn.00407370
mov ecx, dword [esi + 0x1a4c]
push eax
call fcn.00407360
push eax
push edi
call ebx
mov ecx, dword [esi + 0x1a4c]
call fcn.00407370
cmp dword [esp + 0xc], eax
je 0x40d9bb
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
mov ecx, dword [esi + 0x1a50]
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00407370
mov ecx, dword [esi + 0x1a50]
push eax
call fcn.00407360
push eax
push edi
call ebx
mov ecx, dword [esi + 0x1a50]
call fcn.00407370
mov edx, dword [esp + 0xc]
xor ecx, ecx
cmp edx, eax
pop edi
sete cl
pop esi
mov eax, ecx
pop ebx
pop ecx
ret 4
Function at 0x40e0d0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x41e618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
mov eax, dword [esp + 0x30]
push esi
mov esi, dword [esp + 0x38]
push edi
mov edi, dword [esp + 0x40]
sub esi, 0x800
mov ebp, 0
sbb edi, ebp
push ebp
push edi
push esi
push eax
call fcn.00407150
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], ebp
xor bl, bl
call fcn.00401000
push 0x800
push 0x2800
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], ebp
call fcn.00401020
lea ecx, [esp + 0x14]
call fcn.00401110
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x3c]
push ebp
push ecx
push 0x800
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x3c]
cmp eax, ebp
je 0x40e1ef
push eax
lea ecx, [esp + 0x18]
call fcn.00401120
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
mov dword [esp + 0x14], ebp
call fcn.00401140
mov ecx, eax
test ecx, ecx
je 0x40e1b2
mov edx, dword [esp + 0x10]
cmp edx, 4
jle 0x40e1b2
lea ebp, [edx - 4]
xor eax, eax
test ebp, ebp
jle 0x40e1ae
cmp dword [eax + ecx], 0xba010000
je 0x40e1a7
inc eax
cmp eax, ebp
jl 0x40e197
jmp 0x40e1ae
cdq
add esi, eax
mov bl, 1
adc edi, edx
test bl, bl
jne 0x40e1ca
push ebp
lea ecx, [esp + 0x18]
call fcn.004010b0
mov eax, ebp
cdq
add esi, eax
adc edi, edx
xor ebp, ebp
jmp 0x40e137
mov eax, dword [esp + 0x44]
test eax, eax
je 0x40e1d7
mov dword [eax], esi
mov dword [eax + 4], edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.0041d4b0
mov eax, 1
jmp 0x40e202
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.0041d4b0
xor eax, eax
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
Function at 0x40f6e0
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41e6eb
push eax
mov eax, 0x2b98
mov dword fs:[0], esp
call fcn.0041ae80
lea eax, [esp + 0x2a8]
push esi
mov esi, dword [esp + 0x2bac]
lea ecx, [esp + 0x4ac]
push eax
lea edx, [esp + 0xb0]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
push esi
call sub.MSVCRT.dll__wsplitpath
lea ecx, [esp + 0x2c]
push ecx
call sub.MSVCRT.dll__wcslwr
lea edx, [esp + 0x30]
push 0x423ddc
push edx
call sub.MSVCRT.dll_wcscat
mov eax, dword [0x4256f0]
add esp, 0x20
cmp eax, 1
jne 0x40f779
push 0
push 0
lea eax, [esp + 0x18]
push 7
push eax
lea ecx, [esp + 0x28]
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
jmp 0x40f784
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x40f83e
lea ecx, [esp + 0x16ac]
call fcn.0041b350
mov eax, dword [0x4256f0]
mov dword [esp + 0x2ba4], 0
cmp eax, 1
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
jne 0x40f7cb
mov cl, byte [esp + 0x10]
sub cl, 0x61
mov byte [esp + 4], cl
jmp 0x40f7d6
mov dl, byte [esp + 0x18]
sub dl, 0x61
mov byte [esp + 4], dl
mov edx, dword [esp + 4]
lea eax, [esp + 0x28]
lea ecx, [esp + 8]
push eax
push ecx
push edx
lea ecx, [esp + 0x16b8]
call fcn.0041c9a0
test eax, eax
jl 0x40f827
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
and eax, 0xffff
lea edx, [esp + 0x6ac]
push eax
push ecx
push 0x423dc8
push edx
call sub.MSVCRT.dll_swprintf
lea eax, [esp + 0x6bc]
push eax
push esi
call sub.MSVCRT.dll_wcscat
add esp, 0x18
lea ecx, [esp + 0x16ac]
mov dword [esp + 0x2ba4], 0xffffffff
call fcn.0041b500
push 0x5c
push esi
call sub.MSVCRT.dll_wcschr
add esp, 8
test eax, eax
je 0x40f861
push 0x5c
push esi
mov word [eax], 0x2f
call sub.MSVCRT.dll_wcschr
add esp, 8
test eax, eax
jne 0x40f84d
mov ecx, dword [esp + 0x2b9c]
pop esi
mov dword fs:[0], ecx
add esp, 0x2ba4
ret 4
Function at 0x415cc0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x104
lea eax, [esp]
push ebx
push esi
mov esi, dword [esp + 0x110]
push edi
push 0
push 0
push 0x104
push eax
push 0xffffffffffffffff
push esi
push 0
mov ebx, ecx
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [0x4256f0]
xor edi, edi
cmp eax, 1
jne 0x415d06
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
jmp 0x415d0d
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415d67
mov eax, dword [0x4256f0]
push 0
push 0x80
push 3
push 0
cmp eax, 1
push 1
push SysReAllocString
jne 0x415d3a
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x415d41
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x415d56
pop edi
pop esi
or eax, eax
pop ebx
add esp, 0x104
ret 4
push esi
mov ecx, ebx
call fcn.004129a0
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x104
ret 4