joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420004]
jne 0x40100a
repz ret
jmp fcn.00401368

Function at 0x40425b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403568
and dword [ebp - 0x14], 0
cmp dword [0x422940], 0
mov dword [ebp - 0x18], eax
jne 0x40430e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4043b6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4043b6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x422940], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x422944], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x422948], eax
call edi
push eax
call esi
mov dword [0x422950], eax
test eax, eax
je 0x40430e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42294c], eax
mov eax, dword [0x42294c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404367
cmp dword [0x422950], ecx
je 0x404367
push eax
call esi
push dword [0x422950]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404367
test ebx, ebx
je 0x404367
call edi
test eax, eax
je 0x40435e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40435e
test byte [ebp - 8], 1
jne 0x404367
or dword [ebp + 0x10], 0x200000
jmp 0x40439a
mov eax, dword [0x422944]
cmp eax, dword [ebp - 0x18]
je 0x40439a
push eax
call esi
test eax, eax
je 0x40439a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40439a
mov eax, dword [0x422948]
cmp eax, dword [ebp - 0x18]
je 0x40439a
push eax
call esi
test eax, eax
je 0x40439a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x422940]
call esi
test eax, eax
je 0x4043b6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4043b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x41be40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x20
add dword [ebp - 4], 0x20
mov edx, dword [0x1ef4de4]
mov eax, dword [0x1ef4b08]
xor ecx, ecx
mov word [0x1ef4e00], cx
lea ecx, [ebp - 8]
push ecx
push 0x40
push edx
push eax
mov dword [0x1ef4dec], 0x6e0072
mov dword [0x1ef4df0], 0x6c0065
mov dword [0x1ef4df4], 0x320033
mov dword [0x1ef4df8], 0x64002e
mov dword [0x1ef4dfc], 0x6c006c
mov dword [0x1ef4de8], 0x65006b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x41c070
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x420dc0]
sub esp, 0x10
push ebx
mov ebx, dword [0x1ef4b08]
push edi
mov edi, dword [0x1ef4de4]
push eax
call fcn.0041bf90
add esp, 4
cmp dword [0x1ef4de4], 0x2f
jne 0x41c0cd
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.0041bfe0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458f70
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, 0xf1d000dd
setb al
bsr ax, ax
jmp 0x458f9b
mov dx, 0xb051
jmp 0x458fa8
jle 0x458f82
mov dx, 0xb051
jmp 0x458fa8
rcl dword [eax - 0x2d]
lea esp, [esp + 0x18]
add edi, 0x32f6d49e
adc dx, dx
jns 0x458ff2
js 0x458fdc
inc ecx
enter 0x395e, 0xffffffffffffffc8
jns 0x458fa5
adc al, 0x87
cmp dword cs:[edi + reloc.MSVCRT.dll_strncpy], eax
mov dx, 0x941b
mov dl, byte [esp + 2]
mov byte [esp + 2], bh
push dword [esp + 0x18]
ret 0x1c
xchg dx, bx
mov edx, dword [esp]
rdtsc
jmp 0x458ffa
xchg dx, bx
mov edx, dword [esp]
rdtsc
jmp 0x459026
call 0x459038
add edi, dword [esi]
jmp 0x459009
aaa
add byte [eax], al
add byte [ebx], al
notrack jmp 0x459009
sub esp, 0x1e
jl 0x459359
stc
mov edx, 0x83031167
adc bx, dx
lea esp, [esp + 2]
jmp 0x459080
rol edi, 0
btr eax, eax
jo 0x458ffc
jno 0x458ffc
movsd dword es:[edi], dword [esi]
sub bh, byte [eax - 0x346ad521]
bound ecx, qword [edx - 0x17fcdb8c]
sar bh, 0xff
call dword [ebx + 0x27d48d1d]
out 0xe3, eax
outsb dx, byte [esi]
cld
wait
jbe 0x458ffd
out dx, eax
adc dword [ebx], 0x76
test dword [ecx], esi
invalid
stc

Function at 0x463e9a
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x4480e7
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x448101
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x4480f0
pop esi
jmp 0x44810c
ret 4
lea esp, [esp + 8]
jmp 0x4480da

Function at 0x48f92f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx ebx, byte [eax - 2]
pushfd
mov word [esp + 1], ax
jmp 0x48f952
push word [esp + 2]
lea esp, [esp + 2]
or edx, ebx
jmp 0x48f915
or edx, ebx
jmp 0x48f9f4
shl edx, 8
sub esp, 0xd
mov word [esp + 2], dx
lea esp, [esp + 1]
jmp 0x48f93c
cmp ecx, 0x10
jmp 0x48fc25
inc ecx
add eax, 4
pushfd
lea esp, [esp + 4]
jmp 0x48f9c1
mov dword [ebp + ecx*4 - 0x40], edx
push dx
lea esp, [esp + 2]
lea esp, [esp + 0x14]
jmp 0x48f9d7
lea esp, [esp + 4]
jmp 0x48fa8d
mov eax, 0x9aa4c99c
lea eax, [ecx*4]
lea eax, [ebp - 0x40]
push edi
jmp 0x48fa04
call 0x463afd
xor eax, eax
jmp 0x446d7f
jb 0x446dc1
mov ch, 0xed
lea eax, [edi*4]
lea ecx, [esi + 8]
jmp 0x48fa1a

Function at 0x50f254
Capabilities:
Check for vm using instruction vpcext

Disassembly:
packssdw mm6, mm2
sbb bl, byte [edx - 0xa]
mov edx, 0x1aaaa0c7
push eax
salc
push ecx
xchg edi, eax
cwde
mov esp, 0x79f4233f
xor dh, bl
pop esi
rol byte [ebp + 0x141c4fb7], 0xce
and esi, esp
jns 0x50f276
ficomp word [esi - 0x40]
test dword [edi - reloc.MSVCRT.dll_strncpy], esi
mov bh, 0x4f
sbb al, 0x14
into
cmp dword [edi - 0x15], eax
cdq
jp 0x50f242
in eax, dx
in eax, dx
adc ecx, dword [reloc.MSVCRT.dll_strncpy]
loope 0x50f24a
jnp 0x50f26b
dec edi
insd dword es:[edi], dx
outsb dx, byte [esi]
xchg edi, eax
push ebp
cmpsb byte [esi], byte es:[edi]
mov al, byte [0x76707924]
inc esi
jns 0x50f230
mov dword [reloc.MSVCRT.dll_strncpy], eax
in eax, dx
sbb eax, 0x7639cf7
pushfd
arpl word [edi], ax
adc bh, byte [eax + ebp + 0x7505f053]
invalid
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x403203
pop dword [ebp - 0x48]
mov eax, 0x42d98ec6
sub eax, 0x42995cc3
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x9cec8288
sub dword [ebp - 0x58], 0x4e9a3d3d
mov dword [ebp - 0x54], 0x1d46f194
add dword [ebp - 0x54], 0x14ec5ab1
mov dword [ebp - 0x50], 0xb189f001
sub dword [ebp - 0x50], 0x653dabd3
mov dword [ebp - 0x4c], 0x2ded859c
add dword [ebp - 0x4c], 0xd2127a64
lea eax, [ebp - 0x58]
push eax
mov eax, 0x27c0dc96
add eax, 0xd87f93ce
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xfa75b549
sub dword [ebp - 0x58], 0x86034bf3
mov dword [ebp - 0x54], 0x55882634
sub dword [ebp - 0x54], 0x141bc4bf
mov dword [ebp - 0x50], 0xf5e477a7
add dword [ebp - 0x50], 0x6d8af4c5
mov dword [ebp - 0x4c], 0x67b2cf6c
add dword [ebp - 0x4c], 0x984d3094
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x1ed86219
add eax, 0xe1680e8f
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x33e81
push 0
call eax
mov ecx, 0x14986ead
add ecx, 0xeb67ce93
xor edx, edx
add edx, eax
mov ebx, 0x74bfcc78
add ebx, 0x8b813388
add ebx, dword [ebp - 0x48]
mov esi, 0x9c6aa03
xor dword [ebp - 8], ecx
mov edi, dword [ebx]
xor dword [ebp - 0x14], 0x9235c74e
xor edi, esi
xor dword [ebp - 0xc], edi
mov dword [edx], edi
sub dword [ebp - 0x1c], 0x2bab6735
add edx, 0x4810da83
add edx, 0xb7ef2581
add ebx, 0x9db024c9
add ebx, 0x624fdb3b
loop 0x403321
add eax, 0x3ced3e0a
sub eax, 0x3cec5637
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xfb532572
sub ecx, 0xfb132572
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0xef5c60
Capabilities:
Encode data using xor

Disassembly:
jmp 0xef5c6a
pushal
call 0xef5c70
pop ebp
sub ebp, 0x10
sub ebp, 0xaf5c60
jmp 0xef5c86
mov eax, 0xaf5c60
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e1
mov edx, 0x119fc7d3
xor byte [eax], dl
inc eax
dec ecx
jne 0xef5c9d
jmp 0xef5cb0
pop eax
push ds
pop eax
pop edx
out dx, eax
rcl ebx, cl
rcl dword [edx + 0x12], cl
sub edx, ebx
rcl ebx, cl
rcr byte [esi], 1
imul edx, ebp, 0xffffffd3
rcl ebx, cl
imul edi, ebx, 0x24d3d3d3
xor eax, edx
sbb ebx, dword [eax + 0x52]
invalid

Function at 0x401411
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x150
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
call esi
push edx
mov dword [ebp - 0x124], eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x118], 6
push ecx
push ecx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push edx
push edx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x11c], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push ecx
push ecx
mov dword [esp], 0
mov dword [ebp - 0x120], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
lea eax, [ebp - 0x134]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push eax
mov dword [esp], 0
call esi
lea esi, [ebp - 0x10c]
push edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push ecx
push ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
call dword [sym.imp.SHELL32.DLL_SHGetFolderPathA]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
sub esp, 0x1c
call ebx
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 5]
push esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x40162e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 1
call fcn.00401411
test eax, eax
jne 0x4016c8
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x402132
sub eax, 0x4016d0
mov dword [esp], 0x4016d0
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x4016c8
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401382
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.004015b7
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b400
mov dword [esp], 0x40300c
call 0x401e35
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x40c8f5
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
mov ebx, ecx
jne 0x40c910
push 0x80004005
call fcn.0040c608
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x40c912
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40d152
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4150f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], esi
call fcn.0040c853
mov edi, eax
cmp edi, esi
je 0x40d1b4
lea ecx, [ebp - 0x208]
call fcn.0040c7e0
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411548
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x40d1d2
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x208]
call fcn.0040d152
cmp eax, esi
jne 0x40d21a
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], 0x100
call edi
test eax, eax
je 0x40d1bc
lea ecx, [ebp - 0x208]
call fcn.0040c7e0
push dword [ebp - 0x210]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x208]
mov esi, eax
call fcn.0040c7e0
mov eax, esi
jmp 0x40d1a3
Function at 0x40f289
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4150f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push 2
push esi
push eax
mov dword [ebp - 0x410], esi
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x408], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp eax, esi
mov dword [ebp - 0x40c], eax
jne 0x40f2e4
call fcn.0040c717
mov esi, eax
jmp 0x40f3c3
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x40f2fd
call fcn.0040c717
jmp 0x40f3b5
push edi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, esi
je 0x40f2f3
push edi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
jae 0x40f362
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x40f33f
lea ecx, [ebp - 0x408]
call fcn.0040d0f1
mov esi, 0x8007000e
lea ecx, [ebp - 0x410]
call fcn.0040cfe6
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411548
leave
ret 0x10
push eax
lea ecx, [ebp - 0x408]
call fcn.0040da9e
cmp dword [ebp - 0x408], esi
jne 0x40f37d
mov esi, 0x8007000e
jmp 0x40f3b7
push edi
push dword [ebp - 0x408]
push edi
push ebx
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x40f2f3
mov ecx, dword [ebp - 0x408]
push dword [ebp + 0x14]
mov word [ecx + eax*2], si
push dword [ebp - 0x408]
lea ecx, [ebp - 0x418]
call fcn.0040f049
mov esi, eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x40f344
lea ecx, [ebp - 0x408]
call fcn.0040d0f1
jmp 0x40f344
Function at 0x410dd6
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4150f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.00410d6b
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x410e49
cmp dword [ebp - 0x94], 5
jb 0x410e6a
jmp 0x410e66
cmp dword [ebp - 0x88], 1
jne 0x410e6a
cmp dword [ebp - 0x94], 4
ja 0x410e66
jne 0x410e6a
cmp dword [ebp - 0x90], 0
jbe 0x410e6a
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x408e34
call fcn.0040c6ae
test eax, eax
jge 0x410e8b
mov byte [0x415118], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00411548
leave
ret

Function at 0x411750
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x411763
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x41175f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x411790
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x4117cf
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x4117c5
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x4117d1
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4117b5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x412320
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4150f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x408]
push eax
push 0x20006
push 0
push 0x408f10
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41236b
jle 0x412367
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x4123b7
push 0x200
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x4123a9
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x4123a9
jle 0x4123a5
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x4123ab
xor esi, esi
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00411548
leave
ret 4
Function at 0x4011a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x4011b5
xor eax, eax
pop esi
add esp, 0x14
ret 8
mov edx, dword [esi]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
jb 0x4011d6
mov eax, ecx
test eax, eax
mov dword [esp + 4], eax
push edi
jbe 0x40125a
cmp dword [esi + 8], 0
je 0x40122c
mov edx, dword [esp + 0x20]
lea edi, [esi + 0x28]
push edi
lea ecx, [esp + 0xc]
push ecx
push eax
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401256
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40122c
cmp dword [esi + 8], 0
je 0x40122c
mov ecx, dword [esi + 0x38]
push 0x3e8
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40122c
cmp dword [esi + 8], eax
jne 0x401236
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret 8
mov eax, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [esp + 8]
add dword [esi + 0x30], eax
pop edi
pop esi
add esp, 0x14
ret 8
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x14
ret 8

Function at 0x4011a3
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x4011b5
xor eax, eax
pop esi
add esp, 0x14
ret 8
mov edx, dword [esi]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
jb 0x4011d6
mov eax, ecx
test eax, eax
mov dword [esp + 4], eax
push edi
jbe 0x40125a
cmp dword [esi + 8], 0
je 0x40122c
mov edx, dword [esp + 0x20]
lea edi, [esi + 0x28]
push edi
lea ecx, [esp + 0xc]
push ecx
push eax
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401256
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40122c
cmp dword [esi + 8], 0
je 0x40122c
mov ecx, dword [esi + 0x38]
push 0x3e8
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40122c
cmp dword [esi + 8], eax
jne 0x401236
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret 8
mov eax, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [esp + 8]
add dword [esi + 0x30], eax
pop edi
pop esi
add esp, 0x14
ret 8
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x14
ret 8