joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54fa9f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x586220]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [0x57e2d0]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0053cc43
mov dword [ebp - 0x14], eax
cmp dword [0x58ee04], esi
jne 0x54fb92
push 0x800
push esi
push 0x432458
call dword [0x57e20c]
mov edi, eax
test edi, edi
jne 0x54fb1f
call dword [0x57e230]
cmp eax, 0x57
jne 0x54fc72
push esi
push esi
push 0x432458
call dword [0x57e20c]
mov edi, eax
test edi, edi
je 0x54fc72
push 0x432470
push edi
call dword [0x57e0c4]
test eax, eax
je 0x54fc72
push eax
call ebx
push 0x43247c
push edi
mov dword [0x58ee04], eax
call dword [0x57e0c4]
push eax
call ebx
push 0x43248c
push edi
mov dword [0x58ee08], eax
call dword [0x57e0c4]
push eax
call ebx
push 0x4324a0
push edi
mov dword [0x58ee0c], eax
call dword [0x57e0c4]
push eax
call ebx
mov dword [0x58ee14], eax
test eax, eax
je 0x54fb8f
push 0x420f18
push edi
call dword [0x57e0c4]
push eax
call ebx
mov dword [0x58ee10], eax
mov edi, dword [ebp - 0x18]
call dword [0x57e208]
test eax, eax
je 0x54fbb7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x54fbaa
push eax
call dword [0x57e1c0]
cmp dword [ebp - 0x14], esi
je 0x54fbcc
push 4
pop eax
jmp 0x54fc74
cmp dword [ebp - 0x14], esi
je 0x54fbcc
push dword [0x58ee04]
call dword [0x57e2cc]
push 3
jmp 0x54fbb1
mov eax, dword [0x58ee10]
mov ebx, dword [0x57e2cc]
cmp eax, edi
je 0x54fc2a
cmp dword [0x58ee14], edi
je 0x54fc2a
push eax
call ebx
push dword [0x58ee14]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x54fc2a
test eax, eax
je 0x54fc2a
call ecx
test eax, eax
je 0x54fc1f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x54fc1f
test byte [ebp - 8], 1
jne 0x54fc2a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x54fc5a
mov eax, dword [0x58ee08]
cmp eax, edi
je 0x54fc57
push eax
call ebx
test eax, eax
je 0x54fc57
call eax
mov esi, eax
test esi, esi
je 0x54fc57
mov eax, dword [0x58ee0c]
cmp eax, edi
je 0x54fc57
push eax
call ebx
test eax, eax
je 0x54fc57
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x58ee04]
call ebx
test eax, eax
je 0x54fc72
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x54fc74
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00535482
mov esp, ebp
pop ebp
ret
Function at 0x5555e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
cmp byte [ecx + 0x20], 0
lea eax, [ecx + 0x1c]
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esp + 8], ecx
jbe 0x55560e
mov edi, dword [eax]
mov dword [esp + 0xc], edi
cmp esi, edi
jb 0x555605
cmp esi, dword [eax + 8]
jb 0x55561c
add eax, 8
cmp byte [eax + 4], 0
ja 0x5555f6
mov eax, dword [ecx + 0x14]
pop edi
mov al, byte [esi + eax]
pop esi
add esp, 8
ret 4
movzx eax, byte [eax + 4]
sub esi, edi
push ebx
push ebp
lea ebx, [eax*4 + 0x58ee1c]
lea ebp, [eax - 1]
mov edi, edi
movzx eax, byte [ebx]
movzx edx, byte [ebx + 1]
add ecx, eax
movzx eax, byte [ecx]
and edx, eax
mov al, byte [ebx + 2]
test al, al
je 0x555653
movzx ecx, byte [ecx + 1]
movzx eax, al
and ecx, eax
shl ecx, 8
or edx, ecx
mov cl, byte [ebx + 3]
shr edx, cl
test ebp, ebp
je 0x5556bb
mov edi, 1
mov ecx, ebp
shl edi, cl
test esi, edi
setne al
mov byte [esp + 0x1c], al
test dl, 1
je 0x55567a
test al, al
sete byte [esp + 0x1c]
shr edx, 1
mov eax, edx
xor edx, edx
div ebp
mov eax, 1
mov ecx, edx
shl eax, cl
test esi, eax
je 0x555693
or esi, edi
jmp 0x555697
not edi
and esi, edi
cmp byte [esp + 0x1c], 0
je 0x5556aa
mov ecx, dword [esp + 0x10]
or esi, eax
dec ebp
sub ebx, 4
jmp 0x555630
mov ecx, dword [esp + 0x10]
not eax
and esi, eax
dec ebp
sub ebx, 4
jmp 0x555630
pop ebp
pop ebx
test dl, 1
je 0x5556c5
xor esi, 1
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, dword [eax + 0x14]
add eax, esi
pop esi
mov al, byte [eax + ecx]
add esp, 8
ret 4

Function at 0x555ce0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x555d7d
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x555d7c
push ebx
mov ebx, dword [esp + 0x18]
xor edx, edx
test ebx, ebx
je 0x555d77
push edi
cmp ebx, 0x20
jb 0x555d5b
lea eax, [esi - 1]
lea ecx, [ebp - 1]
add eax, ebx
add ecx, ebx
cmp ebp, eax
ja 0x555d1d
cmp ecx, esi
jae 0x555d5b
movdqa xmm1, xmmword [0x4332a0]
mov eax, ebx
and eax, 0x1f
mov ecx, ebx
sub ecx, eax
mov edi, ebp
mov eax, esi
sub edi, esi
movdqu xmm0, xmmword [eax]
lea eax, [eax + 0x20]
pxor xmm0, xmm1
movdqu xmmword [edi + eax - 0x20], xmm0
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm0, xmm1
movdqu xmmword [edx + ebp + 0x10], xmm0
add edx, 0x20
cmp edx, ecx
jb 0x555d34
cmp edx, ebx
jae 0x555d76
mov edi, ebx
lea ecx, [edx + ebp]
sub esi, ebp
sub edi, edx
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 0x67
mov byte [ecx - 1], al
dec edi
jne 0x555d68
pop edi
mov byte [ebx + ebp], 0
pop ebx
pop ebp
pop esi
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x55952b82
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x4a74152a
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x41bb116d
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x41bbc7e0
push 0xffffffffffffffff
push 0x41c2a23e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x41c30ecc
lea edi, [esi + 0x3c]
push 1
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 2
call fcn.41be4868
mov ecx, dword [esi + 0x1c]
xor ebp, ebp
cmp ecx, ebp
mov byte [esp + 0x28], 3
je 0x41bbc834
call fcn.41c2052c
mov dword [esi + 0x1c], ebp
push ebx
mov ebx, dword [esi + 0x30]
test ebx, ebx
jle 0x41bbc850
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax + ebp*4]
test ecx, ecx
je 0x41bbc84b
call fcn.41bb18c5
inc ebp
cmp ebp, ebx
jl 0x41bbc83c
lea ebp, [esi + 0x28]
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.41bb1a46
call fcn.41c1a900
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 2
call fcn.41be48a4
lea ecx, [edi + 8]
mov byte [esp + 0x2c], 1
push ecx
mov dword [edi], 0x41c30fbc
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, edi
call fcn.41be46ac
mov dword [esp + 0x14], ebp
mov dword [ebp], method.CCommandLineInfo.virtual_0
mov ebp, dword [ebp + 4]
mov byte [esp + 0x2c], 4
test ebp, ebp
pop ebx
je 0x41bbc8ae
push ebp
call fcn.41c08e55
add esp, 4
mov ecx, esi
mov dword [esp + 0x28], 0xffffffff
call fcn.41c088da
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x41bb119a
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x41bb33e0
push 0xffffffffffffffff
push 0x41c297a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x41c46258]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esi]
xor ebx, ebx
cmp eax, 3
mov dword [esp + 0x2c], ebx
ja case.default.0x41bb3424
mov ebp, dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
jmp dword [eax*4 + 0x41bb35ec]
lea eax, [esi + 0xc]
lea ecx, [esp + 0x10]
push eax
call fcn.41c076cd
mov eax, dword [esi + 4]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.41bb3300
mov eax, dword [esi + 0x10]
add esp, 8
cmp eax, 0xffffffff
je 0x41bb345b
push eax
call ebp
mov dword [esi + 0x10], 0xffffffff
mov eax, dword [esp + 0x10]
lea edx, [esi + 0x14]
push edx
push eax
call edi
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [esi + 0x10], eax
mov eax, ecx
cmp eax, ebx
jne 0x41bb34e3
mov dword [esi], 3
jmp 0x41bb34b0
mov eax, dword [esi + 0x10]
lea edx, [esi + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41bb356a
lea ecx, [esi + 0xc]
lea edx, [esi + 8]
push ecx
push edx
call fcn.41bb3690
add esp, 8
neg eax
sbb eax, eax
and al, 0xfd
add eax, 4
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, 3
jbe switch.0x41bb3424
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call fcn.41c07594
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
mov eax, dword [esp + 0x38]
mov dword [esi], 2
cmp eax, ebx
je 0x41bb3527
mov edi, dword [esp + 0x34]
lea eax, [esi + 0xc]
push eax
mov ecx, edi
call fcn.41c076cd
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.41bb176c
mov eax, dword [eax]
mov byte [esp + 0x2c], 1
push eax
push edi
call fcn.41bb3300
add esp, 8
mov byte [esp + 0x2c], bl
lea ecx, [esp + 0x14]
jmp 0x41bb354a
lea edx, [esp + 0x18]
mov ecx, esi
push edx
call fcn.41bb176c
mov ecx, dword [esp + 0x34]
push eax
mov byte [esp + 0x30], 2
call fcn.41c076cd
mov byte [esp + 0x2c], bl
lea ecx, [esp + 0x18]
call fcn.41c07594
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call fcn.41c07594
mov eax, 1
jmp 0x41bb34ce
cmp dword [esp + 0x38], ebx
je 0x41bb35a6
mov edi, dword [esp + 0x34]
lea eax, [esi + 0xc]
push eax
mov ecx, edi
call fcn.41c076cd
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.41bb176c
mov eax, dword [eax]
mov byte [esp + 0x2c], 3
push eax
push edi
call fcn.41bb3300
add esp, 8
mov byte [esp + 0x2c], bl
lea ecx, [esp + 0x1c]
jmp 0x41bb35c9
lea edx, [esp + 0x20]
mov ecx, esi
push edx
call fcn.41bb176c
mov ecx, dword [esp + 0x34]
push eax
mov byte [esp + 0x30], 4
call fcn.41c076cd
mov byte [esp + 0x2c], bl
lea ecx, [esp + 0x20]
call fcn.41c07594
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call fcn.41c07594
mov eax, 1
jmp 0x41bb34ce
Function at 0x41bb1523
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
jmp 0x41bb38b0
sub esp, 0x104
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x110]
push ebp
mov ebp, dword [esp + 0x110]
push esi
push eax
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x41bb3946
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x14]
push 0xff
push ecx
push eax
push edx
call edi
mov esi, eax
test esi, esi
jne 0x41bb3926
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.41bb1523
mov esi, eax
test esi, esi
jne 0x41bb3926
lea edx, [esp + 0x14]
push 0xff
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call edi
mov esi, eax
test esi, esi
je 0x41bb38f9
cmp esi, 0x103
pop edi
je 0x41bb393c
cmp esi, 0x3f2
je 0x41bb393c
cmp esi, 2
jne 0x41bb3946
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 8

Function at 0x41bb16e5
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x41bc0420
push 0xffffffffffffffff
push 0x41c2a67f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.41c088c0
xor edi, edi
lea ecx, [esi + 0x1c]
mov dword [esp + 0x14], edi
call fcn.41c03c7e
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call fcn.41c03c7e
lea ecx, [esi + 0x44]
mov byte [esp + 0x14], 2
call fcn.41c03c7e
mov dword [esi + 0x58], 0x41c312e0
mov dword [esi + 0x5c], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x6c], 0x41c30fd8
mov dword [esi + 0x70], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x80], 0x41c312a0
mov dword [esi + 0x84], 0x41c3128c
mov ecx, esi
mov byte [esp + 0x14], 5
mov dword [esi], 0x41c3122c
call fcn.41c25eb9
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x41bb1708
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x41bdc370
les edx, [eax]
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x41bdc39f
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.41bdc0b1
mov al, 0xc6
push 0x77
lea eax, [ebp - 0x40]
push eax
call fcn.41bdc0c1
push eax
push esi
push dword [ebp + 8]
call fcn.41bdc076
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.41bdc0b1
mov dl, 0x3b
invalid

Function at 0x41bb1d84
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x41bc1030
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41c2a7e8
push eax
mov ax, word [esp + 0x10]
mov dword fs:[0], esp
test ax, ax
jl 0x41bc109d
mov edx, dword [ecx + 0x38]
movsx eax, ax
cmp eax, edx
jge 0x41bc109d
push eax
lea eax, [esp + 0x14]
push eax
add ecx, 0x30
call fcn.41bb1235
mov ecx, dword [esp + 0x14]
push eax
mov dword [esp + 0xc], 0
call fcn.41c076cd
lea ecx, [esp + 0x10]
mov dword [esp + 8], 0xffffffff
call fcn.41c07594
xor eax, eax
mov ecx, dword [esp]
mov dword fs:[0], ecx
add esp, 0xc
ret 8
mov ecx, dword [esp]
mov eax, 0x1c
mov dword fs:[0], ecx
add esp, 0xc
ret 8
Function at 0x41bb1f37
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x41bb72b0
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41c29bf0
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x1c
test eax, eax
push ebp
push esi
push edi
mov esi, ecx
je 0x41bb74ec
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x41bb74ec
mov eax, dword [esp + 0x40]
test eax, eax
je 0x41bb74ec
mov eax, dword [esp + 0x44]
test eax, eax
je 0x41bb74ec
mov eax, dword [esp + 0x48]
test eax, eax
je 0x41bb74ec
mov ebp, dword [esp + 0x4c]
test ebp, ebp
je 0x41bb74ec
mov edi, dword [esp + 0x50]
test edi, edi
je 0x41bb74ec
mov ecx, dword [esi + 0x30]
test ecx, ecx
jne 0x41bb7331
push 9
push 5
jmp 0x41bb74f0
mov eax, dword [0x41c46258]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov edx, dword [esi + 0x28]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x24]
push edx
push eax
mov dword [esp + 0x3c], 0
call fcn.41bb15aa
test eax, eax
je 0x41bb73e9
push 9
push 5
call fcn.41bb2040
add esp, 8
lea ecx, [esp + 0x24]
mov dword [esp + 0x30], 6
call fcn.41c07594
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 5
call fcn.41c07594
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 4
call fcn.41c07594
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 3
call fcn.41c07594
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 2
call fcn.41c07594
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.41c07594
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.41c07594
jmp 0x41bb74f8
add esi, 0x20
lea ecx, [esp + 0x4c]
push esi
call fcn.41c07309
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 7
call fcn.41c25f09
mov ecx, dword [esp + 0x38]
mov dword [ecx], eax
lea ecx, [esp + 0x4c]
call fcn.41c25f09
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x14]
mov dword [edx], eax
call fcn.41c25f09
mov ecx, dword [esp + 0x40]
mov dword [ecx], eax
lea ecx, [esp + 0x18]
call fcn.41c25f09
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x1c]
mov dword [edx], eax
call fcn.41c25f09
lea ecx, [esp + 0x20]
mov dword [ebp], eax
call fcn.41c25f09
lea ecx, [esp + 0x24]
mov dword [edi], eax
call fcn.41c25f09
mov ecx, dword [esp + 0x44]
mov byte [esp + 0x30], 0
mov dword [ecx], eax
lea ecx, [esp + 0x4c]
call fcn.41c07594
lea ecx, [esp + 0x24]
mov dword [esp + 0x30], 0xd
call fcn.41c07594
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 0xc
call fcn.41c07594
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0xb
call fcn.41c07594
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 0xa
call fcn.41c07594
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 9
call fcn.41c07594
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 8
call fcn.41c07594
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.41c07594
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 0x1c
push 0xd
push 9
call fcn.41bb2040
add esp, 8
mov ecx, dword [esp + 0x28]
pop edi
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret 0x1c
Function at 0x41bb3240
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push esi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, dword [esp + 0x210]
mov ecx, dword [esi]
mov eax, dword [ecx - 8]
test eax, eax
je 0x41bb3270
push 0x3b
mov ecx, esi
call fcn.41c07997
lea edx, [esp + 4]
mov ecx, esi
push edx
call fcn.41c07970
push str.crystal
push esi
call fcn.41bb3300
add esp, 8
lea eax, [esp + 0x108]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [esi]
mov eax, dword [ecx - 8]
test eax, eax
je 0x41bb32af
push 0x3b
mov ecx, esi
call fcn.41c07997
lea edx, [esp + 0x108]
mov ecx, esi
push edx
call fcn.41c07970
pop esi
add esp, 0x208
ret
Function at 0x41bb47d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c29880
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x164
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
lea eax, [ebp - 0x6c]
push 0x27
push eax
push ecx
xor esi, esi
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea edx, [ebp - 0x6c]
mov ebx, eax
test edx, edx
jne 0x41bb4810
xor edi, edi
jmp 0x41bb4839
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.41be8f90
mov eax, esp
lea ecx, [ebp - 0x6c]
push edi
push ecx
push eax
call fcn.41c07c1b
mov edi, eax
cmp ebx, 0x27
je 0x41bb4845
xor eax, eax
jmp 0x41bb4961
mov edx, dword [0x41c46258]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ecx
mov dword [ebp - 4], ebx
call fcn.41c08866
mov edx, dword [0x41c46258]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.41c07c45
test eax, eax
jne 0x41bb4886
push edi
lea ecx, [ebp - 0x10]
call fcn.41c0771d
push edi
lea ecx, [ebp - 0x170]
push str.CLSID_s
push ecx
mov dword [ebp + 0xc], ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp + 0xc]
lea eax, [ebp - 0x170]
push edx
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41bb493a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
push eax
push 1
lea ecx, [ebp - 0x1c]
push 2
push ecx
push 0x41c30050
mov dword [ebp - 0x18], edx
call fcn.41c24854
mov esi, eax
cmp esi, ebx
je 0x41bb493a
test byte [ebp + 0x14], 2
je 0x41bb493a
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 8]
push edx
push str.InprocServer32
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x41bb493a
push str.Apartment
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp + 8]
inc eax
push eax
push str.Apartment
push 1
push ebx
push str.ThreadingModel
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp + 8]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call edi
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x41bb4944
push eax
call edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.41c07594
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.41c07594
mov eax, esi
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x17c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41bbc6d6
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
jmp 0x41bbc6c0
push 0xffffffffffffffff
push 0x41c2a1ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.41c088c0
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x28], 0x41c30fd8
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], eax
lea edi, [esi + 0x3c]
push eax
mov ecx, edi
mov byte [esp + 0x18], 1
call fcn.41be4681
mov dword [edi], 0x41c30fbc
add edi, 8
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x5c], 0x41c30f90
mov dword [esi + 0x60], 0x41c30f68
mov dword [esi + 0x64], 0x41c30f40
mov dword [esi + 0x68], 0x41c30f2c
mov ecx, esi
mov byte [esp + 0x14], 2
mov dword [esi], 0x41c30ecc
call fcn.41c25eb9
mov ecx, esi
call fcn.41bb1e6f
call fcn.41c1a8f0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x41bf05bc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x41c473f8
cmp edx, dword [eax]
je 0x41bf05de
add eax, 8
inc ecx
cmp eax, 0x41c47488
jl 0x41bf05cf
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x41c473f8]
jne 0x41bf070c
mov eax, dword [0x41c4aea4]
cmp eax, 1
je 0x41bf06e6
test eax, eax
jne 0x41bf060f
cmp dword [0x41c4aea8], 1
je 0x41bf06e6
cmp edx, 0xfc
je 0x41bf070c
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41bf0646
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.41bf1a90
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.41beae80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41bf0689
lea eax, [ebp - 0x1a4]
push eax
call fcn.41beae80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41c34ca8
push edi
call fcn.41bf4be0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.41bf1a90
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.41bf1aa0
lea eax, [ebp - 0xa0]
push 0x41c34c88
push eax
call fcn.41bf1aa0
push dword [esi + 0x41c473fc]
lea eax, [ebp - 0xa0]
push eax
call fcn.41bf1aa0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.41bf6c1e
add esp, 0x2c
pop edi
jmp 0x41bf070c
lea eax, [ebp + 8]
lea esi, [esi + 0x41c473fc]
push 0
push eax
push dword [esi]
call fcn.41beae80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret