joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406e90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 0x4000
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004067b5
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x406f03
push esi
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x3ffe], ax
pop esi
jne 0x406f03
cmp dword [ebp - 8], 1
je 0x406f08
cmp dword [ebp - 8], 2
je 0x406f08
xor eax, eax
mov word [edi], ax
pop edi
leave
ret 0x14

Function at 0x406f0d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406f70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x40b0f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp - 0xc], 0x73006e
mov dword [ebp - 8], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 8], dx
lea eax, [ebp - 0xc]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406fc7
test edi, edi
jne 0x406f8c
mov word [esi], ax
jmp 0x406fc9
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408581
leave
ret 8

Function at 0x4070b6
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4070d8
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x407365
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x466424], 0
push esi
jne 0x40739f
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x407376
mov dword [ecx*4 + 0x466420], edx
inc ecx
cmp ecx, 0x100
jl 0x407371
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x4073c9
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x466420]
inc esi
sub edx, 1
jne 0x4073b1
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x40af70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40afba
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40af89
jmp 0x40afba
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40afaa
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40c050
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40c085
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40c0af
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40c0af
test edi, edi
je 0x40c07c
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40c07c
test edi, edi
je 0x40c0b7
mov eax, edi
jmp 0x40c07e
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40c07e
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040fdc3
add esp, 0xc
int3
Function at 0x40fdf7
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestTemplateLib.exe_gMozillaPoisonSize], eax
call fcn.0040c050
pop ecx
mov ecx, dword [sym.TestTemplateLib.exe_gMozillaPoisonSize]
mov dword [sym.TestTemplateLib.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40fe2f
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestTemplateLib.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x408954
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop esi
sub edx, 0xc2b95378
inc edx
call fcn.00408993
sub ecx, 0x7ba24503
or edx, ecx
xor dword [edi], esi
mov edx, 0x9b58eb35
add edi, 1
mov edx, ecx
cmp edi, eax
jne main
add ecx, 1
ret
Function at 0x4041b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x4041fe
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x4041cd
jmp 0x4041fe
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x4041ee
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x404261
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.TestEnumSet.exe_gMozillaPoisonSize]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x404299
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x1c]
jb 0x4042c3
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x1c]
jb 0x4042c3
test edi, edi
je 0x404290
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x404290
test edi, edi
je 0x4042cb
mov eax, edi
jmp 0x404292
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x404292
int3

Function at 0x4042fa
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
mov dword [sym.TestEnumSet.exe_gMozillaPoisonSize], eax
call fcn.00404261
mov ecx, dword [sym.TestEnumSet.exe_gMozillaPoisonSize]
mov dword [sym.TestEnumSet.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x404330
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestEnumSet.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x412f00
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov ecx, dword [ebp + 8]
mov eax, dword [0x4ce008]
xor eax, ebp
mov dword [esp + 0x28], eax
test ecx, ecx
je 0x413101
cmp dword [0x4cfc98], 0xe69e32f3
jne 0x413104
mov edi, 0x308
mov edx, 0x20
mov esi, 0x20
add edi, dword [ecx + 8]
mov byte [esp + 0xf], 0xff
mov al, byte [ecx + 2]
je 0x412f54
bsr esi, edi
xor esi, 0x1f
mov ecx, 0x4bda04
sub ecx, esi
mov cl, byte [ecx]
mov ebx, edi
shr ebx, cl
sub edx, esi
and ebx, 7
lea ecx, [ebx + edx*8]
mov edx, dword [edx*4 + 0x4bda08]
and edx, edi
cmp edx, 1
mov edx, dword [ebp + 8]
lea esi, [edx + 0x48]
sbb ecx, 0xffffffff
movzx ecx, word [ecx + ecx + 0x4bd7d0]
test al, al
mov dword [esp], edi
jne 0x412fa3
cmp edi, 0x41
setae al
cmp cx, 0x76
setb dl
and dl, al
movzx eax, dl
or eax, ecx
mov ecx, eax
movzx ebx, cx
shl ebx, 5
mov dword [esp + 4], esi
lea edi, [esi + ebx]
mov eax, dword [ebp + 8]
lea esi, [eax + 0x40]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x41309e
mov dword [esp + 8], esi
mov eax, dword [edi]
mov esi, dword [eax]
test esi, esi
je 0x4130aa
mov byte [esp + 0xf], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x413097
mov edx, dword [esp + 4]
mov ebx, dword [edx + ebx + 0xc]
bswap ecx
mov edx, ecx
xor edx, esi
cmp edx, 0x1fffff
ja 0x413107
mov edx, ecx
and edx, 0x1fc000
je 0x413107
prefetcht0 byte [ecx]
mov dword [eax], ecx
mov ecx, dword [eax + 0xc]
lea edx, [ecx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [eax + 0xc], ecx
mov edi, dword [ebp + 8]
mov eax, dword [eax + 8]
mov ecx, dword [edi + 0x117c]
add ecx, dword [eax + 0xc]
mov eax, dword [edi + 0x1180]
mov dword [edi + 0x117c], ecx
cmp eax, ecx
cmova ecx, eax
mov dword [edi + 0x1180], ecx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, esi
push edi
call fcn.0043b760
push esi
push dword [0x4dd3a8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x4d1de0]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x98], esi
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.00462e56
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
jmp 0x41300f
mov ecx, esi
call fcn.0043b3c0
jmp 0x412fc5
lea eax, [esp + 0xf]
mov ecx, edi
push eax
push 0x4000
push dword [esp + 8]
push 2
mov edi, dword [ebp + 8]
push edi
call fcn.00439960
test eax, eax
je 0x4130fa
mov esi, eax
and eax, 0xffe00000
mov ecx, esi
shr ecx, 9
and ecx, 0x1fe0
or ecx, eax
mov eax, ecx
or eax, 0x1000
or ecx, 0x101e
movzx ecx, byte [ecx]
and ecx, 0x3f
shl ecx, 5
sub eax, ecx
jmp 0x41302b
xor esi, esi
jmp 0x41304e
int3
int3
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x10]
movdqa xmmword [edi], xmm0
mov ecx, edi
push 0
push dword [esi]
push str.first
call fcn.0048cfc0
push edi
call fcn.004106c0
add esp, 4
push ebx
call fcn.0048d040
int3
Function at 0x4131a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x4131b7
test eax, eax
je 0x4131b7
pop esi
pop edi
pop ebp
ret 0xc
test eax, eax
jne 0x4131c5
mov ecx, dword [0x4dd40c]
test ecx, ecx
jne 0x413201
cmp dword [0x4dd404], 0
je 0x4131b1
mov esi, dword [0x4dd408]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x41320b
test esi, esi
je 0x4131b1
mov ecx, dword [0x4dd404]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x4131b1
call dword [section..00cfg]
call ecx
jmp 0x4131c5
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4131e9
Function at 0x4172e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x41b5c0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword fs:[0], eax
test byte [ecx + 4], 1
jne 0x417377
movzx edi, byte [ebp + 0x18]
mov eax, dword [esi]
mov ebx, dword [eax + 0x18]
mov ecx, ebx
call dword [section..00cfg]
movsx eax, byte [ebp + 0x14]
mov ecx, esi
push edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
shr al, 7
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0x20]
mov dword [edx], esi
test al, al
je 0x417369
push ecx
call fcn.00462617
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x417347
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x30]
push esi
call fcn.00442820
mov dword [ebp - 0x10], 0
mov ecx, esi
push 0x4e027c
call fcn.00443380
mov esi, eax
mov edi, dword [ebp - 0x30]
xor ebx, ebx
dec ebx
mov eax, ebx
lock xadd dword [edi + 4], eax
test eax, eax
jne 0x4173c6
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], 0xffffffff
call dword [section..00cfg]
mov ecx, edi
call dword [ebp - 0x24]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov eax, dword [esi]
mov cl, byte [ebp + 0x18]
xor cl, 1
movzx ecx, cl
mov edi, dword [eax + ecx*4 + 0x14]
mov dword [ebp - 0x10], ebx
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
lea eax, [ebp - 0x30]
push eax
call edi
movzx eax, byte [ebp - 0x25]
test al, al
js 0x417400
mov edx, eax
and edx, 0x7f
jmp 0x417403
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
test edx, edx
je 0x417351
test al, al
lea eax, [ebp - 0x30]
cmovns ecx, eax
mov dword [ebp - 0x24], ecx
jmp 0x417431
mov esi, dword [ebp - 0x2c]
mov edx, ecx
add edx, esi
mov esi, dword [ebp - 0x24]
inc esi
mov dword [ebp - 0x24], esi
cmp esi, edx
je 0x417351
cmp dword [ebp - 0x20], 0
je 0x417467
mov eax, dword [ebp - 0x24]
mov al, byte [eax]
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + 0x18]
cmp ecx, dword [edx + 0x1c]
je 0x417470
lea edx, [ecx + 1]
mov esi, dword [ebp - 0x20]
mov dword [esi + 0x18], edx
mov byte [ecx], al
movzx eax, byte [ebp - 0x25]
mov ecx, dword [ebp - 0x30]
test al, al
js 0x41741b
mov esi, eax
and esi, 0x7f
lea edx, [ebp - 0x30]
jmp 0x417420
mov dword [ebp - 0x20], 0
jmp 0x417452
movzx edi, al
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov esi, dword [eax + 0x30]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
call dword [section..00cfg]
mov dword [ebp - 0x10], 1
mov ecx, ebx
push edi
call esi
xor ecx, ecx
cmp eax, 0xffffffff
je 0x4174a0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
jmp 0x417452
Function at 0x41d2d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov dword [ecx], 0x4bc12c
add ecx, 4
call fcn.00446130
lea ecx, [esi + 8]
call fcn.00446130
xor ebx, ebx
mov byte [esi + 0xc], bl
lea ecx, [esi + 0x24]
xorps xmm0, xmm0
movups xmmword [esi + 0x10], xmm0
mov dword [esi + 0x20], ebx
call fcn.00446130
mov byte [esi + 0x28], bl
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
lea eax, [esi + 0x3c]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x38], eax
xorps xmm0, xmm0
movups xmmword [esi + 0x44], xmm0
movups xmmword [esi + 0x54], xmm0
mov dword [esi + 0x68], ebx
mov dword [esi + 0x64], ebx
mov edi, 0x3f800000
mov dword [esi + 0x6c], edi
movups xmmword [esi + 0x70], xmm0
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], edi
movups xmmword [esi + 0x88], xmm0
mov dword [esi + 0x98], edi
movups xmmword [esi + 0x9c], xmm0
mov dword [esi + 0xac], edi
movups xmmword [esi + 0xb0], xmm0
mov dword [esi + 0xc0], edi
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xd8], ebx
movups xmmword [esi + 0xc8], xmm0
mov eax, dword [0x4c249c]
mov dword [esi + 0xe8], eax
lea ecx, [esi + 0xec]
call fcn.00428320
xorps xmm0, xmm0
movups xmmword [esi + 0x188], xmm0
mov dword [esi + 0x198], edi
movups xmmword [esi + 0x19c], xmm0
movups xmmword [esi + 0x1a5], xmm0
mov eax, dword [ebp + 8]
mov dword [esi + 0x1b8], eax
mov byte [esi + 0x1bc], bl
mov dword [esi + 0x1c0], ebx
mov dword [esi + 0x1c4], ebx
mov dword [esi + 0x1c8], ebx
call fcn.004106c0
call fcn.00420970
mov ecx, eax
mov dword [esi + 0xd8], eax
xor ecx, 0x84222325
mov edx, 0x1b3
mov eax, ecx
mul edx
shl ecx, 8
add ecx, edx
add ecx, 0x8d40976c
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], ecx
mov edx, dword [esi + 0xe8]
mov ecx, dword [esi + 0xf0]
mov eax, ecx
shr eax, 6
test dword [0x4c24a0], edx
je 0x41d46d
cmp ecx, 0x40
mov ecx, 0x3e8
cmovb eax, ecx
push eax
call fcn.0044ce70
add esp, 4
mov edi, dword [esi + 0x14]
mov dword [esi + 0x14], eax
test edi, edi
jne 0x41d4a4
call fcn.0041f290
mov ecx, eax
push 0
push str.TraceLog
push esi
call fcn.0041f320
mov dword [0x4e0b14], esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
test dword [0x4c24a4], edx
jne 0x41d490
test dword [0x4c24a8], edx
jne 0x41d49a
cmp ecx, 0x40
mov ecx, 0xfa0
cmovb eax, ecx
push eax
call fcn.00427dd0
jmp 0x41d43d
cmp ecx, 0x40
mov ecx, 0x100
jmp 0x41d434
cmp ecx, 0x40
mov ecx, 0x7a1200
jmp 0x41d485
mov eax, dword [edi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
push 1
call ebx
jmp 0x41d44a
Function at 0x41fac0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x4ce008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [edx], eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov ebx, dword [ebp + 8]
push esi
push edi
push edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fb33
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x41fb1d
cmp dword [ebp - 0x18], 4
jne 0x41fb1d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462e56
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x41fb1d
Function at 0x41fb40
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.004639c0
mov esi, ecx
mov eax, dword [0x4ce008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, 0x800
lea edi, [ebp - 0x810]
push ebx
push 0xff
push edi
call fcn.00466490
add esp, 0xc
lea eax, [ebp - 0x1014]
mov dword [eax], 1
lea ecx, [ebp - 0x1018]
mov dword [ecx], ebx
push ecx
push edi
push eax
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fbff
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 1
jne 0x41fc59
push edi
call fcn.0047a8f1
add esp, 4
mov ebx, eax
mov al, byte [esi + 0xb]
test al, al
js 0x41fc37
cmp ebx, 4
jbe 0x41fc03
mov ecx, esi
mov esi, edi
movzx eax, al
mov edx, 4
mov edi, ebx
sub edi, edx
push esi
push ebx
push eax
push 0
push eax
push edi
push edx
call fcn.0041be30
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462e56
mov eax, esi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov esi, eax
jmp 0x41fbe6
mov ecx, esi
test ebx, ebx
je 0x41fc1f
mov eax, ebx
add eax, ebx
push eax
push edi
push ecx
mov edi, ecx
call fcn.00465f10
mov ecx, edi
add esp, 0xc
mov al, byte [esi + 0xb]
test al, al
js 0x41fc32
mov eax, ebx
and al, 0x7f
mov byte [esi + 0xb], al
mov word [ecx + ebx*2], 0
jmp 0x41fbe4
mov dword [esi + 4], ebx
jmp 0x41fc2a
mov eax, dword [esi + 8]
mov edx, eax
and edx, 0x7fffffff
dec edx
cmp edx, ebx
jae 0x41fc52
mov eax, esi
mov esi, edi
mov ecx, eax
mov eax, dword [eax + 4]
jmp 0x41fbd3
shr eax, 0x18
mov ecx, dword [esi]
jmp 0x41fc05
cmp eax, 2
jne 0x41fd23
lea ebx, [ebp - 0x1010]
push 0x800
push 0xff
push ebx
call fcn.00466490
add esp, 0xc
push 0x400
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x41fd2d
push ebx
call fcn.0047a8f1
add esp, 4
mov ebx, eax
mov al, byte [esi + 0xb]
test al, al
js 0x41fcce
cmp ebx, 4
jbe 0x41fce3
movzx eax, al
mov edx, 4
mov edi, ebx
sub edi, edx
mov ecx, esi
lea esi, [ebp - 0x1010]
jmp 0x41fbd7
mov eax, dword [esi + 8]
mov edx, eax
and edx, 0x7fffffff
dec edx
cmp edx, ebx
jae 0x41fd1c
mov eax, dword [esi + 4]
jmp 0x41fcbd
mov edi, esi
test ebx, ebx
je 0x41fd01
mov eax, ebx
add eax, ebx
push eax
lea eax, [ebp - 0x1010]
push eax
push edi
call fcn.00465f10
add esp, 0xc
mov al, byte [esi + 0xb]
test al, al
js 0x41fd17
mov eax, ebx
and al, 0x7f
mov byte [esi + 0xb], al
mov word [edi + ebx*2], 0
jmp 0x41fbe4
mov dword [esi + 4], ebx
jmp 0x41fd0c
shr eax, 0x18
mov edi, dword [esi]
jmp 0x41fce5
mov esi, 0x3f4
jmp 0x41fbe6
mov esi, 0xea
jmp 0x41fbe6

Function at 0x41fd40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push eax
mov eax, dword [ebp + 8]
mov edx, dword [0x4ce008]
xor edx, ebp
mov dword [ebp - 8], edx
mov edx, 4
lea esi, [ebp + 0xc]
push edx
push esi
push edx
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00462e56
mov eax, esi
add esp, 4
pop esi
pop ebp
ret 8
Function at 0x420080
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, edx
mov ebx, ecx
mov eax, dword [0x4ce008]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x4200b7
mov eax, dword [0x4d1d04]
cmp eax, 0xffffffff
je 0x420140
mov ebx, 0x100000
test eax, eax
jne 0x4200b7
mov ebx, 0x80000
push 0x10
call fcn.004625e7
add esp, 4
mov esi, eax
mov eax, edi
shr eax, 0xe
mov ecx, edi
shr ecx, 0x13
mov ecx, dword [ecx*4 + 0x4d4b50]
bt ecx, eax
jb 0x420135
mov eax, edi
shr eax, 0x15
mov byte [eax + 0x4dcb50], 1
mov dword [esi], edi
mov edi, dword [ebp + 8]
test edi, edi
setne byte [esi + 4]
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
xor eax, eax
push eax
push 0x10000
push esi
push 0x420510
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x42017c
test edi, edi
je 0x420160
mov dword [edi], eax
test eax, eax
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462e56
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.0043ed90
add esp, 4
jmp 0x4200e5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x4d1d04
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x42016d
mov eax, dword [0x4d1d04]
jmp 0x4200a9
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x42011c
mov dword [0x4d1d04], 0
jmp 0x4200b2
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x420198
mov edi, eax
cmp eax, 0x5af
je 0x420198
cmp edi, 0xe
jne 0x4201de
push ebx
call fcn.0048cbd0
add esp, 4
test esi, esi
mov eax, dword [ebp - 0x28]
je 0x42011c
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x4d4b50]
bt edx, ecx
jae 0x4201cd
push eax
call fcn.0043ee90
add esp, 4
push esi
call fcn.00462617
add esp, 4
mov eax, dword [ebp - 0x28]
jmp 0x42011c
mov eax, dword [0x4e0b64]
mov ecx, dword [0x4d1de0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x420251
lea ebx, [ebp - 0x24]
push edi
push ebx
call fcn.00427ff0
add esp, 8
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x420218
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
jmp 0x42021b
and eax, 0x7f
lea edi, [ebp - 0x18]
mov ecx, edi
push eax
push ebx
call fcn.004383e0
push dword [edi + 4]
push dword [edi]
push dword [0x4e0b60]
call fcn.0042bad0
add esp, 0xc
cmp byte [ebp - 0x19], 0
jns 0x4201a1
push dword [ebp - 0x24]
call fcn.00462617
jmp 0x42019e
push 0x4e0b64
call fcn.00462687
add esp, 4
cmp dword [0x4e0b64], 0xffffffff
jne 0x4201fb
push 0x20
push str.create_thread_last_error
call fcn.0042ba90
add esp, 8
mov dword [0x4e0b60], eax
push 0x4e0b64
call fcn.004626fd
add esp, 4
jmp 0x4201fb
Function at 0x4208d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x42090b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x420922
lea eax, [ebx + 1]
cmp eax, 2
jb 0x420904
mov dword [esi], ebx
call fcn.0044a3b0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x420939
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.0044a3b0
push dword [esi]
call fcn.00445aa0
add esp, 4
mov dword [esi], 0
jmp 0x4208f5
int3