joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406f30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x646d90
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, ecx
cmp dword [ebx + 0x10], 0
mov esi, edx
je 0x406f87
cmp dword [ebx + 0x14], 8
jb 0x406f75
mov eax, dword [ebx]
jmp 0x406f77
mov eax, ebx
push eax
call edi
test eax, eax
setne al
test al, al
jne 0x407024
cmp dword [esi + 0x10], 0
je 0x406fa5
cmp dword [esi + 0x14], 8
jb 0x406f97
mov eax, dword [esi]
jmp 0x406f99
mov eax, esi
push eax
call edi
test eax, eax
setne al
test al, al
jne 0x407024
mov ecx, esi
lea esi, [ebp - 0x48]
call fcn.00407050
mov edi, eax
mov ecx, ebx
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00407050
mov byte [ebp - 4], 1
mov ecx, dword [edi + 0x10]
mov esi, 0x10
cmp dword [edi + 0x14], esi
jb 0x406fd5
mov edi, dword [edi]
push ecx
mov ecx, dword [eax + 0x10]
push edi
push ecx
push 0
mov ecx, eax
call fcn.0040b020
test eax, eax
sete bl
cmp dword [ebp - 0x18], esi
jb 0x406ffa
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004effaf
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp dword [ebp - 0x34], esi
jb 0x40701d
mov eax, dword [ebp - 0x48]
push eax
call fcn.004effaf
add esp, 4
test bl, bl
setne al
jmp 0x407026
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x407050
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x646d4d
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x88], esi
cmp dword [edi + 0x10], ebx
jne 0x4070b0
push ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push 0x688621
mov ecx, esi
mov byte [esi], bl
call fcn.00403c90
jmp 0x4071ae
lea eax, [ebp - 0x138]
push eax
mov byte [ebp - 0x18], bl
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x80], 0x67452301
mov dword [ebp - 0x7c], 0xefcdab89
mov dword [ebp - 0x78], 0x98badcfe
mov dword [ebp - 0x74], 0x10325476
call fcn.00409210
mov dword [ebp - 4], 1
cmp dword [edi + 0x14], 8
jb 0x4070f2
mov ecx, dword [edi]
jmp 0x4070f4
mov ecx, edi
lea edi, [ebp - 0x138]
call fcn.004092f0
cmp dword [ebp - 0xd4], ebx
jne 0x407141
push ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push 0x688621
mov ecx, esi
mov byte [esi], bl
call fcn.00403c90
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x84], 1
mov byte [ebp - 4], bl
call fcn.00409350
lea ecx, [ebp - 0xd0]
push ecx
jmp 0x40719c
lea edi, [ebp - 0x138]
lea ecx, [ebp - 0x80]
mov byte [ebp - 0x18], bl
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x80], 0x67452301
mov dword [ebp - 0x7c], 0xefcdab89
mov dword [ebp - 0x78], 0x98badcfe
mov dword [ebp - 0x74], 0x10325476
call fcn.0040ee40
push esi
lea ecx, [ebp - 0x80]
call fcn.0040f870
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x84], 1
mov byte [ebp - 4], bl
call fcn.00409350
lea edx, [ebp - 0xd0]
push edx
mov dword [ebp - 0xd0], vtable.std::ios_base.0
call fcn.005fe82e
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x4071f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6438eb
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x6c3afc]
xor eax, esp
mov dword [esp + 0x274], eax
push esi
push edi
mov eax, dword [0x6c3afc]
xor eax, esp
push eax
lea eax, [esp + 0x288]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x407385
push 0xffffffffffffffff
push edi
xor eax, eax
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], ax
call fcn.00403240
lea ecx, [esp + 0x10]
push 0x2f
push ecx
mov dword [esp + 0x298], edi
call fcn.004017c0
lea edx, [esp + 0x18]
push 0x5c
push edx
call fcn.004017c0
add esp, 0x10
cmp dword [esp + 0x20], 3
mov edi, 8
ja case.default.0x4072a4
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], edi
jae 0x407298
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
ja case.default.0x4072a4
jmp dword [eax*4 + 0x4073ac]
lea ecx, [esp + 0x10]
call fcn.004bf3b0
jmp 0x407385
lea ecx, [esp + 0x10]
call fcn.004bf3b0
mov al, 1
jmp 0x407387
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], edi
jae 0x4072d7
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x407347
mov eax, dword [esi + 0x10]
lea ecx, [eax - 1]
cmp eax, ecx
ja 0x4072fc
push str.invalid_string_position
call fcn.005fe693
mov edx, dword [esi + 0x14]
cmp edx, edi
jb 0x407307
mov eax, dword [esi]
jmp 0x407309
mov eax, esi
cmp word [eax + ecx*2], 0x5c
je 0x407330
cmp dword [esi + 0x10], ecx
ja 0x40731f
push str.invalid_string_position
call fcn.005fe693
cmp edx, edi
jb 0x407325
mov esi, dword [esi]
cmp word [esi + ecx*2], 0x2f
jne case.0x4072a4.0
cmp dword [esp + 0x24], edi
jb 0x407343
mov edx, dword [esp + 0x10]
push edx
call fcn.004effaf
add esp, 4
mov al, 1
jmp 0x407387
test byte [esp + 0x2c], 0x10
push eax
je 0x40736c
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x24], edi
jb 0x407343
mov eax, dword [esp + 0x10]
push eax
call fcn.004effaf
add esp, 4
mov al, 1
jmp 0x407387
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x24], edi
jb 0x407385
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004effaf
add esp, 4
xor al, al
mov ecx, dword [esp + 0x288]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x274]
xor ecx, esp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x4078d0
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x643bf8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
xor ebx, ebx
xor ecx, ecx
push ebx
mov word [ebp - 0x2c], cx
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
call fcn.00403240
lea eax, [ebx + 0x20]
lea edi, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.00401880
lea edi, [ebx + 8]
cmp dword [ebp - 0x1c], ebx
je 0x40794d
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x40793d
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
cmp al, bl
jne 0x407965
cmp dword [ebp - 0x18], edi
jb 0x40795e
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004effaf
add esp, 4
mov al, 1
jmp 0x407a38
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004effa4
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x407991
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
add eax, 2
push eax
push esi
call fcn.005dfa9d
mov edx, dword [ebp - 0x1c]
xor eax, eax
xor ecx, ecx
mov word [esi + edx*2], cx
mov ecx, dword [ebp - 0x1c]
mov word [esi + ecx*2 + 2], ax
mov edx, 0x414
mov dword [ebp - 0x40], eax
or word [ebp - 0x40], dx
add esp, 0xc
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], eax
mov word [ebp - 0x34], ax
mov dword [ebp - 0x3a], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x36], ebx
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], ebx
cmp byte [ebp + 0xc], bl
je 0x4079f9
or word [ebp - 0x40], 0x40
jmp 0x407a02
mov eax, 0xffbf
and word [ebp - 0x40], ax
lea ecx, [ebp - 0x50]
push ecx
mov byte [ebp - 0x2d], 1
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x407a17
mov byte [ebp - 0x2d], bl
cmp esi, ebx
je 0x407a24
push esi
call fcn.004effaf
add esp, 4
cmp dword [ebp - 0x18], edi
jb 0x407a35
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004effaf
add esp, 4
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x407e90
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [esi + 0x10], 0
push ebx
push edi
je 0x407f39
mov ebx, 8
cmp dword [esi + 0x14], ebx
jb 0x407ead
mov eax, dword [esi]
jmp 0x407eaf
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
je 0x407f39
mov ecx, esi
call fcn.004071f0
test al, al
je 0x407ed0
xor al, al
pop edi
pop ebx
pop ebp
ret
cmp dword [esi + 0x14], ebx
jb 0x407ed9
mov eax, dword [esi]
jmp 0x407edb
mov eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
jne 0x407f39
cmp byte [ebp + 8], al
je 0x407f39
cmp dword [esi + 0x14], ebx
jb 0x407ef6
mov eax, dword [esi]
jmp 0x407ef8
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x407f19
and eax, 0xfffffffe
cmp dword [esi + 0x14], ebx
jb 0x407f0f
mov ecx, dword [esi]
jmp 0x407f11
mov ecx, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [esi + 0x14], ebx
jb 0x407f22
mov eax, dword [esi]
jmp 0x407f24
mov eax, esi
push eax
call edi
test eax, eax
jne 0x407f39
mov edi, dword [ebp + 0xc]
mov ecx, esi
call fcn.00408af0
pop edi
pop ebx
pop ebp
ret
pop edi
mov al, 1
pop ebx
pop ebp
ret

Function at 0x407f40
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x646470
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
mov eax, dword [0x6c3afc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 0x10], ebx
jne 0x407f84
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x407f8e
mov eax, dword [esi]
jmp 0x407f90
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
push 0x688638
test al, 0x10
je 0x408000
xor eax, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
call fcn.00403600
lea ecx, [ebp - 0x28]
push ecx
push esi
mov dword [ebp - 4], ebx
call fcn.00407a60
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 8
jb 0x407fe2
mov edx, dword [ebp - 0x28]
push edx
call fcn.004effaf
add esp, 4
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.004078d0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov word [ebp - 0x44], cx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], ebx
call fcn.00403600
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x44]
push edx
push eax
mov dword [ebp - 4], 1
call fcn.00407e90
add esp, 8
cmp dword [ebp - 0x30], 8
mov bl, al
jb 0x408043
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.004effaf
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409070
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
jne 0x409080
xor al, al
pop ebp
ret
cmp dword [eax + 0x14], 8
jb 0x409088
mov eax, dword [eax]
push ebx
mov bl, byte [ebp + 0x14]
xor ecx, ecx
push esi
test bl, bl
setne cl
push 0
push 0x80
lea ecx, [ecx + ecx + 2]
push ecx
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4090bd
pop esi
xor al, al
pop ebx
pop ebp
ret
test bl, bl
je 0x4090ce
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push 0
lea edx, [ebp + 8]
push edx
push eax
push ecx
push esi
mov bl, 1
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4090f2
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x409100
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
jne 0x409113
xor al, al
mov esp, ebp
pop ebp
ret
cmp dword [eax + 0x14], 8
jb 0x40911b
mov eax, dword [eax]
push esi
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409143
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp + 8]
push eax
push esi
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp + 8], 0
mov edi, eax
je 0x40916d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x409185
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], edi
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
cmp edi, eax
jbe 0x4091a0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 0x14]
mov dword [edx], edi
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x4091a6
mov eax, edi
mov edx, dword [ebp + 0xc]
push ebx
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push edx
push esi
mov bl, 1
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4091c8
xor bl, bl
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
push esi
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409210
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x643247
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6c3afc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [edi], 0x688810
mov dword [edi + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 0x10]
push esi
mov dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x10], 1
call fcn.00409e20
mov dword [ebp - 4], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], 0x68880c
call fcn.0040a5f0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], 0x6887d0
mov byte [esi + 0x50], bl
mov byte [esi + 0x49], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x6cd9fc]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a390
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x637708
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x40a4b0
cmp byte [edi + 0x49], bl
je 0x40a4b0
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x40a4a4
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x40a404
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x40a41c
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x40a445
dec eax
je 0x40a449
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x40a49f
jmp 0x40a4ab
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x40a459
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x40a482
cmp ebx, 0x10
jae 0x40a468
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.005defb7
add esp, 0x10
cmp esi, eax
jne 0x40a49c
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x40a4a8
test esi, esi
jne 0x40a410
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00402040
jmp 0x40a40a
lea ecx, [ebp - 0x2c]
call fcn.004037f0
xor al, al
jmp 0x40a4b2
lea ecx, [ebp - 0x2c]
call fcn.004037f0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x40a5f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6429db
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6c3afc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.005fe9f9
push 4
mov dword [ebp - 4], 0
call fcn.004eff75
mov edi, eax
add esp, 4
test edi, edi
je 0x40a66c
call fcn.005feead
mov dword [edi], eax
call fcn.005fec6c
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.005fe9ba
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40a662
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.005fe9e2
jmp 0x40a66e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40be20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x643858
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], esi
jb 0x40be65
mov eax, dword [eax]
lea edx, [ebp - 0x3c]
push edx
mov edx, dword [ebp + 0x18]
or edx, 0x20019
push edx
xor edi, edi
push edi
push eax
mov eax, dword [ecx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40be8b
xor al, al
jmp 0x40bfbd
lea ecx, [ebp - 0x34]
push ecx
push edi
lea edx, [ebp - 0x38]
push edx
push edi
mov ecx, ebx
mov dword [esi], edi
mov byte [ebp - 0x2d], 0
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
call fcn.00403dd0
push eax
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x40bec2
cmp eax, edi
jne 0x40bfb0
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004effa4
mov ecx, dword [ebp - 0x34]
add esp, 4
mov esi, eax
test ecx, ecx
je 0x40befe
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
mov edi, esi
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push esi
lea ecx, [ebp - 0x38]
push ecx
xor edi, edi
push edi
mov ecx, ebx
call fcn.00403dd0
mov edx, dword [ebp - 0x3c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x40bfa3
mov eax, dword [ebp - 0x38]
cmp eax, 1
jne 0x40bf4c
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40bf31
mov ecx, dword [ebp - 0x40]
sub eax, edx
sar eax, 1
push eax
push esi
call fcn.00403600
jmp 0x40bf97
cmp eax, 7
je 0x40bf56
cmp eax, 2
jne 0x40bf97
mov eax, dword [ebp - 0x34]
inc eax
shr eax, 1
xor ecx, ecx
push eax
mov word [ebp - 0x2c], cx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
call fcn.00403600
mov ecx, dword [ebp - 0x40]
lea edx, [ebp - 0x2c]
push edx
mov dword [ebp - 4], edi
call fcn.00402260
cmp dword [ebp - 0x18], 8
jb 0x40bf97
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004effaf
add esp, 4
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x38]
mov dword [ecx], edx
mov byte [ebp - 0x2d], 1
cmp esi, edi
je 0x40bfb0
push esi
call fcn.004effaf
add esp, 4
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40bfe0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], 0
jb 0x40bff6
mov eax, dword [eax]
push 0
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 0x18]
push 0
or edx, 0x2001b
push edx
push 0
push 0
push 0
push eax
mov eax, dword [ecx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40c024
xor al, al
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x40c032
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
jb 0x40c03d
mov ecx, dword [ecx]
push ebx
lea edx, [edx + edx + 2]
push edx
push eax
mov eax, dword [ebp + 0x14]
push eax
push 0
push ecx
mov ecx, dword [ebp - 4]
push ecx
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40c05d
xor bl, bl
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x40edc0
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov byte [eax + 0x68], cl
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x40edf0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret