joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042a31
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x1018fea0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10042a77
cmp word [ebx], dx
jne 0x10042a77
or byte [eax + edi + 0x28], 4
jmp 0x10042a7c
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10042bdf
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10042bbf
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10042abd
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10042af3
cmp eax, edx
jae 0x10042b01
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10042a98
jmp 0x10042bdf
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10042bba
cmp dword [ebp - 0x18], 0
je 0x10042bba
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x1018fea0]
test byte [eax + edi + 0x28], 0x48
je 0x10042b90
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x10042b54
mov word [esi], cx
jmp 0x10042b8b
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x1018fea0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x1018fea0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x1018fea0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10042bdf
pop eax
cmp word [ebp - 4], ax
jne 0x10042ba0
cmp esi, ebx
jne 0x10042ba0
mov word [esi], ax
jmp 0x10042bdc
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10042736
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10042bdf
push 0xd
pop eax
jmp 0x10042b9b
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x1018fea0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10042bd9
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10042bdf
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10044bd1
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10044aa5

Function at 0x10048dd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10048dfd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10048dfd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10001589
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
cmp dword [ebx + 0x432024], 0
jne 0x100015b2
push ecx
push edx
call dword [ebx + 0x433118]
push 0
mov dword [esp], edi
sub edi, edi
or edi, eax
mov dword [ebx + 0x432024], edi
pop edi
pop edx
pop ecx
push edx
push ecx
mov dword [ebp - 8], edx
sub edx, dword [ebp - 8]
or edx, dword [ebp + 8]
and eax, 0
or eax, edx
mov edx, dword [ebp - 8]
push edx
mov edx, dword [eax + 0x3c]
push eax
pop dword [ebp - 8]
add dword [ebp - 8], edx
push dword [ebp - 8]
pop eax
pop edx
push eax
push ebx
xor ebx, dword [esp]
or ebx, eax
and edi, 0
xor edi, ebx
pop ebx
movzx eax, word [edi + 6]
push 0
mov dword [esp], ebx
xor ebx, ebx
xor ebx, eax
mov dword [ebp - 4], ebx
pop ebx
push edi
push 0
mov dword [esp], ecx
sub ecx, ecx
xor ecx, dword [edi + 0x54]
mov edx, ecx
pop ecx
mov dword [ebp - 8], esi
xor esi, esi
xor esi, dword [ebx + 0x432030]
mov edi, esi
mov esi, dword [ebp - 8]
push edx
xor edx, dword [esp]
or edx, dword [ebp + 8]
and esi, 0
or esi, edx
pop edx
push ebp
and ebp, 0
or ebp, edx
and ecx, 0
xor ecx, ebp
pop ebp
cmp edi, esi
je 0x10001663
movsb byte es:[edi], byte [esi]
dec ecx
jne 0x1000162e
push ecx
sub ecx, dword [esp]
xor ecx, dword [ebx + 0x432030]
and edi, 0
or edi, ecx
pop ecx
mov dword [ebx + 0x4320b2], 0x40
lea eax, [ebx + 0x4320b2]
push eax
push ecx
mov dword [esp], 2
push edx
push edi
call dword [ebx + 0x4330e8]
pop edi
push esi
mov esi, edi
add esi, 0xf8
mov edi, esi
pop esi
push edi
push edi
sub edi, dword [esp]
xor edi, dword [ebp + 8]
and esi, 0
or esi, edi
pop edi
mov dword [ebp - 8], eax
and eax, 0
or eax, dword [edi + 0x10]
and ecx, 0
or ecx, eax
mov eax, dword [ebp - 8]
push 0
mov dword [esp], edx
push esi
pop edx
add edx, dword [edi + 0x14]
mov esi, edx
pop edx
mov edi, dword [edi + 0xc]
push 0
mov dword [esp], ecx
push edi
pop ecx
add ecx, dword [ebx + 0x432030]
mov edi, ecx
pop ecx
rep movsb byte es:[edi], byte [esi]
pop edi
push ebp
mov ebp, edi
add ebp, 0x28
mov edi, ebp
pop ebp
dec dword [ebp - 4]
jne 0x10001670
pop edi
push esi
and esi, 0
or esi, dword [edi + 0x28]
and eax, 0
or eax, esi
pop esi
push esi
mov esi, dword [ebx + 0x432030]
push eax
pop dword [ebp - 8]
add dword [ebp - 8], esi
push dword [ebp - 8]
pop eax
pop esi
push edx
xor edx, dword [esp]
or edx, eax
and dword [ebx + 0x432058], 0
xor dword [ebx + 0x432058], edx
pop edx
push 0
mov dword [esp], edi
sub edi, edi
xor edi, dword [ebx + 0x432030]
mov esi, edi
pop edi
cmp esi, 0
jbe 0x10001719
push esi
call fcn.10001c90
push esi
call fcn.100017d9
pop ecx
pop edx
leave
ret 4
Function at 0x10001e79
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push eax
push ecx
push edi
push edi
mov edi, eax
xor edi, eax
mov eax, edi
pop edi
and dword [ebp - 4], eax
push eax
pop dword [ebp - 8]
push dword [ebp - 8]
pop ecx
mov dword [ebp - 8], edx
and edx, 0
or edx, eax
and ebx, 0
xor ebx, edx
mov edx, dword [ebp - 8]
lea eax, [0x401e79]
push dword [ebp + 4]
xor dword [esp], ebx
pop ebx
push edi
mov edi, ecx
add edi, 0xffff0000
mov ecx, edi
pop edi
cmp ecx, 0
jbe 0x10001ec5
and ebx, ecx
push edi
mov dword [esp], 3
pop ecx
push ecx
mov dword [esp], 0xf00000
pop edi
push 0
xor dword [esp], edx
push dword [ebp - 4]
pop edx
add edx, edi
mov dword [ebp - 4], edx
pop edx
shl edi, 4
dec ecx
jne 0x10001ed7
and eax, dword [ebp - 4]
push esi
mov esi, ebx
sub esi, eax
mov ebx, esi
pop esi
pop edi
pop ecx
pop eax
leave
ret
Function at 0x40cbc7
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x41a2f8
call fcn.00413724
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x41b69c
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x41b754
push 4
mov ebx, 0x41b68c
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00403291
mov dword [esi + 0x3c], 0x41b804
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.00403291
mov dword [edi], 0x41b80c
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.0040c1be
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.0040c1be
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.0040c1be
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b761
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.0040c1be
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.0040c1be
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x412ff0
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call fcn.0041468e
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x413018
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413027
mov eax, 1
ret 4

Function at 0x4151e0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ba30
push 0x4147fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x4151f9
mov ecx, dword [eax + 0x1c]
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x4151f9
and dword [ebp - 4], 0
push ecx
push dword [eax + 0x18]
invalid
mov esp, ecx
Function at 0x416990
Capabilities:
Terminate process

Disassembly:
pop edi
cmp dword [0x423420], edi
jne 0x4169aa
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [esp + 0xc], 0
push ebx
mov ebx, dword [esp + 0x14]
mov dword [0x42341c], edi
mov byte [0x423418], bl
jne 0x4169fe
mov eax, dword [0x425a30]
test eax, eax
je 0x4169ed
mov ecx, dword [0x425a2c]
push esi
lea esi, [ecx - 4]
cmp esi, eax
jb 0x4169ec
mov eax, dword [esi]
test eax, eax
je 0x4169e1
call eax
sub esi, 4
cmp esi, dword [0x425a30]
jae 0x4169d9
pop esi
push 0x420048
push 0x420044
call fcn.00416a3f
pop ecx
pop ecx
push 0x420054
push 0x42004c
call fcn.00416a3f
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x416a1b
call fcn.00416a36
pop edi
ret
push dword [esp + 8]
mov dword [0x423420], edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x416a66
Capabilities:
Terminate process

Disassembly:
inc ecx
add byte [ecx], ah
add byte [eax], al
add byte [eax + 0x64], dl
mov dword [0], esp
sub esp, 0x1c
in al, dx
sbb al, 0x53

Function at 0x416a77
Capabilities:
Terminate process

Disassembly:
in al, dx
sbb al, 0x53
push esi
push edi
mov eax, dword [0x425a58]
cmp eax, 3
jne 0x416acc
push 9
call fcn.004153da
pop ecx
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
push esi
call fcn.0041576d
pop ecx
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x416aae
mov esi, dword [esi - 4]
sub esi, 9
mov dword [ebp - 0x20], esi
jmp 0x416ab1
mov esi, dword [ebp - 0x20]
or dword [ebp - 4], 0xffffffff
call fcn.00416ac3
cmp dword [ebp - 0x1c], 0
jmp 0x416b15
cmp eax, 2
jne 0x416b17
push 9
call fcn.004153da
pop ecx
mov dword [ebp - 4], 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
call fcn.004164c8
add esp, 0xc
mov dword [ebp - 0x28], eax
test eax, eax
je 0x416b05
movzx ebx, byte [ecx + 0x59]
push 0x420054
push 0x42004c
add byte [edx], al
call fcn.00416b3f
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x416b1b
call fcn.00416b36
sbb eax, 0x5f000000
add byte [eax], al
pop edi
ret
push dword [esp + 8]
mov dword [0x423420], edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401aa0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.0041fe10
mov eax, dword [0x42e00c]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x42e054], 1
push esi
jl 0x401afc
lea eax, [ebp + 0xc]
mov edx, 0x2000
push eax
push ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x200c]
call fcn.00401a70
add esp, 0xc
mov esi, eax
lea eax, [ebp - 0x200c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0041e725
mov esp, ebp
pop ebp
ret

Function at 0x401b10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x42e00c]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x42e054], 2
push esi
jl 0x401b7f
push str.JHI_Service:
lea eax, [ebp - 0x40c]
push 0xe
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
lea eax, [ebp + 0xc]
mov edx, 0x3f3
push eax
push ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x3ff]
call fcn.00401a70
add esp, 0xc
mov esi, eax
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0041e725
mov esp, ebp
pop ebp
ret

Function at 0x401b90
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x42e00c]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x42e054], 2
jl 0x401bcf
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x80c]
call fcn.00401a30
add esp, 0xc
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 8]
xor eax, eax
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret
Function at 0x402dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 8], 0x206
mov dword [ebp - 0xc], 1
push edi
mov edi, edx
test esi, esi
je 0x402e4d
test edi, edi
je 0x402e4d
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push str.SoftwareIntelServicesDAL
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x402e1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_open_Registry__0x_x__n
call fcn.00401b10
add esp, 8
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
test eax, eax
je 0x402e55
push str.Registry_read_failure_for__s_n
call fcn.00401b10
add esp, 8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
shr eax, 1
cmp word [edi + eax*2], 0
lea edi, [edi + eax*2]
je 0x402e87
push str.Registry_read_failure_for__s__string_is_not_NULL_terminated_n
call fcn.00401b10
add esp, 8
xor eax, eax
mov word [edi], ax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.Registry_read_success_for__s_n
call fcn.00401b10
add esp, 8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402eb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
push edi
mov edi, edx
test esi, esi
je 0x402f05
test edi, edi
je 0x402f05
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push str.SoftwareIntelServicesDAL
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x402f0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_open_Registry__0x_x__n
call fcn.00401b10
add esp, 8
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x402f45
push esi
push str.Registry_read_integer_key__s_failed._n
call fcn.00401b10
add esp, 8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402fe0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
mov dword [ebp - 8], ecx
push eax
push 0x20106
push 0
push str.SoftwareIntelServicesDAL
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x403025
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_open_Registry__0x_x__n
call fcn.00401b10
add esp, 8
mov eax, 0x501
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.JHI_SERVICE_PORT
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40305d
push str.write_port_number_to_registry_success_n
call fcn.00401b10
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
push str.write_port_number_to_registry_failed_n
call fcn.00401b10
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x501
mov esp, ebp
pop ebp
ret

Function at 0x403080
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
mov dword [ebp - 8], ecx
push eax
push 0x20106
push 0
push str.SoftwareIntelServicesDAL
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4030c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_open_Registry__0x_x__n
call fcn.00401b10
add esp, 8
mov eax, 0x501
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.JHI_ADDRESS_TYPE
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4030fd
push str.write_address_to_registry_success_n
call fcn.00401b10
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
push str.write_address_to_registry_failed_n
call fcn.00401b10
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x501
mov esp, ebp
pop ebp
ret
Function at 0x403a80
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420008
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x42e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x58]
mov esi, dword [ebp + 8]
push ebx
push esi
push eax
mov dword [ebp - 0x5c], esi
call fcn.00404c10
push ebx
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.00404dc0
xor bl, 1
mov byte [ebp - 4], 1
movzx eax, bl
push eax
push esi
lea eax, [ebp - 0x40]
push eax
call fcn.00404dc0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
add esp, 4
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae eax, dword [ebp - 0x40]
push eax
call esi
add esp, 4
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x58]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x44], 8
push ecx
cmovae eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]
add esp, 8
test eax, eax
je 0x403b4a
push str.rename_file_failed_n
call fcn.00401b10
add esp, 4
xor bl, bl
jmp 0x403b78
push 0xffffffffffffffff
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x5c]
lea eax, [ebp - 0x60]
mov ecx, edi
push eax
call fcn.00408170
mov eax, dword [ebp - 0x60]
mov dword [eax + 0x28], 2
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov bl, 1
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x403b8a
inc eax
push eax
push dword [ebp - 0x40]
call fcn.004025b0
xor eax, eax
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], 7
cmp eax, 8
jb 0x403bb0
inc eax
push eax
push dword [ebp - 0x28]
call fcn.004025b0
mov ecx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp ecx, 8
jb 0x403bd6
inc ecx
push ecx
push dword [ebp - 0x58]
call fcn.004025b0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret 8
Function at 0x4066c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4203b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x42e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
cmp dword [ebx + 0x38], 0
je 0x4067fc
cmp byte [ebx + 0x3d], 0
je 0x4067fc
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x40671c
xor al, al
jmp 0x4067fe
push ecx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00406350
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
cmp esi, 0x10
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
cmovae edx, edi
lea ecx, [ebp - 0x28]
cmovae ecx, edi
add eax, edx
push eax
push ecx
mov ecx, dword [ebx + 0x38]
lea eax, [ebx + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x40678a
sub eax, 1
je 0x40678e
sub eax, 2
je 0x4067ee
lea ecx, [ebp - 0x28]
xor bl, bl
call fcn.00402470
mov al, bl
jmp 0x4067fe
mov byte [ebx + 0x3d], 0
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x28]
cmp esi, 0x10
mov ebx, dword [ebp - 0x30]
cmovae eax, edi
sub ebx, eax
je 0x4067ca
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
cmp esi, 0x10
cmovae eax, edi
push dword [ecx + 0x4c]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebx, eax
jne 0x40677c
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 0x3d], 0
je 0x4067ee
test ebx, ebx
mov ebx, eax
jne 0x406746
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.004063f0
jmp 0x406740
lea ecx, [ebp - 0x28]
mov bl, 1
call fcn.00402470
mov al, bl
jmp 0x4067fe
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e725
mov esp, ebp
pop ebp
ret