joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70c0e200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x70c0e24a
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x70c0e1f1
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x70c0e200
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x71013ea3
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x70c0e251
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.70bf50c7
cmp eax, dword [ebp + 0xc]
pop eax
je 0x70c0e2f0
add edi, 4
add eax, 2
dec ecx
jne 0x70c0e236
call 0x70c0e29d
loope 0x70c0e293
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x70c0e2ed
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x70c0e2fe
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x70c0e2b1
cmp eax, ecx
ja 0x70c0e2b1
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x70c0e33b
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x70c0e331
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.70bf55a6
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x425c88
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x425cc7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x425cc7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x425cc7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x425cc7
cmp dword [ecx + 0x74], 0xe
jbe 0x425cc7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42d42b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42d4c8
push ebx
push esi
call fcn.0042d3f4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042d388
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42d475
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42d4c7
push edi
push eax
call fcn.0042bec0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42d495
call fcn.0042bf0e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42d4c6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042d388
add esp, 0x20
test eax, eax
jne 0x42d4b4
push edi
call fcn.0042bf0e
jmp 0x42d4bc
push ebx
call fcn.0042bf0e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42e6d7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x436e90
push 0x436e88
push str.FlsAlloc
push 0x1f
call fcn.0042e596
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42e70b
push dword [ebp + 8]
mov ecx, esi
call dword [0x434144]
call esi
jmp 0x42e711
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42e755
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x436ea0
push 0x436e98
push str.FlsGetValue
push 0x21
call fcn.0042e596
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42e78c
push dword [ebp + 8]
mov ecx, esi
call dword [0x434144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42e794
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x436ea8
push 0x436ea0
push str.FlsSetValue
push 0x22
call fcn.0042e596
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42e7ce
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x434144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x433aa0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x433acd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x433acd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401060
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
mov dword [ebx], eax
push edi
mov dword [ebx + 4], eax
lea eax, [ebp - 4]
push eax
xor edi, edi
push ecx
mov dword [ebp - 4], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
je 0x4010b3
push esi
mov dword [ebp + 0xc], edi
call fcn.004208c6
mov edx, dword [ebp + 8]
add esp, 4
mov edi, eax
push edi
push esi
push 0
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x4010be
push edi
call fcn.0042088c
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 8]
push eax
lea ecx, [ebp + 0xc]
push ecx
push 0x43d3d0
push edi
mov dword [ebp - 8], 0
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4010aa
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4010eb
cmp dword [eax], 0xfeef04bd
jne 0x4010aa
mov edx, dword [eax + 8]
mov dword [ebx], edx
mov eax, dword [eax + 0xc]
push edi
mov dword [ebx + 4], eax
call fcn.0042088c
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x401230
Capabilities:
Read file via mapping

Disassembly:
push esi
push 0
push 0
push 3
push 0
push 1
mov esi, ecx
mov eax, dword [esi + 4]
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 8], eax
test eax, eax
je 0x401289
cmp eax, 0xffffffff
je 0x401289
push 0
push 0
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0xc], eax
test eax, eax
je 0x401289
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x10], eax
test eax, eax
setne al
pop esi
ret
xor al, al
pop esi
ret

Function at 0x4016e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push 1
push edx
call fcn.00421025
add esp, 0x10
pop ebp
ret 8

Function at 0x401720
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push 1
push edx
call fcn.004212d1
add esp, 0x10
pop ebp
ret 8
Function at 0x401cb0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 1
push 2
mov esi, ecx
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x194], eax
cmp eax, 0xffffffff
jne 0x401cde
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 4]
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
js 0x401cd5
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x194]
push 0x10
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x401d32
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2734
je 0x401d1e
cmp eax, 0x2733
jne 0x401cd5
mov ecx, dword [esi + 0x250]
push ecx
push 1
mov ecx, esi
call fcn.00401b30
test al, al
je 0x401cd5
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4023d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov esi, ecx
test ebx, ebx
jle 0x40245a
mov eax, dword [esi + 0x258]
push eax
push 1
mov ecx, esi
call fcn.00401b30
test al, al
je 0x402421
mov edx, dword [ebp + 8]
push 0
mov ecx, ebx
sub ecx, edi
push ecx
mov ecx, dword [esi + 0x194]
lea eax, [edi + edx]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x40242d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x402456
pop edi
pop esi
mov eax, 0xfffffffc
pop ebx
pop ebp
ret 8
add dword [esi + 0x234], eax
add edi, eax
mov eax, dword [esi + 0x248]
test eax, eax
je 0x402456
mov ecx, dword [esi + 0x24c]
lea edx, [esi + 0x224]
push edx
push ecx
call eax
add esp, 8
test al, al
je 0x402466
cmp edi, ebx
jl 0x4023e1
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret 8
Function at 0x402470
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.004220a0
mov eax, dword [0x44ac68]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x100c]
call fcn.00401660
push 0x43d408
push edi
lea ecx, [ebp - 0x100c]
call fcn.00401670
lea ecx, [ebp - 0x100c]
test al, al
jne 0x4024d0
call fcn.00401790
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042008f
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push eax
mov dword [ebp - 0x1014], ebx
mov dword [esi + 0x23c], ebx
mov dword [esi + 0x240], 0
call fcn.004016c0
test eax, eax
je 0x40251a
lea ecx, [ebp - 0x100c]
call fcn.00401790
pop ebx
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042008f
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp - 0x1010]
test ebx, ebx
je 0x402608
jmp 0x402530
lea ecx, [ebp - 0x100c]
call fcn.00401750
test al, al
jne 0x402608
push 0x1000
lea ecx, [ebp - 0x1004]
push ecx
lea ecx, [ebp - 0x100c]
call fcn.004016e0
mov dword [ebp - 0x1010], eax
cmp eax, ebx
jge 0x402566
mov ebx, eax
add dword [esi + 0x240], ebx
xor edi, edi
test ebx, ebx
jle 0x4025ed
mov edx, dword [esi + 0x258]
push edx
push 1
mov ecx, esi
call fcn.00401b30
test al, al
je 0x4025b3
mov edx, dword [esi + 0x194]
push 0
mov eax, ebx
sub eax, edi
push eax
lea ecx, [ebp + edi - 0x1004]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4025ba
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4025e3
mov edi, 0xfffffffc
jmp 0x402608
add dword [esi + 0x234], eax
add edi, eax
mov eax, dword [esi + 0x248]
test eax, eax
je 0x4025e3
mov edx, dword [esi + 0x24c]
lea ecx, [esi + 0x224]
push ecx
push edx
call eax
add esp, 8
test al, al
je 0x402605
cmp edi, ebx
jl 0x402572
mov eax, dword [ebp - 0x1010]
sub dword [ebp - 0x1014], eax
mov edi, 1
je 0x402608
mov ebx, dword [ebp - 0x1014]
jmp 0x402530
or edi, 0xffffffff
xor eax, eax
lea ecx, [ebp - 0x100c]
mov dword [esi + 0x23c], eax
mov dword [esi + 0x240], eax
call fcn.00401790
mov ecx, dword [ebp - 4]
pop ebx
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0042008f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404c60
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push esi
mov esi, ecx
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, 2
push edi
mov word [esi], ax
call fcn.00404ba0
add esp, 4
push edi
test al, al
je 0x404c95
call dword [sym.imp.WS2_32.dll_inet_addr]
jmp 0x404ca6
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x404ca9
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esi + 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0042188c
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 2], ax
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x405660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jle 0x4056c0
mov eax, dword [ebp + 8]
mov ecx, eax
and ecx, 0x8000000f
jns 0x405684
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp cl, 0xa
jge 0x40568e
add cl, 0x30
jmp 0x405691
add cl, 0x37
cdq
and edx, 0xf
add eax, edx
mov byte [ebx + esi], cl
sar eax, 4
inc ebx
cmp eax, 1
je 0x4056ad
test eax, eax
je 0x4056b7
cmp ebx, edi
jl 0x405675
jmp 0x4056c0
cmp ebx, edi
jge 0x4056c0
mov byte [ebx + esi], 0x31
jmp 0x4056bf
cmp ebx, edi
jge 0x4056c0
mov byte [ebx + esi], 0x30
inc ebx
mov eax, ebx
cdq
sub eax, edx
mov edi, eax
sar edi, 1
xor ecx, ecx
test edi, edi
jle 0x4056f2
lea edx, [ebx + esi - 1]
movsx ebx, byte [ecx + esi]
movsx eax, byte [edx]
xor eax, ebx
mov byte [ecx + esi], al
movsx ebx, byte [edx]
movsx eax, al
xor ebx, eax
mov byte [edx], bl
xor byte [ecx + esi], bl
inc ecx
dec edx
cmp ecx, edi
jl 0x4056d3
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4066a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x44ac68]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push esi
mov esi, dword [0x44d2d4]
push edi
push 0xf0
push eax
mov edi, 1
push esi
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x406868
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x406868
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406868
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x406716
mov edi, dword [ebp - 0x10c]
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x406853
mov edx, dword [esi + 4]
mov edi, eax
movzx eax, word [esi + 2]
mov ecx, 0x403
add esi, 8
mov dword [ebp - 0x114], edx
cmp cx, ax
jne 0x4067a6
push 3
lea edx, [ebp - 0x104]
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x108], edx
call fcn.00405cc0
mov eax, dword [ebp - 0x108]
mov edx, dword [ebp - 0x110]
push eax
mov eax, dword [edx + 4]
push 0
push 0x143
push edi
push eax
call ebx
cmp eax, 0xffffffff
jne 0x406784
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x104]
cmp eax, ecx
je 0x406827
push eax
call fcn.0042088c
add esp, 4
jmp 0x406827
mov edx, 0x1234
cmp dx, ax
jne 0x406827
push 3
lea eax, [ebp - 0x104]
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x134], 0xffffffff
mov dword [ebp - 0x108], eax
call fcn.00405cc0
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x130], eax
cmp eax, ecx
je 0x4067fd
push eax
call fcn.0042088c
add esp, 4
mov ecx, dword [ebp - 0x110]
lea edx, [ebp - 0x138]
push edx
mov edx, dword [ecx + 4]
push 0
push 0x40b
push edi
push edx
call ebx
cmp eax, 0xffffffff
jne 0x406827
mov dword [ebp - 0x10c], 0
add esi, dword [ebp - 0x114]
cmp dword [ebp - 0x10c], 0
jne 0x406710
mov eax, dword [ebp - 0x10c]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042008f
mov esp, ebp
pop ebp
ret 4
pop ebx
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042008f
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0042008f
mov esp, ebp
pop ebp
ret 4
Function at 0x409770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push 0x43db90
mov dword [ebp - 4], ecx
push eax
lea ecx, [ebp + 8]
push ecx
xor bl, bl
call fcn.00422ae2
add esp, 0xc
test eax, eax
je 0x40979e
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp + 8]
push esi
push edi
push 2
push 0
push edx
call fcn.00420d5f
mov eax, dword [ebp + 8]
push eax
call fcn.0042304d
mov ecx, dword [ebp + 8]
push 0
push 0
push ecx
mov edi, eax
call fcn.00420d5f
lea eax, [edi + 1]
add esp, 0x1c
xor esi, esi
test eax, eax
je 0x4097e5
cmp eax, 0xffffffff
ja 0x409834
push eax
call fcn.004217f6
mov esi, eax
add esp, 4
test esi, esi
je 0x409834
mov edx, dword [ebp + 8]
push edx
push 1
push edi
push esi
call fcn.00421025
add esp, 0x10
cmp eax, 1
jne 0x409809
mov ecx, dword [ebp - 4]
push esi
mov byte [esi + edi], 0
call fcn.004095e0
mov bl, al
mov eax, dword [ebp + 8]
push eax
call fcn.00420c61
push esi
call fcn.00420084
add esp, 8
pop edi
pop esi
test bl, bl
jne 0x40982b
mov ecx, dword [ebp - 4]
push 0
call fcn.004095e0
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.00421b93
push 0x445430
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 0x10], vtable.std::bad_alloc.0
call fcn.00420482
int3
Function at 0x40a610
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x44ac68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push edi
or ecx, 0x2001f
push ecx
xor ebx, ebx
push eax
push edx
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x208], ebx
call fcn.00409ee0
mov edi, eax
cmp edi, ebx
je 0x40a68a
mov eax, dword [ebp - 0x210]
cmp eax, ebx
je 0x40a675
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042008f
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x210]
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x204]
push edx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
mov dword [ebp - 0x214], pe_nt_image_headers32
call ebx
test eax, eax
jne 0x40a708
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x210]
call fcn.0040a610
mov edi, eax
test edi, edi
jne 0x40a741
lea edx, [ebp - 0x220]
push edx
mov edx, dword [ebp - 0x210]
push eax
push eax
push eax
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x204]
push ecx
push edi
push edx
mov dword [ebp - 0x214], pe_nt_image_headers32
call ebx
test eax, eax
je 0x40a6c0
mov eax, dword [ebp - 0x210]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
cmp eax, edi
je 0x40a723
push eax
call ebx
mov dword [ebp - 0x210], edi
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x20c], edi
push eax
cmp ecx, edi
je 0x40a76b
mov edx, dword [esi]
push edx
call fcn.00409cb0
jmp 0x40a774
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x40a675
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042008f
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [ebp - 0x210]
cmp eax, edi
je 0x40a783
push eax
call ebx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042008f
mov esp, ebp
pop ebp
ret 4
Function at 0x40c730
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x44ac68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x40c], ecx
xor ecx, ecx
push 2
push ecx
push eax
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x408], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c77f
call fcn.00409bf0
mov esi, eax
jmp 0x40c826
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40c798
call fcn.00409bf0
jmp 0x40c81d
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x40c7ad
call fcn.00409bf0
jmp 0x40c81d
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x40c7c5
mov esi, 0x8007000e
jmp 0x40c81f
push eax
lea ecx, [ebp - 0x408]
call fcn.0040ad60
mov eax, dword [ebp - 0x408]
test eax, eax
jne 0x40c7e2
mov esi, 0x8007000e
jmp 0x40c81f
push esi
push eax
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x40c7fb
call fcn.00409bf0
jmp 0x40c81d
mov edx, dword [ebp - 0x408]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x408]
push eax
push ecx
lea ecx, [ebp - 0x410]
call fcn.0040c1a0
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x404]
cmp dword [ebp - 0x408], edx
je 0x40c840
lea ecx, [ebp - 0x408]
call fcn.0040a5b0
nop
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042008f
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40d000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push esi
push 0x43d408
xor esi, esi
push eax
mov dword [ebp - 8], esi
call fcn.00420b96
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
jne 0x40d031
mov ecx, dword [ebp + 0x14]
mov dword [ecx], esi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
push edi
jmp 0x40d03b
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
push eax
push ebx
push 1
push edx
xor edi, edi
call fcn.00421025
mov esi, eax
add esp, 0x10
cmp esi, ebx
jae 0x40d066
mov eax, dword [ebp - 4]
push eax
call fcn.00421531
add esp, 4
test eax, eax
jne 0x40d066
or edi, 0xffffffff
test esi, esi
je 0x40d07e
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
push esi
push ecx
push edx
call fcn.00435e60
add esp, 0xc
mov dword [ebp - 8], eax
test edi, edi
jne 0x40d086
test esi, esi
jne 0x40d038
mov eax, dword [ebp - 4]
push eax
call fcn.00420c61
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 8]
add esp, 4
mov eax, edi
pop edi
pop ebx
mov dword [ecx], edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d660
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareSysinternalsHandle
push connect
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40d6a3
xor al, al
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push 4
lea edx, [ebp - 0xc]
push edx
push 4
push 0
push str.EulaAccepted
push eax
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40d69d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x40dd10
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe28
mov eax, dword [0x44ac68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0xe18]
push eax
lea ecx, [ebp - 0xe14]
push ecx
or edi, 0xffffffff
mov dword [ebp - 0xe18], ebx
call sub.IPHLPAPI.DLL_GetIpForwardTable
cmp eax, 0x7a
jne 0x40ddce
mov edx, dword [ebp - 0xe18]
push esi
push edx
lea ecx, [ebp - 0xe28]
mov dword [ebp - 0xe28], ebx
mov dword [ebp - 0xe24], ebx
mov dword [ebp - 0xe20], ebx
call fcn.00407250
mov esi, dword [ebp - 0xe28]
push ebx
lea eax, [ebp - 0xe18]
push eax
push esi
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
jne 0x40ddae
mov edx, dword [esi]
cmp edx, ebx
jle 0x40ddae
lea ecx, [esi + 4]
cmp dword [ecx], ebx
je 0x40dda1
inc eax
add ecx, 0x38
cmp eax, edx
jl 0x40dd93
jmp 0x40ddae
lea ecx, [eax*8]
sub ecx, eax
mov edi, dword [esi + ecx*8 + 0x14]
cmp esi, ebx
je 0x40ddbb
push esi
call fcn.00420084
add esp, 4
pop esi
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042008f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.0042008f
mov esp, ebp
pop ebp
ret