joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407990
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
movzx eax, word [0x452060]
movzx edx, word [0x452062]
mov dword [0x4526c0], 0x80caa55
mov ecx, dword [esp + 0x54]
shl eax, 0x10
or eax, edx
mov dword [esp + 0x2c], eax
cmp ecx, 0x29
jg 0x407ae0
mov eax, 0x92492493
imul ecx
mov eax, ecx
sar eax, 0x1f
add edx, ecx
sar edx, 2
sub edx, eax
lea esi, [edx*8]
mov eax, edx
sub esi, edx
mov edx, esi
sub ecx, edx
lea edi, [esp + 0x2c]
mov dword [esp + 8], 4
mov dword [esp + 4], edi
mov dword [esp], 0xffffffff
mov byte [0x4526c4], al
mov eax, dword [esp + 0x58]
mov byte [0x4526c5], cl
mov byte [0x4526c6], 0
mov byte [0x4526c7], al
call fcn.00401f50
mov dword [esp + 8], 8
mov dword [esp + 4], 0x4526c0
mov dword [esp], eax
call fcn.00401f50
mov dword [0x4526c8], eax
imul eax, dword [esp + 0x50], 0xa48
mov edx, dword [eax + 0x452a00]
lea ebp, [eax + 0x22c]
lea esi, [eax + 0x4529ec]
lea ebx, [eax + 0x4527c0]
test edx, edx
jne 0x407af0
imul ebx, dword [esp + 0x50], 0xa48
mov dword [ebp + 0x4527c0], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [ebx + 0x4529d4]
mov dword [esp + 0x10], esi
mov dword [ebx + 0x4529fc], eax
movzx eax, byte [0x4526c2]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x4529cc]
add ebx, 0x4527c0
mov dword [esp + 4], 0x4526c0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x407b38
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ecx - 0x2a]
mov ecx, 7
jmp 0x4079e7
mov eax, dword [eax + 0x4529cc]
mov dword [esp + 0xc], 1
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [ebx + 0x214]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x240], 0
sub esp, 4
jmp 0x407a63
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x407ad8
mov dword [ebx + 0x240], 1
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408180
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
movzx eax, word [0x452060]
movzx edx, word [0x452062]
mov byte [0x4526c2], 0xc
lea edi, [esp + 0x2c]
mov dword [esp + 8], 4
shl eax, 0x10
mov dword [esp + 4], edi
or eax, edx
mov dword [esp], 0xffffffff
mov dword [esp + 0x2c], eax
movzx eax, word [0x44abc0]
mov byte [0x4526c7], 0
mov word [0x4526c0], ax
mov eax, dword [esp + 0x54]
mov byte [0x4526c3], al
mov eax, dword [esp + 0x58]
mov byte [0x4526c4], al
movzx eax, word [0x44abc2]
mov word [0x4526c5], ax
call fcn.00401f50
mov dword [esp + 8], 8
mov dword [esp + 4], 0x4526c0
mov dword [esp], eax
call fcn.00401f50
mov dword [0x4526c8], eax
imul eax, dword [esp + 0x50], 0xa48
mov edx, dword [eax + 0x452a00]
lea ebp, [eax + 0x22c]
lea esi, [eax + 0x4529ec]
test edx, edx
jne 0x4082b0
imul ebx, dword [esp + 0x50], 0xa48
mov dword [ebp + 0x4527c0], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [ebx + 0x4529d4]
mov dword [esp + 0x10], esi
mov dword [ebx + 0x4529fc], eax
movzx eax, byte [0x4526c2]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x4529cc]
add ebx, 0x4527c0
mov dword [esp + 4], 0x4526c0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x408300
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [eax + 0x4527c0]
mov eax, dword [eax + 0x4529cc]
mov dword [esp + 0xc], 1
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [ebx + 0x214]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x240], 0
sub esp, 4
jmp 0x408233
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4082a8
mov dword [ebx + 0x240], 1
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408320
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
movzx eax, word [0x452060]
movzx edx, word [0x452062]
mov dword [0x4526c0], 0xb0caa55
lea edi, [esp + 0x2c]
mov dword [esp + 8], 4
shl eax, 0x10
mov dword [esp + 4], edi
or eax, edx
mov dword [esp], 0xffffffff
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x54]
mov byte [0x4526c5], 0
mov byte [0x4526c4], al
mov eax, dword [esp + 0x58]
mov word [0x4526c6], ax
call fcn.00401f50
mov dword [esp + 8], 8
mov dword [esp + 4], 0x4526c0
mov dword [esp], eax
call fcn.00401f50
mov dword [0x4526c8], eax
imul eax, dword [esp + 0x50], 0xa48
mov edx, dword [eax + 0x452a00]
lea ebp, [eax + 0x22c]
lea esi, [eax + 0x4529ec]
test edx, edx
jne 0x408440
imul ebx, dword [esp + 0x50], 0xa48
mov dword [ebp + 0x4527c0], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [ebx + 0x4529d4]
mov dword [esp + 0x10], esi
mov dword [ebx + 0x4529fc], eax
movzx eax, byte [0x4526c2]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x4529cc]
add ebx, 0x4527c0
mov dword [esp + 4], 0x4526c0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x408490
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [eax + 0x4527c0]
mov eax, dword [eax + 0x4529cc]
mov dword [esp + 0xc], 1
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [ebx + 0x214]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x240], 0
sub esp, 4
jmp 0x4083bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x408432
mov dword [ebx + 0x240], 1
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40a2a0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov eax, dword [0x452480]
mov edx, dword [esp + 0x168]
mov edi, dword [esp + 0x164]
lea ebx, [eax + 0x19fa]
test edx, edx
jne 0x40a2cd
lea ebx, [eax + 0x1a1d]
mov dword [esp], ebx
lea ebp, [esp + 0x3c]
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], ebp
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x160]
mov dword [esp + 0x10], 0
mov dword [esp + 4], ebx
mov dword [esp], eax
call esi
movzx eax, word [edi]
movzx ecx, word [edi + 2]
sub esp, 0x14
mov word [esp + 0x2e], ax
movzx eax, word [edi + 6]
cmp cx, 2
je 0x40a440
movzx ebx, cx
cmp ax, 0x1e
jbe 0x40a339
cmp cx, 0xb
ja 0x40a339
mov edx, 0xa50
bt edx, ecx
jb 0x40a490
mov dword [esp + 0x1c], eax
mov eax, dword [0x452480]
movzx ecx, word [esp + 0x2e]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
add eax, 0x1499
lea ebx, [esp + 0x40]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], ecx
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x100
call fcn.00409740
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x160]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp], eax
call esi
movzx eax, word [edi + 6]
sub esp, 0x14
mov dword [esp + 0x14], eax
movzx eax, word [edi + 2]
mov dword [esp + 0x10], eax
movzx eax, word [edi]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov eax, dword [0x452480]
mov dword [esp + 4], 0x100
add eax, 0x14be
mov dword [esp + 8], eax
call fcn.00409740
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x160]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp], eax
call esi
mov eax, dword [0x452480]
sub esp, 0x14
lea ebx, [eax + 0x1a41]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x160]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp], eax
call esi
sub esp, 0x14
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ax, 0x1c
jbe 0x40a47e
movzx eax, word [esp + 0x2e]
test al, 3
jne 0x40a470
imul ax, ax, 0x5c29
mov ecx, eax
ror cx, 2
cmp cx, 0x28f
jbe 0x40a4a8
mov eax, 0x1d
mov ecx, 0x1d
jmp 0x40a47a
mov eax, 0x1c
mov ecx, 0x1c
mov word [edi + 6], cx
mov ebx, 2
jmp 0x40a339
mov eax, 0x1e
mov word [edi + 6], ax
mov eax, 0x1e
jmp 0x40a339
ror ax, 4
cmp ax, 0xa4
mov ecx, eax
sbb eax, eax
not eax
add eax, 0x1d
cmp cx, 0xa4
sbb ecx, ecx
not ecx
add ecx, 0x1d
jmp 0x40a47a
Function at 0x41a000
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x3c
movzx eax, word [0x452060]
movzx edx, word [0x452062]
mov dword [0x45a340], 0xff0caa55
movzx ecx, byte [0x45a2c0]
mov dword [esp + 8], 4
shl eax, 0x10
mov dword [esp], 0xffffffff
or eax, edx
movzx edx, byte [esp + 0x48]
shl ecx, 0x10
mov dword [esp + 0x2c], eax
movzx eax, byte [esp + 0x40]
mov ah, byte [esp + 0x44]
shl edx, 0x18
movzx eax, ax
or eax, ecx
or eax, edx
mov dword [0x45a344], eax
lea eax, [esp + 0x2c]
mov dword [esp + 4], eax
call fcn.00401f50
mov dword [esp + 8], 8
mov dword [esp + 4], 0x45a340
mov dword [esp], eax
call fcn.00401f50
mov dword [esp + 0x14], 0x10
mov dword [0x45a348], eax
movzx eax, byte [0x45a342]
mov dword [esp + 0x10], 0x45abc4
mov dword [esp + 8], eax
mov eax, dword [0x45abd4]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x45a340
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_sendto]
sub esp, 0x18
add esp, 0x3c
ret

Function at 0x41a0d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
sub esp, 0x38
movzx eax, word [0x452060]
movzx edx, word [0x452062]
mov dword [0x45a340], 0xff20aa55
mov dword [esp + 0xc], 0x18
shl eax, 0x10
mov dword [esp + 8], 0x45ae80
or eax, edx
mov dword [esp + 4], 0x7c
mov dword [esp + 0x2c], eax
mov dword [esp], 0x45a344
call dword [0x42e308]
lea eax, [esp + 0x2c]
mov dword [esp + 8], 4
movzx ebx, byte [0x45a342]
mov dword [esp + 4], eax
mov dword [esp], 0xffffffff
sub ebx, 4
call fcn.00401f50
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x45a340
mov dword [esp], eax
call fcn.00401f50
mov ebx, dword [sym.imp.WS2_32.dll_sendto]
mov dword [esp + 0x14], 0x10
mov dword [0x45a35c], eax
movzx eax, byte [0x45a342]
mov dword [esp + 0x10], 0x45abc4
mov dword [esp + 8], eax
mov eax, dword [0x45abd4]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x45a340
mov dword [esp], eax
call ebx
sub esp, 0x18
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], 0x45abc4
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov eax, dword [0x45abd4]
mov dword [esp], eax
call ebx
sub esp, 0x18
add esp, 0x38
pop ebx
ret
Function at 0x41a550
Capabilities:
Create thread
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push esi
push ebx
sub esp, 0x1c4
lea eax, [esp + 0x30]
mov byte [esp + 0x2f], 1
mov dword [esp + 4], eax
mov dword [esp], 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
jne 0x41a592
movzx eax, word [esp + 0x30]
cmp al, 2
jne 0x41a58c
shr ax, 8
cmp ax, 2
je 0x41a5a0
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
add esp, 0x1c4
pop ebx
pop esi
ret
mov dword [esp + 8], 0x11
mov dword [esp + 4], 2
mov dword [esp], 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x45abd4], eax
sub esp, 0xc
cmp eax, 0xffffffff
je 0x41a58c
mov eax, 2
mov word [0x45abc4], ax
movzx eax, word [0x4583e0]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [0x45abc6], ax
mov eax, dword [0x4583e0]
sub esp, 4
test eax, eax
je 0x41a602
cmp eax, 0xffff
jle 0x41a690
mov dword [esp], 0xffffffff
call dword [sym.imp.WS2_32.dll_htonl]
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 4
mov dword [0x45abc8], eax
mov eax, dword [0x45abd4]
lea esi, [esp + 0x2f]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0xffff
mov dword [esp], eax
call ebx
sub esp, 0x14
cmp eax, 0xffffffff
je 0x41a710
mov eax, dword [0x45abd4]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], esi
mov dword [esp + 8], 4
mov dword [esp + 4], 0xffff
mov dword [esp], eax
call ebx
sub esp, 0x14
cmp eax, 0xffffffff
je 0x41a710
mov eax, 1
jmp 0x41a594
mov dword [esp], 0
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [0x45abc8], eax
mov eax, dword [0x45abd4]
sub esp, 4
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x45abc4
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_bind]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x41a710
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x41a4f0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x45abc0], eax
sub esp, 0x18
test eax, eax
jne 0x41a685
mov eax, dword [0x45abd4]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x45abd4], 0xffffffff
sub esp, 4
jmp 0x41a58c
Function at 0x41b590
Capabilities:
Inspect load icon resource

Disassembly:
cmp word [0x45ad60], 0
jne 0x41b5b0
mov dword [0x45ac38], 0
mov eax, 1
ret
sub esp, 0x6c
mov eax, dword [0x45b0d4]
mov dword [esp + 0x30], 0x30
mov dword [esp + 0x34], 3
mov dword [esp + 0x38], 0x41b090
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], eax
mov dword [esp + 4], 0x65
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadIconW]
sub esp, 8
mov dword [esp + 0x5c], eax
mov dword [esp + 0x48], eax
mov dword [esp + 4], 0x7f88
mov dword [esp], 0
call dword [sym.imp.USER32.dll_LoadCursorW]
sub esp, 8
mov dword [esp + 0x4c], eax
mov dword [esp], 4
call dword [sym.imp.GDI32.dll_GetStockObject]
sub esp, 4
mov dword [esp + 0x50], eax
mov eax, dword [0x452484]
mov dword [esp + 0x54], 0
add eax, 0xa2e
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
sub esp, 4
test ax, ax
jne 0x41b670
xor eax, eax
add esp, 0x6c
ret
mov eax, dword [0x45b0d4]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], eax
mov eax, dword [0x45adcc]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov eax, dword [0x45adc8]
mov dword [esp + 0xc], 0x80000000
mov dword [esp + 0x18], eax
mov eax, dword [0x45ad6c]
mov dword [esp + 8], 0x4525e0
mov dword [esp + 0x14], eax
mov eax, dword [0x45ad68]
mov dword [esp], 0x8000008
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 4], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x45ac38], eax
sub esp, 0x30
test eax, eax
je 0x41b663
mov dword [esp + 4], 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x45ac38]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
sub esp, 4
jmp 0x41b665
Function at 0x42b230
Capabilities:
Set registry value

Disassembly:
push ebx
sub esp, 0x58
lea eax, [esp + 0x38]
mov dword [esp], 0x20006
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
sub esp, 8
test eax, eax
je 0x42b258
add esp, 0x58
pop ebx
ret
lea eax, [esp + 0x3c]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov eax, dword [0x452484]
mov dword [esp + 0x18], 0
add eax, 0xa86
mov dword [esp + 0x14], 0x20006
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 0x24
test eax, eax
jne 0x42b2e3
xor ecx, ecx
mov word [esp + 0x4a], cx
test byte [esp + 0x60], 1
jne 0x42b2f8
test byte [esp + 0x60], 2
jne 0x42b368
mov eax, dword [esp + 0x3c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call ebx
sub esp, 4
add esp, 0x58
pop ebx
ret
mov dword [esp + 4], 0x400
mov edx, 0x68
mov dword [esp], 0x4573e0
mov dword [esp + 0x40], 0x700053
mov dword [esp + 0x44], 0x740061
mov word [esp + 0x48], dx
call fcn.0042d5a0
mov dword [esp + 0x10], 0x4573e0
add eax, eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub esp, 0x18
jmp 0x42b2c6
mov eax, 0x74
mov dword [esp + 0x40], 0x630042
mov word [esp + 0x48], ax
lea eax, [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x44], 0x730061
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0x4583e0
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub esp, 0x18
jmp 0x42b2d1
Function at 0x42b990
Capabilities:
Create process on windows

Disassembly:
push edi
xor eax, eax
mov ecx, 0xe
push ebx
sub esp, 0x64
lea edi, [esp + 0x28]
mov dword [esp + 0x24], 0x3c
rep stosd dword es:[edi], eax
call fcn.00423c60
mov eax, dword [0x452484]
mov dword [esp + 4], 0x104
mov dword [esp], 0x45aec0
add eax, 0xbd6
mov dword [esp + 8], eax
call dword [sym.imp.msvcrt.dll_wcscat_s]
mov eax, dword [0x452484]
mov dword [esp + 0x34], 0x45aec0
mov dword [esp + 0x40], 1
add eax, 0xbfc
mov dword [esp + 0x30], eax
lea eax, [esp + 0x24]
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
sub esp, 4
test eax, eax
je 0x42ba20
xor eax, eax
mov ebx, 1
mov word [0x45aec0], ax
add esp, 0x64
mov eax, ebx
pop ebx
pop edi
ret
mov ebx, eax
mov eax, dword [0x452484]
mov dword [0x45ae40], 0x44affc
mov dword [0x45ae48], 0x10
add eax, 0x320
mov dword [esp + 0x10], 0x45ae40
mov dword [0x45ae44], eax
mov eax, dword [0x45b0dc]
mov dword [esp + 0xc], 0x402210
mov dword [esp + 8], eax
mov eax, dword [0x45b0d4]
mov dword [esp + 4], 0x89
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov eax, ebx
sub esp, 0x14
add esp, 0x64
pop ebx
pop edi
ret

Function at 0x42c420
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0042d790
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0042d790
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x42c480
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0xc5a92c]
test esi, esi
jle 0x42c5a0
mov eax, dword [0xc5a930]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x42c4b4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x42c537
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x42c4a0
mov dword [esp], ebx
call fcn.0042ce70
mov edi, eax
test eax, eax
je 0x42c5c7
mov eax, dword [0xc5a930]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0042cfb0
mov edx, dword [0xc5a930]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x42c5a7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x42c530
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x42c540
add dword [0xc5a92c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0xc5a930]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x42c530
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0042c420
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x42c4be
mov eax, dword [0xc5a930]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0042c420
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0042c420
lea esi, [esi]
nop

Function at 0x42cae0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0xc5a948
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0xc5a940]
sub esp, 4
test ebx, ebx
je 0x42cb35
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x42cb2e
test esi, esi
je 0x42cb2e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x42cb10
mov dword [esp], 0xc5a948
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42ce70
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x42ce95
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x42cea0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x42ce95
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x42cee8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x42cede
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x42ceea
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x42ced0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x402938
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404724
test esi, esi
jne 0x40296e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404814
jmp 0x40298c
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040284c
mov edi, eax
test esi, esi
je 0x40298c
cmp dword [ebx], 0
je 0x40298c
dec esi
jmp 0x402975
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40305c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x41b008], 0x8088405
inc edx
mov dword [ebx + 0x41b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403974
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41b024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403a0c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4039ec
xor eax, eax
push ebp
push 0x4039e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403a28
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4039ec
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x41b024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41b024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4045a8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41c044], 0
je 0x404609
cmp word [0x41c218], 0xd7b2
jne 0x4045d1
cmp dword [0x41c220], 0
jbe 0x4045d1
mov eax, 0x41c214
call dword [0x41c230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41b094
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404630
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41b034], 0
jne 0x404625
push 0
push 0x41b08c
push 0x41b094
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret