joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c120
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4619db
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov eax, dword [0x486904]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
push 0x20
call fcn.00428fa5
add esp, 4
mov dword [esp + 0x14], eax
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x54], ebp
je 0x40c16a
mov ecx, eax
call fcn.00422050
mov esi, eax
jmp 0x40c16c
xor esi, esi
push esi
push 9
push 1
sub esp, 0xc
mov eax, esp
mov dword [esp + 0x2c], esp
push 0x16
push eax
mov dword [esp + 0x74], 0xffffffff
call fcn.0040da50
add esp, 8
mov ecx, 0x493528
call fcn.0041ad30
push 0x469790
lea ecx, [esp + 0x20]
call fcn.004214e0
cmp dword [esi + 0x1c], ebp
mov dword [esp + 0x54], 1
mov dword [esp + 0x14], ebp
jle 0x40c2b5
test ebp, ebp
jl 0x40c2e4
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esi + 0x10]
jge 0x40c2e4
mov eax, dword [esi + 0xc]
add eax, ebp
push eax
lea ecx, [esp + 0x20]
call fcn.004214b0
sub esp, 0xc
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00421420
lea eax, [esp + 0x34]
push eax
call fcn.004045e0
add esp, 0x10
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x58], 2
call fcn.004214b0
lea ecx, [esp + 0x28]
mov byte [esp + 0x54], 1
call fcn.004212c0
push 0x469eec
lea ecx, [esp + 0x38]
push ecx
sub esp, 0xc
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.00421420
lea edi, [esp + 0x54]
call fcn.0040b1e0
add esp, 0xc
mov ecx, eax
mov byte [esp + 0x5c], 3
call fcn.00421710
mov ecx, eax
mov byte [esp + 0x58], 4
call fcn.004212f0
lea ecx, [esp + 0x34]
mov bl, al
mov byte [esp + 0x54], 3
call fcn.004212c0
mov ecx, edi
mov byte [esp + 0x54], 1
call fcn.004212c0
test bl, bl
push 5
je 0x40c28b
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x40c29e
mov ecx, dword [esp + 0x24]
push 0
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [esp + 0x14]
add eax, 1
add ebp, 0xc
cmp eax, dword [esi + 0x1c]
mov dword [esp + 0x14], eax
jl 0x40c1ba
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x54], 0xffffffff
call fcn.004212c0
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
jmp fcn.0042a61f
Function at 0x412d60
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
push esi
push eax
call fcn.00412c70
mov esi, eax
test esi, esi
je 0x412e50
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
call edi
push eax
call fcn.00412850
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
mov dword [esp + 0x18], eax
call ebp
push esi
call edi
test eax, eax
jne 0x412da4
mov dword [esp + 0x10], eax
jmp 0x412db9
cmp dword [eax], 0x28
jne 0x412dae
mov ebx, dword [eax + 4]
jmp 0x412db2
movzx ebx, word [eax + 4]
push esi
call ebp
mov dword [esp + 0x10], ebx
push esi
call edi
test eax, eax
jne 0x412dc4
xor ebx, ebx
jmp 0x412dd5
cmp dword [eax], 0x28
jne 0x412dce
mov ebx, dword [eax + 8]
jmp 0x412dd2
movzx ebx, word [eax + 6]
push esi
call ebp
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x24]
mov ebp, dword [sym.imp.GDI32.dll_SelectPalette]
mov dword [ecx], edx
mov ecx, dword [esp + 0x14]
push 0
mov dword [eax], ebx
mov edx, dword [edi + 4]
push ecx
push edx
call ebp
mov dword [esp + 0x18], eax
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push 0
push 0
push 0
push esi
push ebx
push ecx
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call fcn.00412bd0
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 4]
push 1
push edx
push eax
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x14]
test eax, eax
pop edi
pop ebp
pop ebx
je 0x412e50
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
pop esi
add esp, 0xc
ret

Function at 0x4137c0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x164
mov eax, dword [0x486904]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push 0
push 0
mov esi, ecx
mov eax, dword [esi + 0x20]
push 0x1108
push eax
call ebx
push eax
call fcn.0043590e
test eax, eax
je 0x4137ff
lea ecx, [esi + 0x5c]
call fcn.004358cf
push 0x4001
push 0x160
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x469e38
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
jne 0x413847
push 0x2e
push str.Cannot_retrieve_the_Handle_of_SystemImageList_
lea ecx, [esi + 0x58]
call fcn.00401bc0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x160]
xor ecx, esp
call fcn.00445fb9
add esp, 0x164
ret
push edi
lea edi, [esi + 0x5c]
push eax
mov ecx, edi
call fcn.00435936
test eax, eax
jne 0x413880
push 0x24
push str.Cannot_Attach_SystemImageList_Handle
lea ecx, [esi + 0x58]
call fcn.00401bc0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x160]
xor ecx, esp
call fcn.00445fb9
add esp, 0x164
ret
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_DestroyIcon]
test edi, edi
je 0x413892
mov edi, dword [edi + 4]
mov eax, dword [esi + 0x20]
push edi
push 0
push 0x1109
push eax
call ebx
push eax
call fcn.0043590e
mov ecx, dword [esp + 0x16c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00445fb9
add esp, 0x164
ret
Function at 0x414110
Capabilities:
Get disk information

Disassembly:
sub esp, 0x84
mov eax, dword [0x486904]
xor eax, esp
mov dword [esp + 0x80], eax
push edi
push 0xffff0000
push 0
mov edi, ecx
mov eax, dword [edi + 0x20]
push 0x1101
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 4]
push ecx
push 0x80
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x414178
push 0x23
push str.Error_Getting_Logical_DriveStrings_
lea ecx, [edi + 0x58]
call fcn.00401bc0
xor eax, eax
pop edi
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.00445fb9
add esp, 0x84
ret
cmp byte [esp + 4], 0
push esi
lea esi, [esp + 8]
je 0x4141d9
push ebx
push esi
push 0xffff0000
mov ecx, edi
call fcn.00413a60
push esi
mov ecx, edi
mov ebx, eax
call fcn.00413cf0
test eax, eax
je 0x4141be
push 0xffff0002
push ebx
push 0
push 0
push 0
push 0
push 0
push 0x469790
push 0x23
mov ecx, edi
call fcn.00435636
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4141c3
sub eax, edx
cmp byte [esi + eax + 1], cl
lea esi, [esi + eax + 1]
jne 0x414185
pop ebx
mov ecx, dword [esp + 0x88]
pop esi
pop edi
xor ecx, esp
mov eax, 1
call fcn.00445fb9
add esp, 0x84
ret
Function at 0x414d00
Capabilities:
Get file size

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x804]
test eax, eax
mov dword [esi + 0x818], 0
mov dword [esi + 0x81c], 0
jne 0x414d27
xor edx, edx
pop esi
pop ecx
ret
push edi
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x414d4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x414d4d
pop edi
xor eax, eax
xor edx, edx
pop esi
pop ecx
ret
mov edx, dword [esp + 8]
push 1
push 0
push 0
push edx
call fcn.00447bd0
xor ecx, ecx
add eax, edi
adc edx, ecx
pop edi
mov dword [esi + 0x818], eax
mov dword [esi + 0x81c], edx
pop esi
pop ecx
ret

Function at 0x414e20
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 0xc]
mov dword [edx], 0
mov eax, dword [ecx + 0x804]
test eax, eax
jne 0x414e39
xor al, al
ret 0xc
mov ecx, dword [esp + 8]
push 0
push edx
mov edx, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne al
ret 0xc

Function at 0x414e60
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx + 0x804]
test eax, eax
jne 0x414e6f
xor al, al
ret 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push ecx
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
ret 0xc
Function at 0x415b50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, ecx
mov eax, dword [esi + 0xb388]
mov dword [ebp], eax
mov ecx, dword [esi + 0xb38c]
mov dword [ebp + 4], ecx
mov eax, dword [esi + 0xb388]
mov ecx, dword [esi + 0xb184]
mov edx, dword [esi + 0xb180]
push edi
mov edi, dword [esp + 0x28]
add eax, edi
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0xb38c]
adc eax, ebx
cmp eax, ecx
mov dword [esp + 0x10], edx
jl 0x415bcf
mov eax, edx
jg 0x415ba9
cmp dword [esp + 0x18], eax
jbe 0x415bcf
sub eax, dword [esi + 0xb388]
sbb ecx, dword [esi + 0xb38c]
mov edi, eax
mov ebx, ecx
or eax, ebx
jne 0x415bcf
pop edi
pop esi
mov dword [ebp], eax
mov dword [ebp + 4], eax
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 0x10
mov edx, dword [esi + 0xb390]
mov eax, dword [esi + 0xb394]
mov ecx, dword [0x48809c]
mov dword [esp + 0x28], edx
add edx, edi
mov dword [esp + 0x2c], eax
adc eax, ebx
cmp eax, ecx
jl 0x415d04
mov eax, dword [0x488098]
jg 0x415c04
cmp edx, eax
jbe 0x415d04
sub eax, dword [esp + 0x28]
sbb ecx, dword [esp + 0x2c]
mov dword [esi + 0xb178], eax
test ecx, ecx
mov dword [esi + 0xb17c], ecx
jl 0x415c68
jg 0x415c22
test eax, eax
jbe 0x415c68
mov edx, dword [esp + 0x24]
push 0
lea ebp, [esi + 0xb170]
push ebp
mov ecx, eax
mov eax, dword [esi + 0x1160]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp]
add dword [esi + 0xb388], ecx
mov edx, dword [esi + 0xb178]
mov eax, dword [esi + 0xb17c]
adc dword [esi + 0xb38c], 0
add dword [esi + 0xb390], edx
adc dword [esi + 0xb394], eax
mov ecx, esi
call fcn.00415860
test al, al
jne 0x415c84
pop edi
pop esi
pop ebp
mov byte [0x488047], 1
pop ebx
add esp, 0x10
ret 0x10
mov eax, edi
sub eax, dword [esi + 0xb178]
mov ecx, ebx
sbb ecx, dword [esi + 0xb17c]
mov dword [esp + 0x2c], ecx
js 0x415d57
jg 0x415ca8
test eax, eax
jbe 0x415d57
mov eax, dword [esi + 0xb178]
mov ecx, dword [esp + 0x24]
push 0
lea ebp, [esi + 0xb170]
push ebp
mov edx, edi
sub edx, eax
push edx
mov edx, dword [esi + 0x1160]
add eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp]
add dword [esi + 0xb388], eax
mov al, 1
adc dword [esi + 0xb38c], 0
sub edi, dword [esi + 0xb178]
sbb ebx, dword [esi + 0xb17c]
add dword [esi + 0xb390], edi
pop edi
adc dword [esi + 0xb394], ebx
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 0x1160]
push 0
lea eax, [esi + 0xb170]
push eax
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi + 0xb170]
add dword [esi + 0xb388], eax
mov ecx, dword [esi + 0xb388]
adc dword [esi + 0xb38c], 0
add dword [esi + 0xb390], edi
mov edx, dword [esi + 0xb38c]
adc dword [esi + 0xb394], ebx
sub ecx, dword [ebp]
sbb edx, dword [ebp + 4]
mov dword [ebp], ecx
mov dword [ebp + 4], edx
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 0x10
Function at 0x4192b0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
xor eax, eax
cmp byte [esi + 0xdd], al
je 0x41930a
push 0x488024
push eax
push esi
push 0x4059c0
mov byte [esi + 0xdd], al
push eax
push 0x488028
mov byte [0x488046], al
mov dword [0x488028], 0xc
mov dword [0x48802c], eax
mov dword [0x488030], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x100
push eax
mov dword [0x488020], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 5
mov ecx, esi
call fcn.00429c47
pop esi
ret

Function at 0x419d00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4639f8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x486904]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x34]
push eax
lea ecx, [esi + 0x1c]
mov dword [esp + 0x30], 0
call fcn.004214b0
push str..TempFile
lea ecx, [esp + 0x10]
call fcn.004214e0
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x38], 1
call fcn.00419750
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 3
call fcn.004212c0
sub esp, 0xc
lea edx, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.00421420
mov ecx, esi
call fcn.004197f0
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 0
call fcn.004212c0
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004212c0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 0xc
Function at 0x41e9b0
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x46468e
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x486904]
xor eax, esp
mov dword [esp + 0x81c], eax
push esi
push edi
mov eax, dword [0x486904]
xor eax, esp
push eax
lea eax, [esp + 0x82c]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x840]
push eax
lea ecx, [esp + 0x2c]
push 0x800
push ecx
mov dword [esp + 0x840], 0
call fcn.00446925
lea esi, [esp + 0x34]
add esp, 0xc
lea ecx, [esi + 1]
mov al, byte [esi]
add esi, 1
test al, al
jne 0x41ea17
sub esi, ecx
test esi, esi
jle 0x41ea35
mov al, 0x5c
cmp byte [esp + esi + 0x28], al
je 0x41ea35
sub esi, 1
test esi, esi
jg 0x41ea28
lea edx, [esp + 0x83c]
push edx
lea ecx, [esp + 0x10]
add esi, 1
call fcn.00421420
push 1
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x28], esp
lea eax, [esi - 1]
push eax
push 1
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x850], 1
call fcn.004217b0
mov ecx, edi
call fcn.0041e730
lea ecx, [esp + 0xc]
call fcn.004212b0
sub eax, esi
push eax
add esi, 1
push esi
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x18]
call fcn.004217b0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x838], 2
call fcn.004214b0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x834], 1
call fcn.004212c0
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [esp + 0xc]
mov byte [esp + 0x834], 0
call fcn.004212c0
lea ecx, [esp + 0x83c]
mov dword [esp + 0x834], 0xffffffff
call fcn.004212c0
mov ecx, dword [esp + 0x82c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x81c]
xor ecx, esp
call fcn.00445fb9
add esp, 0x82c
ret 0xc
Function at 0x41eb20
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x4646de
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x486904]
xor eax, esp
mov dword [esp + 0x81c], eax
push esi
push edi
mov eax, dword [0x486904]
xor eax, esp
push eax
lea eax, [esp + 0x82c]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x840]
push eax
lea ecx, [esp + 0x2c]
push 0x800
push ecx
mov dword [esp + 0x840], 0
call fcn.00446925
lea esi, [esp + 0x34]
add esp, 0xc
lea ecx, [esi + 1]
mov al, byte [esi]
add esi, 1
test al, al
jne 0x41eb87
sub esi, ecx
test esi, esi
jle 0x41eba5
mov al, 0x5c
cmp byte [esp + esi + 0x28], al
je 0x41eba5
sub esi, 1
test esi, esi
jg 0x41eb98
lea edx, [esp + 0x83c]
push edx
lea ecx, [esp + 0x10]
add esi, 1
call fcn.00421420
push 1
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x28], esp
lea eax, [esi - 1]
push eax
push 1
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x850], 1
call fcn.004217b0
mov ecx, edi
call fcn.0041e730
lea ecx, [esp + 0xc]
call fcn.004212b0
sub eax, esi
push eax
add esi, 1
push esi
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x18]
call fcn.004217b0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x838], 2
call fcn.004214b0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x834], 1
call fcn.004212c0
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [esp + 0xc]
mov byte [esp + 0x834], 0
call fcn.004212c0
lea ecx, [esp + 0x83c]
mov dword [esp + 0x834], 0xffffffff
call fcn.004212c0
mov ecx, dword [esp + 0x82c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x81c]
xor ecx, esp
call fcn.00445fb9
add esp, 0x82c
ret 0xc

Function at 0x41ec90
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46473a
mov eax, dword fs:[0]
push eax
sub esp, 0xa3c
mov eax, dword [0x486904]
xor eax, esp
mov dword [esp + 0xa38], eax
push ebx
push esi
push edi
mov eax, dword [0x486904]
xor eax, esp
push eax
lea eax, [esp + 0xa4c]
mov dword fs:[0], eax
mov esi, dword [esp + 0xa5c]
xor ebx, ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ecx + 8]
cmp eax, ebx
mov edi, 1
mov dword [esp + 0xa54], edi
jne 0x41ecfc
push 0x469790
mov ecx, esi
call fcn.004214e0
jmp 0x41ed49
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0xa6c]
lea ecx, [esp + 0x24]
push ecx
push ebx
push edx
push eax
mov dword [esp + 0x2c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x41ed3d
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
mov byte [esp + eax + 0x24], bl
call fcn.00421590
jmp 0x41ed49
push 0x469790
mov ecx, esi
call fcn.004214e0
lea ecx, [esp + 0xa60]
mov dword [esp + 0x10], edi
mov byte [esp + 0xa54], bl
call fcn.004212c0
mov eax, esi
mov ecx, dword [esp + 0xa4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa38]
xor ecx, esp
call fcn.00445fb9
add esp, 0xa48
ret 0x10
Function at 0x41ed90
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x46478b
mov eax, dword fs:[0]
push eax
mov eax, 0x2010
call fcn.004474c0
mov eax, dword [0x486904]
xor eax, esp
mov dword [esp + 0x200c], eax
push ebx
push esi
mov eax, dword [0x486904]
xor eax, esp
push eax
lea eax, [esp + 0x201c]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
mov ebx, 1
push eax
lea ecx, [esp + 0x203c]
mov dword [esp + 0x2028], ebx
call fcn.00421710
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push 0x1000
push edx
call fcn.00446925
add esp, 0xc
lea eax, [esp + 0x1018]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.0041e5a0
mov esi, dword [esi + 8]
test esi, esi
je 0x41ee7d
push eax
mov eax, dword [esp + 0x2034]
lea edx, [esp + 0x101c]
push edx
push 3
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x41ee7d
lea ecx, [esp + 0xc]
mov byte [esp + 0x2024], bl
call fcn.004212c0
lea ecx, [esp + 0x202c]
mov byte [esp + 0x2024], 0
call fcn.004212c0
lea ecx, [esp + 0x2038]
mov dword [esp + 0x2024], 0xffffffff
call fcn.004212c0
mov al, bl
jmp 0x41eeba
lea ecx, [esp + 0xc]
mov byte [esp + 0x2024], bl
call fcn.004212c0
lea ecx, [esp + 0x202c]
mov byte [esp + 0x2024], 0
call fcn.004212c0
lea ecx, [esp + 0x2038]
mov dword [esp + 0x2024], 0xffffffff
call fcn.004212c0
xor al, al
mov ecx, dword [esp + 0x201c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x200c]
xor ecx, esp
call fcn.00445fb9
add esp, 0x201c
ret 0x18

Function at 0x41eef0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4647d0
mov eax, dword fs:[0]
push eax
push ebp
push esi
push edi
mov eax, dword [0x486904]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebp, ecx
cmp dword [ebp + 8], 0
mov dword [esp + 0x18], 1
je 0x41ef7e
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x2c]
call fcn.004212b0
push eax
mov eax, dword [ebp + 8]
push esi
push 1
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x41ef7e
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], al
call fcn.004212c0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x18], 0xffffffff
call fcn.004212c0
mov al, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 0x18
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.004212c0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x18], 0xffffffff
call fcn.004212c0
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 0x18
Function at 0x41efc0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4647f8
mov eax, dword fs:[0]
push eax
mov eax, dword [0x486904]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [ecx + 8]
test eax, eax
je 0x41f027
mov edx, dword [esp + 0x18]
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x41f027
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.004212c0
mov al, 1
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.004212c0
xor al, al
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 0x10
Function at 0x4226b0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x465219
mov eax, dword fs:[0]
push eax
mov eax, 0xa030
call fcn.004474c0
mov eax, dword [0x486904]
xor eax, esp
mov dword [esp + 0xa02c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x486904]
xor eax, esp
push eax
lea eax, [esp + 0xa044]
mov dword fs:[0], eax
mov ebp, ecx
xor ebx, ebx
push 0x469790
lea ecx, [esp + 0x1c]
mov dword [esp + 0xa050], ebx
call fcn.004214e0
mov eax, dword [esp + 0xa058]
push 0x469d2c
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0xa058], 1
call fcn.00447468
add esp, 0xc
test eax, eax
jne 0x422854
mov edx, dword [esp + 0x14]
push 2
push ebx
push edx
call fcn.00449670
mov eax, dword [esp + 0x20]
push eax
call fcn.0044957b
add esp, 0x10
cmp eax, ebx
jne 0x422762
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00447137
add esp, 4
jmp 0x422854
cdq
mov ecx, 0xa000
idiv ecx
mov edi, edx
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call fcn.0044931e
add esp, 4
cmp esi, ebx
jle 0x4227da
nop
mov eax, dword [esp + 0x14]
push eax
push 1
lea ecx, [esp + 0x3c]
push 0xa000
push ecx
call fcn.00449303
add esp, 0x10
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0xa038], bl
call fcn.00421590
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa050], 2
call fcn.00421850
lea ecx, [esp + 0x24]
mov byte [esp + 0xa04c], 1
call fcn.004212c0
sub esi, 1
jne 0x422780
mov ecx, dword [esp + 0x14]
push ecx
push 1
lea edx, [esp + 0x3c]
push edi
push edx
call fcn.00449303
add esp, 0x10
cmp edi, ebx
mov byte [esp + edi + 0x34], bl
je 0x42282c
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x28]
call fcn.00421590
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa050], 3
call fcn.00421850
lea ecx, [esp + 0x24]
mov byte [esp + 0xa04c], 1
call fcn.004212c0
mov edx, dword [esp + 0x14]
push edx
call fcn.00447137
add esp, 4
push ebx
sub esp, 0xc
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.00421420
mov ecx, ebp
call fcn.00422500
lea ecx, [esp + 0x18]
mov byte [esp + 0xa04c], bl
call fcn.004212c0
lea ecx, [esp + 0xa054]
mov dword [esp + 0xa04c], 0xffffffff
call fcn.004212c0
mov ecx, dword [esp + 0xa044]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa02c]
xor ecx, esp
call fcn.00445fb9
add esp, 0xa03c
ret 0xc