joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49bd04
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
lea ecx, [ebp + 0x10]
cmp dword [ebp + 0x10], eax
push esi
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
setne al
and dword [ebp + 0x10], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x49bd58
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret

Function at 0x49bd62
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
lea ecx, [ebp + 0xc]
cmp dword [ebp + 0xc], eax
push esi
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
setne al
and dword [ebp + 0xc], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x49bda4
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret

Function at 0x49bdc5
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc1c
push esi
xor esi, esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea ecx, [ebp - 0x41c]
push 0x208
push ecx
push eax
call fcn.0049bdae
mov eax, dword [0x4bd5dc]
mov ecx, 0x81
mov dword [ebp - 0x214], eax
xor eax, eax
lea edi, [ebp - 0x210]
push 0x4b28ec
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push eax
call fcn.0049d3f2
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0049d3f2
lea eax, [ebp - 0x214]
push str.___bg
push eax
call fcn.0049d3f2
mov eax, dword [0x4bd5dc]
add esp, 0x24
mov dword [ebp - 0xc1c], eax
mov ecx, 0x1ff
xor eax, eax
cmp dword [ebp + 0xc], esi
lea edi, [ebp - 0xc18]
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
setne al
lea ecx, [ebp - 4]
add eax, 0x80000001
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push 1
lea eax, [ebp - 0xc]
pop edi
mov dword [ebp - 0xc], 0x400
push eax
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 8], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49bee4
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0049cec5
pop ecx
test eax, eax
pop ecx
je 0x49bee0
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, edi
jmp 0x49bee6
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x49d5ec
Capabilities:
Allocate or change rwx memory

Disassembly:
add byte [eax], al
add byte [ebp + 0x167559c0], al
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac628
push 0x49d9ec
mov eax, dword fs:[0]
push eax
pushal
pushfd
not eax
xor edx, eax
xchg esi, eax
add edi, esp
mov edi, eax
dec eax
shl eax, 7
sub edx, edx
and esi, edi
xor esi, eax
ror edx, 0x19
and esi, edi
not esi
inc esi
sub esi, eax
add ecx, eax
mov edi, dword [0x4b0992]
test edx, ebp
jo 0x49d5cd
xchg ebx, eax
mov edi, ebx
call fcn.0040cce8
or esi, edi
not eax
and esi, edi
call fcn.00460157
sub esi, 0x800f28d
mov ecx, edi
rol eax, 8
add eax, ecx
mov eax, 0x2180621
shl edi, 0xc
xor esi, eax
sub edi, ebx
rol ebx, 0x14
mov ecx, 0xd619a8
not eax
rol esi, 4
test edx, ebp
jo 0x49d682
shr eax, 7
dec esi
xchg edx, eax
inc eax
shr esi, 9
inc esi
call fcn.0042d821
ror esi, 2
loop 0x49d663
mov edx, esp
test eax, eax
jo 0x49d6ff
aam 0x85
sub esi, edx
not esi
test cl, al
mov byte [ecx], 0xe8
mov bl, 0x74
idiv bh

Function at 0x49d6e8
Capabilities:
Allocate or change rwx memory

Disassembly:
sal byte [eax + 0x78], 0x2b
not esi
add ecx, esp
xor ecx, esi
and esi, edi
call fcn.0042d821
xor ecx, esi
mov ecx, 0x42ae8c
inc eax
test ecx, esp
jo 0x49d6ba
mov edi, dword [0x4bb392]
xchg eax, eax
ror edx, 0x1f
xchg esi, edx
inc edi
ror ebx, 0x13
neg esi
not eax
shr ebx, 0x10
loop 0x49d69d
dec eax
sub eax, eax
or esi, edi
sub eax, 0xcf3b7c0
sub eax, 0x340dcca0
not edx
add esi, eax
mov ecx, 0xcaf3a0
not esi
sub edx, dword [0x4bcc5d]
inc edx
shr eax, 4
ror ebx, 0x12
shl esi, 0x10
inc esi
shl edi, 5
shr esi, 0x17
not esi
rol eax, 0xb
xchg esi, edx
loop 0x49d6d6
and esi, edi
add esi, eax
test esp, ebx
jb 0x49d684
rol esi, 1
call fcn.00404bbb
dec eax
xor edx, eax
sub ebx, esp
mov eax, 0x286d2b84
sub byte [edi + 0xbf033c6], al
adc eax, 0x4bc730
dec ecx
xor ebx, ebx
or eax, 0x334d9bc
inc esi
add esi, esi
push 0x40
xor ebx, ebp
add esi, eax
inc edx
sub eax, 0x11eaea18
call fcn.00416239
xor esi, eax
sub edi, eax
xor ebx, dword [0x4b4b9a]
xor eax, eax
dec edi
xor esi, 0x1bf1e09
inc ebx
ror eax, 5
call fcn.00460157
xor ecx, dword [0x4ba540]
ror esi, 0x1c
xchg edi, edx
sub ecx, dword [0x4bac2f]
call fcn.00406711
call fcn.00404cbf
push 0x3000
add edi, dword [0x4b0b60]
sub ecx, dword [0x4b9f86]
sub edi, dword [0x4bb3d0]
ror esi, 0xd
neg esi
xor eax, eax
inc eax
xor edx, esi
xchg esi, edx
xor esi, 0x46c4a18
rol eax, 0xa
push 0x703
neg ecx
xor esi, eax
call fcn.0042d821
add ecx, ecx
xor esi, dword [0x4b6a42]
neg edi
add edx, esp
neg esi
call fcn.0041a60c
Function at 0x407df0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
jmp 0x407e0a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407e11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407e00
mov eax, 1
add ebx, ebx
jne 0x407e23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407e18
jne 0x407e34
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407e18
xor ecx, ecx
sub eax, 3
jb 0x407e48
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x407eba
mov ebp, eax
add ebx, ebx
jne 0x407e53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407e60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x407e84
inc ecx
add ebx, ebx
jne 0x407e70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407e65
jne 0x407e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407e65
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x407ea4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x407e95
jmp 0x407e06
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x407ea4
add edi, ecx
jmp 0x407e06
pop esi
mov edi, esi
mov ecx, 0x58
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x407ec2
cmp byte [edi], 0
jne 0x407ec2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x407ec7
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x407f36
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x81dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x82b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x407ef4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x82c0]
or eax, eax
je 0x407f30
mov dword [ebx], eax
add ebx, 4
jmp 0x407f11
call dword [esi + 0x82bc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x407f67
cmp al, 0xef
ja 0x407f5a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x407f3c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x407f49
mov ebp, dword [esi + 0x82c4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x407f9b
sub esp, 0xffffff80
jmp 0x40126c
Function at 0x421f50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
or ebp, 0xffffffff
jmp 0x421f72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x421f79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x421f68
mov eax, 1
add ebx, ebx
jne 0x421f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x421f80
jne 0x421f9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421f80
xor ecx, ecx
sub eax, 3
jb 0x421fb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x422022
mov ebp, eax
add ebx, ebx
jne 0x421fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x421fc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x421fec
inc ecx
add ebx, ebx
jne 0x421fd8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x421fcd
jne 0x421fe9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421fcd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42200c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x421ffd
jmp 0x421f6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42200c
add edi, ecx
jmp 0x421f6e
pop esi
mov edi, esi
mov ecx, 0x558
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42202a
cmp byte [edi], 5
jne 0x42202a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42202f
lea edi, [esi + 0x1f000]
mov eax, dword [edi]
or eax, eax
je 0x4220a7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x22238]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x222a4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42205c
mov ecx, edi
jns 0x42208b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x222ac]
or eax, eax
je 0x4220a1
mov dword [ebx], eax
add ebx, 4
jmp 0x422079
call dword [esi + 0x222a8]
mov ebp, dword [esi + 0x222b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4220db
sub esp, 0xffffff80
jmp 0x40473a
Function at 0x401970
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4019af
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x18], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebx + 0x14], 0
sub esp, 4
movzx eax, word [esi]
and eax, 0xffffffdf
cmp ax, 0x48
je 0x4019d0
mov dword [ebx + 0x34], 2
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x5c
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcschr]
mov dword [esp], esi
mov edi, eax
test eax, eax
je 0x401a10
call sym._path_get_rootkey
test eax, eax
je 0x4019bb
cmp word [edi + 2], 0
je 0x4019bb
add edi, 2
mov dword [esp], eax
mov dword [esp + 4], edi
call dword [sym.imp.advapi32.dll_RegDeleteTreeW]
sub esp, 8
jmp 0x4019bb
call sym._path_get_rootkey
jmp 0x4019bb

Function at 0x401a20
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 8
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ebx, [eax + 2]
movzx eax, word [eax + 2]
cmp ax, 9
je 0x401a48
cmp ax, 0x20
jne 0x401a5b
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 0x20
je 0x401a48
cmp ax, 9
je 0x401a48
test ax, ax
je 0x401a80
cmp ax, 0x3b
je 0x401a80
mov dword [esi + 0x34], 2
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov eax, dword [esi + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
mov dword [esi + 0x34], 2
mov eax, ebx
sub esp, 8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x402e40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x402e98
cmp byte [esi + ebx - 1], 0xa
je 0x402e6c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4081a8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x402ee0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
mov eax, dword [0x4080ec]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0x10], eax
call eax
mov edx, dword [ebp + 8]
test edx, edx
je 0x403058
mov eax, dword [0x4081b8]
test eax, eax
je 0x403028
mov esi, dword [0x408188]
test esi, esi
je 0x403058
mov dword [esp + 4], 0x409234
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strpbrk]
test eax, eax
jne 0x403068
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov edi, dword [0x408090]
mov dword [esp + 4], esi
mov ebx, eax
lea eax, [eax + 1]
mov dword [esp + 8], eax
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_memmove]
mov esi, dword [0x4081b8]
mov eax, esi
sub eax, ebx
cmp eax, 2
jbe 0x403000
mov eax, dword [ebp + 8]
add edi, ebx
mov dword [esp + 4], 1
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov eax, ebx
not eax
lea edx, [eax + esi]
mov dword [esp + 8], edx
call dword [sym.imp.ucrtbase.dll_fread]
test eax, eax
jne 0x402fc0
mov eax, dword [0x408090]
mov dword [0x408188], 0
test eax, eax
je 0x402fb3
call sym._GetWideString.part.0
mov dword [0x4080ec], eax
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [0x408090]
add ebx, esi
mov dword [0x408188], esi
mov byte [ebx + eax], 0
test esi, esi
jne 0x402f21
mov dword [esp], esi
mov eax, dword [ebp - 0x10]
mov dword [0x4080ec], 0
call eax
xor eax, eax
mov dword [0x4081b8], 0
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
add esi, esi
mov dword [esp], edi
mov dword [0x4081b8], esi
mov dword [esp + 4], esi
call dword [sym.imp.ucrtbase.dll_realloc]
mov dword [0x408090], eax
mov edi, eax
jmp 0x402f72
mov dword [0x4081b8], 0x1000
mov dword [esp], 0x1000
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [0x408090], eax
mov esi, eax
mov byte [eax], 0
mov dword [0x408188], eax
jmp 0x402f21
mov esi, dword [0x408090]
jmp 0x402fda
lea ecx, [eax + 1]
cmp byte [eax], 0xd
mov dword [0x408188], ecx
je 0x403090
mov byte [eax], 0
mov eax, esi
call sym._GetWideString.part.0
mov dword [0x4080ec], eax
jmp 0x402fb8
cmp byte [eax + 1], 0xa
jne 0x403076
lea ecx, [eax + 2]
mov dword [0x408188], ecx
jmp 0x403076
Function at 0x4030b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
test eax, eax
je 0x40323e
mov edi, dword [0x4081b4]
test edi, edi
je 0x403200
mov ebx, dword [0x408184]
test ebx, ebx
je 0x40323e
mov dword [esp + 4], 0x40922e
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcspbrk]
test eax, eax
jne 0x403249
mov edx, dword [0x408184]
cmp word [edx], 0
je 0x403230
mov eax, edx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x403110
sub eax, edx
mov edi, eax
mov ebx, eax
lea eax, [eax + 2]
sar edi, 1
mov esi, dword [0x40808c]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_memmove]
mov eax, dword [0x4081b4]
mov edx, eax
sub edx, edi
cmp edx, 2
jbe 0x4031d0
mov ecx, dword [ebp + 8]
mov edx, edi
mov dword [esp + 4], 2
not edx
add eax, edx
mov dword [esp + 0xc], ecx
lea ecx, [esi + ebx]
mov dword [esp + 8], eax
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_fread]
test eax, eax
jne 0x403190
mov dword [0x408184], 0
mov ebx, dword [0x40808c]
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [0x40808c]
add eax, edi
xor ecx, ecx
mov word [ebx + eax*2], cx
mov dword [0x408184], ebx
test ebx, ebx
jne 0x4030e0
mov dword [esp], ebx
xor ebx, ebx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, ebx
mov dword [0x4081b4], 0
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [eax + eax]
shl eax, 2
mov dword [esp], esi
mov dword [0x4081b4], edx
mov dword [ebp - 0x10], edx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_realloc]
mov edx, dword [ebp - 0x10]
mov dword [0x40808c], eax
mov esi, eax
mov eax, edx
jmp 0x40314d
mov dword [0x4081b4], 0x1000
xor esi, esi
mov dword [esp], 0x2000
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [0x40808c], eax
mov ebx, eax
mov word [eax], si
mov dword [0x408184], eax
jmp 0x4030e0
mov eax, 2
xor ebx, ebx
xor edi, edi
jmp 0x403124
mov ebx, dword [0x40808c]
jmp 0x4031ac
lea edx, [eax + 2]
cmp word [eax], 0xd
mov dword [0x408184], edx
je 0x403262
xor edx, edx
mov word [eax], dx
jmp 0x403186
cmp word [eax + 2], 0xa
jne 0x403258
lea edx, [eax + 4]
mov dword [0x408184], edx
jmp 0x403258
Function at 0x403f70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp], 0xfffffff5
mov edi, dword [sym.imp.kernel32.dll_GetStdHandle]
call edi
lea edx, [ebp - 0x10]
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x403fc0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [sym.imp.kernel32.dll_GetOEMCP]
mov dword [ebp - 0x20], ecx
call ecx
mov edx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call edx
sub esp, 0x20
mov dword [ebp - 0x14], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
call ecx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call edx
sub esp, 0x20
mov dword [esp], 0xfffffff5
call edi
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
sub esp, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 4], edi
mov dword [esp + 0x10], 0
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov dword [ebp + 8], edi
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.ucrtbase.dll_free]
Function at 0x406fa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x24]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebx + 0x20]
sub esp, 0x18
sub eax, 3
cmp eax, 1
jbe 0x407010
cmp word [ebx + 0xc], 1
mov eax, 1
mov dword [ebx + 0x28], 0
sbb eax, 0xffffffff
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x34], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x406fe8
Function at 0x407850
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Read file on windows
Set registry value
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
cmp eax, 1
je 0x407910
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 4]
mov dword [esp + 4], 0x3f
mov dword [esp], ebx
call sym._is_switch
test eax, eax
je 0x4078a0
mov dword [esp], 0x97
call sym._output_message
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x68
mov dword [esp], ebx
call sym._is_switch
test eax, eax
jne 0x407888
mov esi, dword [sym.imp.kernel32.dll_lstrcmpiW]
mov edi, 0x4097c0
mov eax, 0x409468
lea esi, [esi]
mov dword [esp + 4], eax
mov dword [esp], ebx
call esi
sub esp, 8
test eax, eax
je 0x407940
mov eax, dword [edi + 0xc]
add edi, 0xc
test eax, eax
jne 0x4078c8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [esp], 0xa8
mov dword [esp + 4], eax
call sym._output_message
mov dword [esp], 0x96
call sym._output_message
mov edx, 1
jmp 0x407896
mov dword [esp], 0x69
call sym._output_message
mov dword [esp], 0x96
call sym._output_message
lea esp, [ebp - 0xc]
mov edx, 1
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [edi + 4]
cmp ebx, 6
je 0x4078e2
cmp dword [ebp - 0x14], 2
mov dword [ebp - 0x18], eax
je 0x407978
mov eax, dword [ebp - 0x10]
mov esi, dword [eax + 8]
mov dword [esp + 4], 0x3f
mov dword [esp], esi
call sym._is_switch
mov edx, dword [ebp - 0x18]
test eax, eax
je 0x4079b8
cmp dword [ebp - 0x14], 3
jle 0x407a00
mov dword [esp], 0x69
call sym._output_message
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsupr]
mov dword [esp], 0x6a
mov dword [esp + 4], eax
call sym._output_message
lea esp, [ebp - 0xc]
mov edx, 1
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x68
mov dword [esp], esi
call sym._is_switch
mov edx, dword [ebp - 0x18]
test eax, eax
jne 0x40796e
test ebx, ebx
je 0x407a22
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
cmp ebx, 1
je 0x407a46
cmp ebx, 2
je 0x407a52
cmp ebx, 3
je 0x407a5e
cmp ebx, 4
je 0x407a3a
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._reg_query
mov eax, dword [edi + 8]
mov dword [ebp - 0x10], edx
mov dword [esp], eax
call sym._output_message
mov dword [esp], 0xa4
call sym._output_message
mov edx, dword [ebp - 0x10]
jmp 0x407896
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._reg_add
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._reg_import
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._reg_copy
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._reg_delete
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._reg_export
Function at 0x407a70
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop