joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f347
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48645f
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4970c0]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
mov eax, dword [0x4970c0]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, 0x41edbe
xor ebx, ebx
test ecx, ecx
jne 0x41f394
mov dword [esp + 0x2c], ebx
jmp 0x41f3a8
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x410c94
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x68], ebx
cmp dword [eax + 0x14], 8
jb 0x41f3b4
mov eax, dword [eax]
push 0x80
push 3
push ebx
push 3
push SysReAllocString
push eax
call fcn.0041f459
push eax
lea ecx, [esp + 0x20]
lea edi, [esp + 0x38]
call fcn.0042f5f2
lea esi, [esp + 0x1c]
mov byte [esp + 0x68], 2
call fcn.0042f635
cmp dword [esp + 0x34], 0xffffffff
je 0x41f422
push ebx
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41f41f
cmp dword [esp + 0x18], 0
jne 0x41f412
mov bl, 1
jmp 0x41f41f
mov eax, 0xfeff
cmp word [esp + 0x14], ax
sete bl
mov byte [ebp + 0xc], bl
or dword [esp + 0x68], 0xffffffff
lea eax, [esp + 0x34]
push eax
call fcn.00435efa
mov al, byte [ebp + 0xc]
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00484deb
mov esp, ebp
pop ebp
ret 8

Function at 0x424bed
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4970c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push 0x114
lea eax, [ebp - 0x118]
push ebx
push eax
mov byte [edi], bl
mov esi, ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x424c52
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x424c52
and esi, 0xffff
or esi, 0x80070000
cmp dword [ebp - 0x114], 6
ja 0x424c66
jne 0x424c69
cmp dword [ebp - 0x110], 2
jb 0x424c69
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
mov byte [edi], bl
xor ecx, ebp
pop ebx
call fcn.00484deb
leave
ret
Function at 0x42daa6
Capabilities:
Read file via mapping

Disassembly:
push 0xd0
mov eax, 0x4887b6
call fcn.004853fc
mov ecx, dword [ebp + 8]
and dword [ebp - 4], 0
mov al, byte [ebp + 0x10]
mov edi, dword [ebp + 0xc]
and dword [ebp - 0xc4], 0
push ecx
mov dword [ebp - 0xc0], esp
mov esi, ecx
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xcc], ecx
mov byte [ebp - 0xc8], al
mov dword [ebp - 0xc0], esp
call fcn.0042145d
xor ecx, ecx
inc ecx
mov eax, 0x41edbe
mov dword [ebp - 0xc4], ecx
test eax, eax
jne 0x42db06
and dword [ebp - 0x18], eax
jmp 0x42db16
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x410c94
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 8
jb 0x42db21
mov edi, dword [edi]
push ecx
push 3
push 0
push ecx
push SysReAllocString
push edi
call fcn.0041f459
push eax
lea ecx, [ebp - 0x28]
lea edi, [ebp - 0x78]
call fcn.0042f5f2
lea esi, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.0042f635
cmp dword [ebp - 0x78], 0xffffffff
je 0x42dc93
push dword [ebp - 0x78]
call fcn.0041ef1c
mov ebx, eax
test ebx, ebx
je 0x42dc93
mov eax, 0x41edbe
test eax, eax
jne 0x42db74
mov dword [ebp - 0x30], eax
jmp 0x42db86
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x410c94
xor eax, eax
push eax
push eax
push eax
push 2
push eax
mov byte [ebp - 4], 4
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
lea ecx, [ebp - 0x40]
lea edi, [ebp - 0x98]
call fcn.0042f5f2
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 6
call fcn.0042f635
cmp dword [ebp - 0x98], 0xffffffff
je 0x42dc7b
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor ecx, ecx
cmp eax, ecx
jne 0x42dbd1
mov dword [ebp - 0x48], ecx
jmp 0x42dbe1
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x410c5c
mov dword [ebp - 0x48], eax
push ecx
push ecx
push ecx
push 4
mov byte [ebp - 4], 7
push dword [ebp - 0x98]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push eax
lea ecx, [ebp - 0x58]
lea edi, [ebp - 0xb8]
call fcn.0042f5f2
lea esi, [ebp - 0x58]
mov byte [ebp - 4], 9
call fcn.0042f635
mov ecx, dword [ebp - 0xb8]
test ecx, ecx
je 0x42dc63
mov eax, 0xfeff
shr ebx, 1
cmp word [ecx], ax
jne 0x42dc63
push dword [ebp - 0xc8]
add ecx, 2
dec ebx
push ebx
lea eax, [ebp - 0xdc]
push eax
call fcn.0042dcb5
mov byte [ebp - 4], 0xa
mov esi, dword [ebp - 0xbc]
mov edi, eax
mov eax, esi
call fcn.004213e1
lea eax, [ebp - 0xdc]
push eax
mov byte [ebp - 4], 9
call fcn.00420094
jmp 0x42dc69
mov esi, dword [ebp - 0xbc]
lea eax, [ebp - 0xb8]
push eax
mov byte [ebp - 4], 6
call fcn.00435efa
jmp 0x42dc81
mov esi, dword [ebp - 0xbc]
lea eax, [ebp - 0x98]
push eax
mov byte [ebp - 4], 3
call fcn.00435efa
jmp 0x42dc99
mov esi, dword [ebp - 0xbc]
lea eax, [ebp - 0x78]
push eax
mov byte [ebp - 4], 0
call fcn.00435efa
mov eax, esi
call fcn.0048548e
ret 0xc
Function at 0x42f112
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x488348
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4970c0]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x4970c0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
push edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
and dword [esp + 0x48], 0
mov eax, dword [ebx + 4]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
cmp ecx, eax
je 0x42f1d2
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x40c060
mov dword [esp + 0x2c], eax
mov ecx, eax
mov byte [esp + 0x48], 1
call fcn.0041f4a3
lea esi, [esp + 0x1c]
mov dword [esp + 0x14], eax
mov byte [esp + 0x48], 0
call fcn.0042f635
mov eax, dword [esp + 0x14]
test eax, eax
jns 0x42f1c0
test byte [0x4a9400], 4
je 0x42f1c0
push eax
mov eax, dword [esp + 0x14]
push dword [eax + 0xa8]
call fcn.0042b539
lea ecx, [esp + 0xc]
call fcn.0042f8ab
mov ecx, dword [esp + 0xc]
cmp ecx, dword [ebx + 4]
jne 0x42f166
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00484deb
mov esp, ebp
pop ebp
ret
Function at 0x4335b5
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [esi + 0x40]
xor cl, cl
push ebx
mov bl, 1
cmp eax, 0xffff
je 0x43375c
mov edx, 0x10000000
cmp eax, 0x7c
je 0x43375c
cmp eax, 0x29
jne 0x4335f7
cmp dword [esi + 0x10], 0
jne 0x43375c
test dword [esi + 0x44], edx
jne 0x4335f7
push 5
call fcn.00484957
pop ecx
jmp 0x43373e
cmp eax, 0x2e
jne 0x433614
lea eax, [esi + 0x18]
push eax
push 5
pop eax
call fcn.00433857
mov eax, esi
call fcn.00433582
jmp 0x43373e
cmp eax, 0x5c
jne 0x433675
mov eax, esi
call fcn.00433582
mov eax, dword [esi + 0x44]
and eax, 0x80
je 0x433649
cmp word [esi + 0x3e], 0x62
jne 0x433649
lea eax, [esi + 0x18]
push eax
push 4
pop eax
call fcn.00433857
mov eax, esi
call fcn.00433582
jmp 0x433745
test eax, eax
je 0x433669
cmp word [esi + 0x3e], 0x42
jne 0x433669
lea eax, [esi + 0x18]
push eax
push 4
pop eax
call fcn.00433857
mov eax, dword [esi + 0x1c]
xor dword [eax + 8], 1
jmp 0x43363d
mov eax, esi
call fcn.004338e7
jmp 0x43373e
cmp eax, 0x5b
jne 0x43369f
mov eax, esi
call fcn.00433582
mov eax, esi
call fcn.00433897
cmp dword [esi + 0x40], 0x5d
je 0x433608
push 4
call fcn.00484957
pop ecx
jmp 0x433608
cmp eax, 0x28
jne 0x4336cb
mov eax, esi
call fcn.00433582
mov eax, esi
call fcn.004339cd
cmp dword [esi + 0x40], 0x29
mov bl, al
je 0x4336c2
push 5
call fcn.00484957
pop ecx
mov eax, esi
call fcn.00433582
jmp 0x43373a
cmp eax, 0x5e
jne 0x4336db
lea eax, [esi + 0x18]
push eax
push 2
jmp 0x433637
cmp eax, 0x24
jne 0x4336eb
lea eax, [esi + 0x18]
push eax
push 3
jmp 0x433637
cmp eax, 0x2a
je 0x433732
cmp eax, 0x2b
je 0x433732
cmp eax, 0x3f
je 0x433732
cmp eax, 0x7b
je 0x433732
cmp eax, 0x7d
jne 0x433710
test dword [esi + 0x44], edx
jne 0x433710
push 6
jmp 0x4335ec
cmp eax, 0x5d
jne 0x433721
test dword [esi + 0x44], edx
jne 0x433721
push 4
jmp 0x4335ec
mov ax, word [esi + 0x3e]
lea ecx, [esi + 0x18]
call fcn.00433be5
jmp 0x433608
push 0xa
call fcn.00484957
pop ecx
test bl, bl
je 0x433745
mov eax, esi
call fcn.00433afd
mov eax, dword [esi + 0x40]
mov cl, 1
mov bl, cl
mov edx, 0x10000000
cmp eax, 0xffff
jne 0x4335cd
mov al, cl
pop ebx
ret

Function at 0x434cac
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x18], eax
test eax, eax
jne 0x434ccd
call fcn.0041ed9b
mov esi, eax
test esi, esi
js 0x434cf3
push ebx
push ebx
push edi
push 0x434d0b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x14], eax
test eax, eax
jne 0x434cef
call fcn.0041ed9b
mov esi, eax
test esi, esi
jns 0x434d01
cmp dword [edi + 0x18], ebx
je 0x434d01
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
ret
Function at 0x43ea5c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
test edx, edx
jne 0x43ea71
push 0x80004005
call fcn.0041db0a
push esi
xor eax, eax
push edi
mov dword [ebp - 4], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x43ea84
sub ecx, dword [ebp - 8]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x43ea7c
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
leave
ret 4
Function at 0x43f004
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4970c0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
lea edx, [ebp - 0x220]
push edx
xor ebx, ebx
push 0x2001f
mov eax, ecx
mov ecx, dword [ebp + 8]
push ebx
push ecx
push dword [eax]
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x220], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x43f14d
mov esi, ebx
cmp dword [ebp - 0x218], ebx
je 0x43f081
push dword [ebp - 0x218]
call edi
mov esi, eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x218], eax
test esi, esi
jne 0x43f153
lea ecx, [ebp - 0x230]
push ecx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
mov dword [ebp - 0x21c], 0x100
call ebx
test eax, eax
jne 0x43f11f
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x218]
call fcn.0043f004
mov esi, eax
test esi, esi
jne 0x43f10e
lea eax, [ebp - 0x230]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x218]
mov dword [ebp - 0x21c], 0x100
call ebx
test eax, eax
je 0x43f0c5
jmp 0x43f121
cmp dword [ebp - 0x218], 0
je 0x43f15a
push dword [ebp - 0x218]
jmp 0x43f158
xor esi, esi
cmp dword [ebp - 0x218], 0
je 0x43f138
push dword [ebp - 0x218]
call edi
mov dword [ebp - 0x218], esi
push dword [ebp - 0x228]
mov esi, dword [ebp - 0x224]
call fcn.0041db80
mov esi, eax
jmp 0x43f10e
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x43f15a
push eax
call edi
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00484deb
leave
ret 4
Function at 0x43fb0f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x48977b
call fcn.00485437
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, edx
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push ecx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x43fb6f
call fcn.0041dacf
mov esi, eax
jmp 0x43fc85
push ebx
push esi
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
jne 0x43fb8e
call fcn.0041dacf
jmp 0x43fc7c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x43fb84
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [eax + 1]
mov dword [ebp - 0x41c], eax
cmp ecx, eax
jae 0x43fbd8
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x43fbce
lea eax, [ebp - 0x418]
call fcn.0043e65c
mov esi, 0x8007000e
jmp 0x43fc9e
push 2
push ecx
mov byte [ebp - 4], 2
call fcn.0043eafb
cmp eax, 0x400
jbe 0x43fbff
push eax
lea esi, [ebp - 0x418]
call fcn.0043e66b
mov eax, dword [ebp - 0x418]
jmp 0x43fc0b
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x43fc2f
test eax, eax
jne 0x43fc3a
mov esi, 0x8007000e
jmp 0x43fc7e
mov ecx, dword [ebp - 0x41c]
push ecx
push eax
push ecx
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x43fb84
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x10]
xor edx, edx
mov word [eax + ecx*2], dx
mov ecx, dword [ebp - 0x418]
lea edx, [ebp - 0x430]
call fcn.0043f9c1
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x43fc9e
lea eax, [ebp - 0x418]
call fcn.0043e65c
lea ecx, [ebp - 0x428]
call fcn.0041dae9
mov eax, esi
call fcn.004854a2
ret 0xc
Function at 0x443632
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x34
mov eax, 0x48a79c
call fcn.00485389
push 0x78
mov ebx, ecx
call fcn.00483e3c
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
test esi, esi
je 0x443663
push esi
call fcn.00447017
mov dword [esi], 0x410ecc
jmp 0x443665
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 1
mov ebx, dword [ebx]
and dword [esi + 0x70], 0
test ebx, ebx
je 0x4436f3
push 0x4114cc
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4436c7
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esi + 0x50], eax
test eax, eax
je 0x4436c7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 0x48], eax
test eax, eax
je 0x4436c7
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov dword [esi + 0x70], eax
call fcn.00447c14
test al, al
je 0x4436f3
mov eax, esi
call fcn.00485475
ret
xor eax, eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
test edi, edi
je 0x4436f3
push dword [ebp + 4]
mov ecx, 0x8007000e
lea esi, [ebp - 0x40]
call fcn.00449789
push 0x48daf8
mov eax, esi
push eax
call sub.msvcrt.dll__CxxThrowException
mov dword [ebp - 0x10], 0x860003
push 0x48da94
lea eax, [ebp - 0x10]
jmp 0x4436ed
Function at 0x443d00
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x48a91a
call fcn.004853c1
mov edi, edx
test edi, edi
jne 0x443d1c
mov eax, 0x810002
jmp 0x443f61
xor ebx, ebx
mov dword [ebp - 4], ebx
add edi, 0x4b8
cmp dword [ebp + 8], ebx
je 0x443d45
cmp dword [ebp + 8], 3
je 0x443d3a
push 5
pop ebx
jmp 0x443f43
mov dword [edi + 0x25c], ecx
jmp 0x443f43
xor edx, edx
inc edx
mov eax, ecx
shr eax, 6
and al, dl
mov byte [edi + 0x220], al
mov al, cl
and al, dl
mov byte [edi + 0x21d], al
mov eax, ecx
shr eax, 2
and al, dl
mov byte [edi + 0x21c], al
mov eax, ecx
shr eax, 0x11
and al, dl
mov byte [edi + 0x21f], al
mov eax, ecx
shr eax, 1
and al, dl
mov byte [edi + 0x21b], al
mov eax, ecx
shr eax, 0xe
and al, dl
mov byte [edi + 0x21e], al
mov eax, ecx
shr eax, 0xf
and al, dl
mov byte [edi + 0x258], al
mov eax, ecx
shr eax, 4
and al, dl
mov byte [edi + 9], al
mov eax, ecx
shr eax, 0x1c
and al, dl
mov byte [edi + 0x238], al
mov edx, ecx
shr edx, 0x1d
and dl, 1
mov byte [edi + 0x239], dl
mov dword [ebp - 0x14], eax
mov eax, ecx
shr eax, 0x1e
and eax, 0xffffff01
mov dword [ebp + 8], eax
mov byte [edi + 0x23a], al
mov eax, ecx
and eax, 0xf0000000
je 0x443e25
cmp eax, 0x10000000
je 0x443e14
cmp eax, 0x20000000
je 0x443e09
cmp eax, 0x30000000
jne 0x443e34
xor eax, eax
inc eax
mov byte [edi + 0x23e], al
mov byte [edi + 0x23d], al
jmp 0x443e1d
mov word [edi + 0x23c], 1
jmp 0x443e2e
mov word [edi + 0x23d], 0x100
mov byte [edi + 0x23c], bl
jmp 0x443e34
mov word [edi + 0x23c], 0x100
mov byte [edi + 0x23e], bl
mov eax, dword [ebp + 8]
mov byte [edi + 0x21a], dl
mov byte [edi + 1], dl
mov byte [edi + 2], al
mov eax, dword [ebp - 0x14]
mov edx, ecx
mov byte [edi], al
and edx, 0x10000000
je 0x443e62
test ecx, 0x20000000
je 0x443e62
mov dword [edi + 0x228], ebx
jmp 0x443e70
xor eax, eax
test edx, edx
sete al
inc eax
mov dword [edi + 0x228], eax
mov esi, ecx
and esi, 0x40000000
je 0x443e86
test ecx, ecx
jns 0x443e86
mov dword [edi + 0x22c], ebx
jmp 0x443e94
xor eax, eax
test esi, esi
sete al
inc eax
mov dword [edi + 0x22c], eax
test edx, edx
je 0x443ea8
test ecx, 0x20000000
je 0x443ea8
mov dword [edi + 0x234], ebx
jmp 0x443eb6
xor eax, eax
test edx, edx
sete al
inc eax
mov dword [edi + 0x234], eax
mov eax, dword [edi + 0x10]
and eax, 0x3ff
cmp ax, 0x16
jne 0x443ecc
push ecx
mov esi, edi
call fcn.004449bb
mov edx, edi
call fcn.0044f795
mov eax, dword [edi + 0x10]
xor ecx, ecx
and eax, 0x3ff
inc ecx
cmp ax, cx
jne 0x443f43
lea eax, [ebp + 8]
push eax
push ecx
push ebx
push 0x410d1c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x443f43
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x410d4c
push dword [ebp + 8]
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x443f43
cmp dword [ebp - 0x18], ebx
je 0x443f43
xor eax, eax
inc eax
mov edx, edi
mov byte [edi + 0x23a], al
call fcn.0044f795
mov eax, ebx
jmp 0x443f61
call fcn.00485475
ret 4
Function at 0x443f74
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push edi
mov edi, ecx
test edi, edi
jne 0x443f84
mov eax, 0x810002
pop edi
ret
test ebx, ebx
jne 0x443f8d
push 2
pop eax
pop edi
ret
movzx ecx, word [edi + 0x4c8]
add edi, 0x4b8
xor edx, edx
and ecx, 0x3ff
sub eax, edx
je 0x443fbc
dec eax
je 0x443fb1
push 5
pop edx
jmp 0x44417a
mov dword [ebx], 0xf0027057
jmp 0x44417a
movzx eax, byte [edi + 0x220]
push esi
movzx esi, byte [edi + 0x21e]
neg esi
sbb esi, esi
and esi, 0x4000
neg eax
sbb eax, eax
and eax, 0x40
or esi, eax
movzx eax, byte [edi + 0x258]
neg eax
sbb eax, eax
and eax, 0x8000
or esi, eax
movzx eax, byte [edi + 0x21f]
neg eax
sbb eax, eax
and eax, 0x20000
or esi, eax
movzx eax, byte [edi + 0x21c]
neg eax
sbb eax, eax
and eax, 4
or esi, eax
xor eax, eax
cmp byte [edi + 0x21d], al
setne al
or esi, eax
movzx eax, byte [edi + 0x21b]
neg eax
sbb eax, eax
and eax, 2
or esi, eax
movzx eax, byte [edi + 9]
neg eax
sbb eax, eax
and eax, 0x10
or esi, eax
dec ecx
je 0x44413d
sub ecx, 6
je 0x44412a
sub ecx, 3
je 0x444121
dec ecx
dec ecx
je 0x4440e5
dec ecx
je 0x4440ab
sub ecx, 9
je 0x444082
sub ecx, 3
jne 0x444177
movzx eax, byte [edi + 2]
neg eax
sbb eax, eax
and eax, 0x40000000
or esi, eax
jmp 0x444177
mov eax, dword [edi + 0x230]
test eax, eax
jne 0x444097
or esi, 0x30000000
jmp 0x444177
cmp eax, 1
jne 0x444135
or esi, 0x10000000
jmp 0x444177
cmp byte [edi + 0x23d], dl
je 0x4440bb
cmp byte [edi + 0x23e], dl
jne 0x44408c
movzx ecx, byte [edi + 0x23c]
movzx eax, byte [edi + 0x23e]
neg ecx
sbb ecx, ecx
and ecx, 0x20000000
neg eax
sbb eax, eax
and eax, 0x10000000
or ecx, eax
or esi, ecx
jmp 0x444177
mov eax, edi
call fcn.0044fb93
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x20000000
or esi, eax
mov eax, dword [edi + 0x22c]
test eax, eax
jne 0x44410c
or esi, 0xc0000000
jmp 0x444177
cmp eax, 1
jne 0x444119
or esi, 0x40000000
jmp 0x444177
or esi, 0x80000000
jmp 0x444177
movzx ecx, byte [edi + 1]
movzx eax, byte [edi]
jmp 0x4440c9
mov eax, dword [edi + 0x228]
jmp 0x444088
or esi, 0x20000000
jmp 0x444177
movzx edx, byte [edi + 0x23a]
movzx eax, byte [edi + 0x239]
movzx ecx, byte [edi + 0x238]
neg edx
sbb edx, edx
and edx, 0x40000000
neg eax
sbb eax, eax
and eax, 0x20000000
or edx, eax
neg ecx
sbb ecx, ecx
and ecx, 0x10000000
or edx, ecx
or esi, edx
xor edx, edx
mov dword [ebx], esi
pop esi
mov eax, edx
pop edi
ret
Function at 0x4449bb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push 0x11
push ebx
push 0x410d68
push SysReAllocString
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x444a31
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x410ddc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x444a31
cmp dword [ebp - 8], 4
jne 0x444a31
mov eax, dword [ebp - 0xc]
cmp eax, 3
ja 0x444a31
je 0x444a4c
cmp eax, 1
jne 0x444a28
inc ebx
jmp 0x444a4c
cmp eax, 2
jne 0x444a31
push eax
pop ebx
jmp 0x444a4c
mov eax, dword [ebp + 8]
and eax, 0x10000000
je 0x444a44
test dword [ebp + 8], 0x20000000
jne 0x444a4c
xor ebx, ebx
test eax, eax
sete bl
inc ebx
cmp dword [ebp - 4], 0
je 0x444a5b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 0x230], ebx
pop ebx
leave
ret 4

Function at 0x4487ef
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push 1
push 0
push 0
push ebx
mov edi, ecx
call esi
movzx edx, byte [edi + 0x20]
mov dword [ebp + 8], edx
xor edx, edx
mov dword [ebp - 4], eax
mov ecx, eax
div dword [ebp + 8]
test edx, edx
je 0x44882f
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
sub ecx, edx
add ecx, eax
jmp 0x448831
mov eax, ecx
mov dword [edi + 0x24], ecx
cmp eax, ecx
je 0x448840
push 0
push 0
push ecx
push ebx
call esi
mov eax, edi
call fcn.00448cc5
mov esi, dword [eax]
and esi, 0xff000000
neg esi
sbb esi, esi
and dword [ebp - 8], 0
add esi, 2
shl esi, 2
sub esi, dword [edi + 0xc]
push 0
add esi, eax
lea eax, [ebp - 8]
push eax
push esi
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4488a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x44888b
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 4]
mov ecx, eax
lea esi, [ebp - 0x34]
call fcn.00449789
push 0x48daf8
mov eax, esi
push eax
call sub.msvcrt.dll__CxxThrowException
cmp dword [ebp - 8], esi
je 0x4488d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4488be
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 4]
mov ecx, eax
lea esi, [ebp - 0x60]
call fcn.00449789
push 0x48daf8
mov eax, esi
jmp 0x44889f
cmp byte [edi + 0x16], 0
je 0x4488ec
mov eax, dword [edi + 4]
sub eax, dword [edi + 0x28]
push 0
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub eax, dword [edi + 0x24]
mov dword [edi + 0x28], eax
pop edi
pop esi
pop ebx
leave
ret 4