joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426614
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x42679f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x426784
xor eax, eax
push ebp
push 0x42677d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
cmp dword [ebp - 8], 0
je 0x426766
mov eax, dword [ebp - 8]
add eax, eax
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
push 3
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x426760
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x4267b8
call fcn.00414818
mov eax, dword [ebp - 0x1c]
call fcn.004041e8
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x4266dc
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x20]
mov eax, 0x4267d4
call fcn.00414818
mov eax, dword [ebp - 0x20]
call fcn.004041e8
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x42670f
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov esi, dword [ebx]
dec esi
test esi, esi
jl 0x42674c
inc esi
xor ecx, ecx
lea edi, [ecx + ecx*2]
mov eax, dword [ebx + edi*4 + 4]
mov edx, dword [ebx + edi*4 + 8]
cmp edx, dword [ebp - 0xc]
jne 0x42672c
cmp eax, dword [ebp - 0x10]
je 0x426748
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x14]
jne 0x426741
cmp eax, dword [ebp - 0x18]
je 0x426748
or dword [ebx + edi*4 + 0xc], 2
inc ecx
dec esi
jne 0x426719
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push ebx
call sub.kernel32.dll_LocalFree_2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426784
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4267a6
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00403d70
ret
Function at 0x428bcc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
xor eax, eax
mov dword [ebp - 0x10c], eax
xor eax, eax
push ebp
push 0x428c70
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
mov edx, 0x105
call fcn.00406210
push 0x105
lea eax, [ebp - 0x105]
push eax
push 0x428c7c
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
je 0x428c44
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00403fbc
mov ecx, dword [ebp - 0x10c]
mov dl, 1
mov eax, dword [0x4286fc]
call fcn.0042886c
mov dword [0x431b3c], eax
jmp 0x428c57
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4286fc]
call fcn.0042886c
mov dword [0x431b3c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428c77
lea eax, [ebp - 0x10c]
call fcn.00403d4c
ret
Function at 0x1001d69c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x1001f168
sub eax, eax
test esi, esi
je 0x1001d774
sub eax, 1
test ecx, ecx
je 0x1001d772
test esi, 3
je 0x1001d6da
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x1001d6bf
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x1001d759
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x1001d6e4
mov ecx, edx
test ecx, ecx
je 0x1001d772
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x1001d75f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x1001d77c
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.1001d7ff
jae 0x1001d78a
xor ecx, ecx
call fcn.1001d7ff
jae 0x1001d7b9
xor eax, eax
call fcn.1001d7ff
jae 0x1001d7c9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.1001d7ff
adc al, al
jae 0x1001d7ab
jne 0x1001d7f5
stosb byte es:[edi], al
jmp 0x1001d78d
call fcn.1001d80b
sub ecx, ebx
jne 0x1001d7d2
call fcn.1001d809
jmp 0x1001d7f1
lodsb al, byte [esi]
shr eax, 1
je 0x1001d81b
adc ecx, ecx
jmp 0x1001d7ee
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.1001d809
cmp eax, 0x7d00
jae 0x1001d7ee
cmp ah, 5
jae 0x1001d7ef
cmp eax, 0x7f
ja 0x1001d7f0
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1001d78d
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x100b569c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x100b7168
sub eax, eax
test esi, esi
je 0x100b5774
sub eax, 1
test ecx, ecx
je 0x100b5772
test esi, 3
je 0x100b56da
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x100b56bf
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x100b5759
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x100b56e4
mov ecx, edx
test ecx, ecx
je 0x100b5772
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x100b575f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x100b577c
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.100b57ff
jae 0x100b578a
xor ecx, ecx
call fcn.100b57ff
jae 0x100b57b9
xor eax, eax
call fcn.100b57ff
jae 0x100b57c9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.100b57ff
adc al, al
jae 0x100b57ab
jne 0x100b57f5
stosb byte es:[edi], al
jmp 0x100b578d
call fcn.100b580b
sub ecx, ebx
jne 0x100b57d2
call fcn.100b5809
jmp 0x100b57f1
lodsb al, byte [esi]
shr eax, 1
je 0x100b581b
adc ecx, ecx
jmp 0x100b57ee
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.100b5809
cmp eax, 0x7d00
jae 0x100b57ee
cmp ah, 5
jae 0x100b57ef
cmp eax, 0x7f
ja 0x100b57f0
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x100b578d
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x401680
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x41efb0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x43f7ac]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x214]
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x14], 1
cmp eax, 0x80000000
jb 0x4017b0
mov byte [ebp], bl
push 0x103
push ebx
lea ecx, [ebp + 1]
push ecx
call fcn.0040feb0
add esp, 0xc
push 0x104
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp]
push eax
call fcn.0040e2c0
add esp, 4
xor esi, esi
mov dword [ebp - 0x18], esi
lea ebx, [ebx]
cmp esi, 0xf
jae 0x4017b0
mov byte [ebp + 0x104], bl
push 0x103
push ebx
lea ecx, [ebp + 0x105]
push ecx
call fcn.0040feb0
add esp, 0xc
lea ecx, [ebp]
lea edx, [ebp + 0x104]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x401750
mov eax, dword [esi*4 + 0x421620]
mov edx, eax
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x401767
sub eax, edx
lea edi, [ebp + 0x104]
add edi, 0xffffffff
jmp 0x401780
mov cl, byte [edi + 1]
add edi, 1
cmp cl, bl
jne 0x401780
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp + 0x104]
push edx
call fcn.0040f370
add esp, 4
test eax, eax
je 0x4017df
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0040fe67
add ebp, 0x20c
mov esp, ebp
pop ebp
ret
add dword [ebp - 0x18], 1
mov esi, dword [ebp - 0x18]
jmp 0x401720
Function at 0x403580
Capabilities:
Print debug messages

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push eax
push 8
push esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x4035ba
push str.____DataEvent::_Failed_to_allocate_memory_n_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x437f98
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 1
call fcn.00410ecc
mov dword [eax + 4], esi
pop esi
pop ecx
ret

Function at 0x4042a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f430
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x43f7ac]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
cmp dword [0x440b68], 0
jne 0x4043bb
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x118]
push ecx
call fcn.0040e2c0
add esp, 4
lea eax, [ebp - 0x118]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x404310
mov edx, dword [str.kernel32.dll]
mov dword [eax], edx
mov ecx, dword [0x4219fc]
mov dword [eax + 4], ecx
mov edx, dword [0x421a00]
mov dword [eax + 8], edx
mov cl, byte [0x421a04]
mov byte [eax + 0xc], cl
call fcn.00404270
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocStringLen
lea edx, [ebp - 0x118]
push edx
call dword [0x440b84]
mov esi, eax
cmp esi, 0xffffffff
je 0x4043bb
push 0x440b7c
push 0x440b74
push 0x440b6c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x4043b4
cmp dword [0x440b6c], 0
jne 0x4043aa
cmp dword [0x440b70], 0
jne 0x4043aa
mov eax, dword [0x440b7c]
mov dword [0x440b6c], eax
mov ecx, dword [0x440b80]
mov dword [0x440b70], ecx
mov dword [0x440b68], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040fe67
mov esp, ebp
pop ebp
ret
Function at 0x404d80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f540
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x43f7ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 5
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov edi, dword [ebp + 0xc]
push edi
mov ebx, dword [ebp + 8]
push ebx
call fcn.004048b0
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x404e5d
push edi
push ebx
call fcn.00404b10
add esp, 8
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x404e51
push edi
push ebx
call fcn.00404c60
add esp, 8
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x404e43
lea ecx, [ebp - 0x1c]
push ecx
push 0xc0000000
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x404e43
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
push esi
push esi
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x18]
push ecx
push edi
push ebx
call fcn.004049f0
add esp, 0xc
mov edx, dword [ebp - 0x18]
push edx
call fcn.0040dbc0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4050a0
Capabilities:
Delete registry value

Disassembly:
mov edx, dword [esp + 8]
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x14]
xor esi, esi
lea ecx, [esp + 8]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4050ea
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 4]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x405100
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x114
mov eax, dword [0x43f7ac]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
mov ebp, dword [esp + 0x124]
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4051c3
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push eax
push eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push ecx
mov dword [esp + 0x34], 0x100
call edi
test eax, eax
jne 0x4051ae
nop
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push eax
call fcn.00405100
mov esi, eax
add esp, 8
test esi, esi
jne 0x4051da
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push eax
push eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x34]
push eax
push esi
push ecx
mov dword [esp + 0x34], 0x100
call edi
test eax, eax
je 0x405170
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
mov ecx, dword [esp + 0x118]
pop ebp
pop ebx
xor ecx, esp
call fcn.0040fe67
add esp, 0x114
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4051c1

Function at 0x4051f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x414
mov eax, dword [0x43f7ac]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [esp + 0x420]
push ebx
push ebp
mov ebp, dword [esp + 0x42c]
push esi
push edi
mov edi, dword [esp + 0x428]
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0x18], eax
je 0x4052f4
mov esi, dword [esp + 0x42c]
cmp esi, ebx
je 0x4052f4
cmp ebp, ebx
je 0x4052f4
push 0x3ff
lea ecx, [esp + 0x25]
push ebx
push ecx
mov byte [esp + 0x2c], bl
call fcn.0040feb0
lea edx, [esp + 0x2c]
add esp, 0xc
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x405261
lea edx, [esp + 0x14]
push edx
push 0x20019
push ebx
lea eax, [esp + 0x2c]
push eax
push edi
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4052f4
mov eax, dword [esp + 0x43c]
sub eax, 1
mov dword [esp + 0x10], ebx
je 0x4052a6
sub eax, 3
je 0x4052ea
sub eax, 3
jne 0x4052b1
mov ecx, dword [esp + 0x438]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
push ebp
lea eax, [esp + 0x444]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov esi, 1
je 0x4052db
mov esi, ebx
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4052f6
mov dword [esp + 0x10], 4
jmp 0x4052b1
xor eax, eax
mov ecx, dword [esp + 0x420]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040fe67
add esp, 0x414
ret
Function at 0x405a40
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x41f6e8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x43f7ac]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov ecx, dword [ebp + 0x214]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 0x218]
mov dword [ebp - 0x24], eax
xor ebx, ebx
mov dword [ebp - 0x14], ebx
cmp dword [edi + 0x11c], ebx
jne 0x405aa4
xor eax, eax
jmp 0x405c38
mov dword [ebp - 4], ebx
push ebx
call fcn.00403f70
mov eax, dword [edi + 0x124]
cmp eax, 2
jne 0x405b7c
lea ecx, [ebp - 0x18]
push ecx
push 0xf003f
push ebx
add edi, 4
push edi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405c2e
mov dword [ebp - 0x2c], ebx
mov byte [ebp], al
mov dword [ebp - 0x20], 0x208
lea ebx, [ebx]
lea edx, [ebp - 0x38]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp]
push ecx
push ebx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x405b66
lea eax, [ebp]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x405b17
sub eax, edx
lea edi, [eax + 1]
push edi
call fcn.0040db80
add esp, 4
lea edx, [ebp]
mov esi, eax
mov cl, byte [edx]
mov byte [esi], cl
add edx, 1
add esi, 1
test cl, cl
jne 0x405b33
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00403c60
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x405b53
add dword [eax], edi
mov byte [ebp], 0
mov dword [ebp - 0x20], 0x208
add ebx, 1
mov dword [ebp - 0x2c], ebx
jmp 0x405af0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], 1
jmp 0x405c2e
cmp eax, 1
jne 0x405c2e
push 0xffffffffffffffff
push str.EnumSections
mov ecx, dword [edi + 0x138]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00408160
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
mov ecx, edi
call fcn.00405480
cmp dword [edi + 0x12c], ebx
je 0x405c10
mov dword [ebp - 0x30], ebx
cmp ebx, dword [edi + 0x130]
jae 0x405c10
mov edx, dword [edi + 0x12c]
mov eax, dword [edx + ebx*4]
mov eax, dword [eax]
lea edx, [eax + 1]
jmp 0x405bd0
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x405bd0
sub eax, edx
add eax, 1
push eax
call fcn.0040db80
add esp, 4
mov ecx, dword [edi + 0x12c]
mov edx, dword [ecx + ebx*4]
mov edx, dword [edx]
mov esi, eax
mov cl, byte [edx]
mov byte [esi], cl
add edx, 1
add esi, 1
test cl, cl
jne 0x405bf4
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00403c60
add ebx, 1
jmp 0x405bb2
mov ecx, edi
call fcn.004057d0
mov eax, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00408240
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0040fe67
add ebp, 0x20c
mov esp, ebp
pop ebp
ret 8
Function at 0x4062c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f7b0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x43f7ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov ecx, 0x440b94
call fcn.004038a0
mov dword [ebp - 4], ebx
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x406470
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x406470
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
jne 0x4063aa
mov eax, dword [esi]
cmp eax, ebx
je 0x40639e
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x14], ebx
mov eax, dword [esi + 0x110]
mov ecx, dword [eax - 8]
push ebx
lea edx, [ebp - 0x1c]
push edx
push ecx
push eax
mov eax, dword [esi]
push eax
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
call edi
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x40638e
mov dword [ebp - 0x20], ebx
cmp ebx, 0xa
jae 0x40639e
mov eax, dword [esi + 0x110]
mov ecx, dword [eax - 8]
push 0
lea edx, [ebp - 0x1c]
push edx
push ecx
push eax
mov eax, dword [esi]
push eax
call edi
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x40638e
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 1
jmp 0x40635c
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 0x18], 1
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x4063b8
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [esi + 4]
push ecx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov edx, dword [esi]
push edx
call edi
lea edi, [esi + 0xc]
push edi
call fcn.00404400
mov dword [esi], ebx
push 0x104
push ebx
push edi
call fcn.0040feb0
add esp, 0x10
lea ecx, [esi + 0x110]
call fcn.004031d0
lea ecx, [esi + 0x114]
call fcn.004031d0
mov ecx, 0x440b94
call fcn.00403ec0
mov edi, eax
test edi, edi
je 0x406439
push edi
mov ecx, 0x440b94
call fcn.00403ed0
mov ebx, eax
mov ecx, edi
call fcn.00403530
test eax, eax
je 0x40646c
mov ecx, edi
call fcn.00403530
cmp esi, eax
jne 0x40646c
push 0
push edi
mov ecx, 0x440b94
call fcn.00403dd0
test esi, esi
je 0x406446
push 1
mov ecx, esi
call fcn.004062a0
mov dword [ebp - 4], 0xffffffff
mov ecx, 0x440b94
call fcn.00403910
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, ebx
jmp 0x406405
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret