joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010dae
Capabilities:
Inspect section memory permissions

Disassembly:
inc dword [ebx + 0x39660cc4]
pop edi
push es
mov dword [ebp + 0xc], ebx
jbe 0x10010dee
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.100107ef
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x10010dbb
call fcn.1001087e
pop edi
fst qword [ebp - 0x75]
jle 0x10010e36
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x1001106d
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x10010e23
cmp dword [eax + 0xc], ebx
je 0x10010ec6
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.1001087e
mov ebx, 0x39cf919a
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
invalid
call fcn.1001087e
pop edx
dec ebp
insd dword es:[edi], dx
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x10010f32
add eax, esi
cmp dword [eax], ebx
je 0x10010f32
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x10010f2d
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10010f17
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10010f1f
cmp edx, ebx
jne 0x1001106d
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10010eee
add eax, dword [eax + 4]
jmp 0x10010edb
mov dword [ebp + 0xc], ebx
jmp 0x10010f3d
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10010f55
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10010f73
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10010fd1
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
add byte [eax - 0x77], al
jge 0x10010fb0
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10010fb8
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10010fc1
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10010fcb
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10010fad
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10010f37
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x1001e69e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x10027b40]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.1001e633
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.1000e400
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x1001e6ed
cmp dword [ebp - 0x1c], 5
jb 0x1001e705
jmp 0x1001e701
cmp dword [ebp - 0x10], 1
jne 0x1001e705
cmp dword [ebp - 0x1c], 4
ja 0x1001e701
jne 0x1001e705
cmp dword [ebp - 0x18], 0
jbe 0x1001e705
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x100235b0
call fcn.1001e524
test eax, eax
jge 0x1001e726
mov byte [0x1002ba8c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1000c79d
add ebp, 0x78
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40288e
pop dword [ebp - 0x18]
mov eax, 0x40288e
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x6e55ece2
sub dword [ebp - 0x28], 0x2003a797
mov dword [ebp - 0x24], 0xdfdf8dfa
sub dword [ebp - 0x24], 0xadac41b5
mov dword [ebp - 0x20], 0x4f9bb376
sub dword [ebp - 0x20], 0x34f6f48
mov dword [ebp - 0x1c], 0x81951186
sub dword [ebp - 0x1c], 0x81951186
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x1f9488dc
add dword [ebp - 0x28], 0x54dde07a
mov dword [ebp - 0x24], 0x68b0dc4c
sub dword [ebp - 0x24], 0x27447ad7
mov dword [ebp - 0x20], 0x132f0eb7
sub dword [ebp - 0x20], 0xafbfa24b
mov dword [ebp - 0x1c], 0xe828b73
sub dword [ebp - 0x1c], 0xe828b73
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x8f0b365e
sub eax, 0x8ecab58a
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x38032
push 0
call eax
mov ecx, 0x59594074
sub ecx, 0x5958f2ca
mov ebx, eax
mov edx, 0xcabe609e
add edx, 0x3582af62
add edx, dword [ebp - 0x18]
mov edi, 0xd8423467
add edi, 0xbb687d30
sub dword [ebp - 0x14], 0x85b74b6e
mov esi, dword [edx]
add dword [ebp - 0x14], eax
add esi, edi
mov dword [ebp - 4], 0xaf717e1f
mov dword [ebx], esi
xor dword [ebp - 0xc], 0x10a48c1d
add ebx, 0x644f8589
sub ebx, 0x644f8585
add edx, 4
loop 0x4029a6
add eax, 0xcbb6b644
add eax, 0x344a7337
mov ebx, eax
add eax, 5
mov ecx, 0xd0ee20ce
add ecx, 0x2f51df32
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x406243
pop dword [ebp - 0x20]
mov eax, 0x406243
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xe9779cc0
add dword [ebp - 0x30], 0x64daa88b
mov dword [ebp - 0x2c], 0x9c0ef6c5
sub dword [ebp - 0x2c], 0x69dbaa80
mov dword [ebp - 0x28], 0xd60dab31
sub dword [ebp - 0x28], 0x89c16703
mov dword [ebp - 0x24], 0x9c12589a
sub dword [ebp - 0x24], 0x9c12589a
lea eax, [ebp - 0x30]
push eax
mov eax, 0xf393c118
sub eax, 0xf3534014
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xe6db131f
sub dword [ebp - 0x30], 0x7268a9c9
mov dword [ebp - 0x2c], 0xd6791abe
add dword [ebp - 0x2c], 0x6af346b7
mov dword [ebp - 0x28], 0x1b995e87
add dword [ebp - 0x28], 0x47d60de5
mov dword [ebp - 0x24], 0x28fdef0
add dword [ebp - 0x24], 0xfd702110
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x90e1b0b4
add eax, 0x6f5ed04c
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x38acb
push 0
call eax
mov ecx, 0x4e9b
xor esi, esi
add esi, eax
mov edi, 0x46e400
add edi, dword [ebp - 0x20]
mov edx, 0x41eeb87e
sub edx, 0xda0efdf8
xor dword [ebp - 8], ebx
mov ebx, dword [edi]
sub dword [ebp - 8], 0x7e8ddf5c
xor ebx, edx
add dword [ebp - 4], edx
mov dword [esi], ebx
sub dword [ebp - 8], 0x813d3340
add esi, 4
add edi, 0xbc4a8d5e
sub edi, 0xbc4a8d5a
loop 0x406356
add eax, 0xb1b01787
add eax, 0x4e5115b8
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xbf9f3b82
add ecx, 0x40a0c47e
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x405e30
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b280
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4394c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], eax
cmp dword [edi + 0x10], 0
jne 0x405e7a
mov eax, 7
jmp 0x405f78
lea eax, [ebp - 0x4c]
push eax
call fcn.004060e0
push edi
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00407d90
add esp, 4
mov byte [ebp - 4], 2
cmp dword [ebp - 0x38], 8
jb 0x405ead
push dword [ebp - 0x4c]
call fcn.00417533
add esp, 4
xor eax, eax
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], 0
mov word [ebp - 0x4c], ax
lea esi, [eax + 7]
cmp dword [ebp - 0x1c], eax
je 0x405f32
cmp dword [ebp - 0x18], 8
mov ecx, dword [ebp - 0x2c]
jae 0x405ed5
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x14], 8
jb 0x405ee0
mov eax, dword [eax]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x405f32
cmp dword [ebx + 0x14], 8
jb 0x405ef6
mov ebx, dword [ebx]
cmp dword [edi + 0x14], 8
jb 0x405efe
mov edi, dword [edi]
push ebx
push edi
push 0
push 0
call dword [sym.imp.WINSPOOL.DRV_AddPrintProcessorW]
test eax, eax
je 0x405f1d
push 0
mov esi, 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x405f40
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x405f29
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x405f40
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x405f40
lea esi, [eax + 2]
mov edi, dword [ebp - 0x30]
mov eax, dword [edi + 4]
test eax, eax
je 0x405f65
cmp esi, 1
jne 0x405f5a
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
call eax
test eax, eax
jne 0x405f65
mov eax, dword [edi + 4]
push esi
mov eax, dword [eax]
mov eax, dword [eax + 0x20]
call eax
cmp dword [ebp - 0x18], 8
jb 0x405f76
push dword [ebp - 0x2c]
call fcn.00417533
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00416cb0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405fa0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b2b8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4394c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp dword [edi + 0x10], 0
je 0x4060bb
cmp dword [eax + 0x10], 0
je 0x4060bb
cmp dword [eax + 0x14], 8
mov esi, 7
jb 0x405ff4
mov eax, dword [eax]
push eax
push 0
push 0
call dword [sym.imp.WINSPOOL.DRV_DeletePrintProcessorW]
test eax, eax
je 0x406095
lea eax, [ebp - 0x40]
push eax
call fcn.004060e0
push edi
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407d90
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x2c], 8
jb 0x40603d
push dword [ebp - 0x40]
call fcn.00417533
add esp, 4
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x406049
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40606b
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x406060
lea eax, [ebp - 0x28]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [ebp - 0x14], 8
mov esi, 1
jb 0x406081
push dword [ebp - 0x28]
call fcn.00417533
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov eax, dword [ebx + 4]
test eax, eax
je 0x4060b7
cmp esi, 1
jne 0x4060ac
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
call eax
test eax, eax
jne 0x4060b7
mov ecx, dword [ebx + 4]
push esi
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x20]
call ecx
mov eax, esi
jmp 0x4060c0
mov eax, 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416cb0
mov esp, ebp
pop ebp
ret 8
Function at 0x406610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b3e8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4394c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, eax
mov dword [ebp - 0x44], eax
call fcn.00407300
push 6
xor eax, eax
mov dword [ebp - 0x1c], 7
push str.Owners
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
call fcn.004024d0
mov dword [ebp - 4], 0
cmp dword [0x43a52c], 8
mov eax, dword [0x43a518]
jae 0x406685
mov eax, 0x43a518
lea ecx, [ebp - 0x3c]
push ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4067ec
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x4066a9
lea eax, [ebp - 0x30]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x38]
push ecx
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
push eax
push dword [ebp - 0x3c]
call edi
test eax, eax
jne 0x4067ec
cmp dword [ebp - 0x18], 7
jne 0x4067ec
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00412eda
mov esi, eax
add esp, 4
mov dword [ebp - 0x34], esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x406704
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x38]
push ecx
push esi
push 0
push 0
push eax
push dword [ebp - 0x3c]
call edi
test eax, eax
jne 0x4067db
mov edi, esi
xor ebx, ebx
mov dword [ebp - 0x40], ebx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x406725
sub edi, ecx
sar edi, 1
je 0x4067c6
mov edx, esi
lea esp, [esp]
xor eax, eax
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x5c], ax
cmp word [edx], ax
jne 0x40675d
xor ecx, ecx
jmp 0x406774
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406762
sub ecx, ebx
mov ebx, dword [ebp - 0x40]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x5c]
call fcn.004024d0
mov ecx, dword [ebp - 0x44]
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp - 4], 2
call fcn.00407240
mov byte [ebp - 4], 1
cmp dword [ebp - 0x48], 8
jb 0x4067a3
push dword [ebp - 0x5c]
call fcn.00417533
add esp, 4
inc edi
add ebx, edi
mov dword [ebp - 0x40], ebx
lea edx, [esi + ebx*2]
mov edi, edx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4067b1
sub edi, ecx
sar edi, 1
jne 0x406740
mov byte [ebp - 4], 0
test esi, esi
je 0x4067d7
push esi
call fcn.004177db
add esp, 4
mov bl, 1
jmp 0x4067ee
mov byte [ebp - 4], 0
test esi, esi
je 0x4067ec
push esi
call fcn.004177db
add esp, 4
xor bl, bl
cmp dword [ebp - 0x1c], 8
jb 0x4067ff
push dword [ebp - 0x30]
call fcn.00417533
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00416cb0
mov esp, ebp
pop ebp
ret 4
Function at 0x409220
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b5f6
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x4394c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
mov edi, dword [ebp + 0xc]
push 0x104
push eax
mov dword [ebp - 0x24c], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
jne 0x409299
xor ecx, ecx
jmp 0x4092b1
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4092a2
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.004024d0
push 0x4342c0
lea edx, [ebp - 0x230]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.00407b30
push edi
mov edx, eax
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.00407d90
add esp, 8
cmp dword [ebp - 0x234], 8
jb 0x409309
push dword [ebp - 0x248]
call fcn.00417533
add esp, 4
xor eax, eax
mov dword [ebp - 0x234], 7
cmp dword [ebp - 0x21c], 8
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
jb 0x40933d
push dword [ebp - 0x230]
call fcn.00417533
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416cb0
mov esp, ebp
pop ebp
ret 8
Function at 0x409bf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x436fd8
push 0x41caa0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4394c8]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x24], esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
je 0x409c45
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x409c63
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], 0xfffffffe
call fcn.00409c8e
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00416cb0
mov esp, ebp
pop ebp
ret

Function at 0x40a270
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b722
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4394c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0
call fcn.00413432
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
jne 0x40a304
mov dword [ebp - 0x18], str.bad_locale_name
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call fcn.00409fe0
push eax
push esi
call fcn.00413261
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40ad20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b7eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4394c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00417583
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x40add6
push 1
mov dword [edi], 0
call fcn.0041318c
mov dword [edi], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40f390
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ba1b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4394c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 4
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00417583
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x40f3eb
push 1
mov dword [esi], 0
call fcn.0041318c
add esp, 4
mov dword [esi], eax
jmp 0x40f3ed
xor esi, esi
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x412990
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4394c8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x43a574], 8
mov eax, dword [ebp + 0xc]
mov edx, dword [0x43a560]
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
jae 0x4129c6
mov edx, 0x43a560
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
mov eax, esi
or eax, 0x20006
push eax
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x412a1a
cmp dword [0x43a55c], 8
mov eax, dword [0x43a548]
jae 0x4129fc
mov eax, 0x43a548
push 4
push dword [ebp - 0xc]
push 4
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 2
je 0x412a4b
test edi, edi
je 0x412a4b
sub esi, 0x100
lea eax, [ebx + 0xc]
neg esi
push edi
sbb esi, esi
and esi, 0xffffffe0
add esi, 0x40
push esi
push str.PluginManager::WriteOutlookRegKey__:_Setting_state_for_LM_in__d_bit_view._Result_code_is__x.
push 0xc8
push eax
call fcn.00409df0
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416cb0
mov esp, ebp
pop ebp
ret 8