joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5dd05a
Capabilities:
Authenticate hmac

Disassembly:
mov ebx, 0x36787446
or dh, dl
jnp 0x5dd02e
aas
je 0x5dd075
pop edi
inc edi
je 0x5dd079
or dh, dl
jnp 0x5dd03d
aas
je 0x5dd081
xlatb
ret
mov ebx, 0x3f367818
adc eax, edx
fisub word [ebx - 0x39ee9abf]
sbb byte [eax + 0x36], bh
aas
aas
push edi
inc edx
cmp dh, byte [eax + edi*2 + 0x36]
bound ebx, qword [eax + edi*2]
aas
push edi
inc edx
aas
je 0x5dd0c9
fisub dword ss:[ebx + 0x5b024230]
jno 0x5dd090
jbe 0x5dcff1
rcr bl, 1
outsd dx, dword ds:[esi]
inc byte [0xdc6bc640]
outsd dx, dword ds:[esi]
invalid
pop edx
mov ebx, 0x66d96d78
insd dword es:[edi], dx
fldenv [esi + 0x6d]
js 0x5dd0b4
aas
iretd
xor ah, ah
and al, 0x2d
add al, 0xc4
fldcw word [edi - 0x41]
test dword [eax + 0x78], ecx
mov eax, 0x5c147c4a
adc al, 0x5c
aas
je 0x5dd083
jne 0x5dd106
invalid
invalid
and eax, 0x21fc7f5a
js 0x5dd08d
jg 0x5dd0bb
and dword [eax - 0x35], edi
sar dword [ecx - 0xc], 0x31
inc ebx
bound ebx, qword es:[esi + 0x42]
pop esi
inc edx
je 0x5dd145
loopne 0x5dd0bd
retf 0x526b
insw word es:[edi], dx
js 0x5dd168
or eax, 0xe1367875
psubsb mm1, qword [eax + 0x41a1858]
scasd eax, dword es:[edi]
outsd dx, dword [esi]
invalid
out dx, al
stosb byte es:[edi], al
dec edx
hlt
aas
into
int3
jno 0x5dd127
mov bl, byte [ebp*8 + 0x379856c2]
or al, dl
fld st(3)
cmpsd dword [esi], dword es:[edi]
mov edx, 0x6fcc280c
invalid

Function at 0x5eae55
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5eae70
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124b0095]
pop edx
test eax, eax
je 0x5eaf42
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5eaf31
test dword [ebp - 0x2a8], 1
jne 0x5eaf31
and dword [ebp - 0x2a8], 0x100
jne 0x5eaf31
push esi
push edx
push 4
push esi
call dword [edx + 0x122d3ace]
pop edx
pop esi
test eax, eax
je 0x5eaed4
jmp 0x5eaf31
cmp word [esi], 0x5a4d
jne 0x5eaf31
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5eaf31
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d394a]
pop edx
test eax, eax
je 0x5eaf31
lea eax, [ebp - 0x28c]
push eax
call fcn.005eadb1
test eax, eax
jne 0x5eaf2a
jmp 0x5eaf31
mov eax, esi
jmp 0x5eaf42
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5eae70
pop esi
leave
ret 4
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7c4e5153
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x14316e73
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401e50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x401f55
mov edi, dword [esi + 8]
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
seta al
cmp dword [esi + 4], 0x100
jne 0x401eea
cmp edi, 0x1b
jne 0x401eea
mov eax, str.ReOfferCampaignApp:_CHTMLDialog:_TranslateAccelerator:_Escape_was_pressed__Disable_behavior
lea ecx, [esp + 0x10]
call fcn.004034a0
lea ecx, [esp + 0x10]
push ecx
call fcn.00403580
add esp, 4
cmp dword [esp + 0x28], 8
jb 0x401eb7
mov edx, dword [esp + 0x14]
push edx
call fcn.0047cc0e
add esp, 4
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push str.Client_onEscPressed
call fcn.00403c50
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
call fcn.004024b0
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
test al, al
je 0x401f55
cmp edi, 0x73
jne 0x401f55
mov eax, str.ReOfferCampaignApp:_CHTMLDialog:_TranslateAccelerator:_AltF4_was_pressed__Disable_behavior
lea ecx, [esp + 0x10]
call fcn.004034a0
lea edx, [esp + 0x10]
push edx
call fcn.00403580
add esp, 4
cmp dword [esp + 0x28], 8
jb 0x401f22
mov eax, dword [esp + 0x14]
push eax
call fcn.0047cc0e
add esp, 4
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push str.Client_onAltF4Pressed
call fcn.00403c50
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004024b0
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push eax
push ecx
push esi
push edx
call fcn.0047d853
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403690
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4036a9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4036e4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4036e0
lea ebx, [ebx]
cmp esi, eax
jae 0x4036e4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4036d0
cmp esi, eax
jb 0x4036ea
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4057b0
Capabilities:
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
push 0x4bb5f1
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x4e27e0]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e27e0]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov edi, ecx
push edi
xor ecx, ecx
call fcn.004059d0
test al, al
je 0x4059a2
xor eax, eax
mov word [esp + 0x1c], ax
xor ebx, ebx
push 0x1e
mov eax, str.ReOfferCampaignApp:_UnInstall
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
call fcn.004033f0
mov ecx, esi
push ecx
mov dword [esp + 0xc4], ebx
call fcn.00403580
mov ebp, 8
add esp, 4
mov dword [esp + 0xc0], 0xffffffff
cmp dword [esp + 0x30], ebp
jb 0x405857
mov edx, dword [esp + 0x1c]
push edx
call fcn.0047cc0e
add esp, 4
add edi, 0xa4
push edi
push str.ROC_
lea edi, [esp + 0x58]
call fcn.00408e20
add esp, 8
mov dword [esp + 0xc0], 1
xor eax, eax
mov word [esp + 0x1c], ax
mov edi, 7
push 0x2d
mov eax, 0x4c8690
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
call fcn.004033f0
push 1
mov ecx, esi
push ecx
lea edx, [esp + 0x74]
push edx
mov edx, reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0xcc], 2
call fcn.00409f00
mov byte [esp + 0xc0], 4
cmp dword [esp + 0x30], ebp
jb 0x4058d5
mov eax, dword [esp + 0x1c]
push eax
call fcn.0047cc0e
add esp, 4
mov eax, dword [esp + 0x54]
xor ecx, ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], cx
cmp dword [esp + 0x68], ebp
jae 0x4058f2
lea eax, [esp + 0x54]
xor edx, edx
mov ecx, eax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], dx
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x405906
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x38]
call fcn.004033f0
mov edi, esi
lea eax, [esp + 0x6c]
call fcn.0040a900
cmp dword [esp + 0x4c], ebp
jb 0x40593d
mov eax, dword [esp + 0x38]
push eax
call fcn.0047cc0e
add esp, 4
xor ecx, ecx
push 0x4a
mov eax, str.ReOfferCampaignApp:_UnInstall:_Delete_roc.exe_from_Run_Windows_on_Login
lea esi, [esp + 0x38]
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], cx
call fcn.004033f0
mov edx, esi
push edx
mov byte [esp + 0xc4], 5
call fcn.00403580
add esp, 4
cmp dword [esp + 0x4c], ebp
jb 0x405986
mov eax, dword [esp + 0x38]
push eax
call fcn.0047cc0e
add esp, 4
lea ecx, [esp + 0x6c]
call fcn.00402ba0
cmp dword [esp + 0x68], ebp
jb 0x4059a2
mov ecx, dword [esp + 0x54]
push ecx
call fcn.0047cc0e
add esp, 4
xor al, al
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.0049bee5
add esp, 0xb0
ret
Function at 0x408ee0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4ba3b8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4e27e0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.004030c0
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x408f36
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [esp + 0x10]
call fcn.00402d20
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.004030c0
cmp dword [esp + 0x24], 8
jb 0x408f7f
mov edx, dword [esp + 0x10]
push edx
call fcn.0047cc0e
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret

Function at 0x409c90
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4e27e0]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x104
lea eax, [esp + 4]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jbe 0x409d2d
cmp word [esp + eax*2 - 2], 0x5c
push esi
push edi
je 0x409ce4
lea edi, [esp + 8]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x409cd0
mov ecx, dword [0x4c8610]
mov dword [edi], ecx
lea edi, [esp + 8]
add edi, 0xfffffffe
jmp 0x409cf0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x409cf0
lea edx, [esp + 8]
push ebx
mov ecx, 8
mov esi, str.toolbar_log.txt
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.0049d66a
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0049bee5
add esp, 0x20c
ret
mov ecx, dword [esp + 0x208]
xor ecx, esp
xor eax, eax
call fcn.0049bee5
add esp, 0x20c
ret

Function at 0x409e80
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409eee
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x409ebf
cmp eax, 2
jne 0x409eda
mov eax, dword [esp]
test esi, esi
je 0x409ee8
test eax, eax
je 0x409ee3
test al, 1
jne 0x409eda
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x409ee8
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x40a490
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bb0e8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x4e27e0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov eax, dword [ebp + 8]
push eax
mov dword [esp + 0x44], edi
call fcn.0040a0a0
mov ebx, eax
cmp ebx, edi
jne 0x40a4f5
mov eax, 0x3e81
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 8
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edi
cmp dword [esi + 0x18], ecx
jb 0x40a50c
mov esi, dword [esi + 4]
jmp 0x40a50f
add esi, 4
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], ecx
jb 0x40a51c
mov edi, dword [eax + 4]
jmp 0x40a51f
lea edi, [eax + 4]
xor eax, eax
test esi, esi
setne al
test eax, eax
jne 0x40a5e9
lea edi, [eax + 0xd]
xor edx, edx
push 0x21
mov eax, str.CRegistry::setValue_...___for_key
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], dx
call fcn.004033f0
mov ecx, dword [ebp + 0xc]
mov eax, esi
push eax
mov byte [esp + 0x44], 1
call fcn.00402ec0
add esp, 4
mov byte [esp + 0x40], 0
cmp dword [esp + 0x30], 8
jb 0x40a584
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0047cc0e
add esp, 4
xor edx, edx
push 0x2e
mov eax, str.CRegistry::setValue_...___SetStringValue_error
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], dx
call fcn.004033f0
mov ecx, edi
mov byte [esp + 0x40], 2
call fcn.00402c10
cmp dword [esp + 0x30], 8
jb 0x40a5cb
mov eax, dword [esp + 0x1c]
push eax
call fcn.0047cc0e
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
jne 0x40a531
push ebx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
jmp 0x40a5cb
Function at 0x40a620
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bb0a8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x4e27e0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov eax, dword [ebp + 8]
push eax
mov dword [esp + 0x54], ebx
call fcn.0040a190
mov edi, eax
cmp edi, ebx
je 0x40a74d
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 8
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
jb 0x40a683
mov eax, dword [eax + 4]
jmp 0x40a686
add eax, 4
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x20]
push ecx
push ebx
push eax
mov esi, 4
push edi
mov dword [esp + 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x40a764
mov dword [esp + 0x14], eax
xor edx, edx
push 0x21
mov eax, str.CRegistry::getValue_...___for_key
lea esi, [esp + 0x2c]
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], dx
call fcn.004033f0
mov ecx, dword [ebp + 0xc]
mov eax, esi
push eax
mov byte [esp + 0x54], 1
call fcn.00402ec0
add esp, 4
mov byte [esp + 0x50], bl
cmp dword [esp + 0x40], 8
jb 0x40a701
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0047cc0e
add esp, 4
xor edx, edx
push 0x2f
mov eax, str.CRegistry::getValue_...___QueryDWORDValue_error
lea esi, [esp + 0x2c]
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], dx
call fcn.004033f0
mov byte [esp + 0x50], 2
mov ecx, dword [esp + 0x14]
call fcn.00402c10
cmp dword [esp + 0x40], 8
jb 0x40a746
mov eax, dword [esp + 0x2c]
push eax
call fcn.0047cc0e
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esp + 0x18], esi
je 0x40a777
mov dword [esp + 0x14], 0xd
jmp 0x40a6b3
push edi
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov esi, dword [esp + 0x1c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40a7a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bb068
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x4e27e0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov eax, dword [ebp + 8]
push eax
mov dword [esp + 0x4c], esi
call fcn.0040a0a0
mov ebx, eax
cmp ebx, esi
jne 0x40a803
mov eax, 0x3e81
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 8
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
jb 0x40a819
mov eax, dword [eax + 4]
jmp 0x40a81c
add eax, 4
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push esi
push eax
push ebx
mov dword [esp + 0x2c], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp edi, esi
jne 0x40a848
push ebx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
jmp 0x40a8de
mov dword [esp + 0x34], esi
xor edx, edx
push 0x21
mov eax, str.CRegistry::setValue_...___for_key
lea esi, [esp + 0x24]
mov dword [esp + 0x3c], 7
mov word [esp + 0x28], dx
call fcn.004033f0
mov ecx, dword [ebp + 0xc]
mov eax, esi
push eax
mov byte [esp + 0x4c], 1
call fcn.00402ec0
add esp, 4
mov byte [esp + 0x48], 0
cmp dword [esp + 0x38], 8
jb 0x40a897
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0047cc0e
add esp, 4
xor edx, edx
push 0x2d
mov eax, str.CRegistry::setValue_...___SetDWORDValue_error
lea esi, [esp + 0x24]
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], dx
call fcn.004033f0
mov ecx, edi
mov byte [esp + 0x48], 2
call fcn.00402c10
cmp dword [esp + 0x38], 8
jb 0x40a8de
mov eax, dword [esp + 0x24]
push eax
call fcn.0047cc0e
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40a900
Capabilities:
Delete registry key

Disassembly:
push ecx
cmp dword [edi + 0x14], 0
jne 0x40a90e
mov eax, 0xd
pop ecx
ret
cmp dword [eax + 0x1c], 8
mov dword [esp], 0
jb 0x40a920
mov ecx, dword [eax + 8]
jmp 0x40a923
lea ecx, [eax + 8]
mov eax, dword [eax + 0x20]
push esi
lea edx, [esp + 4]
push edx
push 0xf003f
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x40a96c
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x40a96c
cmp dword [edi + 0x18], 8
jb 0x40a954
mov eax, dword [edi + 4]
jmp 0x40a957
lea eax, [edi + 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x40a980
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4bb028
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e27e0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x54]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x48], ebx
mov eax, dword [esp + 0x50]
push eax
call fcn.0040a190
mov edi, eax
cmp edi, ebx
jne 0x40a9d3
mov eax, 0x3e81
jmp 0x40aab3
mov ecx, 8
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebx
cmp dword [ebp + 0x18], ecx
jb 0x40a9ea
mov eax, dword [ebp + 4]
jmp 0x40a9ed
lea eax, [ebp + 4]
mov dword [esp + 0x54], ecx
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x58]
push ecx
push ebx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x40aacb
mov dword [esp + 0x54], eax
xor edx, edx
push 0x23
mov eax, str.CRegistry::getQWValue_...___for_key
lea esi, [esp + 0x28]
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], dx
call fcn.004033f0
mov eax, esi
push eax
mov ecx, ebp
mov byte [esp + 0x4c], 1
call fcn.00402ec0
mov ebp, 8
add esp, 4
mov byte [esp + 0x48], bl
cmp dword [esp + 0x3c], ebp
jb 0x40aa66
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0047cc0e
add esp, 4
xor edx, edx
push 0x31
mov eax, str.CRegistry::getQWValue_...___QueryQWORDValue_error
lea esi, [esp + 0x28]
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], dx
call fcn.004033f0
mov byte [esp + 0x48], 2
mov ecx, dword [esp + 0x54]
call fcn.00402c10
cmp dword [esp + 0x3c], ebp
jb 0x40aaaa
mov eax, dword [esp + 0x28]
push eax
call fcn.0047cc0e
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
xor edx, edx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 8
cmp dword [esp + 0x50], 0xb
je 0x40aadf
mov dword [esp + 0x54], 0xd
jmp 0x40aa15
push edi
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov edx, ebx
jmp 0x40aab5
Function at 0x40ab00
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4bb028
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e27e0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x50]
push eax
mov dword [esp + 0x4c], ebx
call fcn.0040a0a0
mov edi, eax
cmp edi, ebx
jne 0x40ab4f
mov eax, 0x3e81
jmp 0x40ac38
mov eax, dword [esp + 0x54]
cmp dword [eax + 0x18], 8
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebx
jb 0x40ab66
mov eax, dword [eax + 4]
jmp 0x40ab69
add eax, 4
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
push 8
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x20]
push ecx
push 0xb
push ebx
push eax
push edi
mov dword [esp + 0x38], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, eax
cmp ebp, ebx
jne 0x40ab9d
push edi
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
jmp 0x40ac2f
xor edx, edx
push 0x23
mov eax, str.CRegistry::setQWValue_...___for_key
lea esi, [esp + 0x28]
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], dx
call fcn.004033f0
mov ecx, dword [esp + 0x54]
mov eax, esi
push eax
mov byte [esp + 0x4c], 1
call fcn.00402ec0
add esp, 4
mov byte [esp + 0x48], bl
cmp dword [esp + 0x3c], 8
jb 0x40abec
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0047cc0e
add esp, 4
xor edx, edx
push 0x31
mov eax, str.CRegistry::setQWValue_...___QueryQWORDValue_error
lea esi, [esp + 0x28]
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], dx
call fcn.004033f0
mov ecx, ebp
mov byte [esp + 0x48], 2
call fcn.00402c10
cmp dword [esp + 0x3c], 8
jb 0x40ac2f
mov eax, dword [esp + 0x28]
push eax
call fcn.0047cc0e
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0x10

Function at 0x40af60
Capabilities:
Accept command line arguments

Disassembly:
push ecx
mov eax, esi
call fcn.00411a20
mov dword [esi + 0x470], 0
mov byte [esi + 0x5f], 0x2f
mov byte [esi + 0x5b], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0
call fcn.00411e80
mov ecx, dword [esp]
mov edx, 1
cmp ecx, edx
mov dword [esi + 4], eax
mov dword [esi], ecx
mov byte [esi + 0x58], dl
mov eax, dword [eax]
mov dword [esi + 0xc], eax
mov eax, esi
jle 0x40afaf
mov byte [esi + 0x6c], dl
pop ecx
ret