joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001376
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x10010b0
call fcn.01001514
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x10013b1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10013b1
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10013c9
cmp eax, 0x20b
je 0x10013b6
mov dword [ebp - 0x1c], edi
jmp 0x10013dd
cmp dword [ecx + 0x84], 0xe
jbe 0x10013b1
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x10013d7
cmp dword [ecx + 0x74], 0xe
jbe 0x10013b1
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1002220], 0xffffffff
or dword [0x1002224], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100221c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1002218]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1002228], eax
call fcn.0100150e
cmp dword [section..data], edi
jne 0x1001438
push fcn.0100150e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010014fc
push 0x1001088
push 0x1001084
call sub.msvcrt.dll__initterm
mov eax, dword [0x1002214]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1002210]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001080
push 0x100107c
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.010011e6
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x10014af
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x10014e4
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100154d
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41b522
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45e2a0]
jne 0x41b52c
repz ret
jmp fcn.0042026e

Function at 0x4299a7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00420977
and dword [ebp - 4], 0
cmp dword [0x4670d4], 0
mov ebx, eax
jne 0x429a58
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x429b09
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x429b09
push eax
call fcn.00420905
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4670d4], eax
call esi
push eax
call fcn.00420905
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4670d8], eax
call esi
push eax
call fcn.00420905
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4670dc], eax
call esi
push eax
call fcn.00420905
pop ecx
mov dword [0x4670e4], eax
test eax, eax
je 0x429a58
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00420905
pop ecx
mov dword [0x4670e0], eax
mov eax, dword [0x4670e0]
cmp eax, ebx
je 0x429ab0
cmp dword [0x4670e4], ebx
je 0x429ab0
push eax
call fcn.00420980
push dword [0x4670e4]
mov esi, eax
call fcn.00420980
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x429ab0
test edi, edi
je 0x429ab0
call esi
test eax, eax
je 0x429aa7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x429aa7
test byte [ebp - 0xc], 1
jne 0x429ab0
or dword [ebp + 0x10], 0x200000
jmp 0x429ae9
mov eax, dword [0x4670d8]
cmp eax, ebx
je 0x429ae9
push eax
call fcn.00420980
pop ecx
test eax, eax
je 0x429ae9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x429ae9
mov eax, dword [0x4670dc]
cmp eax, ebx
je 0x429ae9
push eax
call fcn.00420980
pop ecx
test eax, eax
je 0x429ae9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4670d4]
call fcn.00420980
pop ecx
test eax, eax
je 0x429b09
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x429b0b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430969
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, eax
cmp dword [esi + 0x18], 8
push edi
lea edi, [esi + 4]
jb 0x430980
mov eax, dword [edi]
jmp 0x430982
mov eax, edi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
test eax, eax
je 0x4309f0
push ebx
push eax
call fcn.0041a320
cmp dword [esi + 0x18], 8
pop ecx
mov ebx, eax
jb 0x4309a3
mov edi, dword [edi]
push ebx
push dword [ebp - 8]
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4309e6
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x44d560
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4309e6
cmp dword [ebp - 4], 0x34
jne 0x4309e6
mov eax, dword [ebp - 0xc]
movzx esi, word [eax + 0xa]
push ebx
call fcn.0041b531
mov ax, si
jmp 0x4309ee
push ebx
call fcn.0041b531
xor eax, eax
pop ecx
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4309f4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [eax + 0x18], 8
jb 0x430a03
mov eax, dword [eax + 4]
jmp 0x430a06
add eax, 4
push ebx
xor ebx, ebx
push ebx
lea ecx, [ebp - 4]
push ecx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x430a2a
xor al, al
pop ebx
leave
ret
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [esi + 0x18], 8
lea ecx, [eax + eax + 2]
jb 0x430a42
mov eax, dword [esi + 4]
jmp 0x430a45
lea eax, [esi + 4]
push ecx
push dword [ebp + 0xc]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x430a67
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x430a27
mov bl, 1
jmp 0x430a5a

Function at 0x430b74
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
jae 0x430b83
lea eax, [ebp + 0xc]
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x430b99
test al, 0x10
je 0x430b99
mov bl, 1
jmp 0x430b9b
xor bl, bl
push 0
push 1
lea esi, [ebp + 8]
call fcn.0040115a
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x430bad
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
jae 0x430bbc
lea eax, [ebp + 0xc]
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x430bd2
test al, 0x10
jne 0x430bd2
mov bl, 1
jmp 0x430bd4
xor bl, bl
push 0
push 1
lea esi, [ebp + 8]
call fcn.0040115a
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x430c89
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
cmp dword [ebp + 0x20], 8
jae 0x430c9b
lea eax, [ebp + 0xc]
push ebx
push esi
lea edx, [ebp - 8]
push edx
push 1
xor ebx, ebx
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x430cce
push ebx
push 1
lea esi, [ebp + 8]
call fcn.0040115a
push ebx
push 1
lea esi, [ebp + 0x24]
call fcn.0040115a
xor al, al
pop esi
pop ebx
leave
ret
cmp dword [ebp + 0x38], ebx
je 0x430d1b
cmp dword [ebp + 0x3c], 8
mov eax, dword [ebp + 0x28]
jae 0x430cdf
lea eax, [ebp + 0x28]
push ebx
push ebx
lea ecx, [ebp - 0xc]
push ecx
push ebx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x430d1b
mov byte [ebp - 1], bl
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 1
lea esi, [ebp + 8]
call fcn.0040115a
push ebx
push 1
lea esi, [ebp + 0x24]
call fcn.0040115a
mov al, byte [ebp - 1]
jmp 0x430cca
mov byte [ebp - 1], 1
jmp 0x430cf7
Function at 0x430fb8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 0x5000
mov esi, ecx
mov edi, edx
call fcn.0041a320
cmp dword [edi + 0x18], 8
pop ecx
mov ebx, eax
jb 0x430fdf
mov edi, dword [edi + 4]
jmp 0x430fe2
add edi, 4
push 0x2800
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
call fcn.00401900
push ebx
call fcn.0041b531
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x4317cd
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443a81
mov eax, dword fs:[0]
push eax
mov eax, 0x4288
call fcn.0042d000
mov eax, dword [0x45e2a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x45ff90], 8
mov eax, dword [0x45ff7c]
jae 0x431812
mov eax, 0x45ff7c
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43196b
lea eax, [ebp - 0x4294]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push esi
test eax, eax
jne 0x43184f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43196b
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x4260], esi
cmp esi, 0xffffffff
je 0x43196b
push 0x228
lea eax, [ebp - 0x4254]
push ebx
push eax
call fcn.00420380
add esp, 0xc
lea eax, [ebp - 0x4258]
push eax
push esi
mov dword [ebp - 0x4258], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x431960
push dword [ebp - 0x4250]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x425c], eax
cmp eax, ebx
je 0x431953
xor ecx, ecx
mov dword [ebp - 0x4014], 7
mov dword [ebp - 0x4018], ebx
mov word [ebp - 0x4028], cx
push 0x2000
lea ecx, [ebp - 0x4010]
push ecx
push ebx
push eax
mov dword [ebp - 4], ebx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x431907
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x402c]
push eax
call fcn.00401e4f
push dword [ebp - 0x425c]
call edi
cmp dword [ebp - 0x4018], ebx
je 0x43193b
push dword [ebp - 0x4264]
lea eax, [ebp - 0x402c]
push dword [ebp - 0x4268]
push dword [ebp - 0x4278]
call fcn.00430a6b
add esp, 0xc
test al, al
jne 0x431987
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x402c]
call fcn.0040115a
mov esi, dword [ebp - 0x4260]
lea eax, [ebp - 0x4258]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4318a1
push esi
call edi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041b522
leave
ret
push esi
call edi
push ebx
push 1
lea esi, [ebp - 0x402c]
call fcn.0040115a
mov al, 1
jmp 0x43196d
Function at 0x432165
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x400c
call fcn.0042d000
mov eax, dword [0x45e2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x4008], ebx
test byte [0x4678b4], 1
push edi
mov dword [ebp - 0x400c], eax
jne 0x4321c3
or dword [0x4678b4], 1
xor eax, eax
push 0x448fa6
mov dword [0x4678b0], 7
mov dword [0x4678ac], ebx
mov word [0x46789c], ax
call fcn.0041b9a8
pop ecx
mov edi, 0x467898
cmp byte [0x467670], bl
jne 0x43226e
mov byte [0x467670], 1
call fcn.004308b4
cmp eax, 0x600
jb 0x432218
lea eax, [ebp - 0x4008]
push eax
push 0x44a600
call fcn.00430802
pop ecx
pop ecx
test eax, eax
jne 0x43226e
push dword [ebp - 0x4008]
push edi
call fcn.00401e4f
push dword [ebp - 0x4008]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x43226e
lea eax, [ebp - 0x4004]
push eax
push ebx
push ebx
push 5
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x43226e
lea eax, [ebp - 0x4004]
push eax
push edi
call fcn.00401e4f
push str.Downloads
push edi
call fcn.0040336b
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x4008], esp
push edi
call fcn.004010aa
call fcn.00430b74
add esp, 0x1c
cmp al, bl
jne 0x43226e
push 0x44d238
push edi
call fcn.00401e4f
mov esi, dword [ebp - 0x400c]
push edi
call fcn.004010aa
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b522
leave
ret
Function at 0x432582
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443eaf
mov eax, dword fs:[0]
push eax
mov eax, 0x2038
call fcn.0042d000
mov eax, dword [0x45e2a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov ebx, ecx
mov dword [ebp - 0x2044], edi
cmp dword [eax + 0x18], 8
mov dword [ebp - 0x2030], ebx
jb 0x4325d2
mov eax, dword [eax + 4]
jmp 0x4325d5
add eax, 4
push edi
push 0x80
push 3
push edi
push edi
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x203c], esi
cmp esi, 0xffffffff
jne 0x43260b
push 0x44d790
mov ecx, ebx
call fcn.004018a5
mov eax, ebx
jmp 0x432706
lea eax, [ebp - 0x2034]
push edi
push eax
call fcn.0044046b
pop ecx
pop ecx
test eax, eax
jne 0x43263b
lea eax, [ebp - 0x2034]
push 8
push eax
call fcn.0044046b
pop ecx
pop ecx
test eax, eax
jne 0x43263b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4325f8
lea eax, [ebp - 0x2038]
push eax
push dword [ebp - 0x2034]
call fcn.0044040b
pop ecx
pop ecx
test eax, eax
jne 0x432661
push dword [ebp - 0x2034]
call fcn.00440440
pop ecx
jmp 0x432632
push edi
lea eax, [ebp - 0x2040]
push eax
mov ebx, 0x2000
push ebx
lea eax, [ebp - 0x2010]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x2040], edi
jmp 0x4326c6
cmp dword [ebp - 0x2040], edi
je 0x432720
push dword [ebp - 0x2040]
lea eax, [ebp - 0x2010]
push eax
push dword [ebp - 0x2038]
call fcn.004403da
add esp, 0xc
test eax, eax
je 0x4326cc
push edi
lea eax, [ebp - 0x2040]
push eax
push ebx
lea eax, [ebp - 0x2010]
push eax
push dword [ebp - 0x203c]
call esi
test eax, eax
jne 0x432685
push dword [ebp - 0x2038]
call fcn.004403b1
push dword [ebp - 0x2034]
call fcn.00440440
pop ecx
pop ecx
push dword [ebp - 0x203c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x2030]
push 0x44d790
call fcn.004018a5
mov eax, dword [ebp - 0x2030]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041b522
leave
ret
push dword [ebp - 0x203c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
pop esi
push edi
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x2010]
push eax
push 2
push dword [ebp - 0x2038]
mov dword [ebp - 0x2044], esi
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 0x2038]
test eax, eax
jne 0x432770
call fcn.004403b1
push dword [ebp - 0x2034]
call fcn.00440440
pop ecx
pop ecx
jmp 0x4326f0
call fcn.004403b1
push dword [ebp - 0x2034]
call fcn.00440440
pop ecx
pop ecx
cmp dword [ebp - 0x2044], esi
jne 0x4326f0
push esi
lea eax, [ebp - 0x2010]
push eax
lea esi, [ebp - 0x202c]
call fcn.00419530
sub esp, 0x1c
mov eax, esi
mov ecx, esp
mov dword [ebp - 0x203c], esp
push eax
mov dword [ebp - 4], edi
call fcn.00401424
mov ecx, dword [ebp - 0x2030]
call fcn.004316a2
add esp, 0x1c
push edi
push 1
mov ecx, esi
call fcn.0040172c
jmp 0x432700
Function at 0x432b64
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x50
mov eax, 0x444146
call fcn.0041ce5d
mov ebx, edx
xor edi, edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
jae 0x432b89
lea eax, [ebp + 0xc]
lea edx, [ebp - 0x10]
push edx
push 9
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x432bb4
push ebx
call fcn.0040813c
push edi
push 1
lea esi, [ebp + 8]
call fcn.0040115a
mov eax, ebx
jmp 0x432ca6
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push edi
push dword [ebp - 0x10]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x432be3
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x432b9c
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041a320
pop ecx
push dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x40]
push eax
call fcn.0041957c
mov byte [ebp - 4], 1
xor ebx, ebx
cmp dword [ebp - 0x14], edi
jbe 0x432c72
mov eax, dword [ebp - 0x1c]
push edi
push edi
push edi
inc eax
push edi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x28]
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x432cac
push dword [ebp - 0x20]
lea eax, [ebp - 0x5c]
push dword [ebp - 0x28]
call fcn.00419556
mov dword [ebp - 0x24], eax
push ebx
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004195da
push eax
mov eax, dword [ebp - 0x24]
call fcn.00401922
push edi
push 1
lea esi, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.0040115a
inc ebx
cmp ebx, dword [ebp - 0x14]
jb 0x432c16
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x18]
call fcn.00401b9a
lea esi, [ebp - 0x40]
call fcn.00402378
push dword [ebp - 0x40]
call fcn.0041b531
pop ecx
push edi
push 1
lea esi, [ebp + 8]
call fcn.0040115a
mov eax, dword [ebp - 0x18]
call fcn.0041cf35
ret
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x18]
call fcn.0040813c
jmp 0x432c87
Function at 0x43371c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x6c
mov eax, 0x4447f0
call fcn.0041cec6
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x38], ebx
cmp dword [eax + 0x18], 8
mov edi, edx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x3c], ebx
jb 0x433746
mov eax, dword [eax + 4]
jmp 0x433749
add eax, 4
lea edx, [ebp - 0x34]
push edx
push 0x101
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x433772
push 0x44d238
mov esi, edi
call fcn.00401900
mov eax, edi
jmp 0x4338f4
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x43377f
mov eax, dword [edi]
jmp 0x433781
mov eax, edi
lea ecx, [ebp - 0x3c]
push ecx
push ebx
lea ecx, [ebp - 0x40]
push ecx
push ebx
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4337b6
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x30]
push 0x44d238
call fcn.00401900
mov eax, esi
jmp 0x4338f4
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x40], 4
jne 0x433837
cmp dword [ebp - 0x3c], 4
mov dword [ebp - 0x38], ebx
jne 0x43381c
cmp dword [esi + 0x18], 8
jb 0x4337e0
mov edi, dword [edi]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43381c
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x5c]
call fcn.004030bb
pop ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x2c]
push ecx
xor ebx, ebx
mov byte [ebp - 4], 1
call fcn.004010d2
push ebx
jmp 0x4338b7
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x30]
push 0x44d238
call fcn.00401900
jmp 0x4338e6
cmp dword [ebp - 0x40], 1
je 0x433843
cmp dword [ebp - 0x40], 2
jne 0x43381c
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041a320
cmp dword [esi + 0x18], 8
pop ecx
mov dword [ebp - 0x38], eax
jb 0x433866
mov edi, dword [edi]
lea ecx, [ebp - 0x3c]
push ecx
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43381c
cmp dword [ebp - 0x40], 2
push dword [ebp - 0x38]
jne 0x4338c8
lea esi, [ebp - 0x5c]
call fcn.00401900
mov edx, esi
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 2
call fcn.00430fb8
push 0xffffffffffffffff
lea ecx, [ebp - 0x2c]
push ecx
xor ebx, ebx
mov byte [ebp - 4], 3
call fcn.004010d2
push ebx
push 1
lea esi, [ebp - 0x78]
call fcn.0040115a
push ebx
push 1
lea esi, [ebp - 0x5c]
mov byte [ebp - 4], bl
call fcn.0040115a
xor ebx, ebx
jmp 0x4338d1
lea eax, [ebp - 0x2c]
push eax
call fcn.00401e4f
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
push eax
call fcn.004010aa
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.0040115a
mov eax, dword [ebp - 0x30]
call fcn.0041cf49
ret
Function at 0x435d19
Capabilities:
Terminate process

Disassembly:
push 8
mov eax, 0x444612
call fcn.0041ce5d
and dword [ebp - 4], 0
push 0x10
push 0x450714
push 0x450724
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
sub esp, 0x1c
lea eax, [ebp + 8]
mov esi, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.004010aa
call fcn.00435cd4
add esp, 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]