joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b238
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41b35d
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0041b040
mov esi, eax
mov eax, dword [0x4436d4]
cmp byte [eax], 0
je 0x41b305
mov eax, dword [0x4435a0]
call fcn.00404e48
call fcn.00404c48
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41b208]
call fcn.00408748
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41b378
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x41b341
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x44356c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x446c50]
call fcn.00408934
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b364
lea eax, [ebp - 4]
mov edx, dword [0x41b208]
call fcn.0040886c
ret

Function at 0x41cf24
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00407194
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040a248
mov edi, eax
cmp edi, 0x104
jbe 0x41cecf
mov eax, edi
add eax, eax
call fcn.00404af4
mov esi, eax
jmp 0x41ced1
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040a248
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x41cf0a
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x41cef4
mov eax, esp
cmp esi, eax
je 0x41cf17
mov eax, esi
call fcn.00404b10
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x41cf50
cmp bl, 0
je 0x41cf4c
cmp bl, 0x41
jl 0x41cf47
cmp bl, 0x5a
jg 0x41cf47
or bl, 0x20
xor al, bl
inc esi
jmp 0x41cf2b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x41ce90

Function at 0x41d64c
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00407848
add esp, 0x800
pop ebx
ret
Function at 0x427a5c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x427aae
test eax, edx
je 0x427ab1
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x427a71
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x427a97
add ecx, 4
js 0x427a87
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x427a94
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x427abd
test edx, edx
jne 0x427a64
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x42b62c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x42b635
xchg dword [ebp - 4], ecx
push ebx
push esi
test dl, dl
je 0x42b64d
add esp, 0xfffffff0
call fcn.004059a4
mov esi, ecx
mov byte [ebp - 5], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x42b74c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x50]
call fcn.00409db4
push eax
mov eax, dword [ebp + 0x10]
push eax
lea edx, [ebp - 0xc]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
test eax, eax
je 0x42b6b8
lea edx, [ebp - 0x18]
mov eax, dword [ebp + 0x14]
call fcn.0040517c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [0x443560]
mov dl, 1
mov eax, dword [0x429894]
call fcn.0041b58c
call fcn.0040643c
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
mov eax, dword [ebx + 0x50]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.0042be94
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
lea edx, [ebp - 0x20]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xc]
push dword [ebp - 0x20]
push 0x42b780
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 4]
call fcn.00407884
push dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00407a14
mov eax, dword [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
movzx eax, byte [ebp + 8]
push eax
mov ecx, esi
xor edx, edx
mov eax, ebx
call fcn.0042adf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b753
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00406d54
lea eax, [ebp - 0xc]
call fcn.00409db4
lea eax, [ebp - 4]
call fcn.00406d3c
ret
Function at 0x42bef0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2001f
push 0
push 0x42bf78
push 0
mov eax, ebx
call fcn.004077a4
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x42bf54
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
mov eax, esi
call fcn.004077a4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x42bf6f
mov ecx, dword [0x4435ac]
mov dl, 1
mov eax, dword [0x429c68]
call fcn.0041b4bc
call fcn.0040643c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42bf7c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x42c018
push 0
mov eax, ebx
call fcn.004077a4
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x42bff3
mov ebx, esi
test ebx, ebx
je 0x42bfc5
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.004077a4
push eax
push 1
push 0
mov eax, edi
call fcn.004077a4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x42c00e
mov ecx, dword [0x4435ac]
mov dl, 1
mov eax, dword [0x429c68]
call fcn.0041b4bc
call fcn.0040643c
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x42c01c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, ebx
call fcn.004077a4
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x42c08e
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, edi
call fcn.004077a4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42c080
cmp dword [ebp - 0x10], 4
je 0x42c083
mov dword [ebp - 4], esi
jmp 0x42c083
mov dword [ebp - 4], esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x42c091
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42c0a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, esi
call fcn.004077a4
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x42c15b
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004077a4
mov esi, eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42c147
cmp dword [ebp - 0xc], 0
jbe 0x42c13e
mov eax, dword [ebp - 0x10]
dec eax
sub eax, 2
jae 0x42c133
mov edx, dword [ebp - 0xc]
shr edx, 1
dec edx
mov eax, ebx
call fcn.004078b4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx]
call fcn.004077a4
push eax
push 0
push 0
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
jmp 0x42c150
mov eax, ebx
mov edx, edi
call fcn.004070a4
jmp 0x42c150
mov eax, ebx
call fcn.00406cf4
jmp 0x42c150
mov eax, ebx
mov edx, edi
call fcn.004070a4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x42c164
mov eax, ebx
mov edx, edi
call fcn.004070a4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42d2f8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x42d440
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
jne 0x42d358
call sub.kernel32.dll_GetLastError_2
lea edx, [ebp - 0x10]
call fcn.00419fdc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, 0x42d45c
mov dl, 1
mov eax, dword [0x412944]
call fcn.0041b3c4
call fcn.0040643c
xor edx, edx
push ebp
push 0x42d423
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.user32.dll_EmptyClipboard
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x42d3f8
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x42d3e7
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.00404c98
mov eax, dword [ebp - 4]
push eax
movzx eax, si
push eax
call sub.user32.dll_SetClipboardData
test eax, eax
jne 0x42d3d0
mov ecx, 0x42d49c
mov dl, 1
mov eax, dword [0x41352c]
call fcn.0041b388
call fcn.0040643c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d3ee
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401750
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2c14
call fcn.00445fa0
mov eax, dword [0x479700]
xor eax, esp
mov dword [esp + 0x2c10], eax
mov eax, dword [esp + 0x2c18]
push edi
xor edi, edi
mov dword [esp + 0xc], eax
cmp eax, edi
je 0x4018bb
cmp dword [esp + 0x2c20], edi
je 0x4018bb
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov dword [esp + 0x10], edi
xor ebx, ebx
lea ebx, [ebx]
push ebx
push str..PhysicalDrive_d
lea eax, [esp + 0x30]
push 0x100
push eax
call fcn.00401170
add esp, 0x10
push edi
push edi
push 3
push edi
push 3
push edi
lea ecx, [esp + 0x40]
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x401894
xor eax, eax
push 0x2710
lea edx, [esp + 0x514]
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.004469f0
add esp, 0xc
push edi
lea eax, [esp + 0x18]
push eax
push 0x2710
lea ecx, [esp + 0x51c]
push ecx
push 0xc
lea edx, [esp + 0x30]
push edx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x401887
push 0x3e8
lea eax, [esp + 0x12c]
push edi
push eax
call fcn.004469f0
mov edx, dword [esp + 0x534]
lea ecx, [esp + 0x134]
push ecx
push 1
push edx
lea eax, [esp + 0x528]
push eax
call fcn.00402de0
mov edx, dword [esp + 0x2c48]
mov eax, dword [esp + 0x34]
add esp, 0x1c
lea ecx, [esp + 0x128]
push ecx
push edx
push eax
call fcn.00401070
test eax, eax
jne 0x401887
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], edi
jne 0x40189e
inc ebx
cmp ebx, 0x10
jl 0x4017a0
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x2c10]
xor ecx, esp
call fcn.00445a5e
add esp, 0x2c14
ret
mov ecx, dword [esp + 0x2c14]
pop edi
xor ecx, esp
xor eax, eax
call fcn.00445a5e
add esp, 0x2c14
ret
Function at 0x401b60
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x2ec
mov eax, dword [0x479700]
xor eax, esp
mov dword [esp + 0x2e8], eax
push edi
mov edi, dword [esp + 0x2f4]
mov dword [esp + 0x18], edi
test edi, edi
je 0x401d61
cmp dword [esp + 0x2f8], 0
je 0x401d61
push 0x64
lea eax, [esp + 0x20]
push 0
push eax
call fcn.004469f0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401d28
mov ecx, dword [esp + 4]
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x100]
push eax
push ebx
mov esi, 0x104
push ecx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x401d1b
lea ebx, [ebx]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 1
push 0
lea eax, [esp + 0xf8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401ce9
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1f4]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401cde
push 0x64
push eax
lea eax, [esp + 0x90]
push eax
call fcn.004469f0
lea ecx, [esp + 0x1fc]
push 0x64
push ecx
lea edi, [esp + 0x9c]
call fcn.00401a50
add esp, 0x14
test eax, eax
je 0x401cde
cmp byte [esp + 0x24], 0
je 0x401ca2
lea edx, [esp + 0x24]
push edx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jge 0x401cde
lea eax, [esp + 0x24]
lea esi, [esp + 0x88]
mov ecx, eax
mov edx, 0x64
sub esi, ecx
lea ecx, [edx + 0x7fffff9a]
test ecx, ecx
je 0x401cd1
mov cl, byte [esi + eax]
test cl, cl
je 0x401cd1
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x401cb6
jmp 0x401cd5
test edx, edx
jne 0x401cd6
dec eax
mov byte [eax], 0
mov esi, 0x104
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x100]
push ecx
inc ebx
push ebx
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x401c00
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
cmp byte [esp + 0x1c], 0
je 0x401d61
mov edx, dword [esp + 0x2f8]
lea ecx, [esp + 0x1c]
push ecx
push edx
push edi
call fcn.00401070
xor ecx, ecx
test eax, eax
setge cl
pop edi
mov eax, ecx
mov ecx, dword [esp + 0x2e8]
xor ecx, esp
call fcn.00445a5e
add esp, 0x2ec
ret
mov ecx, dword [esp + 0x2ec]
pop edi
xor ecx, esp
xor eax, eax
call fcn.00445a5e
add esp, 0x2ec
ret
Function at 0x401fd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x50c
mov eax, dword [0x479700]
xor eax, esp
mov dword [esp + 0x508], eax
push ebp
mov ebp, dword [esp + 0x514]
test edi, edi
je 0x40214d
cmp ebp, 0x20
jb 0x40214d
push 0x400
lea eax, [esp + 0x110]
push 0
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x400
call fcn.004469f0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x10]
push eax
push 0x466d0c
push str.Software360SafeLiveup
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x40214d
lea eax, [esp + 0x10c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402060
sub eax, edx
cmp eax, 0x40
jne 0x40214d
push ebx
lea edx, [eax + 0x40]
push esi
lea eax, [esp + 0x14]
lea esi, [esp + 0x114]
mov ecx, eax
sub esi, ecx
lea ecx, [edx - 0x60]
test ecx, ecx
je 0x40209e
mov cl, byte [esi + eax]
test cl, cl
je 0x40209e
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x402086
jmp 0x4020a2
test edx, edx
jne 0x4020a3
dec eax
mov byte [eax], 0
lea eax, [esp + 0x94]
lea edx, [esp + 0x134]
mov ecx, eax
mov esi, 0x80
sub edx, ecx
lea ecx, [ecx]
lea ecx, [esi + 0x7fffff7e]
test ecx, ecx
je 0x4020db
mov cl, byte [edx + eax]
test cl, cl
je 0x4020db
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x4020c0
jmp 0x4020df
test esi, esi
jne 0x4020e0
dec eax
push 0x400
lea edx, [esp + 0x118]
push 0
push edx
mov byte [eax], 0
call fcn.004469f0
push 0x400
lea ebx, [esp + 0x124]
lea ecx, [esp + 0x24]
call fcn.004011d0
add esp, 0x10
lea eax, [esp + 0x94]
push eax
mov ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
pop ebx
test eax, eax
jne 0x40214d
lea edx, [esp + 0xc]
push edx
push ebp
push edi
call fcn.00401070
neg eax
sbb eax, eax
inc eax
pop ebp
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.00445a5e
add esp, 0x50c
ret
mov ecx, dword [esp + 0x50c]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.00445a5e
add esp, 0x50c
ret

Function at 0x402170
Capabilities:
Set registry value

Disassembly:
sub esp, 0x188
mov eax, dword [0x479700]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
push esi
push 0x80
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
call fcn.004469f0
push 0x80
lea ebx, [esp + 0x18]
mov ecx, esi
call fcn.004011d0
lea eax, [esp + 0x98]
mov ecx, eax
add esp, 0x10
mov edx, 0x104
sub esi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x4021db
mov cl, byte [esi + eax]
test cl, cl
je 0x4021db
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x4021c0
jmp 0x4021df
test edx, edx
jne 0x4021e0
dec eax
lea edx, [esp + 8]
push edx
mov byte [eax], 0
push 0x104
lea eax, [esp + 0x90]
push eax
call fcn.004010e0
lea eax, [esp + 0x88]
pop esi
lea edx, [eax + 1]
pop ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402206
sub eax, edx
push eax
lea ecx, [esp + 0x84]
push ecx
push 1
push 0x466d0c
push str.Software360SafeLiveup
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.00445a5e
add esp, 0x188
ret