joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x6c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
call fcn.10002e90
xor ecx, ecx
mov edx, dword [0x10076b14]
mov esi, edx
add esi, 0xffffdef7
mov dword [0x10076b18], esi
add edx, 0xfffff510
mov dword [0x10076b14], edx
mov edx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
lea edx, section..data
mov esi, eax
shl esi, 8
mov edi, edx
add edi, esi
add edi, 0xb8
mov esi, dword [edi]
mov edi, eax
shl edi, 8
add edx, edi
add edx, 0xb4
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x71b
mov ecx, edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jne 0x10002151
lea eax, [0x10004725]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], ecx
call fcn.10002a20
mov dword [0x10076b18], 0x1e53
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call fcn.10001d30
mov ecx, eax
mov dword [0x10076b30], eax
mov eax, esp
mov edx, dword [ebp - 0x40]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
lea edx, section..data
mov esi, eax
shl esi, 8
mov edi, edx
add edi, esi
add edi, 0xb8
mov esi, dword [edi]
mov edi, eax
shl edi, 8
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
mov ebx, eax
shl ebx, 8
add edx, ebx
add edx, 0xb4
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x4c]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], edx
call fcn.10002f00
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
add eax, ecx
mov edx, dword [ebp - 0x58]
add edx, 1
cmp edx, 0x71b
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], edx
jne 0x1000220b
mov eax, dword [ebp - 0x4c]
add eax, 0x12a537
mov ecx, dword [ebp - 0x4c]
add ecx, 0xa2a0c
mov edx, dword [0x10076b18]
add edx, 0xffffe546
mov dword [0x10076b18], edx
mov edx, dword [ebp - 0x4c]
mov dword [esp], edx
mov dword [esp + 4], edx
mov esi, dword [ebp - 0x40]
mov dword [esp + 8], esi
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x68], ecx
call fcn.100027b0
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x64]
mov dword [ecx], edx
mov dword [ecx + 4], 0x13d000
mov edx, dword [ebp - 0x68]
mov dword [ecx + 8], edx
mov dword [0x10076b14], 0x1652
mov dword [ecx + 0xc], 0x2010
mov dword [0x10076b18], 0xb20
add esp, 0x6c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002430
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x10076b1c], 0
mov dword [0x10076b20], 0
mov dword [0x10076b2c], 0
mov dword [0x10076b18], 0x1e1b
mov dword [0x10076b14], 0x1b07
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x10002584
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov edx, dword [0x10076b1c]
add edx, 1
mov dword [ebp - 0x24], eax
mov eax, edx
cdq
idiv ecx
mov dword [0x10076b1c], edx
mov esi, dword [0x10076b20]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x10076b20], edx
mov ecx, dword [0x10076b1c]
mov bl, byte [edi + ecx]
mov byte [0x10076b24], bl
mov dword [0x10076b14], 0x16e4
mov bl, byte [edi + edx]
mov ecx, dword [0x10076b1c]
mov byte [edi + ecx], bl
mov bl, byte [0x10076b24]
mov ecx, dword [0x10076b20]
mov byte [edi + ecx], bl
mov dword [0x10076b14], 0xf91
mov ecx, dword [0x10076b1c]
movzx ecx, byte [edi + ecx]
mov edx, dword [0x10076b20]
movzx edx, byte [edi + edx]
add edx, ecx
and edx, 0xff
mov dword [0x10076b2c], edx
mov ecx, dword [0x10076b14]
add ecx, 0xffffe516
mov dword [0x10076b14], ecx
mov bl, byte [edi + edx]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
movzx esi, byte [ecx + edx]
mov dword [esp], esi
movzx esi, bl
mov dword [esp + 4], esi
call fcn.10001000
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
mov byte [ecx + edx], al
mov dword [0x10076b14], 0x199a
add edx, 1
mov esi, dword [ebp - 0x10]
cmp edx, esi
mov dword [ebp - 0x20], edx
jne 0x10002493
mov dword [0x10076b14], 0x90
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10002e10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10076b18]
mov dword [ebp - 4], eax
lea eax, [fcn.10002e10]
mov ecx, dword [ebp - 4]
add ecx, 0xffffe4ce
mov edx, dword [ebp - 4]
add edx, 0xffffcc20
mov dword [0x10076b14], ecx
mov dword [0x10076b18], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp word [eax], 0x5a4d
mov dword [ebp - 0xc], eax
jne 0x10002e69
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10002e69
mov eax, dword [ebp - 0xc]
add esp, 0x10
pop ebp
ret
mov eax, dword [ebp - 0xc]
add eax, 0xfffff000
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and eax, 0xfffff000
mov dword [0x10076b14], 0x1438
mov dword [ebp - 8], eax
jmp 0x10002e45
Function at 0x10002f80
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10076b14], 0x26df
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x10003025
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1000306a
jmp 0x100030b2
mov dword [0x10076b14], 0x1f6
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x10002fb6
jmp 0x100030b2
mov eax, dword [ebp - 0x18]
add esp, 0x24
pop ebp
ret
mov dword [0x10076b18], 0xb1b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0xe], 0x6c
jne 0x100030b2
mov eax, 1
mov dword [0x10076b14], 0x71a
mov dword [ebp - 0x18], eax
jmp 0x10002fec
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x10003052
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jl 0x10003025
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x10002fce
jmp 0x100030b2
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x100030b2
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
sete dl
mov byte [ebp - 0x21], dl
mov al, byte [ebp - 0x21]
test al, 1
jne 0x10003095
jmp 0x100030b2
mov dword [0x10076b18], 0x78a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x10002ff4
xor eax, eax
mov ecx, dword [0x10076b14]
add ecx, 0xffffdbfb
mov dword [0x10076b18], ecx
mov dword [ebp - 0x18], eax
jmp 0x10002fec
Function at 0x401261
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push ebx
xor ebx, ebx
call fcn.0040254c
movzx eax, ax
dec eax
dec eax
je 0x40128b
dec eax
je 0x401284
or eax, 0xffffffff
jmp 0x401380
push str.PxInsA64.exe
jmp 0x401290
push str.PxInsI64.exe
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x17c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp + 8], ebx
mov eax, str.__STARTSERVICE
jne 0x4012bb
mov eax, 0x40e030
push esi
push edi
push eax
lea eax, [ebp - 0x34]
push 0x40b1b8
push eax
call fcn.004029a8
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x78]
push 0x11
pop ecx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x14]
push 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop esi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x280]
push str.__s_s__s
push eax
mov dword [ebp - 0x78], esi
call fcn.004029a8
add esp, 0x14
xor eax, eax
lea edi, [ebp - 0x78]
push 0x11
pop ecx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x78], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
lea eax, [ebp - 0x280]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40136c
push 0x7530
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x40136c
cmp dword [ebp - 4], 0x103
je 0x40136c
mov ebx, dword [ebp - 4]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x401383
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
call fcn.004024fb
test eax, eax
je 0x4013a3
push 0
call fcn.00401261
pop ecx
jmp 0x4014cc
lea eax, [ebp - 4]
mov edi, 0x80000002
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4013c3
xor eax, eax
jmp 0x4014cc
push ebx
push esi
call fcn.0040157d
mov esi, eax
cmp esi, 2
jne 0x4013d8
push str.PXHELPER
jmp 0x40140b
cmp esi, 3
je 0x4013e7
cmp esi, 4
je 0x4013e7
cmp esi, 5
jne 0x401415
call fcn.0040254c
movzx eax, ax
dec eax
je 0x401406
dec eax
je 0x4013ff
dec eax
jne 0x401415
push str.PxHlpa64
jmp 0x40140b
push str.PxHelp64
jmp 0x40140b
push str.PxHelp20
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x114]
push 0x100
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x114]
push str._sdrivers_s.SYS
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
xor ebx, ebx
lea eax, [ebp - 0x114]
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4014bf
lea eax, [ebp - 0x14]
push eax
call fcn.00402435
lea eax, [ebp - 0x14]
push eax
call fcn.00401da1
pop ecx
cmp esi, 3
pop ecx
je 0x401484
cmp esi, 4
je 0x401484
cmp esi, 5
jne 0x4014bf
lea eax, [ebp - 0x14]
push ebx
mov esi, str.LowerFilters
push eax
push esi
push str.SYSTEMCurrentControlSetControlClass4d36e965_e325_11ce_bfc1_08002be10318
push edi
call fcn.0040184e
lea eax, [ebp - 0x14]
push ebx
push eax
push esi
push str.SYSTEMCurrentControlSetControlClass4D36E967_E325_11CE_BFC1_08002BE10318
push edi
call fcn.0040184e
lea eax, [ebp - 0x14]
push ebx
push eax
push esi
push str.SYSTEMCurrentControlSetControlClass6D807884_7D21_11CF_801C_08002BE10318
push edi
call fcn.0040184e
add esp, 0x3c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
pop ebx
pop edi
leave
ret

Function at 0x40157d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
push esi
push eax
xor esi, esi
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x401613
cmp dword [ebp - 0x84], 2
jne 0x4015ef
mov eax, dword [ebp - 0x90]
cmp eax, 5
jne 0x4015cb
xor eax, eax
cmp dword [ebp - 0x8c], 1
setge al
add eax, 3
mov esi, eax
jmp 0x401613
cmp eax, 6
jne 0x4015d4
push 5
jmp 0x401612
cmp eax, 4
jne 0x4015dd
push 2
jmp 0x401612
cmp eax, 3
jne 0x401613
cmp dword [ebp - 0x8c], 0x33
jl 0x401613
push 1
jmp 0x401612
cmp dword [ebp - 0x84], 1
jne 0x401613
cmp dword [ebp - 0x90], 4
jg 0x401610
jne 0x40160c
cmp dword [ebp - 0x8c], 0xa
jge 0x401610
push 6
jmp 0x401612
push 7
pop esi
mov eax, esi
pop esi
leave
ret
Function at 0x401646
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x401707
lea eax, [ebp + 0xc]
push eax
push 0xf003f
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401707
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp + 8]
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x4016fd
cmp dword [ebp + 8], 1
jne 0x4016fd
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea edi, [ebp - 0x108]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 4]
not ecx
dec ecx
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 7
push ebx
mov byte [ebp + ecx - 0x107], bl
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
pop edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
leave
ret
Function at 0x40170a
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp + 8]
push ebx
push eax
xor ebx, ebx
push 0xf003f
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40184b
lea eax, [ebp + 0xc]
push edi
push eax
lea eax, [ebp - 4]
push ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x401841
cmp dword [ebp - 4], 7
jne 0x401841
cmp dword [ebp + 0xc], 1
ja 0x401772
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x401841
push esi
push dword [ebp + 0xc]
call fcn.00402a8b
mov esi, eax
pop ecx
lea eax, [ebp + 0xc]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 4]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x4017b1
cmp byte [esi], 0
jne 0x4017b1
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x401839
cmp byte [esi + eax - 1], 0
jne 0x4017e9
cmp byte [esi + eax - 2], 0
je 0x401839
inc eax
push eax
call fcn.00402a8b
pop ecx
mov ebx, eax
mov ecx, dword [ebp + 0xc]
mov edi, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xc]
and byte [ebx + eax], 0
mov eax, dword [ebp + 0xc]
inc eax
jmp 0x40181d
add eax, 2
push eax
call fcn.00402a8b
pop ecx
mov ebx, eax
mov ecx, dword [ebp + 0xc]
mov edi, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xc]
and byte [ebx + eax], 0
mov eax, dword [ebp + 0xc]
and byte [ebx + eax + 1], 0
mov eax, dword [ebp + 0xc]
add eax, 2
push eax
push ebx
push 7
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
call fcn.00402a80
mov esi, dword [ebp - 8]
pop ecx
push esi
call fcn.00402a80
pop ecx
pop esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
leave
ret
Function at 0x40184e
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x10], edi
je 0x401a12
cmp byte [eax], 0
je 0x401a12
mov ebx, dword [ebp + 0x14]
cmp ebx, edi
je 0x401a12
cmp byte [ebx], 0
je 0x401a12
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401a12
lea eax, [ebp + 0xc]
push esi
push eax
lea eax, [ebp - 8]
push edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x401a08
cmp dword [ebp - 8], 7
jne 0x401a08
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, dword [ebp + 0xc]
jg 0x401a08
push dword [ebp + 0xc]
call fcn.00402a8b
mov ebx, eax
pop ecx
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push ebx
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call esi
mov eax, dword [ebp + 0xc]
cmp byte [ebx], 0
mov edi, ebx
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], edi
je 0x401960
mov eax, dword [ebp + 0xc]
add eax, ebx
cmp edi, eax
ja 0x401960
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp + 0x14]
mov esi, eax
inc esi
push edi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x401932
add edi, esi
mov dword [ebp - 0xc], edi
jmp 0x40195b
mov ecx, ebx
mov dword [ebp - 0x10], 1
sub ecx, esi
add esi, edi
sub ecx, edi
add ecx, dword [ebp + 0xc]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
sub dword [ebp + 0xc], eax
mov edi, dword [ebp - 0xc]
cmp byte [edi], 0
jne 0x401907
cmp dword [ebp + 0x18], 0
je 0x4019d4
cmp dword [ebp - 0x10], 0
je 0x4019d4
push dword [ebp + 8]
call fcn.00402a8b
pop ecx
mov dword [ebp + 0x18], eax
push dword [ebp + 0x14]
push 0x40b1b8
push dword [ebp + 8]
push eax
call fcn.0040290b
mov edi, dword [ebp + 0xc]
add esp, 0x10
mov esi, ebx
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp + 0x18]
mov dword [ebp + 0x14], edi
push edx
lea edi, [eax + edx + 1]
mov eax, dword [ebp + 0x14]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov esi, edx
mov eax, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 0xc], eax
call fcn.00402a80
pop ecx
cmp byte [ebx], 0
jne 0x4019e7
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x401a01
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 8], eax
jb 0x401a01
push eax
push ebx
push 7
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
call fcn.00402a80
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebx
leave
ret
Function at 0x401a53
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x40
mov esi, 0x40e034
pop ecx
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp + 0xc]
xor ebx, ebx
push eax
push 0xf003f
push ebx
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401ae4
lea eax, [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp + 8]
push ebx
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x401aad
mov dword [ebp - 4], ebx
jmp 0x401ad6
cmp dword [ebp + 8], 7
jne 0x401ad6
cmp dword [ebp - 8], 1
jbe 0x401ad6
push 0x40b294
lea eax, [ebp + 8]
push esi
push eax
push ebx
mov dword [0x40b294], 0x100
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], ebx
jne 0x401ae8
xor eax, eax
jmp 0x401af7
push dword [ebp + 0x14]
mov dword [0x40e134], ebx
call fcn.00401a16
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401afc
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], edi
je 0x401c79
cmp byte [eax], 0
je 0x401c79
mov esi, dword [ebp + 0x14]
cmp esi, edi
je 0x401c79
cmp byte [esi], 0
je 0x401c79
lea ecx, [ebp + 0xc]
push ecx
push 0xf003f
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401c74
lea eax, [ebp + 0x14]
push ebx
push eax
lea eax, [ebp + 8]
push edi
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401c22
cmp dword [ebp + 8], 7
jne 0x401c6a
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 0x14]
not ecx
dec ecx
lea eax, [ecx + eax + 1]
push eax
mov dword [ebp - 8], eax
call fcn.00402a8b
mov ebx, eax
xor eax, eax
mov edi, ebx
pop ecx
stosd dword es:[edi], eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 8]
push ebx
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x14]
push esi
push ebx
call fcn.00401c7f
mov edx, eax
add esp, 0xc
test edx, edx
je 0x401bd2
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + edx], al
je 0x401c19
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 0x14]
not ecx
dec ecx
lea edi, [ebx + eax - 1]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 7
and ecx, 3
push 0
push dword [ebp + 0x10]
rep movsb byte es:[edi], byte [esi]
and byte [ebx + eax - 2], 0
and byte [ebx + eax - 1], 0
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], 1
push ebx
call fcn.00402a80
pop ecx
jmp 0x401c6a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
inc edi
inc edi
push edi
call fcn.00402a8b
mov ebx, eax
push esi
push edi
push ebx
call fcn.004027db
add esp, 0x10
and byte [ebx + edi - 1], 0
push edi
push ebx
push 7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
call fcn.00402a80
pop ecx
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, dword [ebp - 4]
jmp 0x401c7b
xor eax, eax
pop edi
pop esi
leave
ret