joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e3e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42e401
mov eax, dword [eax - 4]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42e40f
mov eax, dword [eax - 4]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x42e531
test ebx, ebx
jl 0x42e531
test esi, esi
jle 0x42e531
mov eax, dword [ebp - 8]
call fcn.0040aa9c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040aa9c
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42e4ce
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x42e531
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42e4b3
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42e482
inc dword [ebp - 0x14]
jmp 0x42e492
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x42e492
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x42e49d
or eax, 0xffffffff
jmp 0x42e4b3
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42e4b0
inc eax
jmp 0x42e4b3
or eax, 0xffffffff
test eax, eax
jl 0x42e4bb
cmp esi, eax
jg 0x42e470
cmp esi, eax
jg 0x42e4c6
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42e534
inc edx
dec dword [ebp - 0x1c]
jne 0x42e46c
jmp 0x42e531
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x42e531
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42e518
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42e4f7
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42e502
or eax, 0xffffffff
jmp 0x42e518
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42e515
inc eax
jmp 0x42e518
or eax, 0xffffffff
test eax, eax
jl 0x42e520
cmp esi, eax
jg 0x42e4e0
cmp esi, eax
jg 0x42e52b
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42e534
inc edx
dec dword [ebp - 0x1c]
jne 0x42e4dc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43e748
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x43e750
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4413c4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x4413db
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x4413cb
mov eax, ecx
pop ebx
ret
Function at 0x4558c8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x4558dc
add esp, 0xfffffff0
call fcn.004087d0
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x44f84c]
call fcn.00473fec
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x454898]
call fcn.00476da0
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x454898]
call fcn.00476da0
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x455931
call fcn.00408828
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4be17c
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4be1bf
cmp byte [ebx + 0x11], 0
jne 0x4be1bf
cmp byte [ebx + 0x24], 0
jne 0x4be1bf
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4be1d6
mov ecx, dword [0x4e8f94]
mov dl, 1
mov eax, dword [0x48e054]
call fcn.00428b4c
call fcn.004096a0
pop ebx
ret
mov ecx, dword [0x4e8f94]
mov dl, 1
mov eax, dword [0x48e054]
call fcn.00428b4c
call fcn.004096a0
pop ebx
ret

Function at 0x4beb44
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4beb92
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004be028
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bebab
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4bebb4
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004be028
dec esi
jne 0x4bebd6
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4d9990
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4d9b4f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040a470
mov eax, dword [ebp - 4]
call fcn.004d9270
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4d99e2
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040aea4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004da914
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4d9ac3
xor eax, eax
push ebp
push 0x4d9abc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004d957c
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004d9b84
test al, al
je 0x4d9a98
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040a1d0
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4d9a98
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040aa9c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004d94dc
test al, al
je 0x4d9a92
mov eax, dword [ebp - 8]
call fcn.0040aa9c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040aafc
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004d9990
dec ebx
cmp ebx, 0xffffffff
jne 0x4d9a41
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9ac3
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004d957c
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
cmp byte [0x4f08c8], 0
je 0x4d9b03
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.0040aa9c
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004d9568
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004d94dc
mov ebx, eax
jmp 0x4d9b2a
mov eax, dword [ebp - 4]
call fcn.0040aa9c
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004d9568
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004d94dc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9b56
lea eax, [ebp - 0x3c]
call fcn.0040a038
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a098
pop eax
jmp eax
Function at 0x4d9bf4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4d9cae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x48]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.004d9b84
test al, al
je 0x4d9c8e
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a1d0
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x4d9c8e
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040aa9c
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.0040aa9c
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040aafc
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
dec ebx
jne 0x4d9c47
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9cb5
lea eax, [ebp - 0x2c]
call fcn.0040a038
lea eax, [ebp - 4]
call fcn.0040a038
pop eax
jmp eax

Function at 0x4d9e68
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4d9f22
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x48]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.004d9b84
test al, al
je 0x4d9f02
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a1d0
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x4d9f02
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040aa9c
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueW
mov eax, dword [ebp - 4]
call fcn.0040aa9c
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040aafc
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
dec ebx
jne 0x4d9ebb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9f29
lea eax, [ebp - 0x2c]
call fcn.0040a038
lea eax, [ebp - 4]
call fcn.0040a038
pop eax
jmp eax
Function at 0x4da7f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.004d9288
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040aa9c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.004d94dc
test al, al
jne 0x4da858
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4e8ef0]
mov dl, 1
mov eax, dword [0x4d7924]
call fcn.00428c20
call fcn.004096a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4da864
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040aa9c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.004d94dc
test al, al
jne 0x4da8c5
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4e9118]
mov dl, 1
mov eax, dword [0x4d7924]
call fcn.00428c20
call fcn.004096a0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004d92f0
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4daedc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4db008
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.004d957c
xor eax, eax
push ebp
push 0x4dafe1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d9b84
test al, al
je 0x4dafc3
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004dadb4
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a1d0
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x4dafc3
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040aa9c
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d94dc
test al, al
je 0x4dafbf
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040aa9c
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040aafc
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004dadb4
pop ecx
inc edi
dec ebx
jne 0x4daf67
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dafe8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.004d957c
pop eax
jmp eax
Function at 0x4db018
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4db270
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.004d957c
xor eax, eax
push ebp
push 0x4db244
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d9b84
test al, al
je 0x4db226
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a1d0
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x4db226
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040aa9c
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d94dc
test al, al
je 0x4db21a
mov eax, dword [ebp - 4]
call fcn.0040aa9c
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040aafc
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004da914
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4db21a
xor eax, eax
push ebp
push 0x4db213
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.004d957c
xor eax, eax
push ebp
push 0x4db1f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040aa9c
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040aafc
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d9580
mov eax, dword [ebp - 4]
call fcn.0040aa9c
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040aafc
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004da914
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4db1ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004daedc
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004db018
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db1d5
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x4db0a3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db24b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.004d957c
pop eax
jmp eax
Function at 0x40147b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412194]
jne 0x401485
repz ret
jmp fcn.00402145

Function at 0x4092af
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004032a6
and dword [ebp - 4], 0
cmp dword [0x413a68], 0
mov ebx, eax
jne 0x409360
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409411
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409411
push eax
call fcn.00403234
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x413a68], eax
call esi
push eax
call fcn.00403234
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x413a6c], eax
call esi
push eax
call fcn.00403234
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x413a70], eax
call esi
push eax
call fcn.00403234
pop ecx
mov dword [0x413a78], eax
test eax, eax
je 0x409360
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403234
pop ecx
mov dword [0x413a74], eax
mov eax, dword [0x413a74]
cmp eax, ebx
je 0x4093b8
cmp dword [0x413a78], ebx
je 0x4093b8
push eax
call fcn.004032af
push dword [0x413a78]
mov esi, eax
call fcn.004032af
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4093b8
test edi, edi
je 0x4093b8
call esi
test eax, eax
je 0x4093af
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4093af
test byte [ebp - 0xc], 1
jne 0x4093b8
or dword [ebp + 0x10], 0x200000
jmp 0x4093f1
mov eax, dword [0x413a6c]
cmp eax, ebx
je 0x4093f1
push eax
call fcn.004032af
pop ecx
test eax, eax
je 0x4093f1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4093f1
mov eax, dword [0x413a70]
cmp eax, ebx
je 0x4093f1
push eax
call fcn.004032af
pop ecx
test eax, eax
je 0x4093f1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x413a68]
call fcn.004032af
pop ecx
test eax, eax
je 0x409411
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409413
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40aa90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x10], 0
jne 0x40aaa3
mov dword [ebp + 0x10], str.hpqrrx08.log
cmp dword [ebp + 0x10], 0
je 0x40ab32
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40ab32
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40ab32
push 2
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp + 0xc], 0
je 0x40ab28
push 0
lea edx, [ebp - 8]
push edx
push 2
push 0x40fc84
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x40ac40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40ac77
cmp dword [ebp + 0xc], 0
je 0x40ac75
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 8], eax
jmp 0x40ac86
mov edx, dword [ebp - 4]
and edx, 0x10
je 0x40ac86
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8

Function at 0x40ac90
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040aa90
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x413c18]
push eax
call fcn.0040ab40
add esp, 8
pop ebp
ret
Function at 0x40b230
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x412194]
xor eax, ebp
mov dword [ebp - 8], eax
push str.Initializing_the_Log_File
call fcn.0040ade0
add esp, 4
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x110]
push ecx
push str.Shell_folder_to_store_the_log_file:
call fcn.0040ae00
add esp, 8
cmp dword [ebp - 4], 0
jl 0x40b2f1
push str.HPInstallerTemp_
push 0x104
lea edx, [ebp - 0x110]
push edx
call fcn.00401aaf
add esp, 0xc
push 0
lea eax, [ebp - 0x110]
push eax
call fcn.0040acd0
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x110]
push edx
call fcn.00401aaf
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
push str.Full_path_to_the_log_file:
call fcn.0040ae00
add esp, 8
lea ecx, [ebp - 0x110]
push ecx
push 0x104
push str.hpqrrx08.log
call fcn.00401b23
add esp, 0xc
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040147b
mov esp, ebp
pop ebp
ret