joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405784
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405887
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x405871
mov eax, dword [ebp - 8]
mov edx, 0x73
call fcn.00403bd4
push 0
lea eax, [ebp - 0x10]
push eax
push 0x73
mov eax, dword [ebp - 8]
call fcn.00403afc
mov edx, 1
dec edx
test eax, eax
je 0x4057ff
cmp edx, dword [eax - 4]
jb 0x405804
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_ReadFile
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, 0x40589c
call fcn.00403b8c
test eax, eax
jne 0x405839
mov eax, dword [ebp - 8]
call fcn.0040372c
jmp 0x405871
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, 0x4058a8
call fcn.00403b8c
mov ecx, eax
sub ecx, 1
jno 0x405858
call fcn.00402f1c
sub ecx, 0x50
jno 0x405862
call fcn.00402f1c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 0x51
call fcn.00403b04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40588e
lea eax, [ebp - 4]
call fcn.0040372c
ret

Function at 0x4058ac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x40597a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
lea eax, [ebp - 0x9c]
push eax
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_OpenFile
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x40595c
lea eax, [ebp - 0x10]
mov edx, 0x186a0
call fcn.00403bd4
push 0
lea eax, [ebp - 0x14]
push eax
push 0x186a0
lea eax, [ebp - 0x10]
call fcn.00403afc
mov edx, 1
dec edx
test eax, eax
je 0x405926
cmp edx, dword [eax - 4]
jb 0x40592b
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x40595c
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov edx, dword [ebp - 0x10]
mov eax, 0x405990
call fcn.00403b8c
test eax, eax
jle 0x40595c
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405981
lea eax, [ebp - 0x10]
call fcn.0040372c
lea eax, [ebp - 4]
call fcn.0040372c
ret
Function at 0x4059a8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405a42
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp - 9]
xor al, 1
neg al
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0xa]
and al, byte [ebp + 0x10]
je 0x405a27
mov ecx, dword [ebp + 8]
test ecx, ecx
jns 0x405a13
call fcn.00402f14
mov edx, dword [ebp + 0xc]
test edx, edx
jns 0x405a1f
call fcn.00402f14
mov eax, dword [ebp - 8]
call fcn.00405f7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a49
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403750
ret
Function at 0x405acc
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
xor edx, edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405c86
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004038a4
cmp eax, 2
jl 0x405c53
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x154]
mov ecx, 0x405c9c
mov edx, dword [ebp - 4]
call fcn.004038f0
mov eax, dword [ebp - 0x154]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x405c1a
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040388c
mov ecx, dword [ebp - 0x158]
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004038f0
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.0040388c
test byte [ebp - 0x150], 0x10
je 0x405bd2
mov eax, dword [ebp - 0x10]
mov edx, 0x405ca8
call fcn.004039f0
je 0x405c02
mov eax, dword [ebp - 0x10]
mov edx, 0x405cb4
call fcn.004039f0
je 0x405c02
lea eax, [ebp - 0x15c]
mov ecx, 0x405cc0
mov edx, dword [ebp - 0xc]
call fcn.004038f0
mov eax, dword [ebp - 0x15c]
call fcn.00405acc
jmp 0x405c02
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
jne 0x405c02
push 0x20
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_DeleteFileA
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x405b51
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FindClose
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_RemoveDirectoryA
test eax, eax
jne 0x405c53
push 0x20
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405c8d
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.00403750
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403750
lea eax, [ebp - 4]
call fcn.0040372c
ret

Function at 0x405cc4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405d10
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d17
lea eax, [ebp - 4]
call fcn.0040372c
ret
Function at 0x405e20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
xor edx, edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405f4c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
call fcn.00405504
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 4]
call fcn.004037c4
xor edx, edx
mov eax, 2
call fcn.00405234
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x134], 0x128
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 0xc]
call fcn.00405254
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 6], al
jmp 0x405f17
lea eax, [ebp - 0x140]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call fcn.0040388c
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.00405504
mov eax, dword [ebp - 0x13c]
mov edx, dword [ebp - 4]
call fcn.004039f0
jne 0x405f00
push 0
mov eax, dword [ebp - 0x12c]
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 0xc]
call fcn.00405274
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 6], al
cmp byte [ebp - 6], 0
jne 0x405ea8
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f53
lea eax, [ebp - 0x140]
mov edx, 3
call fcn.00403750
lea eax, [ebp - 4]
call fcn.0040372c
ret
Function at 0x4064e0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406574
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
call sub.KERNEL32.DLL_GetLastError
test eax, eax
jne 0x406551
cmp dword [ebp - 0xc], 0
je 0x406551
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0040385c
jmp 0x406559
mov eax, dword [ebp - 8]
call fcn.0040372c
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40657b
lea eax, [ebp - 4]
call fcn.0040372c
ret

Function at 0x406750
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.004038a4
test eax, eax
je 0x4067f1
mov eax, dword [ebp - 4]
call fcn.004038a4
add eax, 1
jno 0x40677f
call fcn.00402f1c
test eax, eax
jns 0x406788
call fcn.00402f14
push eax
push 0x2042
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4067f1
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4067f1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004067f8
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4067e8
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 0xc]
push eax
push 1
call sub.user32.dll_SetClipboardData
test eax, eax
setne byte [ebp - 5]
call sub.user32.dll_CloseClipboard
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalFree
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x4069a8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x406a09
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x19]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x19]
mov ecx, 0x11
call fcn.0040388c
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
call fcn.00405488
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a10
lea eax, [ebp - 0x20]
call fcn.0040372c
ret
Function at 0x406a14
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x406a94
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.0040388c
lea eax, [ebp - 0x110]
mov edx, 0x406aa8
call fcn.004038ac
mov eax, dword [ebp - 0x110]
mov edx, dword [ebp - 4]
call fcn.00405504
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a9b
lea eax, [ebp - 0x110]
call fcn.0040372c
ret

Function at 0x406c10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406cc8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x4136c0
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jns 0x406c66
call fcn.00402f14
mov dword [0x4136c4], eax
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x4136c0]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jns 0x406c9d
call fcn.00402f14
mov dword [0x4136c4], eax
mov eax, dword [0x4136c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406ccf
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret
Function at 0x406cd8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406db6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4136c0
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jns 0x406d29
call fcn.00402f14
mov dword [0x4136c4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
call fcn.00403bd4
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x4136c0]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jns 0x406d64
call fcn.00402f14
mov dword [0x4136c4], eax
cmp dword [0x4136c4], 0
jne 0x406d88
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.00403aa4
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.0040385c
jmp 0x406d90
mov eax, dword [ebp + 8]
call fcn.0040372c
mov eax, dword [0x4136c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406dbd
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret

Function at 0x406dc4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
mov eax, dword [ebp + 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406ed0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4136c0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jns 0x406e25
call fcn.00402f14
mov dword [0x4136c4], eax
cmp dword [ebp + 8], 0
jne 0x406e3d
lea eax, [ebp + 8]
mov edx, 0x406ee8
call fcn.004037c4
mov eax, dword [ebp + 8]
call fcn.004038a4
test eax, eax
jns 0x406e4e
call fcn.00402f14
push eax
lea eax, [ebp + 8]
call fcn.00403afc
mov edx, 1
dec edx
test eax, eax
je 0x406e66
cmp edx, dword [eax - 4]
jb 0x406e6b
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
push 1
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x4136c0]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x406e92
call fcn.00402f14
mov dword [0x4136c4], eax
cmp dword [0x4136c4], 0
sete byte [ebp - 0xd]
mov eax, dword [0x4136c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406ed7
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
lea eax, [ebp + 8]
call fcn.0040372c
ret
Function at 0x406eec
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406fa7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4136c0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jns 0x406f45
call fcn.00402f14
mov dword [0x4136c4], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x4136c0]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x406f71
call fcn.00402f14
mov dword [0x4136c4], eax
cmp dword [0x4136c4], 0
sete byte [ebp - 0xd]
mov eax, dword [0x4136c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406fae
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret

Function at 0x406fb8
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x407048
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, 0x407060
call fcn.00405a54
test al, al
jne 0x407032
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
push 0
push 0x4136c0
push 0
push 6
push 2
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
sete byte [ebp - 9]
mov eax, dword [0x4136c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40704f
lea eax, [ebp - 8]
call fcn.0040372c
ret

Function at 0x407114
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x4071d2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
jne 0x407154
lea eax, [ebp - 0xc]
mov edx, 0x4071e8
call fcn.004037c4
mov eax, dword [ebp - 0xc]
call fcn.004038a4
test eax, eax
jns 0x407165
call fcn.00402f14
push eax
lea eax, [ebp - 0xc]
call fcn.00403afc
mov edx, 1
dec edx
test eax, eax
je 0x40717d
cmp edx, dword [eax - 4]
jb 0x407182
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x4071a7
call fcn.00402f14
mov dword [0x4136c4], eax
cmp dword [0x4136c4], 0
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4071d9
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret
Function at 0x4071ec
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x40725c
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x407236
call fcn.00402f14
mov dword [0x4136c4], eax
cmp dword [0x4136c4], 0
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407263
lea eax, [ebp - 8]
call fcn.0040372c
ret

Function at 0x40726c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x407318
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4136c0
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jns 0x4072c0
call fcn.00402f14
mov dword [0x4136c4], eax
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x4136c0]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
jns 0x4072e2
call fcn.00402f14
mov dword [0x4136c4], eax
cmp dword [0x4136c4], 0
sete byte [ebp - 0xd]
mov eax, dword [0x4136c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40731f
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret
Function at 0x4075c4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4077f5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, 0x407808
mov edx, dword [0x413adc]
call fcn.004038f0
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x407820
mov edx, 0x407834
mov eax, 0x80000002
call fcn.00406dc4
lea eax, [ebp - 8]
mov ecx, 0x407808
mov edx, dword [0x413adc]
call fcn.004038f0
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x407820
mov edx, 0x40786c
mov eax, 0x80000001
call fcn.00406dc4
lea eax, [ebp - 0xc]
mov ecx, 0x407808
mov edx, dword [0x413adc]
call fcn.004038f0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x407820
mov edx, 0x4078b4
mov eax, 0x80000002
call fcn.00406dc4
lea eax, [ebp - 0x10]
mov ecx, 0x4078f4
mov edx, dword [0x413adc]
call fcn.004038f0
mov eax, dword [ebp - 0x10]
push eax
mov edx, 0x407834
mov ecx, 0x407908
mov eax, 0x80000001
call fcn.00406dc4
lea eax, [ebp - 0x14]
mov ecx, 0x407918
mov edx, dword [0x413adc]
call fcn.004038f0
mov eax, dword [ebp - 0x14]
push eax
mov edx, 0x40786c
mov ecx, 0x407930
mov eax, 0x80000002
call fcn.00406dc4
cmp byte [0x413b40], 0
jne 0x4077da
push 0
mov ecx, 0x407944
mov edx, 0x40795c
mov eax, 0x80000002
call fcn.00406dc4
push 0x407990
mov edx, 0x40795c
mov ecx, 0x4079a0
mov eax, 0x80000002
call fcn.00406dc4
push 0x4079b8
mov edx, 0x40795c
mov ecx, 0x4079f4
mov eax, 0x80000002
call fcn.00406dc4
push 0x407a08
mov edx, 0x40795c
mov ecx, 0x407a24
mov eax, 0x80000002
call fcn.00406dc4
push 0x407a38
mov edx, 0x40795c
mov ecx, 0x407a4c
mov eax, 0x80000002
call fcn.00406dc4
push 0x407a5c
mov edx, 0x40795c
mov ecx, 0x407a70
mov eax, 0x80000002
call fcn.00406dc4
lea eax, [ebp - 0x18]
mov ecx, 0x407808
mov edx, dword [0x413adc]
call fcn.004038f0
mov eax, dword [ebp - 0x18]
push eax
mov edx, 0x40795c
mov ecx, 0x407a84
mov eax, 0x80000002
call fcn.00406dc4
push 1
mov edx, 0x40795c
mov ecx, 0x407a98
mov eax, 0x80000002
call fcn.00406eec
push 3
mov edx, 0x40795c
mov ecx, 0x407ab0
mov eax, 0x80000002
call fcn.00406eec
push 2
mov edx, 0x40795c
mov ecx, 0x407acc
mov eax, 0x80000002
call fcn.00406eec
push 0x120
mov edx, 0x40795c
mov ecx, 0x407adc
mov eax, 0x80000002
call fcn.00406eec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4077fc
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00403750
ret
Function at 0x407c84
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_QueryPerformanceFrequency
lea eax, [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_QueryPerformanceCounter
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
adc edx, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
call fcn.00407c80
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
lea eax, [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_QueryPerformanceCounter
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x1c]
jne 0x407cd4
cmp eax, dword [ebp - 0x20]
jb 0x407cb9
jmp 0x407cd6
jl 0x407cb9
call fcn.00407c80
sub eax, dword [ebp - 0x28]
sbb edx, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret