joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4069b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x8dc
mov eax, dword [0x41a190]
xor eax, esp
mov dword [esp + 0x8d8], eax
push ebx
mov ebx, dword [esp + 0x8e4]
push ebp
mov ebp, dword [esp + 0x8ec]
push esi
xor esi, esi
cmp ebx, 0x80000000
push edi
mov edi, ecx
je 0x406a26
cmp ebx, 0x80000001
je 0x406a14
cmp ebx, 0x80000002
je 0x406a02
push ebx
push 0x422478
call fcn.00401580
add esp, 4
jmp 0x406a30
push 0x422458
call fcn.00401580
push eax
lea ecx, [esp + 0x28]
push ecx
jmp 0x406a36
push 0x422438
call fcn.00401580
push eax
lea edx, [esp + 0x28]
push edx
jmp 0x406a36
push 0x422418
call fcn.00401580
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004060b0
add esp, 0xc
push ebp
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x20]
push edx
push 0x4222c8
call fcn.00401580
add esp, 4
push eax
push edi
call fcn.004065a0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x406a9d
push eax
push 0x4223f8
call fcn.00401580
add esp, 4
push eax
push edi
call fcn.004065a0
add esp, 0xc
xor eax, eax
jmp 0x406b54
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xec]
push edx
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x4fc]
push edx
push 0
mov ebp, 0x400
push eax
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
call ebx
test eax, eax
jne 0x406b44
mov edi, edi
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xe8]
push ecx
push edx
lea eax, [esp + 0x4f0]
push eax
push 0x4223e4
call fcn.00401580
add esp, 4
push eax
push edi
call fcn.004065a0
add esp, 0x14
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xec]
push edx
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x4fc]
push edx
add esi, 1
push esi
push eax
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
call ebx
test eax, eax
je 0x406ae0
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x8e8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040acd2
add esp, 0x8dc
ret 8
Function at 0x406ca0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x144
mov eax, dword [0x41a190]
xor eax, esp
mov dword [esp + 0x140], eax
push esi
push edi
mov edi, dword [esp + 0x150]
push edi
push 0x4225b4
mov esi, ecx
call fcn.00401580
add esp, 4
push eax
push esi
call fcn.004065a0
add esp, 0xc
test eax, eax
je 0x406dc3
push ebp
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x406d04
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x42258c
jmp 0x406db0
lea ecx, [esp + 0x38]
push ecx
push 0x4222c8
call fcn.00401580
add esp, 4
push eax
push esi
call fcn.004065a0
add esp, 0xc
test eax, eax
je 0x406dc2
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 0xc]
push edx
push ebp
call edi
test eax, eax
je 0x406d96
lea ebx, [ebx]
test byte [esp + 0xc], 0x10
jne 0x406d6a
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x38]
push eax
push ecx
push 0x42257c
call fcn.00401580
add esp, 4
push eax
push esi
call fcn.004065a0
add esp, 0x10
jmp 0x406d86
lea edx, [esp + 0x38]
push edx
push 0x422564
call fcn.00401580
add esp, 4
push eax
push esi
call fcn.004065a0
add esp, 0xc
test eax, eax
je 0x406dc2
lea eax, [esp + 0xc]
push eax
push ebp
call edi
test eax, eax
jne 0x406d40
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, 0x12
je 0x406dc2
push edi
push 0x422544
call fcn.00401580
add esp, 4
push eax
push esi
call fcn.004065a0
add esp, 0xc
pop ebp
mov ecx, dword [esp + 0x148]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040acd2
add esp, 0x144
ret 4
Function at 0x4071c0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x58
mov eax, dword [0x41a190]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push 0x50
lea eax, [esp + 0xc]
push eax
mov ebx, ecx
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
jne 0x407206
push 0x422838
call fcn.00401580
push eax
push ebx
call fcn.004065a0
add esp, 0xc
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.0040acd2
add esp, 0x58
ret
push edi
lea ecx, [esp + 0xc]
push ecx
push 0x422820
call fcn.00401580
add esp, 4
push eax
push ebx
call fcn.004065a0
add esp, 0xc
lea edx, [esp + 0xc]
push edx
call sub.WSOCK32.dll_gethostbyname
mov edi, eax
test edi, edi
jne 0x407258
push 0x422804
call fcn.00401580
push eax
push ebx
call fcn.004065a0
add esp, 0xc
pop edi
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.0040acd2
add esp, 0x58
ret
mov eax, dword [edi + 0xc]
push esi
xor esi, esi
cmp dword [eax], esi
je 0x4072a4
mov eax, dword [eax]
push 4
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.004022a0
mov edx, dword [esp + 0x18]
add esp, 0xc
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
push 0x4227f4
call fcn.00401580
add esp, 4
push eax
push ebx
call fcn.004065a0
mov eax, dword [edi + 0xc]
add esi, 1
lea eax, [eax + esi*4]
add esp, 0xc
cmp dword [eax], 0
jne 0x407262
mov ecx, dword [esp + 0x60]
pop esi
pop edi
pop ebx
xor ecx, esp
call fcn.0040acd2
add esp, 0x58
ret
Function at 0x407330
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x410
mov eax, dword [0x41a190]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebx
push esi
push 0x4229e4
mov esi, ecx
xor ebx, ebx
call fcn.00401580
push eax
push esi
call fcn.004065a0
push 0x4229b4
call fcn.00401580
push eax
push esi
call fcn.004065a0
add esp, 0x18
lea eax, [esp + 8]
push eax
push 0x20019
push ebx
push 0x422940
call fcn.00401580
add esp, 4
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4073b0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.0040acd2
add esp, 0x410
ret
push ebp
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
push 0
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x30]
push eax
push 0
mov ebp, 0x400
push ecx
mov dword [esp + 0x34], ebp
call edi
test eax, eax
jne 0x40742f
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.00406770
push eax
push 0x4222c8
call fcn.00401580
add esp, 4
push eax
push esi
call fcn.004065a0
add esp, 0xc
push 0
push 0
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x30]
push edx
add ebx, 1
push ebx
push eax
mov dword [esp + 0x34], ebp
call edi
test eax, eax
je 0x4073e3
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x42290c
call fcn.00401580
push eax
push esi
call fcn.004065a0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push 0x422898
call fcn.00401580
add esp, 4
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40747e
xor eax, eax
jmp 0x407512
xor ebx, ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push ebx
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x30]
push edx
push ebx
push eax
mov dword [esp + 0x34], ebp
call edi
test eax, eax
jne 0x4074ee
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.00406770
push eax
push 0x4222c8
call fcn.00401580
add esp, 4
push eax
push esi
call fcn.004065a0
add esp, 0xc
push 0
push 0
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x30]
push ecx
add ebx, 1
push ebx
push edx
mov dword [esp + 0x34], ebp
call edi
test eax, eax
je 0x4074a2
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x42286c
call fcn.00401580
push eax
push esi
call fcn.004065a0
add esp, 0xc
mov eax, 1
mov ecx, dword [esp + 0x41c]
pop edi
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.0040acd2
add esp, 0x410
ret
Function at 0x407bb0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x404
mov eax, dword [0x41a190]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
push esi
lea eax, [esp + 8]
push eax
push 0x400
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
cmp byte [esp + 8], 0
lea esi, [esp + 8]
je 0x407c13
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea ebx, [ebx]
push esi
call edi
cmp eax, 3
jne 0x407c00
push esi
mov ecx, ebx
call fcn.004072c0
push esi
call fcn.00405930
lea esi, [esi + eax + 1]
add esp, 4
cmp byte [esi], 0
jne 0x407bf0
pop edi
mov ecx, dword [esp + 0x408]
pop esi
pop ebx
xor ecx, esp
call fcn.0040acd2
add esp, 0x404
ret

Function at 0x408500
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
sub esp, 0x944
mov eax, dword [0x41a190]
xor eax, esp
mov dword [esp + 0x940], eax
push esi
mov esi, dword [esp + 0x94c]
push edi
mov edi, dword [esp + 0x954]
push 0
lea eax, [esp + 0x14c]
push esi
push eax
call fcn.004059c0
lea ecx, [esp + 0x154]
push edi
push ecx
call fcn.00405980
add esp, 0x14
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4085bb
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ecx]
test byte [esp + 0x10], 0x10
jne 0x4085a6
push 0
lea ecx, [esp + 0x554]
push esi
push ecx
call fcn.004059c0
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x560]
push eax
call fcn.00405980
add esp, 0x14
lea ecx, [esp + 0x550]
push ecx
call ebp
lea edx, [esp + 0x10]
push edx
push edi
call ebx
test eax, eax
jne 0x408570
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop ebx
mov ecx, dword [esp + 0x948]
pop edi
pop esi
xor ecx, esp
call fcn.0040acd2
add esp, 0x944
ret 8

Function at 0x408f80
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4151eb
mov eax, dword fs:[0]
push eax
mov eax, 0x4870
call fcn.0040ad70
mov eax, dword [0x41a190]
xor eax, esp
mov dword [esp + 0x486c], eax
mov eax, dword [0x41a190]
xor eax, esp
push eax
lea eax, [esp + 0x4874]
mov dword fs:[0], eax
call fcn.00401000
test al, al
je 0x408fea
xor eax, eax
mov ecx, dword [esp + 0x4874]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x486c]
xor ecx, esp
call fcn.0040acd2
add esp, 0x487c
ret
push 0x41f760
call fcn.00402ce0
add esp, 4
push 1
lea ecx, [esp + 8]
mov dword [0x41f7c8], 0
call fcn.00408d00
push 0
lea ecx, [esp + 8]
mov dword [esp + 0x4880], 0
call fcn.0040a870
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4090e0
Capabilities:
Delete file
Download url
Get common file path
Get file size
Read file on windows
Receive data

Disassembly:
sub esp, 0x80c
mov eax, dword [0x41a190]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 0
lea eax, [ebp + 0x15]
push eax
lea ecx, [esp + 0x420]
push ecx
call fcn.004059c0
lea edx, [esp + 0x424]
push 0x423668
push edx
call fcn.00405980
mov eax, dword [ebp + 4]
mov ecx, dword [eax + 0xc]
lea edx, [ecx + ebp + 4]
push edx
lea eax, [esp + 0x430]
push eax
call fcn.00405980
mov ecx, dword [ebp + 4]
mov edx, dword [ecx + 0xc]
lea eax, [edx + ebp + 0x14]
push eax
lea ecx, [esp + 0x438]
push ecx
call fcn.00405980
mov edx, dword [ebp]
mov edx, dword [edx]
add esp, 0x24
lea eax, [esp + 0x418]
push eax
mov ecx, ebp
call edx
lea eax, [esp + 0x18]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x18]
push ecx
push 5
push 0x423664
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
xor esi, esi
mov dword [esp + 0x14], esi
mov edi, edi
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x424]
push ecx
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jne 0x409283
push eax
push eax
push 3
push eax
push 1
push 0x80000000
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40929c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
jbe 0x4092b2
lea eax, [ebx + 1]
push eax
call fcn.00402260
mov edi, eax
add esp, 4
test edi, edi
je 0x4092c6
push 0
lea ecx, [esp + 0x14]
push ecx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409266
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x40929c
push eax
push edi
lea ecx, [ebp + 4]
call fcn.00401710
test eax, eax
je 0x4092da
mov byte [edi + ebx], 0
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp]
mov edx, dword [edx + 4]
sub ecx, eax
add ecx, edi
push ecx
push eax
mov ecx, ebp
call edx
push edi
movzx esi, al
call fcn.00402280
add esp, 4
test esi, esi
setne al
jmp 0x4092e5
push edi
call fcn.00402280
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40929c
cmp esi, 3
jge 0x4092e3
mov ecx, dword [ebp + 4]
mov edx, dword [ecx + 0xc]
push 0x1388
lea ecx, [edx + ebp + 4]
call fcn.00409030
mov esi, dword [esp + 0x14]
add esi, 1
cmp esi, 3
mov dword [esp + 0x14], esi
jl 0x409190
jmp 0x4092e3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4092e3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4092e3
push edi
call fcn.00402280
add esp, 4
xor al, al
mov ecx, dword [esp + 0x818]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040acd2
add esp, 0x80c
ret
Function at 0x4093b0
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebp
xor edx, edx
xor ebp, ebp
cmp dword [esp + 0x10], edx
mov dword [esp + 4], ecx
jle 0x4094a6
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
jmp 0x4093d0
mov esi, dword [esp + 0x18]
mov al, byte [esi + ebp]
mov ecx, dword [esp + 0x10]
movzx edi, al
mov eax, edi
shr eax, 2
push eax
add ebp, 1
call fcn.00409350
and edi, 3
mov byte [edx + ebx], al
add edx, 1
shl edi, 4
cmp ebp, dword [esp + 0x1c]
jge 0x409470
mov al, byte [esi + ebp]
movzx esi, al
mov ecx, esi
shr ecx, 4
or edi, ecx
push edi
mov edi, dword [esp + 0x14]
mov ecx, edi
add ebp, 1
call fcn.00409350
and esi, 0xf
add esi, esi
mov byte [edx + ebx], al
add edx, 1
add esi, esi
cmp ebp, dword [esp + 0x1c]
jge 0x409463
mov eax, dword [esp + 0x18]
mov al, byte [eax + ebp]
movzx edi, al
mov ecx, edi
shr ecx, 6
or esi, ecx
push esi
mov esi, dword [esp + 0x14]
mov ecx, esi
add ebp, 1
call fcn.00409350
and edi, 0x3f
mov byte [edx + ebx], al
push edi
mov ecx, esi
add edx, 1
call fcn.00409350
mov byte [edx + ebx], al
jmp 0x40948b
push esi
mov ecx, edi
call fcn.00409350
mov byte [edx + ebx], al
jmp 0x409484
mov ecx, dword [esp + 0x10]
push edi
call fcn.00409350
mov byte [edx + ebx], al
add edx, 1
mov byte [edx + ebx], 0x3d
add edx, 1
mov byte [edx + ebx], 0x3d
add edx, 1
cmp ebp, dword [esp + 0x1c]
jl 0x4093d0
pop edi
pop esi
mov byte [edx + ebx], 0
pop ebx
mov al, 1
pop ebp
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
mov byte [edx + eax], dl
mov al, 1
pop ebp
pop ecx
ret 0xc
Function at 0x4099a0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebp
push edi
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4099cc
pop edi
xor al, al
pop ebp
ret 4
push ebx
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea ecx, [ebx + 1]
push ecx
call fcn.00402260
add esp, 4
push 0
lea edx, [esp + 0x18]
push edx
push ebx
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push edi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x409a40
mov eax, dword [esp + 0x14]
push eax
push esi
lea ecx, [ebp + 4]
call fcn.00401710
test eax, eax
je 0x409a40
mov ecx, dword [esp + 0x14]
mov byte [ecx + esi], 0
mov edx, dword [ebp]
add eax, 0x10
push eax
mov eax, dword [edx]
mov ecx, ebp
call eax
push esi
call fcn.00402280
add esp, 4
pop esi
pop ebx
pop edi
mov al, 1
pop ebp
ret 4
push esi
call fcn.00402280
add esp, 4
pop esi
pop ebx
pop edi
xor al, al
pop ebp
ret 4

Function at 0x409bd0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10
lea eax, [esp + 4]
push eax
push 0x42375c
call fcn.00401580
add esp, 4
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x409bfb
xor eax, eax
add esp, 0x10
ret
push esi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xc]
push eax
mov esi, 4
push 0
push 0x42374c
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
call fcn.00401580
mov ecx, dword [esp + 0x1c]
add esp, 4
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409c3d
cmp dword [esp + 4], esi
je 0x409c86
mov dword [esp + 4], esi
call fcn.00402c00
push esi
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
push eax
push 0
push 0x42374c
call fcn.00401580
mov ecx, dword [esp + 0x1c]
add esp, 4
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x409c86
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
pop esi
add esp, 0x10
ret
Function at 0x409ca0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push 0x42375c
mov dword [esp + 0xc], 0
call fcn.00401580
add esp, 4
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x409cd2
xor al, al
add esp, 0x10
ret
push esi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
mov esi, 4
push 0
push 0x42378c
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
call fcn.00401580
mov ecx, dword [esp + 0x18]
add esp, 4
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409d14
cmp dword [esp + 0xc], esi
je 0x409d5c
push esi
lea edx, [esp + 0xc]
push edx
push esi
push 0
push 0x42378c
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x1c], 1
call fcn.00401580
add esp, 4
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x409d5c
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop esi
add esp, 0x10
ret
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 8], 0
pop esi
setne al
add esp, 0x10
ret

Function at 0x409d80
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0x42375c
mov dword [esp + 0xc], 0
call fcn.00401580
add esp, 4
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x409def
push 4
lea ecx, [esp + 8]
push ecx
push 4
push eax
push 0x42378c
mov dword [esp + 0x18], eax
call fcn.00401580
mov edx, dword [esp + 0x14]
add esp, 4
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x409de5
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret

Function at 0x40a040
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0x42375c
mov esi, ecx
call fcn.00401580
add esp, 4
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40a0ab
push 0x400
add esi, 0x2a6
push esi
push 1
push eax
push 0x4237bc
call fcn.00401580
mov ecx, dword [esp + 0x18]
add esp, 4
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40a0a0
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret
Function at 0x40a120
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0x42375c
mov esi, ecx
call fcn.00401580
add esp, 4
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40a118
push 0x40
add esi, 0x6a6
push esi
push 1
push eax
push 0x4237c8
call fcn.00401580
mov ecx, dword [esp + 0x18]
add esp, 4
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40a10d
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret
push esi
mov esi, ecx
call fcn.0040a040
lea eax, [esi + 0x6a6]
push eax
lea ecx, [esi + 0x2a6]
push ecx
call fcn.00402120
add esp, 8
test al, al
je 0x40a14a
mov ecx, esi
pop esi
jmp 0x40a0b0
pop esi
ret

Function at 0x40a150
Capabilities:
Delete file

Disassembly:
add ecx, 0x2a6
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret
Function at 0x40acd2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a190]
jne 0x40acdc
repz ret
jmp fcn.0040b211

Function at 0x40ffed
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040c0fc
xor ebx, ebx
cmp dword [0x42008c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4100c2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x41002d
xor eax, eax
jmp 0x410186
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x410026
push eax
call fcn.0040c099
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42008c], eax
call esi
push eax
call fcn.0040c099
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x420090], eax
call esi
push eax
call fcn.0040c099
mov dword [0x420094], eax
lea eax, [ebp - 8]
push eax
call fcn.0040d992
test eax, eax
pop ecx
pop ecx
je 0x410090
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040e87d
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4100c2
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040c099
cmp eax, ebx
pop ecx
mov dword [0x42009c], eax
je 0x4100c2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040c099
pop ecx
mov dword [0x420098], eax
mov eax, dword [0x420098]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x41013b
cmp dword [0x42009c], esi
je 0x41013b
push eax
call fcn.0040c105
pop ecx
call eax
cmp eax, ebx
je 0x410108
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x42009c]
call fcn.0040c105
pop ecx
call eax
test eax, eax
je 0x410108
test byte [ebp - 0x18], 1
jne 0x41013b
lea eax, [ebp - 0xc]
push eax
call fcn.0040d9c9
test eax, eax
pop ecx
je 0x410123
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040e87d
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x410132
or dword [ebp + 0x10], 0x200000
jmp 0x41016c
or dword [ebp + 0x10], 0x40000
jmp 0x41016c
mov eax, dword [0x420090]
cmp eax, esi
je 0x41016c
push eax
call fcn.0040c105
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x41016c
mov eax, dword [0x420094]
cmp eax, esi
je 0x41016c
push dword [ebp - 4]
push eax
call fcn.0040c105
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x42008c]
call fcn.0040c105
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret