joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10110860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023e79b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x102e9794]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x101108a9
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
cmp dword [0x102e354c], 0
jne 0x101108c0
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
je 0x1011090d
mov eax, dword [esi]
test eax, eax
je 0x10110892
cmp dword [esi + 4], 0
je 0x10110892
push eax
call fcn.10122cc0
add esp, 4
push dword [esi + 4]
call fcn.10122cc0
mov eax, dword [esi + 0xc]
add esp, 4
test eax, eax
je 0x101108fe
push eax
call fcn.10122cc0
add esp, 4
mov eax, dword [esi + 8]
test eax, eax
je 0x10110945
push eax
call fcn.10122cc0
jmp 0x10110942
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call fcn.10122cc0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
call fcn.10122cc0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
call fcn.10122cc0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.10122cc0
add esp, 4
push 8
call fcn.10122cc0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x10110980
push dword [ebp + 0x18]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.10122cc0
mov dword [edi], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [edi], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10122cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10122ccf
pop dword [ebp - 0x38]
mov eax, 0x102c975a
add eax, 0xffe59575
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xe64906b4
add dword [ebp - 0x48], 0x68093e97
mov dword [ebp - 0x44], 0x951f74b9
sub dword [ebp - 0x44], 0x62ec2874
mov dword [ebp - 0x40], 0xd9f3bbde
sub dword [ebp - 0x40], 0x8da777b0
mov dword [ebp - 0x3c], 0xa3b4ea5a
add dword [ebp - 0x3c], 0x5c4b15a6
lea eax, [ebp - 0x48]
push eax
mov eax, 0x5fd1ad18
add eax, 0xb055d310
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x53934ceb
add dword [ebp - 0x48], 0x20df1c6b
mov dword [ebp - 0x44], 0xf876dbe6
add dword [ebp - 0x44], 0x48f5858f
mov dword [ebp - 0x40], 0x19b1a324
add dword [ebp - 0x40], 0x49bdc948
mov dword [ebp - 0x3c], 0x148aee48
add dword [ebp - 0x3c], 0xeb7511b8
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x78770d21
sub eax, 0x684f8cfd
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x62c6a
push 0
call eax
mov ecx, 0x24823094
add ecx, 0xdb7e1557
mov edx, eax
mov esi, 0x1030fa00
add esi, dword [ebp - 0x38]
mov ebx, 0x2da446ad
add ebx, 0xefc0c68c
sub dword [ebp - 8], ebx
mov edi, dword [esi]
add dword [ebp - 0x28], ebx
add edi, ebx
xor dword [ebp - 0x2c], 0x74e2e0a1
mov dword [edx], edi
sub dword [ebp - 0x20], ebx
add edx, 4
add esi, 0x26f5fff0
sub esi, 0x26f5ffec
loop 0x10122deb
add eax, 0xcf06e692
sub eax, 0xcf05dc13
mov ebx, eax
add eax, 5
mov ecx, 0xe78330a
add ecx, 0x187ccf6
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x1019c030
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023ff89
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102e9794]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
call sym.AIDE.dll_public:_void___thiscall_AIDE::PaletteInfo::constructor_void_
mov ecx, dword [edi + 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call fcn.1019d620
mov dword [esi], eax
lea ecx, [edi + 0x28]
mov dword [esi + 4], 3
mov dword [esi + 8], 0
mov dword [ecx], 8
mov dword [edi + 0x30], 8
mov dword [edi + 0x2c], 8
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 8
mov ecx, dword [edi + 0x14]
call fcn.1019d600
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10209e80
Capabilities:
Terminate process

Disassembly:
cmp dword [str._AdobeIP0000539_], 0
jne 0x10209e91
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
jmp 0x1023bf90
movss xmm5, dword [0x102bd82c]
movss xmm4, dword [0x102bd834]
movss xmm6, dword [0x102bd828]
movss xmm7, dword [0x102bd820]
movss xmm3, dword [0x1027b890]
push esi
xor esi, esi
nop dword [eax + eax]
movd xmm0, esi
mov eax, esi
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
sub esp, 8
addsd xmm0, qword [eax*8 + 0x102d46d0]
cvtpd2ps xmm2, xmm0
movaps xmm0, xmm4
movaps xmm1, xmm2
mulss xmm1, xmm5
subss xmm0, xmm1
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10122cc0
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, xmm6
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10122cc0
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, xmm7
add ecx, eax
mov dword [esi*4 + 0x102fc9f0], ecx
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10122cc0
movaps xmm0, xmm2
mov edx, eax
mulss xmm0, dword [0x102bd830]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10122cc0
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x102bd818]
add eax, edx
mov dword [esi*4 + 0x102fd1f0], eax
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10122cc0
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, dword [0x102bd824]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10122cc0
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x102bd81c]
add eax, ecx
mov dword [esi*4 + 0x102fcdf0], eax
mulss xmm0, xmm3
subss xmm0, xmm4
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10122cc0
movaps xmm0, xmm2
mov dword [esi*4 + 0x102fd5f0], eax
mulss xmm0, dword [0x102bd83c]
mov dword [esi*4 + 0x102fddf0], edx
mov dword [esi*4 + 0x102fd9f0], ecx
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10122cc0
movaps xmm0, xmm2
mov dword [esi*4 + 0x102fe1f0], eax
mulss xmm0, dword [0x102bd840]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10122cc0
movaps xmm0, xmm2
mov dword [esi*4 + 0x102fe5f0], eax
mulss xmm0, dword [0x102bd844]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10122cc0
mov dword [esi*4 + 0x102fe9f0], eax
mulss xmm2, dword [0x102bd838]
cvtps2pd xmm0, xmm2
movsd qword [esp], xmm0
call fcn.10122cc0
mov dword [esi*4 + 0x102fedf0], eax
add esp, 8
inc esi
cmp esi, 0x100
jb 0x1023bfc0
pop esi
ret
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x738e3219
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x6e7c71af
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x4502a8]
shl eax, 2
mov dword [0x4502ac], eax
push edi
push ecx
xor eax, eax
mov edi, 0x4550e0
mov ecx, 0x4591c8
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00441fd4
pop edx
call fcn.00441f38
call fcn.00442014
push 0
call fcn.004433b4
pop ecx
push 0x450270
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4502b0], eax
push 0
jmp fcn.0044a9c4

Function at 0x401e6c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
xor eax, eax
lea edx, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0xffffffff
push edx
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x401eca
push eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp + 0xc]
push eax
push str.cant_open_key__s_result0x_x
push edx
call sub.USER32.DLL_wsprintfA
add esp, 0x10
mov eax, 1
jmp 0x401fb2
xor edx, edx
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryInfoKeyA
cmp dword [ebp - 0x18], 0
jge 0x401efc
mov edx, dword [ebp - 8]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 8], 0
je 0x401f9d
test eax, eax
jne 0x401f9d
xor ebx, ebx
cmp ebx, dword [ebp - 8]
jae 0x401f93
mov dword [ebp - 0xc], 0x100
mov byte [ebp - 0x118], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x118]
push edx
push ebx
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x401f93
push esi
call fcn.00442454
pop ecx
push eax
push esi
lea eax, [ebp - 0x118]
push eax
call fcn.00442644
add esp, 0xc
test eax, eax
jne 0x401f8d
lea edx, [ebp - 0x118]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push edi
call fcn.00402514
add esp, 0xc
test eax, eax
jne 0x401f93
inc dword [ebp - 0x14]
cmp dword [edi + 0x2e0], 0
je 0x401f8d
mov dword [ebp - 0x10], 1
jmp 0x401f93
inc ebx
cmp ebx, dword [ebp - 8]
jb 0x401f15
cmp dword [ebp - 0x10], 0
jne 0x401eca
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x18]
sete al
and eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401fbc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push edi
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4020b3
xor edx, edx
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryInfoKeyA
cmp dword [ebp - 8], 0
je 0x4020aa
test eax, eax
jne 0x4020aa
xor ebx, ebx
cmp ebx, dword [ebp - 8]
jae 0x4020a0
mov dword [ebp - 0xc], 0x100
mov byte [ebp - 0x110], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x110]
push edx
push ebx
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x4020a0
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x110]
push ecx
push edi
push esi
call fcn.004020bc
add esp, 0x14
test eax, eax
je 0x40209a
lea eax, [ebp - 0x110]
push eax
push edi
push esi
call fcn.00402514
add esp, 0xc
cmp dword [esi + 0x2e0], 0
je 0x40209a
mov dword [ebp - 0x10], 1
jmp 0x4020a0
inc ebx
cmp ebx, dword [ebp - 8]
jb 0x40202b
cmp dword [ebp - 0x10], 0
jne 0x401fec
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4020bc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x18]
mov edi, eax
xor eax, eax
push esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x10c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x10c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, dword [ebp + 0x10]
push eax
push edx
call fcn.004423c4
add esp, 8
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push 0
lea eax, [ebp - 0x10c]
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov ebx, eax
test ebx, ebx
je 0x40212e
xor eax, eax
jmp 0x40218e
mov dword [ebp - 0xc], 0x100
mov byte [ebp - 0x10c], 0
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 0x10c]
push ecx
lea eax, [ebp - 8]
push eax
push 0
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
test ebx, ebx
jne 0x40218c
push esi
call fcn.00442454
pop ecx
push eax
push esi
lea edx, [ebp - 0x10c]
push edx
call fcn.00442644
add esp, 0xc
test eax, eax
jne 0x40218c
mov eax, 1
jmp 0x40218e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402198
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push edi
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x402258
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegQueryInfoKeyA
cmp dword [ebp - 8], 0
je 0x4021f3
test eax, eax
je 0x4021fe
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x402258
xor ebx, ebx
cmp ebx, dword [ebp - 8]
jae 0x40224f
mov dword [ebp - 0xc], 0x100
mov byte [ebp - 0x10c], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x10c]
push edx
push ebx
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x40224f
mov eax, dword [ebp + 0x10]
push eax
lea edx, [ebp - 0x10c]
push edx
push edi
push esi
call fcn.00402260
add esp, 0x10
inc ebx
cmp ebx, dword [ebp - 8]
jb 0x402205
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402260
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
lea esi, [ebp - 0x118]
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp + 0x10], 0
je 0x4022b0
mov eax, dword [ebp + 0x10]
push eax
lea edx, [ebp - 0x118]
push edx
call fcn.004423c4
add esp, 8
lea ecx, [ebp - 4]
lea eax, [ebp - 0x118]
push ecx
push 0xf003f
push 0
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4023e0
xor edx, edx
lea ecx, [ebp - 8]
mov dword [ebp - 0x18], edx
push 0
push 0
push 0
push 0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryInfoKeyA
test eax, eax
jne 0x4023d7
xor edi, edi
cmp edi, dword [ebp - 8]
jae 0x4023cd
mov dword [ebp - 0xc], 0x100
mov byte [ebx + 0x3e4], 0
mov byte [ebp - 0x118], 0
mov dword [ebp - 0x14], 0x100
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x118]
push eax
push edx
lea ecx, [ebp - 0x10]
lea eax, [ebp - 0xc]
push ecx
push 0
push eax
lea esi, [ebx + 0x3e4]
push esi
push edi
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegEnumValueA
test eax, eax
jne 0x4023cd
mov edx, dword [ebp + 0x14]
push edx
call fcn.00442454
pop ecx
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push esi
call fcn.00442644
add esp, 0xc
test eax, eax
jne 0x4023c3
push esi
lea ecx, [ebp - 0x218]
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
push str.DELETING__s_s__s_
push ecx
call sub.USER32.DLL_wsprintfA
add esp, 0x14
cmp dword [ebx + 0x2e0], 0
je 0x4023c3
push esi
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegDeleteValueA
test eax, eax
je 0x4023ba
push esi
push str.cant_delete_value__s
lea edx, [ebp - 0x218]
push edx
call sub.USER32.DLL_wsprintfA
add esp, 0xc
jmp 0x4023c3
mov dword [ebp - 0x18], 1
jmp 0x4023cd
inc edi
cmp edi, dword [ebp - 8]
jb 0x40230d
cmp dword [ebp - 0x18], 0
jne 0x4022d4
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4023e8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov edx, dword [ebp + 0xc]
push edx
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov ebx, eax
test ebx, ebx
je 0x40241d
mov eax, ebx
jmp 0x40250d
push 0
push 0
push 0
lea edx, [ebp - 8]
push 0
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegQueryInfoKeyA
mov ebx, eax
test ebx, ebx
je 0x402454
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, ebx
jmp 0x40250d
xor esi, esi
mov ebx, 0xe8
cmp esi, dword [ebp - 8]
jae 0x402502
mov dword [ebp - 0xc], 0x100
mov byte [edi + 0x3e4], 0
mov dword [ebp - 0x14], 0x100
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x114]
push eax
push edx
lea ecx, [ebp - 0x10]
lea eax, [ebp - 0xc]
push ecx
push 0
push eax
lea edx, [edi + 0x3e4]
push edx
push esi
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegEnumValueA
mov ebx, eax
test ebx, ebx
jne 0x402502
mov eax, dword [ebp + 0x10]
push eax
call fcn.00442454
pop ecx
push eax
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [edi + 0x3e4]
push ecx
call fcn.00442644
add esp, 0xc
test eax, eax
jne 0x4024f3
mov eax, dword [ebp + 0x14]
lea edi, [ebp - 0x114]
mov esi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ebx, ebx
jmp 0x402502
mov ebx, 0xe8
inc esi
cmp esi, dword [ebp - 8]
jb 0x402464
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402514
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, eax
xor eax, eax
push esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x100]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x100]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, dword [ebp + 0x10]
push eax
push edx
call fcn.004423c4
add esp, 8
lea ecx, [ebp - 0x100]
push ecx
push str.DELETING__s
lea eax, [ebp - 0x200]
push eax
call sub.USER32.DLL_wsprintfA
add esp, 0xc
cmp dword [esi + 0x2e0], 0
jne 0x402588
xor eax, eax
jmp 0x4025e7
lea edx, [ebp - 0x100]
push edx
push 0x80000002
call sub.SHLWAPI.DLL_SHDeleteKeyA
mov ebx, eax
test ebx, ebx
je 0x4025c2
lea eax, [ebp - 0x100]
push eax
push esi
call fcn.00402c40
add esp, 8
lea edx, [ebp - 0x100]
push edx
push 0x80000002
call sub.SHLWAPI.DLL_SHDeleteKeyA
mov ebx, eax
test ebx, ebx
je 0x4025e5
lea eax, [ebp - 0x100]
lea edx, [ebp - 0x200]
push eax
push str.cant_delete_key__s
push edx
call sub.USER32.DLL_wsprintfA
add esp, 0xc
mov eax, ebx
jmp 0x4025e7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4025f0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x10]
mov ebx, eax
jae 0x40276e
mov eax, dword [ebx]
sub eax, 2
je 0x402682
dec eax
je 0x4026a9
dec eax
je 0x402647
push 0x104
lea edx, [ebp - 0x24c]
push edx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x45085d
lea ecx, [ebp - 0x24c]
push ecx
call fcn.004423c4
add esp, 8
jmp 0x4026ce
push 0x104
lea eax, [ebp - 0x24c]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x45085f
lea edx, [ebp - 0x24c]
push edx
call fcn.004423c4
add esp, 8
push 0x45086a
lea ecx, [ebp - 0x24c]
push ecx
call fcn.004423c4
add esp, 8
jmp 0x4026ce
push 0x104
lea eax, [ebp - 0x24c]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x45086c
lea edx, [ebp - 0x24c]
push edx
call fcn.004423c4
add esp, 8
jmp 0x4026ce
push 0x104
lea ecx, [ebp - 0x24c]
push ecx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x450872
lea eax, [ebp - 0x24c]
push eax
call fcn.004423c4
add esp, 8
lea edx, [ebp - 0x24c]
push edx
call fcn.00442454
pop ecx
mov dword [ebp - 4], eax
mov ecx, dword [ebx + 4]
push ecx
lea eax, [ebp - 0x24c]
push eax
call fcn.004423c4
add esp, 8
lea edx, [ebp - 0x144]
push edx
lea ecx, [ebp - 0x24c]
push ecx
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x402761
lea eax, [ebp - 0x24c]
add eax, dword [ebp - 4]
push esi
mov esi, eax
push edi
xor eax, eax
lea edi, [ebp - 0x118]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x24c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004029d4
add esp, 8
lea ecx, [ebp - 0x144]
push ecx
push esi
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x40270b
inc edi
add ebx, 8
cmp edi, dword [ebp + 0x10]
jb 0x40260c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret