joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7a7f90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x7a7ffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x7a8035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.007a7e00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0x7a7fc5
mov edi, 0x7c28b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x7a8035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.007a7e00
add edi, 4
add esp, 0xc
cmp edi, 0x7c28c0
jb 0x7a8000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0x7a8070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.007ae082
mov esi, eax
add esp, 8
test esi, esi
je 0x7a8107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x7a8102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.007ad946
add esp, 8
test eax, eax
je 0x7a80e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0x7a80e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.007ad946
add esp, 8
test eax, eax
jne 0x7a80c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0x7a8102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0x7a8f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x7bd9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x7a9002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.007acdff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x7a9002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.007a46e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.007ad20b
push 0x10
call fcn.007ad1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x7a8fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.007991c0
jmp 0x7a8fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.007a8b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x7a8ff0
mov ecx, edi
call fcn.007992c0
push edi
call fcn.007ad1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x7a9021
inc ebx
cmp ebx, 0x20
jb 0x7a8f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x7aa250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7be808
push 0x7ae288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x7aa329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x7aa329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.007ad1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x7aa329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x7aa329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x7aa32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.007aa351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7ab000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x7ab131
push esi
call fcn.007ae145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0079d080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x7ab131
push 0
push ebp
call fcn.0079d3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0079d260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x7ab08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0079d2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x7ab121
push 0x7c3918
push edi
call fcn.007ac3f0
push eax
push ebx
push esi
call fcn.007aaf60
push 0x7c38f8
push edi
call fcn.007ac3f0
push eax
push ebx
push esi
call fcn.007aaf60
push 0x7c38d8
push edi
call fcn.007ac3f0
push eax
push ebx
push esi
call fcn.007aaf60
push 0x7c38c0
push edi
call fcn.007ac3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.007aaf60
push 0x7c38a0
push edi
call fcn.007ac3f0
push eax
push ebx
push esi
call fcn.007aaf60
push 0x7c3888
push edi
call fcn.007ac3f0
push eax
push ebx
push esi
call fcn.007aaf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x7ac1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.007ac140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.007ac140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.007ac140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.007ac140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x7acbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7acc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x7be87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7acc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x7acc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x1001ea7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [0x1003014]
xor ebx, ebx
push 0x80000002
xor edi, edi
mov byte [ebp - 2], bl
mov byte [ebp - 1], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
cmp esi, ebx
jne 0x1001f18
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14c]
push eax
push edi
push dword [ebp - 0xc]
mov dword [ebp - 8], 0x12b
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, eax
inc edi
cmp esi, ebx
je 0x1001f39
cmp esi, 0x6f
je 0x1001ed8
cmp esi, 0xea
je 0x1001ed8
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x103
je 0x1001fd5
push esi
push 0x2728
push 2
call fcn.01001327
add esp, 0xc
jmp 0x1001fe8
cmp dword [ebp - 0x20], 1
jne 0x1001ed8
mov eax, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ebp + eax - 0x14c], bl
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.0100142e
test al, al
je 0x1001ed8
cmp dword [ebp + 8], ebx
mov esi, dword [ebp - 0x14]
mov al, 1
je 0x1001f87
cmp dword [ebp + 0xc], 0xffffffff
je 0x1001f87
cmp dword [ebp + 0xc], esi
je 0x1001f87
xor al, al
cmp dword [ebp + 0x10], ebx
je 0x1001f9c
cmp dword [ebp + 0x14], 0xffffffff
je 0x1001f9c
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x10]
je 0x1001f9c
xor al, al
cmp al, bl
je 0x1001ed8
cmp byte [ebp - 2], bl
jne 0x1001fbb
push 0x2727
push 1
call fcn.01001268
pop ecx
pop ecx
mov byte [ebp - 2], 1
push ebx
push dword [ebp - 0x18]
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push esi
call fcn.01001844
mov byte [ebp - 1], 1
jmp 0x1001ed8
cmp byte [ebp - 1], bl
jne 0x1001fe8
push 0x2729
push 1
call fcn.01001268
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x10027e8
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x1002811
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100280e
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x1002811
or eax, 0xffffffff
ret 4

Function at 0x1006a27
Capabilities:
Encode data using xor

Disassembly:
enter 0, 0
pushal
mov ebx, 0x7fffffff
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, esi
imul eax, edx, 0x10dcd
add eax, 0x116c5
xor edx, edx
div ebx
lodsd eax, dword [esi]
xor eax, edx
stosd dword es:[edi], eax
loop 0x1006a3c
popal
leave
ret 0xc

Function at 0x411104
Capabilities:
Terminate process

Disassembly:
jmp 0x42d5e0
jmp fcn.0042e740
cmp ecx, dword [0x43c3c4]
jne 0x42d5ea
repz ret
jmp 0x411447

Function at 0x411b36
Capabilities:
Create process memory minidump

Disassembly:
jmp 0x42ce74
jmp dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
Function at 0x40c360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40c36f
pop dword [ebp - 0x44]
mov eax, 0x40c36f
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x3b98169a
sub dword [ebp - 0x54], 0xed45d14f
mov dword [ebp - 0x50], 0xee1ee700
add dword [ebp - 0x50], 0x44146545
mov dword [ebp - 0x4c], 0x32b18d22
add dword [ebp - 0x4c], 0x199ab70c
mov dword [ebp - 0x48], 0x42ebf4e9
sub dword [ebp - 0x48], 0x42ebf4e9
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xfe81aaeb
add dword [ebp - 0x54], 0x75f0be6b
mov dword [ebp - 0x50], 0x9d7f082e
sub dword [ebp - 0x50], 0x5c12a6b9
mov dword [ebp - 0x4c], 0x8d4e0c6d
add dword [ebp - 0x4c], 0xd6215fff
mov dword [ebp - 0x48], 0x903bb431
sub dword [ebp - 0x48], 0x903bb431
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3e295
push 0
call eax
mov ecx, 0x40b17461
sub ecx, 0x40b11f73
mov esi, eax
mov edi, 0x41a000
add edi, dword [ebp - 0x44]
mov edx, 0x81941f08
sub dword [ebp - 0x30], edi
mov ebx, dword [edi]
add dword [ebp - 0xc], eax
add ebx, edx
xor dword [ebp - 0x2c], 0x456eeee1
mov dword [esi], ebx
sub dword [ebp - 0x18], eax
add esi, 0x9fd7fb39
add esi, 0x602804cb
add edi, 0x8cb9d861
add edi, 0x734627a3
loop 0x40c476
add eax, 0x2f762a33
sub eax, 0x2f74e3a8
mov ebx, eax
add eax, 0x3217e9f1
sub eax, 0x3217e9ec
mov ecx, 0x39bd5f63
add ecx, 0xc682a09d
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x410280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x41029c
mov dword [eax], ecx
jmp 0x41029e
mov eax, ecx
push ecx
push ecx
push esi
push 0x410310
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x1004605f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100870c0]
jne 0x10046069
repz ret
jmp fcn.1004ef8a

Function at 0x100490e6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x100490f5
pop dword [ebp - 0x34]
mov eax, 0x8e8993b6
sub eax, 0x7e8502c1
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x5dea5
push 0
mov eax, 0xbf9147a1
sub eax, 0xaf91367d
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x3f9ec4ca
add ecx, 0xc06193e0
xor esi, esi
add esi, eax
mov edx, 0xc91fd28d
add edx, 0x46ea3973
add edx, dword [ebp - 0x34]
mov ebx, 0xa6db3c41
add ebx, 0x91d87310
xor dword [ebp - 0x20], 0xf6dd04c6
mov edi, dword [edx]
sub dword [ebp - 0x14], 0x3445936c
sub edi, ebx
add dword [ebp - 0x18], 0x810e10a7
mov dword [esi], edi
add dword [ebp - 0x18], 0xabe7bd77
add esi, 4
add edx, 0xdc51f4c4
add edx, 0x23ae0b40
loop 0x10049156
add eax, 0x46fe52d8
add eax, 0xb90302a3
mov ebx, eax
add eax, 0x133ba5c4
add eax, 0xecc45a41
mov ecx, 0xff8fc0eb
add ecx, 0x10703f15
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x1004eda7
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10087268]
je 0x1004edc2
inc edi
cmp edi, 0x17
jb 0x1004edb3
cmp edi, 0x17
jae 0x1004ef42
push ebp
push 3
call fcn.10055799
cmp eax, 1
pop ecx
je 0x1004ef0e
push 3
call fcn.10055799
test eax, eax
pop ecx
jne 0x1004edf6
cmp dword [0x1008894c], 1
je 0x1004ef0e
cmp ebx, 0xfc
je 0x1004ef41
push 0x1000ae6c
mov ebx, 0x314
push ebx
mov ebp, 0x10088b00
push ebp
call fcn.1004bc25
add esp, 0xc
test eax, eax
je 0x1004ee2c
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push 0x104
mov esi, 0x10088b19
push esi
push 0
mov byte [0x10088c1d], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1004ee70
push 0x1000ae54
push 0x2fb
push esi
call fcn.1004bc25
add esp, 0xc
test eax, eax
je 0x1004ee70
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1004fb11
add esp, 0x14
push esi
call fcn.10055430
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1004eeb5
push esi
call fcn.10055430
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x10088e14
push 0x1000a540
sub ecx, eax
push ecx
push eax
call fcn.100490e6
add esp, 0x14
test eax, eax
je 0x1004eeb5
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
jmp 0x1004eeb7
xor esi, esi
push 0x1000ae50
push ebx
push ebp
call fcn.1004bbb4
add esp, 0xc
test eax, eax
je 0x1004eed7
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push dword [edi*8 + 0x1008726c]
push ebx
push ebp
call fcn.1004bbb4
add esp, 0xc
test eax, eax
je 0x1004eef9
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push 0x12010
push 0x1000ae28
push ebp
call fcn.100490e6
add esp, 0xc
jmp 0x1004ef41
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1004ef41
cmp ebp, 0xffffffff
je 0x1004ef41
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1008726c]
push dword [esi]
call fcn.10055430
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.kernel32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x404530
Capabilities:
Query or enumerate registry value

Disassembly:
call fcn.00404840
test eax, eax
je 0x4045a5
push str.NtQuerySystemInformation
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x456d7c], eax
jne 0x40455d
or eax, 0xffffffff
ret
push 0
push 0x2c
push 0x456d50
push 0
call eax
test eax, eax
je 0x404572
or eax, 0xffffffff
ret
mov dword [0x456d48], 0
mov dword [0x456d4c], 0
mov dword [0x456d40], 0
mov dword [0x456d44], 0
call fcn.00404710
mov eax, 1
ret
push 0x456d3c
push 0xf003f
push 0
push str.PerfStatsStartStat
push reloc.OLEAUT32.dll_SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4045c9
or eax, 0xffffffff
ret
mov eax, dword [0x456d3c]
push 0x456d38
push 0x456d30
push 0x456d34
push 0
push str.KERNELCPUUsage
push eax
mov dword [0x456d38], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [0x456d3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
ret

Function at 0x404610
Capabilities:
Query or enumerate registry value

Disassembly:
call fcn.00404840
test eax, eax
jne 0x404675
push 0x456d3c
push 0xf003f
push eax
push str.PerfStatsStopStat
push reloc.OLEAUT32.dll_SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40463c
or eax, 0xffffffff
ret
mov eax, dword [0x456d3c]
push 0x456d38
push 0x456d30
push 0x456d34
push 0
push str.KERNELCPUUsage
push eax
mov dword [0x456d38], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [0x456d3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
ret
Function at 0x409100
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x9ccc
call fcn.0041fa50
mov edx, dword [esp + 0x9cd0]
push ebx
push esi
push edi
mov al, byte [edx + 8]
xor ebx, ebx
mov cl, al
lea esi, [esp + 0xc]
and cl, 1
lea edi, [esp + 0x98]
or cl, 0xfa
mov dword [esp + 0xc], ebx
shl cl, 4
mov byte [esp + 0x15], cl
mov ecx, 8
mov byte [esp + 0x10], 0x42
mov byte [esp + 0x11], 0x80
mov byte [esp + 0x12], bl
mov byte [esp + 0x13], bl
mov byte [esp + 0x14], bl
mov byte [esp + 0x16], 0xec
mov byte [esp + 0x18], al
lea eax, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
push ebx
push eax
lea ecx, [esp + 0x4ec0]
push 0x4e20
push ecx
mov ecx, dword [edx]
lea eax, [esp + 0xa8]
push 0x4e20
push eax
push 0x7c088
push ecx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edx, dword [esp + 0x11]
test eax, eax
mov eax, dword [esp + 0x10]
setne bl
and edx, 0xff
and eax, 0xff
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x40]
push str.error:__d__d__d
push ecx
call fcn.0041f5b7
add esp, 0x14
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0x9ccc
ret
Function at 0x4135d0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x110
lea eax, [esp]
push esi
lea ecx, [esp + 0xc]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.Software
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea edx, [esp + 4]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 8]
push edx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.MicrosoftWindowsCurrentVersionRun
push ecx
call esi
lea edx, [esp + 0x10]
push 0x104
push edx
push 0
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x10]
push 0x104
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov eax, dword [esp + 4]
test eax, eax
jne 0x413683
push edi
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x14]
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x1c]
push str.HD_Tune
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esp + 8], eax
pop edi
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
mov eax, dword [esp + 4]
pop esi
test eax, eax
sete al
add esp, 0x110
ret

Function at 0x4136b0
Capabilities:
Delete registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
push eax
push 0x20019
push 0
push str.Software
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov edx, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
push 0xf003f
push 0
push str.MicrosoftWindowsCurrentVersionRun
push edx
call esi
mov esi, eax
test esi, esi
jne 0x413703
mov eax, dword [esp + 8]
push str.HD_Tune
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
mov ecx, dword [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call edi
test esi, esi
pop edi
pop esi
sete al
add esp, 8
ret

Function at 0x414380
Capabilities:
Link many functions at runtime

Disassembly:
mov ecx, 0x4572e8
jmp 0x414380
push esi
mov esi, ecx
push str.uxtheme.dll
mov dword [esi + 0x14], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x14], eax
je 0x4143ea
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IsThemeActive
push eax
call edi
mov dword [esi], eax
mov eax, dword [esi + 0x14]
push str.OpenThemeData
push eax
call edi
mov ecx, dword [esi + 0x14]
push str.CloseThemeData
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi + 0x14]
push str.GetThemeBackgroundContentRect
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x14]
push str.DrawThemeBackground
push eax
call edi
mov dword [esi + 0x10], eax
mov eax, esi
pop edi
pop esi
ret
mov eax, esi
pop esi
ret
Function at 0x42699d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x455f20
cmp edx, dword [eax]
je 0x4269bf
add eax, 8
inc ecx
cmp eax, 0x455fb0
jl 0x4269b0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x455f20]
jne 0x426aed
mov eax, dword [0x4593d4]
cmp eax, 1
je 0x426ac7
test eax, eax
jne 0x4269f0
cmp dword [0x45567c], 1
je 0x426ac7
cmp edx, 0xfc
je 0x426aed
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x426a27
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00426fe0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00425740
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x426a6a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00425740
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x448ba4
push edi
call fcn.00420060
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00426fe0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00426ff0
lea eax, [ebp - 0xa0]
push 0x448b84
push eax
call fcn.00426ff0
push dword [esi + 0x455f24]
lea eax, [ebp - 0xa0]
push eax
call fcn.00426ff0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00429a3d
add esp, 0x2c
pop edi
jmp 0x426aed
lea eax, [ebp + 8]
lea esi, [esi + 0x455f24]
push 0
push eax
push dword [esi]
call fcn.00425740
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret