joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422360
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1004
push eax
mov eax, dword [ecx + 4]
push 4
push 0
push dword [ebp + 8]
push dword [ecx + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret 8

Function at 0x4224b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 0x10]
mov dword [ebp - 4], 1
push eax
push dword [ebp + 0xc]
mov esi, ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov eax, dword [esi + 4]
push dword [esi + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x422503
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
mov eax, dword [esi + 4]
push dword [ebp + 8]
push dword [esi + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x422503
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x422660
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, edx
push esi
push edi
mov esi, ecx
lea edi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x422670
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
mov eax, dword [esi + 4]
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
pop edi
sbb eax, eax
inc eax
pop esi
pop ebp
ret 8

Function at 0x422710
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
push dword [ebp + 8]
push dword [ecx + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
sbb eax, eax
inc eax
pop ebp
ret 4

Function at 0x426670
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov ebx, ecx
test edi, edi
je 0x4266a4
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043d001
mov esi, eax
add esp, 4
xor eax, eax
mov word [esi], ax
push edi
push esi
push dword [ebx + 0x48]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jns 0x4266b8
or edi, 0xffffffff
jmp 0x4266d1
mov edx, dword [ebp + 8]
test esi, esi
mov ecx, 0x479dc8
cmovne ecx, esi
push ecx
push edi
call fcn.00421bb0
add esp, 8
mov edi, eax
test esi, esi
je 0x4266de
push esi
call fcn.0043cb54
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x426db0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45c3f6
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x48106c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x220], 0
lea eax, [ebp - 0x220]
mov dword [ebp - 4], 0
push eax
push 0x45d2ec
push 1
push 0
push 0x45d31c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x426e18
xor esi, esi
jmp 0x426ed6
mov eax, dword [ebp - 0x220]
push edi
push eax
mov edx, dword [eax]
call dword [edx + 0x50]
push ecx
lea edx, [ebp - 0x21c]
mov ecx, edi
call fcn.00426f80
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
add esp, 4
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x24]
mov dword [ebp - 0x224], 0
mov byte [ebp - 4], 4
lea edx, [ebp - 0x224]
mov eax, dword [ebp - 0x220]
push edx
push 0x45d30c
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x426eb6
mov eax, dword [ebp - 0x224]
push 1
push esi
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
test eax, eax
js 0x426eb6
push ecx
lea edx, [ebp - 0x21c]
mov ecx, esi
call fcn.00426f80
add esp, 4
lea eax, [ebp - 0x21c]
push 0
push eax
push 0x1005
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov esi, 1
jmp 0x426eb8
xor esi, esi
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x426ed6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x224], 0
mov dword [ebp - 4], 0xa
mov ecx, dword [ebp - 0x220]
test ecx, ecx
je 0x426eed
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043c755
mov esp, ebp
pop ebp
ret

Function at 0x426f10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x48106c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x426f40
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c755
mov esp, ebp
pop ebp
ret
push ecx
lea edx, [ebp - 0x20c]
mov ecx, esi
call fcn.00426f80
add esp, 4
lea eax, [ebp - 0x20c]
push 0
push eax
push 0x1005
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.0043c755
mov esp, ebp
pop ebp
ret

Function at 0x427040
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x427056
mov eax, 1
pop esi
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
ret
Function at 0x427220
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x48106c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov eax, ecx
mov ebx, 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, 9
mov dword [ebp - 0x420], eax
mov edx, 0x475688
push esi
push eax
test esi, esi
mov eax, 0x475668
cmovne eax, edx
push eax
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.0041fb80
add esp, 0x14
lea eax, [esi + 1]
push eax
push dword [ebp - 0x420]
lea eax, [ebp - 0x41c]
push 0x47567c
push 0x104
push eax
call fcn.0041fb80
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4272d0
push 1
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
call edi
test eax, eax
je 0x4272ce
push 4
push 0
lea eax, [ebp - 0x41c]
push eax
call edi
jmp 0x4272d0
xor ebx, ebx
sub esi, 1
mov eax, dword [ebp - 0x420]
mov edx, 0x475688
jns 0x427253
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c755
mov esp, ebp
pop ebp
ret

Function at 0x427300
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x48106c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
mov edi, 1
mov esi, 0xa
push esi
push ebx
push 0x4756c0
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0041fb80
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x427362
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
and edi, eax
dec esi
test esi, esi
jg 0x427322
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043c755
mov esp, ebp
pop ebp
ret
Function at 0x427380
Capabilities:
Get file size
Read file via mapping
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45c430
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x48106c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
push ecx
push 0
push 3
push ecx
push 1
mov edx, 0x80000000
call fcn.0041dd80
add esp, 0x14
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
cmp eax, 0xffffffff
jne 0x4273f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x475694
call fcn.0041d110
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, edi
mov ebx, eax
call fcn.00427300
push ecx
push 0x80
push 2
push ecx
push 0
mov edx, 0x40000000
mov ecx, edi
call fcn.0041dd80
add esp, 0x14
mov esi, eax
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
jne 0x42748d
push ecx
mov ecx, edi
call fcn.00427220
mov eax, dword [ebp + 8]
add esp, 4
test eax, eax
je 0x427448
mov dword [eax], 1
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, 0xffffffff
jne 0x42748d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x4756e0
call fcn.0041d110
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
xor ebx, ebx
jmp 0x42754b
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x427523
cmp edi, 0xffffffff
je 0x427523
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x427511
cmp eax, 0xffffffff
je 0x427511
push 0
lea ecx, [ebp - 0x18]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x427511
cmp ebx, dword [ebp - 0x18]
jne 0x427511
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x42750a
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov ebx, 1
jmp 0x427513
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x427525
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x427525
xor ebx, ebx
test edi, edi
je 0x427539
cmp edi, 0xffffffff
je 0x427539
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x42753f
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x42754b
cmp esi, 0xffffffff
je 0x42754b
push esi
call edi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x427555
push eax
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427680
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45c4a1
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x48106c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x27c], ecx
push 0x208
lea eax, [ebp - 0x260]
push 0
push eax
call fcn.0043ffb0
add esp, 0xc
lea eax, [ebp - 0x260]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x264], esi
mov dword [ebp - 4], 0
cmp esi, 0xffffffff
jne 0x427715
xor eax, eax
jmp 0x427873
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
mov dword [ebp - 0x280], edi
mov byte [ebp - 4], 1
test edi, edi
je 0x4278b7
cmp edi, 0xffffffff
je 0x4278b7
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x284], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x427841
cmp esi, 0xffffffff
je 0x427841
push 0x48
lea eax, [ebp - 0x58]
push 0x3d
push eax
call fcn.0043ffb0
add esp, 0xc
mov byte [ebp - 0x11], 0xa
mov byte [ebp - 0x58], 0xa
push 0
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor edx, edx
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x268], edx
lea ebx, [eax - 0x48]
mov dword [ebp - 0x270], ebx
test ebx, ebx
je 0x427841
lea eax, [edx + esi]
lea ecx, [esi + 0x47]
mov dword [ebp - 0x274], eax
add ecx, edx
cmp byte [eax], 0xa
mov dword [ebp - 0x26c], ecx
jne 0x427821
mov cl, byte [ecx]
cmp cl, 0xa
jne 0x427817
mov ecx, eax
lea edx, [ebp - 0x58]
mov ebx, 0x44
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x427804
add ecx, 4
add edx, 4
sub ebx, 4
jae 0x4277e0
mov eax, dword [ebp - 0x26c]
cmp dword [eax + 1], 0x3a325049
je 0x42788f
mov edx, dword [ebp - 0x268]
mov eax, 0x47
mov ebx, dword [ebp - 0x270]
jmp 0x427831
mov eax, 0x48
cmp cl, 0x3d
jmp 0x427829
cmp byte [ecx], 0x3d
mov eax, 0x47
mov ecx, 1
cmove eax, ecx
add edx, eax
mov dword [ebp - 0x268], edx
cmp edx, ebx
jb 0x4277b4
xor ebx, ebx
test esi, esi
je 0x42784e
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [ebp - 0x264]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x42786a
cmp edi, 0xffffffff
je 0x42786a
push edi
call eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x427871
push esi
call eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c755
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x274]
mov ebx, dword [ebp - 0x278]
add eax, 0x48
mov ecx, dword [ebp - 0x27c]
sub ebx, eax
add ebx, esi
push ebx
push eax
call fcn.00423340
cmp eax, ebx
sbb ebx, ebx
neg ebx
jmp 0x427843
xor ebx, ebx
jmp 0x427854
Function at 0x428f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
mov dword [esp + 0xc], eax
lea ebx, [ecx + 8]
mov eax, dword [ebp + 0xc]
push esi
mov esi, edx
mov dword [esp + 0x14], eax
mov eax, esi
mov dword [esp + 0x18], edx
sub eax, ecx
mov dword [esp + 0x1c], ebx
push edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x24], 4
nop word [eax + eax]
movq xmm0, qword [eax + ebx]
mov eax, dword [ebx + 4]
mov edi, dword [ebx - 8]
mov ecx, dword [ebx]
movq qword [esp + 0x30], xmm0
xor eax, dword [esp + 0x34]
xor ecx, dword [esp + 0x30]
movq xmm0, qword [esi]
mov dword [esp + 0x10], eax
mov eax, dword [ebx - 4]
movq qword [esp + 0x28], xmm0
xor eax, dword [esp + 0x2c]
xor edi, dword [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, edi
mul ecx
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 0xc]
mul ecx
mov ecx, eax
mov dword [esp + 0x28], edx
mov eax, edi
mul dword [esp + 0x10]
add eax, esi
mov edi, edx
mov esi, dword [esp + 0x1c]
adc edi, 0
add eax, ecx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xc]
adc edi, 0
mul dword [esp + 0x10]
xor ecx, ecx
or ecx, ebx
mov ebx, dword [esp + 0x20]
add eax, edi
mov edi, dword [esp + 0x14]
adc edx, 0
add eax, dword [esp + 0x28]
adc edx, 0
xor ecx, eax
mov eax, dword [esp + 0x30]
xor eax, edx
mov edx, dword [esp + 0x18]
add edi, ecx
mov dword [esp + 0x14], edi
adc edx, eax
mov eax, dword [esp + 0x3c]
add esi, 0x10
mov dword [esp + 0x18], edx
add ebx, 0x10
mov dword [esp + 0x1c], esi
sub dword [esp + 0x24], 1
mov dword [esp + 0x20], ebx
jne 0x428f80
push 0x16566791
mov ecx, edx
xor eax, eax
push 0x9e3779f9
shr ecx, 5
xor eax, edx
xor ecx, edi
push eax
push ecx
call fcn.0043d380
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4387f0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00438570

Function at 0x439420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00439100

Function at 0x453274
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x453281
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x3c]
push ebx
push ebp
push edi
mov ebx, dword [eax + esi + 0x78]
xor edi, edi
add ebx, esi
mov ebp, dword [ebx + 0x20]
add ebp, esi
cmp dword [ebx + 0x18], edi
jbe 0x4532b5
mov eax, dword [ebp + edi*4]
push dword [esp + 0x18]
add eax, esi
push eax
call fcn.00453310
pop ecx
pop ecx
test al, al
jne 0x4532bc
inc edi
cmp edi, dword [ebx + 0x18]
jb 0x453299
xor eax, eax
pop edi
pop ebp
pop ebx
pop esi
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x4532b7

Function at 0x4532d3
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, dword [eax + 0xc]
add esi, 0xc
mov esi, dword [esi]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x4532e5
test edi, edi
je 0x4532f4
mov dword [edi], eax
cmp dword [esp + 0xc], 0
je 0x45330a
push dword [esi + 0x30]
call fcn.0045338a
pop ecx
cmp dword [esp + 0xc], eax
jne 0x4532e5
mov eax, dword [esi + 0x18]
Function at 0x4533b6
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
xor ebp, ebp
push eax
push ebp
mov dword [esp + 0x18], ebp
call fcn.004532d3
push ebp
push dword [0x4818ac]
mov ebx, eax
call fcn.004532d3
mov esi, dword [0x481898]
add esp, 0x10
mov edi, eax
cmp dword [esi], ebp
je 0x453418
push dword [esp + 0x10]
call fcn.00453337
pop ecx
cmp al, byte [esi]
je 0x453404
cmp al, byte [esi + 1]
je 0x453404
push ebp
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [esp + 0x10]
call fcn.0045336b
pop ecx
cmp eax, dword [esi + 4]
je 0x453418
cmp eax, dword [esi + 8]
jne 0x4533fd
push dword [0x4818b4]
mov dword [esp + 0x18], ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov edx, ebp
cmp dword [0x4818c0], ebp
jbe 0x453457
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
mov dword [edx + esi], ecx
mov eax, dword [0x481884]
add edx, eax
cmp edx, dword [0x4818c0]
jb 0x45343c
push esi
push edi
call fcn.00453274
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4533fd
mov esi, dword [0x48189c]
lea eax, [esp + 0x14]
push eax
push dword [0x4818c0]
push dword [0x481888]
push esi
call edi
mov edx, dword [0x4818c4]
add edx, ebx
push 8
pop ecx
mov ebx, dword [edx + 4]
cmp dword [0x481888], ecx
jbe 0x4534ad
mov eax, dword [edx + ecx]
add eax, ebx
mov dword [esi + ecx], eax
mov eax, dword [0x481884]
add ecx, eax
cmp ecx, dword [0x481888]
jb 0x453496
mov eax, dword [0x4818b8]
mov dword [esi + 8], eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push dword [0x481888]
push esi
call edi
mov eax, dword [0x4818bc]
mov ecx, dword [esi + 0xc]
add ecx, eax
mov eax, dword [0x4818bc]
add ecx, esi
add esi, eax
push esi
call ecx
pop ecx
jmp 0x4533fd
Function at 0x453441
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
xor ebp, ebp
push eax
push ebp
mov dword [esp + 0x18], ebp
call fcn.004532d3
push ebp
push dword [0x4818ac]
mov ebx, eax
call fcn.004532d3
mov esi, dword [0x481898]
add esp, 0x10
mov edi, eax
cmp dword [esi], ebp
je 0x453418
push dword [esp + 0x10]
call fcn.00453337
pop ecx
cmp al, byte [esi]
je 0x453404
cmp al, byte [esi + 1]
je 0x453404
push ebp
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [esp + 0x10]
call fcn.0045336b
pop ecx
cmp eax, dword [esi + 4]
je 0x453418
cmp eax, dword [esi + 8]
jne 0x4533fd
push dword [0x4818b4]
mov dword [esp + 0x18], ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov edx, ebp
cmp dword [0x4818c0], ebp
jbe 0x453457
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
mov dword [edx + esi], ecx
mov eax, dword [0x481884]
add edx, eax
cmp edx, dword [0x4818c0]
jb 0x45343c
push esi
push edi
call fcn.00453274
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4533fd
mov esi, dword [0x48189c]
lea eax, [esp + 0x14]
push eax
push dword [0x4818c0]
push dword [0x481888]
push esi
call edi
mov edx, dword [0x4818c4]
add edx, ebx
push 8
pop ecx
mov ebx, dword [edx + 4]
cmp dword [0x481888], ecx
jbe 0x4534ad
mov eax, dword [edx + ecx]
add eax, ebx
mov dword [esi + ecx], eax
mov eax, dword [0x481884]
add ecx, eax
cmp ecx, dword [0x481888]
jb 0x453496
mov eax, dword [0x4818b8]
mov dword [esi + 8], eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push dword [0x481888]
push esi
call edi
mov eax, dword [0x4818bc]
mov ecx, dword [esi + 0xc]
add ecx, eax
mov eax, dword [0x4818bc]
add ecx, esi
add esi, eax
push esi
call ecx
pop ecx
jmp 0x4533fd
Function at 0x401445
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
mov eax, dword [0x40b0cc]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x228]
lea ecx, [esp]
push ebp
mov ebp, dword [esp + 0x228]
and eax, 0x300
push esi
mov esi, dword [esp + 0x230]
push edi
mov edi, dword [esp + 0x22c]
and esi, 1
push ecx
mov dword [esp + 0x18], eax
or eax, 9
push eax
push ebp
push edi
call fcn.00406785
test eax, eax
jne 0x401554
xor ecx, ecx
test byte [esp + 0x234], 2
je 0x4014cd
push ecx
push ecx
push ecx
push ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ecx
push eax
lea eax, [esp + 0x2c]
push eax
push ecx
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x401531
xor ecx, ecx
push 0x105
lea eax, [esp + 0x1c]
push eax
push ecx
jmp 0x401502
test esi, esi
jne 0x401531
push dword [esp + 0x234]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
call fcn.00401445
test eax, eax
jne 0x401510
push 0x105
lea eax, [esp + 0x1c]
push eax
push esi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4014da
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406dcf
mov esi, eax
test esi, esi
jne 0x401542
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x401554
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x401554
push 0
push dword [esp + 0x18]
mov ecx, esi
push ebp
push edi
call dword [0x4092c8]
call esi
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040818f
add esp, 0x21c
ret 0xc