joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4022f0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x214
mov eax, dword [0x42a0d4]
xor eax, esp
mov dword [esp + 0x210], eax
push ebp
mov ebp, dword [esp + 0x21c]
push esi
mov esi, ecx
push ebp
push str.STS:__s_n
mov dword [esp + 0x1c], esi
call fcn.0040669e
mov ecx, dword [esi + 0x310]
add esp, 8
neg ecx
sbb ecx, ecx
lea eax, [esp + 8]
push eax
and ecx, 0x100
add ecx, 0x20019
push ecx
push 0
push ebp
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402470
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea edx, [esp + 0x28]
push edx
push eax
push eax
push eax
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x402470
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40238a
push ebp
mov ecx, esi
call fcn.00402290
jmp 0x40246e
push ebx
xor ebx, ebx
test eax, eax
jbe 0x402462
push edi
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x134]
push edx
push ebx
push eax
mov dword [esp + 0x38], 0x100
mov byte [esp + 0x140], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x402461
lea edx, [esp + 0x20]
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x4023d7
lea edi, [esp + 0x20]
add edi, 0xffffffff
lea ebx, [ebx]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x4023f0
mov cx, word [0x4254b4]
lea eax, [esp + 0x120]
mov word [edi], cx
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402410
lea edi, [esp + 0x20]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x402422
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.004022f0
push ebp
mov ecx, esi
call fcn.00402290
add ebx, 1
cmp ebx, dword [esp + 0x14]
jb 0x402396
pop edi
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
xor eax, eax
mov ecx, dword [esp + 0x218]
pop esi
pop ebp
xor ecx, esp
call fcn.00405d7a
add esp, 0x214
ret 4
Function at 0x4024ad
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x218
mov eax, dword [0x42a0d4]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
mov ebx, dword [esp + 0x224]
push ebp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x310]
xor ebp, ebp
neg ecx
push edi
mov edi, dword [esp + 0x22c]
sbb ecx, ecx
lea eax, [esp + 0x14]
push eax
and ecx, 0x100
add ecx, 0x20019
push ecx
push ebp
push edi
push 0x80000002
mov dword [esp + 0x24], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
je 0x402504
push eax
push edi
push str.cant_open_key__s_result0x_x_n
call fcn.0040669e
add esp, 0xc
mov eax, 1
jmp 0x402618
push 0x100
lea eax, [esi + 0x204]
push ebp
push eax
call fcn.00407330
add esp, 0xc
mov eax, dword [esp + 0x14]
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
lea edx, [esp + 0x34]
push edx
push ebp
push ebp
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ecx, dword [esp + 0x18]
cmp ecx, ebp
mov dword [esp + 0x20], ecx
je 0x402600
cmp eax, ebp
jne 0x402600
test ecx, ecx
jbe 0x402600
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x38]
push edx
push ebp
push eax
mov dword [esp + 0x3c], 0x100
mov byte [esp + 0x44], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x402600
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402587
sub eax, edx
push eax
lea ecx, [esp + 0x28]
push ebx
push ecx
call fcn.00406642
add esp, 0xc
test eax, eax
jne 0x4025f3
lea edx, [esp + 0x24]
push edx
push edi
lea eax, [esp + 0x12c]
push str._s_s0000Device_Parameters
push eax
call fcn.00407192
add esp, 0x10
lea ecx, [esp + 0x24]
push ecx
push str.PortName
lea edx, [esp + 0x12c]
push edx
mov ecx, esi
call fcn.00401e60
lea eax, [esp + 0x27]
push eax
call fcn.00405db4
add esp, 4
add dword [esp + 0x10], 1
mov byte [eax + esi + 0x203], 1
add ebp, 1
cmp ebp, dword [esp + 0x18]
jb 0x402553
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x20]
xor eax, eax
cmp dword [esp + 0x10], edx
sete al
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405d7a
add esp, 0x218
ret 8
Function at 0x402cc0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x42a0d4]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x118]
push ebx
push ebp
mov ebp, dword [esp + 0x124]
push esi
mov ebx, ecx
mov ecx, dword [esp + 0x120]
lea esi, [esp + 0x18]
push edi
sub esi, ecx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
add ecx, 1
test dl, dl
jne 0x402cf5
lea edi, [esp + 0x1c]
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x402d08
mov cx, word [0x4254b4]
mov word [edi], cx
mov ecx, eax
mov edi, edi
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x402d20
lea edi, [esp + 0x1c]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x402d34
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebx + 0x310]
and ecx, 3
neg eax
sbb eax, eax
lea edx, [esp + 0x10]
push edx
and eax, 0x100
add eax, 0x20019
push eax
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [esp + 0x28]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402dd7
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x20], al
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push str.Driver
push edx
mov dword [esp + 0x2c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x402dd7
lea eax, [esp + 0x1c]
mov edx, ebp
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x402dc4
mov eax, 1
jmp 0x402dd9
xor eax, eax
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405d7a
add esp, 0x110
ret 0xc
Function at 0x402e00
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x24c
mov eax, dword [0x42a0d4]
xor eax, esp
mov dword [esp + 0x248], eax
mov eax, dword [esp + 0x250]
push ebp
push esi
lea edx, [esp + 0x148]
push edi
mov ebp, ecx
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x402e30
lea edi, [esp + 0x14c]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x402e46
mov ax, word [0x4254b4]
mov word [edi], ax
lea eax, [esp + 0x14c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402e63
sub eax, edx
lea edi, [esp + 0x14c]
mov esi, eax
add edi, 0xffffffff
lea ebx, [ebx]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x402e80
mov ecx, dword [0x4256ec]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x150]
push eax
mov dword [edi], ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x402ef3
lea ecx, [esp + 0x38]
sub esi, ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea esi, [esp + esi + 0x150]
lea eax, [esp + 0x3c]
mov cl, byte [eax]
mov byte [esi + eax], cl
add eax, 1
test cl, cl
jne 0x402ec4
lea edx, [esp + 0x150]
push edx
mov ecx, ebp
call fcn.00401fc0
lea eax, [esp + 0x10]
push eax
push edi
call ebx
test eax, eax
jne 0x402ec0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.00405d7a
add esp, 0x24c
ret 4

Function at 0x402f60
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
mov eax, dword [0x42a0d4]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
mov ebp, dword [esp + 0x11c]
push edi
mov edi, ecx
mov ecx, dword [edi + 0x310]
neg ecx
sbb ecx, ecx
lea eax, [esp + 0xc]
push eax
and ecx, 0x100
add ecx, 0xf003f
push ecx
push 0
push ebp
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403045
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea edx, [esp + 0x2c]
push edx
push eax
push eax
push eax
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x40303a
test eax, eax
jne 0x40303a
push esi
xor esi, esi
test ecx, ecx
jbe 0x40302c
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x30]
push edx
push esi
push eax
mov dword [esp + 0x38], 0x100
mov byte [esp + 0x3c], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40302c
push ebx
lea ecx, [esp + 0x20]
push ecx
push ebp
mov ecx, edi
call fcn.00401c80
add esi, 1
cmp esi, dword [esp + 0x14]
jb 0x402fe6
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
jmp 0x403045
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x118]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405d7a
add esp, 0x110
ret 8
Function at 0x403060
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x104
mov eax, dword [0x42a0d4]
xor eax, esp
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x108]
push ebx
lea edx, [esp + 4]
push esi
mov esi, dword [esp + 0x114]
mov ebx, ecx
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x403090
mov eax, esi
mov edx, esi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4030a0
push edi
lea edi, [esp + 0xc]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x4030b3
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0xc]
push eax
and ecx, 3
push str.DELETING__s_n
rep movsb byte es:[edi], byte [esi]
call fcn.0040669e
add esp, 8
cmp dword [ebx + 0x304], 0
pop edi
je 0x403131
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
lea ecx, [esp + 8]
push ecx
push 0x80000002
call esi
test eax, eax
je 0x403131
lea edx, [esp + 8]
push edx
mov ecx, ebx
call fcn.004022f0
lea eax, [esp + 8]
push eax
push 0x80000002
call esi
mov esi, eax
test esi, esi
je 0x403131
lea ecx, [esp + 8]
push ecx
push str.cant_delete_key__s_n
call fcn.0040669e
add esp, 8
mov eax, esi
jmp 0x403133
xor eax, eax
mov ecx, dword [esp + 0x108]
pop esi
pop ebx
xor ecx, esp
call fcn.00405d7a
add esp, 0x104
ret 8

Function at 0x403730
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x214
mov eax, dword [0x42a0d4]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [esp + 0x21c]
push ebp
mov ebp, dword [esp + 0x21c]
push esi
mov esi, ecx
mov edx, dword [esi + 0x310]
neg edx
sbb edx, edx
lea ecx, [esp + 8]
push ecx
and edx, 0x100
add edx, 0x20019
push edx
push 0
push ebp
push 0x80000002
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40383a
push eax
mov ecx, dword [esp + 0xc]
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x40382f
test eax, eax
jne 0x40382f
push edi
xor edi, edi
test ecx, ecx
jbe 0x40382e
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x34]
push eax
push edi
push ecx
mov dword [esp + 0x38], 0x100
mov byte [esp + 0x40], 0
call ebx
test eax, eax
jne 0x40382d
lea edx, [esp + 0x120]
push edx
lea eax, [esp + 0x24]
push eax
push ebp
mov ecx, esi
call fcn.00402cc0
test eax, eax
je 0x403824
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x120]
push ecx
push edx
mov ecx, esi
call fcn.00403060
cmp dword [esi + 0x304], 0
jne 0x40382d
add edi, 1
cmp edi, dword [esp + 0x14]
jb 0x4037c3
pop ebx
pop edi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x218]
pop esi
pop ebp
xor ecx, esp
call fcn.00405d7a
add esp, 0x214
ret 8
Function at 0x403a40
Capabilities:
Delete directory
Get common file path

Disassembly:
sub esp, 0x2d8
mov eax, dword [0x42a0d4]
xor eax, esp
mov dword [esp + 0x2d4], eax
push esi
mov esi, dword [esp + 0x2e0]
push edi
push 0x104
lea eax, [esp + 0x1d8]
push eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + 0x1d4]
add edi, 0xffffffff
mov edi, edi
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x403a80
mov cx, word [0x4254b4]
lea eax, [esp + 0x1d4]
mov word [edi], cx
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x403aa0
mov edx, dword [str.SYSTEM32DRVSTORE_]
mov ecx, dword [0x425774]
mov dword [eax], edx
mov edx, dword [0x425778]
mov dword [eax + 4], ecx
mov ecx, dword [0x42577c]
mov dword [eax + 8], edx
mov dx, word [0x425780]
mov dword [eax + 0xc], ecx
mov cl, byte [0x425782]
mov word [eax + 0x10], dx
mov byte [eax + 0x12], cl
lea eax, [esp + 0x1d4]
lea edx, [eax + 1]
jmp 0x403af0
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403af0
sub eax, edx
cmp byte [esi], cl
je 0x403c78
lea edx, [esp + eax + 0x1d4]
mov dword [esp + 8], edx
push ebp
nop
push 0x2c
push esi
call fcn.00406320
add esp, 8
test eax, eax
mov dword [esp + 0x10], eax
je 0x403b26
mov byte [eax], 0
lea edx, [esp + 0x158]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x403b31
lea eax, [esp + 0x158]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403b47
sub eax, edx
cmp eax, 0xa
jbe 0x403b5e
mov byte [esp + 0x162], cl
lea edi, [esp + 0x158]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x403b68
mov ax, word [0x42576c]
mov ecx, dword [esp + 0xc]
mov word [edi], ax
lea eax, [esp + 0x158]
mov byte [ecx], 0
mov ecx, eax
jmp 0x403b90
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x403b90
lea edi, [esp + 0x1d8]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x403ba7
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x1dc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x403c48
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x44]
mov byte [ecx], 0
mov ecx, eax
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x403be6
lea edi, [esp + 0x1d8]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
lea ecx, [ecx]
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x403c00
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea edx, [esp + 0x1d8]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
push edx
call fcn.00402e00
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x1d8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x403c48
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x10]
test esi, esi
je 0x403c5c
add esi, 1
cmp byte [esi], 0
jne 0x403b10
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x2dc]
pop edi
pop esi
xor ecx, esp
call fcn.00405d7a
add esp, 0x2d8
ret 4
xor eax, eax
jmp 0x403c5f
Function at 0x403c80
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x42a0d4]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push ebp
mov ebp, dword [esp + 0x12c]
push esi
mov esi, dword [esp + 0x12c]
push edi
mov edi, ecx
mov ecx, dword [edi + 0x310]
xor ebx, ebx
neg ecx
sbb ecx, ecx
lea eax, [esp + 0x14]
push eax
and ecx, 0x100
add ecx, 0x20019
push ecx
push ebx
push esi
push 0x80000002
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x403d00
push eax
push esi
push str.cant_open_key__s_result0x_x_n
call fcn.0040669e
add esp, 0xc
mov eax, 1
jmp 0x403dd5
mov eax, dword [esp + 0x14]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x38]
push edx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [esp + 0x10], ebx
mov ecx, dword [esp + 0x1c]
jge 0x403d28
mov dword [esp + 0x10], ecx
cmp ecx, ebx
je 0x403dbd
cmp eax, ebx
jne 0x403dbd
xor esi, esi
cmp ecx, ebx
jbe 0x403dbd
mov edi, edi
mov eax, dword [esp + 0x14]
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x3c]
push edx
push esi
push eax
mov dword [esp + 0x44], 0x100
mov byte [esp + 0x48], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x403dbd
mov eax, ebp
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x403d70
sub eax, edx
push eax
lea ecx, [esp + 0x2c]
push ebp
push ecx
call fcn.00406642
add esp, 0xc
test eax, eax
jne 0x403db4
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x28]
push edx
push eax
mov ecx, edi
call fcn.00403060
test eax, eax
jne 0x403dbd
add dword [esp + 0x18], 1
cmp dword [edi + 0x304], ebx
jne 0x403d00
add esi, 1
cmp esi, dword [esp + 0x1c]
jb 0x403d40
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x10]
xor eax, eax
cmp dword [esp + 0x18], edx
sete al
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405d7a
add esp, 0x11c
ret 8
Function at 0x403f9b
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x114
mov eax, dword [0x42a0d4]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x120]
push ebx
mov ebx, dword [esp + 0x120]
push ebp
mov ebp, dword [esp + 0x120]
push esi
mov esi, ecx
mov edx, dword [esi + 0x310]
neg edx
sbb edx, edx
lea ecx, [esp + 0xc]
push ecx
and edx, 0x100
add edx, 0xf003f
push edx
push 0
push ebp
push 0x80000002
mov dword [esp + 0x2c], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404085
push edi
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x404079
test eax, eax
jne 0x404079
xor edi, edi
test ecx, ecx
jbe 0x404079
jmp 0x404010
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x34]
push eax
push edi
push ecx
mov dword [esp + 0x38], 0x100
mov byte [esp + 0x40], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x404079
mov edx, dword [esp + 0x1c]
push edx
push ebx
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.00401b40
test eax, eax
je 0x404070
lea ecx, [esp + 0x20]
push ecx
push ebp
mov ecx, esi
call fcn.00403060
cmp dword [esi + 0x304], 0
jne 0x403fd5
add edi, 1
cmp edi, dword [esp + 0x14]
jb 0x404010
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [esp + 0x11c]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405d7a
add esp, 0x114
ret 0xc

Function at 0x405d7a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a0d4]
jne 0x405d84
repz ret
jmp fcn.00408188
Function at 0x416f13
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040a0f4
xor ebx, ebx
cmp dword [0x42bd98], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x416fe8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x416f53
xor eax, eax
jmp 0x4170ac
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x416f4c
push eax
call fcn.0040a091
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42bd98], eax
call esi
push eax
call fcn.0040a091
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42bd9c], eax
call esi
push eax
call fcn.0040a091
mov dword [0x42bda0], eax
lea eax, [ebp - 8]
push eax
call fcn.0040ef79
test eax, eax
pop ecx
pop ecx
je 0x416fb6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040c5ab
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x416fe8
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040a091
cmp eax, ebx
pop ecx
mov dword [0x42bda8], eax
je 0x416fe8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040a091
pop ecx
mov dword [0x42bda4], eax
mov eax, dword [0x42bda4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x417061
cmp dword [0x42bda8], esi
je 0x417061
push eax
call fcn.0040a0fd
pop ecx
call eax
cmp eax, ebx
je 0x41702e
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x42bda8]
call fcn.0040a0fd
pop ecx
call eax
test eax, eax
je 0x41702e
test byte [ebp - 0x18], 1
jne 0x417061
lea eax, [ebp - 0xc]
push eax
call fcn.0040f028
test eax, eax
pop ecx
je 0x417049
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040c5ab
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x417058
or dword [ebp + 0x10], 0x200000
jmp 0x417092
or dword [ebp + 0x10], 0x40000
jmp 0x417092
mov eax, dword [0x42bd9c]
cmp eax, esi
je 0x417092
push eax
call fcn.0040a0fd
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x417092
mov eax, dword [0x42bda0]
cmp eax, esi
je 0x417092
push dword [ebp - 4]
push eax
call fcn.0040a0fd
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x42bd98]
call fcn.0040a0fd
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x405d6b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a0c], 0
push esi
jne 0x405da2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d7c
mov dword [ecx*4 + 0x422a08], eax
inc ecx
cmp ecx, 0x100
jl 0x405d77
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405dd3
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a08]
xor eax, esi
inc ecx
dec edx
jne 0x405db5
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx