joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403439
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
movzx eax, word [esi]
cmp ax, 0x22
push 2
pop ecx
jne 0x4044ee
add esi, ecx
movzx eax, word [esi]
test ax, ax
je 0x403466
cmp ax, 0x22
jne 0x403456
cmp word [esi], 0x22
jne 0x40346e
add esi, ecx
movzx eax, word [esi]
test ax, ax
je 0x40347c
cmp ax, 0x20
jbe 0x40346c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
inc edi
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4034d4
push esi
push edi
push ebx
call fcn.0040357d
test eax, eax
jl 0x4034d4
push 0x4034f8
push edi
push ebx
call fcn.00403509
test eax, eax
jne 0x4034a4
push 0x4034ec
push edi
push ebx
call fcn.00403509
test eax, eax
jne 0x4034a4
push 0x4034dc
push edi
push ebx
call fcn.00403509
test eax, eax
jne 0x4034a4
pop edi
pop esi
mov eax, ebx
pop ebx
ret
cmp ax, 0x20
jbe 0x40346e
add esi, ecx
cmp word [esi], 0x20
ja 0x4044f8
jmp 0x40346e

Function at 0x403bb1
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x40f040]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x64], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x68], ecx
lea ecx, [ebp - 0x60]
push ecx
push 9
xor ebx, ebx
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x403c76
mov dword [ebp - 0x5c], ebx
cmp byte [ebp + 0xc], bl
jne 0x405102
push 0x27
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
cmp esi, ebx
jne 0x403c3d
lea eax, [ebp - 0x58]
push eax
push edi
push dword [ebp - 0x64]
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x58], ebx
call fcn.00403c88
test eax, eax
jl 0x403c3d
cmp dword [edi], ebx
jne 0x403c3d
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x68]
or dword [eax], ecx
inc dword [ebp - 0x5c]
cmp esi, ebx
jne 0x403c48
cmp dword [edi], ebx
je 0x403bf8
cmp dword [edi], ebx
jne 0x403c58
cmp esi, 0x103
jne 0x405126
xor esi, esi
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004032ff
leave
ret 0x14
cmp eax, 2
jne 0x40513f
xor esi, esi
jmp 0x403c63
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x5c]
mov dword [ebp - 0x58], 0x27
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x403c13
cmp esi, ebx
jle 0x403c5a
and esi, 0xffff
or esi, 0x80070000
jmp 0x403c5a
cmp eax, ebx
jle 0x40514d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x403c63
Function at 0x404134
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x40414d
call fcn.00404153
test al, al
je 0x408da2
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x480
mov eax, dword [0x40f040]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x224], 0
push ebx
push 0x206
lea eax, [ebp - 0x222]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x224]
push eax
call fcn.00408bcf
test eax, eax
je 0x408eaa
push esi
push edi
push 6
pop ecx
push ebx
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x224]
mov esi, 0x408ec8
lea edi, [ebp - 0x1c]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x408ea8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0x408eb8
lea eax, [ebp - 0x224]
push ebx
push eax
call fcn.004028a3
add esp, 0x14
test eax, eax
jl 0x408ea8
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x480]
push esi
push eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x480], edi
xor eax, eax
lea edi, [ebp - 0x43c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x480]
push eax
push esi
push esi
push 0x8000020
push esi
push esi
push esi
lea eax, [ebp - 0x224]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x408ea8
push dword [ebp - 0x43c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x438]
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004032ff
leave
ret

Function at 0x40452b
Capabilities:
Check mutex on windows

Disassembly:
push 0x18
push 0x404600
call fcn.00402944
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], edi
push 0x4045c0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x20], eax
cmp eax, edi
je 0x4045ae
mov esi, 0x2710
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
jne 0x4045ae
mov dword [ebp - 4], edi
lea eax, [ebp - 0x1c]
push eax
call fcn.004046d3
cmp eax, edi
jne 0x4049a0
lea eax, [ebp - 0x28]
push eax
push 0x4013e4
call sub.iertutil.dll_IEGetProcessModule
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x1c], edi
je 0x4045a2
push edi
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
call fcn.00404996
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
call fcn.00403794
ret
cmp eax, 0xb7
je 0x404578
jmp 0x404589
Function at 0x40462c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x404508
push 0x401390
push 0x80000001
mov dword [ebp - 8], 4
call sub.SHLWAPI.dll_SHGetValueW
test eax, eax
jne 0x404673
cmp dword [ebp - 0xc], 4
jne 0x404682
cmp dword [ebp - 4], 1
jne 0x4052de
cmp dword [ebp - 4], 0
je 0x4052f7
mov eax, dword [ebp - 4]
leave
ret
and dword [ebp - 4], 0
jmp 0x404673
cmp dword [ebp - 4], 2
je 0x404673
cmp dword [ebp - 4], 0xa
jne 0x404682
jmp 0x404673
call fcn.0040441d
test eax, eax
mov dword [ebp - 4], eax
je 0x40467d
call sub.iertutil.dll_Ordinal_32
cmp eax, 1
jne 0x40467d
push dword [ebp - 4]
call fcn.0040b9b0
jmp 0x40467d

Function at 0x4046d3
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x40f040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
push ebx
call edi
push 0x40483c
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x404805
push ebx
call edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x404805
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x404824
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x404800
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push 0x40480c
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0040485f
test eax, eax
jl 0x404800
push 0x40
lea eax, [ebp - 0x25c]
push ebx
push eax
mov dword [ebp - 0x260], ebx
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x21c], ebx
lea edi, [ebp - 0x218]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x260]
push eax
push ebx
push ebx
push 0x4000020
push 1
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404805
push dword [ebp - 0x218]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x21c]
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004032ff
leave
ret 4
push 0x6f
pop eax
jmp 0x4047ef
call esi
jmp 0x4047ef
Function at 0x40865d
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x40f040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x40fc90]
test eax, eax
jne 0x40871a
push 0x11c
push eax
lea eax, [ebp - 0x328]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
mov dword [ebp - 0x328], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40870c
cmp dword [ebp - 0x318], 2
jne 0x408702
cmp dword [ebp - 0x324], 6
jae 0x408702
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [0x40f048]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40870c
push 0
push 8
lea eax, [ebp - 0x20c]
push eax
call fcn.0040a25b
cmp eax, dword [0x40f048]
mov dword [0x40fc90], eax
jne 0x40870c
push eax
call fcn.00409d6d
jmp 0x40870c
mov eax, dword [0x40f048]
mov dword [0x40fc90], eax
mov eax, dword [0x40fc90]
test eax, eax
jne 0x40871a
mov eax, dword [0x40f048]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004032ff
leave
ret

Function at 0x408bcf
Capabilities:
Accept command line arguments
Persist via active setup registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x40f040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0x2e
pop ecx
mov esi, 0x408ce8
lea edi, [ebp - 0xc0]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xc8]
push eax
push 1
movsw word es:[edi], word [esi]
xor edi, edi
push edi
lea eax, [ebp - 0xc0]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408cbd
mov eax, dword [ebp + 0xc]
add eax, eax
push eax
push edi
push ebx
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc4], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xcc]
push eax
push ebx
lea eax, [ebp - 0xc4]
push eax
push edi
push 0x408cd0
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408cb1
cmp dword [ebp - 0xc4], 1
je 0x408c75
cmp dword [ebp - 0xc4], 2
jne 0x408cb1
mov eax, dword [ebp - 0xcc]
shr eax, 1
mov word [ebx + eax*2 - 2], di
lea eax, [ebp - 0xd0]
push eax
push ebx
mov dword [ebp - 0xd0], edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp esi, edi
je 0x408cb1
push dword [esi]
push dword [ebp + 0xc]
push ebx
call fcn.0040357d
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
inc edi
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004032ff
leave
ret 8
Function at 0x409185
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x40f040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
lea ecx, [ebp - 0x210]
push ecx
push eax
call fcn.0040d015
mov ebx, eax
xor edi, edi
cmp ebx, edi
jl 0x409286
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x409272
push 0x409298
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0040485f
mov ebx, eax
cmp ebx, edi
jl 0x409279
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0040485f
mov ebx, eax
cmp ebx, edi
jl 0x409279
push 0x44
pop esi
push esi
lea eax, [ebp - 0x264]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x238], eax
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x264]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push eax
push edi
mov dword [ebp - 0x264], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x409272
push dword [ebp - 0x220]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x21c]
call esi
jmp 0x409279
call fcn.0040ac6a
mov ebx, eax
push dword [ebp - 0x210]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004032ff
leave
ret 4

Function at 0x409a20
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x409a33
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x409a2f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x409a54
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x409a93
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x409a89
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x409a95
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x409a79
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x409d7e
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x40f040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x409dd7
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x11c]
xor eax, eax
dec ecx
pop esi
je 0x409e2b
dec ecx
jne 0x409e4e
cmp edx, 5
jne 0x409e23
mov ecx, dword [ebp - 0x118]
sub ecx, eax
je 0x409e1f
dec ecx
je 0x409e14
dec ecx
je 0x409e05
push 0x14
jmp 0x409e76
cmp word [ebp - 0xc], 1
jb 0x409e0f
push 0x10
pop eax
or eax, 4
jmp 0x409e4e
cmp word [ebp - 0xc], 2
jb 0x409e0f
push 8
jmp 0x409e0e
push 4
jmp 0x409e76
cmp edx, 4
ja 0x409e5a
push 2
pop eax
cmp edx, 4
jne 0x409e4e
cmp dword [ebp - 0x118], 0
je 0x409e4b
cmp dword [ebp - 0x118], 0xa
je 0x409e4b
cmp dword [ebp - 0x118], 0x5a
jne 0x409e4e
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004032ff
leave
ret
cmp edx, 6
jne 0x409e79
cmp dword [ebp - 0x118], 0
jne 0x409e79
cmp dword [ebp - 0x114], 0x1554
jae 0x409e79
push 0x40
pop eax
jmp 0x409e4e
push 0x20
jmp 0x409e76

Function at 0x409ebf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x40f040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp word [0x40fcc8], si
jne 0x409f57
lea eax, [ebp - 0x10]
push eax
push 1
push esi
push 0x40a050
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409f57
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x40a108
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x409f57
push 3
push dword [esi*8 + 0x409f70]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x409f49
inc esi
cmp esi, 0x1c
jae 0x409f57
jmp 0x409f28
mov ax, word [esi*8 + 0x409f74]
mov word [0x40fcc8], ax
mov ecx, dword [ebp - 4]
mov ax, word [0x40fcc8]
xor ecx, ebp
pop esi
call fcn.004032ff
leave
ret
Function at 0x40ac83
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x18]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
je 0x40ac9d
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x40aca0
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x40acae
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x40acb1
mov dword [ebp - 8], ebx
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x40ad21
cmp dword [esi], ebx
jne 0x40acc1
cmp dword [esi + 8], ebx
je 0x40ad21
cmp dword [ebp + 0x1c], ebx
mov edi, 0xffff
jne 0x40aced
push ebx
push esi
call fcn.0040afe5
cmp eax, ebx
jne 0x40acf4
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push ebx
push dword [esi]
call sub.SHLWAPI.dll_SHRegGetValueW
jmp 0x40acf0
push 2
pop eax
cmp eax, ebx
je 0x40ad64
push ebx
push esi
call fcn.0040b00d
cmp eax, ebx
jne 0x40ad28
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x40ad0b
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push ebx
push dword [esi + 8]
call sub.SHLWAPI.dll_SHRegGetValueW
jmp 0x40ad24
push 0x57
pop eax
cmp eax, ebx
je 0x40ad64
cmp dword [ebp + 0x20], ebx
je 0x40ad64
mov esi, dword [ebp + 0x24]
cmp esi, ebx
je 0x40ad64
cmp dword [ebp + 0x14], ebx
je 0x40ad64
cmp dword [ebp - 4], esi
jb 0x40ad64
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x14]
call sub.msvcrt.dll_memmove
mov eax, dword [ebp + 0x18]
add esp, 0xc
cmp eax, ebx
je 0x40ad56
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x40ad62
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x20
Function at 0x40ad70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x1c]
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x210]
xor ebx, ebx
and ecx, 0xa
and eax, 1
cmp dword [esi], ebx
push edi
jne 0x40ad99
cmp dword [esi + 8], ebx
je 0x40ae3f
cmp ecx, ebx
jne 0x40ada5
cmp eax, ebx
je 0x40ae3f
test byte [ebp + 0x1c], 3
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
je 0x40adf2
push 1
push esi
call fcn.0040afe5
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x40ae46
test byte [ebp + 0x1c], 2
jne 0x40addc
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [esi]
call sub.SHLWAPI.dll_SHQueryValueExW
test eax, eax
je 0x40adfa
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 0xc]
push dword [esi]
call edi
mov dword [ebp + 8], eax
jmp 0x40adf5
mov dword [ebp + 8], ebx
cmp dword [ebp + 8], ebx
jne 0x40ae46
test byte [ebp + 0x1c], 0xc
je 0x40ae46
push 1
push esi
call fcn.0040b00d
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x40ae46
test byte [ebp + 0x1c], 8
jne 0x40ae28
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [esi + 8]
call sub.SHLWAPI.dll_SHQueryValueExW
test eax, eax
je 0x40ae46
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 0xc]
push dword [esi + 8]
call edi
mov dword [ebp + 8], eax
jmp 0x40ae46
mov dword [ebp + 8], 0x57
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 0x18

Function at 0x40b038
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
xor ebx, ebx
cmp eax, ebx
push edi
sete cl
mov edi, eax
and eax, 0x10
and edi, 1
cmp esi, ebx
mov dword [ebp + 0x10], eax
je 0x40b104
cmp dword [esi], ebx
jne 0x40b06f
cmp dword [esi + 8], ebx
je 0x40b104
cmp ecx, ebx
jne 0x40b0a2
cmp edi, ebx
jne 0x40b07f
cmp eax, ebx
je 0x40b104
xor eax, eax
cmp edi, ebx
je 0x40b0d9
push ebx
push esi
call fcn.0040afe5
cmp eax, ebx
jne 0x40b107
cmp dword [ebp + 0x14], ebx
push dword [ebp + 0xc]
push dword [esi]
je 0x40b0c1
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x40b0c7
push ebx
push esi
call fcn.0040afe5
cmp eax, ebx
je 0x40b085
push ebx
push esi
call fcn.0040b00d
cmp eax, ebx
jne 0x40b107
mov dword [ebp + 0x10], 1
jmp 0x40b081
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
jne 0x40b0d5
mov dword [ebp + 0x10], 1
xor eax, eax
cmp eax, ebx
jne 0x40b107
cmp dword [ebp + 0x10], ebx
je 0x40b107
push ebx
push esi
call fcn.0040b00d
cmp eax, ebx
jne 0x40b107
cmp dword [ebp + 0x14], ebx
push dword [ebp + 0xc]
push dword [esi + 8]
je 0x40b0fc
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x40b107
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x40b107
push 0x57
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x40ba10
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ecx]
xor ecx, ecx
cmp eax, ecx
jne 0x40ba59
cmp dword [ebp + 0xc], ecx
mov eax, 0x12b9b0a5
jbe 0x40ba49
push esi
mov edx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
mov esi, eax
imul esi, esi, 0x820
add edx, esi
mov esi, eax
shr esi, 2
add edx, esi
xor eax, edx
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x40ba28
pop esi
and eax, 0x7fffffff
xor edx, edx
div dword [ebp + 0x10]
mov eax, edx
pop ebp
ret 0xc
pop ebp
jmp eax

Function at 0x40be14
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x40f040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 4
call dword [sym.imp.iertutil.dll_Ordinal_74]
test eax, eax
mov dword [ebp - 0x68], eax
je 0x40bef0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
lea eax, [ebp - 0x6c]
push eax
mov ebx, 0x20019
push ebx
push 0
mov edi, 0x40bf40
push edi
push 0x80000001
call esi
test eax, eax
je 0x40be72
lea eax, [ebp - 0x6c]
push eax
push ebx
push 0
push edi
push 0x80000002
call esi
test eax, eax
jne 0x40beef
xor esi, esi
xor ebx, ebx
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push dword [ebp - 0x6c]
mov dword [ebp - 0x74], 0x27
call sub.SHLWAPI.dll_SHEnumValueW
mov edi, eax
cmp edi, esi
jne 0x40bee1
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.SHELL32.dll_SHCLSIDFromString]
test eax, eax
jl 0x40bee1
lea eax, [ebp - 0x70]
push eax
push 0x40bfa8
push 1
push esi
lea eax, [ebp - 0x64]
push eax
call sub.ole32.dll_CoCreateInstance
test eax, eax
jl 0x40bee1
push dword [ebp - 0x70]
push 0x7fffffff
push dword [ebp - 0x68]
call dword [sym.imp.iertutil.dll_Ordinal_85]
cmp eax, 0xffffffff
jne 0x40bee1
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
inc ebx
cmp edi, esi
je 0x40be76
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov esi, 0x40f074
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [0x40fcd0], edi
jne 0x40bf11
mov eax, dword [ebp - 0x68]
mov dword [0x40fcd0], eax
mov dword [ebp - 0x68], edi
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x68], edi
je 0x40bf2c
push edi
push 0x40bdf6
push dword [ebp - 0x68]
call dword [sym.imp.iertutil.dll_Ordinal_79]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004032ff
leave
ret