joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407360
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x40ea20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov al, byte [esp + 0x28]
push edi
mov edi, ecx
push 0
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], al
call fcn.004021d0
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], 0
mov ecx, eax
shr ecx, 0x10
test cx, cx
je 0x4073b4
lea edx, [esp + 0xc]
push eax
push edx
call fcn.00401460
add esp, 8
jmp 0x4073c9
test eax, eax
je 0x4073c9
and eax, 0xffff
push 0
push eax
lea ecx, [esp + 0x14]
call fcn.00401950
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
lea ecx, [edi + 4]
mov dword [esp + 0x2c], 1
call fcn.00404cb0
test eax, eax
je 0x40740f
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4073f4
mov eax, 0x40f15c
lea edx, [esp + 4]
push 0x2001f
push edx
push eax
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.00406f50
test eax, eax
jne 0x407459
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x407445
mov al, byte [ecx - 1]
test al, al
je 0x40743b
cmp al, 0xff
je 0x40743b
dec al
pop edi
mov byte [ecx - 1], al
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x14
dec ecx
push ecx
call fcn.00408750
add esp, 4
xor eax, eax
pop edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x14
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
push esi
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x10]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
lea eax, [esp + 8]
push eax
mov ecx, edi
call fcn.00406fb0
xor ecx, ecx
test esi, esi
sete cl
mov esi, ecx
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4074b6
mov al, byte [ecx - 1]
test al, al
je 0x4074ac
cmp al, 0xff
je 0x4074ac
dec al
mov byte [ecx - 1], al
jmp 0x4074b6
dec ecx
push ecx
call fcn.00408750
add esp, 4
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop edi
mov dword fs:[0], ecx
add esp, 0x24
ret 0x14
Function at 0x407570
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40ea40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov al, byte [esp + 0x34]
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.004021d0
xor ecx, ecx
mov dword [esp + 0x30], 0
cmp ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
jne 0x4075c6
mov edx, dword [0x40f158]
push edx
push ecx
lea ecx, [esp + 0x10]
call fcn.004016a0
jmp 0x40764a
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40762a
cmp eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
ja 0x40762a
mov ecx, dword [esp + 0x10]
add ecx, eax
cmp ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
jb 0x40762a
mov edx, dword [0x40f158]
mov ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
push edx
sub ecx, eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.004017c0
mov ecx, dword [0x40f158]
mov byte [esp + 0x30], 1
push ecx
push 0
push eax
lea ecx, [esp + 0x14]
call fcn.00401d20
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 0
call fcn.004021d0
jmp 0x40764a
push edi
mov edi, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
lea ecx, [esp + 0x14]
call fcn.00401f20
pop edi
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x407661
mov eax, 0x40f15c
lea ecx, [esp + 4]
push ecx
push str.QuitFlag
push eax
mov ecx, esi
call fcn.00407340
mov ecx, dword [esp + 0xc]
pop esi
test eax, eax
jne 0x4076c2
test ecx, ecx
je 0x4076ae
mov al, byte [ecx - 1]
test al, al
je 0x4076a4
cmp al, 0xff
je 0x4076a4
dec al
mov byte [ecx - 1], al
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 4
dec ecx
push ecx
call fcn.00408750
add esp, 4
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 4
test ecx, ecx
je 0x4076f3
mov al, byte [ecx - 1]
test al, al
je 0x4076e9
cmp al, 0xff
je 0x4076e9
dec al
mov byte [ecx - 1], al
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 4
dec ecx
push ecx
call fcn.00408750
add esp, 4
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x30
ret 4
Function at 0x407710
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40ea60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov al, byte [esp + 3]
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.004021d0
xor ecx, ecx
mov dword [esp + 0x30], 0
cmp ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
jne 0x407766
mov edx, dword [0x40f158]
push edx
push ecx
lea ecx, [esp + 0x10]
call fcn.004016a0
jmp 0x4077ea
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4077ca
cmp eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
ja 0x4077ca
mov ecx, dword [esp + 0x10]
add ecx, eax
cmp ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
jb 0x4077ca
mov edx, dword [0x40f158]
mov ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
push edx
sub ecx, eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.004017c0
mov ecx, dword [0x40f158]
mov byte [esp + 0x30], 1
push ecx
push 0
push eax
lea ecx, [esp + 0x14]
call fcn.00401d20
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 0
call fcn.004021d0
jmp 0x4077ea
push edi
mov edi, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
lea ecx, [esp + 0x14]
call fcn.00401f20
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4077f7
mov eax, 0x40f15c
push str.QuitFlag
push eax
mov ecx, esi
call fcn.004071d0
mov ecx, dword [esp + 0xc]
pop esi
test eax, eax
jne 0x40784f
test ecx, ecx
je 0x40783d
mov al, byte [ecx - 1]
test al, al
je 0x407833
cmp al, 0xff
je 0x407833
dec al
mov byte [ecx - 1], al
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
dec ecx
push ecx
call fcn.00408750
add esp, 4
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
test ecx, ecx
je 0x40787e
mov al, byte [ecx - 1]
test al, al
je 0x407874
cmp al, 0xff
je 0x407874
dec al
mov byte [ecx - 1], al
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
dec ecx
push ecx
call fcn.00408750
add esp, 4
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x407890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40ea80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov al, byte [esp + 3]
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.004021d0
xor ecx, ecx
mov dword [esp + 0x30], 0
cmp ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
jne 0x4078e6
mov edx, dword [0x40f158]
push edx
push ecx
lea ecx, [esp + 0x10]
call fcn.004016a0
jmp 0x40796a
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40794a
cmp eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
ja 0x40794a
mov ecx, dword [esp + 0x10]
add ecx, eax
cmp ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
jb 0x40794a
mov edx, dword [0x40f158]
mov ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
push edx
sub ecx, eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.004017c0
mov ecx, dword [0x40f158]
mov byte [esp + 0x30], 1
push ecx
push 0
push eax
lea ecx, [esp + 0x14]
call fcn.00401d20
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 0
call fcn.004021d0
jmp 0x40796a
push edi
mov edi, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
lea ecx, [esp + 0x14]
call fcn.00401f20
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x407977
mov eax, 0x40f15c
push str.BCliBuildNo
push eax
mov ecx, esi
call fcn.004071d0
mov ecx, dword [esp + 0xc]
pop esi
test eax, eax
jne 0x4079cf
test ecx, ecx
je 0x4079bd
mov al, byte [ecx - 1]
test al, al
je 0x4079b3
cmp al, 0xff
je 0x4079b3
dec al
mov byte [ecx - 1], al
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
dec ecx
push ecx
call fcn.00408750
add esp, 4
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
test ecx, ecx
je 0x4079fe
mov al, byte [ecx - 1]
test al, al
je 0x4079f4
cmp al, 0xff
je 0x4079f4
dec al
mov byte [ecx - 1], al
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
dec ecx
push ecx
call fcn.00408750
add esp, 4
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x407a10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40eaa0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov al, byte [esp + 3]
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.004021d0
xor ecx, ecx
mov dword [esp + 0x30], 0
cmp ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsC435160E_DEE2_40B3_980E_377CA90D2D9F
jne 0x407a66
mov edx, dword [0x40f158]
push edx
push ecx
lea ecx, [esp + 0x10]
call fcn.004016a0
jmp 0x407aea
mov eax, dword [esp + 0xc]
test eax, eax
je 0x407aca
cmp eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsC435160E_DEE2_40B3_980E_377CA90D2D9F
ja 0x407aca
mov ecx, dword [esp + 0x10]
add ecx, eax
cmp ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsC435160E_DEE2_40B3_980E_377CA90D2D9F
jb 0x407aca
mov edx, dword [0x40f158]
mov ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsC435160E_DEE2_40B3_980E_377CA90D2D9F
push edx
sub ecx, eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.004017c0
mov ecx, dword [0x40f158]
mov byte [esp + 0x30], 1
push ecx
push 0
push eax
lea ecx, [esp + 0x14]
call fcn.00401d20
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 0
call fcn.004021d0
jmp 0x407aea
push edi
mov edi, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsC435160E_DEE2_40B3_980E_377CA90D2D9F
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsC435160E_DEE2_40B3_980E_377CA90D2D9F
lea ecx, [esp + 0x14]
call fcn.00401f20
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x407af7
mov eax, 0x40f15c
push eax
mov ecx, esi
call fcn.00407070
mov ecx, dword [esp + 0xc]
pop esi
test eax, eax
jne 0x407b4a
test ecx, ecx
je 0x407b38
mov al, byte [ecx - 1]
test al, al
je 0x407b2e
cmp al, 0xff
je 0x407b2e
dec al
mov byte [ecx - 1], al
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
dec ecx
push ecx
call fcn.00408750
add esp, 4
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
test ecx, ecx
je 0x407b79
mov al, byte [ecx - 1]
test al, al
je 0x407b6f
cmp al, 0xff
je 0x407b6f
dec al
mov byte [ecx - 1], al
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
dec ecx
push ecx
call fcn.00408750
add esp, 4
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x407b90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40eac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov al, byte [esp + 3]
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.004021d0
xor ecx, ecx
mov dword [esp + 0x30], 0
cmp ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
jne 0x407be6
mov edx, dword [0x40f158]
push edx
push ecx
lea ecx, [esp + 0x10]
call fcn.004016a0
jmp 0x407c6a
mov eax, dword [esp + 0xc]
test eax, eax
je 0x407c4a
cmp eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
ja 0x407c4a
mov ecx, dword [esp + 0x10]
add ecx, eax
cmp ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
jb 0x407c4a
mov edx, dword [0x40f158]
mov ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
push edx
sub ecx, eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.004017c0
mov ecx, dword [0x40f158]
mov byte [esp + 0x30], 1
push ecx
push 0
push eax
lea ecx, [esp + 0x14]
call fcn.00401d20
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 0
call fcn.004021d0
jmp 0x407c6a
push edi
mov edi, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
lea ecx, [esp + 0x14]
call fcn.00401f20
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x407c77
mov eax, 0x40f15c
push str.BCliVersion
push eax
mov ecx, esi
call fcn.004071d0
mov ecx, dword [esp + 0xc]
pop esi
test eax, eax
jne 0x407ccf
test ecx, ecx
je 0x407cbd
mov al, byte [ecx - 1]
test al, al
je 0x407cb3
cmp al, 0xff
je 0x407cb3
dec al
mov byte [ecx - 1], al
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
dec ecx
push ecx
call fcn.00408750
add esp, 4
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
test ecx, ecx
je 0x407cfe
mov al, byte [ecx - 1]
test al, al
je 0x407cf4
cmp al, 0xff
je 0x407cf4
dec al
mov byte [ecx - 1], al
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
dec ecx
push ecx
call fcn.00408750
add esp, 4
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x407d10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40eae0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov al, byte [esp + 3]
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.004021d0
xor ecx, ecx
mov dword [esp + 0x30], 0
cmp ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
jne 0x407d66
mov edx, dword [0x40f158]
push edx
push ecx
lea ecx, [esp + 0x10]
call fcn.004016a0
jmp 0x407dea
mov eax, dword [esp + 0xc]
test eax, eax
je 0x407dca
cmp eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
ja 0x407dca
mov ecx, dword [esp + 0x10]
add ecx, eax
cmp ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
jb 0x407dca
mov edx, dword [0x40f158]
mov ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
push edx
sub ecx, eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.004017c0
mov ecx, dword [0x40f158]
mov byte [esp + 0x30], 1
push ecx
push 0
push eax
lea ecx, [esp + 0x14]
call fcn.00401d20
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 0
call fcn.004021d0
jmp 0x407dea
push edi
mov edi, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
lea ecx, [esp + 0x14]
call fcn.00401f20
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x407df7
mov eax, 0x40f15c
push str.InstallSuccess
push eax
mov ecx, esi
call fcn.004071d0
mov ecx, dword [esp + 0xc]
pop esi
test eax, eax
jne 0x407e4f
test ecx, ecx
je 0x407e3d
mov al, byte [ecx - 1]
test al, al
je 0x407e33
cmp al, 0xff
je 0x407e33
dec al
mov byte [ecx - 1], al
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
dec ecx
push ecx
call fcn.00408750
add esp, 4
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
test ecx, ecx
je 0x407e7e
mov al, byte [ecx - 1]
test al, al
je 0x407e74
cmp al, 0xff
je 0x407e74
dec al
mov byte [ecx - 1], al
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
dec ecx
push ecx
call fcn.00408750
add esp, 4
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x408280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40eb40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov al, byte [esp + 3]
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.004021d0
xor ecx, ecx
mov dword [esp + 0x30], 0
cmp ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices
jne 0x4082d6
mov edx, dword [0x40f158]
push edx
push ecx
lea ecx, [esp + 0x10]
call fcn.004016a0
jmp 0x40835a
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40833a
cmp eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices
ja 0x40833a
mov ecx, dword [esp + 0x10]
add ecx, eax
cmp ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices
jb 0x40833a
mov edx, dword [0x40f158]
mov ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices
push edx
sub ecx, eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.004017c0
mov ecx, dword [0x40f158]
mov byte [esp + 0x30], 1
push ecx
push 0
push eax
lea ecx, [esp + 0x14]
call fcn.00401d20
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 0
call fcn.004021d0
jmp 0x40835a
push edi
mov edi, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices
lea ecx, [esp + 0x14]
call fcn.00401f20
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x408367
mov eax, 0x40f15c
push str.BBupgrad
push eax
mov ecx, esi
call fcn.004071d0
mov ecx, dword [esp + 0xc]
pop esi
test eax, eax
jne 0x4083bf
test ecx, ecx
je 0x4083ad
mov al, byte [ecx - 1]
test al, al
je 0x4083a3
cmp al, 0xff
je 0x4083a3
dec al
mov byte [ecx - 1], al
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
dec ecx
push ecx
call fcn.00408750
add esp, 4
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
test ecx, ecx
je 0x4083ee
mov al, byte [ecx - 1]
test al, al
je 0x4083e4
cmp al, 0xff
je 0x4083e4
dec al
mov byte [ecx - 1], al
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
dec ecx
push ecx
call fcn.00408750
add esp, 4
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x408400
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40eb60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov al, byte [esp + 3]
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.004021d0
xor ecx, ecx
mov dword [esp + 0x30], 0
cmp ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
jne 0x408456
mov edx, dword [0x40f158]
push edx
push ecx
lea ecx, [esp + 0x10]
call fcn.004016a0
jmp 0x4084da
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4084ba
cmp eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
ja 0x4084ba
mov ecx, dword [esp + 0x10]
add ecx, eax
cmp ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
jb 0x4084ba
mov edx, dword [0x40f158]
mov ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
push edx
sub ecx, eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.004017c0
mov ecx, dword [0x40f158]
mov byte [esp + 0x30], 1
push ecx
push 0
push eax
lea ecx, [esp + 0x14]
call fcn.00401d20
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 0
call fcn.004021d0
jmp 0x4084da
push edi
mov edi, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x14]
call fcn.00401f20
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4084e7
mov eax, 0x40f15c
push str.BService
push eax
mov ecx, esi
call fcn.004071d0
mov ecx, dword [esp + 0xc]
pop esi
test eax, eax
jne 0x40853f
test ecx, ecx
je 0x40852d
mov al, byte [ecx - 1]
test al, al
je 0x408523
cmp al, 0xff
je 0x408523
dec al
mov byte [ecx - 1], al
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
dec ecx
push ecx
call fcn.00408750
add esp, 4
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
test ecx, ecx
je 0x40856e
mov al, byte [ecx - 1]
test al, al
je 0x408564
cmp al, 0xff
je 0x408564
dec al
mov byte [ecx - 1], al
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
dec ecx
push ecx
call fcn.00408750
add esp, 4
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x408580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40eb80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov al, byte [esp + 3]
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], al
call fcn.004021d0
xor ecx, ecx
mov dword [esp + 0x30], 0
cmp ecx, str.HKEY_LOCAL_MACHINESystemCurrentControlSetServicesVxDScFilter
jne 0x4085d6
mov edx, dword [0x40f158]
push edx
push ecx
lea ecx, [esp + 0x10]
call fcn.004016a0
jmp 0x40865a
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40863a
cmp eax, str.HKEY_LOCAL_MACHINESystemCurrentControlSetServicesVxDScFilter
ja 0x40863a
mov ecx, dword [esp + 0x10]
add ecx, eax
cmp ecx, str.HKEY_LOCAL_MACHINESystemCurrentControlSetServicesVxDScFilter
jb 0x40863a
mov edx, dword [0x40f158]
mov ecx, str.HKEY_LOCAL_MACHINESystemCurrentControlSetServicesVxDScFilter
push edx
sub ecx, eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.004017c0
mov ecx, dword [0x40f158]
mov byte [esp + 0x30], 1
push ecx
push 0
push eax
lea ecx, [esp + 0x14]
call fcn.00401d20
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 0
call fcn.004021d0
jmp 0x40865a
push edi
mov edi, str.HKEY_LOCAL_MACHINESystemCurrentControlSetServicesVxDScFilter
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_LOCAL_MACHINESystemCurrentControlSetServicesVxDScFilter
lea ecx, [esp + 0x14]
call fcn.00401f20
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x408667
mov eax, 0x40f15c
push str.StaticVxD
push eax
mov ecx, esi
call fcn.004071d0
mov ecx, dword [esp + 0xc]
pop esi
test eax, eax
jne 0x4086bf
test ecx, ecx
je 0x4086ad
mov al, byte [ecx - 1]
test al, al
je 0x4086a3
cmp al, 0xff
je 0x4086a3
dec al
mov byte [ecx - 1], al
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
dec ecx
push ecx
call fcn.00408750
add esp, 4
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
test ecx, ecx
je 0x4086ee
mov al, byte [ecx - 1]
test al, al
je 0x4086e4
cmp al, 0xff
je 0x4086e4
dec al
mov byte [ecx - 1], al
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
dec ecx
push ecx
call fcn.00408750
add esp, 4
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x30
ret