joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ec3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x405ee7
xor eax, eax
test eax, eax
je 0x405ef9
cmp byte [ebp + eax - 0x121], 0x5c
je 0x405ef9
xor ecx, ecx
jmp 0x405efc
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409010]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret 4

Function at 0x405f9c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c654], 0
push esi
jne 0x405fd3
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405fad
mov dword [ecx*4 + 0x42c650], eax
inc ecx
cmp ecx, 0x100
jl 0x405fa8
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406004
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c650]
xor eax, esi
inc ecx
dec edx
jne 0x405fe6
pop edi
not eax
pop esi
ret 0xc
Function at 0x401249
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x43c4b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 8]
push ecx
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push 0x400
push eax
mov byte [ebp - 0x805], 0
call fcn.004011f1
add esp, 0x14
test eax, eax
js 0x401320
and dword [ebp - 0x80c], 0
lea eax, [ebp - 0x80c]
push eax
push 1
push 0
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401320
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x810]
push eax
xor edi, edi
push edi
push ebx
push dword [ebp - 0x80c]
mov dword [ebp - 0x810], edi
mov dword [ebp - 0x814], edi
mov dword [ebp - 0x818], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401314
cmp dword [ebp - 0x810], 4
jne 0x401314
cmp dword [ebp - 0x814], edi
mov byte [ebp - 0x805], 1
setne al
mov dword [esi], eax
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x805]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e766
leave
ret

Function at 0x401f2e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x43c50c], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
jne 0x401f72
call ebx
test eax, eax
jns 0x401f68
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x43c508], eax
mov dword [0x43c50c], 1
mov eax, dword [0x43c508]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401f8e
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
test eax, eax
jne 0x401fbe
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x401fb4
call ebx
test eax, eax
mov eax, dword [ebp + 8]
jns 0x401fa9
push dword [eax + 0xc]
call dword [eax + 8]
jmp 0x401fae
push dword [eax + 4]
call dword [eax]
test eax, eax
je 0x401fbd
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc
Function at 0x402137
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x432748
xor edi, edi
push reloc.OLEAUT32.dll_SysReAllocString
inc edi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4021a1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x432744
push dword [ebp - 4]
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402198
cmp dword [ebp - 8], esi
jne 0x402198
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x4030be
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x43058d
call fcn.0042e77c
mov edi, 0x200
push edi
call fcn.0042e6ea
pop ecx
mov dword [ebp - 0x18], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ebx, str.SoftwareAdobeAdobe_Acrobat11.0LanguageNext
push ebx
push SysReAllocString
call esi
test eax, eax
je 0x403151
lea eax, [ebp - 0x10]
push eax
push ebx
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
call esi
test eax, eax
je 0x403151
lea eax, [ebp - 0x10]
push eax
push str.SoftwareAdobeAcrobat_Reader11.0LanguageNext
push SysReAllocString
call esi
test eax, eax
je 0x403151
lea eax, [ebp - 0x10]
push eax
push str.SoftwareAdobeAcrobat_Reader11.0LanguageNext
push ebx
call esi
test eax, eax
je 0x403151
lea eax, [ebp - 0x10]
push eax
push str.SoftwareAdobeAcrobat_Reader11.0LanguageCurrent
push ebx
call esi
test eax, eax
je 0x403151
or esi, 0xffffffff
push dword [ebp - 0x18]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
call fcn.0042e854
ret
mov esi, dword [ebp - 0x18]
push edi
xor ebx, ebx
push ebx
push esi
mov dword [ebp - 0x14], edi
call sub.MSVCR100.dll_memset
sub dword [ebp - 0x14], 2
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
shr eax, 1
cmp edi, ebx
jne 0x40313d
cmp dword [ebp - 0x1c], 1
jne 0x40313d
cmp eax, 4
jb 0x40313d
mov edi, dword [sym.imp.MSVCR100.dll__wcsicmp]
lea esi, [esi + eax*2 - 8]
push 0x432af4
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40321b
push 0x432aec
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40321b
movzx eax, word [esi]
mov edi, dword [sym.imp.MSVCR100.dll_iswalpha]
push eax
call edi
pop ecx
test eax, eax
je 0x40313d
movzx eax, word [esi + 2]
push eax
call edi
pop ecx
test eax, eax
je 0x40313d
movzx eax, word [esi + 4]
push eax
call edi
pop ecx
test eax, eax
je 0x40313d
cmp word [esi + 6], bx
jne 0x40313d
push esi
push 4
push dword [ebp + 8]
call fcn.00403054
test eax, eax
js 0x40313d
xor esi, esi
inc esi
jmp 0x403140
xor esi, esi
jmp 0x403140
Function at 0x4032b2
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x43c4b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
call fcn.00402682
mov ebx, eax
cmp ebx, esi
je 0x403323
lea ecx, [ebp - 0x214]
call fcn.004025ff
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e766
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x403341
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.004032b2
cmp eax, esi
jne 0x403388
lea eax, [ebp - 0x220]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x208], 0x100
call ebx
test eax, eax
je 0x40332b
lea ecx, [ebp - 0x214]
call fcn.004025ff
push dword [ebp - 0x218]
mov ecx, edi
call fcn.0040258f
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.004025ff
mov eax, esi
jmp 0x403312

Function at 0x40385c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
cmp eax, esi
jne 0x40387b
xor eax, eax
jmp 0x4038a1
push ebx
lea eax, [ebp - 4]
push eax
push esi
push edi
push 0x403222
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, esi
jne 0x40389e
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret
Function at 0x404f96
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x430755
call fcn.0042e81b
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call fcn.004034ad
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x404fee
call fcn.0040210c
mov esi, eax
jmp 0x4050c4
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x405007
call fcn.0040210c
jmp 0x4050b6
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, esi
je 0x404ffd
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x424], edi
cmp eax, edi
jae 0x405041
mov esi, 0x8007000e
jmp 0x4050b8
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.00403ddd
mov dword [ebp - 4], 1
jmp 0x40506f
cmp dword [ebp - 0x418], esi
je 0x40503a
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x420]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x404ffd
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.00404d75
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4050dd
lea ecx, [ebp - 0x418]
call fcn.00402cec
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.00402c6e
mov eax, esi
call fcn.0042e877
ret 0x10

Function at 0x4053f3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40545c
cmp dword [ebp + 0x10], 1
je 0x405434
cmp dword [ebp + 0x10], 2
je 0x405434
push 0xd
pop eax
jmp 0x40545c
mov eax, dword [ebp - 4]
test edi, edi
je 0x405456
test eax, eax
je 0x405451
test al, 1
jne 0x40542f
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x405456
jmp 0x40542f
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x405614
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040b5f7
pop ecx
pop ecx
test eax, eax
jne 0x405634
mov eax, 0x80004005
leave
ret 0x18
push esi
push dword [ebp + 0x14]
call fcn.004054d6
pop ecx
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0040c1ef
push dword [ebp + 0x18]
lea ecx, [ebp - 0x18]
push esi
call fcn.0040bdee
test al, al
jne 0x405668
xor esi, esi
inc esi
lea ecx, [ebp - 0x18]
call fcn.0040bd65
mov eax, esi
pop esi
jmp 0x405630
lea eax, [ebp + 0x10]
push eax
push 0xf003f
push 0
push dword [ebp + 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405696
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
jmp 0x40565b

Function at 0x40569a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
lea eax, [ebp - 4]
push eax
push 0xf003f
xor esi, esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405771
push edi
mov edi, 0xff
push 0x1fe
mov dword [ebp - 8], edi
call dword [sym.imp.MSVCR100.dll_malloc]
pop ecx
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x405767
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x1c]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 8]
push ecx
push eax
jmp 0x40574f
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40575c
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.0040569a
pop ecx
pop ecx
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40575c
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
je 0x40575c
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push esi
push dword [ebp - 4]
mov dword [ebp - 8], edi
call ebx
test eax, eax
je 0x4056f6
push dword [ebp - 0xc]
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
pop ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
leave
ret
Function at 0x405780
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43c4b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040b5f7
pop ecx
pop ecx
test eax, eax
jne 0x4057bd
mov eax, 0x80004005
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e766
leave
ret 0x1c
push dword [ebp + 0x14]
call fcn.004054d6
pop ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0xc], eax
call fcn.0040c1ef
mov ebx, dword [ebp + 0x18]
push ebx
push dword [ebp - 0xc]
lea ecx, [ebp - 0x24]
call fcn.0040bdee
xor esi, esi
test al, al
jne 0x4057f3
inc esi
lea ecx, [ebp - 0x24]
call fcn.0040bd65
mov eax, esi
jmp 0x4057a9
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp ebx, esi
je 0x405808
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x40580c
xor eax, eax
jmp 0x405824
lea esi, [eax + eax]
mov eax, esi
call fcn.0042ea80
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.004053bb
xor esi, esi
push esi
lea ecx, [ebp - 8]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4057e7
cmp dword [ebp + 0x1c], esi
je 0x405852
push dword [ebp + 0x1c]
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x405856
xor eax, eax
jmp 0x405870
lea esi, [eax + eax]
mov eax, esi
call fcn.0042ea80
mov eax, esp
push 3
push esi
push dword [ebp + 0x1c]
push eax
call fcn.004053bb
xor esi, esi
push 4
lea ecx, [ebp + 0x20]
push ecx
push 4
push esi
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4057e7
Function at 0x405891
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43c4b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040b5f7
pop ecx
pop ecx
test eax, eax
jne 0x4058ce
mov eax, 0x80004005
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e766
leave
ret 0x1c
push dword [ebp + 0x14]
call fcn.004054d6
pop ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0xc], eax
call fcn.0040c1ef
mov edi, dword [ebp + 0x18]
push edi
push dword [ebp - 0xc]
lea ecx, [ebp - 0x24]
call fcn.0040bdee
xor ebx, ebx
test al, al
jne 0x405904
inc ebx
lea ecx, [ebp - 0x24]
call fcn.0040bd65
mov eax, ebx
jmp 0x4058ba
cmp edi, ebx
je 0x405917
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40591b
xor eax, eax
jmp 0x405931
lea esi, [eax + eax]
mov eax, esi
call fcn.0042ea80
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.004053bb
push ebx
lea ecx, [ebp - 8]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4058f8
mov eax, dword [ebp + 0x20]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x405953
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x20]
push 1
push ebx
push dword [ebp + 0x1c]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4058f8
Function at 0x405987
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x43c4b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040b5f7
pop ecx
pop ecx
test eax, eax
je 0x405ae2
push dword [ebp + 0x14]
call fcn.004054d6
pop ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xc], eax
call fcn.0040c1ef
push dword [ebp + 0x18]
lea ecx, [ebp - 0x28]
push dword [ebp - 0xc]
call fcn.0040bdee
test al, al
jne 0x4059e7
xor esi, esi
inc esi
lea ecx, [ebp - 0x28]
call fcn.0040bd65
mov eax, esi
jmp 0x405ae7
mov esi, dword [ebp + 0x20]
test esi, esi
jne 0x4059f3
push 0x57
pop esi
jmp 0x4059d8
cmp word [esi], 1
jne 0x405ada
cmp dword [esi + 4], 1
jne 0x405ada
cmp dword [esi + 0x14], 0
jne 0x405ada
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
je 0x405a24
mov esi, eax
jmp 0x4059d8
cmp dword [ebp + 0x18], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, 0x3fffffff
je 0x405a3f
push dword [ebp + 0x18]
call edi
inc eax
cmp eax, ebx
jle 0x405a43
xor eax, eax
jmp 0x405a5e
lea esi, [eax + eax]
mov eax, esi
call fcn.0042ea80
mov eax, esp
push 3
push esi
push dword [ebp + 0x18]
push eax
call fcn.004053bb
mov esi, dword [ebp + 0x20]
xor ecx, ecx
push ecx
lea edx, [ebp - 8]
push edx
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x405ac7
cmp dword [ebp + 0x1c], eax
je 0x405aaa
push dword [ebp + 0x1c]
call edi
inc eax
cmp eax, ebx
jle 0x405a8f
xor eax, eax
jmp 0x405aaa
lea esi, [eax + eax]
mov eax, esi
call fcn.0042ea80
mov eax, esp
push 3
push esi
push dword [ebp + 0x1c]
push eax
call fcn.004053bb
mov esi, dword [ebp + 0x20]
push dword [esi + 0x10]
push dword [ebp - 0x10]
push 3
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
lea ecx, [ebp - 0x28]
call fcn.0040bd65
xor eax, eax
jmp 0x405ae7
lea ecx, [ebp - 0x28]
call fcn.0040bd65
mov eax, 0x80004005
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e766
leave
ret 0x1c
Function at 0x405afb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x43c4b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040b5f7
pop ecx
pop ecx
test eax, eax
jne 0x405b38
mov eax, 0x80004005
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e766
leave
ret 0x1c
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
mov ebx, 0x3fffffff
cmp dword [ebp + 0x20], esi
je 0x405b54
push dword [ebp + 0x20]
call edi
inc eax
cmp eax, ebx
jle 0x405b59
mov dword [ebp - 8], esi
jmp 0x405b76
lea esi, [eax + eax]
mov eax, esi
call fcn.0042ea80
mov eax, esp
push 3
push esi
push dword [ebp + 0x20]
push eax
call fcn.004053bb
mov dword [ebp - 8], eax
xor esi, esi
push dword [ebp + 0x14]
call fcn.004054d6
pop ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xc], eax
call fcn.0040c1ef
push dword [ebp + 0x18]
lea ecx, [ebp - 0x28]
push dword [ebp - 0xc]
call fcn.0040bdee
test al, al
jne 0x405bae
xor esi, esi
inc esi
lea ecx, [ebp - 0x28]
call fcn.0040bd65
mov eax, esi
jmp 0x405b24
cmp dword [ebp + 0x18], esi
je 0x405bbd
push dword [ebp + 0x18]
call edi
inc eax
cmp eax, ebx
jle 0x405bc1
xor eax, eax
jmp 0x405bdb
lea esi, [eax + eax]
mov eax, esi
call fcn.0042ea80
mov eax, esp
push 3
push esi
push dword [ebp + 0x18]
push eax
call fcn.004053bb
xor esi, esi
push esi
lea ecx, [ebp - 0x10]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x405b9f
cmp dword [ebp + 0x1c], esi
je 0x405c20
push dword [ebp + 0x1c]
call edi
inc eax
cmp eax, ebx
jg 0x405c20
lea esi, [eax + eax]
mov eax, esi
call fcn.0042ea80
mov eax, esp
push 3
push esi
push dword [ebp + 0x1c]
push eax
call fcn.004053bb
mov esi, eax
push 0
push SysReAllocString
push dword [ebp - 8]
call fcn.00405462
add esp, 0xc
inc eax
push eax
push dword [ebp - 8]
push 3
push 0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
jmp 0x405b9f