joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b88c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40b8c5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00405018
jmp 0x40b8ce
mov eax, ebx
mov edx, esi
call fcn.00404edc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b8d8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40b8fa
movzx eax, word [esp]
jmp 0x40b8fc
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c084
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x40c1a9
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0040be98
mov esi, eax
mov eax, dword [0x417d54]
cmp byte [eax], 0
je 0x40c151
mov eax, dword [0x417c78]
call fcn.0040319c
call fcn.00402f8c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x40c060]
call fcn.00405d68
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x40c1c4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c18d
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x417c58]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x41ab48]
call fcn.00405e20
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c1b0
lea eax, [ebp - 4]
mov edx, dword [0x40c060]
call fcn.00405d74
ret
Function at 0x40da43
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404ad0
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x40da66
mov eax, edi
add eax, eax
call fcn.00402e24
mov esi, eax
jmp 0x40da68
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40daa1
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40da8b
mov eax, esp
cmp esi, eax
je 0x40daae
mov eax, esi
call fcn.00402e40
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40dae8
cmp bl, 0
je 0x40dae4
cmp bl, 0x41
jl 0x40dadf
cmp bl, 0x5a
jg 0x40dadf
or bl, 0x20
xor al, bl
inc esi
jmp 0x40dac3
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40da28

Function at 0x40e9c0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ea06
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040e8d8
mov eax, dword [ebp - 4]
call fcn.00404f68
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ea0d
lea eax, [ebp - 4]
call fcn.00404ecc
ret

Function at 0x40ed34
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40edcb
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x40ed7f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.00405018
jmp 0x40edb5
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
cmp word [ebx], 0
jne 0x40ed98
lea eax, [ebp - 4]
xor edx, edx
call fcn.00404f30
jmp 0x40edab
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040ebf4
mov ebx, eax
test esi, esi
je 0x40edab
dec esi
jmp 0x40ed86
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404edc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40edd2
lea eax, [ebp - 4]
call fcn.00404ecc
ret

Function at 0x40eddc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00408bb8
add esp, 0x208
pop ebx
ret
Function at 0x40ef5c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40f099
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x40f083
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40efb9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40f083
cmp dword [ebp - 0x14], 0
jne 0x40efd0
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404edc
mov bl, 1
jmp 0x40f083
cmp dword [ebp - 0x14], 0x70000000
jb 0x40efde
call fcn.0040c1f0
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00405018
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.004056f0
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
cmp eax, 0xea
je 0x40ef82
test eax, eax
jne 0x40f083
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40f02c
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40f083
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x40f034
dec esi
test esi, esi
je 0x40f048
lea eax, [ebp - 4]
call fcn.00404990
cmp word [eax + esi*2 - 2], 0
je 0x40f033
cmp dword [ebp - 0x10], 7
jne 0x40f053
test esi, esi
je 0x40f053
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00405144
cmp dword [ebp - 0x10], 7
jne 0x40f076
test esi, esi
je 0x40f076
lea eax, [ebp - 4]
call fcn.004056f0
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404edc
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f0a0
lea eax, [ebp - 4]
call fcn.00404ecc
ret

Function at 0x40fb1c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x41cd98
mov eax, esi
mov edx, 8
test al, 1
je 0x40fb38
shr eax, 1
xor eax, 0xedb88320
jmp 0x40fb3a
shr eax, 1
dec edx
jne 0x40fb2b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40fb24
pop esi
ret

Function at 0x40fb50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x41cd94], 0
jne 0x40fb73
call fcn.0040fb1c
push 1
push 0x41cd94
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x40fb9e
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x41cd98]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40fb79
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x41148c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00411440
test al, al
jne 0x4114ad
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4114f9
xor eax, eax
push ebp
push 0x4114e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404f68
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4114f0
lea eax, [ebp - 0xc]
call fcn.0041147c
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411738
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x411740
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x41182d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0040ee08
mov edx, dword [ebp - 8]
mov ecx, 0x411848
xor eax, eax
call fcn.0041161c
push 0
mov eax, dword [ebp - 4]
call fcn.00404f68
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4117fb
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x41175a
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.004112ac
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.004084bc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0040f3b0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x60
call fcn.0041127c
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x406f50]
call fcn.0040c1fc
call fcn.004040b0
jmp 0x41175a
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404edc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411834
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404ed4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ed4
ret

Function at 0x41185c
Capabilities:
Shutdown system

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov esi, edx
mov ebx, eax
mov eax, dword [0x417dbc]
cmp dword [eax], 2
jne 0x4118ca
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x411885
xor eax, eax
jmp 0x4118d7
lea eax, [esp + 8]
push eax
push 0x4118e0
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4118ca
xor eax, eax
jmp 0x4118d7
push esi
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
pop esi
pop ebx
ret
Function at 0x411918
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x411972
inc esi
xor edi, edi
cmp edi, 1
jne 0x41193e
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep_1
jmp 0x41194c
cmp edi, 1
jle 0x41194c
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep_1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0041148c
test eax, eax
jne 0x411972
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x411972
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x411972
inc edi
dec esi
jne 0x41192e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4151b0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x415285
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4152a0
push ebx
push 0x4152b0
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405380
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403270
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404f68
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x415230
mov al, 0x62
call fcn.00414d8c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00415184
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x415239
call fcn.00415184
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41528c
lea eax, [ebp - 4]
call fcn.00404ecc
ret
Function at 0x415338
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x415403
jmp 0x4153f7
cmp dword [esi + 0x10], 0x1000
jne 0x4153e3
test byte [esi + 0x15], 1
jne 0x4153e3
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x415394
cmp ebp, 2
je 0x415394
cmp ebp, 0x10
je 0x415394
cmp ebp, 0x20
jne 0x4153b0
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4153b0
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4153c1
mov eax, dword [esi]
add eax, ebx
call fcn.00415330
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4153b4
cmp byte [esp + 4], 0
je 0x4153e3
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x415403
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x415369
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xb5803f
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
jmp 0xb58056
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
movzx esi, byte [eax + 1]
movzx edi, byte [eax + 5]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 4]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 6]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 7]
shl esi, 8
xor esi, edi
xor esi, dword [ecx + 4]
movzx edi, byte [eax + 8]
movzx ebx, byte [eax + 0xd]
mov dword [ebp - 0x14], esi
movzx esi, byte [eax + 9]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xa]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xb]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xc]
xor edi, dword [ecx + 8]
xor edx, dword [ecx]
shl esi, 8
Function at 0xbab465
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp], bp
add esp, 0
lea esp, [esp + 8]
test ebx, ebx
jmp 0xbab44f
Function at 0x413640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x413699
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x413699
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x41368a
cmp esi, edx
jae 0x413699
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x413678
cmp esi, edx
jae 0x413699
cmp word [esi], 0
je 0x413699
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x413a60
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x5b63ec]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
mov ebx, ecx
mov dword [esp + 8], 0
mov ecx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 4]
or eax, 0x2001f
mov dword [esp + 0xc], ecx
push eax
push ecx
push dword [ebx]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call fcn.00413970
mov esi, eax
test esi, esi
je 0x413ae1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x413ac8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.004ea9ac
mov esp, ebp
pop ebp
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0x100
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push dword [esp + 0x2c]
call edi
test eax, eax
jne 0x413b49
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.00413a60
mov esi, eax
test esi, esi
jne 0x413b9b
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x2c]
call edi
test eax, eax
je 0x413b10
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x413b62
push eax
call esi
mov dword [esp + 0x10], 0
push dword [esp + 0xc]
mov ecx, ebx
mov dword [esp + 0x18], 0
call fcn.00413740
mov ecx, dword [esp + 0x10]
mov edi, eax
test ecx, ecx
je 0x413b82
push ecx
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.004ea9ac
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x413ac8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ea9ac
mov esp, ebp
pop ebp
ret 4
Function at 0x416920
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55f9bb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x5b63ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov byte [ebp - 0x231], cl
mov dword [ebp - 4], 0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
nop word [eax + eax]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005279e0
add esp, 0xc
mov dword [ebp - 0x228], 0x104
lea eax, [ebp - 0x230]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x416ac4
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4169c6
sub eax, edx
mov ecx, edi
mov edx, dword [edi + 0x10]
sar eax, 1
cmp dword [edi + 0x14], 8
jb 0x4169e2
mov ecx, dword [edi]
cmp edx, eax
jne 0x416a7b
push edx
lea edx, [ebp - 0x218]
call fcn.0042a890
add esp, 4
test eax, eax
jne 0x416a7b
xorps xmm0, xmm0
mov dword [ebp - 0x21c], eax
movq qword [ebp - 0x224], xmm0
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
cmp byte [ebp - 0x231], 0
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x224]
mov edx, dword [ebp + 8]
je 0x416a43
push 0x20119
jmp 0x416a48
push 0x20219
push eax
call fcn.004533d0
add esp, 8
test al, al
jne 0x416a81
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x416a6c
push eax
call ebx
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
jmp 0x416970
inc esi
jmp 0x416970
sub esp, 8
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x416a9e
lock inc dword [eax + 4]
mov eax, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x224]
call fcn.00416330
mov eax, dword [ebp - 0x224]
add esp, 8
test eax, eax
je 0x416ac4
push eax
call ebx
mov eax, dword [ebp + 8]
test eax, eax
je 0x416ad5
push eax
call ebx
mov dword [ebp + 8], 0
mov dword [ebp + 0xc], 0
mov dword [ebp - 4], 4
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x416b0b
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x416b0b
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x416b0b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ea9ac
mov esp, ebp
pop ebp
ret
Function at 0x41f390
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x560765
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5b63ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 7
mov word [ebx + 0x18], ax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], 7
mov word [ebx + 0x30], ax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], 7
mov word [ebx + 0x48], ax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x74], 7
mov word [ebx + 0x60], ax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x8c], 7
mov word [ebx + 0x78], ax
mov byte [ebp - 4], 5
lea edi, [ebx + 0x90]
mov dword [ebp - 0x18], edi
push eax
mov dword [edi], eax
push eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
call fcn.00435750
mov dword [edi + 4], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [ebp - 4], 7
lea ecx, [edi + 0xc]
push 0x10
mov dword [edi], 0x3f800000
call fcn.0042b810
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], ecx
lea ecx, [edi + 0xc]
push 0x10
call fcn.0042b2a0
mov dword [edi + 0x18], 7
mov eax, ebx
mov dword [edi + 0x1c], 8
mov byte [ebx + 0xb4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret