joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e400
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x820], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0x400
mov dword [ebp - 0x10], 1
xor eax, eax
mov word [ebp - 0x818], ax
push ecx
mov ecx, esp
lea edx, [ebp + 0xc]
push edx
call fcn.0041c880
mov ecx, dword [ebp - 0x820]
call fcn.0042e5a0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0x42e487
cmp dword [ebp - 4], 2
je 0x42e487
cmp dword [ebp - 4], 7
je 0x42e487
lea eax, [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041c880
lea ecx, [ebp + 0xc]
call fcn.0040f740
lea ecx, [ebp + 0x10]
call fcn.0040f740
mov eax, dword [ebp + 8]
jmp 0x42e583
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x820]
mov eax, dword [edx + 4]
or eax, 0x20019
push eax
push 0
mov ecx, dword [ebp - 0x820]
add ecx, 0x10
call fcn.0041cb20
push eax
mov ecx, dword [ebp - 0x820]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x820]
mov dword [ecx], eax
mov edx, dword [ebp - 0x820]
cmp dword [edx], 0
je 0x42e4f2
lea eax, [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041c880
lea ecx, [ebp + 0xc]
call fcn.0040f740
lea ecx, [ebp + 0x10]
call fcn.0040f740
mov eax, dword [ebp + 8]
jmp 0x42e583
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x818]
push edx
lea eax, [ebp - 4]
push eax
push 0
lea ecx, [ebp + 0xc]
call fcn.0041cb20
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x820]
mov dword [edx], eax
mov eax, dword [ebp - 0x820]
cmp dword [eax], 0
je 0x42e530
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
jne 0x42e561
lea edx, [ebp + 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041c880
lea ecx, [ebp + 0xc]
call fcn.0040f740
lea ecx, [ebp + 0x10]
call fcn.0040f740
mov eax, dword [ebp + 8]
jmp 0x42e583
lea eax, [ebp - 0x818]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041c8a0
lea ecx, [ebp + 0xc]
call fcn.0040f740
lea ecx, [ebp + 0x10]
call fcn.0040f740
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42e5a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
or edx, 1
push edx
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x10
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
je 0x42e5f3
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0xc]
jmp 0x42e65d
mov dword [ebp - 4], 1
push 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0
lea ecx, [ebp + 8]
call fcn.0041cb20
push eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0
jne 0x42e641
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x10]
jmp 0x42e65d
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], 0
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x42ed80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ecx, [ebp + 0x10]
call fcn.0041cb20
mov dword [ebp - 4], eax
lea ecx, [ebp + 0x14]
call fcn.0041cb20
mov dword [ebp - 0xc], eax
push 0x55451c
lea eax, [ebp + 0xc]
push eax
call fcn.0041cac0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x42eef5
lea edx, [ebp - 8]
push edx
push 0x20019
push 0
mov eax, dword [ebp - 4]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42eef5
mov dword [ebp - 0xb4], 0x208
lea ecx, [ebp - 0xb4]
push ecx
lea edx, [ebp - 0xb0]
push edx
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xb8], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xb8], 0
jne 0x42eecb
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0041c8a0
lea ecx, [ebp - 0xbc]
call fcn.0041cc20
test eax, eax
jle 0x42ee8b
lea ecx, [ebp - 0xbc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041c880
lea ecx, [ebp - 0xbc]
call fcn.0040f740
lea ecx, [ebp + 0xc]
call fcn.0040f740
lea ecx, [ebp + 0x10]
call fcn.0040f740
lea ecx, [ebp + 0x14]
call fcn.0040f740
mov eax, dword [ebp + 8]
jmp 0x42ef1d
push 0x554518
mov ecx, dword [ebp + 8]
call fcn.0041c8a0
lea ecx, [ebp - 0xbc]
call fcn.0040f740
lea ecx, [ebp + 0xc]
call fcn.0040f740
lea ecx, [ebp + 0x10]
call fcn.0040f740
lea ecx, [ebp + 0x14]
call fcn.0040f740
mov eax, dword [ebp + 8]
jmp 0x42ef1d
push 0x554518
mov ecx, dword [ebp + 8]
call fcn.0041c8a0
lea ecx, [ebp + 0xc]
call fcn.0040f740
lea ecx, [ebp + 0x10]
call fcn.0040f740
lea ecx, [ebp + 0x14]
call fcn.0040f740
mov eax, dword [ebp + 8]
jmp 0x42ef1d
push 0x554518
mov ecx, dword [ebp + 8]
call fcn.0041c8a0
lea ecx, [ebp + 0xc]
call fcn.0040f740
lea ecx, [ebp + 0x10]
call fcn.0040f740
lea ecx, [ebp + 0x14]
call fcn.0040f740
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret
Function at 0x42ef30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 4
mov dword [ebp - 8], 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
or edx, 0x20019
push edx
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42ef8a
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x14]
jmp 0x42efd0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 4]
push edx
push 0
lea ecx, [ebp + 8]
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x42efb5
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 8

Function at 0x42efe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00512af0
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push 0x8026
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x42f048
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041c8a0
mov eax, dword [ebp + 8]
jmp 0x42f058
push 0x554518
mov ecx, dword [ebp + 8]
call fcn.0041c8a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret 4

Function at 0x42f0c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00512af0
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x42f125
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041c8a0
mov eax, dword [ebp + 8]
jmp 0x42f135
push 0x554518
mov ecx, dword [ebp + 8]
call fcn.0041c8a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret 4
Function at 0x42f150
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x88], ecx
push 0x40
push 0
mov eax, dword [ebp - 0x88]
add eax, 0x600
push eax
call fcn.00512af0
add esp, 0xc
push 0x40
push 0
mov ecx, dword [ebp - 0x88]
add ecx, 0x640
push ecx
call fcn.00512af0
add esp, 0xc
push 8
push 0
mov edx, dword [ebp - 0x88]
add edx, 0x680
push edx
call fcn.00512af0
add esp, 0xc
push 8
push 0
mov eax, dword [ebp - 0x88]
add eax, 0x688
push eax
call fcn.00512af0
add esp, 0xc
push 0x41
push 0
mov ecx, dword [ebp - 0x88]
add ecx, 0x690
push ecx
call fcn.00512af0
add esp, 0xc
push 0x11
push 0
mov edx, dword [ebp - 0x88]
add edx, 0x6d1
push edx
call fcn.00512af0
add esp, 0xc
push 9
push 0
mov eax, dword [ebp - 0x88]
add eax, 0x6e2
push eax
call fcn.00512af0
add esp, 0xc
push 0x1000
push 0
mov ecx, dword [ebp - 0x88]
add ecx, 0x6eb
push ecx
call fcn.00512af0
add esp, 0xc
push 0x1000
push 0
mov edx, dword [ebp - 0x88]
add edx, 0x16eb
push edx
call fcn.00512af0
add esp, 0xc
mov byte [ebp - 0x48], 0
push 0x3f
push 0
lea eax, [ebp - 0x47]
push eax
call fcn.00512af0
add esp, 0xc
push 0x40
lea ecx, [ebp - 0x48]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x88]
call fcn.0042f550
mov byte [ebp - 0x80], 0
push 0x37
push 0
lea eax, [ebp - 0x7f]
push eax
call fcn.00512af0
add esp, 0xc
mov dword [ebp - 0x84], 0
jmp 0x42f2a5
mov ecx, dword [ebp - 0x84]
add ecx, 1
mov dword [ebp - 0x84], ecx
cmp dword [ebp - 0x84], 0x38
jge 0x42f2cb
mov edx, dword [ebp - 0x84]
movsx eax, byte [edx + str.91__]
mov ecx, dword [ebp - 0x84]
mov dl, byte [ebp + eax - 0x49]
mov byte [ebp + ecx - 0x80], dl
jmp 0x42f296
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x80]
push ecx
mov ecx, dword [ebp - 0x88]
call fcn.0042f2f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret 8
Function at 0x42f870
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], ecx
mov byte [ebp - 0x68], 0
push 0x3f
push 0
lea eax, [ebp - 0x67]
push eax
call fcn.00512af0
add esp, 0xc
mov byte [ebp - 0xc8], 0
push 0x3f
push 0
lea ecx, [ebp - 0xc7]
push ecx
call fcn.00512af0
add esp, 0xc
mov byte [ebp - 0x24], 0
xor edx, edx
mov dword [ebp - 0x23], edx
mov dword [ebp - 0x1f], edx
mov dword [ebp - 0x1b], edx
mov dword [ebp - 0x17], edx
mov dword [ebp - 0x13], edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov word [ebp - 7], dx
mov byte [ebp - 5], dl
mov byte [ebp - 0x88], 0
xor eax, eax
mov dword [ebp - 0x87], eax
mov dword [ebp - 0x83], eax
mov dword [ebp - 0x7f], eax
mov dword [ebp - 0x7b], eax
mov dword [ebp - 0x77], eax
mov dword [ebp - 0x73], eax
mov dword [ebp - 0x6f], eax
mov word [ebp - 0x6b], ax
mov byte [ebp - 0x69], al
mov byte [ebp - 0x108], 0
push 0x3f
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.00512af0
add esp, 0xc
push 0x40
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x114]
call fcn.0042f550
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp - 0x68]
push edx
mov ecx, dword [ebp - 0x114]
call fcn.0042fc20
push 0x20
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.00511ce0
add esp, 0xc
push 0x20
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x88]
push eax
call fcn.00511ce0
add esp, 0xc
mov dword [ebp - 0x10c], 0
jmp 0x42f991
mov ecx, dword [ebp - 0x10c]
add ecx, 1
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x10c], 0x10
jge 0x42f9bd
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp - 0x114]
call fcn.0042fa70
jmp 0x42f982
push 0x20
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.00511ce0
add esp, 0xc
push 0x20
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0xe8]
push eax
call fcn.00511ce0
add esp, 0xc
mov dword [ebp - 0x110], 0
jmp 0x42fa05
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
cmp dword [ebp - 0x110], 0x40
jge 0x42fa36
mov edx, dword [ebp - 0x110]
movsx eax, byte [edx + 0x54cd60]
mov ecx, dword [ebp - 0x114]
add ecx, dword [ebp - 0x110]
mov dl, byte [ebp + eax - 0x109]
mov byte [ecx + 0x600], dl
jmp 0x42f9f6
push 0x40
mov eax, dword [ebp - 0x114]
add eax, 0x600
push eax
mov ecx, dword [ebp - 0x114]
add ecx, 0x680
push ecx
mov ecx, dword [ebp - 0x114]
call fcn.0042fe80
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret 8

Function at 0x42fc20
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x42fc3b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x40
jge 0x42fc5c
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + str.:2_]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + edx - 1]
mov byte [eax], dl
jmp 0x42fc32
mov esp, ebp
pop ebp
ret 8
Function at 0x42fc70
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x42fc8b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x30
jge 0x42fcac
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x54cb10]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + edx - 1]
mov byte [eax], dl
jmp 0x42fc82
mov esp, ebp
pop ebp
ret 8

Function at 0x42fe30
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x42fe4b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jge 0x42fe6c
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x54cd40]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + edx - 1]
mov byte [eax], dl
jmp 0x42fe42
mov esp, ebp
pop ebp
ret 8

Function at 0x4306f0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x438], ecx
mov dword [ebp - 0x430], 0x428
push 0x424
push 0
lea eax, [ebp - 0x42c]
push eax
call fcn.00512af0
add esp, 0xc
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0xffffffff
jne 0x430745
xor eax, eax
jmp 0x4307c4
lea ecx, [ebp - 0x430]
push ecx
mov edx, dword [ebp - 0x434]
push edx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x4307a8
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 0x41c]
cmp eax, dword [ebp - 0x418]
jae 0x430791
lea ecx, [ebp - 0x410]
push ecx
mov edx, dword [ebp - 0x438]
add edx, 0x10
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x41c]
mov dword [eax], ecx
jmp 0x4307a8
lea edx, [ebp - 0x430]
push edx
mov eax, dword [ebp - 0x434]
push eax
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x43075c
mov ecx, dword [ebp - 0x434]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x438]
add eax, 0x10
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret 8
Function at 0x4307e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x244], ecx
xor eax, eax
mov ecx, dword [ebp + 8]
mov word [ecx], ax
mov dword [ebp - 0x240], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x238], 0x22c
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x240]
push eax
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x23c]
call fcn.0040ee90
cmp dword [ebp - 4], 0
je 0x430887
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005180b0
add esp, 8
push 0x5548d8
mov eax, dword [ebp + 8]
push eax
call fcn.005180b0
add esp, 8
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x240]
push edx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 4], eax
jmp 0x430845
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x23c]
call fcn.0040f740
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret 4

Function at 0x431250
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x828], ecx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x828]
mov edx, dword [ecx + 4]
or edx, 0x20019
push edx
push 0
mov ecx, dword [ebp - 0x828]
add ecx, 0x10
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0x828]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4312a9
xor eax, eax
jmp 0x431362
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xc]
call fcn.0040ee90
mov dword [ebp - 0x10], 0x80
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x818]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x431322
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0x81c]
call fcn.0041c8a0
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0048b1e0
lea ecx, [ebp - 0x81c]
call fcn.0040f740
mov dword [ebp - 0x10], 0x80
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x4312bf
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x43134a
mov dword [ebp - 0x820], 0
lea ecx, [ebp - 0xc]
call fcn.0040f740
mov eax, dword [ebp - 0x820]
jmp 0x431362
mov dword [ebp - 0x824], 1
lea ecx, [ebp - 0xc]
call fcn.0040f740
mov eax, dword [ebp - 0x824]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret 4
Function at 0x431380
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00512af0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x214]
call fcn.0041c8a0
lea ecx, [ebp - 0x214]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041c880
lea ecx, [ebp - 0x214]
call fcn.0040f740
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret 4
Function at 0x442c90
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], ecx
mov byte [ebp - 0x68], 0
push 0x3f
push 0
lea eax, [ebp - 0x67]
push eax
call fcn.00512af0
add esp, 0xc
mov byte [ebp - 0xc8], 0
push 0x3f
push 0
lea ecx, [ebp - 0xc7]
push ecx
call fcn.00512af0
add esp, 0xc
mov byte [ebp - 0x24], 0
xor edx, edx
mov dword [ebp - 0x23], edx
mov dword [ebp - 0x1f], edx
mov dword [ebp - 0x1b], edx
mov dword [ebp - 0x17], edx
mov dword [ebp - 0x13], edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov word [ebp - 7], dx
mov byte [ebp - 5], dl
mov byte [ebp - 0x88], 0
xor eax, eax
mov dword [ebp - 0x87], eax
mov dword [ebp - 0x83], eax
mov dword [ebp - 0x7f], eax
mov dword [ebp - 0x7b], eax
mov dword [ebp - 0x77], eax
mov dword [ebp - 0x73], eax
mov dword [ebp - 0x6f], eax
mov word [ebp - 0x6b], ax
mov byte [ebp - 0x69], al
mov byte [ebp - 0x108], 0
push 0x3f
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.00512af0
add esp, 0xc
push 0x40
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x114]
call fcn.0042f550
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp - 0x68]
push edx
mov ecx, dword [ebp - 0x114]
call fcn.0042fc20
push 0x20
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x88]
push ecx
call fcn.00511ce0
add esp, 0xc
push 0x20
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.00511ce0
add esp, 0xc
mov dword [ebp - 0x10c], 0
jmp 0x442db1
mov ecx, dword [ebp - 0x10c]
add ecx, 1
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x10c], 0x10
jge 0x442de2
mov edx, dword [ebp + 0xc]
push edx
mov eax, 0xf
sub eax, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x88]
push edx
mov ecx, dword [ebp - 0x114]
call fcn.0042fa70
jmp 0x442da2
push 0x20
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.00511ce0
add esp, 0xc
push 0x20
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0xe8]
push eax
call fcn.00511ce0
add esp, 0xc
mov dword [ebp - 0x110], 0
jmp 0x442e2a
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
cmp dword [ebp - 0x110], 0x40
jge 0x442e5b
mov edx, dword [ebp - 0x110]
movsx eax, byte [edx + 0x54cd60]
mov ecx, dword [ebp - 0x114]
add ecx, dword [ebp - 0x110]
mov dl, byte [ebp + eax - 0x109]
mov byte [ecx + 0x640], dl
jmp 0x442e1b
push 0x40
mov eax, dword [ebp - 0x114]
add eax, 0x640
push eax
mov ecx, dword [ebp - 0x114]
add ecx, 0x688
push ecx
mov ecx, dword [ebp - 0x114]
call fcn.0042fe80
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret 8
Function at 0x452e00
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
or edx, 2
push edx
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x10
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x452e4a
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0xc]
jmp 0x452e96
lea ecx, [ebp + 8]
call fcn.0041cb20
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x452e84
mov dword [ebp - 0x10], 1
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x10]
jmp 0x452e96
mov dword [ebp - 0x14], 0
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4

Function at 0x452ea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 4
mov dword [ebp - 8], 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
or edx, 0x20019
push edx
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x452efa
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x14]
jmp 0x452f40
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 4]
push edx
push 0
lea ecx, [ebp + 8]
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x452f25
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 8