joyce8/EMBER2024-capa huggingface dataset:
Function at 0x721508
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x7b09f8
test esi, esi
jne 0x721522
xor eax, eax
jmp 0x721613
cmp dword [ebp], 0
jne 0x72152d
call fcn.00721498
xor ebx, 0xffffffff
cmp edi, 8
jb 0x7215ed
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x721539
test edi, edi
jbe 0x72160e
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x7215f1
or eax, 0xffffffff
xor eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x72c340
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetCurrentProcessId
push eax
call sub.KERNEL32.DLL_ProcessIdToSessionId
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 5
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.wtsapi32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x72c3aa
xor eax, eax
push ebp
push 0x72c3a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040a80c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72c3aa
mov eax, dword [ebp - 8]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x734754
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x160], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x7348d2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x7348f0
lea eax, [ebp - 0x15c]
mov edx, ebx
mov ecx, 0
call fcn.0040ae18
push dword [ebp - 0x15c]
push 0x734900
lea eax, [ebp - 0x160]
mov edx, esi
mov ecx, 0
call fcn.0040ae18
push dword [ebp - 0x160]
lea eax, [ebp - 0x158]
mov edx, 4
call fcn.0040ae88
mov edx, dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov ecx, 0xff
call fcn.0040ae64
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x44
call fcn.00407d38
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], 1
mov word [ebp - 0x14], di
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x168]
mov edx, ebx
call fcn.0040b458
mov eax, dword [ebp - 0x168]
lea edx, [ebp - 0x164]
call fcn.00426614
mov eax, dword [ebp - 0x164]
call fcn.0040b2d0
push eax
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0x154]
call fcn.0040b458
mov eax, dword [ebp - 0x16c]
call fcn.0040b2d0
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x7348a4
push 0xffffffffffffffff
mov eax, dword [ebp - 0x54]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
mov eax, dword [ebp - 0x54]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x50]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7348d9
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.0040a6e4
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.0040a714
ret
Function at 0x43aa98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x43aaa7
pop dword [ebp - 0x28]
mov eax, 0x43aaa7
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x50f58
push 0
mov eax, 0x5acfe30c
add eax, 0xa574cfa4
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x54787f2f
add ecx, 0xab87c7db
xor edi, edi
add edi, eax
mov esi, 0x7a55e777
add esi, 0x85f2a689
add esi, dword [ebp - 0x28]
mov ebx, 0x41a4d70b
sub ebx, 0xc0bf0d8c
mov dword [ebp - 0x14], 0xb0b30791
mov edx, dword [esi]
xor edx, ebx
xor dword [ebp - 0x10], esi
mov dword [edi], edx
add edi, 0x511ead8b
sub edi, 0x511ead87
add esi, 4
loop 0x43ab03
add eax, 0xb31798f6
sub eax, 0xb31689fb
mov ebx, eax
add eax, 0x3555f38e
add eax, 0xcaaa0c77
mov ecx, 0xa654fb7e
sub ecx, 0xa614fb7e
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x100167e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x100167f2
pop dword [ebp - 0x4c]
mov eax, 0x100167f2
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x7392a71b
sub dword [ebp - 0x5c], 0x254061d0
mov dword [ebp - 0x58], 0xc4cbee10
add dword [ebp - 0x58], 0x6d675e35
mov dword [ebp - 0x54], 0xb3aeae8b
add dword [ebp - 0x54], 0x989d95a3
mov dword [ebp - 0x50], 0xa959912c
add dword [ebp - 0x50], 0x56a66ed4
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x94744c5
sub dword [ebp - 0x5c], 0x94d4db6f
mov dword [ebp - 0x58], 0xec8a5841
add dword [ebp - 0x58], 0x54e20934
mov dword [ebp - 0x54], 0x5b7722a6
add dword [ebp - 0x54], 0x7f849c6
mov dword [ebp - 0x50], 0x16979196
add dword [ebp - 0x50], 0xe9686e6a
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x757b061
add eax, 0x8aaa01b
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c30a
push 0
call eax
mov ecx, 0x757424d6
add ecx, 0x8a8c263f
mov edi, eax
mov ebx, 0x10030c00
add ebx, dword [ebp - 0x4c]
mov edx, 0xa6b0d9ae
sub dword [ebp - 0x18], 0x452c052a
mov esi, dword [ebx]
add esi, edx
xor dword [ebp - 0x20], 0x5fdf1c25
mov dword [edi], esi
sub dword [ebp - 0x48], 0xbe33e8d6
add edi, 4
add ebx, 0x96f3c3f8
sub ebx, 0x96f3c3f4
loop 0x100168fe
add eax, 0xe6c0bc34
sub eax, 0xe6bf9d0d
mov ebx, eax
add eax, 0x1dfed328
add eax, 0xe2012cdd
mov ecx, 0xef41f1e5
sub ecx, 0xdf41f1e5
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x1001c940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c9db
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c992
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c992
cmp esi, ebx
jge 0x1001c992
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c9d5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c9d5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c9ed
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..00cfg
mov ebx, 0x408ecc
nop
mov ecx, 0x163c7772
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x45695a9d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4019c2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc10
push edi
xor edi, edi
push edi
push 0x3fc
lea eax, [ebp - 0xc10]
push eax
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x401a94
push 0xf003f
push 1
push edi
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
cmp eax, edi
mov dword [ebp - 8], eax
je 0x401a94
push 0x7fe
lea eax, [ebp - 0x812]
push edi
push eax
mov dword [ebp - 0xc], 0x400
mov word [ebp - 0x814], di
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 4], edi
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x10], 0x400
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
cmp ebx, edi
jne 0x401a7f
push 0x401238
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
je 0x401a8a
inc dword [ebp - 4]
cmp ebx, 0x103
jne 0x401a39
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
leave
ret
Function at 0x404897
Capabilities:
Access peb ldr_data

Disassembly:
push esp
call fcn.004026f2
out dx, eax
xchg esp, eax
cmp dh, byte [edx]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
add byte [ebx + 0x708b0c40], cl
sbb al, 0xad
cmp byte [eax + 0x1c], 0x18
je 0x4048b6
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.004026f2
ror dh, cl
pushfd
mov al, byte [0x478bf88b]
cmp al, 0x8b
push esp
pop es
js 0x4048d0
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.004026f2
jp 0x404954
add edi, dword [edi]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x4048df
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x4048df
call fcn.004026f2
js 0x4048a6
aam 0x6a
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.004026f2
sub esp, dword [edi + 0x75ffe569]
or bh, bh
jne 0x404928
jmp [ebx]
push dword [ebp]
call fcn.00402ef2
call dword [eax + 0x6a]
jge 0x404919
invalid
sbb dl, 0xff
call [ecx + 0x59]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0xaa8]
push eax
call esi
lea eax, [ebp - 0x208]
push eax
push 0x7e
call fcn.004023b5
pop ecx
pop ecx
call [ecx + 0x59]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0xaa8]
push eax
call esi
lea eax, [ebp - 0x208]
push eax
push 0x7f
call fcn.004023b5
pop ecx
pop ecx
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0xaa8]
push eax
call esi
lea eax, [ebp - 0x208]
push eax
push 0x80
call fcn.004023b5
pop ecx
pop ecx
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0xaa8]
push eax
call esi
lea eax, [ebp - 0x208]
push eax
push 0x8e
call fcn.004023b5
pop ecx
pop ecx
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0xaa8]
push eax
call esi
lea eax, [ebp - 0x208]
push eax
push 0x8f
call fcn.004023b5
pop ecx
pop ecx
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0xaa8]
push eax
call esi
lea eax, [ebp - 0x208]
push eax
push 0x90
call fcn.004023b5
pop ecx
pop ecx
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0xaa8]
push eax
call esi
push edi
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0xaa8]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
leave
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x40de38
nop
mov ecx, 0x532753a6
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data_1
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x76ac2d55
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x402978
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
xor eax, eax
lea edx, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0xffffffff
push edx
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x4029d6
push eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp + 0xc]
push eax
push 0x456a8c
push edx
call sub.USER32.DLL_wsprintfA
add esp, 0x10
mov eax, 1
jmp 0x402abe
xor edx, edx
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryInfoKeyA
cmp dword [ebp - 0x18], 0
jge 0x402a08
mov edx, dword [ebp - 8]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 8], 0
je 0x402aa9
test eax, eax
jne 0x402aa9
xor ebx, ebx
cmp ebx, dword [ebp - 8]
jae 0x402a9f
mov dword [ebp - 0xc], 0x100
mov byte [ebp - 0x118], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x118]
push edx
push ebx
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x402a9f
push esi
call fcn.00447ae8
pop ecx
push eax
push esi
lea eax, [ebp - 0x118]
push eax
call fcn.00447ce4
add esp, 0xc
test eax, eax
jne 0x402a99
lea edx, [ebp - 0x118]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push edi
call fcn.0040314c
add esp, 0xc
test eax, eax
jne 0x402a9f
inc dword [ebp - 0x14]
cmp dword [edi + 0x304], 0
je 0x402a99
mov dword [ebp - 0x10], 1
jmp 0x402a9f
inc ebx
cmp ebx, dword [ebp - 8]
jb 0x402a21
cmp dword [ebp - 0x10], 0
jne 0x4029d6
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x18]
sete al
and eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402ac8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push edi
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x402bec
xor edx, edx
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryInfoKeyA
cmp dword [ebp - 8], 0
je 0x402be3
test eax, eax
jne 0x402be3
xor ebx, ebx
cmp ebx, dword [ebp - 8]
jae 0x402bd9
mov dword [ebp - 0xc], 0x100
mov byte [ebp - 0x110], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x110]
push edx
push ebx
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x402bd9
push esi
xor eax, eax
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x210]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x110]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x210]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push eax
push edx
call fcn.00447a58
add esp, 8
push 0x456aaa
lea ecx, [ebp - 0x210]
push ecx
call fcn.00447a58
add esp, 8
mov eax, dword [ebp + 0x10]
push eax
lea edx, [ebp - 0x210]
push edx
push esi
call fcn.00402978
add esp, 0xc
inc ebx
cmp ebx, dword [ebp - 8]
jb 0x402b3b
cmp dword [ebp - 0x10], 0
jne 0x402af8
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402bf4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push edi
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x402ceb
xor edx, edx
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryInfoKeyA
cmp dword [ebp - 8], 0
je 0x402ce2
test eax, eax
jne 0x402ce2
xor ebx, ebx
cmp ebx, dword [ebp - 8]
jae 0x402cd8
mov dword [ebp - 0xc], 0x100
mov byte [ebp - 0x110], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x110]
push edx
push ebx
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x402cd8
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x110]
push ecx
push edi
push esi
call fcn.00402cf4
add esp, 0x14
test eax, eax
je 0x402cd2
lea eax, [ebp - 0x110]
push eax
push edi
push esi
call fcn.0040314c
add esp, 0xc
cmp dword [esi + 0x304], 0
je 0x402cd2
mov dword [ebp - 0x10], 1
jmp 0x402cd8
inc ebx
cmp ebx, dword [ebp - 8]
jb 0x402c63
cmp dword [ebp - 0x10], 0
jne 0x402c24
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402cf4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x18]
mov edi, eax
xor eax, eax
push esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x10c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x10c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, dword [ebp + 0x10]
push eax
push edx
call fcn.00447a58
add esp, 8
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push 0
lea eax, [ebp - 0x10c]
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov ebx, eax
test ebx, ebx
je 0x402d66
xor eax, eax
jmp 0x402dc6
mov dword [ebp - 0xc], 0x100
mov byte [ebp - 0x10c], 0
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 0x10c]
push ecx
lea eax, [ebp - 8]
push eax
push 0
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
test ebx, ebx
jne 0x402dc4
push esi
call fcn.00447ae8
pop ecx
push eax
push esi
lea edx, [ebp - 0x10c]
push edx
call fcn.00447ce4
add esp, 0xc
test eax, eax
jne 0x402dc4
mov eax, 1
jmp 0x402dc6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402dd0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push edi
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x402e90
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegQueryInfoKeyA
cmp dword [ebp - 8], 0
je 0x402e2b
test eax, eax
je 0x402e36
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x402e90
xor ebx, ebx
cmp ebx, dword [ebp - 8]
jae 0x402e87
mov dword [ebp - 0xc], 0x100
mov byte [ebp - 0x10c], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x10c]
push edx
push ebx
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x402e87
mov eax, dword [ebp + 0x10]
push eax
lea edx, [ebp - 0x10c]
push edx
push edi
push esi
call fcn.00402e98
add esp, 0x10
inc ebx
cmp ebx, dword [ebp - 8]
jb 0x402e3d
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret