joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
pop eax
dec eax
pop eax
push dword [0x405cf4]
lea ecx, [ecx + 0x62]
mov edi, dword [esp]
or ebx, edi
imul dword [esp + 0x54]
lea ebx, [edx]
mov bl, cl
mov cl, bl
lea edx, [esp]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
or ebx, esp
inc dword [0x405e36]
or ebx, 0x3bc79b
cmp eax, 0x6a
jb 0x401296
jne 0x4012ae
mov ebx, 0x402f62
lea ecx, [eax]
pop dword [0x405b01]
push 0x21
pop edi
sub edi, dword [0x403f93]
xor ebx, eax
mov bl, 0x98
push 0x405a2b
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov eax, dword [ebp]
mov dword [0x405ced], 0x4055d6
jbe 0x4012bf
and ebx, edx
add bh, bh
sbb ebx, ebp
mov eax, dword fs:[0x30]
jbe 0x4012d0
add bh, al
lea ebx, [eax + edx]
sbb ebx, eax
mov edx, eax
mov bl, al
jbe 0x4012da
sbb ebx, ecx
add ebx, edi
lea ebx, [eax]
mov eax, dword [edx + 0x2c]
mov bl, cl
mov cl, 0xa9
mov cl, bl
and ebx, esp
mov cl, byte [eax + 0x6f]
jae 0x4012f4
sub ebx, eax
mov ebx, ecx
mov ecx, ebx
shr eax, 0x10
sub ebx, edx
add bl, al
sub cl, ah
je 0x401322
sub dword [ebp + 8], ecx
mov dword [0x405fa8], 0x404bc9
or ebx, 0xffffffff
push esp
add bh, bh
add ecx, ecx
call dword [sym.imp.KERNEL32.dll__lclose]
lea ebx, [0x40303b]
leave
ret
and ebx, ebp
lea edx, [edx]
jae 0x40132a
add ebx, esi
add bl, cl
mov eax, dword [edx + 0xc]
not ebx
dec bl
mov esi, dword [eax + 0x1c]
jbe 0x40133c
or ebx, ecx
mov ebx, eax
lodsd eax, dword [esi]
sbb ebx, edi
mov eax, dword [eax + 8]
jbe 0x40134a
mov ebx, eax
mov eax, ebx
add bl, ch
jbe 0x401350
sub ebx, ebp
xor ebx, edi
mov edx, dword [eax + 0x3c]
lea edx, [edx]
jbe 0x40135d
inc bh
pop ebx
sub esp, 4
add edx, 0x104
add eax, dword [eax + edx]
or ebx, edx
neg bh
or ebx, edi
inc eax
jbe 0x401374
lea eax, [eax]
add bh, 8
mov ecx, dword [eax]
dec bl
and ecx, dword [eax + 4]
mov eax, eax
add bl, ch
add ecx, 0x4021e6
mov ebx, esp
cmp ecx, 0x558322b
jne 0x40136a
lea ebx, [eax + ecx]
add ebx, ebx
xchg edx, eax
mov ebx, ebp
or ebx, esi
sub edx, 1
and ebx, ebp
mov eax, dword [edx]
xor ebx, 0x49
and eax, 0xffff
lea ebx, [ebx]
add eax, 0x402412
and ebx, ebp
sub eax, 0x40af67
jne 0x401397
or ebx, esp
jbe 0x4013be
mov ebx, ebp
xor dword [0x405fda], edx
add ebx, eax
push 0x405fef
jae 0x4013d3
sbb ebx, ecx
mov bl, al
mov al, bl
push 0x2f
add dword [esp], 0x11
and ebx, esi
push 0x2fd0
jg 0x4013e4
not ebx
sbb ebx, edx
push 0x40121c
mov ebx, ebx
sub ebx, esp
push 0xfffffffffffffffe
xor ebx, edi
inc dword [esp]
lea ebx, [edx]
sub ebx, ebp
add bh, 8
or ebx, 0x4240a6
jg 0x40140a
sub ebx, ebp
lea ebx, [eax + edi]
mov ebx, dword [0x405fda]
call ebx
sbb ebx, eax
lea ecx, [0x403c86]
jg 0x40141e
mov ebx, eax
sub ecx, 0x403bf0
sbb ebx, edx
mov edx, 0x401502
sub ebx, eax
mov edi, 0xeb
xor dword [edx], edi
lea ebx, [eax + edx]
add bl, bl
mov ebx, ecx
mov ecx, ebx
mov esi, dword [edx]
sbb ebx, eax
and ebx, edi
add esi, 4
mov dword [edx], esi
jbe 0x401451
mov ebx, ebp
sub ebx, ebp
jbe 0x401457
add bh, bl
inc bh
add edx, 0xffffffff
or ebx, esp
jg 0x401460
xor ebx, ebx
lea ebx, [edi]
sub ecx, 1
jne 0x40142b
lea ebx, ds:[esp]
mov eax, eax
invalid
Function at 0x40284b
Capabilities:
Hide graphical window

Disassembly:
dec eax
je 0x4028bc
dec eax
je 0x40288d
dec eax
je 0x402864
dec eax
jne 0x4028d5
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x4028d5
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00408e37
mov eax, dword [eax + 4]
test eax, eax
je 0x4028d5
push 0
push 0
push 0x503
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
jmp 0x4028d5
mov ecx, dword [esi + 4]
push ebx
push 0
push 0
push 0x435350
mov edx, 0x435624
call fcn.0041672f
add esp, 0xc
push 1
push 0x3ea
lea ebx, [esi + reloc.WININET.dll_InternetSetOptionW]
call fcn.00418441
pop ebx
jmp 0x4028d5
mov ecx, dword [esi + 4]
push 0
push 0
push 0x435350
mov edx, 0x4355f4
call fcn.0041672f
add esp, 0xc
xor eax, eax
ret

Function at 0x402aa8
Capabilities:
Create thread
Terminate process

Disassembly:
push 8
push 0x43ba78
call fcn.00421c3c
push 0x8007
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [ebp + 8]
mov dword [0x440868], eax
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00404c45
mov ecx, eax
call fcn.00404c90
test eax, eax
je 0x402bb7
call fcn.00402d28
call fcn.0040c3ac
mov dword [ebp + 8], edi
lea ecx, [ebp + 8]
push ecx
push edi
push eax
push 0x40c403
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
je 0x402b0b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00404c45
mov eax, dword [eax + 0xc]
mov dword [ebp + 8], eax
cmp eax, edi
jne 0x402b4c
push edi
push 0x43f458
push 0x44087c
call sub.gdiplus.dll_GdiplusStartup
call fcn.00419b1a
mov esi, eax
mov ecx, esi
call fcn.00419efe
test eax, eax
je 0x402b46
push esi
call fcn.0041a181
test eax, eax
jne 0x402b4c
push esi
call fcn.00419b56
call fcn.00404c45
mov ecx, eax
call fcn.0040538f
test eax, eax
je 0x402b98
call fcn.00404c45
cmp dword [eax + 8], 2
je 0x402b8d
call fcn.00408e37
mov ebx, eax
mov ecx, ebx
call fcn.0040b663
call fcn.00404c45
mov eax, dword [eax + 8]
xor esi, esi
inc esi
cmp eax, esi
jne 0x402b90
mov eax, ebx
call fcn.0040b91b
jmp 0x402b90
xor esi, esi
inc esi
call fcn.004065a1
mov dword [eax + 8], esi
cmp dword [ebp + 8], edi
jne 0x402bb2
mov eax, dword [0x44087c]
cmp eax, edi
je 0x402bb2
push eax
call sub.gdiplus.dll_GdiplusShutdown
mov dword [0x44087c], edi
call fcn.00402c9b
mov dword [ebp - 4], 0xfffffffe
jmp 0x402be3
call fcn.00404c45
cmp dword [eax + 8], 3
je 0x402bfa
call fcn.00404c45
mov esi, eax
call fcn.004055a1
call fcn.004065a1
mov ebx, eax
call fcn.004065c7
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
call fcn.00421c81
ret 0x10
Function at 0x4038bd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x4038cb
push 0xd
pop eax
jmp 0x4038fe
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x4038d2
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x403d67
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 4]
push edi
push ecx
push dword [esi]
mov dword [ebp - 0x21c], ecx
xor edi, edi
or eax, 0x2001f
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], edi
call fcn.00403d29
mov ebx, eax
cmp ebx, edi
je 0x403dcd
cmp dword [ebp - 0x214], edi
je 0x403dc6
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x403e65
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x403df5
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.00403d67
mov dword [ebp - 0x220], eax
cmp eax, edi
jne 0x403e76
lea eax, [ebp - 0x228]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x403dd5
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x214], edi
je 0x403e40
push dword [ebp - 0x214]
call ebx
mov dword [ebp - 0x214], edi
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], edi
call fcn.00403ee3
mov esi, eax
cmp dword [ebp - 0x214], edi
je 0x403e63
push dword [ebp - 0x214]
call ebx
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f23c
leave
ret 4
cmp dword [ebp - 0x214], edi
je 0x403e8a
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x220]
jmp 0x403e65

Function at 0x403ee3
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x4409a8], 0
jne 0x403f13
push 0x435938
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403f0c
push 0x435954
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4409ac], eax
mov byte [0x4409a8], 1
mov eax, dword [0x4409ac]
test eax, eax
je 0x403f2b
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x403f37
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4
Function at 0x40538f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4328be
mov eax, dword fs:[0]
push eax
sub esp, 0xda8
mov eax, dword [0x43e030]
xor eax, esp
mov dword [esp + 0xda0], eax
push ebx
push esi
push edi
mov eax, dword [0x43e030]
xor eax, esp
push eax
lea eax, [esp + 0xdb8]
mov dword fs:[0], eax
and dword [esp + 0x10], 0
xor edi, edi
mov ebx, ecx
mov eax, dword [ebx + 8]
inc edi
cmp eax, edi
jne 0x40547a
cmp dword [ebx + 0xc], 0
jne 0x40542e
lea esi, [esp + 0x6d4]
call fcn.00401cc9
and dword [esp + 0xdc0], 0
push 0
mov ebx, esi
call fcn.00405e06
cmp eax, edi
jne 0x40540f
mov dword [esp + 0x10], edi
or dword [esp + 0xdc0], 0xffffffff
mov dword [esp + 0x6d4], 0x43566c
lea ecx, [esp + 0x6d4]
jmp 0x40555d
lea eax, [esp + 0x14]
push 0x7d0
push eax
mov dword [esp + 0x1c], 0x435690
mov dword [esp + 0x20], 0x435650
call fcn.00408e37
call fcn.004097c9
test eax, eax
je 0x405469
call fcn.00408e37
call fcn.0040982b
mov dword [esp + 0x10], eax
jmp 0x405562
call fcn.004065a1
mov dword [eax + 0xc], SetHandleCount
jmp 0x405562
cmp eax, 3
jne 0x405510
mov eax, dword [ebx + 0x14]
neg eax
sbb eax, eax
and eax, 0x7d0
add eax, 0x3e8
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x435690
mov dword [esp + 0x20], 0x435650
call fcn.00408e37
call fcn.004097c9
test eax, eax
je 0x4054c8
call fcn.00408e37
call fcn.0040982b
mov dword [esp + 0x10], eax
jmp 0x4054dd
mov esi, dword [ebx + 0x14]
neg esi
sbb esi, esi
add esi, 0xcc
call fcn.004065a1
mov dword [eax + 0xc], esi
cmp dword [esp + 0x10], 0
je 0x405508
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push 0x435d34
mov edi, 0x435d48
push edi
mov ebx, 0x80000001
push ebx
call esi
push reloc.KERNEL32.dll_SetEndOfFile
push edi
push ebx
call esi
jmp 0x405562
push ebx
call fcn.00405bcb
jmp 0x405562
lea esi, [esp + 0x1c]
call fcn.0040c954
mov dword [esp + 0xdc0], edi
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
mov ebx, esi
call fcn.00405e06
cmp eax, edi
jne 0x405549
call fcn.0040d009
and dword [eax + 0x14], 0
call fcn.0040d009
call fcn.0040d65c
mov dword [esp + 0x10], edi
or dword [esp + 0xdc0], 0xffffffff
mov dword [esp + 0x1c], vtable.CUninstallDlg.0
lea ecx, [esp + 0x1c]
call fcn.004010ef
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xdb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xda0]
xor ecx, esp
call fcn.0041f23c
mov esp, ebp
pop ebp
ret
Function at 0x4055b4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x7c], ax
xor ebx, ebx
lea eax, [ebp - 0x7a]
push ebx
xor edi, edi
push eax
inc edi
call fcn.00421bc0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
push 0x435d80
push esi
call fcn.0041faf6
pop ecx
pop ecx
test eax, eax
jne 0x405620
push 3
jmp 0x40564f
push 0x435650
push esi
call fcn.0041faf6
pop ecx
pop ecx
test eax, eax
je 0x40564d
mov dword [ebp - 0x80], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ebx, [ebp - 0x80]
mov ecx, 0x435d98
mov esi, eax
call fcn.0040fb7a
test eax, eax
je 0x405650
push 2
pop edi
mov ecx, dword [ebp + 0x18c]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f23c
add ebp, 0x190
leave
ret

Function at 0x40566a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
push edi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
cmp esi, edi
je 0x405706
push ebx
xor eax, eax
push 0x206
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x78]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ebx, [ebp - 0x7c]
mov ecx, 0x435dac
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], edi
call fcn.0040fb7a
test eax, eax
jne 0x405702
call fcn.00408e37
mov ebx, dword [ebp - 0x80]
cmp ebx, edi
je 0x4056f7
lea eax, [ebp - 0x7c]
push eax
push edi
call fcn.0040ab29
jmp 0x4056f9
xor eax, eax
cmp eax, edi
je 0x405705
cmp dword [ebp - 0x7c], edi
je 0x405705
xor edi, edi
inc edi
pop ebx
mov ecx, dword [ebp + 0x190]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0041f23c
add ebp, 0x194
leave
ret
Function at 0x40571f
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp + 0x188], eax
push esi
push edi
xor eax, eax
push 0x206
xor edi, edi
mov word [ebp - 0x80], ax
lea eax, [ebp - 0x7e]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x80]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x80]
push eax
call esi
lea eax, [ebp - 0x80]
push eax
call esi
push 0x435690
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4057ad
lea eax, [ebp - 0x80]
push eax
push 0x435dc0
push 0x103
push ebx
call fcn.0041fb89
add esp, 0x10
inc edi
mov ecx, dword [ebp + 0x188]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0041f23c
add ebp, 0x18c
leave
ret

Function at 0x4057c6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
xor esi, esi
mov word [ebp - reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x405842
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x435650
push 0x435dc8
lea eax, [ebp - 0x20c]
push eax
push 0x435ddc
push 0x103
push edi
call fcn.0041fb89
add esp, 0x18
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041f23c
leave
ret
Function at 0x405c91
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
xor esi, esi
mov word [ebp - reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x435e58
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov edi, 0x103
call fcn.0040fa78
add esp, 0xc
test eax, eax
je 0x405d12
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405d12
lea eax, [ebp - 0x20c]
push eax
push 0x435dc0
push edi
push ebx
call fcn.0041fb89
add esp, 0x10
inc esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041f23c
leave
ret
Function at 0x406c37
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [esi + 0x10]
mov dword [ebp - 0x10], esi
test eax, eax
je 0x406c5c
push reloc.KERNEL32.dll_HeapFree
push eax
call fcn.00407f15
push ebx
push edi
lea eax, [ebp - 0xc]
push eax
add esi, 0x90
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 8]
push eax
push 0
mov ebx, 0x435d48
push ebx
mov edi, 0x80000001
push edi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x7e
call esi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
add eax, 0x110
push eax
lea eax, [ebp - 8]
push eax
push 0x435f2c
push ebx
push edi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x7e
call esi
mov eax, dword [ebp - 0x10]
add eax, 0x190
lea ecx, [ebp - 0xc]
push ecx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
push 0x436224
push ebx
push edi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x206
call esi
mov esi, dword [ebp - 0x14]
mov eax, esi
pop edi
lea ecx, [eax + 2]
pop ebx
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x406cee
sub eax, ecx
sar eax, 1
cmp eax, 8
jle 0x406d10
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov word [edx + eax*2 + reloc.ADVAPI32.dll_RegCloseKey], cx
jmp 0x406d15
xor eax, eax
mov word [esi], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041f23c
leave
ret
Function at 0x406d69
Capabilities:
Get mac address on windows
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x164
lea ebp, [esp - 4]
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp + 0x164], eax
push 0x14
mov eax, 0x431d0c
call fcn.00421aad
mov eax, dword [ebp + 0x170]
mov esi, 0x288
push esi
mov dword [ebp - 0x10], eax
call fcn.0041edea
pop ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
xor ebx, ebx
cmp eax, 0x6f
jne 0x406de7
mov eax, dword [ebp - 0x18]
dec eax
cmp eax, 0xfffe
ja 0x406f52
push dword [ebp - 0x14]
call fcn.0041f319
push dword [ebp - 0x18]
call fcn.0041edea
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x14], eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, ebx
jne 0x406f52
mov esi, dword [ebp - 0x14]
jmp 0x406f4a
lea edi, [esi + 8]
cmp edi, ebx
je 0x406f48
cmp byte [edi], bl
je 0x406f48
push 0x436238
lea ecx, [ebp]
call fcn.00408ae3
push edi
lea eax, [ebp]
push eax
mov dword [ebp - 4], ebx
call fcn.004084c7
push 0x43628c
lea eax, [ebp]
push eax
call fcn.004084c7
mov eax, 0x104
push eax
mov dword [ebp - 0x1c], eax
xor edi, edi
lea eax, [ebp + 0x1d]
push ebx
inc edi
push eax
mov dword [ebp - 0x20], edi
mov byte [ebp + 0x1c], bl
call fcn.00421bc0
mov eax, dword [ebp + 4]
add esp, 0xc
cmp dword [ebp + 0x18], 0x10
jae 0x406e5d
lea eax, [ebp + 4]
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp + 0x1c]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push 0x436298
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
push 3
lea eax, [ebp + 0x1c]
push 0x4362a8
push eax
call fcn.0041ff7c
add esp, 0xc
test eax, eax
je 0x406eaf
push 3
lea eax, [ebp + 0x1c]
push 0x4362ac
push eax
call fcn.0041ff7c
add esp, 0xc
test eax, eax
je 0x406eaf
push ebx
push edi
jmp 0x406f3c
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x14], ebx
je 0x406ec2
push 0x4362b0
push eax
call fcn.004084c7
xor edi, edi
cmp dword [esi + 0x190], ebx
jbe 0x406f2d
push HeapFree
lea eax, [ebp + 0x125]
push ebx
push eax
mov byte [ebp + 0x124], bl
call fcn.00421bc0
movzx eax, byte [esi + edi + 0x194]
push eax
push 0x4362b4
lea eax, [ebp + 0x124]
push reloc.KERNEL32.dll_HeapFree
push eax
call fcn.0041fddb
add esp, 0x1c
lea eax, [ebp + 0x124]
push eax
push dword [ebp - 0x10]
call fcn.004084c7
cmp edi, dword [esi + 0x190]
jae 0x406f24
push 0x4362bc
push dword [ebp - 0x10]
call fcn.004084c7
inc edi
cmp edi, dword [esi + 0x190]
jb 0x406ecc
lea eax, [esi + 8]
push eax
push dword [ebp - 0x10]
call fcn.004084c7
push ebx
push 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0040896d
mov esi, dword [esi]
cmp esi, ebx
jne 0x406df7
push dword [ebp - 0x14]
call fcn.0041f319
pop ecx
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp dword [ecx + 0x14], ebx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x164]
xor ecx, ebp
call fcn.0041f23c
add ebp, 0x168
leave
ret
Function at 0x407bde
Capabilities:
Set registry value

Disassembly:
push ebp
sub esp, 0xb8
lea ebp, [esp - 4]
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp + 0xb8], eax
push reloc.KERNEL32.dll_GetSystemTimeAsFileTime
mov eax, 0x43249d
call fcn.00421aad
push 7
pop eax
xor edi, edi
xor ecx, ecx
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x14], edi
mov word [ebp + 4], cx
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], edi
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 1
call fcn.00406f89
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop ecx
cmp dword [ebp - 0x14], edi
je 0x407cc1
xor eax, eax
push 0x7e
mov word [ebp + 0x38], ax
lea eax, [ebp + 0x3a]
push edi
push eax
call fcn.00421bc0
mov edx, dword [ebp - 0x24]
add esp, 0xc
cmp dword [ebp - 0x10], 8
jae 0x407c60
lea edx, [ebp - 0x24]
lea ecx, [ebp + 0x1c]
call fcn.00410073
cmp dword [ebp + 0x30], edi
je 0x407cb6
cmp dword [ebp + 0x34], 0x10
mov ecx, dword [ebp + 0x20]
jae 0x407c79
lea ecx, [ebp + 0x20]
push dword [ebp + 0x30]
lea ebx, [ebp + 0x38]
call fcn.0040ffa8
pop ecx
test eax, eax
je 0x407cb6
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x407c8e
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp + 0x38]
push eax
push 1
push 0x435f2c
push 0x435d48
push 0x80000001
call esi
push edi
push 1
lea ecx, [ebp + 0x1c]
call fcn.0040896d
lea ecx, [ebp]
call fcn.004077a6
cmp dword [ebp + 0x14], edi
je 0x407d54
xor eax, eax
push 0x7e
mov word [ebp + 0x38], ax
lea eax, [ebp + 0x3a]
push edi
push eax
call fcn.00421bc0
mov edx, dword [ebp + 4]
add esp, 0xc
cmp dword [ebp + 0x18], 8
jae 0x407cf3
lea edx, [ebp + 4]
lea ecx, [ebp + 0x1c]
call fcn.00410073
cmp dword [ebp + 0x30], edi
je 0x407d49
cmp dword [ebp + 0x34], 0x10
mov ecx, dword [ebp + 0x20]
jae 0x407d0c
lea ecx, [ebp + 0x20]
push dword [ebp + 0x30]
lea ebx, [ebp + 0x38]
call fcn.0040ffa8
pop ecx
test eax, eax
je 0x407d49
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x407d21
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp + 0x38]
push eax
push 1
push 0x43568c
push 0x435d48
push 0x80000001
call esi
push edi
push 1
lea ecx, [ebp + 0x1c]
call fcn.0040896d
push edi
push 1
lea esi, [ebp - 0x28]
call fcn.004064c2
push edi
push 1
lea esi, [ebp]
call fcn.004064c2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xb8]
xor ecx, ebp
call fcn.0041f23c
add ebp, 0xbc
leave
ret