joyce8/EMBER2024-capa huggingface dataset:
Function at 0xca4d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xca4d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xca4d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xca4d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xca4d94
push eax
push esi
call fcn.00ca720b
add esp, 8
pop esi
ret 0x10

Function at 0xca4da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xca4e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xca4e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xcbd320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00ca6dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xca4dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xca4e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xca4ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xca4eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xcbd320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00ca6dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xca4eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xca4e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xca5000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xca5131
push esi
call fcn.00ca8145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00c97080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xca5131
push 0
push ebp
call fcn.00c973a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00c97260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xca508b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00c972f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xca5121
push 0xcbd918
push edi
call fcn.00ca63f0
push eax
push ebx
push esi
call fcn.00ca4f60
push 0xcbd8f8
push edi
call fcn.00ca63f0
push eax
push ebx
push esi
call fcn.00ca4f60
push 0xcbd8d8
push edi
call fcn.00ca63f0
push eax
push ebx
push esi
call fcn.00ca4f60
push 0xcbd8c0
push edi
call fcn.00ca63f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00ca4f60
push 0xcbd8a0
push edi
call fcn.00ca63f0
push eax
push ebx
push esi
call fcn.00ca4f60
push 0xcbd888
push edi
call fcn.00ca63f0
push eax
push ebx
push esi
call fcn.00ca4f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xca61b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00ca6140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00ca6140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00ca6140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00ca6140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xca6bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xca6c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xcb887c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xca6c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xca6c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x51917483
xor edx, 0x2be3be2b
mov eax, 0x68302a02
mov edi, 0x1200842d
add byte [edx], dl
push 0x175fa41e
mov ecx, 0x7afe8be8
pop edi
xor ecx, edi
mov edx, 0x4909a2d3
mov edi, 0x604524
xor edx, edi
xor edx, ecx
push 0x1318e048
mov edi, 0x393e0d99
pop eax
xor edi, eax
mov esi, 0x150b8000
mov eax, 0x4aa04389
xor esi, eax
xor esi, edi
xor esi, edx
xor edi, edi
add edi, esi
sub edi, 0
jne 0x403f54
mov dword [0x40c02c], eax
mov byte [0x40c033], 2
mov byte [0x40c034], 2
mov byte [0x40c035], 3
mov word [0x40c3dc], 0
mov word [0x40c3ec], 1
call fcn.0040285c
mov eax, 0x40c038
mov edx, 0x404398
call fcn.00403c25
mov eax, 0x40c204
mov edx, 0x404398
call fcn.00403c25
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404391
ret

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40491e
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
mov edi, dword [0x4129fc]
cmp dword [edi + 8], 0
je 0x404955
lea eax, [ebp - 4]
push eax
push dword [edi + 8]
call sub.KERNEL32.DLL_GetExitCodeThread
push dword [ebp - 4]
push dword [edi + 8]
call sub.KERNEL32.DLL_TerminateThread
push dword [edi + 8]
call sub.KERNEL32.DLL_CloseHandle
add edi, 0x10
jmp 0x40492b
push dword [0x4129fc]
call sub.KERNEL32.DLL_GlobalFree
mov dword [0x412a00], 0
mov edi, dword [0x4129f8]
inc edi
cmp dword [edi], 0
je 0x404989
push dword [edi]
call fcn.0040ce3b
push dword [edi]
call sub.user32.dll_DestroyWindow
add edi, 4
jmp 0x404971
push dword [0x4129d0]
call fcn.00405c45
mov dword [0x4129d0], 0
cmp dword [0x4129ec], 0
je 0x4049c3
push 0x8000
push 0
push dword [0x4129ec]
call sub.KERNEL32.DLL_VirtualFree
mov dword [0x4129ec], 0
cmp dword [0x41287a], 0
je 0x4049e8
push 0x8000
push 0
push dword [0x41287a]
call sub.KERNEL32.DLL_VirtualFree
mov dword [0x41287a], 0
push dword [0x4129d8]
call fcn.00403dd8
push dword [0x4129dc]
call fcn.00403dd8
push 0x104
push 0x40
call sub.KERNEL32.DLL_GlobalAlloc
mov edi, eax
push edi
push 0x413648
call fcn.00408491
push edi
push str.EC2RUNDIALOGBOX
call fcn.00408491
push edi
push 0x413660
call fcn.00408491
push edi
push 0x413670
call fcn.00408491
push edi
push str.EC2RUNWINDOW
call fcn.00408491
push edi
push str.EC2RUNMDICHILDWINDOW
call fcn.00408491
push edi
push str.EC2RUNMDIWINDOW
call fcn.00408491
push edi
call sub.KERNEL32.DLL_GlobalFree
pop edi
leave
ret
Function at 0x407384
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push ecx
push edx
push edi
push esi
push 0
push dword [ebp + 8]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov word [eax], 0
xor esi, esi
push 1
push 0
push 0
push dword [ebp + 8]
call sub.KERNEL32.DLL_SetFilePointer
cmp eax, dword [ebp - 8]
jge 0x4073be
mov esi, 1
mov ebx, dword [ebp + 0xc]
or ebx, ebx
jne 0x4073c7
mov edi, eax
push 1
push 0
push 0
push dword [ebp + 8]
call sub.KERNEL32.DLL_SetFilePointer
cmp eax, dword [ebp - 8]
jge 0x4074fc
mov word [ebp - 0xa], 0
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xa]
push eax
push dword [ebp + 8]
call sub.KERNEL32.DLL_ReadFile
or eax, eax
je 0x4074f3
cmp dword [ebp - 4], 0
je 0x4074f3
mov ax, word [ebp - 0xa]
cmp dword [ebp + 0x14], 0
jne 0x407417
xor ah, ah
cmp ax, 0xd
jne 0x40746c
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xa]
push eax
push dword [ebp + 8]
call sub.KERNEL32.DLL_ReadFile
or eax, eax
je 0x407460
cmp dword [ebp - 4], 0
je 0x407460
mov ax, word [ebp - 0xa]
cmp dword [ebp + 0x14], 0
jne 0x407448
xor ah, ah
cmp ax, 0xa
je 0x407460
mov eax, dword [ebp + 0x10]
neg eax
push 1
push 0
push eax
push dword [ebp + 8]
call sub.KERNEL32.DLL_SetFilePointer
mov eax, 1
jmp 0x4074fe
cmp ax, 0xa
jne 0x4074bc
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xa]
push eax
push dword [ebp + 8]
call sub.KERNEL32.DLL_ReadFile
or eax, eax
je 0x4074b5
cmp dword [ebp - 4], 0
je 0x4074b5
mov ax, word [ebp - 0xa]
cmp dword [ebp + 0x14], 0
jne 0x40749d
xor ah, ah
cmp ax, 0xd
je 0x4074b5
mov eax, dword [ebp + 0x10]
neg eax
push 1
push 0
push eax
push dword [ebp + 8]
call sub.KERNEL32.DLL_SetFilePointer
mov eax, 1
jmp 0x4074fe
cmp dword [ebp + 0x14], 0
je 0x4074d0
cmp dword [ebp + 0xc], 0
je 0x4074cb
mov word [ebx], ax
add ebx, 2
jmp 0x4074d9
cmp dword [ebp + 0xc], 0
je 0x4074d8
mov byte [ebx], al
inc ebx
or ax, ax
je 0x4074ec
mov eax, ebx
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
jl 0x4073c7
mov eax, 0xffffffff
jmp 0x4074fe
mov eax, 0xffffffff
jmp 0x4074fe
mov eax, esi
cmp dword [ebp + 0xc], 0
je 0x407513
mov byte [ebx], 0
cmp dword [ebp + 0x14], 0
je 0x407533
mov byte [ebx + 1], 0
jmp 0x407533
cmp eax, 0xffffffff
jne 0x40751c
mov ebx, eax
jmp 0x407524
inc ebx
cmp dword [ebp + 0x14], 0
je 0x407524
inc ebx
push 0
push 0
push edi
push dword [ebp + 8]
call sub.KERNEL32.DLL_SetFilePointer
mov eax, ebx
pop esi
pop edi
pop edx
pop ecx
pop ebx
leave
ret 0x10
Function at 0x40cab5
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ecx
push edx
push edi
push esi
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x40cbb7
mov dword [ebp - 8], 0x104
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push dword [0x4129f0]
push 0
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0x103
je 0x40cb99
push dword [0x4129f0]
push dword [ebp - 4]
call sub.advapi32.dll_RegDeleteKeyA
cmp eax, 0
je 0x40cadd
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push 0x208
push 0x40
call sub.KERNEL32.DLL_GlobalAlloc
mov edi, eax
push dword [ebp + 0xc]
push edi
call sub.KERNEL32.DLL_lstrcpyA
push edi
call sub.KERNEL32.DLL_lstrlenA
or eax, eax
je 0x40cb59
cmp byte [eax + edi - 1], 0x5c
je 0x40cb59
mov byte [eax + edi], 0x5c
mov byte [eax + edi + 1], 0
push dword [0x4129f0]
push edi
call sub.KERNEL32.DLL_lstrcatA
push edi
push dword [ebp + 8]
call fcn.0040cab5
push eax
push edi
call fcn.00405c45
pop eax
or eax, eax
je 0x40cb99
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
cmp eax, 0
je 0x40cadd
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegDeleteKeyA
or eax, eax
jne 0x40cbb7
mov eax, 1
jmp 0x40cbb9
xor eax, eax
pop esi
pop edi
pop edx
pop ecx
leave
ret 8

Function at 0x40cbc1
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ecx
push edx
push edi
push esi
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExW
or eax, eax
jne 0x40ccca
mov dword [ebp - 8], 0x208
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push dword [0x4129f0]
push 0
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExW
cmp eax, 0x103
je 0x40ccac
push dword [0x4129f0]
push dword [ebp - 4]
call sub.advapi32.dll_RegDeleteKeyW
cmp eax, 0
je 0x40cbe9
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push 0x208
push 0x40
call sub.KERNEL32.DLL_GlobalAlloc
mov edi, eax
push dword [ebp + 0xc]
push edi
call sub.KERNEL32.DLL_lstrcpyW
push edi
call sub.KERNEL32.DLL_lstrlenW
or eax, eax
je 0x40cc6c
shl eax, 1
cmp word [eax + edi - 2], 0x5c
je 0x40cc6c
mov word [eax + edi], 0x5c
mov word [eax + edi + 2], 0
push dword [0x4129f0]
push edi
call sub.KERNEL32.DLL_lstrcatW
push edi
push dword [ebp + 8]
call fcn.0040cbc1
push eax
push edi
call fcn.00405c45
pop eax
or eax, eax
je 0x40ccac
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExW
cmp eax, 0
je 0x40cbe9
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegDeleteKeyW
or eax, eax
jne 0x40ccca
mov eax, 1
jmp 0x40cccc
xor eax, eax
pop esi
pop edi
pop edx
pop ecx
leave
ret 8
Function at 0x40ccf9
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ecx
push edx
push esi
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x40cd3c
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegDeleteValueA
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
pop eax
or eax, eax
jne 0x40cd3c
mov eax, 1
jmp 0x40cd3e
xor eax, eax
pop esi
pop edx
pop ecx
leave
ret 0xc

Function at 0x40cd45
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ecx
push edx
push esi
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExW
or eax, eax
jne 0x40cd88
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegDeleteValueW
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
pop eax
or eax, eax
jne 0x40cd88
mov eax, 1
jmp 0x40cd8a
xor eax, eax
pop esi
pop edx
pop ecx
leave
ret 0xc

Function at 0x40d783
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ecx
push edx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jl 0x40d815
cmp dword [ebp + 8], 0x80000006
jg 0x40d815
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x40d815
cmp dword [ebp + 0x14], 0
je 0x40d7ec
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call sub.advapi32.dll_RegQueryValueExA
jmp 0x40d802
push 0
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call sub.advapi32.dll_RegQueryValueExA
or eax, eax
jne 0x40d80d
mov dword [ebp - 4], 1
push dword [ebp - 0x10]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 4]
pop edx
pop ecx
leave
ret 0x10

Function at 0x40d81e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ecx
push edx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jl 0x40d8b0
cmp dword [ebp + 8], 0x80000006
jg 0x40d8b0
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x208
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExW
or eax, eax
jne 0x40d8b0
cmp dword [ebp + 0x14], 0
je 0x40d887
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call sub.advapi32.dll_RegQueryValueExW
jmp 0x40d89d
push 0
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call sub.advapi32.dll_RegQueryValueExW
or eax, eax
jne 0x40d8a8
mov dword [ebp - 4], 1
push dword [ebp - 0x10]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 4]
pop edx
pop ecx
leave
ret 0x10
Function at 0x40e2c7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ecx
push edx
push esi
mov dword [ebp - 4], 0
mov esi, dword [ebp + 0xc]
or esi, esi
je 0x40e348
cmp byte [esi], 0
je 0x40e348
cmp dword [ebp + 8], 0x80000000
jl 0x40e348
cmp dword [ebp + 8], 0x80000006
jg 0x40e348
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2001f
push 0
push str.REG_SZ
push 0
push esi
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
cmp eax, 0
jne 0x40e348
push dword [ebp + 0x14]
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
or eax, eax
jne 0x40e340
mov dword [ebp - 4], 1
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 4]
pop esi
pop edx
pop ecx
leave
ret 0x10

Function at 0x40e352
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ecx
push edx
push esi
mov dword [ebp - 4], 0
mov esi, dword [ebp + 0xc]
or esi, esi
je 0x40e3d3
cmp word [esi], 0
je 0x40e3d3
cmp dword [ebp + 8], 0x80000000
jl 0x40e3d3
cmp dword [ebp + 8], 0x80000006
jg 0x40e3d3
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push esi
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExW
cmp eax, 0
jne 0x40e3d3
push dword [ebp + 0x14]
call sub.KERNEL32.DLL_lstrlenW
inc eax
shl eax, 1
push eax
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExW
or eax, eax
jne 0x40e3cb
mov dword [ebp - 4], 1
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 4]
pop esi
pop edx
pop ecx
leave
ret 0x10

Function at 0x40e991
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push ecx
push edx
push esi
mov esi, dword [ebp + 0xc]
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
add esi, eax
or eax, eax
jne 0x40e9ba
mov esi, 2
jmp 0x40ea3e
cmp eax, 1
jne 0x40e9d6
cmp byte [esi - 1], 0xd
je 0x40e9cb
cmp byte [esi - 1], 0xa
jne 0x40e9d6
mov byte [esi - 1], 0
mov esi, 2
jmp 0x40ea3e
cmp byte [esi - 1], 0xa
jne 0x40e9e2
cmp byte [esi - 2], 0xd
je 0x40e9ee
cmp byte [esi - 1], 0xd
jne 0x40e9f2
cmp byte [esi - 2], 0xa
jne 0x40e9f2
xor esi, esi
jmp 0x40ea04
cmp byte [esi - 1], 0xd
jne 0x40e9ff
mov esi, 1
jmp 0x40ea04
mov esi, 2
push 0
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.DLL_WriteFile
or eax, eax
je 0x40ea53
or esi, esi
je 0x40ea53
cmp esi, 1
jne 0x40ea3e
mov edx, 0x413974
add edx, 1
push 0
lea eax, [ebp - 4]
push eax
push 1
push edx
push dword [ebp + 8]
call sub.KERNEL32.DLL_WriteFile
jmp 0x40ea53
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x413977
push dword [ebp + 8]
call sub.KERNEL32.DLL_WriteFile
pop esi
pop edx
pop ecx
pop ebx
leave
ret 8
Function at 0x40ea5b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push ecx
push edx
push esi
mov esi, dword [ebp + 0xc]
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_lstrlenW
shl eax, 1
mov ebx, eax
add esi, eax
or eax, eax
jne 0x40ea86
mov esi, 2
jmp 0x40eb13
cmp eax, 2
jne 0x40eaa6
cmp word [esi - 2], 0xd
je 0x40ea99
cmp word [esi - 2], 0xa
jne 0x40eaa6
mov word [esi - 2], 0
mov esi, 2
jmp 0x40eb13
cmp word [esi - 2], 0xa
jne 0x40eab4
cmp word [esi - 4], 0xd
je 0x40eac2
cmp word [esi - 2], 0xd
jne 0x40eac6
cmp word [esi - 4], 0xa
jne 0x40eac6
xor esi, esi
jmp 0x40ead9
cmp word [esi - 2], 0xd
jne 0x40ead4
mov esi, 1
jmp 0x40ead9
mov esi, 2
push 0
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.DLL_WriteFile
or eax, eax
je 0x40eb28
or esi, esi
je 0x40eb28
cmp esi, 1
jne 0x40eb13
mov edx, 0x41397c
add edx, 2
push 0
lea eax, [ebp - 4]
push eax
push 2
push edx
push dword [ebp + 8]
call sub.KERNEL32.DLL_WriteFile
jmp 0x40eb28
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x413984
push dword [ebp + 8]
call sub.KERNEL32.DLL_WriteFile
pop esi
pop edx
pop ecx
pop ebx
leave
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219