joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a14f4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a15cd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a15e8
push ebx
push 0x4a15f8
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040a768
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004077c0
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a494
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4a1576
mov ax, 0x83
call fcn.004a1118
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004a14c8
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4a157f
call fcn.004a14c8
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a15d4
lea eax, [ebp - 4]
call fcn.00409a3c
pop eax
jmp eax

Function at 0x4a16e8
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a17b1
jmp 0x4a17a5
cmp dword [esi + 0x10], 0x1000
jne 0x4a1793
test byte [esi + 0x15], 1
jne 0x4a1793
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4a1744
cmp ebp, 2
je 0x4a1744
cmp ebp, 0x10
je 0x4a1744
cmp ebp, 0x20
jne 0x4a1760
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a1760
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4a1771
mov eax, dword [esi]
add eax, ebx
call fcn.004a16e0
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4a1764
cmp byte [esp + 4], 0
je 0x4a1793
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov edi, dword [esi]
add edi, dword [esi + 0xc]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a17b1
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4a1719
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x438c99
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x438a14
push edx
mov edx, dword [esp]
add esp, 4
call fcn.00438cbd
inc ecx
xor dword [edi], eax
mov edx, 0x772a80da
inc edi
and ecx, edx
cmp edi, esi
jne fcn.00438c99
inc edx
ret
Function at 0x1000fd46
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
mov dword [ebp - 0x14], edx
push ebx
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], eax
mov eax, dword [0x10089098]
push esi
push edi
mov dword [ebp - 0x10], ecx
xor edi, edi
mov ecx, dword [eax + 0x38]
inc edi
mov edx, dword [eax + 0x3c]
mov eax, ecx
or eax, edx
mov dword [ebp - 0xc], 2
je 0x1000fd8a
push edi
push edx
push ecx
push 0x29
pop edx
call fcn.10010290
mov ecx, dword [ebp + 8]
lea edx, [ebp - 4]
call fcn.100153b4
mov esi, eax
test esi, esi
js 0x1000fe8f
mov ecx, dword [ebp - 4]
call fcn.1000f9c6
push 6
pop ecx
test eax, eax
je 0x1000fdb1
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0xc], ecx
jne 0x1000fdef
mov ecx, dword [ebp + 8]
call fcn.1001ae36
push dword [ebp + 8]
neg eax
sbb edi, edi
and edi, 0x1c00
add edi, 0x401
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x1000fdef
or edi, 0x100
test edi, 0x400
jne 0x1000fdef
or edi, 0x80
xor eax, eax
inc eax
test eax, eax
jne 0x1000fe13
mov eax, dword [0x10089098]
mov ecx, dword [eax + 0x38]
mov edx, dword [eax + 0x3c]
mov eax, ecx
or eax, edx
je 0x1000fe13
push 1
push edx
push ecx
push 0x29
pop edx
call fcn.10010290
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x10]
and dword [ebp - 0x1c], 0
push eax
push dword [ebp + 0xc]
push edi
push dword [ebp - 4]
call fcn.10010062
mov esi, eax
test esi, esi
js 0x1000fe8f
test dword [ebp - 8], 0x10000
je 0x1000fe3f
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 8]
and al, 2
movzx eax, al
neg eax
sbb eax, eax
and ebx, eax
je 0x1000fe6b
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xc]
lea ecx, [ebp - 4]
mov esi, ebx
call fcn.100181d6
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, esi
test byte [ebp - 8], 4
je 0x1000fe82
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 4]
call fcn.1000fbbb
mov esi, eax
test esi, esi
js 0x1000fe8f
mov eax, dword [ebp - 0x1c]
test ebx, ebx
jne 0x1000fdf2
xor esi, esi
lea ecx, [ebp - 4]
call fcn.1000b34b
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001888c
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x210]
mov ebx, ecx
xor esi, esi
lea ecx, [ebp - 0x224]
push eax
mov dword [ebp - 0x218], esi
call fcn.100102ed
mov eax, dword [ebx]
mov edi, esp
push esi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x214], esi
mov esi, dword [eax + 0x14]
mov ecx, esi
push ebx
call dword [0x1008c6d4]
call esi
cmp edi, esp
je 0x100188ef
mov ecx, 4
int 0x29
mov esi, eax
test esi, esi
jns 0x100189e5
cmp esi, 0x800700d7
jne 0x100189e7
lea edx, [ebp - 0x228]
mov ecx, ebx
call fcn.10031469
mov esi, eax
test esi, esi
js 0x100189e7
mov esi, dword [ebx]
lea eax, [ebp - 0x218]
mov edi, esp
push eax
push 0x10004dc8
mov ecx, dword [esi]
push ebx
call dword [0x1008c6d4]
call dword [esi]
cmp edi, esp
je 0x10018942
mov ecx, 4
int 0x29
mov esi, eax
test esi, esi
js 0x100189e7
mov edi, dword [ebp - 0x228]
mov esi, 0x10003f08
mov eax, esi
test edi, edi
je 0x10018963
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10018985
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100189e7
movzx esi, si
or esi, 0x80070000
jmp 0x100189e7
test edi, edi
je 0x1001898f
mov esi, dword [ebp - 0x224]
lea eax, [ebp - 0x214]
push eax
push 0x40000000
push 1
push esi
call dword [sym.imp.MSOERT2.dll_OpenFileStreamW]
mov esi, eax
test esi, esi
js 0x100189e7
mov eax, dword [ebp - 0x218]
mov edi, esp
push 0
push dword [ebp - 0x214]
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x18]
call dword [0x1008c6d4]
call dword [esi + 0x18]
cmp edi, esp
je 0x100189d4
mov ecx, 4
int 0x29
mov esi, eax
test esi, esi
js 0x100189e7
lea ecx, [ebp - 0x214]
call fcn.1000b34b
xor esi, esi
lea ecx, [ebp - 0x214]
call fcn.1000b34b
lea ecx, [ebp - 0x218]
call fcn.1000b34b
and dword [ebp - 0x228], 0
lea ecx, [ebp - 0x224]
call fcn.1000deab
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10087900
mov esp, ebp
pop ebp
ret
Function at 0x1001ae36
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x208
lea eax, [ebp - 0x824]
push ebx
xor esi, esi
mov edi, ecx
push esi
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0x414]
push esi
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0x61c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0x30
lea ecx, [ebp - 0x824]
call fcn.10029091
test eax, eax
js 0x1001afc4
mov ebx, 0x104
lea eax, [ebp - 0x824]
push ebx
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.msvcrt.dll__wfullpath]
add esp, 0xc
test eax, eax
je 0x1001afc4
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push ebx
lea eax, [ebp - 0x20c]
push edi
push eax
call dword [sym.imp.msvcrt.dll__wfullpath]
add esp, 0xc
test eax, eax
je 0x1001afc4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x1001afc4
shr eax, 4
test al, 1
je 0x1001af1f
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
jmp 0x1001af38
and ecx, 6
cmp cl, 6
je 0x1001afc4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1001af41
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x1001afc4
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
jmp 0x1001afa5
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001afc4
and eax, 6
cmp al, 6
je 0x1001afc4
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x1001afc4
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x1001af7f
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10087900
mov esp, ebp
pop ebp
ret
Function at 0x10042192
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [edx + 0x18]
mov esi, ecx
mov dword [ebp - 0x34], eax
xor ebx, ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], edx
push eax
mov eax, dword [edx + 0x10]
mov ecx, edi
mov edx, dword [ebp + 8]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x28], ebx
push dword [eax + 0x24]
call fcn.10033a19
test eax, eax
je 0x100422bb
mov eax, dword [ebp - 0x28]
push 8
pop ecx
push ebx
mov edx, dword [edi + eax*8 + 4]
xor eax, eax
push ebx
push edx
lea edi, [ebp - 0x24]
mov dword [ebp - 0x30], edx
rep stosd dword es:[edi], eax
push esi
mov dword [ebp - 0x28], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1004220e
push ebx
push 0x20
lea edx, [ebp - 0x24]
mov ecx, esi
call fcn.10035ff0
jmp 0x10042210
mov eax, ebx
test eax, eax
je 0x100422bb
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [ebp + 8]
mov edx, dword [ebp - 0x30]
lea esi, [ebp - 0x24]
push 1
push eax
mov eax, dword [ebp - 0x2c]
sub esp, 0x20
mov eax, dword [eax + 0x10]
push 8
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x14]
call fcn.100352ac
test eax, eax
je 0x100422bb
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x10042254
mov eax, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0x3fffffff
ja 0x100422bb
shl eax, 2
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x100422bb
push ebx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x10]
push esi
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100422b4
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x10]
jne 0x100422b4
mov eax, ebx
cmp dword [ebp - 0x18], eax
jbe 0x100422b4
mov ecx, dword [0x1008b3cc]
cmp dword [esi + eax*4], ecx
je 0x100422b1
cmp dword [esi + eax*4], 0x660c1102
je 0x100422b1
inc eax
cmp eax, dword [ebp - 0x18]
jb 0x1004229b
jmp 0x100422b4
xor ebx, ebx
inc ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10031469
mov esp, ebp
pop ebp
ret 8
Function at 0x431006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..3ean
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x65221476
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..7LWLf
mov ebx, 0x42f3f8
nop
mov ecx, 0x1f1b7076
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x406e46
Capabilities:
Set registry value

Disassembly:
push 0xb4
mov eax, 0x442146
call fcn.00441db8
mov ebx, ecx
call fcn.00406cc3
test al, al
jne 0x406ef0
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
push edi
push ecx
push 0x2001f
push 1
push ecx
push 0x4027e0
push SysReAllocString
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], edi
call fcn.004084dc
mov esi, dword [ebp - 0x1c]
test eax, eax
jne 0x406ebd
push 4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push 4
push edi
push 0x4027c4
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x406ebd
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, edi
mov dword [ebp - 0x1c], esi
lea ecx, [ebp - 0xc0]
call fcn.00420dd2
push ecx
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 1
call fcn.004217a5
lea ecx, [ebp - 0xc0]
call fcn.00420e0b
test esi, esi
je 0x406f46
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406f46
push 0x402880
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, eax
test esi, esi
je 0x406f20
and bl, 1
push 0x404018
mov dl, bl
call fcn.0041fb37
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406f46
lea ecx, [ebp - 0x10]
call fcn.0041fa77
mov dword [ebp - 4], 2
and bl, 1
push dword [eax]
mov dl, bl
call fcn.0041fb37
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.0041324b
call fcn.00441d81
ret
Function at 0x40d9b9
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x814
mov eax, dword [0x4467a4]
xor eax, esp
mov dword [esp + 0x810], eax
mov eax, dword [ebp + 0x1c]
sub eax, dword [0x44745c]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [0x447468]
mov dword [esp + 0x14], edi
cmp eax, 0x1f4
jb 0x40db16
push dword [edi + 0xe18]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40db16
mov eax, dword [ebp + 8]
xor bl, bl
sub eax, 3
je 0x40da64
sub eax, 3
je 0x40da5c
sub eax, 0x7ffc
je 0x40da64
dec eax
sub eax, 1
jne 0x40db16
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x10], eax
je 0x40db16
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
jne 0x40db16
jmp 0x40daf8
mov bl, byte [ebp + 0x20]
jmp 0x40daf4
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x10], eax
je 0x40db16
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 8
je 0x40daca
push 0x400
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x446098]
cmp eax, 0x446098
je 0x40dac8
test byte [eax + 0x1c], 0x10
je 0x40dac8
lea ecx, [esp + 0x18]
mov edx, 0x402ca8
push ecx
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xe
pop ecx
call fcn.00406a31
mov bl, 1
mov ecx, dword [edi]
sub esp, 0x10
mov edi, esp
sub esp, 0x10
lea esi, [ecx + 0xc]
fld dword [ecx + 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ecx + 0x5c]
push ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
fstp dword [esp]
call fcn.0040c088
mov edi, dword [esp + 0x14]
test bl, bl
je 0x40db16
mov eax, dword [ebp + 0x1c]
push 0x13
mov dword [0x44745c], eax
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [edi + 0xe18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004406d0
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x413996
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4467a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 5
mov ebx, ecx
lea eax, [ebp - 0x20]
pop ecx
push eax
mov esi, 0x403074
lea edi, [ebp - 0x18]
rep movsd dword es:[edi], dword [esi]
push 3
xor esi, esi
push esi
push 0x403798
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413a30
push 4
pop edi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], esi
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], edi
push eax
push esi
push 0x10
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x413a02
cmp dword [ebp - 0x1c], esi
jne 0x413a27
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 1
push eax
push edi
push esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebx + 0xfc], 0x1388
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004406d0
mov esp, ebp
pop ebp
ret

Function at 0x4154b2
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x415523
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
je 0x415522
cmp edi, dword [esi + 0xec]
jne 0x4154fd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0xf0]
cmp eax, 0x3e8
jbe 0x415522
push 0x13
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov dword [esi + 0xec], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xf0], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x415721
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x104], 0
mov byte [esi + 0x105], al
je 0x415764
test al, al
je 0x415764
cmp byte [esi + 0x106], 0
jne 0x415790
cmp dword [esi + 0x2c], 0
mov byte [esi + 0x106], 1
je 0x415760
push 0
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
jmp 0x415787
cmp byte [esi + 0x106], 0
je 0x415790
cmp dword [esi + 0x2c], 0
mov byte [esi + 0x106], 0
je 0x415785
push 4
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 4
Function at 0x41b01e
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov esi, SysReAllocString
cmp dword [edi], 0
jne 0x41b04d
push edi
push 1
push 0
push 0x403798
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41b04d
and dword [edi], 0
and dword [ebp - 4], 0
cmp byte [ebp + 8], 0
je 0x41b074
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403ca8
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
neg eax
sbb eax, eax
not eax
and dword [ebp - 4], eax
mov esi, 0x4460d8
xor bl, bl
cmp dword [edi], 0
je 0x41b0d2
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push dword [esi - 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41b0d2
cmp dword [esi - 4], 0
mov eax, dword [ebp - 8]
je 0x41b0cd
cmp eax, dword [esi]
jge 0x41b0bb
mov eax, dword [esi]
mov dword [ebp - 8], eax
mov dword [esi + 0x10], 1
cmp eax, dword [esi + 4]
jle 0x41b0cd
mov eax, dword [esi + 4]
mov dword [ebp - 8], eax
mov dword [esi + 0x10], 1
mov dword [esi + 0xc], eax
mov bl, 1
mov eax, dword [ebp - 4]
test eax, eax
je 0x41b135
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x10
push dword [esi - 8]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x41b135
cmp dword [esi - 4], 0
mov cl, 1
mov eax, dword [ebp - 0xc]
je 0x41b11f
cmp eax, dword [esi]
jge 0x41b112
mov eax, dword [esi]
xor cl, cl
mov dword [ebp - 0xc], eax
cmp eax, dword [esi + 4]
jle 0x41b11f
mov eax, dword [esi + 4]
xor cl, cl
mov dword [ebp - 0xc], eax
test bl, bl
jne 0x41b12a
mov dword [esi + 0x10], 1
test cl, cl
jne 0x41b132
test bl, bl
jne 0x41b135
mov dword [esi + 0xc], eax
cmp dword [edi + 8], 0
je 0x41b157
mov eax, dword [esi + 0xc]
push 4
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push dword [esi - 8]
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0x20
cmp esi, 0x446498
jl 0x41b079
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
test eax, eax
je 0x41b177
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 4

Function at 0x41b1d5
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [0x447488]
test ecx, ecx
je 0x41b1f3
push ecx
call fcn.0041b22d
and dword [0x447488], 0
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x403c20
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41b229
push 0x403c00
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret