joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000515c
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov dword [ebp - 4], eax
mov ecx, ebx
call fcn.100050cb
mov edi, eax
test edi, edi
je 0x100051e4
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x4e20
ja 0x100051dd
test esi, esi
je 0x100051a0
push esi
call ebx
push edi
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100051cd
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x100051cd
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.100050cb
mov edi, eax
test edi, edi
jne 0x10005189
test esi, esi
je 0x100051e4
push esi
call ebx
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100051fb
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 0x618
push esi
test ecx, ecx
jne 0x10005265
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall9563BC59_9556_4805_8CD4_886781779D8D
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x10005235
xor al, al
jmp 0x10005327
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x628]
push eax
push ebx
push ebx
push str.Parameters
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1000522e
lea ecx, [ebp - 0x628]
push edi
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
jne 0x1000527e
xor al, al
jmp 0x10005326
cmp dword [ebp - 8], 8
jl 0x1000531d
mov ebx, dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x104
push dword [edi]
push ebx
call esi
push 0x104
push dword [edi + 4]
lea eax, [ebx + 0x208]
push eax
call esi
push 0x104
push dword [edi + 8]
lea eax, [ebx + 0x410]
push eax
call esi
push 0x104
push dword [edi + 0xc]
lea eax, [ebx + 0x618]
push eax
call esi
push 0x104
push dword [edi + 0x10]
lea eax, [ebx + 0x820]
push eax
call esi
push 0x104
push dword [edi + 0x14]
lea eax, [ebx + 0xa28]
push eax
call esi
push 0x10007af8
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
neg eax
push 0x104
sbb eax, eax
neg eax
mov dword [ebx + 0xc30], eax
lea eax, [ebx + 0xc34]
push dword [edi + 0x1c]
push eax
call esi
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005384
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ecx, ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push str.SoftwareCLASSESCLSID9563BC59_9556_4805_8CD4_886781779D8D
push SysReAllocString
mov bl, cl
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10005419
cmp dword [ebp - 8], 2
push dword [ebp - 4]
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x100053d1
push str.SoftwareCLASSESCLSID9563BC59_9556_4805_8CD4_886781779D8D
jmp 0x1000540e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push 0xf003f
push eax
push eax
push eax
push str.SoftwareCLASSESCLSID9563BC59_9556_4805_8CD4_886781779D8DInprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, 0x3fd
sete bl
test eax, eax
jne 0x10005419
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareCLASSESCLSID9563BC59_9556_4805_8CD4_886781779D8DInprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100058c5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ebx
call fcn.10005848
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x100058ea
xor al, al
jmp 0x10005999
push edi
mov edi, dword [eax + 0x10]
xor ecx, ecx
add edi, ebx
mov dword [ebp - 4], ecx
cmp cx, word [eax + 0xa]
jae 0x10005996
push esi
mov edx, ebx
mov ecx, edi
call fcn.1000576c
mov dword [ebp - 0x10], eax
pop ecx
test eax, eax
je 0x1000599f
mov esi, dword [edi + 0x2a]
mov edx, ebx
push dword [ebp - 8]
add esi, ebx
mov ecx, esi
call fcn.100056fe
pop ecx
test eax, eax
je 0x1000599f
xor eax, eax
cmp word [esi + 8], ax
jne 0x1000599f
mov edx, dword [esi + 0x12]
cmp edx, dword [esi + 0x16]
jne 0x1000599f
test byte [esi + 6], 8
jne 0x1000599f
test edx, edx
je 0x1000597a
movzx ebx, word [esi + 0x1c]
movzx eax, word [esi + 0x1a]
add ebx, 0x1e
add ebx, esi
add ebx, eax
or ecx, 0xffffffff
movzx eax, byte [ebx]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10006e90]
inc ebx
dec edx
jne 0x10005957
mov ebx, dword [ebp - 0xc]
not ecx
mov dword [esi + 0xe], ecx
mov dword [edi + 0x10], ecx
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 4]
add edi, dword [ebp - 0x10]
inc esi
mov dword [ebp - 4], esi
movzx eax, word [eax + 0xa]
cmp esi, eax
mov esi, dword [ebp - 8]
jb 0x100058ff
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
jmp 0x10005998
Function at 0x401164
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc18
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], ebx
mov esi, 0x40c1a0
mov ecx, 0xc00
mov ebx, dword [ebp + 0x10]
lea edi, [ebp - 0xc18]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0x14]
mov dword [ebp - 0x18], 0xc00
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.MSVCR71.dll_wcscpy]
add esp, 8
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0xc18]
lea eax, [ebp - 0x18]
push eax
push edx
push ecx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40127b
mov eax, dword [ebp - 0x14]
cmp eax, 1
je 0x401256
cmp eax, 2
je 0x40123a
cmp eax, 3
je 0x401215
cmp eax, 7
je 0x401215
cmp eax, 4
jne 0x40127b
mov eax, dword [ebp - 0xc18]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 0x4440d4
push ebx
call dword [sym.imp.MSVCR71.dll_swprintf]
add esp, 0xc
jmp 0x40127b
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0xc18]
mov eax, 0x800
cmp edx, 0x800
jb 0x40122d
mov edx, eax
push edx
push ecx
push ebx
call fcn.0040990c
add esp, 0xc
jmp 0x40127b
lea eax, [ebp - 0xc18]
push 0x800
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
call fcn.00401950
pop ecx
jmp 0x40127b
lea eax, [ebp - 0xc18]
push 0x800
push eax
push ebx
call dword [sym.imp.MSVCR71.dll_wcsncpy]
push ebx
xor eax, eax
mov word [ebx + 0xffe], ax
call fcn.00401950
add esp, 0x10
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x401288
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov dword [ebp - 4], edi
mov dword [ebp - 8], esi
mov eax, dword [ebp + 0x10]
mov esi, 0x40cda0
mov ecx, 0x800
mov dword [ebp - 0x814], eax
lea edi, [ebp - 0x810]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x10], 0x800
lea ecx, [ebp - 0xc]
xor esi, esi
mov dword [ebp - 0xc], esi
lea edx, [ebp - 0x810]
lea eax, [ebp - 0x10]
push eax
push edx
push ecx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401341
mov eax, dword [ebp - 0xc]
cmp eax, 1
je 0x40131d
cmp eax, 4
je 0x4012fc
cmp eax, 3
jne 0x401331
mov eax, dword [ebp - 0x10]
cmp eax, 4
jne 0x401331
lea ecx, [ebp - 0x814]
lea edx, [ebp - 0x810]
push eax
push edx
push ecx
call fcn.0040990c
add esp, 0xc
jmp 0x401331
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.MSVCR71.dll_atol]
pop ecx
mov dword [ebp - 0x814], eax
mov eax, dword [ebp - 0x814]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x814], eax
jmp 0x401331
Function at 0x4016f8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1220
call fcn.0040ba90
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
lea edi, [ebp - 0x1220]
mov esi, 0x40d5a0
mov ecx, 0x1000
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40179c
mov eax, dword [ebp - 0x110]
cmp eax, 2
jne 0x40179c
mov eax, dword [ebp - 0x11c]
cmp eax, 5
jne 0x40177c
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x401770
mov dword [0x44c3a4], 2
jmp 0x40179c
mov dword [0x44c3a4], 4
jmp 0x40179c
cmp eax, 3
jb 0x401792
cmp eax, 4
ja 0x401792
mov dword [0x44c3a4], 1
jmp 0x40179c
mov dword [0x44c3a4], 0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401833
push 0x4434c0
lea eax, [ebp - 0x1220]
push eax
push str.ProductName
push dword [ebp - 0xc]
call fcn.00401164
add esp, 0x10
lea eax, [ebp - 0x1220]
push eax
call dword [sym.imp.MSVCR71.dll_wcslen]
pop ecx
test eax, eax
je 0x401802
push 0x4440dc
lea eax, [ebp - 0x1220]
push eax
call dword [sym.imp.MSVCR71.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x401816
push str.Microsoft_Windows
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR71.dll_wcscpy]
add esp, 8
jmp 0x40182a
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x1220]
push eax
push edx
call dword [sym.imp.MSVCR71.dll_wcscpy]
add esp, 8
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4028a8
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov edx, dword [ebp + 8]
push edx
xor eax, eax
mov dword [0x44e884], eax
mov dword [0x44e888], eax
mov dword [0x44e88c], eax
mov dword [0x44e890], eax
mov dword [0x44e894], eax
mov dword [0x44e898], eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x4028e6
mov eax, 0x44e884
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp eax, 1
jne 0x4028dd
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x10]
mov dword [0x44e884], ecx
sub ecx, eax
mov dword [0x44e888], ebx
sbb ebx, edx
mov dword [0x44e88c], eax
mov dword [0x44e890], edx
mov dword [0x44e894], ecx
mov dword [0x44e898], ebx
mov ebx, dword [ebp - 4]
jmp 0x4028dd
Function at 0x4046d4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 4], edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ebx
mov esi, 0x41b940
mov ecx, 0x100
lea edi, [ebp - 0x114]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], 0x80
lea eax, [ebp - 0x10]
xor ebx, ebx
xor edx, edx
mov dword [ebp - 0x10], edx
push eax
push 0x20019
push edx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404795
lea ecx, [ebp - 0x114]
lea edx, [ebp - 0x14]
xor eax, eax
push eax
push eax
push eax
push eax
push edx
push ecx
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x40478c
mov eax, dword [0x44e880]
test eax, eax
je 0x404773
test ebx, ebx
jne 0x404773
test eax, eax
je 0x404767
mov eax, str.ROWSET_TABLE_MGMT_ECM_HW_NIC__CONFIG_TRUE_
jmp 0x40476c
mov eax, str.NETWORK_INTERFACE_CARD
push eax
call fcn.00402e10
pop ecx
lea eax, [ebp - 0x114]
push eax
call fcn.004047c8
pop ecx
mov dword [ebp - 0x14], 0x80
add ebx, 1
jmp 0x404730
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x44e880]
test eax, eax
je 0x4047b9
test ebx, ebx
je 0x4047b9
test eax, eax
je 0x4047ad
mov eax, str.ROWSET_TABLE_MGMT_ECM_HW_NIC__CONFIG_TRUE_
jmp 0x4047b2
mov eax, str.NETWORK_INTERFACE_CARD
push eax
call fcn.0040322c
pop ecx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4067ec
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 4], edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ebx
mov esi, 0x434c80
mov ecx, 0x100
lea edi, [ebp - 0x114]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], 0x80
lea eax, [ebp - 0x10]
xor esi, esi
xor ebx, ebx
push eax
push 0x20019
xor edx, edx
mov dword [ebp - 0x10], edx
push edx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfix
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406927
lea ecx, [ebp - 0x114]
lea edx, [ebp - 0x14]
xor eax, eax
push eax
push eax
push eax
push eax
push edx
push ecx
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4068e0
test ebx, ebx
jne 0x4068c4
mov eax, dword [0x44c3a8]
mov ebx, 1
test eax, eax
je 0x40688a
push str.Operating_System_Patches
call fcn.00402db0
pop ecx
mov eax, dword [0x44e880]
test eax, eax
je 0x40689a
mov eax, 0x4434c0
jmp 0x40689f
mov eax, str.SUBCOMPONENT
push eax
call fcn.00402e10
pop ecx
mov eax, dword [0x44e880]
test eax, eax
je 0x4068c4
je 0x4068b8
mov eax, str.ROWSET_TABLE_MGMT_ECM_OS_COMPONENT__DATECOLUMNS_INSTALLATION_DATE__CONFIG_TRUE_
jmp 0x4068bd
mov eax, str.OS_COMPONENT
push eax
call fcn.00402e10
pop ecx
lea eax, [ebp - 0x114]
push eax
call fcn.00406934
pop ecx
mov dword [ebp - 0x14], 0x80
add esi, 1
jmp 0x40684e
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x406927
mov eax, dword [0x44e880]
test eax, eax
je 0x406910
je 0x4068ff
mov eax, str.ROWSET_TABLE_MGMT_ECM_OS_COMPONENT__DATECOLUMNS_INSTALLATION_DATE__CONFIG_TRUE_
jmp 0x406904
mov eax, str.OS_COMPONENT
push eax
call fcn.0040322c
pop ecx
mov eax, dword [0x44e880]
test eax, eax
je 0x40691b
mov eax, 0x4434c0
jmp 0x406920
mov eax, str.SUBCOMPONENT
push eax
call fcn.0040322c
pop ecx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x406c7c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 4], edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ebx
mov esi, 0x437280
mov ecx, 0x100
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x114]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], 0x80
lea eax, [ebp - 0x10]
xor edi, edi
xor esi, esi
push eax
push 0x20019
xor edx, edx
mov dword [ebp - 0x10], edx
push edx
mov word [ebx], dx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfix
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406d47
lea eax, [ebp - 0x114]
lea ecx, [ebp - 0x14]
xor edx, edx
push edx
push edx
push edx
push edx
push ecx
push eax
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x406d3e
mov edx, dword [ebp - 0x14]
cmp edx, 2
jbe 0x406d32
test esi, esi
je 0x406d1a
push 0x445b90
push ebx
call dword [sym.imp.MSVCR71.dll_wcscat]
add esp, 8
lea edx, [ebp - 0x114]
push edx
push ebx
call dword [sym.imp.MSVCR71.dll_wcscat]
add esp, 8
mov edx, dword [ebp - 0x14]
lea esi, [edx + esi + 1]
mov dword [ebp - 0x14], 0x80
add edi, 1
jmp 0x406ce0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov eax, ebx
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x406f2c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov eax, 0x437380
mov ebx, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x298], edx
mov edx, dword [eax + 8]
mov dword [ebp - 0x294], ecx
mov dword [ebp - 0x290], edx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x28c], edx
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x288], edx
mov edx, dword [eax + 0x14]
mov dword [ebp - 0x284], edx
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x280], edx
mov edx, dword [eax + 0x1c]
mov dword [ebp - 0x27c], edx
mov edx, dword [eax + 0x20]
mov dword [ebp - 0x278], edx
mov edx, dword [eax + 0x24]
mov dword [ebp - 0x274], edx
mov edx, dword [eax + 0x28]
mov dword [ebp - 0x270], edx
mov edx, dword [eax + 0x2c]
mov dword [ebp - 0x26c], edx
mov edx, dword [eax + 0x30]
mov dword [ebp - 0x268], edx
mov edx, dword [eax + 0x34]
mov dword [ebp - 0x264], edx
mov edx, dword [eax + 0x38]
mov dword [ebp - 0x260], edx
mov edx, dword [eax + 0x3c]
mov dword [ebp - 0x25c], edx
mov edx, dword [eax + 0x40]
mov dword [ebp - 0x258], edx
mov edx, dword [eax + 0x44]
mov dword [ebp - 0x254], edx
mov edx, dword [eax + 0x48]
mov dword [ebp - 0x250], edx
mov edx, dword [eax + 0x4c]
mov dword [ebp - 0x24c], edx
mov edx, dword [eax + 0x50]
mov dword [ebp - 0x248], edx
mov edx, dword [eax + 0x54]
mov dword [ebp - 0x244], edx
mov edx, dword [eax + 0x58]
mov dword [ebp - 0x240], edx
mov edx, dword [eax + 0x5c]
mov dword [ebp - 0x23c], edx
mov edx, dword [eax + 0x60]
mov dword [ebp - 0x238], edx
mov edx, dword [eax + 0x64]
mov dword [ebp - 0x234], edx
mov edx, dword [eax + 0x68]
mov dword [ebp - 0x230], edx
mov edx, dword [eax + 0x6c]
mov dword [ebp - 0x22c], edx
mov edx, dword [eax + 0x70]
mov dword [ebp - 0x228], edx
mov edx, dword [eax + 0x74]
mov dword [ebp - 0x224], edx
mov edx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x21c], eax
lea edi, [ebp - 0x218]
mov esi, 0x437400
mov ecx, 0x1fe
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 1
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x4070ad
mov dword [ebp - 0x18], 0
jmp 0x4070d5
lea eax, [ebp - 0x18]
lea edi, [ebp - 0x14]
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x298]
push 0x40
push edx
push ecx
push edi
push eax
push 0xff
lea edx, [ebp - 0x218]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x407868
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4218
call fcn.0040ba90
mov dword [ebp - 4], edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ebx
mov esi, 0x4379e0
mov ecx, 0x100
mov ebx, dword [ebp + 0xc]
lea edi, [ebp - 0x4218]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4118]
mov esi, 0x437ae0
mov ecx, 0x4000
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], 0x80
mov edi, 0x2c
xor ecx, ecx
mov word [ebp - 0x14], di
mov word [ebp - 0x12], cx
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x10]
push edx
xor edi, edi
push 0x20019
push ecx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x407901
jmp 0x407a18
mov dword [ebp - 0x18], 0x80
lea esi, [ebp - 0x4218]
lea ecx, [ebp - 0x18]
xor edx, edx
push edx
push edx
push edx
push edx
push ecx
push esi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x407a0f
movzx edx, word [ebp - 0x4218]
cmp edx, 0x51
je 0x40797c
push 0x446888
call dword [sym.imp.MSVCR71.dll_wcslen]
lea edx, [ebp - 0x4218]
push eax
push edx
push 0x446888
call dword [sym.imp.MSVCR71.dll__wcsnicmp]
add esp, 0x10
test eax, eax
je 0x40797c
push 0x446880
call dword [sym.imp.MSVCR71.dll_wcslen]
lea edx, [ebp - 0x4218]
push eax
push edx
push 0x446880
call dword [sym.imp.MSVCR71.dll__wcsnicmp]
add esp, 0x10
test eax, eax
jne 0x4079ce
push 0x463400
lea edx, [ebp - 0x4118]
push edx
call dword [sym.imp.MSVCR71.dll_wcscpy]
lea ecx, [ebp - 0x4118]
lea edx, [ebp - 0x14]
push edx
push ecx
call dword [sym.imp.MSVCR71.dll_wcstok]
add esp, 0x10
test eax, eax
je 0x4079ce
lea edx, [ebp - 0x4218]
push edx
push eax
call dword [sym.imp.MSVCR71.dll_wcscmp]
add esp, 8
test eax, eax
je 0x407a02
lea edx, [ebp - 0x14]
push edx
push 0
call dword [sym.imp.MSVCR71.dll_wcstok]
add esp, 8
test eax, eax
jne 0x4079a6
lea ecx, [ebp - 0x4218]
push ecx
xor edx, edx
mov word [0x4500e0], dx
mov edx, dword [ebp + 8]
push edx
push str._s_s
push 0x4500e0
call dword [sym.imp.MSVCR71.dll_swprintf]
push ebx
push 0x4500e0
call fcn.00407a28
mov ebx, eax
add esp, 0x18
add edi, 1
test esi, esi
je 0x4078fa
jmp 0x407a18
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov eax, ebx
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x40bacd
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x4486c8
call fcn.0040bd54
xor edi, edi
push edi
call dword [sym.imp.orauts.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x40bb08
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bb08
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40bb20
cmp eax, 0x20b
je 0x40bb0d
mov dword [ebp - 0x1c], edi
jmp 0x40bb34
cmp dword [ecx + 0x84], 0xe
jbe 0x40bb08
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x40bb2e
cmp dword [ecx + 0x74], 0xe
jbe 0x40bb08
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x468740], 0xffffffff
or dword [0x468744], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x468738]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x468734]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x46873c], eax
call fcn.0040bcb0
call fcn.0040bd50
cmp dword [0x4497c0], edi
jne 0x40bb94
push fcn.0040bd50
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0040bd3e
push 0x44900c
push 0x449008
call sub.MSVCR71.dll__initterm
push 0x40bcf4
call fcn.0040bc9e
mov eax, dword [0x468730]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x46872c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCR71.dll___wgetmainargs]
add esp, 0x20
mov dword [ebp - 0x34], eax
cmp eax, edi
jge 0x40bbe8
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x449004
push section..data
call sub.MSVCR71.dll__initterm
call dword [sym.imp.MSVCR71.dll___p___winitenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.00401000
add esp, 0x14
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x40bc24
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x40bc59
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040bd8f
ret