joyce8/EMBER2024-capa huggingface dataset:
Function at 0x684c8200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x9c
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov dword [edx + 0xc], 0
movzx edx, word [eax]
mov dword [ebp - 0x70], 0x4e
test dx, dx
je 0x684c8370
nop
add eax, 2
cmp word [eax], 0
jne 0x684c8240
sub eax, esi
mov dword [ebp - 0x7c], edx
add eax, 0x10
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x7c]
test eax, eax
mov edi, eax
je 0x684c83f6
mov ecx, esi
jmp 0x684c8273
movzx edx, word [ecx]
add eax, 2
add ecx, 2
mov word [eax - 2], dx
test dx, dx
jne 0x684c8270
cmp word [edi], 0
mov edx, edi
je 0x684c8299
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x684c8290
xor eax, eax
mov ecx, 0x5c
jmp 0x684c82af
movzx ecx, word [eax + str.CLSID]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x684c82a8
lea eax, [ebp - 0x6c]
mov ecx, 0x2000000
mov edx, edi
mov dword [esp], eax
mov eax, 0x80000000
call fcn.684c7c50
mov dword [esp], edi
test eax, eax
jne 0x684c838f
call dword [sym.imp.ucrtbase.dll_free]
lea eax, [ebp - 0x70]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x66]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueW]
mov edi, eax
mov eax, dword [ebp - 0x6c]
sub esp, 0x10
mov dword [esp], eax
test edi, edi
jne 0x684c83cf
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
cmp word [ebp - 0x66], 0x7b
je 0x684c8358
mov dword [ebx], 0
mov edi, 0x800401f3
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, ebx
lea eax, [ebp - 0x66]
call fcn.684c7ff0
test eax, eax
jne 0x684c8348
mov edi, 0x800401f3
jmp 0x684c8348
mov dword [esp], 0x10
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, eax
test eax, eax
je 0x684c83f6
xor eax, eax
mov edi, edx
mov word [edx], ax
jmp 0x684c8299
call dword [sym.imp.ucrtbase.dll_free]
test byte [0x684eb160], 4
je 0x684c8366
mov eax, esi
call fcn.684c73b0
mov dword [esp + 0xc], str.couldnt_open_key_for_ProgID__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.clsid_from_string_reg
mov dword [esp + 4], 0x684eb160
mov dword [esp], 2
call fcn.684c7690
jmp 0x684c8366
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test byte [0x684eb160], 4
je 0x684c8366
mov eax, esi
call fcn.684c73b0
mov dword [esp + 0xc], str.couldnt_query_clsid_value_for_ProgID__s_n
mov dword [esp + 0x10], eax
jmp 0x684c83b1
mov edi, 0x8007000e
jmp 0x684c8348
Function at 0x684ca450
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
or edx, 0x20019
mov ebp, esp
push esi
push ebx
mov ebx, ecx
mov ecx, edx
lea edx, [ebp - 0x60]
add esp, 0xffffff80
mov dword [esp], edx
mov edx, eax
mov eax, 0x80000000
call fcn.684c7c50
test eax, eax
jne 0x684ca4e8
lea eax, [ebp - 0x5c]
lea esi, [ebp - 0x56]
mov dword [ebp - 0x5c], 0x4e
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x60]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x684ca4e8
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym.combase.dll_CLSIDFromString
sub esp, 8
test eax, eax
jne 0x684ca4e8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, 0x80040155
jmp 0x684ca4da

Function at 0x684ca820
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0xcc]
push ebx
sub esp, 0xec
mov esi, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.684ca720
test eax, eax
js 0x684ca93e
lea eax, [ebp - 0xd0]
lea edi, [ebp - 0xc2]
mov dword [ebp - 0xd0], 0x4e
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xcc]
mov dword [esp + 0x10], edi
mov dword [esp + 8], 0
mov dword [esp + 4], str.AppId
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ebx, eax
mov eax, dword [ebp - 0xcc]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
cmp ebx, 2
je 0x684ca94d
test ebx, ebx
jne 0x684ca946
cmp dword [ebp - 0xc8], 1
jne 0x684ca946
xor eax, eax
mov edx, 0x41
jmp 0x684ca8e7
movzx edx, word [eax + str.AppId_]
mov word [ebp + eax - 0x74], dx
add eax, 2
test dx, dx
jne 0x684ca8e0
cmp word [ebp - 0x74], 0
lea eax, [ebp - 0x74]
je 0x684ca910
nop
add eax, 2
cmp word [eax], 0
jne 0x684ca900
lea esi, [esi]
movzx edx, word [edi + ebx]
mov word [eax + ebx], dx
add ebx, 2
test dx, dx
jne 0x684ca910
mov eax, dword [ebp + 0x10]
mov ecx, esi
lea edx, [ebp - 0x74]
mov dword [esp], eax
mov eax, 0x80000000
call fcn.684c7c50
cmp eax, 2
je 0x684ca94d
test eax, eax
jne 0x684ca946
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x80040150
jmp 0x684ca93e
mov eax, 0x80040152
jmp 0x684ca93e
Function at 0x684ca960
Capabilities:
Query or enumerate registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x98
mov dword [ebp - 0x70], 0x4e
mov ebx, dword [ecx]
mov dword [ebp - 0x6c], 0
mov esi, dword [ecx + 4]
test byte [0x684eb160], 8
jne 0x684caa90
test ebx, ebx
je 0x684cab60
test esi, esi
je 0x684cab60
mov eax, dword [ebx]
mov dword [esi], eax
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x6c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20019
mov dword [esp + 4], str.TreatAs
mov dword [esp], ebx
call fcn.684ca720
test eax, eax
js 0x684caa09
lea eax, [ebp - 0x70]
lea edi, [ebp - 0x66]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 8], edi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueW]
sub esp, 0x10
test eax, eax
je 0x684caa38
mov ebx, 1
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x684caa21
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 4], esi
mov dword [esp], edi
call sym.combase.dll_CLSIDFromString
sub esp, 8
mov ebx, eax
test eax, eax
jns 0x684caa0e
test byte [0x684eb160], 2
je 0x684caa0e
mov eax, edi
call fcn.684c73b0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_get_CLSID_from_string__s__hr__lx._n
mov dword [esp + 8], str.CoGetTreatAsClass
mov dword [esp + 4], 0x684eb160
mov dword [esp], 1
call fcn.684c7690
jmp 0x684caa0e
test ebx, ebx
je 0x684cab58
mov eax, ebx
shr eax, 0x10
je 0x684cab40
movzx eax, byte [ebx + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [ebx + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [ebx + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [ebx + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [ebx + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [ebx + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [ebx + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 8]
mov dword [esp + 0x10], eax
movzx eax, word [ebx + 6]
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], 0x684eebec
mov dword [esp + 4], eax
call fcn.684c7210
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x684ef150
mov dword [esp + 8], str.CoGetTreatAsClass
mov dword [esp + 4], 0x684eb160
mov dword [esp], 3
call fcn.684c7690
jmp 0x684ca997
movzx eax, bx
mov dword [esp], 0x684eebda
mov dword [esp + 4], eax
call fcn.684c7210
jmp 0x684cab05
mov eax, 0x684ee820
jmp 0x684cab05
mov ebx, 0x80070057
jmp 0x684caa21
Function at 0x684cab80
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
mov esi, dword [ecx + 4]
mov ebx, dword [ecx]
mov dword [ebp - 0x64], 0
test esi, esi
je 0x684cadaa
lea eax, [ebp - 0x58]
mov dword [esi], 0
mov dword [ebp - 0x58], 0x40
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_FindActCtxSectionGuid]
sub esp, 0x14
test eax, eax
je 0x684cac40
mov ebx, dword [ebp - 0x50]
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x684cada0
add eax, 2
mov dword [esp], eax
call sym.combase.dll_CoTaskMemAlloc
mov dword [esi], eax
sub esp, 4
test eax, eax
je 0x684cadb4
mov edx, dword [ebx + 0x54]
add ebx, dword [ebx + 0x58]
mov dword [esp], eax
xor edi, edi
mov dword [esp + 4], ebx
add edx, 2
mov dword [esp + 8], edx
call sub.ucrtbase.dll_memcpy
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
lea eax, [ebp - 0x60]
mov dword [esp + 8], 0x20019
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.ProgID
mov dword [esp], ebx
call fcn.684ca720
mov edi, eax
test eax, eax
js 0x684cad18
lea eax, [ebp - 0x64]
mov dword [esp + 8], 0
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueW]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], 0
mov dword [esp], eax
call ebx
sub esp, 0x10
test eax, eax
jne 0x684cacf0
test edi, edi
jne 0x684cacf5
mov eax, dword [ebp - 0x64]
add eax, eax
mov dword [esp], eax
call sym.combase.dll_CoTaskMemAlloc
mov dword [esi], eax
sub esp, 4
test eax, eax
je 0x684cadbe
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x64]
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call ebx
sub esp, 0x10
mov edi, eax
test eax, eax
je 0x684cacf5
mov eax, dword [esi]
mov dword [esp], eax
call sym.combase.dll_CoTaskMemFree
mov dword [esi], 0
sub esp, 4
lea esi, [esi]
mov edi, 0x80040154
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, edi
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
lea eax, [ebp - 0x5c]
mov dword [esp], 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_IsWow64Process]
sub esp, 8
test eax, eax
je 0x684cad3a
mov eax, dword [ebp - 0x5c]
test eax, eax
jne 0x684cad70
lea eax, [ebp - 0x64]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueW]
sub esp, 0x10
test eax, eax
jne 0x684cacf0
jmp 0x684cacf5
lea eax, [ebp - 0x60]
mov dword [esp + 8], 0x20119
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.ProgID
mov dword [esp], ebx
call fcn.684ca720
mov edi, eax
test eax, eax
jns 0x684cac69
jmp 0x684cac2b
mov edi, 0x80040154
jmp 0x684cac2b
mov edi, 0x80070057
jmp 0x684cac2b
mov edi, 0x8007000e
jmp 0x684cac2b
mov edi, 0x8007000e
jmp 0x684cacf5
Function at 0x684dba20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x68505028]
test eax, eax
je 0x684dba30
ret
push ebp
xor eax, eax
mov ebp, esp
push ebx
lea ebx, [ebp - 0x2c]
sub esp, 0x54
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x26]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x63006e
mov dword [ebp - 0x14], 0x6c0061
mov dword [ebp - 0x10], 0x700072
mov dword [ebp - 0xc], 0x63
mov dword [ebp - 0x26], 0x720069
mov dword [ebp - 0x22], 0x630070
mov dword [ebp - 0x1e], 0x730073
mov dword [ebp - 0x30], 0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.rpcrt4.dll_RpcStringBindingComposeW]
sub esp, 0x18
test eax, eax
je 0x684dbad0
mov edx, dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x2c], edx
lock cmpxchg dword [0x68505028], edx
test eax, eax
jne 0x684dbaf8
mov eax, dword [0x68505028]
mov ebx, dword [ebp - 4]
leave
ret
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_RpcBindingFromStringBindingW]
sub esp, 8
mov dword [esp], ebx
call dword [sym.imp.rpcrt4.dll_RpcStringFreeW]
sub esp, 4
jmp 0x684dbaae
mov dword [esp], ebx
call dword [sym.imp.rpcrt4.dll_RpcBindingFree]
sub esp, 4
jmp 0x684dbac2
Function at 0x684dc6c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x68505024]
test eax, eax
je 0x684dc6d0
ret
push ebp
xor eax, eax
mov ebp, esp
push ebx
lea ebx, [ebp - 0x28]
sub esp, 0x54
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x22]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x63006e
mov dword [ebp - 0x14], 0x6c0061
mov dword [ebp - 0x10], 0x700072
mov dword [ebp - 0xc], 0x63
mov dword [ebp - 0x22], 0x720069
mov dword [ebp - 0x1e], 0x74006f
mov dword [ebp - 0x2c], 0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.rpcrt4.dll_RpcStringBindingComposeW]
sub esp, 0x18
test eax, eax
je 0x684dc768
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x28], edx
lock cmpxchg dword [0x68505024], edx
test eax, eax
jne 0x684dc790
mov eax, dword [0x68505024]
mov ebx, dword [ebp - 4]
leave
ret
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_RpcBindingFromStringBindingW]
sub esp, 8
mov dword [esp], ebx
call dword [sym.imp.rpcrt4.dll_RpcStringFreeW]
sub esp, 4
jmp 0x684dc747
mov dword [esp], ebx
call dword [sym.imp.rpcrt4.dll_RpcBindingFree]
sub esp, 4
jmp 0x684dc75b
Function at 0x4011c0
Capabilities:
Access peb ldr_data
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4213e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x42b1d0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x42b1d0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push esi
push str.Delete_file__s.
call fcn.004124a0
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00401370
add esp, 0xc
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0xc]
mov esi, 8
cmp dword [esp + 0x20], esi
jae 0x401226
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401252
push str.This_file_didnt_exists__delete_file_function_exit.
call fcn.004124a0
add esp, 4
cmp dword [esp + 0x20], esi
jb 0x4012e3
mov ecx, dword [esp + 0xc]
push ecx
jmp 0x4012db
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x20], esi
jae 0x401260
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x401284
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0x20], esi
jae 0x401279
lea ecx, [esp + 0xc]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x20], esi
jae 0x40129a
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4012d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeleteFile_error__d
call fcn.00412560
add esp, 8
cmp dword [esp + 0x20], esi
jb 0x4012cc
mov edx, dword [esp + 0xc]
push edx
call fcn.0041288e
add esp, 4
xor al, al
jmp 0x4012e5
cmp dword [esp + 0x20], esi
jb 0x4012e3
mov eax, dword [esp + 0xc]
push eax
call fcn.0041288e
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00412899
add esp, 0x2c
ret

Function at 0x402870
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x42b1d0]
xor eax, esp
mov dword [esp + 0x804], eax
push ebp
mov ebp, dword [esp + 0x810]
push esi
push 0x800
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.004183e0
push 0x42422c
push edi
call fcn.00413b3c
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x4028ce
pop esi
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.00412899
add esp, 0x808
ret
push esi
push 0x800
lea ecx, [esp + 0x10]
push 1
push ecx
call fcn.00413df3
push esi
call fcn.00413fbe
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x820], 0
call fcn.00412c85
lea eax, [esp + 0x20]
push ebp
push eax
call fcn.00413540
add esp, 0x20
mov esi, eax
neg esi
sbb esi, esi
neg esi
je 0x40291e
push edi
push str.the_eom_inf_is__s
call fcn.004124a0
add esp, 8
mov ecx, dword [esp + 0x80c]
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.00412899
add esp, 0x808
ret
Function at 0x4048f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x28
mov eax, dword [0x42b1d0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push str.ModifRegist_run..
mov esi, ecx
call fcn.004124a0
movzx eax, byte [edi + 1]
movzx ecx, byte [edi]
add esp, 4
push eax
push ecx
push esi
push str.the_Reg_dir_is__s__value_is__x_x
call fcn.004124a0
add esp, 0x10
xor eax, eax
lea edx, [esp + 8]
push edx
push 0x2001f
push eax
push esi
push 0x80000002
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
je 0x404988
push esi
push str.Open_Regedit_fail_with_error_code__d
call fcn.004124a0
add esp, 8
mov eax, esi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00412899
add esp, 0x28
ret
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push str.osvc
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
je 0x4049cf
push esi
push str.Query_Regedit_fail_with_error_code__d
call fcn.004124a0
add esp, 8
mov eax, esi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00412899
add esp, 0x28
ret
cmp byte [esp + 0x14], 0
lea eax, [esp + 0x14]
jne 0x4049e6
lea ebx, [ebx]
inc eax
cmp byte [eax], 0
je 0x4049e0
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
shl ecx, 8
or ecx, edx
cmp ecx, 0x1ee
jne 0x404a1a
push str._the_key_value_had_been_set_
call fcn.004124a0
add esp, 4
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00412899
add esp, 0x28
ret
mov eax, dword [esp + 8]
push 2
push edi
push 3
push 0
push str.osvc
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x404a57
push esi
push str.set_Regedit_fail_with_error_code__d
call fcn.004124a0
add esp, 8
mov eax, esi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00412899
add esp, 0x28
ret
push str.ModifRegist_exit..
call fcn.004124a0
mov ecx, dword [esp + 0x28]
add esp, 4
pop esi
xor ecx, esp
xor eax, eax
call fcn.00412899
add esp, 0x28
ret
Function at 0x405440
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4209c6
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x42b1d0]
xor eax, esp
mov dword [esp + 0x298], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42b1d0]
xor eax, esp
push eax
lea eax, [esp + 0x2b0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2c0]
lea ecx, [esp + 0x54]
push ecx
push 0x64
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x5c3a41
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, 0xf
push edi
xor ebp, ebp
push str.Logical_Drives:
lea ecx, [esp + 0x40]
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebp
mov byte [esp + 0x44], 0
call fcn.00401c30
mov dword [esp + 0x2b8], ebp
push ebp
push 0x423d93
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebp
mov byte [esp + 0x28], 0
call fcn.00401c30
mov byte [esp + 0x2b8], 1
cmp byte [esp + 0x54], 0
lea esi, [esp + 0x54]
je 0x405591
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, edi
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405505
sub eax, edx
push eax
push esi
lea eax, [esp + 0x40]
call fcn.00401740
push 1
push 0x423ddc
lea eax, [esp + 0x40]
call fcn.00401740
push esi
call edi
cmp eax, 5
jne 0x405570
mov bl, byte [esi]
push 0x1f4
lea edx, [esp + 0xbc]
push edx
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x20], bl
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
test eax, eax
je 0x405570
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0xb8]
push ecx
push edx
call fcn.0041fdc6
add esp, 8
test eax, eax
je 0x4055f5
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405575
sub eax, edx
cmp byte [esi + eax + 1], cl
lea esi, [esi + eax + 1]
jne 0x405500
mov edi, 0xf
mov esi, 0x10
cmp dword [esp + 0x34], esi
jb 0x4055a9
mov edx, dword [esp + 0x20]
push edx
call fcn.0041288e
add esp, 4
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebp
mov byte [esp + 0x20], 0
cmp dword [esp + 0x50], esi
jb 0x4055c9
mov eax, dword [esp + 0x3c]
push eax
call fcn.0041288e
add esp, 4
mov al, 0x30
mov ecx, dword [esp + 0x2b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x298]
xor ecx, esp
call fcn.00412899
add esp, 0x2a8
ret 4
mov esi, 0x10
cmp dword [esp + 0x34], esi
jb 0x40560d
mov eax, dword [esp + 0x20]
push eax
call fcn.0041288e
add esp, 4
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebp
mov byte [esp + 0x20], 0
cmp dword [esp + 0x50], esi
jb 0x405631
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.0041288e
add esp, 4
mov al, bl
jmp 0x4055cb