joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409a54
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x200
push 0x5afb80
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a50c4
push 0x5afb80
call fcn.0041e940
add esp, 8
push 0x4a50c8
push 0x5afb80
call fcn.0041e940
add esp, 8
cmp dword [ebp + 8], 0
je 0x409b30
mov eax, dword [ebp + 8]
push eax
push 0x5afda0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4a50d8
push 0x5afda0
call fcn.0041e940
add esp, 8
push 0x4a50dc
push 0x5afda0
call fcn.0041e940
add esp, 8
push 0
push 0x5afda0
call fcn.0042486f
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x409b30
mov eax, dword [ebp - 8]
push eax
call fcn.0042248d
add esp, 4
push 0
push 0x5afb80
push 0x5afda0
call fcn.0040d3dd
add esp, 0xc
test eax, eax
jne 0x409b29
push 0x4000c
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x409bb0
xor eax, eax
jmp 0x409bb0
push 0x200
push 0x5afb80
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a50ec
push 0x5afb80
call fcn.0041e940
add esp, 8
push 0x4a50f0
push 0x5afb80
call fcn.0041e940
add esp, 8
push 0
push 0x5afb80
push 0
call fcn.0041ae8c
add esp, 4
push eax
push 0x53f560
call fcn.0041ab34
add esp, 0x10
mov dword [ebp - 4], eax
push 1
push 0x5afb80
push 1
call fcn.0041ae8c
add esp, 4
push eax
push 0x54f560
call fcn.0041ab34
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x409bb0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409bb5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x200
push 0x5afb80
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a5100
push 0x5afb80
call fcn.0041e940
add esp, 8
cmp dword [ebp + 8], 0
je 0x409c6d
mov eax, dword [ebp + 8]
push eax
push 0x5afda0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4a5110
push 0x5afda0
call fcn.0041e940
add esp, 8
push 0
push 0x5afda0
call fcn.0042486f
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x409c6d
mov eax, dword [ebp - 8]
push eax
call fcn.0042248d
add esp, 4
push 0
push 0x5afb80
push 0x5afda0
call fcn.0040d3dd
add esp, 0xc
test eax, eax
jne 0x409c66
push 0x4000c
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x409c91
xor eax, eax
jmp 0x409c91
push 0
push 0x5afb80
push 0xbc00
push 0x4993c0
call fcn.0041ab34
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x409c91
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409c96
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x200
push 0x5afb80
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a5120
push 0x5afb80
call fcn.0041e940
add esp, 8
cmp dword [ebp + 8], 0
je 0x409d4e
mov eax, dword [ebp + 8]
push eax
push 0x5afda0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4a512c
push 0x5afda0
call fcn.0041e940
add esp, 8
push 0
push 0x5afda0
call fcn.0042486f
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x409d4e
mov eax, dword [ebp - 8]
push eax
call fcn.0042248d
add esp, 4
push 0
push 0x5afb80
push 0x5afda0
call fcn.0040d3dd
add esp, 0xc
test eax, eax
jne 0x409d47
push 0x4000c
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x409d8e
xor eax, eax
jmp 0x409d8e
push 0
push 0x5afb80
push 0xffff
push 0x487118
call fcn.0041ab34
add esp, 0x10
mov dword [ebp - 4], eax
push 1
push 0x5afb80
push 0x22a3
push 0x497118
call fcn.0041ab34
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x409d8e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409d93
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.00408aac
test eax, eax
jne 0x409db0
xor eax, eax
jmp 0x409e83
push 0x200
push 0x5afb80
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a5138
push 0x5afb80
call fcn.0041e940
add esp, 8
cmp dword [ebp + 8], 0
je 0x409e5f
mov eax, dword [ebp + 8]
push eax
push 0x5afda0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4a5148
push 0x5afda0
call fcn.0041e940
add esp, 8
push 0
push 0x5afda0
call fcn.0042486f
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x409e5f
mov eax, dword [ebp - 8]
push eax
call fcn.0042248d
add esp, 4
push 0
push 0x5afb80
push 0x5afda0
call fcn.0040d3dd
add esp, 0xc
test eax, eax
jne 0x409e58
push 0x4000c
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x409e83
xor eax, eax
jmp 0x409e83
push 0
push 0x5afb80
push 0xe000
push 0x479118
call fcn.0041ab34
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x409e83
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409f73
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [0x5ac750], 0
jmp 0x409f91
inc dword [0x5ac750]
cmp dword [0x5ac750], 0x3000
jge 0x409fb2
mov eax, dword [0x5ac750]
mov byte [eax + 0x5ac760], 0
jmp 0x409f8b
push 0x200
push 0x5afb80
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4a5158
push 0x5afb80
call fcn.0041e940
add esp, 8
push 0x5b2fc0
push 0x5ac760
push 0x5afb80
call fcn.0040c4c3
add esp, 0xc
cmp eax, 0xffffffff
jne 0x409ffe
mov eax, 0xffffffff
jmp 0x40a15d
mov ax, word [0x5b2fc0]
mov word [ebp - 4], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
jmp 0x40a0fa
push 0x4a5164
push 0x5b2fd0
call fcn.0041e930
add esp, 8
test byte [ebp + 0xc], 2
je 0x40a054
push 0x5b2fc0
push 0x5ac760
call fcn.0040a437
add esp, 8
cmp eax, 0xffffffff
jne 0x40a054
mov eax, 0xffffffff
jmp 0x40a15d
test byte [ebp + 0xc], 1
je 0x40a083
push 0x5b2fc0
push 0x5ac760
call fcn.0040a63b
add esp, 8
cmp eax, 0xffffffff
jne 0x40a083
mov eax, 0xffffffff
jmp 0x40a15d
jmp 0x40a113
mov ax, word [0x5b2fc0]
mov word [ebp - 4], ax
test byte [ebp + 0xc], 1
je 0x40a0c1
push 0x5b2fc0
push 0x5ac760
call fcn.0040a936
add esp, 8
cmp eax, 0xffffffff
jne 0x40a0c1
mov eax, 0xffffffff
jmp 0x40a15d
test byte [ebp + 0xc], 2
je 0x40a0f0
push 0x5b2fc0
push 0x5ac760
call fcn.0040a162
add esp, 8
cmp eax, 0xffffffff
jne 0x40a0f0
mov eax, 0xffffffff
jmp 0x40a15d
jmp 0x40a113
cmp dword [ebp - 8], 1
je 0x40a088
cmp dword [ebp - 8], 2
je 0x40a013
jmp 0x40a113
mov eax, dword [ebp - 4]
and eax, 0xffff
xor ecx, ecx
mov cx, word [0x5b2fc0]
cmp eax, ecx
je 0x40a156
push 0x5b2fc0
push 0x5ac760
push 0x5afb80
call fcn.0040c60c
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40a156
mov eax, 0xffffffff
jmp 0x40a15d
xor eax, eax
jmp 0x40a15d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b23f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x200
push 0x5afb80
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4a5354
push 0x5afb80
call fcn.0041e940
add esp, 8
push 0x5afb80
call fcn.0040d3b0
add esp, 4
push 0x200
push 0x5afb80
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4a5360
push 0x5afb80
call fcn.0041e940
add esp, 8
push 0x5afb80
call fcn.0040d3b0
add esp, 4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b305
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
mov dword [ebp - 0x204], 0
push 0x200
push 0x5af760
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test byte [ebp + 8], 2
je 0x40b3e1
push 0x5af760
lea eax, [ebp - 0x200]
push eax
call fcn.0041e930
add esp, 8
push 0x4a5370
lea eax, [ebp - 0x200]
push eax
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0040b2a8
add esp, 4
test eax, eax
je 0x40b38b
push 0x200400b
call fcn.00406c68
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
push 0x5af760
lea eax, [ebp - 0x200]
push eax
call fcn.0041e930
add esp, 8
push 0x4a537c
lea eax, [ebp - 0x200]
push eax
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0040b2a8
add esp, 4
test eax, eax
je 0x40b3e1
push 0x200400a
call fcn.00406c68
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
test byte [ebp + 8], 1
je 0x40b4ab
push 0x5af760
lea eax, [ebp - 0x200]
push eax
call fcn.0041e930
add esp, 8
push 0x4a538c
lea eax, [ebp - 0x200]
push eax
call fcn.0041e940
add esp, 8
push 0x4a5390
lea eax, [ebp - 0x200]
push eax
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0040b2a8
add esp, 4
test eax, eax
je 0x40b455
push 0x2004017
call fcn.00406c68
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
push 0x5af760
lea eax, [ebp - 0x200]
push eax
call fcn.0041e930
add esp, 8
push 0x4a53a0
lea eax, [ebp - 0x200]
push eax
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0040b2a8
add esp, 4
test eax, eax
je 0x40b4ab
push 0x2004015
call fcn.00406c68
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
mov eax, dword [ebp - 0x204]
jmp 0x40b4b6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b4bb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x200
push 0x5afb80
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x5afb80
push 0x5b2fe0
call fcn.0041e930
add esp, 8
push 0x4a53b0
push 0x5afb80
call fcn.0041e940
add esp, 8
push 2
push 0x5afb80
call fcn.0042851d
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40b578
cmp dword [0x5a5bf4], 2
je 0x40b554
cmp dword [ebp - 4], 0
je 0x40b54f
push 0x2010003
call fcn.00406c68
add esp, 4
push 0x80005
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40b5ee
jmp 0x40b578
push 0x2010003
call fcn.00406c68
add esp, 4
push 0x80006
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40b5ee
push 0x200
push 0x5afb80
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a53bc
push 0x5afb80
call fcn.0041e940
add esp, 8
push 2
push 0x5afb80
call fcn.0042851d
add esp, 8
mov dword [ebp - 4], eax
cmp dword [0x5a5bf4], 2
je 0x40b5e7
cmp dword [ebp - 4], 0
je 0x40b5e7
push 0x2010004
call fcn.00406c68
add esp, 4
push 0x80005
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40b5ee
xor eax, eax
jmp 0x40b5ee
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c4c3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x180
push 0x8002
mov eax, dword [ebp + 8]
push eax
call fcn.0042486f
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x40c506
push 0x40006
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40c607
mov eax, dword [ebp - 8]
push eax
call fcn.00428561
add esp, 4
mov ecx, dword [ebp + 0x10]
mov word [ecx], ax
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0xffff
jne 0x40c54f
mov eax, dword [ebp - 8]
push eax
call fcn.0042248d
add esp, 4
push 0x40008
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40c607
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.00422947
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40c58b
push 0x40009
call fcn.00406ccc
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.0042248d
add esp, 4
mov eax, 0xffffffff
jmp 0x40c607
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.00422751
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40c5d4
push 0x4000a
call fcn.00406ccc
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.0042248d
add esp, 4
mov eax, 0xffffffff
jmp 0x40c607
mov eax, dword [ebp - 8]
push eax
call fcn.0042248d
add esp, 4
cmp eax, 0xffffffff
jne 0x40c600
push 0x40005
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40c607
xor eax, eax
jmp 0x40c607
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40cbbd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x34], 0
push 0x200
push 0x5af760
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5af760
lea eax, [ebp - 0x200]
push eax
call fcn.0041e930
add esp, 8
push 0x4a5800
lea eax, [ebp - 0x200]
push eax
call fcn.0041e940
add esp, 8
push 0x4a5804
lea eax, [ebp - 0x200]
push eax
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0041ad43
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x28], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x28], 0xffffffff
jne 0x40cc69
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
push 0x5af760
lea eax, [ebp - 0x200]
push eax
call fcn.0041e930
add esp, 8
push str.Api_1lnm.dll
lea eax, [ebp - 0x200]
push eax
call fcn.0041e940
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0041ad80
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2c], 0xffffffff
jne 0x40ccbd
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040ccd5
add esp, 4
xor eax, eax
jmp 0x40ccd0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d05d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
push 0x200
push 0x5afb80
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str._system.ini
push 0x5afb80
call fcn.0041e940
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x40d0ae
push str._hasp_
lea eax, [ebp - 0x88]
push eax
call fcn.0041e930
add esp, 8
jmp 0x40d0c2
push str._HARDLOCK_
lea eax, [ebp - 0x88]
push eax
call fcn.0041e930
add esp, 8
mov dword [0x5ac750], 0
jmp 0x40d0d7
inc dword [0x5ac750]
cmp dword [0x5ac750], 0x3000
jge 0x40d0f8
mov eax, dword [0x5ac750]
mov byte [eax + 0x5ac760], 0
jmp 0x40d0d1
push 0x5b2fc0
push 0x5ac760
push 0x5afb80
call fcn.0040c4c3
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40d122
mov eax, 0xffffffff
jmp 0x40d279
push 0x5afd84
mov ax, word [0x5b2fc0]
push eax
push 0x5ac760
lea eax, [ebp - 0x88]
push eax
call fcn.00409e88
add esp, 0x10
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jne 0x40d16c
push 0x80002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40d279
push 0x5b3230
xor eax, eax
mov ax, word [0x5b2fc0]
xor ecx, ecx
mov cx, word [0x5afd84]
sub eax, ecx
push eax
mov eax, dword [ebp - 0x8c]
inc eax
push eax
push 0x4a5880
call fcn.00409e88
add esp, 0x10
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x40d1bc
mov ax, word [0x5b3230]
mov word [ebp - 4], ax
jmp 0x40d1d3
xor eax, eax
mov ax, word [0x5b2fc0]
xor ecx, ecx
mov cx, word [0x5afd84]
sub eax, ecx
mov word [ebp - 4], ax
push 0x5afd86
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00409e88
add esp, 0x10
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x40d261
push 0x80
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041e7b0
add esp, 4
mov ecx, dword [ebp - 0x90]
add ecx, eax
inc ecx
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0041e830
add esp, 0xc
push 0x4a4fc0
mov eax, dword [ebp + 8]
push eax
call fcn.0041ef50
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40d252
mov eax, dword [ebp - 8]
mov byte [eax], 0
jmp 0x40d25c
mov eax, dword [ebp + 8]
mov byte [eax + 0x80], 0
jmp 0x40d272
push 0x4a5884
mov eax, dword [ebp + 8]
push eax
call fcn.0041e930
add esp, 8
xor eax, eax
jmp 0x40d279
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40d3dd
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40d416
push 0x180
mov eax, dword [ebp + 0xc]
push eax
call fcn.004285d9
add esp, 8
mov eax, dword [ebp - 4]
jmp 0x40d41e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ded1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
push 0x5abf60
push 0xf003f
push 0
push 0x521a60
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5ac184], eax
cmp dword [0x5ac184], 0
je 0x40df3c
cmp dword [0x5ac184], 2
je 0x40df3a
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x40e14f
jmp 0x40df7f
mov dword [ebp - 0x10], 1
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5ac184], eax
cmp dword [0x5ac184], 0
je 0x40df7f
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x40e14f
push 0x5abf60
push 0xf003f
push 0
push 0x521a98
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5ac184], eax
cmp dword [0x5ac184], 0
je 0x40dfe8
cmp dword [0x5ac184], 2
je 0x40dfd4
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x40e14f
cmp dword [ebp - 0x10], 1
jne 0x40dfe3
mov ecx, dword [ebp - 0x20]
or ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x40e14c
mov edx, dword [ebp - 0x20]
or edx, 1
mov dword [ebp - 0x20], edx
mov dword [ebp - 0xc], 0xc
push 0x521ac4
push 0x5ac400
call fcn.0041e930
add esp, 8
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0x5ac400
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x5ac184], eax
cmp dword [0x5ac184], 0
je 0x40e04f
push 0x521acc
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0041e930
add esp, 8
lea edx, [ebp - 0x1c]
push edx
push 0x5b2fd0
call fcn.0041e930
add esp, 8
push 0x521ad4
lea eax, [ebp - 0x1c]
push eax
call fcn.0041efd0
add esp, 8
test eax, eax
jge 0x40e089
cmp dword [ebp - 0x10], 1
jne 0x40e084
mov ecx, dword [ebp - 0x20]
or ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x40e112
push 0x521adc
lea edx, [ebp - 0x1c]
push edx
call fcn.0041efd0
add esp, 8
test eax, eax
jg 0x40e0a8
mov eax, dword [ebp - 0x20]
or al, 2
mov dword [ebp - 0x20], eax
jmp 0x40e112
push 0x521ae4
push 0x5ac400
call fcn.0041e930
add esp, 8
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], 4
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0x5ac400
mov ecx, dword [0x5abf60]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x5ac184], eax
cmp dword [0x5ac184], 0
je 0x40e0ff
mov edx, dword [ebp - 0x20]
or edx, 2
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 4]
and eax, 2
test eax, eax
je 0x40e112
mov ecx, dword [ebp - 0x20]
or ecx, 2
mov dword [ebp - 0x20], ecx
mov edx, dword [0x5abf60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5ac184], eax
cmp dword [0x5ac184], 0
je 0x40e14c
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x40e14f
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret
Function at 0x40e153
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x5abf60
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesHaspnt
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5ac184], eax
cmp dword [0x5ac184], 0
je 0x40e1a5
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x40e2c6
mov dword [ebp - 0xc], 0xc
push 0x521b18
push 0x5ac400
call fcn.0041e930
add esp, 8
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0x5ac400
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x5ac184], eax
cmp dword [0x5ac184], 0
je 0x40e214
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10006
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x40e2c6
push 0x521b20
lea ecx, [ebp - 0x18]
push ecx
call fcn.0041efd0
add esp, 8
test eax, eax
jl 0x40e28a
push 0x521b28
push 0x5ac400
call fcn.0041e930
add esp, 8
mov edx, dword [ebp + 8]
mov dword [ebp - 4], edx
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x5ac400
mov ecx, dword [0x5abf60]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5ac184], eax
cmp dword [0x5ac184], 0
je 0x40e28a
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x40e2c6
mov edx, dword [0x5abf60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5ac184], eax
cmp dword [0x5ac184], 0
je 0x40e2c4
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x40e2c6
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40f10a
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0
cmp dword [0x42dfbc], 0
je 0x40f1ea
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push 0
push 0x521cc4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40f1ea
mov dword [ebp - 0xc], 4
push 0x521cfc
push 0x5ac400
call fcn.0041e930
add esp, 8
mov dword [ebp - 4], 4
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0x5ac400
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40f1e0
push 0x521d1c
push 0x5ac400
call fcn.0041e930
add esp, 8
mov dword [ebp - 8], 0
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push 0x5ac400
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40f1d4
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40f1ea
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x40f1f1
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x42dfbc], 0
je 0x40f268
cmp dword [ebp + 8], 1
jne 0x40f268
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesPerfProcPerformance
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40f268
push str.Disable_Performance_Counters
push 0x5ac400
call fcn.0041e930
add esp, 8
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push 0x5ac400
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret