joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407f37
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx + 0x14]
push esi
mov esi, eax
and esi, 0x3f
jne 0x407f52
or dword [ecx + 0x18], 0x1000000
and eax, 0xffffffc1
or eax, 1
mov dword [ecx + 0x14], eax
mov edx, dword [ecx + 0x14]
mov eax, edx
and al, 0x3f
cmp al, 1
jne 0x407f69
and edx, 0xffffffc2
or edx, 0x40000002
mov dword [ecx + 0x14], edx
mov edx, dword [ecx + 0x14]
mov eax, edx
and al, 0x3f
cmp al, 2
jne 0x407f80
and edx, 0xffffffc3
or edx, 0x82000003
mov dword [ecx + 0x14], edx
mov edx, dword [ecx + 0x14]
mov eax, edx
and eax, 0x3f
cmp al, 3
jne 0x407f98
and edx, 0xf7ffffc4
or edx, 4
mov dword [ecx + 0x14], edx
mov eax, dword [ecx + 0x14]
and eax, 0x3f
cmp esi, eax
pop esi
jne fcn.00408721
ret

Function at 0x407fab
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x5107c0]
xor eax, ebp
mov dword [ebp + 0x190], eax
lea eax, [ebp - 0x80]
push eax
push dword [0x5218b8]
push 0x80000001
test cl, cl
je 0x408006
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x408027
lea ecx, [ebp - 0x7c]
call fcn.004087ad
add eax, eax
push eax
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
push 0x4e8940
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40801e
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x408027
push 0x4e8940
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
call fcn.004b35e5
lea esp, [ebp + 0x194]
pop ebp
ret

Function at 0x40803c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x5107c0]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
push ebx
lea eax, [ebp - 0x78]
xor ebx, ebx
push eax
push dword [0x5218b8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x408077
xor al, al
jmp 0x4080ed
push esi
push edi
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], 0x106
push eax
lea eax, [ebp - 0x74]
mov edi, 0x4e8940
push eax
lea eax, [ebp - 0x7c]
xor esi, esi
push eax
push ebx
push edi
push dword [ebp - 0x78]
inc esi
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4080e0
lea ecx, [ebp + 0x198]
call fcn.004087ad
add eax, eax
push eax
lea eax, [ebp + 0x198]
push eax
push esi
push ebx
push edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp + 0x198]
push eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
movzx ebx, bl
cmove ebx, esi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, bl
pop esi
mov ecx, dword [ebp + 0x3a4]
xor ecx, ebp
pop ebx
call fcn.004b35e5
lea esp, [ebp + 0x3a8]
pop ebp
ret
Function at 0x40813f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
add eax, eax
xor ebx, ebx
mov dword [ebp + 0xc], eax
xor esi, esi
lea eax, [ebp + 0xc]
inc esi
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
movzx ecx, bl
cmove ecx, esi
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408179
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5107c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
mov esi, ecx
push eax
push dword [0x5218bc]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40823b
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 3
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 8
push eax
push 0
push dword [0x5218c0]
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x4081e8
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x18], eax
push 4
pop ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [esi + 0x10]
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [0x5218c4]
push dword [ebp - 0x18]
call edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [esi + 0x24]
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x10]
mov edx, 0x193e8f7f
push eax
push 0
push 0xa16239c3
mov ecx, 0xa04a9cc4
call fcn.00401337
pop ecx
push eax
push dword [ebp - 0x18]
call edi
pop edi
pop ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b35e5
mov esp, ebp
pop ebp
ret
Function at 0x408535
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 4
pop edi
mov edx, edi
mov word [esi + 8], ax
mov ecx, esi
call fcn.00408253
test al, al
je 0x4085e1
push 0x89b1b287
mov edx, 0x31ed0436
mov ecx, 0x88991677
call fcn.00401337
pop ecx
mov ecx, eax
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408594
test dx, dx
je 0x408590
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408594
add eax, edi
add ecx, edi
test dx, dx
jne 0x408570
xor eax, eax
jmp 0x408599
sbb eax, eax
or eax, 1
test eax, eax
je 0x4085e1
push 0x47d17073
mov edx, 0xff8dc6c2
mov ecx, 0x46f9d497
call fcn.00401337
pop ecx
mov ecx, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4085d8
test dx, dx
je 0x4085d4
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4085d8
add ecx, edi
add eax, edi
test dx, dx
jne 0x4085b4
xor eax, eax
jmp 0x4085dd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40860b
push 0x8c27b588
mov edx, 0x347b0339
mov ecx, 0x8d0f1150
call fcn.00401337
pop ecx
mov ecx, eax
mov edx, esi
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4085fc
xor edx, edx
lea ecx, [ebp + 8]
call fcn.00408804
test eax, eax
je 0x408648
push 0xa
push esi
push 1
push 0
push 0x70a79a7f
mov edx, 0xc8fb2cc0
mov ecx, 0x718f3ebd
call fcn.00401337
pop ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x408650
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 5
pop edx
mov ecx, esi
mov word [esi + 0xa], ax
call fcn.00408253
test al, al
je 0x4086b3
push 0xbe670a46
mov edx, 0x63bbcf4
mov ecx, 0xbf4fae71
call fcn.00401337
pop ecx
mov ecx, eax
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4086aa
test dx, dx
je 0x4086a6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4086aa
add eax, 4
add ecx, 4
test dx, dx
jne 0x408684
xor eax, eax
jmp 0x4086af
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4086dd
push 0x9fa98d47
mov edx, 0x27f53bf5
mov ecx, 0x9e81296e
call fcn.00401337
pop ecx
mov ecx, eax
mov edx, esi
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4086ce
xor edx, edx
lea ecx, [ebp + 8]
call fcn.00408804
test eax, eax
je 0x40871a
push 0xc
push esi
push 1
push 0
push 0x39f8e3b7
mov edx, 0x81a4550f
mov ecx, 0x38d047a6
call fcn.00401337
pop ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x408721
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5107c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x10]
mov esi, ecx
push eax
push dword [0x5218bc]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x408795
mov eax, dword [esi + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x18]
push 8
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 3
push 0
push dword [0x5218c0]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40877c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 4
lea eax, [esi + 0x10]
push eax
push 4
push 0
push dword [0x5218c4]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b35e5
mov esp, ebp
pop ebp
ret

Function at 0x40887f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor eax, eax
xor edx, edx
lea ecx, [ebp - 4]
mov word [edi], ax
call fcn.00408804
test eax, eax
je 0x4088cb
push 0x104
push edi
push 0x16281d9d
mov edx, 0xae74ab23
mov ecx, 0x1700b9c2
call fcn.00401337
pop ecx
mov ecx, dword [ebp - 4]
mov edx, eax
call fcn.0040813f
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp word [edi], bx
jne 0x408900
mov ecx, edi
call fcn.00408e4b
push 0xf48af423
mov edx, 0x4cd64293
mov ecx, 0xf5a25296
mov esi, eax
call fcn.00401337
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x408905
sub ecx, edx
sar ecx, 1
push 0x5c
pop eax
lea esi, [edi + ecx*2]
cmp word [esi - 2], ax
je 0x40892b
mov word [esi], ax
add esi, 2
xor eax, eax
mov word [esi], ax
push edi
call fcn.00419cdb
pop ecx
test al, al
jne 0x40893f
push ebx
push edi
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408948
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push ebp
xor edx, edx
lea ecx, [esp + 8]
call fcn.00408804
mov ebp, dword [esp + 0x10]
test eax, eax
je 0x4089b5
cmp byte [esp + 0x14], 0
je 0x408976
push 0x96e7c2eb
mov edx, 0x2ebb7453
mov ecx, 0x97cf655c
jmp 0x408985
push 0x968e72b2
mov edx, 0x2ed2c400
mov ecx, 0x97a6d511
call fcn.00401337
pop ecx
mov ecx, dword [esp + 8]
mov edx, eax
push 0x104
push ebp
call fcn.0040813f
pop ecx
pop ecx
push dword [esp + 8]
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x4089b5
mov al, 1
jmp 0x408a87
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
push edi
push ebp
xor edi, edi
push edi
push edi
push 0x1a
push edi
call ebx
test eax, eax
jne 0x408a1d
push 0xa72e4630
mov edx, 0x1f72f094
mov ecx, 0xa606e1b3
call fcn.00401337
mov edx, eax
pop ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x4089e4
sub edx, esi
lea edi, [ebp - 2]
xor ecx, ecx
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x4089f6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call fcn.00419cdb
pop ecx
cmp al, 1
je 0x408a79
xor edi, edi
push ebp
push edi
push edi
push 0x23
push edi
call ebx
test eax, eax
jne 0x408a7d
push 0x8dd3bcc7
mov edx, 0x358f0a63
mov ecx, 0x8cfb1b22
call fcn.00401337
mov edx, eax
pop ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x408a42
sub edx, esi
lea edi, [ebp - 2]
xor ecx, ecx
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x408a54
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call fcn.00419cdb
pop ecx
cmp al, 1
jne 0x408a7d
mov al, 1
jmp 0x408a85
xor eax, eax
mov word [ebp], ax
xor al, al
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x408b00
Capabilities:
Create directory

Disassembly:
push ecx
push ebp
push esi
push edi
push 0x25c03c9f
mov edx, 0x9d9c8a2f
mov ecx, 0x24e89bb4
call fcn.00401337
pop ecx
xor edx, edx
lea ecx, [esp + 0xc]
mov ebp, eax
call fcn.00408804
mov edi, dword [esp + 0x14]
test eax, eax
je 0x408b7a
mov ecx, dword [esp + 0xc]
mov edx, ebp
push ebx
push 0x104
push edi
call fcn.0040813f
pop ecx
pop ecx
push dword [esp + 0x10]
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
pop ebx
je 0x408b7a
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [edi + eax*2]
cmp esi, edi
je 0x408bad
movzx eax, word [esi - 2]
cmp eax, 0x2f
je 0x408bad
push 0x5c
pop ecx
cmp ax, cx
je 0x408bad
mov word [esi], cx
add esi, 2
jmp 0x408ba8
mov ecx, edi
call fcn.00408e4b
mov esi, eax
sub eax, ebp
movzx ecx, word [ebp]
mov word [eax + ebp], cx
lea ebp, [ebp + 2]
test cx, cx
jne 0x408b85
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x5c
pop eax
mov word [esi + 6], ax
add esi, 8
xor eax, eax
mov word [esi], ax
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 4
Function at 0x408c12
Capabilities:
Create directory
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4cc4cd
mov eax, dword fs:[0]
push eax
sub esp, 0x568
mov eax, dword [0x5107c0]
xor eax, esp
mov dword [esp + 0x560], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5107c0]
xor eax, esp
push eax
lea eax, [esp + 0x57c]
mov dword fs:[0], eax
mov bx, word [esp + 0x58c]
movzx eax, bl
mov edi, dword [eax*4 + 0x5217fc]
test edi, edi
je 0x408e21
lea ecx, [esp + 0x15c]
call fcn.0040887f
push 0
lea eax, [esp + 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esp + 0x15c]
push 0x5c
lea ecx, [esp + 0x20]
lea esi, [esi + eax*2]
pop eax
mov word [esi], ax
add esi, 2
call fcn.0041a2bc
and dword [esp + 0x584], 0
mov edx, 0xeeb0464e
movzx eax, bx
mov ecx, 0x57c457e9
push eax
push 0x56ecf0fd
call fcn.00401337
pop ecx
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x168]
push eax
call fcn.00419cdb
add esp, 0x10
test al, al
je 0x408e10
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x160]
push eax
call fcn.0041b72e
mov ebp, eax
pop ecx
pop ecx
test ebp, ebp
je 0x408e10
push 0
push 0
push dword [esp + 0x20]
mov edx, 0x73fd0af3
mov ecx, 0xca891b44
push ebp
push 0xcba1bc4f
call fcn.00401316
pop ecx
push eax
lea ecx, [esp + 0x30]
call fcn.0041a544
push ebp
call fcn.0040746c
pop ecx
lea eax, [edi + 0x94]
mov edx, 0xd4bd0a6e
push eax
movsx eax, bl
mov ecx, 0x6dc91ba7
push eax
push 0x4e8a30
push 0x4e8940
push 0x6ce1bcca
call fcn.00401337
pop ecx
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [esp + 0x364]
xor ebx, ebx
push ebx
push ebx
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x170]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [esp + 0x364]
push eax
lea ecx, [esp + 0x20]
call fcn.0041afc2
lea eax, [esp + 0x364]
mov edx, 0x288fc7a4
push eax
push 0x90d3711c
mov ecx, 0x91fbd64f
call fcn.00401316
pop ecx
push eax
lea eax, [esp + 0x474]
push eax
call fcn.004b4a31
add esp, 0xc
lea eax, [esp + 0x46c]
mov edx, 0x7dcc7d9e
mov ecx, 0xc4b86c6f
push 1
push ebx
push eax
push 0xc590cb23
call fcn.00401316
pop ecx
push eax
push 0xd4886c65
mov edx, 0x6cd4dad4
mov ecx, 0xd5a0cb2d
call fcn.00401316
pop ecx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
or dword [esp + 0x584], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.0041a3b8
mov ecx, dword [esp + 0x57c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x560]
xor ecx, esp
call fcn.004b35e5
add esp, 0x574
ret 4
Function at 0x408e4b
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor eax, eax
push esi
push eax
push eax
push 0x23
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
pop ebp
test eax, eax
jle 0x408e78
cmp word [esi + eax*2 - 2], bp
je 0x408e78
mov word [esi + eax*2], bp
inc eax
mov ebx, 0x4e8940
lea esi, [esi + eax*2]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
lea eax, [esi + eax*2]
mov word [eax], bp
add eax, 2
pop esi
pop ebp
pop ebx
mov word [eax], cx
ret
Function at 0x409436
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push dword [0x5218bc]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4094ac
push esi
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 3
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0xc
push eax
push 0
push 0x9924ec6a
mov edx, 0x21785ad6
mov ecx, 0x980c4a3f
call fcn.00401337
pop ecx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
xor ecx, ecx
test esi, esi
pop esi
cmovne eax, ecx
jmp 0x4094af
mov eax, dword [ebp - 4]
shr eax, 2
mov esp, ebp
pop ebp
ret 8

Function at 0x4094b8
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push dword [0x5218bc]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x409530
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4094fd
push 0xd84d9626
mov edx, 0x6011209a
mov ecx, 0xd9653061
call fcn.00401337
pop ecx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x409527
shl eax, 2
mov edx, 0x3e646fc0
push eax
push dword [ebp + 8]
mov ecx, 0x871078c5
push 3
push 0
push 0x8638d97c
call fcn.00401337
pop ecx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8

Function at 0x409536
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push dword [0x5218bc]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4095ac
push esi
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 3
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0x15
push eax
push 0
push 0x5d8bbc23
mov edx, 0xe5d70a99
mov ecx, 0x5ca31d8e
call fcn.00401337
pop ecx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
xor ecx, ecx
test esi, esi
pop esi
cmovne eax, ecx
jmp 0x4095af
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x4095b5
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push dword [0x5218bc]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40962a
cmp dword [ebp + 0xc], eax
jne 0x4095f8
push 0x8c72c1a2
mov edx, 0x342e7718
mov ecx, 0x8d5a602d
call fcn.00401337
pop ecx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x409621
push dword [ebp + 0xc]
mov edx, 0xb7eb2669
mov ecx, 0xe9f3132
push dword [ebp + 8]
push 3
push 0
push 0xfb790d3
call fcn.00401337
pop ecx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8

Function at 0x409630
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edx, edx
lea ecx, [ebp - 4]
call fcn.00408804
mov esi, dword [ebp + 8]
xor edi, edi
test eax, eax
je 0x409681
push ebx
push 0x104
push esi
push 0xd8b4fabe
mov edx, 0x60e84c0d
mov ecx, 0xd99c5b74
call fcn.00401337
pop ecx
mov ecx, dword [ebp - 4]
mov edx, eax
call fcn.0040813f
pop ecx
pop ecx
push dword [ebp - 4]
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
pop ebx
jne 0x40968d
push esi
push edi
push edi
push 5
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x409692
sub ecx, edx
sar ecx, 1
push 0x5c
lea eax, [esi + ecx*2]
pop ecx
pop edi
pop esi
cmp word [eax - 2], cx
je 0x4096ba
mov word [eax], cx
add eax, 2
xor ecx, ecx
mov word [eax], cx
mov esp, ebp
pop ebp
ret 4

Function at 0x409ce6
Capabilities:
Get disk size

Disassembly:
sub esp, 0x220
mov eax, dword [0x5107c0]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x23c]
mov ebx, edx
push 0x5c
pop eax
push eax
push ebx
mov ebp, ecx
call fcn.004b3fe0
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x409d20
xor eax, eax
mov word [esi], ax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x409dc7
test esi, esi
je 0x409d45
push 0x5c
pop eax
mov word [esi], ax
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x238]
jb 0x409d66
ja 0x409d61
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x234]
jbe 0x409d66
xor eax, eax
inc eax
jmp 0x409dc9
test edi, edi
je 0x409dc7
mov ecx, dword [0x521818]
lea eax, [esp + 0x20]
mov esi, 0x104
push esi
push eax
push 0x16
call fcn.0041c148
test eax, eax
jne 0x409da5
movzx edx, word [0x517244]
lea eax, [esp + 0x20]
push esi
push eax
xor edx, 0xc7c7
mov ecx, 0x517246
call fcn.00415bfb
pop ecx
pop ecx
movzx eax, word [ebx]
push eax
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x10
push 0x4e8940
push edi
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b35e5
add esp, 0x220
ret
Function at 0x40a8cf
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040abee
test al, al
je 0x40a93d
xor ebx, ebx
lea esi, [edi + 0x102]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [edi + 0x574]
push ebx
push ebx
call fcn.00442453
mov edx, eax
lea eax, [esi + 2]
mov cx, word [esi]
add esi, 2
cmp cx, bx
jne 0x40a8ff
sub esi, eax
lea ecx, [edi + 0x102]
sar esi, 1
lea ecx, [ecx + esi*2]
push ecx
lea eax, [ecx + 2]
mov ecx, edi
push edx
mov dword [edi + 0x564], eax
call fcn.0040a9b6
mov ecx, edi
call fcn.0040ac32
xor eax, eax
cmp byte [edi + 0x310], al
sete al
jmp 0x40a93f
xor al, al
pop edi
pop esi
pop ebx
ret