joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406b9f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x413118]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x207
lea eax, [ebp - 0x30f]
push 0
push eax
mov byte [ebp - 0x310], 0
call sub.MSVCR100.dll_memset
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.MSVCR100.dll_memset
add esp, 0x18
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
push 0x40de24
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x406c3e
cmp eax, esi
jae 0x406c3e
lea eax, [ebp - 0x108]
push eax
push str.javaplugin.user.profile
push str._D_s_s
lea eax, [ebp - 0x310]
push 0x208
push eax
call dword [sym.imp.MSVCR100.dll__snprintf]
add esp, 0x14
lea eax, [ebp - 0x310]
push eax
mov ecx, edi
call fcn.00406f4c
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040ad48
leave
ret

Function at 0x407278
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4072d2
cmp dword [ebp + 0x10], 1
je 0x4072b7
cmp dword [ebp + 0x10], 2
je 0x4072b7
push 0xd
pop eax
jmp 0x4072d2
mov eax, dword [ebp - 4]
test edi, edi
je 0x4072ce
test eax, eax
je 0x4072cb
cmp byte [eax + edi - 1], 0
je 0x4072ce
jmp 0x4072b2
mov byte [edi], 0
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x4076ee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x413118]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x103
push esi
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edi, [esi + 1]
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x407780
cmp eax, edi
ja 0x407780
push esi
lea eax, [ebp - 0x20b]
push 0
push eax
mov byte [ebp - 0x20c], 0
call sub.MSVCR100.dll_memset
push ebx
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push 0x40e6a0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x407782
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ad48
leave
ret

Function at 0x4078a6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x4078b3
xor eax, eax
pop ebp
ret
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop ebp
ret
Function at 0x40790f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
push 0x44
xor esi, esi
lea eax, [ebp - 0x58]
push esi
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
add esp, 0xc
mov word [ebp - 0x28], ax
lea eax, [ebp - 4]
xor edi, edi
push eax
inc edi
push 0x2000000
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x407988
cmp dword [ebp + 8], esi
je 0x407988
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push 0x8000008
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
cmp eax, esi
jne 0x40798c
xor eax, eax
jmp 0x4079aa
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x407bb6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x413118]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
mov ebx, dword [ebp + 0x798]
push esi
mov esi, dword [ebp + 0x79c]
push edi
mov edi, dword [ebp + 0x794]
push 0x3ff
lea eax, [ebp + 0x389]
push 0
push eax
mov byte [ebp + 0x388], 0
call sub.MSVCR100.dll_memset
push edi
push str.SOFTWAREClassesCLSID_sInprocServer32
mov edi, 0x400
lea eax, [ebp + 0x388]
push edi
push eax
call dword [sym.imp.MSVCR100.dll_sprintf_s]
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
neg esi
push 0
lea eax, [ebp + 0x388]
sbb esi, esi
push eax
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x407c4f
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
jmp 0x407c92
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x40e19a
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x7c]
test eax, eax
je 0x407c79
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x407c92
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x78]
push eax
push ebx
call dword [sym.imp.MSVCR100.dll__mbscmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ad48
add ebp, 0x78c
leave
ret

Function at 0x407e8e
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x407eaf
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x407eaf
inc esi
mov eax, esi
pop esi
ret
Function at 0x407f9c
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x40c397
call fcn.0040ae47
mov eax, dword [ebp + 8]
push 0x104
push eax
xor edi, edi
push edi
push edi
xor ecx, ecx
push 0x40d6fc
mov word [eax], cx
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x408010
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__NULL__pPath__MAX_PATH_
call fcn.0040993d
pop ecx
pop ecx
push edi
push esi
call fcn.0040bac0
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.0040960e
push eax
push esi
push 0x40e3c4
call fcn.0040993d
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x408009
ret
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x4080c1
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x40806d
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x407fd4
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x4080c1
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x4080c1
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x407fd4
mov eax, esi
call fcn.0040aeb3
ret

Function at 0x408b91
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x413118]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x40c41a
call fcn.0040ae47
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x408beb
push edi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.0040993d
pop ecx
pop ecx
push ebx
push edi
call fcn.0040bac0
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.004094d6
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x408c08
call fcn.00409363
jmp 0x408c0a
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call dword [sym.imp.MSVCR100.dll__mbsnbcpy_s]
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x408c56
call fcn.004096aa
jmp 0x408c56
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0040ad48
add ebp, 0x20c
leave
ret
Function at 0x408c80
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x413118]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x40c44a
call fcn.0040ae47
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x408cda
push edi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.0040993d
pop ecx
pop ecx
push ebx
push edi
call fcn.0040bac0
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.004094d6
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x408cf7
call fcn.00409363
jmp 0x408cf9
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call dword [sym.imp.MSVCR100.dll__mbsnbcpy_s]
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x408d45
call fcn.004096aa
jmp 0x408d45
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0040ad48
add ebp, 0x20c
leave
ret

Function at 0x4093be
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x413118]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.004071f1
mov ebx, eax
cmp ebx, esi
je 0x409431
lea ecx, [ebp - 0x74]
call fcn.004071d6
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ad48
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x409449
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.004093be
cmp eax, esi
jne 0x40947b
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x409439
lea ecx, [ebp - 0x74]
call fcn.004071d6
push dword [ebp - 0x78]
mov ecx, edi
call fcn.00407167
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.004071d6
mov eax, esi
jmp 0x409417
Function at 0x4097cb
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x413118]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x823]
push 0
push eax
mov byte [ebp - 0x824], 0
call sub.MSVCR100.dll_memset
push edi
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x824]
push 0x400
push eax
call dword [sym.imp.MSVCR100.dll__vsnprintf_s]
add esp, 0x20
test eax, eax
jns 0x409826
mov byte [ebp - 0x425], 0
push 7
xor eax, eax
mov byte [ebp - 0x24], 0
pop ecx
lea edi, [ebp - 0x23]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.0040974c
push 0x40eb90
lea eax, [ebp - 0x24]
push 0x20
push eax
call dword [sym.imp.MSVCR100.dll_strcat_s]
push esi
lea eax, [ebp - 0x423]
push 0
push eax
mov byte [ebp - 0x424], 0
call sub.MSVCR100.dll_memset
mov eax, ebx
add esp, 0x20
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409871
sub eax, edi
cmp eax, 6
jbe 0x40989a
lea eax, [ebx + eax - 6]
push str.__08x_
push eax
call dword [sym.imp.MSVCR100.dll__mbscmp]
pop ecx
pop ecx
test eax, eax
jne 0x40989a
xor ebx, ebx
inc ebx
jmp 0x40989c
xor ebx, ebx
lea eax, [ebp - 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4098a2
sub eax, edx
mov edi, eax
mov eax, str.Error:
test ebx, ebx
jne 0x4098bb
mov eax, 0x40eaa6
lea ecx, [ebp - 0x824]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
push 0xffffffffffffffff
sub esi, edi
lea eax, [ebp + edi - 0x424]
push esi
push eax
call dword [sym.imp.MSVCR100.dll__snprintf_s]
add esp, 0x20
test eax, eax
jns 0x4098f7
mov dword [ebp - 0x29], 0x2e2e2e
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x424]
push eax
call sub.MSVCR100.dll_memcpy
lea edi, [ebp - 0x424]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409912
lea eax, [ebp - 0x424]
mov esi, 0x40ebbc
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ad48
leave
ret
Function at 0x4099ff
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x179c]
mov eax, 0x181c
call fcn.0040ad60
mov eax, dword [0x413118]
xor eax, ebp
mov dword [ebp + 0x1798], eax
mov eax, dword [ebp + 0x17a4]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x7ff
push edi
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0xf99]
push ebx
push eax
mov dword [ebp - 0x70], ebx
mov byte [ebp + 0xf98], bl
call sub.MSVCR100.dll_memset
push edi
lea eax, [ebp - 0x67]
push ebx
push eax
mov byte [ebp - 0x68], bl
call sub.MSVCR100.dll_memset
add esp, 0x18
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push ebx
push 0x40ed44
lea esi, [edi + 1]
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x6c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409b5f
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0xf98]
push eax
push ebx
jmp 0x409b4e
lea eax, [ebp + 0xf98]
push eax
push 0x40ed70
push 0x40ed9c
lea eax, [ebp - 0x68]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_sprintf_s]
add esp, 0x14
lea eax, [ebp - 0x78]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x68]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409b36
push edi
lea eax, [ebp + 0x799]
push ebx
push eax
mov byte [ebp + 0x798], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x798]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x40eda4
push dword [ebp - 0x78]
mov dword [ebp - 0x6c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409b36
cmp dword [ebp - 0x6c], ebx
jbe 0x409b36
mov eax, dword [ebp + 0x17a8]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x40edb0
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
inc dword [ebp - 0x70]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0xf98]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x6c], esi
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x409a96
mov eax, dword [ebp - 0x74]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x409b65
sub eax, edx
xor ecx, ecx
cmp ecx, eax
mov ecx, dword [ebp + 0x1798]
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
neg eax
pop ebx
call fcn.0040ad48
add ebp, 0x179c
leave
ret
Function at 0x409b8e
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
push dword [ebp + 8]
xor esi, esi
inc esi
mov dword [ebp - 8], esi
call dword [sym.imp.MSVCR100.dll_getenv]
pop ecx
test eax, eax
je 0x409bc3
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
neg eax
sbb eax, eax
inc eax
jmp 0x409c11
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [0x4130ac]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x409be7
xor eax, eax
jmp 0x409c11
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x409c06
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x409d57
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00409c14
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [eax + 1]
lea eax, [ebp - 4]
push eax
push 0x20006
push edi
push dword [0x4130ac]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x409d98
xor eax, eax
pop edi
pop esi
leave
ret
push esi
push dword [ebp + 0xc]
push 1
push edi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x409dbc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x409d94
xor edi, edi
inc edi
jmp 0x409daf
Function at 0x40a3b1
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1f9c]
mov eax, 0x201c
call fcn.0040ad60
mov eax, dword [0x413118]
xor eax, ebp
mov dword [ebp + 0x1f98], eax
mov eax, dword [ebp + 0x1fa4]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x7ff
push edi
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x1799]
push ebx
mov dword [ebp - 0x78], ebx
push eax
mov dword [ebp - 0x70], ebx
mov byte [ebp + 0x1798], bl
call sub.MSVCR100.dll_memset
push edi
lea eax, [ebp + 0x799]
push ebx
push eax
mov byte [ebp + 0x798], bl
call sub.MSVCR100.dll_memset
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
push 0x20019
push ebx
push 0x40f0ac
lea esi, [edi + 1]
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x6c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a51b
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1798]
push eax
push ebx
jmp 0x40a50a
lea eax, [ebp + 0x1798]
push eax
push str.SOFTWAREJavaSoftJava_Runtime_Environment
push str._s_s
lea eax, [ebp + 0x798]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_sprintf_s]
add esp, 0x14
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push ebx
lea eax, [ebp + 0x798]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a4f2
push edi
lea eax, [ebp + 0xf99]
push ebx
push eax
mov byte [ebp + 0xf98], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0xf98]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push str.RuntimeLib
push dword [ebp - 0x7c]
mov dword [ebp - 0x6c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40a4f2
cmp dword [ebp - 0x6c], ebx
jbe 0x40a4f2
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push 0x40f118
push dword [ebp - 0x7c]
mov dword [ebp - 0x6c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
inc dword [ebp - 0x70]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1798]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x6c], esi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x40a451
mov ecx, dword [ebp - 0x74]
lea eax, [ebp - 0x68]
push eax
call fcn.00409489
mov ecx, dword [ebp + 0x1f98]
mov eax, dword [ebp - 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ad48
add ebp, 0x1f9c
leave
ret

Function at 0x40ad48
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x413118]
jne 0x40ad52
repz ret
jmp fcn.0040b28b
Function at 0x402ac0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push eax
push 0x104
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x402b03
push edi
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0xc]
push ecx
call fcn.004038d0
add esp, 8
pop edi
pop esi
add esp, 0x104
ret
mov eax, esi
pop esi
add esp, 0x104
ret

Function at 0x402b10
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x144
push ebx
mov ebx, dword [esp + 0x14c]
push ebp
mov ebp, dword [esp + 0x15c]
push esi
push edi
mov esi, dword [ebp]
mov dword [esp + 0x10], 0
test ebx, ebx
je 0x402b9b
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x402b9b
test esi, esi
je 0x402b55
cmp esi, 0xffffffff
je 0x402b55
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp], esi
je 0x402be1
mov eax, dword [esp + 0x160]
test eax, eax
je 0x402b84
mov ecx, dword [esp + 0x14]
and ecx, 0x10
cmp cl, 0x10
je 0x402b9b
jmp 0x402b93
mov edx, dword [esp + 0x15c]
mov eax, dword [esp + 0x14]
test edx, eax
je 0x402b9b
mov dword [esp + 0x10], 1
test esi, esi
je 0x402be1
cmp esi, 0xffffffff
je 0x402be1
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x402c18
mov eax, dword [esp + 0x160]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x14]
push eax
push esi
je 0x402bee
call edi
test eax, eax
je 0x402be1
mov ecx, dword [esp + 0x14]
and ecx, 0x10
cmp cl, 0x10
jne 0x402c18
lea edx, [esp + 0x14]
push edx
push esi
call edi
test eax, eax
jne 0x402bc9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x144
ret
call edi
test eax, eax
je 0x402be1
mov ebx, dword [esp + 0x15c]
test dword [esp + 0x14], ebx
jne 0x402c18
lea ecx, [esp + 0x14]
push ecx
push esi
call edi
test eax, eax
jne 0x402bfb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00402240
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret