joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4383be
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45166c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0042a8cf
and dword [ebp - 0x14], 0
cmp dword [0x454310], 0
mov dword [ebp - 0x18], eax
jne 0x438471
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x438519
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x438519
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x454310], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x454314], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x454318], eax
call edi
push eax
call esi
mov dword [0x454320], eax
test eax, eax
je 0x438471
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x45431c], eax
mov eax, dword [0x45431c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4384ca
cmp dword [0x454320], ecx
je 0x4384ca
push eax
call esi
push dword [0x454320]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4384ca
test ebx, ebx
je 0x4384ca
call edi
test eax, eax
je 0x4384c1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4384c1
test byte [ebp - 8], 1
jne 0x4384ca
or dword [ebp + 0x10], 0x200000
jmp 0x4384fd
mov eax, dword [0x454314]
cmp eax, dword [ebp - 0x18]
je 0x4384fd
push eax
call esi
test eax, eax
je 0x4384fd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4384fd
mov eax, dword [0x454318]
cmp eax, dword [ebp - 0x18]
je 0x4384fd
push eax
call esi
test eax, eax
je 0x4384fd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x454310]
call esi
test eax, eax
je 0x438519
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x43851b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042396b
leave
ret
Function at 0x404fd5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp 0x6058db
sbb esi, dword [ebx - 0x22a9a30]
mov ebx, 0xc5f2d6f0
scasd eax, dword es:[edi]
xchg ebx, eax
add ah, 0xdd
push ebp
inc ecx
push ecx
outsb dx, byte [esi]
xchg edi, eax
sahf
popal
outsd dx, dword [esi]
jmp 0xb59dee6c
jns 0x6058c1
mov ch, 0x90
aad 0x4f
rcr dword [edx - 0x7f], 1
stosd dword es:[edi], eax
mov edi, 0x5987cf96
fnstcw word [edi - 0x2b]
sahf
push edx
mov byte [ebp + 0x60], dl
popfd
and eax, 0x9478cbae
adc ebx, ecx
sub dl, bh
xchg ecx, eax
mov dh, 0x77
in eax, 0x78
cmpsd dword [esi], dword es:[edi]
ja 0x605882
js 0x605846
pop ebx
or al, 0xb1
mov cl, 0x94
xor al, 0x2d
in al, dx
lodsd eax, dword [esi]
push ss
jmp 0x60589b
adc eax, 0x3533a3bb
pop ebp
add al, 0xeb
xor ebp, dword [0x6795ebe6]
xor al, 0x61
xor al, 0x61
popal
sar byte [ecx - 0x7f074b9e], cl
inc ebx
jnp 0x6058db
xchg ecx, eax
test al, 0xd6
loopne 0x6058bf
std
loop 0x6058ad
inc esi
push ds
jl 0x6058f2
salc
pop ecx
test eax, 0x750ef50e
outsd dx, dword [esi]
push cs
cmc
push cs
jne 0x60594f
xor eax, 0xd6ad5c60
mov dword [esp + eax*4], edi
lodsb al, byte [esi]
cmp eax, eax
loopne 0x6058b2
invalid
jns 0x605933
jbe 0x605878
das
dec ebp
or ch, dh
sti
add dl, byte [ebp - 0x73]
xchg esp, eax
sbb eax, 0x1b4c3b33
pop ebx
xor eax, 0x5a1a1e54
xchg ebx, eax
sbb ebx, dword [edx - 0x13]
jns 0x605919
test dword [edx + 0x77], edx
jle 0x605941
push es
push cs
enter 0x3fcb, 0x38
dec edi
fsub qword [ecx]
std
aas
cmp byte [edi - 0x24], cl
and ebp, edi
in eax, dx
pop ebx
or cl, byte [ebx - 0x5882ef47]
int 0x1b
in eax, dx
jbe 0x605959
invalid
in al, 0xed
invalid
insd dword es:[edi], dx
imul edi, dword [ebx], 0xa
mov eax, 0xd309d61
push edi
cwde
pop ebx
int 0x52
push ecx
mov ebx, 0xef30f3
aad 0xb1
sub byte [edi - 0x2b], ch
inc esi
outsd dx, dword [esi]
aad 0x46
jle 0x60595c
test eax, 0xa83ff4d
retf
Function at 0x455d75
Capabilities:
Encode data using xor

Disassembly:
pop esi
sub byte [edx - 0x8ed854b], ch
push ss
or ah, byte [ecx - 0x68]
fcomp qword [edx - 0x6ba4e1d4]
les eax, [eax]
cli
cld
in al, 0x7a
dec edi
mov bl, 0xa0
adc al, 0x76
leave
out 0xd8, al
mov al, byte [0x359f6fbb]
mov bl, 0x20
pop ss
shr edx, 1
shl dword [ebx], 1
mov al, 0xf4
movsb byte es:[edi], byte [esi]
and eax, 0xc6e4ad4c
lodsd eax, dword [esi]
in al, 0xc6
mov al, byte [0x9466e157]
fild word [ebx - 0x17408fd5]
test al, 0xc1
fistp word [edi + 0x44]
cmc
inc edi
sub dword [ebx - 0x3a], ebx
cmp dh, byte [edi + 0x347dba6e]
enter 0x202b, 0xffffffffffffffb8
adc ecx, edx
adc dword [ebp - 0x3550507b], 0x1b65c570
sahf
jl 0xac1d7df7
pop dword [edx]
imul esp, dword [edi], 0x4b
lock xor byte [ebx + 0x23], cl
xlatb
pop ecx
cwde
cmp dword [edx + 0x31], ebp
pushal
wait
cmp byte [eax + 0x760bc0a8], bh
scasb al, byte es:[edi]
pop ss
jne 0x455d5d
sbb cl, bl
std
imul esp, dword [eax + 0x7c8e800f], 0xffffffad
scasd eax, dword es:[di]
inc edi
invalid

Function at 0x580755
Capabilities:
Encode data using xor

Disassembly:
test dword [edx], esp
pop esi
cmp esp, edx
jmp ecx
cmp byte [ebx + 0x25], dh
dec esp
jmp 0x5806b6
pop ecx
jns 0x58074f
pop ds
adc byte [ebx + esi*2 - 0x21], 0x45
sahf
or ebx, esi
mov al, 0xe8
test eax, 0xc5888b79
push esp
and dword [ebx], edx
loop 0x580727
stosb byte es:[edi], al
sbb al, 0
loope 0x580721
dec esp
ror dword [ebp - 0xd877cd], cl
mov dh, 0x9a
invalid
adc al, 0x2f
stosd dword es:[edi], eax
or byte [eax - 0x74], cl
mov word [ebp - 0x79], ss
mov bh, 0xbb
xor eax, 0xfedbd3a9
jl 0x5806d1
invalid
pop eax
cli
cmp byte [ecx + 0x448c4e4e], dh
jecxz 0x58078e
mov cl, 0x4e
dec esi
mov word [ebx + 0x60], es
jo 0x5806c5
sahf
mov byte [ebp - 0x22574980], ch
sub word [ebx], sp
sbb eax, 0x8526f333
mov esi, 0x7f515212
mov al, byte [0x105e2d94]
mov byte [ebp - 0xe544c4e], ch
xchg esp, eax
sub ebp, esi
or al, byte [ebx]
rcr dword [ebp - 0x35], 0xa3
outsb dx, byte [esi]
jae 0x580712
and eax, 0xdd05dc45
xchg edi, eax
scasd eax, dword es:[edi]
test byte [edi - 0x4b], bh
add byte [ebp - 0x6d57903a], 0x78
nop
dec edi
out 5, eax
add al, 0xf8
in eax, dx
nop
pop es
inc dword [eax - 0x3a06fa58]
dec eax
xchg ebx, eax
pop es
mov ebp, 0xff7b0e37
pop eax
pop edx
int3
lcall 0x6f55, 0x6d5e1d31
inc eax
cmp esp, dword [ecx]
jmp [edi - 0x2e]
Function at 0x617365
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x617249
jae 0x61722f
mov edi, 0x59f0d28
into
dec ebx
dec esp
push 0x6470622e
bound esi, qword [eax + 0x64]
fdiv dword [edx]
int3
nop
add dh, dl
ljmp 0x6fa1:0xca36aa33
mov edx, 0x7006b245
pop ds
sahf
invalid
and dl, ah
mov dl, 0xb0
cmp byte [ebx - 0x20], 0xb
std
push ds
loop 0x61728d
lcall 0x8bb3, 0xf45da75
into
mov cs, word [esi + 0x3b62235a]
jecxz 0x617273
mov dl, 0x5a
add ebx, 0xdaa2988b
and bh, byte [edx + 0x3ed27637]
mov edx, 0x3ed27637
ja 0x617221
aad 0xe9
and edx, dword [eax + 0x4b07da82]
cmp bh, byte [edi]
fist dword [edi + 0xe]
popal
inc esi
jo 0x617269
push edi
jns 0x61724c
inc ebp
and dl, cl
mov byte [0x63e9325f], al
stosd dword es:[edi], eax
jecxz 0x617298
pop ebp
call dword [esi]
add dword [esi], edi
cmp dword [ebp + 0x69], esi
jl 0x61733e
xchg ebx, eax
cdq
movsb byte es:[edi], byte [esi]
outsd dx, dword [esi]
and ebp, dword [edx - 5]
dec byte [ebx - 0xc]
pushal
out dx, eax
inc ecx
cmp edx, dword [ebx - 0x58]
add byte [ebx + 0x6dfbe49d], ch
push edx
mov dl, byte [ebx]
sub ebx, dword [ebx - 0x2d46dddd]
push esp
in eax, dx
das
adc al, byte [ebp + 0x45]
push 0x9767db0b
cmpsw word [esi], word es:[edi]
mov ch, byte [ebx - 0x7938c2e5]
aad 0xcc
invalid
arpl dx, dx
jne 0x6172df
mov ch, ch
fcomp qword [ecx + 0x7f7485ed]
xchg esp, eax
cdq
in eax, dx
test dword [edi + edi*2 - 0x6c], esi
sar byte ss:[ebp + 0x1372b44], 0x50
mov ebp, 0x1372b44
push eax
dec edi
inc eax
jp 0x617337
out 0xbb, eax
xchg dword [edi], ebx
popfd
mov ebx, 0x9d651f87
mov al, 0xb8
js 0x617346
je 0x6173a4
add eax, 0xe0b2f40b
xlatb
xchg ebp, eax
or ecx, dword [ebp + 0x2ee8bb5f]
mov ebx, 0xd9b22ee8
and eax, esi
adc edi, ecx
jno 0x6173da
dec ecx
xor al, 0x63
invalid
ror dword [edi], 0x7e
loop 0x61734f
outsd dx, dword [esi]
sub esi, dword [ecx - 0x26]
sbb byte [esp + edi*4], bh
js fcn.00617335
loopne 0x61742d
push edx
adc ebx, dword [ebx + 0x2b]
cmp byte [edx - 0x222455d8], dl
invalid
mov edx, dword [edi]
lodsb al, byte [esi]
loope 0x6173e5
or bl, byte [edx + edx]
sbb al, 0x12
call 0xdd8e6e2d
adc dword [edx], edi
test byte [edx + 0x61f5aec], al
sub ah, 0x5a
pop ds
push es
ret
jnp 0x617459
imul dword [edx - 0x4d24554c]
mov ebx, 0x1342abe6
xor eax, 0x729b30af
mov edx, 0xa7821b37
sub dh, al
mov byte [0xf82f252b], al
outsb dx, byte [esi]
sub dword [ebp + 0x606db39d], ebp
xor byte [ecx], cl
mov al, 0x59
loope 0x6173d6
rcr byte [esp + ecx*4 - 0xc7633f6], 0xaa
sub al, dh
lds ebx, [edi]
and bh, byte [ebx - 0xe]
sub esi, dword [edx - 0x5d0401cd]
add esi, edx
invalid
mov byte [0xb78ff203], al
xchg ebp, eax
jge 0x6173ee
mov byte [0x4bf802c0], al
in eax, 0xca
or ecx, dword [esi - 0x6d]
pop edx
insb byte es:[edi], dx
push edx
arpl word [edx], dx
dec edi
mov ebx, 0x277a0a7a
mov byte [0x933f121], al
mov dword [esi + ebx*4 - 0x1c], ecx
jb 0x617472
xchg dh, bh
int 0xd4
rcl dword [ebx + 0x35]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
fadd dword [esi]
sbb eax, dword [ebx + 0x56]
bound eax, qword [edx + 0x10]
xor edx, edi
pop ebx
add dh, byte [edx + ecx*8]
sbb ah, bh
setl byte [esi - 0x33]
mov esi, edx
sal byte [ebx], 1
pop edx
scasb al, byte es:[edi]
ret 0xc2ae
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x401443
pop dword [ebp - 0x38]
mov eax, 0x401443
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xb95fa51e
sub dword [ebp - 0x48], 0x6b0d5fd3
mov dword [ebp - 0x44], 0x1da42f29
sub dword [ebp - 0x44], 0xeb70e2e4
mov dword [ebp - 0x40], 0xefcb0229
add dword [ebp - 0x40], 0x5c814205
mov dword [ebp - 0x3c], 0x4d5dfefd
add dword [ebp - 0x3c], 0xb2a20103
lea eax, [ebp - 0x48]
push eax
mov eax, 0x851b9dd9
sub eax, 0x84db2c95
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x5e6d404a
add dword [ebp - 0x48], 0x1605290c
mov dword [ebp - 0x44], 0x10270e9e
sub dword [ebp - 0x44], 0xcebaad29
mov dword [ebp - 0x40], 0x4eaa9076
sub dword [ebp - 0x40], 0xeb3b240a
mov dword [ebp - 0x3c], 0x2b79f1f2
sub dword [ebp - 0x3c], 0x2b79f1f2
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xcff4923e
sub eax, 0xcfb4212e
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x34c39
push 0
call eax
mov ecx, 0x3aad
mov esi, eax
mov edi, 0x436000
add edi, dword [ebp - 0x38]
mov ebx, 0x3f90c16c
xor dword [ebp - 4], eax
mov edx, dword [edi]
add dword [ebp - 0x10], 0xa2e38af1
sub edx, ebx
sub dword [ebp - 0x28], 0x6cb88189
mov dword [esi], edx
sub dword [ebp - 0x18], 0x2e76a4a0
add esi, 0xd558625f
sub esi, 0xd558625b
add edi, 4
loop 0x40154e
add eax, 0x6f0e6795
sub eax, 0x6f0d8a0e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4c0b73a0
sub ecx, 0x4bcb73a0
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x402a69
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x424010]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402afd
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402aba
cmp dword [ebp + 0x10], ebx
jne 0x402af1
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402acc
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402aa1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.004060b1
cmp eax, ebx
je 0x402b04
push ebx
push dword [0x424010]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402afd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x424010], ebx
jne 0x402afa
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402afa
jmp 0x402afd
Function at 0x406120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422af4], 0
push esi
jne 0x406157
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406131
mov dword [ecx*4 + 0x422af0], eax
inc ecx
cmp ecx, 0x100
jl 0x40612c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406188
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422af0]
xor eax, esi
inc ecx
dec edx
jne 0x40616a
pop edi
not eax
pop esi
ret 0xc

Function at 0x430a40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x21000]
push edi
or ebp, 0xffffffff
jmp 0x430a62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x430a69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x430a58
mov eax, 1
add ebx, ebx
jne 0x430a7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x430a70
jne 0x430a8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x430a70
xor ecx, ecx
sub eax, 3
jb 0x430aa0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x430b12
mov ebp, eax
add ebx, ebx
jne 0x430aab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x430ab8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x430adc
inc ecx
add ebx, ebx
jne 0x430ac8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x430abd
jne 0x430ad9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x430abd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x430afc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x430aed
jmp 0x430a5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x430afc
add edi, ecx
jmp 0x430a5e
pop esi
mov edi, esi
mov ecx, 0xda5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x430b1a
cmp byte [edi], 6
jne 0x430b1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x430b1f
lea edi, [esi + 0x2e000]
mov eax, dword [edi]
or eax, eax
je 0x430b8e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x387cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x38808]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x430b4c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3880c]
or eax, eax
je 0x430b88
mov dword [ebx], eax
add ebx, 4
jmp 0x430b69
call dword [esi + 0x3881c]
mov ebp, dword [esi + 0x38810]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x430bc2
sub esp, 0xffffff80
jmp 0x41dcaf
Function at 0x40955e
Capabilities:
Set registry value

Disassembly:
push 0x218
mov eax, 0x51adb1
call fcn.004b21de
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test ebx, ebx
jne 0x40957e
xor eax, eax
jmp 0x4096f5
push 0x208
xor edi, edi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.004f2670
add esp, 0xc
call fcn.00409be7
lea ecx, [ebp - 0x219]
test al, al
je 0x4095f8
call fcn.00409090
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x220]
call fcn.0040a0bc
push esi
push edi
lea eax, [ebp - 0x218]
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x219]
call fcn.0040862f
push eax
lea ecx, [ebp - 0x220]
call fcn.0040a5a6
lea ecx, [ebp - 0x220]
mov edi, eax
call fcn.0040a198
jmp 0x4096f3
call fcn.00408c4c
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x224]
push eax
push 0x20006
push edi
lea ecx, [ebp - 0x219]
call fcn.00408d48
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4096f3
call fcn.004060a0
push eax
lea ecx, [ebp - 0x220]
call fcn.004056b0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x219]
test esi, esi
je 0x409679
push esi
push eax
call fcn.00408db6
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.00409928
add esp, 0x10
jmp 0x40968f
push eax
call fcn.00408d7f
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.00409928
add esp, 0xc
mov esi, dword [ebp - 0x220]
cmp dword [esi - 4], 1
mov ebx, dword [esi - 0xc]
jle 0x4096b0
push ebx
lea ecx, [ebp - 0x220]
call fcn.00405810
mov esi, dword [ebp - 0x220]
lea eax, [ebx + ebx]
push eax
push esi
push 1
push edi
lea ecx, [ebp - 0x219]
call fcn.004090c7
push eax
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x220]
mov edi, eax
call fcn.00409cd9
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esi - 0x10]
call fcn.00405e50
mov eax, edi
call fcn.004b2188
ret

Function at 0x40984a
Capabilities:
Delete registry value

Disassembly:
push 0xc
mov eax, 0x51ade1
call fcn.004b21aa
cmp dword [ebp + 8], 0
jne 0x409863
xor eax, eax
jmp 0x4098e8
lea eax, [ebp - 0x14]
xor esi, esi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
call fcn.00409a40
pop ecx
pop ecx
test eax, eax
jne 0x40987d
inc eax
jmp 0x4098e8
call fcn.00409be7
test al, al
je 0x4098b0
lea ecx, [ebp - 0x10]
call fcn.0040a0bc
push 1
lea ecx, [ebp + 0xb]
mov dword [ebp - 4], esi
call fcn.004088ca
push eax
lea ecx, [ebp - 0x10]
call fcn.0040ac21
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.0040a198
jmp 0x4098e6
lea eax, [ebp - 0x18]
push eax
push 0x20006
push esi
lea ecx, [ebp + 0xb]
call fcn.00408893
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4098e6
lea ecx, [ebp + 0xb]
call fcn.00408eac
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov eax, esi
call fcn.004b2173
ret
Function at 0x409a40
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x42c
mov eax, 0x51ae1d
call fcn.004b21de
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test esi, esi
jne 0x409a60
xor eax, eax
jmp 0x409be1
xor edi, edi
test ebx, ebx
je 0x409a68
mov dword [ebx], edi
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.004f2670
add esp, 0xc
call fcn.00409be7
lea ecx, [ebp - 0x421]
test al, al
je 0x409adf
call fcn.0040850a
push eax
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x430]
call fcn.0040a0bc
push ebx
lea eax, [ebp - 0x218]
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x421]
call fcn.00408365
push eax
lea ecx, [ebp - 0x430]
call fcn.0040af35
lea ecx, [ebp - 0x430]
mov edi, eax
call fcn.0040a198
jmp 0x409bdf
call fcn.00408ee3
push eax
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x434]
push eax
push 0x20019
push edi
lea ecx, [ebp - 0x421]
call fcn.0040936c
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409bdf
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], 0x104
push eax
lea eax, [ebp - 0x420]
push eax
push edi
push edi
lea ecx, [ebp - 0x421]
call fcn.00408541
push eax
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x434]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x409bdf
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x42c]
call fcn.0040829f
inc esi
lea ecx, [ebp - 0x42c]
mov dword [ebp - 4], esi
call fcn.00409cb1
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x428]
call fcn.0040829f
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 2
call fcn.00409cb1
push edi
push dword [ebp - 0x428]
lea ecx, [ebp - 0x42c]
call fcn.004098ee
test eax, eax
js 0x409bc3
mov edi, esi
test ebx, ebx
je 0x409bc3
mov dword [ebx], esi
mov ecx, dword [ebp - 0x428]
lea ecx, [ecx - 0x10]
call fcn.00405e50
mov ecx, dword [ebp - 0x42c]
lea ecx, [ecx - 0x10]
call fcn.00405e50
mov eax, edi
call fcn.004b2188
ret
Function at 0x40ae0b
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp word [0x564698], 0
push esi
mov esi, 0x564698
jne 0x40ae32
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x100
push eax
push esi
push 2
call sub.Secur32.dll_GetUserNameExW
mov ecx, dword [ebp + 8]
push esi
call fcn.0040829f
mov eax, dword [ebp + 8]
pop esi
leave
ret 4

Function at 0x410a6a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x55f5a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x20d]
call fcn.0040f8bb
push 0x208
mov esi, eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004f2670
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x410b2a
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x410b2a
lea ecx, [ebp - 0x20d]
call fcn.0040f646
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x410b2a
and dword [ebp - 0x214], 0
lea ecx, [ebp - 0x214]
push ecx
push 1
call eax
test eax, eax
je 0x410b2a
mov dword [edi + 0x3f8], eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b2162
leave
ret