joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40edf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x484d88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
movzx ecx, word [esp + 0x14]
push eax
push ecx
push 0
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40ee32
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40ee4f
push 0x492e6c
mov ecx, edi
call fcn.00407060
mov eax, edi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
call fcn.0045d6c9
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
push esi
lea eax, [esp + 0x1c]
push 0x494f98
push eax
mov dword [esp + 0x1c], 0
call fcn.00408290
mov esi, dword [esp + 0x24]
add esi, 0xfffffff0
push esi
call fcn.004057a0
add eax, 0x10
add esp, 0x10
mov dword [edi], eax
mov dword [esp + 0x10], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40eeb8
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov ecx, dword [esp + 8]
pop esi
mov eax, edi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x414340
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x138
mov eax, dword [0x4ba8b4]
mov dword [esp + 0x134], eax
mov eax, dword [0x4bbb6c]
test eax, eax
jne 0x414447
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPlus_ThemesCurrent
push SysFreeString
mov dword [0x4bbb6c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414447
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41443d
mov edx, dword [str.Windows_Classic.theme]
mov eax, dword [0x4954d0]
mov ecx, dword [0x4954d4]
mov dword [esp + 0xc], edx
mov edx, dword [0x4954d8]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], eax
mov eax, dword [0x4954dc]
mov dword [esp + 0x1c], ecx
mov cx, word [0x4954e0]
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], cx
call edi
mov esi, eax
lea eax, [esp + 0x14]
push eax
call edi
cmp esi, eax
jl 0x41443b
lea ecx, [esp + 0x14]
push ecx
mov edx, ecx
push edx
call edi
sub esi, eax
lea eax, [esp + esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x41443b
mov dword [0x4bbb68], 1
pop edi
pop esi
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x134]
mov eax, dword [0x4bbb68]
call fcn.0043d9f4
add esp, 0x138
ret

Function at 0x415650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4855a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov ecx, ebx
mov dword [esp + 0x18], edi
mov dword [esi], 0x4955a8
call fcn.0045703a
mov dword [ebx], method.CPtrArray.virtual_0
lea ebx, [esi + 0x1c]
mov ecx, ebx
mov byte [esp + 0x18], 1
call fcn.0045703a
mov dword [ebx], method.CPtrArray.virtual_0
or eax, 0xffffffff
push 0x4bbb18
push edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0x10
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x38], 0xc0c0c0
mov dword [esi + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x58], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x416080
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x485638
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
xor eax, eax
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], vtable.CPen.0
mov ecx, dword [esp + 0x3c]
push ecx
push eax
push eax
mov dword [esp + 0x34], eax
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x14]
call fcn.00463dcb
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00463ed9
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x3c], eax
lea eax, [edi + 2]
push eax
push ebx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00463739
lea eax, [edi + 5]
push eax
push ebx
mov ecx, esi
call fcn.00463186
lea ebp, [edi + 3]
push ebp
lea eax, [ebx + 1]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00463739
lea eax, [edi + 6]
push eax
lea eax, [ebx + 1]
push eax
mov ecx, esi
call fcn.00463186
lea eax, [edi + 4]
push eax
lea ecx, [ebx + 2]
push ecx
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.00463739
lea eax, [edi + 7]
push eax
lea eax, [ebx + 2]
push eax
mov ecx, esi
call fcn.00463186
push ebp
lea eax, [ebx + 3]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00463739
lea eax, [edi + 6]
push eax
lea eax, [ebx + 3]
push eax
mov ecx, esi
call fcn.00463186
lea eax, [edi + 2]
lea ecx, [ebx + 4]
push eax
push ecx
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.00463739
lea eax, [edi + 5]
push eax
lea eax, [ebx + 4]
push eax
mov ecx, esi
call fcn.00463186
lea ecx, [edi + 1]
push ecx
lea eax, [ebx + 5]
push eax
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.00463739
lea eax, [edi + 4]
push eax
lea eax, [ebx + 5]
push eax
mov ecx, esi
call fcn.00463186
push edi
add ebx, 6
push ebx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00463739
push ebp
push ebx
mov ecx, esi
call fcn.00463186
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, esi
call fcn.00463ed9
lea ecx, [esp + 0x10]
call fcn.00463e22
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x10], vtable.CGdiObject.0
call fcn.00463e22
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x416780
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4856b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
mov ebp, ecx
mov eax, esi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + 8]
push edi
mov dword [esp + 0x1c], edx
mov edx, dword [eax + 0xc]
xor edi, edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], vtable.CBrush.0
cmp dword [0x4bbb50], 7
mov dword [esp + 0x30], edi
jne 0x4167e7
call fcn.00414340
test eax, eax
jne 0x4167e7
push 0xf
jmp 0x4167e9
push 4
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
call ebx
cmp dword [esp + 0x40], edi
jne 0x41680c
fld qword [0x4955d8]
sub esp, 8
fstp qword [esp]
push eax
call fcn.00413dd0
add esp, 0xc
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x14]
call fcn.00463dcb
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x38]
mov edx, dword [edi + 4]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x10]
call fcn.00463e22
cmp dword [0x4bbb50], 2
jl 0x41685a
mov ecx, dword [edi + 4]
push 0xf
push 2
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_DrawEdge]
mov eax, dword [esp + 0x44]
test eax, eax
push 7
jne 0x41687e
call ebx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi]
add edx, 4
push edx
add eax, 4
push eax
push edi
mov ecx, ebp
call fcn.00416080
jmp 0x416896
call ebx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push eax
add ecx, 4
push ecx
add edx, 5
push edx
push edi
mov ecx, ebp
call fcn.00415f60
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x10], vtable.CGdiObject.0
call fcn.00463e22
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10

Function at 0x416d10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.00479656
movzx ebx, word [esp + 0x14]
mov edi, dword [eax + 0xc]
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 2
push ebx
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x416d41
push 2
push ebx
xor edi, edi
push edi
call ebp
mov esi, eax
test esi, esi
je 0x416d72
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x416d72
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x416d72
push eax
call fcn.004142e0
add esp, 4
push ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp bp, 0x10
je 0x416d79
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push esi
push edi
call fcn.0046a215
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x418190
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x485828
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x2c]
test edi, edi
mov esi, ecx
je 0x418256
lea ecx, [esp + 8]
call fcn.004557c8
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x30]
push 1
push 1
push 0xff
push eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0
call fcn.00455b4c
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4181f9
mov eax, dword [esi + 0x38]
mov edi, dword [edi + 4]
mov edx, dword [esp + 0xc]
push eax
push edi
push edx
jmp 0x41820b
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov edi, dword [edi + 4]
push eax
mov eax, dword [esp + 0x10]
push edi
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push 0
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
mov ecx, esi
call fcn.004176c0
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x18], 0xffffffff
call fcn.00455b41
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0x10
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
push 0
push 0
push edx
push eax
push ecx
mov ecx, esi
call fcn.004176c0
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x10

Function at 0x4188b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.00479656
mov ebx, dword [esp + 0x18]
mov esi, dword [eax + 0xc]
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0xf1
push ebx
push esi
call ebp
test eax, eax
jne 0x4188e5
push 0xf1
push ebx
xor esi, esi
push esi
call ebp
test eax, eax
je 0x418902
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [esp + 0x10], eax
je 0x418902
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x41890c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
movzx eax, word [esi + 6]
shl eax, 2
push eax
call fcn.0045d558
mov ebx, eax
xor eax, eax
add esp, 4
cmp word [esi + 6], ax
jbe 0x418942
lea ecx, [esi + 8]
lea esp, [esp]
movzx edx, word [ecx]
mov dword [ebx + eax*4], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 2
cmp eax, edx
jl 0x418930
movzx eax, word [esi + 6]
push eax
push ebx
mov ecx, edi
call fcn.0047a2fb
push ebx
mov ebp, eax
call fcn.0045d55d
add esp, 4
test ebp, ebp
je 0x418999
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea ebx, [ecx + 7]
push eax
lea edx, [eax + 7]
push ebx
push edx
mov ecx, edi
call fcn.0047a575
movzx ecx, word [esi + 2]
mov eax, dword [esp + 0x18]
mov dword [edi + 0xb4], ecx
movzx edx, word [esi + 4]
push eax
mov ecx, edi
mov dword [edi + 0xb8], edx
call fcn.00417290
mov ebp, eax
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x41e3e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
xor ecx, ecx
test ebp, ebp
jle 0x41e40e
mov edi, edi
xor edx, edx
mov dh, byte [ecx + edi]
xor eax, eax
mov al, byte [ecx + edi + 1]
add ecx, 2
movzx edx, dx
and eax, 0xff
xor eax, edx
add esi, eax
cmp ecx, ebp
jl 0x41e3f0
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x41e431
jmp 0x41e420
and esi, 0xffff
add esi, eax
mov eax, esi
shr eax, 0x10
test eax, eax
jne 0x41e420
mov eax, esi
pop esi
not eax
pop ebp
ret

Function at 0x41e440
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
xor eax, eax
test ebp, ebp
jle 0x41e46f
mov edi, edi
xor edx, edx
mov dh, byte [eax + edi]
xor ecx, ecx
mov cl, byte [eax + edi + 1]
add eax, 2
movzx edx, dx
and ecx, 0xff
xor ecx, edx
add esi, ecx
cmp eax, ebp
jl 0x41e450
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x41e491
jmp 0x41e480
and esi, 0xffff
add esi, eax
mov eax, esi
shr eax, 0x10
test eax, eax
jne 0x41e480
xor eax, eax
cmp si, 0xffff
pop esi
sete al
pop ebp
ret

Function at 0x41e4a0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1a4
mov eax, dword [0x4ba8b4]
mov dword [esp + 0x1a0], eax
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x41e4dc
xor al, al
mov ecx, dword [esp + 0x1a0]
call fcn.0043d9f4
add esp, 0x1a4
ret
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx edx, word [esp + 0xe]
push edx
call fcn.0043ebae
mov ecx, dword [esp + 0x1a4]
add esp, 4
mov al, 1
call fcn.0043d9f4
add esp, 0x1a4
ret

Function at 0x41e910
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x485d99
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
push 0
mov esi, ecx
push 0x8d
mov dword [esp + 0x18], esi
call fcn.0045f246
mov dword [esp + 0x1c], 0
mov dword [esi], 0x495698
lea edi, [esi + 0x70]
call fcn.0045d6c9
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x1c], 1
lea ebx, [esi + 0x78]
call fcn.0045d6c9
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [esp + 0x1c], 2
lea ebp, [esi + 0x7c]
call fcn.0045d6c9
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp], eax
mov eax, dword [esp + 0x24]
push eax
mov ecx, edi
mov byte [esp + 0x20], 3
call fcn.00406d40
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x74], ecx
push edx
mov ecx, ebx
call fcn.00406d40
mov eax, dword [esp + 0x30]
push eax
mov ecx, ebp
call fcn.00406d40
mov ecx, dword [esp + 0x14]
pop edi
mov dword [esi + 0x80], 0
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x41fbf0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x485e28
mov eax, dword fs:[0]
push eax
mov eax, 0x1070
mov dword fs:[0], esp
call fcn.0043e9c0
mov eax, dword [0x4ba8b4]
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x1088]
mov dword [esp + 0x1074], eax
mov dword [esp + 0xc], ebx
push ebx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1090], ebx
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x41fca0
push 0x492e6c
mov ecx, ebp
call fcn.00407060
mov eax, dword [esp + 0x108c]
add eax, 0xfffffff0
mov dword [esp + 0x1080], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41fdc1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x41fdc1
push esi
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x1090]
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], eax
mov word [esp + 0x54], bx
mov dword [esp + 0x50], 0x101
mov eax, dword [esi - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [esi - 8]
sub eax, 0xfff
or eax, ecx
jge 0x41fd02
push 0xfff
lea ecx, [esp + 0x1094]
call fcn.00404140
mov esi, dword [esp + 0x1090]
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
push ebx
push 0x20
push 1
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x41fd49
push 0x492e6c
mov ecx, ebp
call fcn.00407060
lea eax, [esi - 0x10]
mov dword [esp + 0x1084], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x41fdb6
mov eax, dword [esp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x7c]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x41fd70
mov eax, dword [esp + 0x14]
push ebx
lea ecx, [esp + 0x28]
push ecx
push 0xfff
lea edx, [esp + 0x88]
push edx
push eax
call edi
test eax, eax
jne 0x41fd70
lea ecx, [esp + 0x7c]
push ecx
mov ecx, ebp
call fcn.00407060
lea eax, [esi - 0x10]
mov dword [esp + 0x1088], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
pop edi
test ecx, ecx
jg 0x41fdc0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop esi
mov ecx, dword [esp + 0x1078]
mov eax, ebp
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x1070]
pop ebx
call fcn.0043d9f4
add esp, 0x107c
ret
Function at 0x422eb0
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x486070
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebp
push esi
push 0x4bbcec
lea eax, [esp + 0x1c]
push str.Software_
push eax
call fcn.00406eb0
push 0x4944b0
push eax
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x48], 0
call fcn.00406df0
push 0x4bbcec
push eax
lea edx, [esp + 0x30]
push edx
mov byte [esp + 0x54], 1
call fcn.0040b210
push 0x4944a4
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x60], 2
call fcn.00406df0
mov esi, dword [eax]
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
or ebp, 0xffffffff
add esp, 0x30
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422f45
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x30], 1
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422f67
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x30], 0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422f89
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x30], ebp
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x422faa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push esi
push SysFreeString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42305a
push edi
push 0x100
call fcn.0045d558
mov esi, eax
add esp, 4
xor eax, eax
mov ecx, 0x40
mov edi, esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x10]
push esi
lea edx, [esp + 0x2c]
push edx
push eax
mov eax, dword [esp + 0x4c]
push eax
push ecx
mov dword [esp + 0x38], 0x100
mov dword [esp + 0x3c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop edi
jne 0x423051
push esi
lea ecx, [esp + 0x28]
call fcn.0040d730
mov ecx, dword [esp + 0x3c]
push eax
mov dword [esp + 0x34], 3
call fcn.00406d40
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov dword [esp + 0x30], ebp
lea edx, [eax + 0xc]
lock xadd dword [edx], ebp
dec ebp
test ebp, ebp
jg 0x423051
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
call fcn.0045d55d
add esp, 4
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x28]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x424c70
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x486188
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push 0x4bc180
lea eax, [esp + 0x18]
push str.Software_
push eax
call fcn.00406eb0
push 0x4944b0
push eax
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x38], 0
call fcn.00406df0
push 0x4bc180
push eax
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x44], 1
call fcn.0040b210
push 0x4944a4
push eax
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x50], 2
call fcn.00406df0
mov esi, dword [eax]
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
add esp, 0x30
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x424d02
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x20], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x424d25
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x20], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x424d48
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x424d6e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esp + 4]
push eax
push 0x20006
push 0
push esi
push SysFreeString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop esi
jne 0x424dae
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424d90
mov ecx, dword [esp + 0x24]
sub eax, edx
mov edx, dword [esp]
push eax
push edi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret