joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426dcb
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00418cbb
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x426e03
xor eax, eax
jmp 0x426e2f
cmp esi, dword [ebp - 4]
je 0x426e2c
cmp dword [ebp + 0xc], 0
je 0x426e2c
push dword [edi + 0x9c]
call fcn.004269d9
push dword [edi + 0x9c]
mov esi, eax
call fcn.00416bd5
pop ecx
pop ecx
cmp esi, eax
je 0x426dff
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x4010a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
lea eax, [ebp - 0x810]
sub esp, 0x82c
mov dword [ebp - 0x80c], 0x800
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20019
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegedit
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
sub esp, 0x24
test eax, eax
je 0x401118
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea eax, [ebp - 0x80c]
mov dword [esp + 0xc], 0
lea esi, [ebp - 0x808]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0
mov dword [esp + 4], str.LastKey
mov eax, dword [ebp - 0x810]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x4011b0
mov eax, dword [section..bss]
mov dword [esp], esi
add eax, 0x40
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
je 0x4011b0
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0040d7d0
test eax, eax
je 0x4011b0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 9
mov dword [esp + 4], 0x110b
mov dword [esp], ebx
call dword [0x4166fc]
sub esp, 0x10
jmp 0x4011fa
mov dword [esp + 0xc], 0
mov esi, dword [0x4166fc]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x110a
mov eax, dword [section..bss]
mov eax, dword [eax + 4]
mov dword [esp], eax
call esi
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 0x1102
mov dword [esp], ebx
call esi
sub esp, 0x10
mov eax, dword [ebp - 0x810]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x401430
Capabilities:
Get hostname

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, ecx
sub esp, 0x22c
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x228], 0
test edx, edx
je 0x401590
lea eax, [ebp - 0x228]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.0040c960
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x228]
test ebx, ebx
je 0x401518
test eax, eax
je 0x4014d0
cmp eax, 0x80000000
je 0x4015e0
cmp eax, 0x80000001
je 0x401620
cmp eax, 0x80000002
jne 0x40153d
mov eax, dword [str.HKEY_LOCAL_MACHINE]
mov dword [ebp - 0x21c], eax
lea esi, [esi]
mov dword [ebp - 0x224], 0x104
lea eax, [ebp - 0x224]
lea ebx, [ebp - 0x218]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetComputerNameW]
lea eax, [ebp - 0x220]
sub esp, 8
mov dword [ebp - 0x220], ebx
call fcn.004012f0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
test eax, eax
je 0x401507
cmp eax, 0x80000000
je 0x4015f0
cmp eax, 0x80000001
je 0x4015c0
cmp eax, 0x80000002
je 0x401600
cmp eax, 0x80000003
je 0x4015d0
cmp eax, 0x80000005
je 0x401610
mov edx, str.Unknown_HKEY._Please_report.
cmp eax, 0x80000006
je 0x401588
mov dword [ebp - 0x21c], edx
test ebx, ebx
jne 0x4014d0
lea eax, [ebp - 0x220]
call fcn.004012f0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov edx, dword [str.HKEY_DYN_DATA]
jmp 0x40155f
mov dword [esp + 0xc], 0
mov dword [esp + 8], 9
mov dword [esp + 4], 0x110a
mov dword [esp], eax
call dword [0x4166fc]
sub esp, 0x10
mov edx, eax
jmp 0x401471
mov eax, dword [str.HKEY_CURRENT_USER]
mov dword [ebp - 0x21c], eax
jmp 0x40156d
mov edx, dword [str.HKEY_USERS]
jmp 0x40155f
mov eax, dword [str.HKEY_CLASSES_ROOT]
mov dword [ebp - 0x21c], eax
jmp 0x4014d0
mov eax, dword [str.HKEY_CLASSES_ROOT]
mov dword [ebp - 0x21c], eax
jmp 0x40156d
mov eax, dword [str.HKEY_LOCAL_MACHINE]
mov dword [ebp - 0x21c], eax
jmp 0x40156d
mov edx, dword [str.HKEY_CURRENT_CONFIG]
jmp 0x40155f
mov eax, dword [str.HKEY_CURRENT_USER]
mov dword [ebp - 0x21c], eax
jmp 0x4014d0
Function at 0x402b20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [edx + 0x10]
push ebx
lea esi, [edx + 8]
mov ebx, edx
sub esp, 0x24
mov dword [ebp - 0x14], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
mov eax, dword [edx]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [ebp - 0x18], eax
call eax
sub esp, 0x18
test eax, eax
je 0x402be0
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x10], 0
cmp eax, 2
je 0x402bb0
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x8045
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00402740
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov dword [ebx + 0xc], 0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test ecx, ecx
jne 0x402b78
mov dword [ebx + 8], 1
mov dword [ebx + 0x10], 2
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll_malloc]
xor ecx, ecx
mov dword [ebx + 0xc], eax
mov word [eax], cx
jmp 0x402c2b
mov eax, dword [ebx + 0x10]
add eax, 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x10], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
mov eax, dword [ebp - 0x18]
call eax
sub esp, 0x18
test eax, eax
jne 0x402c50
mov eax, dword [ebx + 0x10]
test al, 1
je 0x402c38
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0xc], eax
mov eax, 1
jmp 0x402ba4
mov ecx, dword [ebp - 0x10]
and eax, 0xfffffffe
xor edx, edx
mov word [ecx + eax], dx
jmp 0x402c25
mov ecx, dword [ebx + 4]
jmp 0x402b78

Function at 0x4037f0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x10]
push ebx
sub esp, 0x18
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x2001b
mov dword [esp + 8], 0
mov dword [esp], edi
mov dword [esp + 4], esi
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
jne 0x403890
mov ebx, eax
mov dword [esp + 0xc], 0x8150
mov dword [esp + 8], 0x814f
mov dword [esp + 4], 0x34
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00403450
cmp eax, 6
je 0x403870
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.shcore.dll_SHDeleteKeyW]
sub esp, 8
test eax, eax
jne 0x4038b0
mov ebx, 1
jmp 0x403854
mov dword [esp + 4], 0x7df
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esp], eax
call fcn.00402740
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], esi
mov dword [esp + 4], 0x805e
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00402740
jmp 0x403854
Function at 0x4038d0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
sub esp, 0x18
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], 0x2001b
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x403918
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
mov ebx, eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 8]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
sub esp, 8
test eax, eax
je 0x40393b
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0x403960
xor ebx, ebx
test eax, eax
sete bl
mov eax, dword [ebp - 8]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, ebx
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], 0x8045
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00402740
jmp 0x403942
Function at 0x403980
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x270
mov eax, dword [ecx]
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 0
mov esi, dword [ecx + 0xc]
mov edx, dword [ecx + 8]
mov ebx, dword [ecx + 0x10]
mov dword [ebp - 0x268], eax
mov eax, dword [ecx + 4]
lea ecx, [ebp - 0x25c]
mov dword [ebp - 0x264], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0x2001b
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
mov dword [ebp - 0x260], eax
test eax, eax
jne 0x403bb0
mov dword [esp], 0
lea esi, [ebp - 0x210]
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], 0x100
mov dword [esp + 8], esi
mov dword [esp + 4], 0x805d
mov dword [esp], eax
call dword [0x4166c0]
sub esp, 0x10
test eax, eax
je 0x403b68
mov edi, 1
jmp 0x403a54
add edi, 1
cmp edi, 0x64
je 0x403b90
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [0x416748]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x25c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
cmp eax, 2
jne 0x403a48
mov eax, dword [ebp - 0x264]
mov esi, 2
sub eax, 3
cmp eax, 8
jbe 0x403bd8
lea edi, [ebp - 0x258]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov eax, dword [ebp - 0x264]
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x25c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
test eax, eax
jne 0x403b90
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov eax, dword [ebp - 0x264]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [section..bss]
mov eax, dword [eax + 8]
mov dword [esp], eax
call fcn.00407fc0
lea edx, [ebp - 0x250]
mov ecx, 3
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x240], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x102b
mov eax, dword [section..bss]
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [0x4166fc]
sub esp, 0x10
mov dword [ebp - 0x260], 1
mov eax, dword [ebp - 0x25c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov eax, dword [ebp - 0x260]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 4], 0x7dc
mov eax, dword [ebp - 0x268]
mov dword [esp], eax
call fcn.00402740
jmp 0x403b68
mov dword [esp + 4], 0x7dc
mov eax, dword [ebp - 0x268]
mov dword [esp], eax
call fcn.00402740
mov dword [ebp - 0x260], 0
jmp 0x403b7a
mov esi, dword [eax*4 + 0x412240]
jmp 0x403ab7
Function at 0x403bf0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x403cd3
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x403cd3
lea edi, [ebp - 0x20]
mov dword [esp + 0xc], 0x2001b
mov dword [esp + 0x10], edi
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
mov ebx, eax
test eax, eax
jne 0x403cc0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
je 0x403d40
mov eax, dword [ebp + 8]
mov edx, edi
mov dword [ebp - 0x1c], esi
call fcn.00402b20
mov edi, eax
test eax, eax
jne 0x403ce0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x7e1
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00402740
lea esp, [ebp - 0xc]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
test eax, eax
jne 0x403d72
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x20]
mov esi, dword [sym.imp.advapi32.dll_RegDeleteValueW]
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
jne 0x403d60
mov ebx, edi
jmp 0x403c93
mov dword [esp + 8], esi
mov dword [esp + 4], 0x7de
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00402740
jmp 0x403c93
mov eax, dword [ebp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call esi
sub esp, 8
mov dword [esp + 4], 0x7e1
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00402740
jmp 0x403c93
Function at 0x404750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
mov ebx, eax
lea eax, [ebp - 0x20]
sub esp, 0x48
mov dword [ebp - 0x24], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegeditFavorites
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x4047a0
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, eax
mov dword [esp + 0x2c], 0
lea eax, [ebp - 0x18]
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryInfoKeyW]
sub esp, 0x30
test eax, eax
jne 0x404930
mov edx, dword [ebp - 0x1c]
test edx, edx
jne 0x404830
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
add eax, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov esi, eax
test ebx, ebx
je 0x404879
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x800
mov dword [esp], ebx
call dword [0x4165ec]
mov eax, dword [ebp - 0x1c]
sub esp, 0x10
test eax, eax
je 0x404910
xor edi, edi
jmp 0x40488c
add edi, 1
cmp edi, dword [ebp - 0x1c]
jae 0x404910
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumValueW]
sub esp, 0x20
test eax, eax
jne 0x404880
cmp dword [ebp - 0x10], 1
jne 0x404880
test ebx, ebx
je 0x404970
lea eax, [edi + 0x80e8]
mov dword [esp + 0xc], esi
add edi, 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [0x4165ec]
sub esp, 0x10
cmp edi, dword [ebp - 0x1c]
jb 0x40488c
lea esi, cs:[esi]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x404825
test byte [0x410014], 2
je 0x404816
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RegQueryInfoKey_failed:__ld_n
mov dword [esp + 8], str.add_favourite_key_items
mov dword [esp + 4], 0x410014
mov dword [esp], 1
call fcn.004046f0
jmp 0x404816
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x404880
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x180
mov dword [esp], eax
call dword [0x4166fc]
sub esp, 0x10
jmp 0x404880
Function at 0x409900
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.ucrtbase.dll_exit]
lea esi, cs:[esi]
lea esi, cs:[esi]

Function at 0x409920
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 1
mov ebp, esp
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
call fcn.00409440
call fcn.00409900
lea esi, cs:[esi]
Function at 0x40a750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0x10
mov dword [esp + 4], 0x412c28
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x40a830
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__fileno]
mov dword [esp + 4], 0x8000
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__setmode]
mov dword [esp + 0xc], ebx
test edi, edi
je 0x40a808
mov esi, dword [sym.imp.ucrtbase.dll_fwrite]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x412d2e
call esi
mov eax, str.Windows_Registry_Editor_Version_5.00_r_n
nop
add eax, 2
cmp word [eax], 0
jne 0x40a7d0
sub eax, str.Windows_Registry_Editor_Version_5.00_r_n
mov dword [esp + 0xc], ebx
sar eax, 1
mov dword [esp + 4], 2
mov dword [esp + 8], eax
mov dword [esp], str.Windows_Registry_Editor_Version_5.00_r_n
call esi
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0xa
mov dword [esp + 4], 1
mov dword [esp], str.REGEDIT4_r_n
call sub.ucrtbase.dll_fwrite
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x412c2c
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll__wfopen]
mov ebx, eax
test eax, eax
jne 0x40a7a2
mov dword [esp], 0x412c32
call dword [sym.imp.ucrtbase.dll__wperror]
mov dword [esp + 4], esi
mov dword [esp], 0xbbf
call fcn.004098e0
call fcn.00409900
jmp 0x40a7a2

Function at 0x40add0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x10
test ecx, ecx
je 0x40ae20
cmp word [edx], 0
je 0x40ae50
mov eax, edx
lea esi, cs:[esi]
add eax, 2
cmp word [eax], 0
jne 0x40adf0
sub eax, esi
sar eax, 1
mov dword [esp + 0xc], ebx
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 2
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
test edx, edx
je 0x40ae2d
mov eax, edx
call fcn.0040ad20
mov esi, eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fputs]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x40adfd
Function at 0x40bd30
Capabilities:
Read file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x50
mov ebx, dword [ecx]
test ebx, ebx
je 0x40be70
lea eax, [ebp - 0x42]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_fread]
cmp eax, 1
jne 0x40be70
pinsrw xmm0, word [ebp - 0x42], 0
movdqa xmm3, xmm0
movd eax, xmm0
pxor xmm2, xmm2
xor ecx, ecx
punpcklbw xmm3, xmm2
mov edx, 0x40ab30
movdqa xmm1, xmm3
cmp al, 0xff
je 0x40be98
mov dword [0x415de0], edx
lea eax, [ebp - 0x3c]
mov edx, 0xffffffff
mov dword [ebp - 0x40], ebx
lea ebx, [ebp - 0x40]
mov word [ebp - 0x34], dx
mov edx, 0x40a490
mov dword [ebp - 0x38], ecx
movd dword [ebp - 0x3c], xmm1
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
jmp 0x40be12
mov edx, dword [ebp - 0x10]
mov edx, dword [edx*4 + 0x412de0]
mov dword [esp + 4], eax
mov dword [esp], ebx
call edx
test eax, eax
jne 0x40be08
movzx eax, word [ebp - 0x34]
lea edx, [eax - 3]
cmp dx, 1
jbe 0x40be80
mov eax, dword [ebp - 0x28]
mov ebx, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x40be5f
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 8]
mov eax, 1
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
lea esp, [ebp - 8]
xor eax, eax
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
cmp ax, 3
sete al
lea esp, [ebp - 8]
movzx eax, al
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
cmp ah, 0xfe
jne 0x40bd9e
mov ecx, 1
mov edx, 0x40a580
jmp 0x40bd9e
Function at 0x40f070
Capabilities:
Accept command line arguments
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov edx, 2
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
cmp word [eax + ecx + 0x5c], 2
je 0x40f0c0
mov edx, 1
mov dword [esp], edx
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x40f0e0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x54
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x40f137
xor ecx, ecx
xor edx, edx
jmp 0x40f119
cmp ax, 0x5c
jne 0x40f1a0
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x40f137
cmp ax, 9
je 0x40f125
cmp ax, 0x20
jne 0x40f100
test ecx, ecx
je 0x40f18b
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x40f119
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x20], 1
je 0x40f1c0
movzx esi, word [ebp - 0x1c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00408d80
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x40f188
cmp ax, 0x20
je 0x40f188
jmp 0x40f137
cmp ax, 0x22
jne 0x40f129
and edx, 1
jne 0x40f129
xor ecx, 1
jmp 0x40f10d
mov eax, 1
mov esi, 1
mov word [ebp - 0x1c], ax
jmp 0x40f150