joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4018f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x44c
mov eax, dword [0x43a044]
test eax, eax
jne 0x40197b
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x424]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call eax
sub esp, 8
lea eax, [ebp - 0x424]
mov dword [esp], eax
call sym._strlen
mov edx, eax
lea eax, [ebp - 0x424]
add eax, edx
mov dword [eax], 0x7a616d5c
mov dword [eax + 4], 0x65676e69
mov dword [eax + 8], 0x6e692d72
mov dword [eax + 0xc], 0x6c617473
mov dword [eax + 0x10], 0x6f6c2e6c
mov word [eax + 0x14], 0x67
mov dword [esp + 4], 0x4280ae
lea eax, [ebp - 0x424]
mov dword [esp], eax
call sym._fopen
mov dword [0x43a044], eax
mov eax, dword [0x43a044]
test eax, eax
je 0x401a55
lea eax, [ebp - 0x20]
mov dword [esp], eax
call sym._time
lea eax, [ebp - 0x20]
mov dword [esp], eax
call sym._localtime
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + 4]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x14]
add eax, 0x76c
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x10]
lea edi, [eax + 1]
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0xc]
mov eax, dword [0x43a044]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp - 0x42c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
mov dword [esp + 8], edx
mov dword [esp + 4], str._d__02d__04d__02d:_02d:_02d_UNINSTALL
mov dword [esp], eax
call sym.fprintf__iobuf__char_const__..._
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [0x43a044]
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.vfprintf__iobuf__char_const__char_
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
add eax, edx
movzx eax, byte [eax]
cmp al, 0xa
je 0x401a55
mov eax, dword [0x43a044]
mov dword [esp + 4], 0x4280d7
mov dword [esp], eax
call sym.fprintf__iobuf__char_const__..._
nop
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401a5e
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x43a048]
test eax, eax
jne 0x401a98
mov dword [esp], str.ADVAPI32.DLL
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.RegDeleteKeyEx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x43a048], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.__Deleting_registry_key__s
call sym.log_char_const__..._
mov eax, dword [0x43a048]
test eax, eax
jne 0x401acd
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call eax
sub esp, 8
jmp 0x401af4
mov eax, dword [0x43a048]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x100
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
call eax
sub esp, 0x10
nop
leave
ret
Function at 0x401ded
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1038
call fcn.0040cd90
sub esp, eax
call sym.getMazingerDir__
mov dword [esp + 8], eax
mov dword [esp + 4], str._sFFExtension
lea eax, [ebp - 0x1008]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_wsprintfA]
call eax
lea eax, [ebp - 0x100c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMozillaFirefoxExtensions
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x401e95
mov eax, dword [ebp - 0x100c]
mov dword [esp + 4], str.df382936_f24b_11df_96e1_9bf54f13e327
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
call eax
sub esp, 8
mov eax, dword [ebp - 0x100c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp], str.Unregistered_firefox_extension
call sym.log_char_const__..._
jmp 0x401ea1
mov dword [esp], str.Cannot_unregister_firefox_extension
call sym.log_char_const__..._
nop
leave
ret

Function at 0x401ea4
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1038
call fcn.0040cd90
sub esp, eax
lea eax, [ebp - 0x100c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwarePoliciesGoogleChromeExtensionInstallForcelist
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x401f2b
mov eax, dword [ebp - 0x100c]
mov dword [esp + 4], 0x4282a6
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
call eax
sub esp, 8
mov eax, dword [ebp - 0x100c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp], str.Unregistered_firefox_extension
call sym.log_char_const__..._
jmp 0x401f37
mov dword [esp], str.Cannot_unregister_chrome_extension
call sym.log_char_const__..._
mov dword [esp + 4], str.SoftwareGoogleChromeExtensionsgacgphonbajokjblndebfhakgcpbemdl
mov dword [esp], 0x80000000
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call eax
sub esp, 8
mov dword [esp + 4], str.SoftwareGoogleChromeExtensionsgacgphonbajokjblndebfhakgcpbemdl
mov dword [esp], 0x80000000
call sym.RegDelete64bitsKey_HKEY____char_const_
nop
leave
ret
Function at 0x401f67
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x234
mov dword [ebp - 0x108], 0
lea edx, [ebp - 0x104]
mov eax, 0
mov ecx, 0x3f
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x208], 0
lea edx, [ebp - 0x204]
mov eax, 0
mov ecx, 0x3f
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp], str.Unregistering_internet_explorer_extension
call sym.log_char_const__..._
mov dword [esp + 0xc], str.CLSID
mov dword [esp + 8], str.Mazinger.IEPlugin
mov dword [esp + 4], str._s_s
lea eax, [ebp - 0x108]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_wsprintfA]
call eax
lea eax, [ebp - 0x108]
mov dword [esp + 4], eax
mov dword [esp], 0x80000000
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call eax
sub esp, 8
lea eax, [ebp - 0x108]
mov dword [esp + 4], eax
mov dword [esp], 0x80000000
call sym.RegDelete64bitsKey_HKEY____char_const_
mov dword [esp + 4], str.Mazinger.IEPlugin
mov dword [esp], 0x80000000
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call eax
sub esp, 8
mov dword [esp + 4], str.Mazinger.IEPlugin
mov dword [esp], 0x80000000
call sym.RegDelete64bitsKey_HKEY____char_const_
lea eax, [ebp - 0x20c]
mov dword [esp + 4], eax
mov dword [esp], str.R_S6_
mov eax, dword [sym.imp.ole32.dll_StringFromCLSID]
call eax
sub esp, 8
mov eax, dword [ebp - 0x20c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x428358
lea eax, [ebp - 0x208]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_wsprintfA]
call eax
mov dword [esp + 0x10], str.InprocServer32
lea eax, [ebp - 0x208]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.CLSID
mov dword [esp + 4], str._s_s_s
lea eax, [ebp - 0x108]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_wsprintfA]
call eax
lea eax, [ebp - 0x108]
mov dword [esp + 4], eax
mov dword [esp], 0x80000000
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call eax
sub esp, 8
lea eax, [ebp - 0x108]
mov dword [esp + 4], eax
mov dword [esp], 0x80000000
call sym.RegDelete64bitsKey_HKEY____char_const_
mov dword [esp + 0x10], str.ProgId
lea eax, [ebp - 0x208]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.CLSID
mov dword [esp + 4], str._s_s_s
lea eax, [ebp - 0x108]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_wsprintfA]
call eax
lea eax, [ebp - 0x108]
mov dword [esp + 4], eax
mov dword [esp], 0x80000000
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call eax
sub esp, 8
lea eax, [ebp - 0x108]
mov dword [esp + 4], eax
mov dword [esp], 0x80000000
call sym.RegDelete64bitsKey_HKEY____char_const_
lea eax, [ebp - 0x208]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.CLSID
mov dword [esp + 4], str._s_s
lea eax, [ebp - 0x108]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_wsprintfA]
call eax
lea eax, [ebp - 0x108]
mov dword [esp + 4], eax
mov dword [esp], 0x80000000
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call eax
sub esp, 8
lea eax, [ebp - 0x108]
mov dword [esp + 4], eax
mov dword [esp], 0x80000000
call sym.RegDelete64bitsKey_HKEY____char_const_
nop
mov edi, dword [ebp - 4]
leave
ret
Function at 0x4023e6
Capabilities:
Persist via ginadll registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], 0xf003f
call sym.Wow64Key_unsigned_long_
lea edx, [ebp - 0x10]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x40249e
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.GinaDll
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40248c
mov dword [esp], str.__Unable_to_set_gina_to_MSGINA
call sym.log_char_const__..._
mov dword [esp], str.Error_setting_registry_value_GinaDll__n
call sym.printf_char_const__..._
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
jmp 0x4024aa
mov dword [esp], str.__Unable_to_deregister_gina
call sym.log_char_const__..._
nop
leave
ret
Function at 0x4027f7
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [esp], str.Unregistering_ShiroKabuto
call sym.log_char_const__..._
mov byte [ebp - 9], 1
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4028df
mov dword [esp + 8], 0xf003f
mov dword [esp + 4], str.ShiroKabuto
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
call eax
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40287a
mov dword [esp], str.WARNING____Cannot_remove_ShiroKabuto_service_n
call sym.printf_char_const__..._
call sym.notifyError__
jmp 0x4028fc
lea eax, [ebp - 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_ControlService]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_DeleteService]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x4028c0
mov dword [esp], str.ShiroKabuto_service_uninstalled_n
call sym.printf_char_const__..._
jmp 0x4028fc
mov dword [esp], str.WARNING____Cannot_delete_ShiroKabuto_service_n
call sym.printf_char_const__..._
mov dword [esp], str.__Cannot_delete_ShiroKabuto_service
call sym.log_char_const__..._
call sym.notifyError__
jmp 0x4028fc
mov dword [esp], str.WARNING____Cannot_access_ShiroKabuto_service_n
call sym.printf_char_const__..._
mov dword [esp], str.__Cannot_access_shiro_kabuto_service
call sym.log_char_const__..._
call sym.notifyError__
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
sub esp, 4
movzx eax, byte [ebp - 9]
leave
ret
Function at 0x402912
Capabilities:
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x144
mov dword [esp], str.Unregistering_BOSS..._n
call sym.log_char_const__..._
mov dword [esp + 4], str.exefile_shellRun_with_administrator_permissioncommand
mov dword [esp], 0x80000000
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call eax
sub esp, 8
mov dword [esp + 4], str.exefile_shellRun_with_administrator_permission
mov dword [esp], 0x80000000
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call eax
sub esp, 8
lea eax, [ebp - 0x10d]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8017
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
test al, al
je 0x402a38
lea eax, [ebp - 9]
mov ecx, eax
call fcn.0041b3e0
lea eax, [ebp - 0x128]
lea edx, [ebp - 9]
mov dword [esp + 4], edx
lea edx, [ebp - 0x10d]
mov dword [esp], edx
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
sub esp, 8
lea eax, [ebp - 9]
mov ecx, eax
call sym.std::allocator_char_::allocator__
lea eax, [ebp - 0x128]
mov dword [esp], str.Soffid_ESSO
mov ecx, eax
call fcn.00422e40
sub esp, 4
lea eax, [ebp - 0x128]
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov dword [esp], eax
call sym.RecursiveRemoveDirectory_char_const_
lea eax, [ebp - 0x128]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x402a38
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x402a3e
Capabilities:
Delete registry value
Get installed programs

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1038
call fcn.0040cd90
sub esp, eax
call sym.getMazingerDir__
mov dword [esp + 4], eax
lea eax, [ebp - 0x1010]
mov dword [esp], eax
call sym._strcpy
lea eax, [ebp - 0x1010]
mov dword [esp], eax
call sym._strlen
mov edx, eax
lea eax, [ebp - 0x1010]
add eax, edx
mov dword [eax], 0x6a6f4b5c
mov dword [eax + 4], 0x62614b69
mov dword [eax + 8], 0x2e6f7475
mov dword [eax + 0xc], 0x657865
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x402ae0
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_tolower]
call eax
mov edx, eax
lea ecx, [ebp - 0x1010]
mov eax, dword [ebp - 0xc]
add eax, ecx
mov byte [eax], dl
add dword [ebp - 0xc], 1
jmp 0x402a9e
mov dword [esp + 4], str.userinit
lea eax, [ebp - 0x1010]
mov dword [esp], eax
call sym.updateUserInit_char_const__char_const_
mov dword [esp], str.MSGINA.DLL
call sym.updateGina_char_const_
call sym.removeCP__
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallSoffidESSO
mov dword [esp], 0x80000002
call sym.RegDelete64bitsKey_HKEY____char_const_
mov dword [esp], 0xf003f
call sym.Wow64Key_unsigned_long_
lea edx, [ebp - 0x10]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWARESoffidesso
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x402b84
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], str.MazingerVersion
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
call eax
sub esp, 8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
call sym.unregisterIEHook__
call sym.unregisterFFHook__
call sym.unregisterChromeHook__
call sym.unregisterShiroKabuto__
call sym.IsWindowsXP__
test eax, eax
setne al
test al, al
je 0x402bab
call sym.unregisterBoss__
nop
leave
ret
Function at 0x402bae
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Removing__s_...
call sym.printf_char_const__..._
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Removing__s
call sym.log_char_const__..._
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_MoveFileExA]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402c1d
mov dword [esp], str.Removed_n
call sym.printf_char_const__..._
mov dword [esp], str.__Removed
call sym.log_char_const__..._
jmp 0x402c78
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_MoveFileExA]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402c60
mov dword [esp], str.Delayed_n
call sym.printf_char_const__..._
mov dword [esp], str.__Delayed
call sym.log_char_const__..._
jmp 0x402c78
mov dword [esp], str.Failed_n
call sym.printf_char_const__..._
mov dword [esp], str.__Failed
call sym.log_char_const__..._
mov dword [esp], 1
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov dword [esp], eax
call sym._fflush
nop
leave
ret
Function at 0x402d00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov byte [ebp - 9], 0
mov dword [esp], 0x42891b
call sym.log_char_const__..._
mov dword [esp], str._Scheduled_file_operations
call sym.log_char_const__..._
mov dword [esp], 0x20019
call sym.Wow64Key_unsigned_long_
lea edx, [ebp - 0x30]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMCurrentControlSetControlSession_Manager
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x402ec6
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x38]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0x43a04c
lea edx, [ebp - 0x34]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.PendingFileRenameOperations
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
setne al
test al, al
je 0x402eb6
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x38]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x34]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.PendingFileRenameOperations
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x402eb6
call sym.getMazingerDir__
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x402eb6
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add eax, 1
add dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 1
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._strstr
test eax, eax
je 0x402e93
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov dword [esp], str.___s_____s__
call sym.log_char_const__..._
add dword [ebp - 0x10], 1
jmp 0x402e22
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp], 0x42891b
call sym.log_char_const__..._
movzx eax, byte [ebp - 9]
leave
ret
Function at 0x40c120
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x40c180
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x43a08c]
test esi, esi
jle 0x40c2a0
mov eax, dword [0x43a090]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x40c1b4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40c237
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40c1a0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x40c2c7
mov eax, dword [0x43a090]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x43a090]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40c2a7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40c230
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x40c240
add dword [0x43a08c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x43a090]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40c230
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40c1be
mov eax, dword [0x43a090]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop