joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43182a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0043182a
xor esi, esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyA]
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
push 4
mov ebx, dword [ebp + 0x14]
push ebx
push 4
push 0
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x4318a2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004318a2
xor esi, esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
fild dword [0x186b324]
fild dword [0x186aae0]
call fcn.0045a6e9
call fcn.0045a86f
push eax
push 0
mov ebx, dword [ebp + 0xc]
call fcn.0045b77c
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
push 4
lea ebx, [ebp + 0x14]
push ebx
push 4
push 0
mov ebx, dword [ebp + 0x10]
call fcn.0045b77c
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x43193d
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0043193d
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push 0
xor eax, eax
lea ebx, [esp]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
push 0
fild dword [0x186b324]
fild dword [0x186aae0]
call fcn.0045a6e9
call fcn.0045a86f
push eax
push 0
push 0
push 0
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
add esp, 4
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegDeleteValueA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
push 0
xor eax, eax
lea ebx, [esp]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
push 0
push 0xf003f
push 0
push 0
push 0
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
add esp, 4
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegDeleteValueA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x431a30
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00431a30
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push 0
xor eax, eax
lea ebx, [esp]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
push 0
fild dword [0x186b324]
fild dword [0x186aae0]
call fcn.0045a6e9
call fcn.0045a86f
push eax
push 0
push 0
push 0
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
add esp, 4
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x431acb
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00431acb
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
mov ebx, dword [ebp + 0xc]
call fcn.0045b45a
mov eax, 1
call fcn.00452863
mov edx, 0x185e9b0
call fcn.0045b687
call fcn.0045abcf
je 0x431b2a
mov ebx, dword [ebp + 0xc]
call fcn.0045b45a
mov edx, 0x185e9b0
call fcn.0045b687
call fcn.0045ab3a
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
call fcn.0045b4a3
push 0
push 0
xor eax, eax
lea ebx, [esp]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
push 0
fild dword [0x186b324]
fild dword [0x186aae0]
call fcn.0045a6e9
call fcn.0045a86f
push eax
push 0
push 0
push 0
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
add esp, 4
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x431c32
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
push 0
push 0
push 0
xor eax, eax
lea ebx, [esp + 4]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
push 0
fild dword [0x186b324]
fild dword [0x186aae0]
call fcn.0045a6e9
call fcn.0045a86f
push eax
push 0
push 0
push 0
mov ebx, dword [ebp + 0xc]
call fcn.0045b45a
mov ebx, dword [ebp + 0x10]
call fcn.0045b45a
call fcn.0045ab3a
lea ebx, [esp + 0x1c]
call fcn.0045a938
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 8
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x431c32
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x431c4f
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00431c4f
xor esi, esi
xor edi, edi
mov ecx, 0x52
push esi
dec ecx
jne 0x431c6b
lea ebx, [ebp + 8]
call fcn.0045b45a
xor eax, eax
call fcn.00451592
lea ebx, [ebp + 8]
mov ecx, 0x104
call fcn.0045b4a3
push 0
mov eax, 2
mov ecx, 1
add eax, ecx
mov ecx, 4
add eax, ecx
mov ecx, 8
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
jne 0x431cbd
jmp 0x431d5a
mov eax, 0x128
mov dword [ebp - 0x1c0], eax
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32First]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp - 0x1cc], 0
je 0x431d4e
lea ebx, [ebp - 0x19c]
call fcn.0045b45a
xor eax, eax
call fcn.00451592
lea ebx, [ebp + 8]
call fcn.0045b45a
call fcn.0045abcf
jne 0x431d33
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x98], eax
jmp 0x431d4e
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32Next]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
jmp 0x431cf0
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104

Function at 0x43206e
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0043206e
xor esi, esi
xor edi, edi
mov ecx, 0x16
push esi
dec ecx
jne 0x43208a
push 0
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
mov edx, 0x1863758
call fcn.0045b687
lea ebx, [esp + 4]
call fcn.0045a938
fild qword [0x186adbc]
call fcn.0045a86f
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
mov eax, esi
test eax, eax
je 0x432154
mov edi, 0x40
push 0
push 0
push 0
xor eax, eax
lea ebx, [esp + 4]
push ebx
mov dword [ebx], eax
push 0
xor eax, eax
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
push 0
lea ebx, [ebp - 0x9c]
mov dword [ebx], edi
push ebx
lea ebx, [ebp - 0xdc]
push ebx
push 0
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegEnumValueA]
add esp, 8
mov edi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x43214d
lea ebx, [ebp - 0xdc]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegDeleteValueA]
fldcw word [ebp - 0x10]
jmp 0x432152
jmp 0x432154
jmp 0x4320e0
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x432175
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00432175
xor esi, esi
xor edi, edi
mov ecx, 0xe
push esi
dec ecx
jne 0x432191
push 0
push 0
push 0xf003f
mov edx, 0x185e9a0
call fcn.0045b687
lea ebx, [esp + 8]
call fcn.0045a938
mov edx, 0x185e9a0
call fcn.0045b687
lea ebx, [esp + 8]
call fcn.0045a938
call dword [sym.imp.ADVAPI32.DLL_OpenSCManagerA]
push eax
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00456355
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 8
fldcw word [ebp - 0x10]
mov esi, eax
fild dword [0x186b388]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
jne 0x432205
jmp 0x432281
push 0xf01ff
mov ebx, dword [ebp + 8]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_OpenServiceA]
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
jne 0x432236
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
fldcw word [ebp - 0x10]
jmp 0x432281
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 0xffffffffffffffff
mov eax, edi
push eax
call dword [sym.imp.ADVAPI32.DLL_ChangeServiceConfigA]
fldcw word [ebp - 0x10]
test eax, eax
je 0x432269
mov dword [ebp - 0x98], 1
mov eax, edi
push eax
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x432460
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00432460
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0
push 0
push 0
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
push 0
push 2
mov edx, dword [ebp + 8]
call fcn.0045b670
mov edx, 0x185e9a0
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [esp + 0x14]
call fcn.0045a938
mov edx, 0x185e9a0
call fcn.0045b687
lea ebx, [esp + 0x14]
call fcn.0045a938
mov edx, 0x1863790
call fcn.0045b687
lea ebx, [esp + 0x14]
call fcn.0045a938
call dword [sym.imp.ADVAPI32.DLL_LogonUserA]
push eax
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00456355
mov eax, dword [ebx + 8]
call fcn.00456355
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 0xc
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
test eax, eax
je 0x43251e
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
jmp 0x432528
mov dword [ebp - 0x98], 1
jmp 0x43252d
call fcn.0045b4f9
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4339a6
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004339a6
xor esi, esi
mov ecx, 0x4d
push esi
dec ecx
jne 0x4339c0
push 0
push 0x400
lea ebx, [ebp - 0x19c]
push ebx
mov edx, 0x1863f68
call fcn.0045b687
lea ebx, [esp + 8]
call fcn.0045a938
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x19c]
call fcn.0045b45a
call fcn.0045b655
test eax, eax
je 0x433b28
fild dword [0x186b560]
fimul dword [0x186b560]
fimul dword [0x186b560]
fimul dword [ebp + 8]
fistp qword [ebp - 0x1b0]
fild dword [0x186b560]
fimul dword [0x186b560]
fimul dword [0x186b560]
fimul dword [ebp + 8]
fistp qword [ebp - 0x1b8]
lea ebx, [ebp - 0x19c]
call fcn.0045b45a
mov edx, 0x1863f70
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [ebp - 0x1a8]
call fcn.0045a876
mov edx, dword [ebp - 0x1a8]
call fcn.0045b670
xor eax, eax
call fcn.004557b7
lea ebx, [ebp - 0x1a8]
call fcn.0045a876
mov edx, dword [ebp - 0x1a8]
call fcn.0045b670
call fcn.0045b655
mov word [ebp - 0x1a4], ax
mov eax, 2
movzx ecx, word [ebp - 0x1a4]
add eax, ecx
mov word [ebp - 0x1a2], ax
lea ebx, [ebp - 0x1a8]
call fcn.0045b77c
mov eax, ebx
mov dword [ebp - 0x1a0], eax
push 1
call fcn.00433b4a
test eax, eax
je 0x433b28
fild dword [0x186b388]
mov edx, 1
call fcn.0045aefb
push 0
lea ebx, [ebp - 0x1b8]
push ebx
lea ebx, [ebp - 0x1b0]
push ebx
lea ebx, [ebp - 0x1a4]
push ebx
call dword [sym.imp.NTDLL.DLL_NtCreatePagingFile]
mov ebx, 0x4001
call fcn.0045aec3
call fcn.0045a848
fcompp
fnstsw ax
sahf
jne 0x433b28
mov dword [ebp - 0x98], 1
call fcn.0045b4f9
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4344e8
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004344e8
xor esi, esi
xor edi, edi
mov ecx, 0x207
push esi
dec ecx
jne 0x434504
push 0
push 0
push 0
xor eax, eax
lea ebx, [esp + 4]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
push 0
fild dword [0x186b324]
fild dword [0x186aae0]
call fcn.0045a6e9
call fcn.0045a86f
push eax
push 0
push 0
push 0
mov edx, 0x18637b8
call fcn.0045b687
lea ebx, [esp + 0x1c]
call fcn.0045a938
fild qword [0x186adc4]
call fcn.0045a86f
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 8
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x43472f
mov edi, 0x400
push 0
push 0
push 0
lea ebx, [ebp - 0x8a0]
mov dword [ebx], edi
push ebx
lea ebx, [ebp - 0x49c]
push ebx
mov eax, 1
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
push 0
mov edx, 0x1864184
call fcn.0045b687
lea ebx, [esp + 0x10]
call fcn.0045a938
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 8
mov edi, dword [ebp - 0x8a0]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x43472f
lea ebx, [ebp - 0x49c]
call fcn.0045b45a
mov eax, 1
call fcn.00452863
mov edx, 0x185fca0
call fcn.0045b687
call fcn.0045abcf
je 0x434642
lea ebx, [ebp - 0x49c]
call fcn.0045b45a
mov edx, 0x185fca0
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [ebp - 0x49c]
mov ecx, 0x400
call fcn.0045b4a3
xor eax, eax
lea ebx, [ebp - 0x49c]
call fcn.0045b45a
xor ecx, ecx
xchg ecx, eax
call fcn.00451592
mov eax, 1
mov ebx, dword [ebp + 8]
call fcn.0045b45a
call fcn.0045020d
cmp eax, ecx
jne 0x43470d
lea ebx, [ebp - 0x49c]
call fcn.0045b45a
mov ebx, dword [ebp + 8]
call fcn.0045b45a
call fcn.0045ab3a
mov edx, 0x185fca0
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [ebp - 0x49c]
mov ecx, 0x400
call fcn.0045b4a3
push 0
push 0
lea ebx, [ebp - 0x49c]
call fcn.0045b45a
call fcn.0045b655
push eax
lea ebx, [ebp - 0x49c]
push ebx
push 1
push 0
mov edx, 0x1864184
call fcn.0045b687
lea ebx, [esp + 0x10]
call fcn.0045a938
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x434708
mov dword [ebp - 0x98], 1
jmp 0x434717
mov dword [ebp - 0x98], 1
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegFlushKey]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x43474c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0043474c
xor esi, esi
xor edi, edi
mov ecx, 0x52
push esi
dec ecx
jne 0x434768
lea ebx, [ebp + 8]
call fcn.0045b45a
xor eax, eax
call fcn.00451592
lea ebx, [ebp + 8]
mov ecx, 0x104
call fcn.0045b4a3
push 0
mov eax, 2
mov ecx, 1
add eax, ecx
mov ecx, 4
add eax, ecx
mov ecx, 8
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
jne 0x4347ba
jmp 0x43484a
mov eax, 0x128
mov dword [ebp - 0x1c0], eax
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32First]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
nop
nop
cmp dword [ebp - 0x1cc], 0
je 0x43483e
lea ebx, [ebp - 0x19c]
call fcn.0045b45a
xor eax, eax
call fcn.00451592
lea ebx, [ebp + 8]
call fcn.0045b45a
call fcn.0045abcf
jne 0x434823
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x98], eax
jmp 0x43483e
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32Next]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
jmp 0x4347e0
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104
Function at 0x439e56
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00439e56
xor esi, esi
xor edi, edi
mov ecx, 0x54
push esi
dec ecx
jne 0x439e72
push 0
push dword [0x185e264]
call dword [sym.imp.USER32.DLL_ShowWindow]
fldcw word [ebp - 0x10]
call fcn.00439951
test eax, eax
je 0x43a061
lea ebx, [ebp - 0xb8]
push ebx
lea ebx, [ebp - 0xb4]
push ebx
call fcn.00439c68
push 0
push 0
push 0x1004
push dword [0x185e264]
call dword [sym.imp.USER32.DLL_SendMessageA]
fldcw word [ebp - 0x10]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
sub eax, 1
mov dword [ebp - 0x1cc], eax
mov esi, 0
jmp 0x43a053
mov eax, esi
push eax
call fcn.00439b58
call fcn.0045b69e
lea ebx, [ebp - 0x1bc]
mov ecx, 0x104
call fcn.0045b4a3
mov edi, 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edi
sub eax, dword [0x185e710]
imul eax, eax, 0x88
add eax, dword [0x185e6f8]
mov ebx, eax
lea ebx, [ebx + 8]
call fcn.0045b45a
lea ebx, [ebp - 0x1bc]
call fcn.0045b45a
call fcn.0045abcf
jne 0x43a043
lea ebx, [ebp - 0x1c4]
push ebx
mov eax, esi
push eax
call fcn.00439be9
mov eax, dword [ebp - 0x1c4]
cdq
idiv dword [ebp - 0xb4]
add eax, 1
mov ecx, edi
sub ecx, dword [0x185e710]
imul ecx, ecx, 0x88
add ecx, dword [0x185e6f8]
cmp eax, dword [ecx]
jne 0x439fac
mov eax, dword [ebp - 0x1c0]
cdq
idiv dword [ebp - 0xb8]
add eax, 1
mov ecx, edi
sub ecx, dword [0x185e710]
imul ecx, ecx, 0x88
add ecx, dword [0x185e6f8]
cmp eax, dword [ecx + 4]
je 0x43a038
mov eax, dword [ebp - 0xb4]
mov ecx, 1
mov dword [ebp - 0x30], eax
mov eax, edi
sub eax, dword [0x185e710]
imul eax, eax, 0x88
add eax, dword [0x185e6f8]
neg ecx
add ecx, dword [eax]
mov eax, ecx
imul dword [ebp - 0x30]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xb8]
mov ecx, 1
mov dword [ebp - 0x30], eax
mov eax, edi
sub eax, dword [0x185e710]
imul eax, eax, 0x88
add eax, dword [0x185e6f8]
neg ecx
add ecx, dword [eax + 4]
mov eax, ecx
imul dword [ebp - 0x30]
mov dword [ebp - 0xa8], eax
push dword [ebp - 0xa8]
push dword [ebp - 0xa4]
call fcn.0043a09e
push eax
mov eax, esi
push eax
push 0x100f
push dword [0x185e264]
call dword [sym.imp.USER32.DLL_SendMessageA]
fldcw word [ebp - 0x10]
inc dword [ebp - 0xb0]
jmp 0x43a051
inc edi
cmp edi, 0xc8
jle 0x439f10
inc esi
mov eax, esi
cmp eax, dword [ebp - 0x1cc]
jle 0x439ee0
call fcn.00439ae3
push 5
push dword [0x185e264]
call dword [sym.imp.USER32.DLL_ShowWindow]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x43bbe8
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0043bbe8
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push 0
push 0
push 0
xor eax, eax
lea ebx, [esp + 4]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
push 0
fild dword [0x186b324]
fild dword [0x186aae0]
call fcn.0045a6e9
call fcn.0045a86f
push eax
push 0
push 0
push 0
mov edx, 0x18660b8
call fcn.0045b687
lea ebx, [esp + 0x1c]
call fcn.0045a938
fild qword [0x186adc4]
call fcn.0045a86f
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 8
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x43bc87
jmp 0x43bcc3
push 0
mov edx, 0x18660c8
call fcn.0045b687
lea ebx, [esp]
call fcn.0045a938
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret