joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a380
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
push str.SaveSFX__
call fcn.0040ffb0
add esp, 0x10
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x24], ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.0040ca90
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40a3f4
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
push str.Err_open
call fcn.0040ffb0
add esp, 0x10
mov eax, 0x80004005
jmp 0x40a50d
push 0
push 0x80
xor ecx, ecx
cmp dword [ebp + 0x14], 0
setne cl
add ecx, 1
push ecx
push 0
push 0
push 0x40000000
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x40a46f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push str.Err_save_to
push 0
call fcn.0040b330
add esp, 0x10
cmp dword [ebp - 0x18], 0
jg 0x40a452
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x28], edx
jmp 0x40a467
mov eax, dword [ebp - 0x18]
and eax, 0xffff
or eax, 0x70000
or eax, 0x80000000
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
jmp 0x40a50d
mov dword [ebp - 0x10], 0
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], 0
je 0x40a4a9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
je 0x40a4f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push str.Err_write
push 0
call fcn.0040b330
add esp, 0x10
cmp dword [ebp - 0x1c], 0
jg 0x40a4d7
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
jmp 0x40a4ef
mov ecx, dword [ebp - 0x1c]
and ecx, 0xffff
or ecx, 0x70000
or ecx, 0x80000000
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
jmp 0x40a50d
push 1
push 0
mov edx, dword [ebp + 0x10]
push edx
push str._..._saved_to
call fcn.0040ffb0
add esp, 0x10
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40a520
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x40a52e
xor eax, eax
jmp 0x40a5ad
push 1
push 0
mov eax, dword [ebp + 8]
push eax
push str.Cleanup_folder
call fcn.0040ffb0
add esp, 0x10
push 0
push 0
push fcn.0040bd00
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040bab0
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40a57d
push 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp + 8]
push edx
push str.Cleanup_files_err
call fcn.0040ffb0
add esp, 0x10
jmp 0x40a5aa
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40a5aa
push 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.Cleanup_folder_err
call fcn.0040ffb0
add esp, 0x10
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x40a710
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x40a722
cmp dword [ebp + 8], 0
jne 0x40a729
xor eax, eax
jmp 0x40a7bf
mov eax, dword [ebp + 0xc]
mov word [eax], 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x48fe00
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40a770
push 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push str.CreateTempFolder:_Cant_get_temp_name
call fcn.0040ffb0
add esp, 0x10
xor eax, eax
jmp 0x40a7bf
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40a78d
mov ecx, dword [ebp + 0xc]
mov word [ecx], 0
cmp dword [ebp - 8], 0
je 0x40a79b
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
jmp 0x40a7a2
mov dword [ebp - 0xc], 0x48fe30
push 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0xc]
push eax
push str.CreateTempFolder:
call fcn.0040ffb0
add esp, 0x10
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x40b560
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
sub ecx, 0xffffffff
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esp, ebp
pop ebp
ret
Function at 0x40bab0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b4
mov eax, dword [0x4c4754]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x40bacf
cmp dword [ebp + 0xc], 0
jne 0x40bad6
xor eax, eax
jmp 0x40bc90
mov eax, dword [ebp + 8]
push eax
push str._s.
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 1
push 0
lea edx, [ebp - 0x210]
push edx
push str.ForEachFile_____by_mask
call fcn.0040ffb0
add esp, 0x10
push 0x250
push 0
lea eax, [ebp - 0x468]
push eax
call fcn.00466b50
add esp, 0xc
lea ecx, [ebp - 0x468]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xffffffff
jne 0x40bb64
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x210]
push eax
push str.Cant_find_any_files_matching
push 0
call fcn.0040b330
add esp, 0x10
xor eax, eax
jmp 0x40bc90
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x468]
push ecx
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x40bc13
push 0x4904a0
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40bbb3
push 0x4904a4
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x40bbb5
jmp 0x40bb6b
cmp dword [ebp + 0x14], 0
je 0x40bbd2
lea edx, [ebp - 0x43c]
push edx
mov ecx, dword [ebp + 0x14]
call fcn.00409a10
mov ecx, dword [ebp + 0x14]
call fcn.0040bca0
lea eax, [ebp - 0x43c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x4904ac
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [ebp + 0xc]
add esp, 8
test eax, eax
jne 0x40bc0e
mov dword [ebp - 4], 0
jmp 0x40bb6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x12
je 0x40bc4c
mov edx, dword [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
push str.File_operation_failed_for
push 1
call fcn.0040b330
add esp, 0x10
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x40bc6b
mov dword [ebp - 0x4b4], 0x4904d4
jmp 0x40bc75
mov dword [ebp - 0x4b4], str.FAIL
push 1
push 0
mov edx, dword [ebp - 0x4b4]
push edx
push str.ForEachFile____
call fcn.0040ffb0
add esp, 0x10
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00466b32
mov esp, ebp
pop ebp
ret
Function at 0x40bd00
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40bd61
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x40bd61
push 0
push 0
push fcn.0040bd00
mov edx, dword [ebp + 8]
push edx
call fcn.0040bab0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x40bd5c
push 1
push 0
mov ecx, dword [ebp + 8]
push ecx
push str.ActDelFile_____cant_remove_directory
call fcn.0040ffb0
add esp, 0x10
mov eax, dword [ebp - 8]
jmp 0x40bd6b
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esp, ebp
pop ebp
ret

Function at 0x40bd70
Capabilities:
Check os version
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x4c4754]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.00466b50
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40be6d
cmp dword [ebp - 0x118], 2
jne 0x40be6d
cmp dword [ebp - 0x124], 5
ja 0x40bde8
cmp dword [ebp - 0x124], 5
jne 0x40be6d
cmp dword [ebp - 0x120], 1
jb 0x40be6d
mov dword [ebp - 0x130], 0
xor edx, edx
cmp dword [ebp + 0x10], 0
setne dl
mov dword [ebp - 0x134], edx
mov eax, dword [ebp - 0x134]
or eax, 8
mov dword [ebp - 0x134], eax
push 0x490524
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x40be6d
push str.CopyFileExW
mov ecx, dword [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
je 0x40be6d
mov edx, dword [ebp - 0x134]
push edx
lea eax, [ebp - 0x130]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x138]
jmp 0x40be7f
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00466b32
mov esp, ebp
pop ebp
ret
Function at 0x40c910
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0
jne 0x40c93a
push 0x24
push 0x49076c
push str.Reboot_is_required_to_complete_RoboForm_Setup._nDo_you_want_to_reboot_now_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0x40c946
cmp dword [ebp - 4], 6
jne 0x40c9aa
push 1
push 0
push 0
push str.AskForReboot_____rebooting
call fcn.0040ffb0
add esp, 0x10
call fcn.0040c9d0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40c97f
push 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push str.Failed_to_get_reboot_priv
call fcn.0040ffb0
add esp, 0x10
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40c9aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push str.Reboot_Failed.
push 1
call fcn.0040b330
add esp, 0x10
push 1
push 0
push 0
push str.AskForReboot_____cancelled
call fcn.0040ffb0
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x40ccf0
Capabilities:
Get file attributes
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x40cd08
xor eax, eax
jmp 0x40ce32
mov ecx, dword [ebp + 0xc]
and ecx, 0x40000000
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
sub ecx, 0xffffffff
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp dword [eax + 0x10], 0
sete cl
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
cmp dword [edx], 0
je 0x40cd6a
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffff
jne 0x40cd71
xor eax, eax
jmp 0x40ce32
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0xc], 0xffffffff
je 0x40cd97
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
jne 0x40cda6
mov ecx, dword [ebp - 8]
call fcn.0040ce40
xor eax, eax
jmp 0x40ce32
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
xor edx, edx
cmp dword [ecx + 0x10], 0
setne dl
lea edx, [edx + edx + 2]
push edx
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x40cde6
mov ecx, dword [ebp - 8]
call fcn.0040ce40
xor eax, eax
jmp 0x40ce32
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 0xf001b
add ecx, 4
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 8], 0
jne 0x40ce2d
mov ecx, dword [ebp - 8]
call fcn.0040ce40
xor eax, eax
jmp 0x40ce32
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40ce40
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0
je 0x40ce76
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
and eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 4], 0
je 0x40ce9c
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
je 0x40ceea
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x10], 0
je 0x40cecf
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40d040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
xor eax, eax
cmp dword [ebp + 0x10], 0
setne al
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40d072
push 0x14c4
push str.D:VisualStudio8VC_atlmfcinclude_atlbase.h
push 0x80004005
call fcn.00412870
add esp, 0xc
xor ecx, ecx
jne 0x40d049
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x40d185
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
jbe 0x40d17d
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x40d16c
cmp dword [ebp - 0x14], 2
jbe 0x40d0d5
cmp dword [ebp - 0x14], 7
je 0x40d10b
jmp 0x40d16c
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x40d0fa
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 - 2]
test edx, edx
je 0x40d109
mov eax, dword [ebp + 8]
mov word [eax], 0
mov eax, 0xd
jmp 0x40d188
jmp 0x40d17b
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x40d15b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
cmp eax, 1
jb 0x40d15b
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shr edx, 1
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
jne 0x40d15b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
cmp eax, 1
jbe 0x40d16a
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shr edx, 1
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 - 4]
test ecx, ecx
je 0x40d16a
mov edx, dword [ebp + 8]
mov word [edx], 0
mov eax, 0xd
jmp 0x40d188
jmp 0x40d17b
mov eax, dword [ebp + 8]
mov word [eax], 0
mov eax, 0xd
jmp 0x40d188
jmp 0x40d185
mov ecx, dword [ebp + 8]
mov word [ecx], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40d190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48b208
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4c4754]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 0
je 0x40d1c1
cmp dword [ebp + 0x10], 0
jne 0x40d1cb
mov eax, 0x57
jmp 0x40d2db
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x40d22f
mov dword [ebp - 0x28], 0
cmp dword [ebp - 0x10], 0
je 0x40d223
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40d26e
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x10], 0
je 0x40d269
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
jmp 0x40d2db
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 4
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x30]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x30], 4
je 0x40d2aa
mov dword [ebp - 0x1c], 0xd
jmp 0x40d2b0
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x3c], 0
cmp dword [ebp - 0x10], 0
je 0x40d2d8
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40d440
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48b238
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4c4754]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 0
je 0x40d471
cmp dword [ebp + 0x10], 0
jne 0x40d47b
mov eax, 0x57
jmp 0x40d589
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x24], eax
xor ecx, ecx
je 0x40d4c3
mov edx, dword [ebp - 0x28]
mov dword [0], edx
cmp dword [ebp - 0x24], 0
jne 0x40d4f6
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x10], 0
je 0x40d4ea
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40d535
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], 0
cmp dword [ebp - 0x10], 0
je 0x40d530
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
jmp 0x40d589
xor eax, eax
jne 0x40d535
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x34], ecx
xor edx, edx
jne 0x40d53f
push 4
lea eax, [ebp - 0x34]
push eax
push 4
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x38], 0
cmp dword [ebp - 0x10], 0
je 0x40d586
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40d5a0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48b268
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4c4754]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 0
je 0x40d5d1
cmp dword [ebp + 0x10], 0
jne 0x40d5db
mov eax, 0x57
jmp 0x40d6be
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push 0x20006
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x40d63f
mov dword [ebp - 0x28], 0
cmp dword [ebp - 0x10], 0
je 0x40d633
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40d67e
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x10], 0
je 0x40d679
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
jmp 0x40d6be
xor eax, eax
jne 0x40d67e
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], 0
cmp dword [ebp - 0x10], 0
je 0x40d6bb
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret