joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d40e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x36619f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x4d4191
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x4d417a
test esi, esi
jbe 0x4d4191
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a644
test eax, eax
jne 0x4d416c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x4d4191
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x4d4149
jmp 0x4d4191
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x4d4191
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3661a6
ret
Function at 0x4d4bc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x366d6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404980
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4d4bfb
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4d4c14
lea eax, [ebp - 0x10]
mov edx, dword [0x3c6c48]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.004049e0
jmp 0x4d4c27
lea eax, [ebp - 0x10]
mov edx, dword [0x3c6c48]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.004049e0
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4d4c33
adc edx, 0
mov edx, dword [edx*4 + 0x3b48ac]
call fcn.00404bec
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404bd0
push eax
call fcn.00406b4c
mov esi, eax
cmp esi, 0xffffffff
je 0x4d4d41
mov eax, 0x40
call fcn.00402714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406f5c
test eax, eax
je 0x4d4d34
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4d4d34
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406fcc
mov eax, edi
call fcn.00402734
mov eax, 0x18
call fcn.00402714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406f5c
test eax, eax
je 0x4d4d34
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4d4d34
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x4d4d34
cmp dx, 0x150
ja 0x4d4d34
mov eax, edi
call fcn.00402734
mov eax, 0xe0
call fcn.00402714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406f5c
test eax, eax
je 0x4d4d34
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x4d4d34
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.004049bc
mov eax, edi
call fcn.00402734
push esi
call fcn.00406b04
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00404cf8
jne 0x4d4d59
inc ebx
cmp ebx, 0x19
jne 0x4d4bed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x366d76
lea eax, [ebp - 0x10]
call fcn.00404980
ret
Function at 0x509568
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x3d3594
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x50958a
shr eax, 1
xor eax, 0xedb88320
jmp 0x50958c
shr eax, 1
dec edx
jne 0x509578
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x509571
mov byte [0x3d3994], 1
pop esi
pop ebx
ret

Function at 0x5095a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x3d3994], 0
jne 0x5095bf
call fcn.00509568
mov eax, edi
dec eax
test eax, eax
jl 0x5095e8
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x3d3594]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5095c9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x10138908
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [esi*4]
sub esp, 5
rdtsc
lea esp, [esp + 1]
jmp 0x10138934
xchg dword [esp + 4], eax
mov edx, 0xe8119522
mov ebx, dword [esp]
dec dh
mov bh, byte [esp]
rcl dl, cl
jmp 0x1013897e
lea eax, [eax + 0x28]
not edx
xchg bx, dx
neg edx
call fcn.10138961
pushfd
mov bx, 0x4fdf
ror ebp, 0
setge ah
rdtsc
jmp 0x10138a49
bswap edx
lea esp, [esp + 4]
not ebp
call fcn.101389be
xchg bx, ax
lea esp, [esp + 2]
bsf bx, bp
lea eax, [esi*4]
lea esp, [esp + 2]
jmp 0x10138a28
mov dh, 0x9e
and ebx, 0x8b4e70c1
jmp 0x101389d4
neg ebp
not eax
mov bl, 0x84
lea eax, [edx - 0xfc5f]
jmp 0x10138ac3
dec bx
jge 0x101389fd
mov dh, 0x9e
and ebx, 0x8b4e70c1
bswap edx
jmp 0x101389d6
xchg bx, ax
jmp 0x10138aaa
movzx eax, byte [ebp - 1]
mov ebx, edi
jmp 0x10138ad4
neg ebp
call fcn.10138a97
jle 0x10138aa2
xchg bx, ax
jmp 0x10138aaa
mov dh, 8
lea edx, [eax - 0x7bdce315]
not ebx
neg dx
jnp 0x10138b8d
jp 0x10138b25
scasd eax, dword es:[edi]
aas
pop edx
test eax, 0xccfd425e
pop edi
mov edx, 0xb4405a76
stc

Function at 0x1017d42a
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [ecx], eax
clc
jmp 0x1017d42f
mov edi, dword [ecx]
stc
jmp 0x1017d414
mov eax, dword [edx + 4]
mov dword [edx], edi
mov edi, dword [ecx + 4]
call fcn.1017d43d
popfd

Function at 0x1017d52a
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 0
pop di
lea esp, [esp + 2]
jmp 0x1017d637
mov ebx, dword [ebx*4 + 0x1013191c]
xor di, 0xd9ba
add esi, 0x10
mov edx, dword [esi]
jmp 0x1017d538

Function at 0x1017d7c1
Capabilities:
Encrypt data using aes

Disassembly:
and edx, ecx
mov edx, dword [edx*4 + 0x1013191c]
sub esp, 0x1c
jmp 0x1017d761
mov ebp, esi
add ebp, 9
movzx ebx, byte [ebp]
pop ebp
jmp 0x1017d724
mov edx, dword [esi + 8]
jmp 0x1017d79f
and edx, ecx
lea esp, [esp + 0x1c]
xor edi, dword [edx*4 + 0x1013291c]
jmp 0x1017d74b
and ebx, ecx
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + 0x1013211c]
push ebp
jmp 0x1017d73f
push eax
pushal
mov dword [esp + 0x1c], esi
push ebp
call fcn.1017d789
lea esp, [esp + 8]
popal
jmp 0x1017d7dd
lea esp, [esp + 3]
jmp 0x1017d779
mov ebx, dword [ebx*4 + 0x1013191c]
jmp 0x1017d819
add eax, 4
mov dword [eax], edi
pop eax
mov edi, dword [esp]
sub esp, 0
jmp 0x1017d7c7
push ecx
jmp 0x1017d841
mov edi, edx
push di
lea esp, [esp + 2]
shr edi, 0x18
jmp 0x1017d803
lea ecx, [ecx + 0x1013191c]
mov edi, dword [ecx]
pop ecx
cmc
push ax
lea esp, [esp + 2]
jmp 0x1017d885
pushal
mov dword [esp + 0x18], edi
popal
lea ecx, [ecx*4]
jmp 0x1017d826
cpuid
mov cl, ch
mov ebp, dword [esp]
mov dword [esp + 8], edi
call fcn.1017d850
mov ebp, 0x3ec3a436
mov ecx, 0xdebb2ba7
sub eax, 0xb859cecf
and edi, ecx
push ebp
pushal
jmp 0x1017d866

Function at 0x1017da31
Capabilities:
Encrypt data using aes

Disassembly:
xor edi, dword [ebx*4 + 0x1013251c]
mov bx, 0x67b5
xchg bh, bl
bsr ebx, eax
jmp 0x1017da4d
lea esp, [esp + 0x2c]
jmp 0x1017da1b
movzx ebx, byte [esi + 0xe]
call fcn.1017da37
Function at 0x1017da37
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], ebp
jmp 0x1017da56
mov ebx, dword [ebx*4 + 0x1013191c]
jmp 0x1017da91
and edx, ecx
mov edx, dword [edx*4 + 0x1013191c]
sub esp, 7
lea esp, [esp + 3]
jmp 0x1017da7b

Function at 0x1017dae9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edi, ecx
sub esp, 0x17
lea esp, [esp + 3]
jmp 0x1017da6d
lea eax, [eax*4]
lea eax, [eax + 0x1013191c]
mov edi, dword [eax]
pop eax
jmp 0x1017d9d5
mov word [esp], bx
lea esp, [esp + 2]
push eax
mov eax, edi
jmp 0x1017d9eb
mov edi, dword [edi*4 + 0x10131d1c]
and ebx, ecx
call fcn.1017da31
and ebx, ecx
jmp 0x1017dab9
and edx, ecx
jmp 0x1017dacd
lea esp, [esp + 8]
xor edi, dword [ebx*4 + 0x1013211c]
sub esp, 7
lea esp, [esp + 3]
jmp 0x1017daa3
lea esp, [esp + 4]
xor edi, dword [edx*4 + 0x1013291c]
jmp 0x1017db0a
add esp, 2
lea esp, [esp]
jmp 0x1017da0e
mov dword [esi + 0xc], edi
call fcn.1017db92
sub byte [edx + 0x3e06b445], ch
mov ecx, 0xcbb4829
sbb byte [ebx - 1], bh
dec ebp
cld
dec dword [ebp - 4]
jmp 0x1017daf4

Function at 0x1017e416
Capabilities:
Encode data using base64

Disassembly:
jmp 0x1017e43d
jmp 0x1017e498
lea esp, [esp + 4]
cmp al, 0x2f
jmp 0x1017e8a1
cmp al, 0x5a
jmp 0x1017e479
lea esp, [esp + 0x18]
movzx eax, al
clc
add eax, 4
jmp 0x1017dc11
movzx eax, al
call fcn.1017e463
sub eax, 0x41
jmp 0x1017dc11
cmp al, 0x39
ja 0x1017dbfb
sub esp, 0x19
lea esp, [esp + 1]
jmp 0x1017e453
jne 0x1017de2a
push 0x3f
jmp 0x1017dbd2

Function at 0x1017e463
Capabilities:
Encode data using base64

Disassembly:
pushfd
mov byte [esp + 1], bh
mov word [esp + 1], sp
jmp 0x1017e7df
lea esp, [esp + 4]
ja 0x1017ddad
jbe 0x1017e481
imul ebp, eax, 0x7e
sbb eax, ebp
push cs
test dword [edi], esi
dec esi
lea esp, [esp + 4]
sub eax, 0x47
jmp 0x1017dc11

Function at 0x1017e54d
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
push 0x3e
jmp 0x1017dcd9
lea esp, [esp + 1]
jmp 0x1017e4da

Function at 0x1017e6f7
Capabilities:
Encode data using base64

Disassembly:
jmp 0x1017e6aa
cmp cl, 0x39
call 0x1017e700
ja 0x1017de5e
clc
outsb dx, byte [esi]
or eax, edi
push ds
push edi
aad 0x45
sub al, 0xdf
sub ah, al
mov ebp, 0x31c7342d
or al, 0x9f
jmp 0x1017e716
retf 0xd159
cmp cl, 0x2f
jmp 0x1017e6d2
jne 0x1017dd91
pushal
lea esp, [esp + 0x20]
push 0x3e
jmp 0x1017ddf7
jne 0x1017ddd9
push ax
lea esp, [esp + 2]
push 0x3f
jmp 0x1017ddf7
lea esp, [esp + 4]
cmp cl, 0x2b
jmp 0x1017e6c0
pop ecx
jmp 0x1017ddc3
Function at 0x10191a8b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 4]
push dword [ebp + 8]
jmp 0x10191a9c
pushal
mov dword [ebp - 8], esi
jmp 0x10191ad4
lea esp, [esp + 0x20]
test eax, eax
jmp 0x10191ae1
lea esp, [esp + 0x20]
call eax
pushal
mov byte [esp + 7], dl
jmp 0x10191abe
je 0x101258ae
pushal
jmp 0x10191b27
pushfd
jmp 0x10191b60
lea esp, [esp + 0x20]
pushal
xchg esi, edi
sets bl
jmp 0x10191b11
mov eax, 0x25ff
mov bh, 0x46
lea ecx, [eax - 0xb7]
mov dh, ch
jmp 0x10191b84
mov edi, dword [ebp + 8]
xchg al, bl
jmp 0x10191b33
cld
lea ebx, [edi + 0xc76d]
mov bh, byte [esp]
rdtsc
jmp 0x10191b49
stosw word es:[edi], ax
call 0x10191b6e
pushal
rdtsc
mov dword [esp], ebp
popal
jmp 0x10191bf7
popfd
lea edx, [ecx + ebx]
popal
bswap edx
jmp 0x10191bd1
dec cx
jmp 0x10191be1
mov ah, ch
mov edx, dword [esp]
mov eax, dword [0x10133f98]
clc
lea edx, [esi + esi]
jmp 0x10191bbb
xor eax, 0x10133f98
bsr ecx, esi
lea edx, [esi*4]
jmp 0x10191e0d
add edi, 0xfffffff8
mov eax, dword [edi]
pop edi
lea esp, [esp + 4]
stosd dword es:[edi], eax
jmp 0x10191b94
lea edx, [eax*4]
bsf dx, cx
jmp 0x10191ca2
sub esp, 0x18
push dword [esp + 6]
mov dword [esp + 2], edx
xor eax, ecx
btr dx, sp
jmp 0x10191c07
pushal
lea esp, [esp + 0x20]
push 6
clc
call fcn.10191c46
lea esp, [esp + 0x1c]
add eax, 0x18
mov edx, dword [eax]
stc
jmp 0x10191c67
push dword [esp + 2]
mov dword [esp + 4], edx
lea esp, [esp + 4]
push dword [ebp - 4]
jmp 0x10191c1d
lea edx, [eax*4]
mov ecx, 0x4917bf42
lea edx, [ebp - 4]
push ecx
jmp 0x10191cd4

Function at 0x102bcdf9
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 0xc]
jmp 0x102bce30
mov byte [esp], dh
mov ebp, ecx
xchg ecx, eax
mov word [esp], sp
mov byte [esp], ch
cpuid
jmp 0x102bce56
push dword [esp + 0xc]
pushal
lea eax, [edx + ebp]
push bx
mov ax, 0xe641
jmp 0x102bce1a
mov byte [esp], ah
mov esi, dword [esp]
mov cx, 0x684f
mov dx, 0xb5a5
mov byte [esp], bh
lea ebx, [eax + ebp]
rdtsc
push word [esp]
jmp 0x102bce40

Function at 0x102d22c6
Capabilities:
Parse pe header

Disassembly:
call fcn.102d2018
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0xc], esi
push ecx
pop word [esp]
jmp 0x102d2397
mov eax, dword [eax]
jmp 0x102d2326
lea edi, [edi + 0xc]
mov eax, dword [edi]
pop edi
mov eax, dword [eax + 0x1c]
jmp 0x102d2305
push ecx
mov ecx, eax
lea ecx, [ecx + 8]
jmp 0x102d2332
mov eax, dword [ecx]
pop ecx
push eax
jmp 0x102d2013
mov eax, dword fs:[0x30]
push edi
mov edi, eax
jmp 0x102d231b
mov byte [esp], ch
push word [esp]
pop word [esp]
push word [esp]
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x102d234c
Function at 0x40b346
Capabilities:
Copy file
Persist via run registry key
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1800
call fcn.0040d5a0
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, 0x400
push esi
lea eax, [ebp - 0x800]
push eax
xor ebx, ebx
push ebx
call edi
push str.cmxjc48cjj.exe
lea eax, [ebp - 0x800]
call fcn.00405493
test eax, eax
pop ecx
je 0x40b3cf
push esi
lea eax, [ebp - 0x800]
push eax
push ebx
call edi
push 1
lea eax, [ebp - 0x800]
push eax
push str.Taskhost
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004069fd
add esp, 0x14
test eax, eax
push 4
je 0x40b3b9
push ebx
push 3
jmp 0x40b3c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 6
call fcn.0040a786
add esp, 0xc
call fcn.0040b2ce
call fcn.0040aafd
test eax, eax
jne 0x40b3ca
call fcn.0040ab7c
test eax, eax
je 0x40b442
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 4
push ebx
push 9
call fcn.0040a786
add esp, 0xc
push esi
lea eax, [ebp - 0x1800]
push eax
push ebx
call edi
lea eax, [ebp - 0x800]
push eax
call fcn.0040ac20
test eax, eax
pop ecx
je 0x40b442
push ebx
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x1800]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40b442
lea eax, [ebp - 0x800]
push eax
call fcn.004077f0
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.0040abd9
test eax, eax
je 0x40b49c
lea eax, [ebp - 0x800]
push eax
call fcn.0040ac20
lea eax, [ebp - 0x800]
push eax
call fcn.00407727
test eax, eax
pop ecx
pop ecx
je 0x40b487
lea eax, [ebp - 0x800]
push eax
call fcn.004077f0
test eax, eax
pop ecx
jne 0x40b43b
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xb
jmp 0x40b492
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
call fcn.0040a786
add esp, 0xc
jmp 0x40b43b
push ebx
call fcn.00407727
cmp eax, ebx
pop ecx
push esi
je 0x40b4be
lea ecx, [ebp - 0x1000]
push ecx
push dword [eax*4 + 0x41103c]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x40b4d8
lea eax, [ebp - 0x1000]
push eax
push ebx
call edi
mov ecx, str.__nomove
lea eax, [ebp - 0x1000]
call fcn.004054ed
lea eax, [ebp - 0x1000]
push eax
call fcn.004077f0
test eax, eax
pop ecx
jne 0x40b43b
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xb
call fcn.0040a786
add esp, 0xc
mov dword [0x411054], ebx
jmp 0x40b3ca

Function at 0x40cd56
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x40cd60
repz ret
jmp fcn.0040cffb

Function at 0x402658
Capabilities:
Terminate process

Disassembly:
xor edi, edi
xor esi, esi
mov edx, eax
mov eax, 5
add eax, 5
inc eax
test eax, 0xb
jne 0x40267a
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401036], eax
ret
Function at 0x401d10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
xor esi, esi
push eax
push 1
push esi
push str.SYSTEMCurrentControlSetControlClass4D36E965_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401d3d
xor eax, eax
pop esi
add esp, 0x10
ret
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x14]
push edx
push eax
push esi
push str.NeroCheck_Function
push ecx
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401d84
cmp dword [esp + 0x10], 4
jne 0x401d84
test byte [esp + 8], 1
jne 0x401d84
mov esi, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x401e70
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
test eax, eax
push esi
jne 0x401e8d
push 1
call fcn.00402df0
add esp, 4
xor eax, eax
pop esi
add esp, 8
ret
lea ecx, [esp + 4]
lea edx, [esp + 0x10]
push ecx
lea ecx, [esp + 0xc]
push edx
push ecx
push 0
mov esi, 4
push str.Start
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401e86
cmp dword [esp + 8], esi
jne 0x401e86
cmp dword [esp + 0x10], esi
jne 0x401e86
push 8
call fcn.00402df0
add esp, 4
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x401ee0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4188c8
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
test ebp, ebp
push edi
jne 0x401f23
push 1
call fcn.00402df0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push str.system32driversNeroCd2k.sys
lea ecx, [esp + 0x2c]
call fcn.0041285b
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], 0
mov eax, dword [eax - 8]
lea edi, [eax + 1]
lea ebx, [edi + edi]
push ebx
call fcn.00412ebe
mov esi, eax
add esp, 4
test esi, esi
jne 0x401f5e
push 1
call fcn.00402df0
jmp 0x401fab
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push esi
push ecx
push 0
push str.ImagePath
push ebp
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push esi
jne 0x401fd4
mov edx, dword [esp + 0x2c]
push edx
call fcn.00403c29
add esp, 8
test eax, eax
push esi
jne 0x401fd4
call fcn.00412ee7
add esp, 4
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.004127e7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
call fcn.00412ee7
push 8
call fcn.00402df0
add esp, 8
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.004127e7
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x402010
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4188e8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [esp + 0x28]
test edi, edi
jne 0x40203f
push 1
call fcn.00402df0
jmp 0x402122
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
push 0
push ecx
push 0
push str.ImagePath
push edi
mov dword [esp + 0x40], 1
call ebx
test eax, eax
jne 0x402125
mov edx, dword [esp + 0x28]
push edx
call fcn.00412ebe
mov esi, eax
add esp, 4
test esi, esi
jne 0x40208a
push 1
call fcn.00402df0
jmp 0x402122
lea eax, [esp + 0x28]
lea ecx, [esp + 0xc]
push eax
push esi
push ecx
push 0
push str.ImagePath
push edi
call ebx
test eax, eax
jne 0x40211c
cmp dword [esp + 0xc], 2
jne 0x40211c
push esi
lea ecx, [esp + 0x14]
call fcn.0041285b
push 0x420358
mov ecx, eax
mov dword [esp + 0x24], 0
call fcn.00412bb3
cmp eax, 0xffffffff
lea ecx, [esp + 0x10]
sete bl
mov dword [esp + 0x20], 0xffffffff
call fcn.004127e7
test bl, bl
je 0x40211c
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.0041285b
call fcn.00401610
add esp, 4
test eax, eax
jne 0x40211c
push esi
call fcn.00412ee7
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
push esi
call fcn.00412ee7
add esp, 4
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret

Function at 0x402210
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x402270
lea eax, [esp + 0xc]
lea ecx, [esp + 4]
push eax
push 0
push ecx
push 0
push str.LowerFilters
push esi
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402248
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 2
jne 0x402270
push 4
push 0x423df0
push 7
push 0
push str.LowerFilters
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x402270
mov eax, 1
pop esi
pop ecx
ret
push 1
call fcn.00402df0
add esp, 4
xor eax, eax
pop esi
pop ecx
ret
Function at 0x402280
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x418908
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
push edi
xor edi, edi
cmp ebx, edi
je 0x40248f
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push edi
push ecx
push edi
push str.LowerFilters
push ebx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], 1
call esi
cmp eax, edi
jne 0x40248f
mov edx, dword [esp + 0x10]
push edx
call fcn.00412ebe
add esp, 4
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x40248f
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push eax
push edx
push edi
push str.LowerFilters
push ebx
call esi
cmp eax, edi
jne 0x402479
cmp dword [esp + 0x18], 7
jne 0x402479
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x14]
push ecx
shr eax, 1
push edx
mov dword [esp + 0x2c], eax
call fcn.00401c50
add esp, 8
test eax, eax
jne 0x402347
mov eax, dword [esp + 0x14]
push eax
call fcn.00412ee7
jmp 0x402496
mov ecx, dword [esp + 0x24]
push str.Nerocd2k
lea edx, [ecx + ecx]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], edx
call fcn.0041285b
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
push eax
mov dword [esp + 0x34], edi
call fcn.00412ebe
mov ebp, eax
add esp, 4
cmp ebp, edi
jne 0x4023a5
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00412ee7
push 1
call fcn.00402df0
add esp, 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call fcn.004127e7
jmp 0x402499
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [esp + 0x20], 0
and ecx, 3
rep stosb byte es:[edi], al
cmp word [esi], 0
mov edi, ebp
je 0x40240e
push esi
call fcn.0040411b
mov ebx, eax
mov eax, dword [esp + 0x20]
push esi
push eax
call fcn.00403c29
add esp, 0xc
test eax, eax
je 0x4023f6
push ebx
push esi
push edi
call fcn.004040de
add esp, 0xc
lea edi, [edi + ebx*2 + 2]
jmp 0x4023fe
mov dword [esp + 0x20], 1
cmp word [esi + ebx*2 + 2], 0
lea esi, [esi + ebx*2 + 2]
jne 0x4023cb
mov ebx, dword [esp + 0x38]
mov eax, dword [esp + 0x20]
sub edi, ebp
add edi, 2
test eax, eax
mov dword [esp + 0x10], edi
je 0x40243e
mov ecx, dword [esp + 0x18]
push edi
push ebp
push ecx
push 0
push str.LowerFilters
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x20
call fcn.00402df0
add esp, 4
push ebp
call fcn.00412ee7
mov edx, dword [esp + 0x18]
push edx
call fcn.00412ee7
add esp, 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call fcn.004127e7
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
push 1
call fcn.00402df0
mov eax, dword [esp + 0x18]
push eax
call fcn.00412ee7
add esp, 8
jmp 0x402499
push 1
call fcn.00402df0
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret