joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411350
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x45c
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x42c]
mov dword [esp], eax
call sub.msvcrt.dll_time
lea eax, [ebp - 0x438]
mov dword [esp], eax
call sub.KERNEL32.dll_QueryPerformanceCounter
sub esp, 4
mov ecx, dword [ebp - 0x438]
mov ebx, dword [ebp - 0x434]
mov dword [esp + 8], 0x989680
mov dword [esp + 0xc], 0
mov dword [esp], ecx
mov dword [esp + 4], ebx
call fcn.0044e440
mov ecx, eax
mov ebx, edx
mov eax, 0x989680
imul dword [ebp - 0x42c]
add ecx, eax
adc ebx, edx
add ecx, 0x13814000
adc ebx, 0x1b21dd2
mov edx, 0
mov byte [esi + edx], cl
shrd ecx, ebx, 8
sar ebx, 8
inc edx
cmp edx, 8
jne 0x4113ca
movzx eax, byte [esi + 7]
and al, 0xf
or al, 0x40
mov byte [esi + 7], al
mov byte [ebp - 0x418], 0
mov dword [ebp - 0x43c], 0x400
lea eax, [ebp - 0x43c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sub.KERNEL32.dll_GetComputerNameA
sub esp, 8
lea edi, [ebp - 0x418]
cld
mov ecx, 0xffffffff
mov al, 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, 0x400
sub eax, ecx
mov dword [ebp - 0x43c], eax
lea edi, [ebp - 0x418]
mov ecx, 0xffffffff
mov al, 0
repne scasb al, byte es:[edi]
not ecx
lea ecx, [ecx + ebp - 0x419]
lea eax, [ebp - 0x43c]
mov dword [esp + 4], eax
mov dword [esp], ecx
call sub.ADVAPI32.DLL_GetUserNameA
sub esp, 8
lea edx, [ebp - 0x418]
cld
mov ecx, 0xffffffff
mov edi, edx
mov al, 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x43c], ecx
call sub.msvcrt.dll__getpid
mov ebx, eax
call sub.KERNEL32.dll_GetTickCount
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._lX_d
mov eax, dword [ebp - 0x43c]
mov edx, 0x400
sub edx, eax
mov dword [esp + 4], edx
lea edi, [ebp - 0x418]
lea eax, [edi + eax]
mov dword [esp], eax
call fcn.0044e850
cld
mov ecx, 0xffffffff
mov al, 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x428]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
lea edx, [ebp - 0x418]
mov dword [esp], edx
call fcn.0041e7f0
mov edx, 8
movzx eax, byte [ebp + edx - 0x428]
mov byte [esi + edx], al
inc edx
cmp edx, 0x10
jne 0x4114e5
movzx eax, byte [esi + 8]
and al, 0x3f
or al, 0x80
mov byte [esi + 8], al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x411557
Capabilities:
Resolve path using msvcrt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.msvcrt.dll___p__pgmptr
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
leave
ret
Function at 0x413176
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp], 0x1000
call fcn.004131ff
mov dword [0x472070], eax
mov edx, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x1000
mov dword [esp], eax
call sub.msvcrt.dll__vsnprintf
cmp eax, 0xfff
jle 0x4131db
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 1
mov dword [esp], str.buffer_overflow_in_vsnprintf
call sub.msvcrt.dll_fwrite
mov eax, dword [0x472070]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
mov ebx, eax
mov eax, dword [0x472070]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, ebx
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x41396b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov dword [ebp - 0xc], 4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004138ff
lea edx, [ebp - 8]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0x18]
or edx, 0x20019
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
mov ebx, eax
test eax, eax
jne 0x4139fe
lea eax, [ebp - 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
test ebx, ebx
je 0x413a02
mov eax, ebx
jmp 0x413a12
cmp dword [ebp - 0x10], 4
sete al
movzx eax, al
dec eax
and eax, 0xa0
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x413a17
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x844
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x820], 0x800
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004138ff
lea edx, [ebp - 0x81c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x413ad2
lea eax, [ebp - 0x820]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x818]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x824]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x81c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x81c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
cmp dword [ebp - 0xc], 0
je 0x413aeb
mov eax, dword [ebp - 0x18]
mov dword [ebx], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0xc], eax
jmp 0x413b4a
cmp dword [ebp - 0x824], 3
je 0x413afd
mov dword [ebp - 0xc], 0xa0
jmp 0x413b33
mov eax, dword [ebp - 0x820]
mov dword [esp], eax
call fcn.004131ff
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x818]
mov edx, dword [ebp - 0x820]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0xc], eax
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x413c86
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x1854
call fcn.0044e410
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1830], 0x800
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004138ff
lea edx, [ebp - 0x182c]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0x18]
or edx, 0x20019
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x413d4a
lea eax, [ebp - 0x1830]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x818]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1834]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x182c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x182c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
cmp dword [ebp - 0xc], 0
je 0x413d66
mov eax, dword [ebp - 0x18]
mov dword [ebx], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0xc], eax
jmp 0x413e45
cmp dword [ebp - 0x1834], 2
jne 0x413de6
mov dword [esp + 8], 0x1004
lea eax, [ebp - 0x1828]
mov dword [esp + 4], eax
lea eax, [ebp - 0x818]
mov dword [esp], eax
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
sub esp, 0xc
mov dword [ebp - 0x1830], eax
lea eax, [eax - 1]
cmp eax, 0x1003
jbe 0x413dae
mov dword [ebp - 0xc], 0xea
jmp 0x413e2e
mov eax, dword [ebp - 0x1830]
mov dword [esp], eax
call fcn.004131ff
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x1828]
mov edx, dword [ebp - 0x1830]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x1830]
mov dword [ebp - 0x10], eax
jmp 0x413e2e
cmp dword [ebp - 0x1834], 1
je 0x413df8
mov dword [ebp - 0xc], 0xa0
jmp 0x413e2e
mov eax, dword [ebp - 0x1830]
mov dword [esp], eax
call fcn.004131ff
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x818]
mov edx, dword [ebp - 0x1830]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x1830]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0xc], eax
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x413e4e
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xec
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], esi
call fcn.00412aaa
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], 0
mov dword [esp], ebx
call fcn.004138ff
lea edx, [ebp - 0xbc]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 8
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
mov edx, eax
mov dword [ebp - 0xa8], eax
test eax, eax
je 0x413eec
mov eax, dword [ebp - 0xb8]
mov dword [edi], eax
mov eax, dword [ebp - 0xb4]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0xb0]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0xac]
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], edx
jmp 0x413fde
mov ebx, 0
cmp dword [ebp - 0xa8], 0
jne 0x413f8b
lea esi, [ebp - 0x98]
mov dword [ebp - 0xcc], pe_nt_image_headers32
lea eax, [ebp - 0xc8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea eax, [ebp - 0xcc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0xbc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegEnumKeyExA
sub esp, 0x20
mov dword [ebp - 0xa8], eax
test eax, eax
jne 0x413f7d
mov dword [esp], esi
call sub.msvcrt.dll__strdup
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xb0]
mov dword [esp], eax
call fcn.00412bb1
inc dword [ebp - 0xac]
inc ebx
cmp dword [ebp - 0xa8], 0
je 0x413f04
cmp dword [ebp - 0xa8], 0x103
jne 0x413fa1
mov dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0xbc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, dword [ebp - 0xb8]
mov dword [edi], eax
mov eax, dword [ebp - 0xb4]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0xb0]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0xac]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0xa8]
mov dword [edi + 0x10], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x41414b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004138ff
mov dword [esp + 0x20], 0
lea edx, [ebp - 8]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20006
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCreateKeyExA
sub esp, 0x24
mov ebx, eax
test eax, eax
jne 0x4141f6
mov dword [esp + 0x14], 4
lea eax, [ebp + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, ebx
test ebx, ebx
je 0x4141f8
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4141fd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004138ff
mov dword [esp + 0x20], 0
lea edx, [ebp - 8]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20006
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCreateKeyExA
sub esp, 0x24
mov ebx, eax
test eax, eax
jne 0x4142a7
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, ebx
test ebx, ebx
je 0x4142a9
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4142ae
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004138ff
mov dword [esp + 0x20], 0
lea edx, [ebp - 0x10]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20006
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCreateKeyExA
sub esp, 0x24
mov ebx, eax
test eax, eax
jne 0x41436b
mov edi, esi
cld
mov ecx, 0xffffffff
mov al, 0
repne scasb al, byte es:[edi]
not ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, ebx
test ebx, ebx
je 0x41436d
mov eax, ebx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x41437a
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
lea eax, [ebp - 0x38]
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov ecx, dword [ebp + 8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00413e4e
sub esp, 4
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov dword [esp], eax
call fcn.00412f7b
test eax, eax
je 0x41443f
mov edx, dword [ebp - 0x3c]
mov dword [esp], edx
call fcn.00413063
jmp 0x414430
mov ecx, dword [ebp - 0x3c]
mov dword [esp], ecx
call fcn.00412fa8
mov esi, eax
mov edi, eax
cld
mov ecx, 0xffffffff
mov al, 0
repne scasb al, byte es:[edi]
mov edx, ecx
not edx
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edi, [eax + edx]
mov dword [esp], edi
call fcn.004131ff
mov ebx, eax
mov dword [esp + 0x10], esi
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_s
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0044e850
mov dword [esp + 4], ebx
mov edx, dword [ebp + 8]
mov dword [esp], edx
call fcn.0041437a
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov ecx, dword [ebp - 0x3c]
mov dword [esp], ecx
call fcn.00413072
test eax, eax
jne 0x4143c2
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.00412ad8
mov edx, dword [ebp + 8]
mov dword [esp], edx
call fcn.004138ff
mov ecx, dword [ebp + 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegDeleteKeyA
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x41446f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004138ff
lea edx, [ebp - 8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x20006
mov dword [esp + 8], 0
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
mov ebx, eax
test eax, eax
jne 0x4144d5
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegDeleteValueA
sub esp, 8
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x415a3b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov eax, 0xffffffff
cmp dword [ebx + 0x3c], 0
jne 0x415aba
cmp dword [ebx + 4], 0
jne 0x415aad
call sub.msvcrt.dll__errno
mov dword [eax], 0
mov eax, dword [ebx + 0x40]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4000
mov dword [esp + 4], 1
mov eax, dword [ebx + 0x44]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebx + 4], eax
test eax, eax
jne 0x415aa8
mov dword [ebx + 0x3c], 1
mov eax, dword [ebx + 0x40]
test byte [eax + 0xc], 0x20
je 0x415aa1
mov dword [ebx + 0x38], 0xffffffff
mov eax, 0xffffffff
jmp 0x415aba
mov eax, dword [ebx + 0x44]
mov dword [ebx], eax
dec dword [ebx + 4]
mov eax, dword [ebx]
movzx edx, byte [eax]
inc eax
mov dword [ebx], eax
mov eax, edx
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x415ac0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 4]
cmp ebx, 1
ja 0x415b4c
test ebx, ebx
je 0x415ae8
mov eax, dword [esi + 0x44]
mov edx, dword [esi]
movzx edx, byte [edx]
mov byte [eax], dl
call sub.msvcrt.dll__errno
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov dword [esp + 0xc], eax
mov eax, 0x4000
mov cl, bl
sar eax, cl
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, ebx
add eax, dword [esi + 0x44]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov ebx, eax
test eax, eax
jne 0x415b32
mov eax, dword [esi + 0x40]
test byte [eax + 0xc], 0x20
je 0x415b32
mov dword [esi + 0x38], 0xffffffff
mov edx, ebx
add edx, dword [esi + 4]
mov dword [esi + 4], edx
mov eax, dword [esi + 0x44]
mov dword [esi], eax
cmp edx, 1
ja 0x415b4c
mov dword [esi + 0x58], edx
jmp 0x415c35
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x415b59
cmp byte [eax + 1], 0x8b
je 0x415b65
mov dword [esi + 0x58], 1
jmp 0x415c35
sub dword [esi + 4], 2
add dword [esi], 2
mov dword [esp], esi
call fcn.00415a3b
mov ebx, eax
mov dword [esp], esi
call fcn.00415a3b
mov edi, eax
cmp ebx, 8
jne 0x415b8e
mov ebx, 0
test al, 0xe0
je 0x415b9a
mov dword [esi + 0x38], 0xfffffffd
jmp 0x415c35
mov dword [esp], esi
call fcn.00415a3b
inc ebx
cmp ebx, 5
jbe 0x415b9a
test edi, 4
je 0x415bda
mov dword [esp], esi
call fcn.00415a3b
mov ebx, eax
mov dword [esp], esi
call fcn.00415a3b
shl eax, 8
add ebx, eax
dec ebx
cmp ebx, 0xffffffff
je 0x415bda
mov dword [esp], esi
call fcn.00415a3b
cmp eax, 0xffffffff
jne 0x415bc7
test edi, 8
je 0x415bf3
mov dword [esp], esi
call fcn.00415a3b
test eax, eax
je 0x415bf3
cmp eax, 0xffffffff
jne 0x415be2
test edi, 0x10
je 0x415c0c
mov dword [esp], esi
call fcn.00415a3b
test eax, eax
je 0x415c0c
cmp eax, 0xffffffff
jne 0x415bfb
test edi, 2
je 0x415c27
mov ebx, 0
mov dword [esp], esi
call fcn.00415a3b
inc ebx
cmp ebx, 1
jbe 0x415c19
cmp dword [esi + 0x3c], 1
sbb eax, eax
not eax
and eax, 0xfffffffd
mov dword [esi + 0x38], eax
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4160b1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4160cd
cmp byte [ebx + 0x5c], 0x77
je 0x4160e3
mov eax, 0xfffffffe
jmp 0x416183
mov dword [ebx + 0x38], 0xffffffff
jmp 0x416168
mov dword [ebx], edi
mov dword [ebx + 4], esi
test esi, esi
je 0x416168
cmp dword [ebx + 0x10], 0
jne 0x416125
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0xc], eax
mov edx, dword [ebx + 0x40]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x4000
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, 0x4000
jne 0x4160d7
mov dword [ebx + 0x10], 0x4000
mov eax, dword [ebx + 0x64]
add eax, dword [ebx + 4]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x68]
add eax, dword [ebx + 0x10]
mov dword [ebx + 0x68], eax
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.00417066
mov dword [ebx + 0x38], eax
mov eax, dword [ebx + 0x64]
sub eax, dword [ebx + 4]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x68]
sub eax, dword [ebx + 0x10]
mov dword [ebx + 0x68], eax
cmp dword [ebx + 0x38], 0
jne 0x416168
cmp dword [ebx + 4], 0
jne 0x4160ec
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov eax, dword [ebx + 0x4c]
mov dword [esp], eax
call fcn.0041a99a
mov dword [ebx + 0x4c], eax
mov eax, esi
sub eax, dword [ebx + 4]
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x41625e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, 0
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x416279
cmp byte [ebx + 0x5c], 0x77
je 0x416283
mov eax, 0xfffffffe
jmp 0x41633a
mov dword [ebx + 4], 0
mov eax, 0x4000
mov esi, eax
sub esi, dword [ebx + 0x10]
je 0x4162c5
mov eax, dword [ebx + 0x40]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov eax, dword [ebx + 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, esi
jne 0x41632e
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 0x4000
test edi, edi
jne 0x41631e
mov eax, dword [ebx + 0x68]
add eax, dword [ebx + 0x10]
mov dword [ebx + 0x68], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00417066
mov dword [ebx + 0x38], eax
mov eax, dword [ebx + 0x68]
sub eax, dword [ebx + 0x10]
mov dword [ebx + 0x68], eax
test esi, esi
jne 0x4162fe
cmp dword [ebx + 0x38], 0xfffffffb
jne 0x4162fe
mov dword [ebx + 0x38], 0
mov edi, 0
cmp dword [ebx + 0x10], 0
jne 0x41630f
cmp dword [ebx + 0x38], 1
jne 0x416314
mov edi, 1
cmp dword [ebx + 0x38], 1
jbe 0x41628a
mov eax, 0
cmp dword [ebx + 0x38], 1
je 0x41633a
mov eax, dword [ebx + 0x38]
jmp 0x41633a
mov dword [ebx + 0x38], 0xffffffff
mov eax, 0xffffffff
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret