joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e290
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, 0xbb40e64e
cmp dword [0x4096f0], eax
je 0x42e2b2
cmp dword [0x4096f0], ebx
jne 0x42e34b
push esi
push eax
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4096f0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x4096f0], esi
test esi, esi
jne 0x42e321
mov dword [0x4096f0], ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
mov esi, 0x4096f0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
push esi
call sub.KERNEL32.dll_WerRegisterMemoryBlock
mov eax, dword [0x4096f0]
not eax
mov dword [0x476e14], eax
pop esi
pop ebx
leave
ret

Function at 0x42e34e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4096f0]
jne fcn.0042f04f
ret

Function at 0x42e5fd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x4175e4
push 0x80000000
mov dword [ebp - 8], ebx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42e69b
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push dword [ebp - 8]
call esi
test eax, eax
jne 0x42e691
push 4
pop esi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x409734
push dword [ebp - 4]
mov dword [ebp + 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42e691
cmp dword [ebp + 8], esi
jne 0x42e691
mov esi, dword [ebp - 0xc]
cmp esi, 3
ja 0x42e691
cmp dword [ebp - 4], ebx
je 0x42e683
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], ebx
je 0x42e68d
push dword [ebp - 8]
call edi
mov eax, esi
jmp 0x42e6a7
cmp dword [ebp - 4], ebx
je 0x42e69b
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], ebx
je 0x42e6a5
push dword [ebp - 8]
call edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42ea28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x477edc], 0
je 0x42ea3d
mov eax, dword [0x477ee0]
leave
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x409818
push 0x80000001
mov dword [ebp - 4], esi
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42eab4
lea eax, [ebp - 8]
push eax
push 0x477ee0
push esi
push esi
push dword [0x476e18]
mov dword [ebp - 8], 4
push dword [ebp - 4]
call edi
test eax, eax
jne 0x42eab4
cmp dword [ebp - 8], 4
jne 0x42eab4
mov esi, dword [0x477ee0]
mov byte [0x477edc], 1
cmp dword [ebp - 4], eax
je 0x42eaad
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x42eb3f
mov eax, dword [ebp - 4]
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x42eac7
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x409864
push 0x80000001
call ebx
test eax, eax
jne 0x42eb24
push 4
pop ebx
lea eax, [ebp - 8]
push eax
push 0x477ee0
push 0
push 0
push dword [0x476e18]
mov dword [ebp - 8], ebx
push dword [ebp - 4]
call edi
test eax, eax
jne 0x42eb24
cmp dword [ebp - 8], ebx
jne 0x42eb24
mov edi, dword [0x477ee0]
mov byte [0x477edc], 1
cmp dword [ebp - 4], eax
je 0x42eb20
push dword [ebp - 4]
call esi
mov eax, edi
jmp 0x42eb3f
and dword [0x477ee0], 0
cmp dword [ebp - 4], 0
mov byte [0x477edc], 1
je 0x42eb3d
push dword [ebp - 4]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42ee3c
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x442068
call fcn.0042f54e
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp dword [0x479a00], ebx
jne 0x42ebd7
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], ebx
mov edi, 0x4799f4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x42ec11
cmp eax, esi
jne 0x42ec04
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x42ec14
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42ebeb
xor esi, esi
inc esi
mov eax, dword [0x4799f0]
cmp eax, esi
jne 0x42ec27
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x42ec62
mov eax, dword [0x4799f0]
test eax, eax
jne 0x42ec5c
mov dword [0x4799f0], esi
push 0x401344
push 0x401330
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x42ec62
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x42ed7c
mov dword [0x477f00], esi
mov eax, dword [0x4799f0]
cmp eax, esi
jne 0x42ec86
push 0x40132c
push 0x4012e8
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x4799f0], 2
cmp dword [ebp - 0x24], ebx
jne 0x42ec93
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x479a04], ebx
je 0x42ecb4
push 0x479a04
call fcn.0042f486
pop ecx
test eax, eax
je 0x42ecb4
push ebx
push 2
push ebx
call dword [0x479a04]
mov eax, dword [sym.imp.MSVCR100.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x42ed0d
cmp al, bl
je 0x42eccd
cmp dword [ebp - 0x1c], ebx
jne 0x42ed0d
mov al, byte [esi]
cmp al, bl
je 0x42ecdd
cmp al, 0x20
ja 0x42ecdd
inc esi
mov dword [ebp - 0x20], esi
jmp 0x42eccd
test byte [ebp - 0x40], 1
je 0x42ece9
movzx eax, word [ebp - 0x3c]
jmp 0x42ecec
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x477efc], eax
cmp dword [0x477ef0], ebx
jne 0x42ed62
push eax
call dword [sym.imp.MSVCR100.dll_exit]
cmp al, 0x22
jne 0x42ed1c
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR100.dll__ismbblead]
pop ecx
test eax, eax
je 0x42ed2f
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x42ecbb
cmp dword [0x477f00], ebx
jne 0x42ed70
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x477efc]
call fcn.0042f593
ret
call fcn.0042e290
jmp 0x42eba9
Function at 0x42f04f
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x478010], eax
mov dword [0x47800c], ecx
mov dword [0x478008], edx
mov dword [0x478004], ebx
mov dword [0x478000], esi
mov dword [0x477ffc], edi
mov word [0x478028], ss
mov word [0x47801c], cs
mov word [0x477ff8], ds
mov word [0x477ff4], es
mov word [0x477ff0], fs
mov word [0x477fec], gs
pushfd
pop dword [0x478020]
mov eax, dword [ebp]
mov dword [0x478014], eax
mov eax, dword [ebp + 4]
mov dword [0x478018], eax
lea eax, [ebp + 8]
mov dword [0x478024], eax
mov eax, dword [ebp - 0x320]
mov dword [0x477f60], 0x10001
mov eax, dword [0x478018]
mov dword [0x477f14], eax
mov dword [0x477f08], 0xc0000409
mov dword [0x477f0c], 1
mov eax, dword [0x4096f0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x476e14]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x477f58], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x409908
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x477f58], 0
jne 0x42f13b
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x43287b
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4096f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x214], 1
call sub.MSVCR100.dll_memset
mov ecx, 0x4782f0
add esp, 0xc
mov dword [ebp - 0x210], 0x208
xor esi, esi
mov eax, ecx
cmp dword [eax], 0
je 0x4328e7
add eax, 0x14
inc esi
cmp eax, 0x478318
jl 0x4328d2
jmp 0x432a45
imul esi, esi, 0x14
add esi, ecx
je 0x432a45
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x432a25
cmp dword [ebp - 0x214], 1
jne 0x432a25
cmp word [ebp - 0x20c], ax
je 0x432a25
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x432a25
shr eax, 1
mov dword [ebp - 0x210], eax
cmp eax, 0x104
jae 0x43296a
add eax, eax
cmp eax, 0x208
jae 0x432965
xor ecx, ecx
mov word [ebp + eax - 0x20c], cx
jmp 0x432970
call fcn.0042f04f
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x20c]
push eax
call fcn.00432a99
mov dword [esi], eax
test eax, eax
je 0x432a25
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x409ae8
push eax
call edi
test eax, eax
jne 0x43299d
mov eax, dword [ebp + 0x10]
jmp 0x43299f
call eax
mov dword [esi + 4], eax
cmp eax, 1
jne 0x4329c3
push 0x409b04
push dword [esi]
call edi
push 0x409b10
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x409b24
jmp 0x4329f7
cmp eax, 2
jne 0x4329d8
push 0x409b04
push dword [esi]
call edi
push 0x409b34
jmp 0x4329b5
cmp eax, 3
jne 0x432a01
push 0x409b48
push dword [esi]
call edi
push 0x409b58
push dword [esi]
mov dword [esi + 8], eax
call edi
push 0x409b70
push dword [esi]
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0xc], eax
cmp dword [esi + 8], 0
je 0x432a25
cmp dword [esi + 0x10], 0
je 0x432a25
cmp dword [esi + 0xc], 0
je 0x432a25
push dword [0x478318]
push esi
call fcn.0043275b
test eax, eax
js 0x432a25
xor esi, esi
test esi, esi
je 0x432a45
cmp dword [esi], 0
je 0x432a36
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [esi], 0
and dword [esi + 8], 0
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e34e
leave
ret 0xc
Function at 0x436c10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x904
mov eax, dword [0x4096f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x100
lea eax, [ebp - 0x904]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
xor edi, edi
call fcn.00429168
push 0x5c
pop esi
lea eax, [ebp - 0x804]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x436c76
xor ecx, ecx
mov dword [ebp + edi*4 - 0x904], eax
mov word [eax], cx
inc edi
cmp edi, 0x40
jge 0x436cb9
test eax, eax
je 0x436caf
lea eax, [ebp - 0x804]
push eax
call fcn.00440163
test eax, eax
js 0x436c55
jmp 0x436caf
mov eax, dword [ebp + edi*4 - 0x908]
dec edi
mov word [eax], si
push 0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x436cb9
cmp edi, 1
jg 0x436c91
xor eax, eax
inc eax
jmp 0x436cbb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042e34e
leave
ret 4

Function at 0x436cd1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x436d19
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x436d19
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x436d19
cmp word [eax + 2], 0
je 0x436d19
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x436d19
add eax, 0x30
jmp 0x436d1e
mov eax, 0x40b738
pop esi
pop ebp
ret
Function at 0x4375dc
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x4096f0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], eax
test ebx, ebx
jne 0x437621
push 0x15b3c8
call fcn.00429d5a
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x43761a
and dword [ebp - 0x4c], ebx
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x437785
cmp dword [0x4789a4], eax
je 0x437638
mov eax, dword [0x4772e4]
mov dword [ebx], eax
xor eax, eax
inc eax
jmp 0x437785
push edi
mov dword [ebx], eax
lea eax, [ebp - 0x4c]
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x437666
push 0x15b3c9
call fcn.00429d5a
xor edi, edi
jmp 0x437770
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 2
push dword [ebp - 0x4c]
call edi
test eax, eax
je 0x437686
push 0x15b3ca
jmp 0x43765a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x437698
push 0x15b3cb
jmp 0x43765a
push esi
push dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
call fcn.004359dd
mov esi, dword [ebp - 0x50]
test al, al
jne 0x4376bc
push 0x15b3cc
call fcn.00429d5a
xor edi, edi
jmp 0x437764
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push esi
push 2
push dword [ebp - 0x4c]
call edi
test eax, eax
jne 0x4376d6
push 0x15b3cd
jmp 0x4376b0
push 0x43
lea eax, [ebp - 0x47]
push 0
push eax
mov byte [ebp - 0x48], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0xb
mov dword [ebp - 0x5c], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x43770e
push 0x15b3ce
jmp 0x4376b0
and dword [ebp - 0x58], 0
xor edi, edi
inc edi
cmp dword [esi], 0
jbe 0x437757
lea eax, [esi + 4]
mov dword [ebp - 0x50], eax
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x43773f
mov eax, dword [ebp - 0x50]
push dword [eax]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x437755
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x50]
inc ecx
add eax, 8
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x50], eax
cmp ecx, dword [esi]
jb 0x437720
jmp 0x437757
mov dword [ebx], edi
mov dword [0x4789a4], edi
mov eax, dword [ebx]
mov dword [0x4772e4], eax
test esi, esi
je 0x43776f
push esi
call fcn.0042a11a
pop ecx
pop esi
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x437782
and dword [ebp - 0x4c], 0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0042e34e
leave
ret 4
Function at 0x4382c2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4096f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor bl, bl
call fcn.0044011a
test eax, eax
je 0x4383e3
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x214]
push eax
push 0x20019
xor edi, edi
push edi
push 0x40b7a8
push 0x80000002
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x218], edi
call esi
test eax, eax
jne 0x4383b5
lea eax, [ebp - 0x218]
push eax
push 0x20119
push edi
push 0x40b7a8
push 0x80000002
call esi
test eax, eax
jne 0x4383b5
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
push eax
push edi
push 0x40b80c
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], 0x20a
call esi
test eax, eax
jne 0x4383b5
cmp dword [ebp - 0x220], 1
jne 0x4383b5
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
push eax
push edi
push 0x40b80c
push dword [ebp - 0x218]
mov dword [ebp - 0x21c], 0x20a
call esi
test eax, eax
jne 0x4383b5
cmp dword [ebp - 0x220], 1
jne 0x4383b5
inc bl
mov eax, dword [ebp - 0x218]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4383ce
push eax
mov dword [ebp - 0x218], edi
call esi
mov ecx, dword [ebp - 0x214]
test ecx, ecx
je 0x4383e1
push ecx
mov dword [ebp - 0x214], edi
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0042e34e
leave
ret
Function at 0x4392b4
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x440bb6
call fcn.0042f1fc
mov ebx, dword [ebp + 8]
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x4392dd
cmp dword [0x478a1c], edi
je 0x4393c7
push 2
pop ebx
jmp 0x4392f7
cmp edi, 1
jne 0x4393c7
mov eax, ebx
call fcn.0043a185
test al, al
je 0x4393c7
xor ebx, ebx
lea ecx, [ebp - 0xd]
mov dword [ebp - 0x1c], ebx
call fcn.0043a1a7
mov ecx, dword [ebp + 8]
xor eax, eax
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0xc]
shr eax, 1
and eax, 0x10
or eax, ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ecx + 8]
jmp 0x4393a9
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x43933e
mov eax, dword [ebx]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
call fcn.0043999e
test eax, eax
je 0x4393db
push 0x1c049f
push 0
call fcn.00429daf
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
and dword [eax + 0x4772f8], 0
push ebx
mov ecx, 0x478a48
call fcn.00439133
movzx eax, word [esi + 0xc]
and dword [ebp - 0x14], 0
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x1c]
push 0
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
call fcn.00439ab5
mov esi, eax
test esi, esi
je 0x43932a
mov ebx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.0043a1c8
inc edi
cmp edi, 2
jl 0x4392c5
mov eax, esi
call fcn.0042f29b
ret 0x18
push ebx
mov ecx, 0x478a48
call fcn.00439097
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x4393bb
movzx ecx, word [ebx + 0xc]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x20], eax
je 0x439416
cmp dword [ebp - 0x20], 3
jne 0x439411
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
jne 0x439411
and cl, 0xf
cmp cl, 4
je 0x439416
push 2
pop esi
jmp 0x4393bb
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0xd]
mov dword [eax], 1
call fcn.0043a1c8
xor eax, eax
jmp 0x4393d3
Function at 0x43989f
Capabilities:
Query or enumerate registry value

Disassembly:
push 4
mov eax, 0x440c27
call fcn.0042f1fc
mov esi, dword [ebp + 8]
cmp esi, dword [0x478a40]
jne 0x4398bd
xor al, al
jmp 0x439996
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x4398ce
xor ecx, ecx
cmp dword [0x478a1c], ecx
jmp 0x4398d9
mov eax, esi
call fcn.0043a185
xor ecx, ecx
test al, al
sete cl
test ecx, ecx
jne 0x4398b6
xor edi, edi
lea ecx, [ebp + 0xf]
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], edi
call fcn.0043a1a7
mov dword [ebp - 4], edi
movzx edi, bl
neg edi
sbb edi, edi
and edi, 2
xor ebx, ebx
jmp 0x439957
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x43990d
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
call fcn.0043999e
test eax, eax
je 0x43997c
push 0x1c04c2
xor ebx, ebx
push ebx
call fcn.00429daf
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp + 8]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x478a48
mov dword [eax + 0x4772f8], ebx
call fcn.00439133
mov dword [ebp + 8], ebx
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
push ebx
or eax, edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call fcn.00439ab5
mov ebx, eax
test ebx, ebx
je 0x439901
jmp 0x439989
push dword [ebp + 8]
mov ecx, 0x478a48
call fcn.00439097
lea ecx, [ebp + 0xf]
call fcn.0043a1c8
test ebx, ebx
sete al
call fcn.0042f29b
ret 8

Function at 0x43a0d9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 4], eax
test ecx, ecx
jne 0x43a0eb
mov ecx, dword [edi]
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp + 0xc]
push eax
push 0xffff
push dword [ebp + 8]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp dword [ebp - 4], 2
mov esi, eax
jae 0x43a11c
cmp dword [ebp + 0xc], 1
je 0x43a119
cmp dword [ebp + 0xc], 2
jne 0x43a11c
push 2
pop esi
mov eax, esi
call fcn.0043999e
test eax, eax
je 0x43a140
push 0x1c0491
push 0
call fcn.00429daf
push edi
mov ecx, 0x478a48
call fcn.00439133
jmp 0x43a17d
test esi, esi
jne 0x43a172
mov ecx, dword [ebp + 0xc]
cmp ecx, 2
je 0x43a151
cmp ecx, 1
jne 0x43a160
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov word [ebx + eax*2 - 2], cx
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ebp + 0x10]
push eax
push ecx
call fcn.00439875
test eax, eax
jne 0x43a172
push 2
pop esi
push edi
mov ecx, 0x478a48
call fcn.00439097
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x43a1e9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x440c7d
call fcn.0042f1fc
mov esi, dword [ebp + 8]
cmp esi, dword [0x478a40]
jne 0x43a207
xor eax, eax
jmp 0x43a36c
and dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], ecx
xor ebx, ebx
or edi, 0xffffffff
test ebx, ebx
jne 0x43a22a
cmp dword [0x478a1c], ebx
je 0x43a32c
push 2
pop edi
jmp 0x43a244
cmp ebx, 1
jne 0x43a32c
mov eax, esi
call fcn.0043a185
test al, al
je 0x43a32c
xor edi, edi
and dword [ebp - 0x10], 0
lea ecx, [ebp + 0xb]
mov dword [ebp - 0x20], edi
call fcn.0043a1a7
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
push eax
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, edi
jmp 0x43a2ef
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x43a278
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x18], 2
mov edi, eax
jae 0x43a2a4
cmp dword [ebp - 0x1c], 1
je 0x43a2a1
cmp dword [ebp - 0x1c], 2
jne 0x43a2a4
push 2
pop edi
mov eax, edi
call fcn.0043999e
test eax, eax
je 0x43a30c
push 0x1c0496
xor edi, edi
push edi
call fcn.00429daf
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp - 0x10]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x478a48
mov dword [eax + 0x4772f8], edi
call fcn.00439133
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
call fcn.00439ab5
mov edi, eax
test edi, edi
je 0x43a26c
jmp 0x43a31d
push dword [ebp - 0x10]
mov ecx, 0x478a48
call fcn.00439097
test edi, edi
je 0x43a338
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.0043a1c8
mov ecx, dword [ebp - 0x18]
inc ebx
cmp ebx, 2
jl 0x43a212
jmp 0x43a347
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.0043a1c8
mov ecx, dword [ebp - 0x18]
test edi, edi
jne 0x43a362
cmp dword [ebp - 0x1c], 2
je 0x43a35a
mov al, byte [esi + 0xc]
and al, 0xf
cmp al, 2
jne 0x43a36a
push ecx
call fcn.00438786
jmp 0x43a368
push esi
call fcn.00438418
mov ecx, eax
mov eax, ecx
call fcn.0042f29b
ret 4