joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4109fb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x448630]
xor eax, ebp
mov dword [ebp + 0x390], eax
mov eax, dword [ebp + 0x39c]
push esi
push edi
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push 0x80000002
mov dword [ebp - 0x78], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x410add
mov byte [ebp - 0x70], al
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push str.TransferJobID
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x78], 0
jbe 0x410add
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x70]
push eax
call esi
test eax, eax
je 0x410add
lea eax, [ebp - 0x70]
push eax
call esi
lea edi, [eax + 1]
cmp edi, 0x3fffffff
jle 0x410a9b
xor eax, eax
jmp 0x410ab1
lea eax, [edi + edi]
call fcn.00430a00
mov esi, esp
push 3
push edi
lea eax, [ebp - 0x70]
push eax
call fcn.00401106
push dword [ebp - 0x74]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
push 0x10
push 0x439410
push dword [ebp - 0x74]
call fcn.00420158
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
jmp 0x410ae2
mov eax, 0x80004005
lea esp, [ebp - 0x88]
pop edi
pop esi
mov ecx, dword [ebp + 0x390]
xor ecx, ebp
call fcn.0041e56d
add ebp, 0x394
leave
ret

Function at 0x411d60
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x60
mov eax, 0x4362f2
call fcn.0042501e
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x5c], eax
xor eax, eax
dec ecx
push 4
neg ecx
sbb ecx, ecx
mov esi, edx
pop edx
and ecx, 0xfffffffc
mov dword [ebp - 0x54], ebx
lea edi, [ebp - 0x50]
stosd dword es:[edi], eax
add ecx, edx
lea eax, [ebp - 0x54]
push eax
or ecx, 1
push ecx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x60], edx
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x411ded
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push eax
lea esi, [ebp - 0x30]
call fcn.00411cfa
push eax
lea eax, [ebp - 0x4c]
push str.encryption_failed__sysError
push eax
mov dword [ebp - 4], ebx
call fcn.004060a2
add esp, 0x14
lea esi, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.00407285
push 0x44232c
mov eax, esi
push eax
call fcn.00424705
mov edi, dword [ebp - 0x58]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov esi, dword [ebp - 0x54]
mov eax, edi
call fcn.0040e897
push dword [ebp - 0x54]
mov eax, dword [edi]
push dword [ebp - 0x50]
push eax
call fcn.0041e580
add esp, 0xc
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
call fcn.004250a1
ret
Function at 0x411e24
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x60
mov eax, 0x4362f2
call fcn.0042501e
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x54], ebx
lea edi, [ebp - 0x50]
stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
push eax
push 1
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x60]
mov esi, edx
push eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x60], ecx
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x411ea2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push eax
lea esi, [ebp - 0x30]
call fcn.00411cfa
push eax
lea eax, [ebp - 0x4c]
push str.decryption_failed__sysError
push eax
mov dword [ebp - 4], ebx
call fcn.004060a2
add esp, 0x14
lea esi, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.00407285
push 0x44232c
mov eax, esi
push eax
call fcn.00424705
mov edi, dword [ebp - 0x58]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov esi, dword [ebp - 0x54]
mov eax, edi
call fcn.0040e897
push dword [ebp - 0x54]
mov eax, dword [edi]
push dword [ebp - 0x50]
push eax
call fcn.0041e580
add esp, 0xc
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
call fcn.004250a1
ret

Function at 0x411f4b
Capabilities:
Encode data using base64 via winapi

Disassembly:
push 0x6c
mov eax, 0x4362bd
call fcn.0042501e
mov eax, dword [ebp + 8]
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], ecx
cmp dword [ebp + 0xc], ecx
jne 0x411f7a
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ecx
mov byte [edi], cl
jmp 0x412073
mov esi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
lea edx, [ebp - 0x68]
push edx
push ecx
mov ebx, 0x40000001
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x68], ecx
push eax
call esi
test eax, eax
jne 0x411fd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
lea esi, [ebp - 0x64]
call fcn.00411cfa
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x48]
push str.binary2string__phase1__failed__sysError
push eax
call fcn.004060a2
add esp, 0x14
mov byte [ebp - 4], 1
lea esi, [ebp - 0x78]
call fcn.00407285
push 0x44232c
mov eax, esi
push eax
call fcn.00424705
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0x2c]
call fcn.004122ca
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x412005
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x68]
push ecx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x6c]
call esi
test eax, eax
jne 0x412047
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
lea esi, [ebp - 0x48]
call fcn.00411cfa
push eax
lea eax, [ebp - 0x64]
push str.binary2string__phase2__failed__sysError
push eax
mov byte [ebp - 4], 3
call fcn.004060a2
add esp, 0x14
mov byte [ebp - 4], 4
jmp 0x411fc3
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0x2c]
call fcn.004122ca
and dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
lea esi, [ebp - 0x2c]
mov byte [edi], 0
call fcn.00405ce9
push 0
push 1
mov ecx, esi
call fcn.00405dcc
mov eax, edi
call fcn.004250a1
ret
Function at 0x41207b
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0x98
mov eax, 0x43626d
call fcn.0042501e
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x84], ebx
mov ecx, dword [edi + 0x10]
mov dword [ebp - 0x88], eax
cmp ecx, ebx
jne 0x4120b1
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
jmp 0x4121eb
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x84], ebx
jb 0x4120c1
mov eax, dword [edi]
jmp 0x4120c3
mov eax, edi
push ebx
push ebx
lea edx, [ebp - 0x84]
push edx
push ebx
push 1
push ecx
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x41211c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push eax
lea esi, [ebp - 0x48]
call fcn.00411cfa
push eax
lea eax, [ebp - 0x80]
push str.string2binary__phase1__failed__sysError
push eax
mov dword [ebp - 4], ebx
call fcn.004060a2
add esp, 0x14
lea esi, [ebp - 0x94]
mov byte [ebp - 4], 1
call fcn.00407285
push 0x44232c
mov eax, esi
push eax
call fcn.00424705
mov esi, dword [ebp - 0x84]
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
call fcn.0040e897
mov dword [ebp - 4], 2
cmp dword [edi + 0x14], 0x10
mov eax, dword [edi + 0x10]
jb 0x412151
mov edi, dword [edi]
push ebx
push ebx
lea ecx, [ebp - 0x84]
push ecx
push dword [ebp - 0x98]
push 1
push eax
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x4121af
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push eax
lea esi, [ebp - 0x64]
call fcn.00411cfa
push eax
lea eax, [ebp - 0x2c]
push str.string2binary__phase2__failed__sysError
push eax
mov byte [ebp - 4], 3
call fcn.004060a2
add esp, 0x14
lea esi, [ebp - 0xa4]
mov byte [ebp - 4], 4
call fcn.00407285
push 0x44232c
mov eax, esi
jmp 0x412116
mov esi, dword [ebp - 0x84]
lea eax, [ebp - 0x98]
call fcn.0040e897
mov eax, dword [ebp - 0x88]
lea edi, [ebp - 0x98]
call fcn.004122ed
cmp dword [ebp - 0x98], ebx
je 0x4121e5
push dword [ebp - 0x98]
call fcn.0041e562
pop ecx
mov eax, dword [ebp - 0x88]
call fcn.004250a1
ret
Function at 0x41396b
Capabilities:
Create process on windows

Disassembly:
push 0x2c
mov eax, 0x437267
call fcn.0042501e
cmp dword [0x44b6cc], 1
mov ebx, ecx
jg 0x4139c6
lea eax, [ebp - 0x30]
push str.Executor.exec__:
lea edi, [ebx + 0x38]
push eax
call fcn.00410b38
pop ecx
pop ecx
and dword [ebp - 4], 0
push str.Executor::startExecution
push 0x93
push str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u45_3627_install_src_windows_common_Executor.cpp
push 1
mov edx, eax
mov ecx, 0x44b6cc
call fcn.00412fce
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00405dcc
push 0x44
pop esi
push esi
lea edi, [ebx + 0x7c]
push 0
push edi
call fcn.0041f900
add esp, 0xc
push 0x10
lea eax, [ebx + 0x6c]
push 0
push eax
mov dword [edi], esi
call fcn.0041f900
add esp, 0xc
cmp dword [ebx + 0xc0], 1
jne 0x413a0a
or dword [ebx + 0xa8], 1
xor eax, eax
mov word [ebx + 0xac], ax
mov dword [ebx + 0x60], 0x8000000
cmp byte [ebx + 0xcd], 0
je 0x413a1a
mov esi, ebx
call fcn.00413eab
lea eax, [ebx + 0x38]
mov edx, dword [eax + 0x14]
cmp edx, 0x10
jb 0x413a29
mov esi, dword [eax]
jmp 0x413a2b
mov esi, eax
mov ecx, dword [eax + 0x10]
add ecx, esi
cmp edx, 0x10
jb 0x413a37
mov eax, dword [eax]
push dword [ebp - 0x35]
xor edx, edx
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
call fcn.0040cc48
mov dword [ebp - 4], 1
lea eax, [ebp - 0x31]
lea esi, [ebp - 0x24]
mov byte [ebp - 0x31], 0
call fcn.0040a1c4
cmp dword [ebx + 0x14], 0x10
jb 0x413a70
mov ecx, dword [ebx]
jmp 0x413a72
mov ecx, ebx
lea eax, [ebx + 0x6c]
push eax
push edi
push dword [ebx + 0x68]
push dword [ebx + 0x64]
push dword [ebx + 0x60]
push dword [ebx + 0x5c]
push dword [ebx + 0x58]
push dword [ebx + 0x54]
push dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
setne bl
cmp dword [ebp - 0x24], 0
je 0x413aa7
push dword [ebp - 0x24]
call fcn.0041e562
pop ecx
mov al, bl
call fcn.004250a1
ret
Function at 0x41422e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x436bd4
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x448630]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x448630]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov edi, ecx
cmp dword [ebp + 8], ebx
jne 0x4142d2
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], str.Destination_buffer_cant_be_NULL
call fcn.0041eced
mov dword [esp + 0x20], vtable.std::invalid_argument.0
mov dword [esp + 0x80], ebx
lea eax, [esp + 0x48]
push eax
lea esi, [esp + 0x18]
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u45_3627_install_src_common_share_tstrings.cpp
mov dword [esp + 0x1c], str.tstrings::format
mov dword [esp + 0x20], 0x1b
call fcn.00414b88
lea eax, [esp + 0x4c]
mov dword [esp], 0x4424cc
push eax
call fcn.00424705
push 0xf
pop esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
mov dword [esp + 0x80], 1
mov eax, dword [esp + 0x3c]
add eax, 0x100
lea ecx, [esp + 0x2c]
call fcn.004122ca
cmp dword [esp + 0x40], 0x10
mov eax, dword [esp + 0x2c]
jae 0x41430d
lea eax, [esp + 0x2c]
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 8]
push 0xffffffffffffffff
push dword [esp + 0x48]
push eax
call fcn.004243f2
add esp, 0x14
cmp eax, 0xffffffff
je 0x4142ec
lea ecx, [esp + 0x2c]
call fcn.004122ca
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], ebx
lea esi, [esp + 0x2c]
mov byte [edi], bl
call fcn.00405ce9
push ebx
push 1
mov ecx, esi
call fcn.00405dcc
mov eax, edi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0041e56d
mov esp, ebp
pop ebp
ret

Function at 0x415c78
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0041f900
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor eax, eax
cmp word [ebp - 0x24], 9
sete al
leave
ret
Function at 0x415fab
Capabilities:
Get common file path

Disassembly:
push 0x38
mov eax, 0x435ca3
call fcn.0042501e
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x30], eax
mov esi, 0x104
lea eax, [ebp - 0x40]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
call fcn.004140a7
mov dword [ebp - 4], edi
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x3c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
sub edi, esi
push edi
call ebx
cmp eax, edi
jbe 0x416007
mov esi, eax
lea eax, [ebp - 0x40]
call fcn.004140a7
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
push esi
sub eax, esi
push eax
call ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.00405ac0
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0041bda5
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00405dcc
test esi, esi
je 0x416036
push esi
call fcn.0041e562
pop ecx
mov eax, dword [ebp - 0x30]
call fcn.004250a1
ret

Function at 0x41603f
Capabilities:
Get common file path

Disassembly:
push 0x18c
mov eax, 0x4377b4
call fcn.0042501e
xor ebx, ebx
push 0x104
lea eax, [ebp - 0x118]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x18c], ebx
call fcn.0041f900
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push ebx
push ebx
push 0x25
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp eax, ebx
je 0x41616f
cmp dword [0x44b6cc], 3
jg 0x416138
push eax
lea edi, [ebp - 0x188]
call fcn.0041336d
mov esi, eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x16c]
mov dword [esp], str.GetSystem32Dir
call fcn.00405ac0
mov byte [ebp - 4], 1
cmp dword [esi + 0x14], 0x10
jb 0x4160c3
mov esi, dword [esi]
cmp dword [eax + 0x14], 0x10
jb 0x4160cb
mov eax, dword [eax]
push esi
push eax
push str._s_failed_with__s
lea ecx, [ebp - 0x150]
call fcn.0041422e
add esp, 0xc
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 0x10
jb 0x4160ec
mov eax, dword [eax]
push eax
push 0xd6
push 3
mov ebx, str.SysInfo::getSystem32Dir
mov edi, str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u45_3627_install_src_windows_common_SysInfo.cpp
mov esi, 0x44b6cc
call fcn.0040102d
xor esi, esi
push esi
push 1
lea ecx, [ebp - 0x150]
call fcn.00405dcc
push esi
push 1
lea ecx, [ebp - 0x16c]
call fcn.00405dcc
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea ecx, [ebp - 0x188]
call fcn.00405dcc
lea eax, [ebp - 0x18c]
push eax
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x18c], str.SHGetFolderPath_CSIDL_SYSTEM__failed
call fcn.0041eced
push 0x44232c
lea eax, [ebp - 0x198]
push eax
mov dword [ebp - method.std::logic_error.virtual_0], vtable.std::runtime_error.0
call fcn.00424705
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x134]
call fcn.00405ac0
lea edx, [ebp - 0x134]
mov eax, esi
mov dword [ebp - 4], 3
call fcn.0041bda5
push ebx
push 1
lea ecx, [ebp - 0x134]
call fcn.00405dcc
mov eax, esi
call fcn.004250a1
ret
Function at 0x41c28f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x64
mov eax, 0x4368b9
call fcn.0042501e
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x58], ebx
mov esi, edx
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x54], eax
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x58], 1
mov edx, dword [edi + 4]
mov ecx, dword [edi]
mov eax, edx
sub eax, ecx
mov dword [ebp - 0x50], eax
mov eax, ecx
sub eax, edx
neg eax
sbb eax, eax
and eax, ecx
cmp dword [esi + 0x14], 0x10
jb 0x41c2eb
mov ecx, dword [esi]
mov dword [ebp - 0x4c], ecx
jmp 0x41c2ee
mov dword [ebp - 0x4c], esi
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ecx]
lea edx, [ebp - 0x50]
push edx
push eax
push dword [ebp - 0x54]
push ebx
push dword [ebp - 0x4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x4c], eax
cmp eax, 0xea
je 0x41c320
mov ecx, dword [edi]
cmp ecx, dword [edi + 4]
jne 0x41c32f
cmp eax, ebx
jne 0x41c333
cmp dword [ebp - 0x50], ebx
jbe 0x41c371
mov esi, dword [ebp - 0x50]
mov eax, edi
call fcn.0040e897
mov esi, dword [ebp - 0x60]
jmp 0x41c2c8
cmp eax, ebx
je 0x41c371
push str.query_value
lea ecx, [ebp - 0x2c]
call fcn.00405ac0
push dword [ebp - 0x4c]
lea edi, [ebp - 0x2c]
push esi
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 1
call fcn.0041c6cc
pop ecx
pop ecx
lea esi, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.00407285
push 0x44232c
mov eax, esi
push eax
call fcn.00424705
mov esi, dword [ebp - 0x50]
mov eax, edi
call fcn.0040e897
mov eax, edi
call fcn.004250a1
ret 8

Function at 0x41c479
Capabilities:
Set registry value

Disassembly:
push 0x48
mov eax, 0x436836
call fcn.0042501e
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
cmp dword [esi + 0x14], 0x10
jb 0x41c49b
mov edi, dword [esi]
jmp 0x41c49d
mov edi, esi
mov edx, dword [edx]
push eax
push ecx
push 3
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test edi, edi
je 0x41c4ec
push str.set_binary_value
lea ecx, [ebp - 0x2c]
call fcn.00405ac0
and dword [ebp - 4], 0
push edi
push esi
lea edi, [ebp - 0x2c]
lea ecx, [ebp - 0x48]
call fcn.0041c6cc
pop ecx
pop ecx
lea esi, [ebp - 0x54]
mov byte [ebp - 4], 1
call fcn.00407285
push 0x44232c
mov eax, esi
push eax
call fcn.00424705
call fcn.004250a1
ret 4
Function at 0x41c4f4
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x198
mov eax, 0x436d79
call fcn.0042501e
mov eax, dword [ebp + 8]
mov esi, pe_nt_image_headers32
xor ebx, ebx
push esi
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x110]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x198], edi
mov dword [ebp - 0x190], ebx
call fcn.0041f900
add esp, 0xc
mov dword [ebp - 0x184], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x190], 1
mov eax, dword [ebp - 0x18c]
mov eax, dword [eax]
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x194]
push ecx
lea ecx, [ebp - 0x110]
push ecx
push dword [ebp - 0x184]
mov dword [ebp - 0x194], esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc dword [ebp - 0x184]
mov dword [ebp - 0x188], eax
cmp eax, ebx
jne 0x41c5c1
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x12c]
call fcn.00405ac0
lea ebx, [ebp - 0x12c]
mov dword [ebp - 4], 1
call fcn.0041c733
push 0
push 1
mov ecx, ebx
mov byte [ebp - 4], 0
call fcn.00405dcc
xor ebx, ebx
jmp 0x41c54d
cmp eax, 0x103
je 0x41c628
push str.enum_subkeys
lea ecx, [ebp - 0x148]
call fcn.00405ac0
push dword [ebp - 0x184]
lea eax, [ebp - 0x180]
push eax
mov dword [ebp - 4], 2
call fcn.004146a9
push dword [ebp - 0x188]
lea edi, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x164]
call fcn.0041c6cc
add esp, 0x10
lea esi, [ebp - 0x1a4]
mov byte [ebp - 4], 4
call fcn.00407285
push 0x44232c
mov eax, esi
push eax
call fcn.00424705
mov eax, edi
call fcn.004250a1
ret 4
Function at 0x431c8c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x448630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004299b2
and dword [ebp - 0x14], 0
cmp dword [0x44b3c4], 0
mov dword [ebp - 0x18], eax
jne 0x431d3f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x431de7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x431de7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44b3c4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44b3c8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44b3cc], eax
call edi
push eax
call esi
mov dword [0x44b3d4], eax
test eax, eax
je 0x431d3f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44b3d0], eax
mov eax, dword [0x44b3d0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x431d98
cmp dword [0x44b3d4], ecx
je 0x431d98
push eax
call esi
push dword [0x44b3d4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x431d98
test ebx, ebx
je 0x431d98
call edi
test eax, eax
je 0x431d8f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x431d8f
test byte [ebp - 8], 1
jne 0x431d98
or dword [ebp + 0x10], 0x200000
jmp 0x431dcb
mov eax, dword [0x44b3c8]
cmp eax, dword [ebp - 0x18]
je 0x431dcb
push eax
call esi
test eax, eax
je 0x431dcb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x431dcb
mov eax, dword [0x44b3cc]
cmp eax, dword [ebp - 0x18]
je 0x431dcb
push eax
call esi
test eax, eax
je 0x431dcb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44b3c4]
call esi
test eax, eax
je 0x431de7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x431de9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e56d
leave
ret
Function at 0x4065d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40668f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.0040c47c
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push edi
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x406679
cmp dword [ebp - 8], 0
jbe 0x406677
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00402830
mov ebx, eax
xor esi, esi
jmp 0x406655
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403870
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040c46c
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
inc esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push edi
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0x103
jne 0x406638
mov eax, ebx
call fcn.00402860
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406696
lea eax, [ebp - 0x10]
call fcn.00403694
ret

Function at 0x40aa70
Capabilities:
Get file attributes

Disassembly:
push ebx
push eax
push 0x8001
call sub.kernel32.dll_SetErrorMode
xchg ebx, eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x40aa8b
dec eax
and al, 0x10
setne al
xchg ebx, eax
push eax
call sub.kernel32.dll_SetErrorMode
xchg ebx, eax
pop ebx
ret

Function at 0x40b8b4
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x27], 0xef
test dl, dl
je 0x40b8c0
or byte [eax + 0x27], 0x10
mov ecx, dword [eax + 0x1c]
jecxz 0x40b8d9
push eax
je 0x40b8da
call dword [0x426148]
pop eax
push 5
push dword [eax + 0x1c]
call sub.user32.dll_ShowWindow
ret
and byte [eax + 0x37], 0xfe
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x426148]
ret

Function at 0x40cbc4
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.0040cb60
je 0x40cbf6
mov eax, ebx
push edx
call fcn.004094c8
pop edx
cmp eax, edx
je 0x40cbf6
test edx, edx
mov eax, ebx
jne 0x40cbe8
pop ebx
inc edx
jmp fcn.004094b8
mov byte [ebx + 0x49], dl
xor edx, edx
call fcn.004094b8
xchg ebx, eax
cmp eax, 0
pop ebx
jne fcn.0040cc14
ret