joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408386
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0x24
mov eax, 0x595e34
call fcn.004103bb
mov ebx, dword [ebp + 8]
and dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], ebx
call fcn.004113ce
test al, al
je 0x4083b9
push edi
pop ecx
push edi
push edi
push esi
push ebp
pop ebp
push ebx
push eax
pop eax
pop eax
push edx
pop esp
pop edi
push edx
pop edi
pop edi
pop eax
pop edi
pop edi
and dword [ebp - 0x18], 0
xor eax, eax
mov esi, 0x59b038
mov dword [ebp - 0x14], 7
push esi
mov word [ebp - 0x28], ax
call fcn.00433f51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401c7b
and dword [ebp - 4], 0
mov esi, str.30D6FCAC_6E23_45E5_8FF1_BCF7AB345F06
push esi
call fcn.00433f51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00402595
mov esi, 0x59b08c
push esi
call fcn.00433f51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00402595
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call fcn.004114e2
test al, al
je 0x408454
push eax
pop esi
pop edi
pop esp
push esi
pop edi
pop ecx
pop ebp
push ebx
pop ebp
push ecx
push ecx
push eax
push edi
push ebx
pop esi
pop eax
pop edx
push esi
push esp
push edi
pop ecx
pop ebx
push ecx
pop ebx
push edx
pop edx
pop esp
pop edx
call fcn.0041111c
test al, al
je 0x408473
push ebp
pop ecx
push esp
pop edx
push ecx
push ebx
push edi
push esp
pop ebx
pop eax
pop edx
pop edx
push ebx
pop esi
pop ecx
push ebx
push esi
pop ecx
push ebx
push edx
push ebp
pop edi
call fcn.004112ff
test al, al
je 0x40848d
push edi
pop esp
pop edx
push eax
push edx
pop ebp
push ebx
push esp
push esp
pop esi
pop esp
pop eax
push ebx
push ecx
push esp
push esp
pop ecx
cmp dword [ebp - 0x2c], 0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
je 0x4084ee
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x59a528
push dword [ebp - 0x2c]
call esi
push 0x59b090
push dword [ebp - 0x2c]
call esi
push str.InprocServer32
push dword [ebp - 0x2c]
call ebx
push str.ProgID
push dword [ebp - 0x2c]
call ebx
push str.Programmable
push dword [ebp - 0x2c]
call ebx
push str.TypeLib
push dword [ebp - 0x2c]
call ebx
push str.VersionIndependentProgID
push dword [ebp - 0x2c]
call ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00411344
test al, al
je 0x408517
pop esp
pop edx
pop ebx
push esp
push esp
pop esp
push ecx
push ebp
push eax
push eax
push ebx
pop ebx
push ecx
push ecx
push esi
pop edx
pop esi
pop ebp
push eax
push ebx
push ecx
push eax
push edx
pop eax
push esi
push eax
push esp
pop ebx
pop edx
pop esi
pop ecx
push edi
call fcn.0041163b
test al, al
je 0x408536
push ebp
pop edi
pop edi
push edi
push ebp
pop edi
pop eax
pop edx
pop esp
pop esp
pop edi
pop eax
push ebx
push esi
pop ebx
push ebx
push esp
pop esi
pop ebp
pop ebp
push esi
pop eax
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401b31
call fcn.00410376
ret 4
Function at 0x40855f
Capabilities:
Delete registry key

Disassembly:
push 0x2c
mov eax, 0x595eec
call fcn.004103bb
mov ebx, dword [ebp + 8]
xor edi, edi
xor eax, eax
mov dword [ebp - 0x38], ebx
mov esi, 0x59b038
mov dword [ebp - 0x34], edi
push esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
call fcn.00433f51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401c7b
mov esi, str.20829028_3AA4_4A37_857D_5AD484DEDE83
mov dword [ebp - 4], edi
push esi
call fcn.00433f51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00402595
mov esi, 0x59b08c
push esi
call fcn.00433f51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00402595
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x34]
push ecx
mov esi, 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push ebx
call edi
test eax, eax
jne 0x4086f8
lea eax, [ebp - 0x2c]
push eax
push esi
push 0
push 0x59b15c
push dword [ebp - 0x34]
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40866f
lea eax, [ebp - 0x30]
push eax
push 0xf013f
push 0
push 0x59b164
push dword [ebp - 0x2c]
call edi
test eax, eax
jne 0x40864c
push 0x59b168
push dword [ebp - 0x30]
call ebx
push str.win64
push dword [ebp - 0x30]
call ebx
push dword [ebp - 0x30]
call esi
push 0x59b164
push dword [ebp - 0x2c]
call ebx
push str.FLAGS
push dword [ebp - 0x2c]
call ebx
push str.HELPDIR
push dword [ebp - 0x2c]
call ebx
push dword [ebp - 0x2c]
call esi
call fcn.004114e2
test al, al
je 0x408695
push eax
pop esi
pop edi
pop esp
push esi
pop edi
pop ecx
pop ebp
push ebx
pop ebp
push ecx
push ecx
push eax
push edi
push ebx
pop esi
pop eax
pop edx
push esi
push esp
push edi
pop ecx
pop ebx
push ecx
pop ebx
push edx
pop edx
pop esp
pop edx
call fcn.0041111c
test al, al
je 0x4086b4
push ebp
pop ecx
push esp
pop edx
push ecx
push ebx
push edi
push esp
pop ebx
pop eax
pop edx
pop edx
push ebx
pop esi
pop ecx
push ebx
push esi
pop ecx
push ebx
push edx
push ebp
pop edi
call fcn.004112ff
test al, al
je 0x4086ce
push edi
pop esp
pop edx
push eax
push edx
pop ebp
push ebx
push esp
push esp
pop esi
pop esp
pop eax
push ebx
push ecx
push esp
push esp
pop ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push 0x59b15c
push dword [ebp - 0x34]
call esi
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x38]
call esi
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401b31
call fcn.00410376
ret 4
Function at 0x40870c
Capabilities:
Delete registry key

Disassembly:
push 0x20
mov eax, 0x595f19
call fcn.004103bb
and dword [ebp - 0x2c], 0
call fcn.00411275
test al, al
je 0x40873d
pop ecx
push eax
push esi
push edx
push esi
push ebx
push edi
pop ebp
push ecx
push edi
push esp
push edx
push ebp
pop ebp
push ecx
pop ecx
pop esi
push edx
pop edi
pop ebp
pop esi
pop esi
pop ebp
pop eax
call fcn.004110d7
test al, al
je 0x408765
pop eax
push esi
push eax
pop ebp
push ebx
pop esi
push ecx
push eax
push esi
push ebx
pop esi
pop esp
pop ebp
pop esi
push edi
pop esi
push eax
pop eax
push esp
push edx
pop esp
pop edx
push esp
pop edi
push eax
pop ebp
pop ebx
pop ebx
push eax
pop ebx
pop eax
and dword [ebp - 0x18], 0
xor eax, eax
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers_
mov dword [ebp - 0x14], 7
push esi
mov word [ebp - 0x28], ax
call fcn.00433f51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401c7b
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push 0xf013f
push 0
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408800
mov esi, 0x59b240
push esi
call fcn.00433f51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401c7b
mov esi, str.WindowsResetMasterOverlayIcon
push esi
call fcn.00433f51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00402595
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0041111c
test al, al
je 0x408828
pop ecx
push ebx
pop eax
push esp
push edx
push esp
pop eax
pop esp
pop ebp
push esi
pop edi
push eax
pop edi
push eax
pop esi
push ebp
push ebx
push eax
pop esi
push edx
pop ebx
pop ecx
push ebx
push esi
pop ebx
pop edx
push edx
push ebp
push eax
push ebx
push esp
call fcn.004110d7
test al, al
je 0x40884f
pop eax
push edi
pop ebx
push esp
pop edi
push esp
pop ebp
push ecx
pop ecx
push edi
push ecx
pop edi
push eax
pop esp
push edx
push ecx
pop esi
push eax
pop ecx
push ebx
pop edi
push ebp
push ecx
push ecx
push eax
pop esp
pop esp
pop esp
push eax
push ebx
call fcn.00411680
test al, al
je 0x408873
push ebp
pop ebx
push esi
pop edx
pop eax
push esp
push edx
pop edx
push ebp
push eax
pop ecx
push edi
pop esp
pop edx
pop esp
pop edi
push ebx
pop edi
pop edx
pop ebx
push ebx
pop eax
push ebx
push edx
push edi
push esp
push edx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401b31
call fcn.00410376
ret
Function at 0x408885
Capabilities:
Delete registry key

Disassembly:
push 0x24
mov eax, 0x595e34
call fcn.004103bb
mov ebx, dword [ebp + 8]
xor eax, eax
and dword [ebp - 0x2c], 0
mov esi, 0x59b038
and dword [ebp - 0x18], 0
push esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00433f51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401c7b
and dword [ebp - 4], 0
mov esi, str.4C6C327A_90BB_4D08_91EF_AEACDDE064E9
push esi
call fcn.00433f51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00402595
call fcn.004113ce
test al, al
je 0x4088f9
push edi
pop ecx
push edi
push edi
push esi
push ebp
pop ebp
push ebx
push eax
pop eax
pop eax
push edx
pop esp
pop edi
push edx
pop edi
pop edi
pop eax
pop edi
pop edi
mov esi, 0x59b08c
push esi
call fcn.00433f51
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00402595
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408a0b
call fcn.00411344
test al, al
je 0x40895e
pop esp
pop edx
pop ebx
push esp
push esp
pop esp
push ecx
push ebp
push eax
push eax
push ebx
pop ebx
push ecx
push ecx
push esi
pop edx
pop esi
pop ebp
push eax
push ebx
push ecx
push eax
push edx
pop eax
push esi
push eax
push esp
pop ebx
pop edx
pop esi
pop ecx
push edi
call fcn.0041163b
test al, al
je 0x40897d
push ebp
pop edi
pop edi
push edi
push ebp
pop edi
pop eax
pop edx
pop esp
pop esp
pop edi
pop eax
push ebx
push esi
pop ebx
push ebx
push esp
pop esi
pop ebp
pop ebp
push esi
pop eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.InprocServer32
push dword [ebp - 0x2c]
call esi
push str.Programmable
push dword [ebp - 0x2c]
call esi
push str.TypeLib
push dword [ebp - 0x2c]
call esi
push 0x59b38c
push dword [ebp - 0x2c]
call esi
call fcn.0041156c
test al, al
je 0x4089cd
push eax
push eax
pop edx
push esp
pop ebp
push esp
push edx
push edi
pop esp
pop ecx
pop esi
push ebx
pop ebp
push esi
pop esi
push eax
pop esi
pop edx
pop edx
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
call fcn.00411389
test al, al
je 0x4089f1
push edx
push esi
pop ebx
push esi
push eax
pop edi
push esi
pop ecx
push ecx
pop edi
pop ebx
pop edx
push edx
pop ebx
push edi
push ebx
pop ebp
pop edi
pop esp
push edx
push esp
push esi
pop ecx
push esp
pop ebx
push esi
pop ebp
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x30]
call esi
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401b31
call fcn.00410376
ret 4
Function at 0x409694
Capabilities:
Delete registry key

Disassembly:
push 0x238
mov eax, 0x595fd6
call fcn.004103bb
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00430680
push 0x59a724
lea eax, [ebp - 0x218]
push str._sService
push eax
call fcn.0040351f
add esp, 0x18
lea ecx, [ebp - 0x244]
call fcn.00410e64
and dword [ebp - 4], 0
call fcn.00411863
test al, al
je 0x4096fc
pop eax
push ebx
pop ecx
push ebx
pop ebp
push edx
pop ebp
pop edx
pop edi
pop eax
pop esp
push edi
push ecx
push edx
push ebx
push eax
push esp
pop esi
pop ecx
push edx
push esp
call fcn.0041111c
test al, al
je 0x409717
pop edi
push ebp
push edx
pop esp
push esp
pop esi
pop ebx
pop ebp
pop eax
pop ebx
pop esp
pop edi
pop edx
pop edx
pop ebx
pop ebx
push ebx
push ebp
call fcn.004118a8
test al, al
je 0x40973e
pop esi
push edi
pop edi
pop edi
pop ebx
push eax
push ebx
pop edi
push edi
push esi
push eax
pop ebx
push ebp
push ecx
push ebp
push ebp
push ecx
pop ecx
pop edx
pop ebp
pop eax
pop eax
pop edx
push edi
push ebx
push eax
push edx
push ecx
pop esp
push edi
lea ecx, [ebp - 0x244]
call fcn.00410e98
test eax, eax
je 0x4097dd
lea eax, [ebp - 0x21c]
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x220], eax
call fcn.004114e2
test al, al
je 0x40979b
push eax
pop esi
pop edi
pop esp
push esi
pop edi
pop ecx
pop ebp
push ebx
pop ebp
push ecx
push ecx
push eax
push edi
push ebx
pop esi
pop eax
pop edx
push esi
push esp
push edi
pop ecx
pop ebx
push ecx
pop ebx
push edx
pop edx
pop esp
pop edx
call fcn.0041111c
test al, al
je 0x4097ba
push ebp
pop ecx
push esp
pop edx
push ecx
push ebx
push edi
push esp
pop ebx
pop eax
pop edx
pop edx
push ebx
pop esi
pop ecx
push ebx
push esi
pop ecx
push ebx
push edx
push ebp
pop edi
call fcn.004112ff
test al, al
je 0x4097d4
push edi
pop esp
pop edx
push eax
push edx
pop ebp
push ebx
push esp
push esp
pop esi
pop esp
pop eax
push ebx
push ecx
push esp
push esp
pop ecx
cmp dword [ebp - 0x220], 0
jmp 0x40981a
call fcn.004113ce
test al, al
je 0x4097fa
push edi
pop ecx
push edi
push edi
push esi
push ebp
pop ebp
push ebx
push eax
pop eax
pop eax
push edx
pop esp
pop edi
push edx
pop edi
pop edi
pop eax
pop edi
pop edi
lea eax, [ebp - 0x21c]
push eax
push 0xf003f
push 0
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40983b
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x244]
call fcn.00410e77
call fcn.00410376
ret
Function at 0x40b4fa
Capabilities:
Delete registry value

Disassembly:
push 0x424
mov eax, 0x59635e
call fcn.004103bb
push 0x208
xor esi, esi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00430680
lea eax, [ebp - 0x218]
push 0x59a724
push eax
call fcn.0043eb48
lea eax, [ebp - 0x218]
push 0x59b604
push eax
call fcn.00433f6c
add esp, 0x1c
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x430]
push eax
call fcn.00427ba3
lea ecx, [ebp - 0x430]
mov dword [ebp - 4], esi
call fcn.00427c90
test eax, eax
jne 0x40b604
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x428]
push eax
mov ebx, 0xf003f
push ebx
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_accept
call edi
test eax, eax
jne 0x40b604
lea eax, [ebp - 0x424]
push eax
push ebx
push esi
push 0x59ac1c
push dword [ebp - 0x428]
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40b5f9
push 0x208
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.00430680
push 0x59ac28
push 0x59a724
lea eax, [ebp - 0x420]
push 0x59a6c0
push eax
call fcn.0040351f
add esp, 0x1c
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x424]
call edi
push dword [ebp - 0x428]
call edi
xor esi, esi
inc esi
lea ecx, [ebp - 0x430]
call fcn.00427bb8
mov eax, esi
call fcn.00410376
ret

Function at 0x40c320
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x596453
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x61e088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x622e6c
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x622e6c
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x59a908
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0040ff00
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410f33
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push str.kernel32.dll
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
call fcn.0041111c
test al, al
je 0x410f74
pop ecx
push ebx
pop eax
push esp
push edx
push esp
pop eax
pop esp
pop ebp
push esi
pop edi
push eax
pop edi
push eax
pop esi
push ebp
push ebx
push eax
pop esi
push edx
pop ebx
pop ecx
push ebx
push esi
pop ebx
pop edx
push edx
push ebp
push eax
push ebx
push esp
call fcn.004110d7
test al, al
je 0x410f9b
pop eax
push edi
pop ebx
push esp
pop edi
push esp
pop ebp
push ecx
pop ecx
push edi
push ecx
pop edi
push eax
pop esp
push edx
push ecx
pop esi
push eax
pop ecx
push ebx
pop edi
push ebp
push ecx
push ecx
push eax
pop esp
pop esp
pop esp
push eax
push ebx
call fcn.00411680
test al, al
je 0x410fbf
push ebp
pop ebx
push esi
pop edx
pop eax
push esp
push edx
pop edx
push ebp
push eax
pop ecx
push edi
pop esp
pop edx
pop esp
pop edi
push ebx
pop edi
pop edx
pop ebx
push ebx
pop eax
push ebx
push edx
push edi
push esp
push edx
mov esi, dword [ebp - 4]
cmp dword [esi], 0
jne 0x410fce
xor eax, eax
jmp 0x4110b3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetNativeSystemInfo
push dword [esi]
call edi
push str.IsWow64Process
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.Wow64DisableWow64FsRedirection
push dword [esi]
mov dword [esi + 0xc], eax
call edi
push str.Wow64RevertWow64FsRedirection
push dword [esi]
mov dword [esi + 0x18], eax
call edi
push str.GetSystemWow64DirectoryW
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push str.advapi32.dll
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
call fcn.0041170a
test al, al
je 0x41103c
push eax
pop ebp
pop edx
push edx
push esp
push ecx
pop ebx
pop esp
pop ecx
pop ecx
pop ebx
push edi
push ebp
pop ecx
push edx
pop ebp
pop eax
push edx
push ebx
pop eax
push edi
call fcn.00411389
test al, al
je 0x41106b
push eax
push esi
pop esp
push ecx
push ebx
pop ebp
pop ebx
pop esi
pop eax
pop ebp
pop ebp
push ebx
pop esp
pop edx
pop esi
push eax
pop edi
pop esp
pop esp
push edi
push ebp
pop edx
pop ecx
push esp
push ebx
push edi
pop esp
push esi
push eax
mov esi, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call fcn.0041149d
test al, al
je 0x41108f
pop ebx
push ebp
push edx
push eax
pop esp
pop edx
pop edx
push eax
pop esp
push eax
push ebx
pop eax
pop edx
pop eax
push esi
push eax
push ebx
push esp
push ebp
pop ebp
push esi
pop ecx
push ebx
push esp
push ecx
pop ebp
pop ebp
cmp dword [esi + 4], 0
je 0x410fc7
mov ebx, str.Wow64RevertWow64FsRedirection
push ebx
push dword [esi + 4]
call edi
push ebx
push dword [esi + 4]
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x1c], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4121c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x412242
push ebx
push edi
xor edi, edi
push str.958a208fcb7062e5cb0b4133fd0e8da3
mov dword [ebp + 8], edi
call fcn.00437350
mov ebx, dword [ebp + 0xc]
mov edx, edi
pop ecx
test ebx, ebx
je 0x4121ff
mov cl, byte [edi + str.958a208fcb7062e5cb0b4133fd0e8da3]
xor byte [edx + esi], cl
inc edi
xor ecx, ecx
cmp edi, eax
cmovge edi, ecx
inc edx
cmp edx, ebx
jb 0x4121e9
cmp ebx, 1
jle 0x412236
cmp byte [esi], 0x37
jne 0x412236
mov al, byte [esi + 1]
cmp al, 0x7a
je 0x412214
cmp al, 0x5a
jne 0x412236
lea eax, [ebp + 8]
push eax
push ebx
push esi
call fcn.0058ac90
test eax, eax
je 0x412236
mov edx, dword [ebp + 8]
test edx, edx
je 0x412236
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x412240
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x412a71
Capabilities:
Set registry value

Disassembly:
push 0x2c
mov eax, 0x596a0b
call fcn.00410387
xor esi, esi
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00410e64
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], esi
call fcn.00410e98
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x412aaa
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412b1a
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x59a724
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x412ae7
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x412b1a
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x38]
call fcn.00410e77
call fcn.00410361
ret 8
Function at 0x41301f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x596acf
call fcn.00410387
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00410e64
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.00410e98
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x41305f
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4130c1
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x59a724
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x41309c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4130c1
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.00410e77
call fcn.00410361
ret 8

Function at 0x413220
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x596af5
call fcn.004103bb
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x8c]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x41324b
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x413329
xor esi, esi
mov dword [ebp - 0x814], 7
push esi
xor eax, eax
mov dword [ebp - 0x818], esi
push 0x59a528
lea ecx, [ebp - 0x828]
mov word [ebp - 0x828], ax
call fcn.00401c7b
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.00430680
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x59c6e0
push eax
call fcn.0040351f
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 5], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x4132de
call fcn.0041313c
jmp 0x4132e3
call fcn.004131f6
push eax
lea ecx, [ebp - 0x828]
call fcn.004038c3
push esi
push 1
lea ecx, [ebp - 0x840]
call fcn.00401b31
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.0043fdb4
pop ecx
push 0
push 1
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.00401b31
mov eax, esi
call fcn.00410376
ret 0xc