joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405afc
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.0040500c
test eax, eax
je 0x405b22
test ebx, ebx
je 0x405b22
cmp word [ebx], 0
je 0x405b22
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x405b2a
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x405b3d
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.00405d24
xor eax, eax
jmp 0x405b58
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x405b4c
cmp eax, 3
jne 0x405b53
mov eax, 2
jmp 0x405b58
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x405cd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.0040500c
test eax, eax
je 0x405cfb
test ebx, ebx
je 0x405cfb
cmp word [ebx], 0
je 0x405cfb
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x405d24
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.0040500c
test eax, eax
je 0x405d51
test ebx, ebx
je 0x405d51
cmp word [ebx], 0
je 0x405d51
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x405d60
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x405e60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, 0x40e180
push ebp
mov ebp, edx
cmp dword [edi + 4], 0
mov esi, ecx
mov ebx, eax
jne 0x405e7a
call fcn.00405e28
mov eax, ebp
jmp 0x405e92
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x405e9a
test al, 7
jne 0x405e7e
cmp esi, 8
jb 0x405f23
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x405ea3
xor edx, edx
jmp 0x405f3d
mov ecx, ebx
xor cl, byte [eax + edx]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [edi + ecx*4]
xor ecx, ebx
mov ebx, ecx
inc edx
cmp esi, edx
ja 0x405f27
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x406d84
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
add esp, 0xffffffe8
lea ecx, [esp + 0x10]
lea edx, [esp + 8]
mov eax, esp
call fcn.00406ce8
mov ebx, eax
mov eax, dword [0x41b220]
call fcn.004069bc
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
push 0x41b238
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
mov eax, dword [0x40f120]
mov eax, dword [eax + 0x10]
test al, 0x5f
je 0x406ddc
and eax, 0x7f
push eax
push 0x41b238
call sub.KERNEL32.DLL_SetFileAttributesA
cmp esi, 0xffffffff
jne 0x406dfb
push 0x41b238
mov eax, 0x6d
call fcn.00402874
push eax
call fcn.00402e2c
add esp, 8
jmp 0x406e33
test ebx, ebx
je 0x406e2d
test bl, 1
je 0x406e08
mov eax, esp
jmp 0x406e0a
xor eax, eax
test bl, 2
je 0x406e15
lea edx, [esp + 8]
jmp 0x406e17
xor edx, edx
test bl, 4
je 0x406e22
lea ecx, [esp + 0x10]
jmp 0x406e24
xor ecx, ecx
push eax
push edx
push ecx
push esi
call sub.KERNEL32.DLL_SetFileTime
push esi
call sub.KERNEL32.DLL_CloseHandle
add esp, 0x18
pop esi
pop ebx
ret
Function at 0x409428
Capabilities:
Set file attributes

Disassembly:
mov edx, 0x40c7a2
mov eax, 0x41b238
call fcn.0040695c
mov dword [0x41b220], eax
test eax, eax
jne 0x409491
push 0
push 0x41b238
call sub.KERNEL32.DLL_SetFileAttributesA
mov edx, 0x40c7a2
mov eax, 0x41b238
call fcn.0040695c
mov dword [0x41b220], eax
test eax, eax
jne 0x409491
mov eax, 0x40ccb4
mov edx, 9
call fcn.0040666c
push 0x41b238
mov eax, 0x6e
call fcn.00402874
push eax
call fcn.00402e2c
add esp, 8
mov eax, 1
ret
xor eax, eax
ret

Function at 0x40961c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
cmp dword [0x40eafc], 0
jg 0x40963a
dec dword [0x40eafc]
xor eax, eax
mov dword [0x41b134], eax
or eax, 0xffffffff
pop esi
pop ebx
ret
cmp dword [0x41b134], 0
jg 0x40968f
push dword [0x41b150]
mov ecx, 0x2000
mov edx, 1
mov eax, dword [0x41b12c]
call fcn.00406a08
mov dword [0x41b134], eax
test eax, eax
jne 0x409674
xor edx, edx
or eax, 0xffffffff
mov dword [0x41b134], edx
pop esi
pop ebx
ret
add dword [0x41b158], 0x2000
mov edx, dword [0x41b12c]
mov dword [0x41b130], edx
call fcn.004094e4
mov ecx, dword [0x40f120]
test byte [ecx + 0x14], 1
je 0x4096c6
mov esi, dword [0x41b134]
mov ebx, dword [0x41b130]
jmp 0x4096bd
call fcn.0040a87c
xor byte [ebx], al
mov al, byte [ebx]
and eax, 0xff
call fcn.0040a8a0
inc ebx
mov edx, esi
add esi, 0xffffffff
test edx, edx
jne 0x4096a9
dec dword [0x41b134]
mov ecx, dword [0x41b130]
inc dword [0x41b130]
xor eax, eax
mov al, byte [ecx]
pop esi
pop ebx
ret

Function at 0x409790
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x40979f
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x40a7c2
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, eax
mov eax, edx
call fcn.0040a90c
mov eax, esp
mov ecx, 0xc
mov edx, ebx
call fcn.00406a8c
xor ebx, ebx
call fcn.0040a87c
xor byte [esp + ebx], al
mov al, byte [esp + ebx]
and eax, 0xff
call fcn.0040a8a0
inc ebx
cmp ebx, 0xc
jl 0x40a7e0
mov edx, dword [0x40f120]
xor eax, eax
mov al, byte [esp + 0xb]
test byte [edx + 0x14], 2
je 0x40a819
movzx ecx, word [0x41b17e]
sar ecx, 8
jmp 0x40a825
mov ecx, dword [0x41b184]
shr ecx, 0x18
movzx ecx, cx
movzx eax, ax
cmp ecx, eax
je 0x40a831
or eax, 0xffffffff
jmp 0x40a874
mov edx, dword [0x41b134]
cmp edx, dword [0x40eafc]
jle 0x40a847
mov ebx, dword [0x40eafc]
jmp 0x40a84d
mov ebx, dword [0x41b134]
mov esi, dword [0x41b130]
jmp 0x40a869
call fcn.0040a87c
xor byte [esi], al
mov al, byte [esi]
and eax, 0xff
call fcn.0040a8a0
inc esi
mov edx, ebx
add ebx, 0xffffffff
test edx, edx
jne 0x40a855
xor eax, eax
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x40a8a0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [0x41b344]
push ebx
mov ecx, edx
mov ebx, dword [0x41b124]
xor ecx, eax
and ecx, 0xff
shr edx, 8
mov ecx, dword [ebx + ecx*4]
xor ecx, edx
mov dword [0x41b344], ecx
and ecx, 0xff
add dword [0x41b348], ecx
imul edx, dword [0x41b348], 0x8088405
inc edx
mov dword [0x41b348], edx
shr edx, 0x18
mov ecx, dword [0x41b34c]
xor edx, ecx
mov ebx, dword [0x41b124]
and edx, 0xff
shr ecx, 8
mov edx, dword [ebx + edx*4]
xor edx, ecx
mov dword [0x41b34c], edx
pop ebx
ret

Function at 0x40aae8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test esi, esi
jne 0x40aafc
xor eax, eax
jmp 0x40abf4
call fcn.0040aae0
xor ebx, 0xffffffff
cmp edi, 8
jb 0x40abd1
xor edx, edx
sub edi, 8
mov dl, byte [esi]
inc esi
xor edx, ebx
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
xor edx, edx
mov dl, byte [esi]
mov ebx, ecx
xor edx, ebx
inc esi
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
cmp edi, 8
mov ebx, ecx
jae 0x40ab0d
test edi, edi
je 0x40abef
xor edx, edx
mov dl, byte [esi]
inc esi
xor edx, ebx
and edx, 0xff
shr ebx, 8
mov ecx, dword [eax + edx*4]
xor ecx, ebx
dec edi
mov ebx, ecx
jne 0x40abd5
mov eax, ebx
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
Function at 0x4ca2a0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x4ca2a6
pop ebp
sub ebp, 0x45854c
lea edi, [ebp + 0x45a155]
mov esi, edi
mov ecx, 0x92
xor ebx, ebx
lodsb al, byte [esi]
xor al, 0x44
sub al, bl
rol al, 2
stosb byte es:[edi], al
inc ebx
loop 0x4ca2bc
mov eax, dword [esp + 0x20]
inc eax
js 0x4ca2d9
mov dword [ebp + 0x45a159], 1
inc ebp
add byte [ecx], al
add byte [eax], al
add byte [ebx + 0x45a159bd], al
add byte [eax], al
cmp dword [ebp + 0x45a159], 0
jne 0x4ca2e4
jmp 0x4ca2fa
push ebp
lea eax, [ebp + 0x4585c2]
push eax
mov eax, 0x30
push eax
call fcn.004ca389
pop ebp
jmp 0x4ca30e
push ebp
lea eax, [ebp + 0x4585c2]
push eax
mov eax, 0x30
push eax
call fcn.004ca616
pop ebp
mov ecx, 0x17a7
lea edi, [ebp + 0x4589ae]
mov esi, edi
lodsb al, byte [esi]
xchg ecx, eax
mov ah, 9
mov al, byte [0x1b2c5cc8]
test byte [eax + 0x64], ah
jg 0x4ca2d3
ret
Function at 0x4ca389
Capabilities:
Check for trap flag exception

Disassembly:
mov ebp, esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add ecx, dword [ebx + 0x33020875]
fild dword [esi]
mov edx, 0x8b030001
dec ebp
add al, 3
mov edi, dword [ebp + 0xc]
push es
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add cl, byte [edx + 0x7d8b0306]
or al, 6
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
push ebx
push ecx
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add dh, byte [ecx + 0x7d8b0300]
or al, 6
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add dh, byte [ebx]
fild dword [ebx]
mov bx, dx
add al, 0x66
and ebx, 1
add dl, dl
jecxz 0x4ca4d1
xor al, bl
add esp, dword [esi - 0x2f]
loop 0x4ca4d9
mov bx, dx
add eax, 0xe38166
add byte [edx], 0xb5
add byte [ebx], 0x8b
jge 0x4ca4f2
push es
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
add byte [eax], al
pop dword fs:[0]
add esp, 4
cmp bh, ch
jne 0x4ca556
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add eax, 0x3f28166
add byte [ebx], 0x8b
jge 0x4ca54a
push es
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
add byte [eax], al
pop dword fs:[0]
add esp, 4
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add bh, dh
rol dword [edx], 0xb5
or byte [ebx], al
mov edi, dword [ebp + 0xc]
push es
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
cmp cl, ch
jne 0x4ca48d
pop ecx
pop ebx
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a15d]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add cl, byte [eax + 0x1460106]
inc ebx
add ecx, dword [ebx - 0x72f9f383]
mov edi, 0x45a155
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
cmp ecx, ebx
jne 0x4ca3e9
mov esp, ebp
ret 8
Function at 0x4ca616
Capabilities:
Check for trap flag exception

Disassembly:
mov ebp, esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a1aa]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add ecx, dword [ebx + 0x33020875]
fild dword [esi]
mov edx, 0x8b030001
jge 0x4ca666
push es
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
add byte [eax], al
pop dword fs:[0]
add esp, 4
mov ecx, dword [ebp + 4]
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a1aa]
push edi
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0xc]
lea edi, [edi + 0x45a155]
mov dword [edi], 1
pushfd
or dword [esp], 0x100
popfd
xor edi, edi
add cl, byte [edx + 0x7d8b0306]
or al, 6
lea edi, [edi + 0x45a155]
push es
mov dword [edi], 0
pop dword fs:[0]
add esp, 4
push ebx
push ecx
mov cl, 0
xor ebx, ebx
mov bx, dx
and bx, 1
shl bl, cl
xor al, bl
shl dx, 1
mov bx, dx
and bx, 0x8000
mov ch, 0x80
cmp bh, ch
jne 0x4ca6ed
xor dx, 0x8003
inc cl
mov ch, 8
cmp cl, ch
jne 0x4ca6ca
pop ecx
pop ebx
mov byte [esi], al
inc esi
inc ebx
cmp ecx, ebx
jne 0x4ca675
mov esp, ebp
ret 8
Function at 0x401310
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
cmp word [eax], 0x5a4d
jne 0x40134f
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov ax, word [ecx]
cmp ax, 0x454e
je 0x401347
cmp ax, 0x454c
je 0x401347
mov eax, dword [ecx]
sub eax, 0x4550
neg eax
sbb eax, eax
and eax, 0x14fd
add eax, 0x4550
ret 4
and eax, 0xffff
ret 4
xor eax, eax
ret 4
Function at 0x401fb0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4230f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 4], ebx
mov cl, byte [esp + 0x24]
xor eax, eax
cmp cl, bl
lea ecx, [esp + 0x24]
setne al
push ecx
push 0x20019
add eax, 0x80000001
push ebx
push str.SOFTWAREPKPMMAINPATH
push eax
mov byte [esp + 0x28], 1
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40205c
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x2c]
push 0x104
mov ecx, edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 0x103
call fcn.0041bd16
lea edx, [esp + 0x14]
mov dword [esp + 0x30], ebx
push edx
push eax
lea eax, [esp + 0x38]
push eax
push ebx
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
push 0xffffffffffffffff
mov ecx, edi
je 0x402086
call fcn.0041bd65
mov ecx, edi
call fcn.0041b94b
jmp 0x40208b
mov ecx, dword [esp + 0x20]
call fcn.0041b94b
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.0041b9c0
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
call fcn.0041bd65
pop edi
cmp ebp, ebx
pop esi
je 0x402098
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.0041b9c0
mov ecx, dword [esp + 0x10]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4020e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x423110
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0xc], ebx
mov al, byte [esp + 0x2c]
mov byte [esp + 0x1c], 1
cmp al, bl
je 0x402149
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SoftwareClassesVirtualStoreMACHINESOFTWAREPKPMMAINPATH
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40213b
mov edi, dword [esp + 0x2c]
jmp 0x402170
mov ecx, dword [esp + 0x28]
call fcn.0041b94b
jmp 0x4021d4
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], ebx
push ecx
push 0x20019
push ebx
push str.SoftwareClassesVirtualStoreMACHINESOFTWAREWow6432NodePKPMMAINPATH
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40213b
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x28]
push 0x104
mov ecx, esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 0x103
call fcn.0041bd16
lea edx, [esp + 0x14]
mov dword [esp + 0x30], ebx
push edx
push eax
lea eax, [esp + 0x38]
push eax
push ebx
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ebp
cmp eax, ebx
push 0xffffffffffffffff
mov ecx, esi
je 0x4021c4
call fcn.0041bd65
mov ecx, esi
call fcn.0041b94b
cmp edi, ebx
je 0x4021d4
jmp 0x4021cd
call fcn.0041bd65
cmp edi, ebx
je 0x4021d4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0041b9c0
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x402200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x423140
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x10], ebx
mov cl, byte [esp + 0x34]
xor eax, eax
cmp cl, bl
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
setne al
lea ecx, [esp + 0x34]
add eax, 0x80000001
push ecx
push 0x20006
mov esi, eax
push ebx
push str.SOFTWAREPKPMMAINPATH
push esi
mov byte [esp + 0x38], 2
mov dword [esp + 0x48], ebx
call ebp
cmp eax, ebx
jne 0x402319
mov edi, dword [esp + 0x34]
mov dword [esp + 0x10], edi
mov esi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x34], ebx
lea edx, [esp + 0x18]
lea eax, [esp + 0x14]
push edx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x42f320
push edi
mov byte [esp + 0x48], 3
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x4022c2
lea ecx, [esp + 0x34]
call fcn.004023c0
mov ecx, dword [esp + 0x14]
cmp eax, ebx
mov dword [esp + 0x34], ecx
jne 0x4022c2
push esi
push ebp
lea ecx, [esp + 0x3c]
call fcn.004023e0
lea ecx, [esp + 0x34]
mov byte [esp + 0x24], 2
call fcn.004023c0
push 0xffffffffffffffff
lea ecx, [esp + 0x34]
call fcn.0041bd65
cmp edi, ebx
je 0x4022e6
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], bl
call fcn.0041b9c0
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], 0xffffffff
call fcn.0041b9c0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea edx, [esp + 0x14]
lea eax, [esp + 0x34]
push edx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SOFTWAREPKPMMAINPATH
push esi
mov dword [esp + 0x58], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x40237b
mov edi, dword [esp + 0x34]
lea ecx, [esp + 0x34]
push ecx
push 0x20006
push ebx
push str.SOFTWAREPKPMMAINPATH
push esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x48], ebx
call ebp
cmp eax, ebx
jne 0x40226a
cmp edi, ebx
je 0x402372
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x34]
jmp 0x402266
lea ecx, [esp + 0x30]
call fcn.0041b94b
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], bl
call fcn.0041b9c0
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], 0xffffffff
call fcn.0041b9c0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x4023e0
Capabilities:
Set registry value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esi]
inc eax
push eax
mov eax, dword [esp + 0x14]
push edi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 8
Function at 0x402430
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x4231ac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd0
lea eax, [esp + 0x3c]
push esi
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x44], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x402483
mov esi, dword [esp + 0xe4]
push 0x42f320
mov ecx, esi
call fcn.0041ba2e
jmp 0x40267a
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov eax, dword [0x42d5bc]
push edi
mov esi, edx
mov edi, ecx
mov dword [esp + 8], eax
mov dword [esp + 0xe0], 1
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
cmp edx, 5
mov byte [esp + 0xe0], 3
jne 0x4024dc
test ecx, ecx
jne 0x4024c4
push str.Windows_2000
jmp 0x40250e
cmp ecx, 1
jne 0x4024d0
push str.Windows_Xp
jmp 0x40250e
cmp ecx, 2
jne 0x402517
push str.Windows_xp64__Server2003__Server2003_R2
jmp 0x40250e
cmp edx, 6
jne 0x402517
test ecx, ecx
jne 0x4024ec
push str.Windows_Vista
jmp 0x40250e
cmp ecx, 1
jne 0x4024f8
push str.Windows_win7
jmp 0x40250e
cmp ecx, 2
jne 0x402504
push str.Windows_win8
jmp 0x40250e
cmp ecx, 3
jne 0x402517
push str.Windows_win8.1
lea ecx, [esp + 0xc]
call fcn.0041bb49
push edi
push esi
lea ecx, [esp + 0x1c]
push 0x42d2e8
push ecx
call fcn.004173bc
add esp, 0x10
push str.GetNativeSystemInfo
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [esp + 0x20]
push edx
call eax
mov ax, word [esp + 0x20]
pop edi
cmp ax, 9
je 0x402575
cmp ax, 6
je 0x402575
push str.32bit
lea ecx, [esp + 0x10]
call fcn.0041bb49
mov eax, dword [esp + 0xe8]
mov byte [eax], 1
jmp 0x40258d
push str.64bit
lea ecx, [esp + 0x10]
call fcn.0041bb49
mov ecx, dword [esp + 0xe8]
mov byte [ecx], 0
mov edx, dword [0x42d5bc]
mov dword [esp + 8], edx
lea eax, [esp + 0x10]
push 0x42d2b0
lea ecx, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0xe8], 4
call fcn.0041bbef
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0xe0], 5
call fcn.0041bcfe
lea ecx, [esp + 0x14]
mov byte [esp + 0xdc], 4
call fcn.0041b9c0
lea edx, [esp + 4]
push 0x42d2b0
lea eax, [esp + 0x18]
push edx
push eax
call fcn.0041bbef
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0xe0], 6
call fcn.0041bcfe
lea ecx, [esp + 0x14]
mov byte [esp + 0xdc], 4
call fcn.0041b9c0
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
call fcn.0041bcfe
mov esi, dword [esp + 0xe4]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.0041b735
lea ecx, [esp + 8]
mov dword [esp + 0x18], 1
mov byte [esp + 0xdc], 3
call fcn.0041b9c0
lea ecx, [esp + 0x10]
mov byte [esp + 0xdc], 2
call fcn.0041b9c0
lea ecx, [esp + 0xc]
mov byte [esp + 0xdc], 1
call fcn.0041b9c0
lea ecx, [esp + 4]
mov byte [esp + 0xdc], 0
call fcn.0041b9c0
mov ecx, dword [esp + 0xd4]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0xdc
ret