joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433a39
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x433ad6
push ebx
push esi
call fcn.00433a02
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00433996
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x433a83
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x433ad5
push edi
push eax
call fcn.0042eddc
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x433aa3
call fcn.0042eda2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x433ad4
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00433996
add esp, 0x20
test eax, eax
jne 0x433ac2
push edi
call fcn.0042eda2
jmp 0x433aca
push ebx
call fcn.0042eda2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x433ad9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x433aea
pop esi
ret
push ebx
push edi
push esi
call fcn.00433a02
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0042eddc
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x433b12
push ebx
push esi
push edi
call fcn.00421330
add esp, 0xc
push 0
call fcn.0042eda2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x43426c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00433d87
Function at 0x43b9e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43ba0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43ba0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404140
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488260
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4c4074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4c60a4]
cmp eax, dword [ecx + 4]
jle 0x4041eb
push 0x4c60a4
call fcn.0046e5c6
add esp, 4
cmp dword [0x4c60a4], 0xffffffff
jne 0x4041eb
mov dword [ebp - 4], 0
xor eax, eax
mov dword [0x4c60b8], 0
mov dword [0x4c60bc], 0
mov dword [0x4c60b8], 0
mov dword [0x4c60bc], 7
mov word [0x4c60a8], ax
mov byte [ebp - 4], al
push 0x498f00
call fcn.0046e922
mov dword [ebp - 4], 0xffffffff
push 0x4c60a4
call fcn.0046e57c
add esp, 8
mov ebx, dword [ebp + 8]
mov esi, ebx
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
mov dword [ebp + 8], eax
jb 0x4041fe
mov esi, dword [ebx]
lea edi, [eax + eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x404221
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x404210
and edx, dword [0x4c60f8]
mov eax, dword [0x4c60ec]
mov ecx, dword [eax + edx*8]
lea edx, [edx*8 + 4]
add edx, eax
mov dword [ebp - 0x10], ecx
mov esi, ecx
mov dword [ebp - 0x14], edx
mov eax, dword [0x4c60e4]
cmp ecx, eax
je 0x40424d
mov eax, dword [edx]
mov eax, dword [eax]
cmp esi, eax
je 0x4042c8
cmp dword [ebx + 0x14], 8
lea edi, [esi + 8]
mov edx, ebx
jb 0x40425e
mov edx, dword [ebx]
cmp dword [edi + 0x14], 8
mov ecx, edi
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x18], eax
jb 0x40426e
mov ecx, dword [edi]
cmp eax, dword [ebp + 8]
jne 0x404280
push eax
call fcn.00403700
add esp, 4
test eax, eax
je 0x40428a
mov esi, dword [esi]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
jmp 0x404240
cmp dword [edi + 0x14], 8
jb 0x404292
mov edi, dword [edi]
cmp dword [ebx + 0x14], 8
jb 0x40429a
mov ebx, dword [ebx]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x18]
jne 0x4042ba
push eax
mov edx, edi
mov ecx, ebx
call fcn.00403700
add esp, 4
test eax, eax
jne 0x4042ba
mov eax, dword [0x4c60e4]
jmp 0x4042c1
mov eax, dword [0x4c60e4]
mov esi, eax
cmp esi, eax
lea eax, [esi + 0x20]
jne 0x4042cd
mov eax, 0x4c60a8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404540
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x224]
sub esp, 0x224
push 0xffffffffffffffff
push 0x4883b1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4c4074]
xor eax, ebp
mov dword [ebp + 0x220], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4c60c0]
cmp eax, dword [ecx + 4]
jle 0x404607
push 0x4c60c0
call fcn.0046e5c6
add esp, 4
cmp dword [0x4c60c0], 0xffffffff
jne 0x404607
mov dword [ebp - 4], 1
xor eax, eax
mov dword [0x4c60d4], 0
mov dword [0x4c60d8], 0
mov dword [0x4c60d4], 0
mov dword [0x4c60d8], 7
mov word [0x4c60c4], ax
mov byte [ebp - 4], 1
push 0x498fa0
call fcn.0046e922
mov byte [ebp - 4], 0
push 0x4c60c0
call fcn.0046e57c
add esp, 8
cmp dword [0x4c60d4], 0
jne 0x4046f4
lea eax, [ebp + 0x18]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4046f4
add eax, eax
cmp eax, 0x208
jae 0x404731
xor ecx, ecx
mov dword [ebp + 0x10], ecx
mov word [ebp + eax + 0x18], cx
xor eax, eax
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x10], ecx
lea ecx, [ebp + 0x18]
mov dword [ebp + 0x14], 7
lea edx, [ecx + 2]
mov word [ebp], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404660
sub ecx, edx
lea eax, [ebp + 0x18]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp]
call fcn.00403850
mov dword [ebp - 4], 4
lea eax, [ebp]
cmp dword [ebp + 0x14], 8
mov ecx, 0x4c60c4
push dword [ebp + 0x10]
cmovae eax, dword [ebp]
push eax
call fcn.00403850
mov ecx, 0x4c60c4
call fcn.00405150
mov byte [ebp - 4], 0
mov edx, dword [ebp + 0x14]
cmp edx, 8
jb 0x4046e0
mov ecx, dword [ebp]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4046d6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404736
push edx
push ecx
call fcn.0046e3c2
add esp, 8
xor eax, eax
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x14], 7
mov word [ebp], ax
push 0x4c60c4
mov ecx, esi
call fcn.00402990
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x220]
xor ecx, ebp
call fcn.0046e38e
lea esp, [ebp + 0x224]
pop ebp
ret
call fcn.0046ea58
call fcn.004736d9
int3
Function at 0x404740
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x23c]
sub esp, 0x23c
push 0xffffffffffffffff
push 0x48849b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4c4074]
xor eax, ebp
mov dword [ebp + 0x238], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp]
mov dword [ebp - 0x10], 0
call fcn.00404540
mov dword [ebp - 4], 5
lea ecx, [ebp + 0x18]
push eax
mov dword [ebp - 0x10], 4
call fcn.00402990
mov dword [ebp - 4], 9
mov eax, 4
mov dword [ebp - 0x10], eax
and eax, 0xfffffffb
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 9
mov edx, dword [ebp + 0x14]
cmp edx, 8
jb 0x4047fb
mov ecx, dword [ebp]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4047f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404921
push edx
push ecx
call fcn.0046e3c2
add esp, 8
xor eax, eax
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x14], 7
mov word [ebp], ax
mov byte [ebp - 4], 0x10
lea ecx, [ebp + 0x30]
cmp dword [ebp + 0x2c], 8
lea eax, [ebp + 0x18]
push ecx
cmovae eax, dword [ebp + 0x18]
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
sub esp, 0x18
lea ecx, [ebp + 0x30]
mov edx, esp
mov dword [ebp - 0x14], esp
xor eax, eax
lea edi, [ecx + 2]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404863
sub ecx, edi
lea eax, [ebp + 0x30]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.00403850
mov dword [ebp - 4], 0x11
mov byte [ebp - 4], 0x10
mov ecx, esi
call fcn.00420160
mov eax, 0x10
mov dword [ebp - 0x10], eax
and eax, 0xffffffef
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x10], 8
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0x2c]
cmp edx, 8
jb 0x4048e9
mov ecx, dword [ebp + 0x18]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4048df
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404926
push edx
push ecx
call fcn.0046e3c2
add esp, 8
xor eax, eax
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 7
mov word [ebp + 0x18], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x238]
xor ecx, ebp
call fcn.0046e38e
lea esp, [ebp + 0x23c]
pop ebp
ret
call fcn.004736d9
call fcn.004736d9
int3
Function at 0x404bd0
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xffffffffffffffff
push 0x4885e9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4c4074]
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp + 0x41c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0
cmp dword [edx + 0x14], 8
jb 0x404c26
mov edx, dword [edx]
lea ecx, [ebp]
push ecx
push 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [ebp + 0x420]
test edi, edi
je 0x404d02
xor eax, eax
lea ecx, [ebp + 0x208]
mov word [ebp + 0x208], ax
mov ax, word [ebp]
test ax, ax
je 0x404c73
lea edx, [ebp]
movzx eax, ax
mov ebx, ecx
sub edx, ebx
mov word [ecx], ax
add ecx, 2
movzx eax, word [edx + ecx]
test ax, ax
jne 0x404c64
xor eax, eax
cmp word [edi], 0x2e
mov word [ecx], ax
je 0x404c8e
mov eax, 0x2e
mov word [ecx], ax
add ecx, 2
xor eax, eax
mov word [ecx], ax
push ecx
mov edx, edi
call fcn.00420ae0
add esp, 4
lea eax, [ebp + 0x208]
push eax
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
sub esp, 0x18
lea ecx, [ebp + 0x208]
mov edx, esp
mov dword [ebp - 0x14], esp
xor eax, eax
lea edi, [ecx + 2]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404cd0
sub ecx, edi
lea eax, [ebp + 0x208]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.00403850
mov dword [ebp - 4], 1
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00420160
jmp 0x404d50
sub esp, 0x18
lea ecx, [ebp]
mov edx, esp
mov dword [ebp - 0x14], esp
xor eax, eax
lea edi, [ecx + 2]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404d23
sub ecx, edi
lea eax, [ebp]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.00403850
mov dword [ebp - 4], 2
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00420160
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0046e38e
lea esp, [ebp + 0x414]
pop ebp
ret

Function at 0x405320
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
push ebx
push esi
push edi
cmp dword [edx + 0x14], 8
mov ebx, ecx
mov edi, dword [edx + 0x10]
jb 0x405334
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add edi, edi
je 0x405351
nop
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x405340
mov eax, dword [ebx + 0x18]
pop edi
and eax, esi
pop esi
pop ebx
ret 4
Function at 0x405a90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov ebp, ecx
cmp dword [edi + 0x1c], 8
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x405aa9
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x405ac5
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x405ab4
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x405afb
cmp eax, edi
jne 0x405af3
mov eax, dword [ebp + 4]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 4]
mov dword [edx + ecx + 4], eax
jmp 0x405b03
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x405b03
cmp eax, edi
jne 0x405b03
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebp + 8]
call fcn.00404330
push 0x38
push edi
call fcn.0046e3c2
mov eax, dword [esp + 0x1c]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x405dc0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x210]
sub esp, 0x210
push 0xffffffffffffffff
push 0x488838
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4c4074]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0x4a8ad0
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
lea eax, [ebp]
push 0x105
push eax
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x405ea7
cmp eax, 0x105
jae 0x405ea7
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00407430
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
push 1
push 0x4a8ad8
call fcn.004023a0
push 0xc
push str.Kernel32.dll
lea ecx, [ebp - 0x10]
call fcn.004023a0
mov edi, dword [ebp - 0x10]
push 0x5c
push edi
call fcn.0046f9b8
add esp, 8
test eax, eax
jne 0x405e79
xor edi, edi
jmp 0x405e86
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x405ea9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x405ea9
xor edi, edi
mov eax, dword [esi + 4]
cmp edi, eax
je 0x405ebc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [esi + 4], edi
mov eax, edi
test eax, eax
jne 0x405ec9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.0046e38e
lea esp, [ebp + 0x210]
pop ebp
ret 8
Function at 0x4070a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488010
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4c4074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4070e9
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4070d5
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x407122
nop dword [eax]
cmp esi, edx
jae 0x4070d5
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x407110
cmp esi, edx
jae 0x4070d5
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407780
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
mov ebx, ecx
push ebp
push edi
mov eax, dword [ebx + 4]
test eax, eax
je 0x4077f7
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
mov ebp, dword [esp + 0x14]
push edi
push 0
push ecx
push 0
push dword [ebp]
mov dword [esp + 0x20], 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4077f7
cmp dword [edi], eax
je 0x4077f7
push esi
mov esi, dword [esp + 0x1c]
push dword [esi]
call fcn.0046eb32
mov dword [esi], 0
push dword [edi]
call fcn.0046e3d0
add esp, 8
mov dword [esi], eax
push edi
push eax
push 0
push 0
push dword [ebp]
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
pop esi
test eax, eax
jne 0x4077f7
pop edi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0xc
Function at 0x407800
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488c38
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4c4074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
jne 0x407845
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
push dword [ebx]
mov dword [ebp - 0x10], 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40782f
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40782f
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046e3d0
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push esi
push 0
push 0
push dword [ebx]
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4078ae
xor bl, bl
jmp 0x4078db
test esi, esi
jne 0x4078b6
xor eax, eax
jmp 0x4078cf
mov eax, esi
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4078c0
sub eax, edx
sar eax, 1
mov ecx, dword [ebp + 0xc]
push eax
push esi
call fcn.00407350
mov bl, 1
mov dword [ebp - 4], 0xffffffff
push esi
call fcn.0046eb32
add esp, 4
mov dword [ebp + 8], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x407910
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x8004]
mov eax, 0x8004
call fcn.0046f5e0
push 0xffffffffffffffff
push 0x488c78
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4c4074]
xor eax, ebp
mov dword [ebp + 0x8000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
cmp dword [esi + 4], 0
mov eax, dword [ebp + 0x800c]
mov dword [ebp - 0x1c], eax
jne 0x407968
xor al, al
jmp 0x4079f6
mov ecx, eax
call fcn.00407e70
xor edi, edi
push 0
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x10], 0x3fff
push eax
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
push edi
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test ebx, ebx
jne 0x4079e8
mov esi, dword [ebp - 0x10]
call fcn.00403d50
push eax
push esi
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.00408450
mov dword [ebp - 4], 1
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
push eax
call fcn.00407f10
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4079e5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x18]
inc edi
test ebx, ebx
je 0x407971
cmp ebx, 0x103
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8000]
xor ecx, ebp
call fcn.0046e38e
lea esp, [ebp + 0x8004]
pop ebp
ret 4
Function at 0x407a20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x8004]
mov eax, 0x8004
call fcn.0046f5e0
push 0xffffffffffffffff
push 0x488cd0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4c4074]
xor eax, ebp
mov dword [ebp + 0x8000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
cmp dword [ebx + 4], 0
mov eax, dword [ebp + 0x800c]
mov dword [ebp - 0x30], eax
je 0x407bb7
mov ecx, eax
call fcn.00407cb0
xor edi, edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], 0x3fff
push eax
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0
push eax
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
push edi
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test ebx, ebx
jne 0x407b90
mov dword [ebp - 0x10], 0x3fff
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.00408010
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
mov eax, dword [ebp - 0x2c]
push edi
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp dword [ebp - 0x20], 1
mov ebx, eax
jne 0x407ba0
test ebx, ebx
jne 0x407b79
mov edi, dword [ebp - 0x10]
call fcn.00403d50
push eax
push edi
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x28]
call fcn.00408450
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
push esi
call fcn.00407430
mov byte [ebp - 4], 3
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00407d90
mov byte [ebp - 4], 2
or eax, 0xffffffff
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407b57
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407b76
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
push esi
call fcn.0046eb32
add esp, 4
mov dword [ebp - 0x14], 0
inc edi
mov dword [ebp - 0x1c], edi
test ebx, ebx
jne 0x407bbb
mov ebx, dword [ebp - 0x2c]
jmp 0x407a81
mov dword [ebp - 4], 0xffffffff
push esi
call fcn.0046eb32
add esp, 4
mov dword [ebp - 0x14], 0
xor al, al
jmp 0x407bc4
cmp ebx, 0x103
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8000]
xor ecx, ebp
call fcn.0046e38e
lea esp, [ebp + 0x8004]
pop ebp
ret 4