joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
neg eax
bswap edi
rol edi, 0x12
sbb edx, 0xde
sub esi, 0xf6
dec edx
rol edx, 0xa
ror eax, 0xff
and esi, 0xa2
add eax, 0xea
imul edi
rcr edx, 0xc0
imul edi
not esi
imul ebx
mov edi, 0x9d
ror edx, 0xe
rcr edx, 0x83
not ebx
mov esi, 0x27
rol edi, 0x76
bswap esi
imul edi
or edi, 0x78
sub eax, 0x55
mov esi, 0xf6
imul ebx
mov ebx, 0x64
sbb eax, 0xf0
mov esi, 0x8c
mov esi, 0x40
rcl edx, 0x81
and edx, 0xda
rol ebx, 0xdc
add ebx, 0xb8
dec edi
mov ebx, 0x7a
or ebx, 0xe
add ebx, 1
bswap edx
dec edi
rcl esi, 0x24
sub esi, 0x1f
sub esi, 0x7a
sbb ebx, 0x19
dec ebx
rol eax, 0xa8
and edi, 6
bswap edi
bswap ebx
xor ecx, ecx
xor edi, edi
mov edx, 0x3c
not edx
sbb edx, 0x78
sbb eax, 0xba
rol esi, 0x13
bswap ebx
rol esi, 0x39
ror esi, 0x1d
not eax
imul esi
neg edx
and ebx, 0xa5
sub edi, 0x24
sub edi, 0x64
bswap edi
bswap eax
inc esi
inc edi
or edi, 0xb8
not esi
neg esi
not eax
add esi, 0x81
mov esi, 0x7f
imul edx
dec ebx
not eax
mov ebx, 0xa4
inc ebx
dec ebx
not edi
and esi, 0xa4
rcl esi, 0x2d
add ebx, 0x4b
mov eax, 0xee
ror edi, 0xb3
bswap esi
or ebx, 0xf8
neg eax
rcl esi, 0xa
dec edx
neg edx
not eax
bswap eax
sbb eax, 0x82
ror esi, 0xf8
imul esi
rcl edi, 0x63
sbb eax, 0xc9
and ebx, 0xc3
mov ecx, dword [ebp + 0xc]
add edx, 0xe8
mov edi, 0xb
add eax, 0x4a
mov edi, 0x18
dec edi
sub eax, 0
rcl eax, 0xa
bswap esi
imul edx
inc edi
inc ebx
or ebx, 0xb3
rcr eax, 0x5a
bswap edi
imul eax
inc ebx
not ebx
or edx, 0x6e
sub edx, 0x42
rcr edx, 0xc1
not edx
imul ebx
imul edi
rol edx, 0xd1
and edi, 0
inc eax
bswap ebx
dec edi
dec ebx
sbb edi, 0x5a
not eax
imul eax
and eax, 0x2c
rol ebx, 0x6d
mov edi, 0x3e
dec eax
not eax
dec esi
bswap ebx
rcl ebx, 0xf3
imul eax
rcr ebx, 0x1a
inc edi
mov esi, 0x78
add esi, 0xf4
bswap eax
imul ebx
not ebx
rcl esi, 0x90
and esi, 2
mov edi, dword [ebp + 8]
xor eax, ebx
mov esi, esi
xor ebx, esi
not byte [edi]
xor esi, ebx
xor esi, esi
mov eax, eax
xor ebx, ebx
mov eax, esi
mov esi, eax
mov esi, ebx
mov eax, esi
xor ebx, esi
add byte [edi], 0x75
xor ebx, ebx
xor ebx, esi
mov esi, eax
xor ebx, ebx
xor eax, ebx
mov esi, eax
mov esi, esi
mov eax, ebx
xor ebx, ebx
sub byte [edi], 0x25
xor esi, eax
mov esi, eax
mov esi, eax
xor esi, ebx
mov eax, ebx
xor esi, esi
mov esi, eax
mov esi, ebx
mov esi, esi
imul byte [edi]
inc edi
loop 0x4013f1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4064bd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4453b8]
jne 0x4064c7
repz ret
jmp fcn.0040872c
Function at 0x4080ec
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040653e
and dword [ebp - 4], 0
cmp dword [0x4462e4], 0
mov ebx, eax
jne 0x40819d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40824e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40824e
push eax
call fcn.004064cc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4462e4], eax
call esi
push eax
call fcn.004064cc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4462e8], eax
call esi
push eax
call fcn.004064cc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4462ec], eax
call esi
push eax
call fcn.004064cc
pop ecx
mov dword [0x4462f4], eax
test eax, eax
je 0x40819d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004064cc
pop ecx
mov dword [0x4462f0], eax
mov eax, dword [0x4462f0]
cmp eax, ebx
je 0x4081f5
cmp dword [0x4462f4], ebx
je 0x4081f5
push eax
call fcn.00406547
push dword [0x4462f4]
mov esi, eax
call fcn.00406547
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4081f5
test edi, edi
je 0x4081f5
call esi
test eax, eax
je 0x4081ec
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4081ec
test byte [ebp - 0xc], 1
jne 0x4081f5
or dword [ebp + 0x10], 0x200000
jmp 0x40822e
mov eax, dword [0x4462e8]
cmp eax, ebx
je 0x40822e
push eax
call fcn.00406547
pop ecx
test eax, eax
je 0x40822e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40822e
mov eax, dword [0x4462ec]
cmp eax, ebx
je 0x40822e
push eax
call fcn.00406547
pop ecx
test eax, eax
je 0x40822e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4462e4]
call fcn.00406547
pop ecx
test eax, eax
je 0x40824e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408250
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4017d0
Capabilities:
Create service
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
push edi
push 0xf003f
mov ebx, ecx
push 0
push 0
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
mov dword [esp + 0x14], esi
jne 0x401804
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret
lea eax, [esp + 0x20]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x30]
push 0
push ecx
push 1
push 2
add ebx, 4
push 0x10
push 0xf01ff
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebp, eax
test ebp, ebp
jne 0x401856
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x214
ret
mov edi, str.SYSTEMCurrentControlSetServicesEventLogApplication_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x124]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], 0
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x124]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x128]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x4018ee
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x214
ret
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push 2
push 0
push str.EventMessageFile
push ecx
call esi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push 0
push str.TypesSupported
push eax
mov dword [esp + 0x30], 7
call esi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
push 0
push 0
push ebx
push 0x64
push 4
call fcn.00401b40
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x214
ret
Function at 0x401980
Capabilities:
Delete service

Disassembly:
push ecx
push ebp
push edi
push 0xf003f
push 0
mov edi, ecx
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
jne 0x40199e
pop edi
pop ebp
pop ecx
ret
push ebx
push esi
lea esi, [edi + 4]
push 0x10000
push esi
push ebp
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
je 0x4019f5
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0
push 0
test eax, eax
push esi
je 0x4019e3
push 0x65
push 4
mov ecx, edi
call fcn.00401b40
mov dword [esp + 0x10], 1
jmp 0x4019ee
push 0x66
push 1
mov ecx, edi
call fcn.00401b40
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [edi + 0x174]
mov edi, 0x20
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x401a1d
push eax
call ebx
mov dword [esi], 0xffffffff
add esi, 4
dec edi
jne 0x401a0d
mov eax, dword [esp + 0x10]
pop esi
pop ebx
pop edi
pop ebp
pop ecx
ret

Function at 0x401a30
Capabilities:
Pause service

Disassembly:
sub esp, 0x20
push ebx
push edi
push 0xf003f
push 0
mov edi, ecx
push 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x401a5a
pop edi
pop ebx
add esp, 0x20
ret
push ebp
push esi
lea esi, [edi + 4]
push 0x10000
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, eax
test ebp, ebp
je 0x401aa3
lea eax, [esp + 0x14]
push eax
push 2
push ebp
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x401a9c
push 0
push 0
push esi
push 0x6c
push 4
mov ecx, edi
call fcn.00401b40
mov dword [esp + 0x10], 1
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x20
ret

Function at 0x401b40
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x20]
push edi
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
xor edi, edi
lea eax, [esp + 8]
mov ecx, 3
cmp dword [eax], 0
je 0x401b70
inc edi
add eax, 4
dec ecx
jne 0x401b6a
mov eax, dword [esi + 0x1f4]
test eax, eax
jne 0x401b92
lea eax, [esi + 4]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [esi + 0x1f4], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x401bbb
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 8]
push 0
push ecx
mov ecx, dword [esp + 0x20]
push 0
push edi
push 0
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
pop edi
pop esi
add esp, 0xc
ret 0x14
Function at 0x401ce0
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, ecx
push str._nEntering_CNTService::Initialize__
call edi
push 2
mov ecx, esi
call fcn.00401cc0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
mov dword [esi + 0x5c], eax
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
jne 0x401d3c
push ebx
push ebx
push ebx
push 0x68
push 1
mov ecx, esi
call fcn.00401b40
push 1
mov ecx, esi
call fcn.00401cc0
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov ecx, esi
call fcn.00401e50
push 0
push 0
push 0
push 0x69
push 4
mov ecx, esi
call fcn.00401b40
push 4
mov ecx, esi
call fcn.00401cc0
push str._nLeaving_CNTService::Initialize__
call edi
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x401e50
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, ecx
push str._nEntering_CNTService::OnInitFileSpy__
call edi
mov eax, dword [esi + 0x170]
cmp eax, 0xffffffff
je 0x401e73
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push str..NtFsLdf20
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x170], eax
jne 0x401ea2
push str._nm_hSysHandle__INVALID_HANDLE_VALUE
jmp 0x401ea7
push str._nm_hSysHandle_is_valid
call edi
push 1
mov ecx, esi
call fcn.00402890
mov ecx, esi
call fcn.00402e40
mov ecx, esi
call fcn.00402ac0
mov ecx, esi
call fcn.00402b00
mov ecx, esi
call fcn.00402680
mov ecx, esi
call fcn.00402090
mov ecx, esi
call fcn.004028e0
mov ecx, esi
call fcn.00402b40
mov ecx, esi
call fcn.00402e80
mov ecx, esi
call fcn.00403180
mov ecx, esi
call fcn.00403060
mov ecx, esi
call fcn.00402d20
push 0
mov ecx, esi
call fcn.00402890
push str._nExit_CNTService::OnInitFileSpy__
call edi
pop edi
mov eax, 1
pop esi
ret
Function at 0x4023c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x50
push esi
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0xc], 0
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.SOFTWAREFinalDataOptions
push 0x80000002
call esi
test eax, eax
je 0x402444
lea ecx, [esp + 8]
push ecx
push str.SOFTWAREFinalDataOptions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.SOFTWAREFinalDataOptions
push 0x80000002
call esi
test eax, eax
jne 0x402513
mov ecx, dword [esp + 0x5c]
lea eax, [ecx - 1]
cmp eax, 8
ja case.default.0x402454
jmp dword [eax*4 + 0x402520]
lea edx, [esp + 0x18]
push 0x40a614
push edx
jmp 0x4024bb
lea eax, [esp + 0x18]
push 0x40a610
push eax
jmp 0x4024bb
push 0x40a60c
jmp 0x4024b6
lea edx, [esp + 0x18]
push 0x40a608
push edx
jmp 0x4024bb
lea eax, [esp + 0x18]
push 0x40a604
push eax
jmp 0x4024bb
push 0x40a600
jmp 0x4024b6
lea edx, [esp + 0x18]
push 0x40a5fc
push edx
jmp 0x4024bb
lea eax, [esp + 0x18]
push 0x40a5f8
push eax
jmp 0x4024bb
push str.DataPath
lea ecx, [esp + 0x1c]
push ecx
call fcn.004038a0
mov eax, 4
add esp, 8
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x50
ret 4
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x50
ret 4

Function at 0x402550
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0xf003f
push 0
push str.SOFTWAREFinalDataOptions
push 0x80000002
call esi
test eax, eax
je 0x4025bb
lea ecx, [esp + 4]
push ecx
push str.SOFTWAREFinalDataOptions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREFinalDataOptions
push 0x80000002
call esi
test eax, eax
je 0x4025bb
xor eax, eax
pop esi
add esp, 0xc
ret 4
mov esi, dword [esp + 0x14]
push esi
call fcn.004083f0
mov eax, dword [esp + 8]
add esp, 4
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push esi
push edx
push 0
push str.NTUserExclude
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0xc
ret 4
Function at 0x402610
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push ebx
push edi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x40266f
push ebp
push esi
push 0xf0015
push str.NtFsLdf20
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x402662
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ecx, dword [esp + 0x14]
push esi
cmp ecx, 4
sete bl
call ebp
push edi
call ebp
pop esi
pop ebp
mov eax, ebx
pop edi
pop ebx
add esp, 0x1c
ret
mov eax, ebx
pop edi
pop ebx
add esp, 0x1c
ret

Function at 0x402680
Capabilities:
Get disk information

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
xor ebx, ebx
mov dword [esp + 0x10], ebp
mov esi, 1
mov ecx, ebx
shl esi, cl
test ebp, esi
je case.default.0x4026ca
lea eax, [ebx + 0x41]
lea ecx, [esp + 0x18]
push eax
push str._c:_
push ecx
call fcn.004038a0
add esp, 0xc
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 6
ja case.default.0x4026ca
jmp dword [eax*4 + 0x402710]
mov eax, dword [esp + 0x10]
not esi
and eax, esi
mov dword [esp + 0x10], eax
jmp case.default.0x4026ca
mov al, bl
mov ecx, edi
add al, 0x41
push eax
mov byte [esp + 0x18], al
call fcn.004027e0
mov eax, dword [esp + 0x14]
mov ecx, edi
push eax
call fcn.00402730
inc ebx
cmp ebx, 0x20
jb 0x402697
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret

Function at 0x402730
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x100
push ebx
push ebp
movsx ebp, byte [esp + 0x10c]
push esi
mov ebx, ecx
lea esi, [ebp - 0x41]
test esi, esi
jl 0x4027d1
cmp esi, 0x20
jge 0x4027d1
mov eax, dword [ebx + esi*4 + 0x174]
cmp eax, 0xffffffff
je 0x402766
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push ebp
lea eax, [esp + 0x14]
push str._c:Drive_InformationwkNtFsLdf.dat
push eax
call fcn.004038a0
add esp, 0xc
lea ecx, [esp + 0x10]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx + esi*4 + 0x174], eax
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x40a63c
call esi
lea edx, [esp + 0x10]
push edx
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x100
ret 4
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x100
ret 4
Function at 0x4028e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1c58
call fcn.00403910
mov edx, ecx
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0xc5d]
mov byte [esp + 0xc5c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [edx + 0x170]
mov dword [esp + 0xc], edx
cmp eax, 0xffffffff
jne 0x402936
xor eax, eax
pop edi
add esp, 0x1c58
ret
mov ecx, edx
call fcn.00402610
test eax, eax
jne 0x402949
pop edi
add esp, 0x1c58
ret
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREFinalDataOptions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402973
xor eax, eax
pop edi
add esp, 0x1c58
ret
lea ecx, [esp + 0x1c]
push str.ProtectPaths
push ecx
call fcn.004038a0
add esp, 8
lea edx, [esp + 0x10]
lea eax, [esp + 0xc5c]
lea ecx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x28]
push 0
push edx
push eax
mov dword [esp + 0x2c], 3
mov dword [esp + 0x28], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4029d2
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
add esp, 0x1c58
ret
mov edx, dword [esp + 4]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc60]
mov ebp, 4
test eax, eax
jbe 0x402aa4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
mov dword [esp + 0x14], eax
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x68]
add ebp, 4
rep stosd dword es:[edi], eax
mov eax, dword [esp + ebp + 0xc64]
lea esi, [esp + ebp + 0xc68]
mov ecx, eax
lea edi, [esp + 0x68]
mov edx, ecx
add ebp, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor eax, eax
and ecx, 3
push 0x400
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x200
lea edi, [esp + 0x46c]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x6c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x46c]
dec ecx
push eax
push ecx
lea ecx, [esp + 0x74]
push ecx
push 0
push 0
call ebx
lea edx, [esp + 0x24]
push 0
push edx
mov edx, dword [esp + 0x20]
push 0
add eax, eax
push 0
lea ecx, [esp + 0x478]
push eax
mov eax, dword [edx + 0x170]
push ecx
push 0x12350030
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x14], eax
jne 0x4029fe
pop esi
pop ebx
pop ebp
mov eax, 1
pop edi
add esp, 0x1c58
ret
Function at 0x402b40
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1c58
call fcn.00403910
mov edx, ecx
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0xc5d]
mov byte [esp + 0xc5c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [edx + 0x170]
mov dword [esp + 0xc], edx
cmp eax, 0xffffffff
jne 0x402b96
xor eax, eax
pop edi
add esp, 0x1c58
ret
mov ecx, edx
call fcn.00402610
test eax, eax
jne 0x402ba9
pop edi
add esp, 0x1c58
ret
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREFinalDataOptions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402bd3
xor eax, eax
pop edi
add esp, 0x1c58
ret
lea ecx, [esp + 0x1c]
push str.DeleteProtectPaths
push ecx
call fcn.004038a0
add esp, 8
lea edx, [esp + 0x10]
lea eax, [esp + 0xc5c]
lea ecx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x28]
push 0
push edx
push eax
mov dword [esp + 0x2c], 3
mov dword [esp + 0x28], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402c32
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
add esp, 0x1c58
ret
mov edx, dword [esp + 4]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc60]
mov ebp, 4
test eax, eax
jbe 0x402d04
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
mov dword [esp + 0x14], eax
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x68]
add ebp, 4
rep stosd dword es:[edi], eax
mov eax, dword [esp + ebp + 0xc64]
lea esi, [esp + ebp + 0xc68]
mov ecx, eax
lea edi, [esp + 0x68]
mov edx, ecx
add ebp, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor eax, eax
and ecx, 3
push 0x400
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x200
lea edi, [esp + 0x46c]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x6c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x46c]
dec ecx
push eax
push ecx
lea ecx, [esp + 0x74]
push ecx
push 0
push 0
call ebx
lea edx, [esp + 0x24]
push 0
push edx
mov edx, dword [esp + 0x20]
push 0
add eax, eax
push 0
lea ecx, [esp + 0x478]
push eax
mov eax, dword [edx + 0x170]
push ecx
push 0x12350038
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x14], eax
jne 0x402c5e
pop esi
pop ebx
pop ebp
mov eax, 1
pop edi
add esp, 0x1c58
ret