joyce8/EMBER2024-capa huggingface dataset:
Function at 0x73ed20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x73ed58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x73ed60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x73ed94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x73ed94
push eax
push esi
call fcn.0074120b
add esp, 8
pop esi
ret 0x10

Function at 0x73eda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x73ee22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x73ee15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x757320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00740dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x73edda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x73ee30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x73eec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x73eeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x757320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00740dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x73eeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x73ee6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x73f000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x73f131
push esi
call fcn.00742145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00731080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x73f131
push 0
push ebp
call fcn.007313a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00731260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x73f08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.007312f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x73f121
push 0x757918
push edi
call fcn.007403f0
push eax
push ebx
push esi
call fcn.0073ef60
push 0x7578f8
push edi
call fcn.007403f0
push eax
push ebx
push esi
call fcn.0073ef60
push 0x7578d8
push edi
call fcn.007403f0
push eax
push ebx
push esi
call fcn.0073ef60
push 0x7578c0
push edi
call fcn.007403f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0073ef60
push 0x7578a0
push edi
call fcn.007403f0
push eax
push ebx
push esi
call fcn.0073ef60
push 0x757888
push edi
call fcn.007403f0
push eax
push ebx
push esi
call fcn.0073ef60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x7401b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00740140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00740140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00740140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00740140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x740bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x740c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x75287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x740c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x740c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x40ed8d
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x40eae0
sub eax, 1
call fcn.0040edb3
xor dword [edi], edx
sub eax, esi
inc edi
and eax, eax
cmp edi, ecx
jne fcn.0040ed8d
sub esi, eax
and esi, eax
ret
Function at 0x4055bc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x40568a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
lea eax, [ebp - 0x9c]
push eax
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_OpenFile
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x40566c
lea eax, [ebp - 0x10]
mov edx, 0x186a0
call fcn.00403b84
push 0
lea eax, [ebp - 0x14]
push eax
push 0x186a0
lea eax, [ebp - 0x10]
call fcn.00403af4
mov edx, 1
dec edx
test eax, eax
je 0x405636
cmp edx, dword [eax - 4]
jb 0x40563b
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x40566c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 0x10]
mov eax, 0x4056a0
call fcn.00403b3c
test eax, eax
jle 0x40566c
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405691
lea eax, [ebp - 0x10]
call fcn.0040372c
lea eax, [ebp - 4]
call fcn.0040372c
ret

Function at 0x4056b8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405752
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp - 9]
xor al, 1
neg al
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
invalid
movsb byte es:[edi], byte [esi]
jecxz 0x4056fe
Function at 0x405b30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
xor edx, edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405c5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
call fcn.0040520c
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 4]
call fcn.004037c4
xor edx, edx
mov eax, 2
call fcn.00404cf0
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x134], 0x128
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 0xc]
call fcn.00404d10
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 6], al
jmp 0x405c27
invalid
Function at 0x406108
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceFrequency
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
adc edx, dword [ebp - 0xc]
jno 0x406133
call fcn.00402f1c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push ebp
call fcn.00406100
pop ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x1c]
jne 0x406161
cmp eax, dword [ebp - 0x20]
jb 0x406146
jmp 0x406163
jl 0x406146
push ebp
call fcn.00406100
pop ecx
sub eax, dword [ebp - 0x28]
sbb edx, dword [ebp - 0x24]
jno 0x406177
call fcn.00402f1c
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4062e0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406374
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x406351
cmp dword [ebp - 0xc], 0
je 0x406351
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0040385c
jmp 0x406359
mov eax, dword [ebp - 8]
call fcn.0040372c
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40637b
lea eax, [ebp - 4]
call fcn.0040372c
ret

Function at 0x406550
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.004038a4
test eax, eax
je 0x4065f1
mov eax, dword [ebp - 4]
call fcn.004038a4
add eax, 1
jno 0x40657f
call fcn.00402f1c
test eax, eax
jns 0x406588
call fcn.00402f14
push eax
push 0x2042
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4065f1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4065f1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004065f8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
push 0
add al, ch
xor esp, ebx
invalid
invalid
test eax, eax
je 0x4065e8
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 0xc]
push eax
push 1
call sub.user32.dll_SetClipboardData
test eax, eax
setne byte [ebp - 5]
call sub.user32.dll_CloseClipboard
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalFree
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x406868
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x406900
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xfa
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 8]
lea edx, [ebp - 0x108]
mov ecx, pe_nt_image_headers32
call fcn.0040388c
mov edx, dword [ebp - 8]
mov eax, 0x406918
call fcn.00403b3c
test eax, eax
jne 0x4068e5
mov edx, dword [ebp - 8]
mov eax, 0x406928
call fcn.00403b3c
test eax, eax
jne 0x4068e5
mov edx, dword [ebp - 8]
mov eax, 0x40693c
call fcn.00403b3c
test eax, eax
jne 0x4068e5
xor eax, eax
jmp 0x4068e7
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406907
lea eax, [ebp - 8]
call fcn.0040372c
ret

Function at 0x40694c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4069ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x19]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x19]
mov ecx, 0x11
call fcn.0040388c
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
call fcn.00405190
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4069b4
lea eax, [ebp - 0x20]
call fcn.0040372c
ret

Function at 0x4069b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
xor edx, edx
invalid
xchg ebp, eax

Function at 0x406bb4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406c6c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x41e6b8
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jns 0x406c0a
call fcn.00402f14
mov dword [0x41e6bc], eax
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jns 0x406c41
call fcn.00402f14
mov dword [0x41e6bc], eax
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c73
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret
Function at 0x406c7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406d5a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41e6b8
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jns 0x406ccd
call fcn.00402f14
mov dword [0x41e6bc], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
call fcn.00403b84
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jns 0x406d08
call fcn.00402f14
mov dword [0x41e6bc], eax
cmp dword [0x41e6bc], 0
jne 0x406d2c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.00403aa4
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.0040385c
jmp 0x406d34
mov eax, dword [ebp + 8]
call fcn.0040372c
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406d61
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret

Function at 0x406d68
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
mov eax, dword [ebp + 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406e74
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x41e6b8
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jns 0x406dc9
call fcn.00402f14
mov dword [0x41e6bc], eax
cmp dword [ebp + 8], 0
jne 0x406de1
lea eax, [ebp + 8]
mov edx, 0x406e8c
call fcn.004037c4
mov eax, dword [ebp + 8]
call fcn.004038a4
test eax, eax
jns 0x406df2
call fcn.00402f14
push eax
lea eax, [ebp + 8]
call fcn.00403af4
mov edx, 1
dec edx
test eax, eax
je 0x406e0a
cmp edx, dword [eax - 4]
jb 0x406e0f
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
push 1
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x406e36
call fcn.00402f14
mov dword [0x41e6bc], eax
cmp dword [0x41e6bc], 0
sete byte [ebp - 0xd]
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e7b
lea eax, [ebp - 0xc]
invalid
invalid
Function at 0x406e90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406f4b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x41e6b8
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jns 0x406ee9
call fcn.00402f14
mov dword [0x41e6bc], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x406f15
call fcn.00402f14
mov dword [0x41e6bc], eax
cmp dword [0x41e6bc], 0
sete byte [ebp - 0xd]
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406f52
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret

Function at 0x407004
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x4070c2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
jne 0x407044
lea eax, [ebp - 0xc]
mov edx, 0x4070d8
call fcn.004037c4
mov eax, dword [ebp - 0xc]
call fcn.004038a4
test eax, eax
jns 0x407055
call fcn.00402f14
push eax
lea eax, [ebp - 0xc]
call fcn.00403af4
mov edx, 1
dec edx
test eax, eax
je 0x40706d
cmp edx, dword [eax - 4]
jb 0x407072
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x407097
call fcn.00402f14
mov dword [0x41e6bc], eax
cmp dword [0x41e6bc], 0
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4070c9
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret

Function at 0x4070dc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x40714c
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x407126
call fcn.00402f14
mov dword [0x41e6bc], eax
cmp dword [0x41e6bc], 0
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407153
lea eax, [ebp - 8]
call fcn.0040372c
ret

Function at 0x40715c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
Function at 0x4077dc
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xffffff54
cmp byte [0x41d1bc], 0
jne 0x4078ae
mov byte [0x41d1bc], 1
xor eax, eax
mov dword [0x41d1b4], eax
mov dword [esp + 0x18], 0x94
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x1c], 3
ja 0x407824
cmp dword [esp + 0x1c], 3
jne 0x407884
cmp dword [esp + 0x20], 0x33
jbe 0x407884
mov dword [esp + 4], 9
push esp
push 0x20019
push 0
push 0x4078b8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4078ae
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4078e8
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4078ae
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [esp + 8], 0x31
jne 0x4078ae
cmp byte [esp + 9], 0
jne 0x4078ae
jmp 0x407899
push 0
push 0x4078e8
push 0x4078f0
call sub.kernel32.dll_GetProfileIntA
test eax, eax
je 0x4078ae
mov eax, dword [0x41d1b0]
call fcn.00403aa4
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x41d1b4], eax
add esp, 0xac
ret
Function at 0x408aa8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x408ab0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x409d03
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41eb54
mov edx, 0x409d18
call fcn.00403780
call fcn.0040825c
mov eax, dword [ebp - 8]
call fcn.0040372c
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, 0x41eb54
mov edx, 0x409dcc
call fcn.00403780
mov eax, dword [ebp - 4]
call fcn.004038a4
cmp eax, 0x7f
jge 0x408b3c
push 0
push 0x41ec20
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_OpenFile
mov dword [0x41ebcc], eax
cmp dword [0x41ebcc], 0xffffffff
jne 0x408b71
mov dword [ebp - 0xc], 1
jmp 0x408b71
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x41ebcc], eax
cmp dword [0x41ebcc], 0xffffffff
jne 0x408b71
mov dword [ebp - 0xc], 2
mov eax, 0x41eb54
mov edx, 0x409e8c
call fcn.00403780
cmp dword [ebp - 0xc], 0
jbe 0x408bf9
mov eax, 0x41eb54
mov edx, 0x409ee4
call fcn.00403780
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 0xcf
ja 0x408bae
bt dword [0x409fb0], eax
jb 0x408be9
cmp dword [ebp - 0xc], 0x4cf
je 0x408be9
push 0x409fd4
push dword [ebp - 4]
push 0x409fe4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00406434
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00403964
mov eax, dword [ebp - 0x14]
call fcn.00412764
mov eax, dword [0x41ebcc]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x409ce0
mov eax, 0x41eb54
mov edx, 0x409ff0
call fcn.00403780
mov eax, 0x41ebfc
call fcn.0040372c
mov eax, 0x41ec00
call fcn.0040372c
mov eax, 0x41ec04
call fcn.0040372c
xor eax, eax
mov dword [0x41ebf0], eax
xor eax, eax
mov dword [0x41ebf4], eax
xor eax, eax
mov dword [0x41ebf8], eax
xor eax, eax
mov dword [0x41ebec], eax
mov eax, 0x41ec08
mov edx, 0x12
call fcn.00403b84
mov eax, 0x41ec0c
mov edx, 0x20
call fcn.00403b84
mov eax, 0x41ec10
mov edx, 0x1a
call fcn.00403b84
mov eax, 0x41ec14
mov edx, 0x2f
call fcn.00403b84
mov eax, 0x41ec18
mov edx, 0x12
call fcn.00403b84
mov eax, 0x41eb54
mov edx, 0x40a094
call fcn.00403780
mov eax, 0x41ec1c
mov edx, 0x20
call fcn.00403b84
xor eax, eax
mov edx, dword [0x41ecac]
test edx, edx
je 0x408cbc
cmp eax, dword [edx - 4]
jb 0x408cc1
call fcn.00402f14
mov byte [edx + eax], 0
jmp 0x409bda