joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push esi
mov dword [esp + 0x14], edx
lea esi, [ecx + 4]
mov edx, dword [ecx]
add esi, 4
xor eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
push edi
movd xmm0, edx
mov edi, eax
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + 0x20], xmm0
test al, 3
je 0x403470
and edi, 0xfffffffc
add edi, 4
mov eax, dword [0x40e510]
test eax, eax
jne 0x403494
mov ecx, 0xa2ce093f
call fcn.00403f70
mov edx, 0x4fee74f4
mov ecx, eax
call fcn.00403ed0
mov dword [0x40e510], eax
call eax
mov ebx, eax
mov eax, dword [0x40e284]
test eax, eax
jne 0x4034bc
mov ecx, 0xa2ce093f
call fcn.00403f70
mov edx, 0xafb2ca58
mov ecx, eax
call fcn.00403ed0
mov dword [0x40e284], eax
push edi
push 8
push ebx
call eax
mov dword [esp + 0xc], eax
test eax, eax
je 0x403572
shr edi, 2
xor edx, edx
lea ecx, [esi + edi*4]
mov edi, eax
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
mov ecx, eax
cmova ebx, edx
test ebx, ebx
je 0x403562
cmp ebx, 8
jb 0x403547
lea eax, [esi - 4]
lea eax, [eax + ebx*4]
cmp ecx, eax
ja 0x403506
lea eax, [ecx - 4]
lea eax, [eax + ebx*4]
cmp eax, esi
jae 0x403547
movdqa xmm1, xmmword [esp + 0x20]
mov eax, ebx
and eax, 7
mov dword [esp + 0xc], ebx
sub dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea ecx, [ecx]
movdqu xmm0, xmmword [esi]
add edx, 8
pxor xmm0, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esi + 0x10]
add esi, 0x20
pxor xmm0, xmm1
movdqu xmmword [edi + 0x10], xmm0
add edi, 0x20
cmp edx, eax
jb 0x403520
cmp edx, ebx
jae 0x403562
sub edi, esi
lea ecx, [ecx]
mov eax, dword [esi]
lea esi, [esi + 4]
xor eax, dword [esp + 0x14]
inc edx
mov dword [edi + esi - 4], eax
cmp edx, ebx
jb 0x403550
mov edx, dword [esp + 0x18]
test edx, edx
je 0x403570
mov eax, dword [esp + 0x1c]
mov dword [edx], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4035e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push esi
lea esi, [ecx + 4]
mov dword [esp + 8], edx
lea ebx, [eax + 1]
mov dword [esp + 0x10], eax
add esi, 4
push edi
test bl, 3
je 0x403609
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x40e510]
test eax, eax
jne 0x40362d
mov ecx, 0xa2ce093f
call fcn.00403f70
mov edx, 0x4fee74f4
mov ecx, eax
call fcn.00403ed0
mov dword [0x40e510], eax
call eax
mov edi, eax
mov eax, dword [0x40e284]
test eax, eax
jne 0x403655
mov ecx, 0xa2ce093f
call fcn.00403f70
mov edx, 0xafb2ca58
mov ecx, eax
call fcn.00403ed0
mov dword [0x40e284], eax
lea ecx, [ebx + ebx]
push ecx
push 8
push edi
call eax
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x4036d5
shr ebx, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, edi
lea ecx, [esi + ebx*4]
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
cmova ebx, eax
test ebx, ebx
je 0x4036ca
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [esi]
lea edx, [edx + 8]
xor ecx, edi
lea esi, [esi + 4]
movzx eax, cl
inc ebp
mov word [edx - 8], ax
mov eax, ecx
shr eax, 8
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
mov word [edx - 4], ax
shr ecx, 8
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, ebx
jb 0x403690
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
pop ebp
mov word [edi + eax*2], cx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x4036e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push ebp
push esi
lea esi, [ecx + 4]
mov dword [esp + 0xc], edx
lea ebx, [eax + 1]
mov dword [esp + 0x14], eax
add esi, 4
push edi
test bl, 3
je 0x40370a
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [0x40e510]
test eax, eax
jne 0x40372e
mov ecx, 0xa2ce093f
call fcn.00403f70
mov edx, 0x4fee74f4
mov ecx, eax
call fcn.00403ed0
mov dword [0x40e510], eax
call eax
mov edi, eax
mov eax, dword [0x40e284]
test eax, eax
jne 0x403756
mov ecx, 0xa2ce093f
call fcn.00403f70
mov edx, 0xafb2ca58
mov ecx, eax
call fcn.00403ed0
mov dword [0x40e284], eax
push ebx
push 8
push edi
call eax
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x4037c2
shr ebx, 2
xor eax, eax
xor edi, edi
mov ecx, ebp
lea edx, [esi + ebx*4]
mov ebx, edx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, edx
cmova ebx, eax
test ebx, ebx
je 0x4037ba
mov ebp, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
lea ecx, [ecx + 4]
xor edx, ebp
lea esi, [esi + 4]
mov byte [ecx - 4], dl
mov eax, edx
shr eax, 8
inc edi
shr edx, 0x10
mov byte [ecx - 3], al
mov byte [ecx - 2], dl
shr edx, 8
mov byte [ecx - 1], dl
cmp edi, ebx
jb 0x403790
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [eax + ebp], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x403cc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov dword [esp], 0x64bc
add dword [esp], 0xffff85b7
xor dword [esp], 0xe5a68224
shl dword [esp], 6
or dword [esp], 0x7fa52244
add dword [esp], 0x7bfd
shl dword [esp], 5
add dword [esp], 0xba34
xor dword [esp], 0xfff73254
mov dword [esp + 4], 0x1a8a
add dword [esp + 4], 0xffffd02b
shl dword [esp + 4], 0xe
xor dword [esp + 4], 0xfaad4006
push ebx
mov dword [esp + 8], 0xb8f9
mov ebx, ecx
xor dword [esp + 8], 0x3f0625fa
xor dword [esp + 8], 0x3f069d13
cmp byte [ebx], 0
je 0x403dad
push esi
push edi
jmp 0x403d40
mov edi, dword [esp + 0xc]
lea ebx, [ebx + 1]
mov dword [esp + 0x10], 0x1a8a
add dword [esp + 0x10], 0xffffd02b
shl dword [esp + 0x10], 0xe
xor dword [esp + 0x10], 0xfaad4006
movzx ecx, byte [esp + 0x10]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], 0xb8f9
xor dword [esp + 0x10], 0x3f0625fa
xor dword [esp + 0x10], 0x3f069d13
shl esi, cl
movzx ecx, byte [esp + 0x10]
mov edx, dword [esp + 0xc]
movsx eax, byte [ebx - 1]
mov dword [esp + 0xc], eax
add dword [esp + 0xc], esi
shl edx, cl
add dword [esp + 0xc], edx
sub dword [esp + 0xc], edi
cmp byte [ebx], 0
jne 0x403d40
pop edi
pop esi
mov eax, dword [esp + 4]
pop ebx
add esp, 8
ret
Function at 0x403ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, 0x78
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax]
mov eax, dword [edi + ebx + 0x1c]
add edi, ebx
add eax, ebx
mov dword [esp + 0x18], eax
mov ebp, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ebp, ebx
add eax, ebx
mov dword [esp + 0x14], eax
cmp dword [edi + 0x18], esi
jbe 0x403f2c
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
add ecx, ebx
call fcn.00403cc0
xor eax, 0xbdb9b51
cmp eax, dword [esp + 0x10]
je 0x403f36
inc esi
cmp esi, dword [edi + 0x18]
jb 0x403f10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, ebx
cmp ecx, edi
jb 0x403f64
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
add eax, edi
cmp ecx, eax
jae 0x403f64
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp 0x4040d0
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret
sub esp, 0x104
lea edx, [esp]
push esi
mov esi, ecx
push edi
mov al, byte [esi]
test al, al
je 0x4040f6
cmp al, 0x2e
je 0x4040f3
inc esi
mov byte [edx], al
inc edx
mov al, byte [esi]
test al, al
jne 0x4040e3
jmp 0x4040f6
mov byte [edx], 0
mov eax, dword [0x40e430]
test eax, eax
jne 0x40411a
mov ecx, 0xa2ce093f
call fcn.00403f70
mov edx, 0xfce32466
mov ecx, eax
call fcn.00403ed0
mov dword [0x40e430], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x404161
mov eax, dword [0x40e344]
test eax, eax
jne 0x40414b
mov ecx, 0xa2ce093f
call fcn.00403f70
mov edx, 0xd4f020bd
mov ecx, eax
call fcn.00403ed0
mov dword [0x40e344], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x404161
pop edi
pop esi
add esp, 0x104
ret
lea ecx, [esi + 1]
call fcn.00403cc0
xor eax, 0xbdb9b51
mov ecx, edi
mov edx, eax
call fcn.00403ed0
pop edi
pop esi
add esp, 0x104
ret
Function at 0x403f70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub esp, 0x10
mov eax, dword fs:[0x30]
mov dword [esp + 0xc], ecx
push ebx
push ebp
mov ecx, dword [eax + 0xc]
add ecx, 0xc
push esi
push edi
mov dword [esp + 0x18], ecx
mov ebx, dword [ecx]
cmp ebx, ecx
je 0x4040b5
mov edx, dword [ebx + 0x30]
mov dword [esp + 0x10], 0x64bc
add dword [esp + 0x10], 0xffff85b7
xor dword [esp + 0x10], 0xe5a68224
shl dword [esp + 0x10], 6
or dword [esp + 0x10], 0x7fa52244
add dword [esp + 0x10], 0x7bfd
shl dword [esp + 0x10], 5
add dword [esp + 0x10], 0xba34
xor dword [esp + 0x10], 0xfff73254
mov dword [esp + 0x14], 0x1a8a
add dword [esp + 0x14], 0xffffd02b
shl dword [esp + 0x14], 0xe
xor dword [esp + 0x14], 0xfaad4006
mov dword [esp + 0x14], 0xb8f9
xor dword [esp + 0x14], 0x3f0625fa
xor dword [esp + 0x14], 0x3f069d13
cmp word [edx], 0
je 0x40409c
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x14], 0x1a8a
add dword [esp + 0x14], 0xffffd02b
shl dword [esp + 0x14], 0xe
xor dword [esp + 0x14], 0xfaad4006
movzx ecx, byte [esp + 0x14]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x14], 0xb8f9
xor dword [esp + 0x14], 0x3f0625fa
xor dword [esp + 0x14], 0x3f069d13
shl esi, cl
movzx ecx, byte [esp + 0x14]
mov edi, dword [esp + 0x10]
movzx eax, word [edx]
shl edi, cl
cmp eax, 0x41
jb 0x40407f
cmp eax, 0x5a
ja 0x40407f
add eax, 0x20
mov dword [esp + 0x10], eax
add edx, 2
add dword [esp + 0x10], esi
add dword [esp + 0x10], edi
sub dword [esp + 0x10], ebp
cmp word [edx], 0
jne 0x404020
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
xor eax, 0x2db0ef4d
cmp eax, dword [esp + 0x1c]
je 0x4040bf
mov ebx, dword [ebx]
cmp ebx, ecx
jne 0x403f95
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [ebx + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x404390
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
mov dword [esp + 0x10], ebp
push edi
cmp edx, 0x40
jb 0x40452e
mov eax, 0x5a4d
cmp word [ebp], ax
jne 0x40452e
mov edi, dword [ebp + 0x3c]
add edi, ebp
mov dword [esp + 0x18], edi
cmp dword [edi], 0x4550
jne 0x40452e
mov eax, 0x10b
cmp word [edi + 0x18], ax
jne 0x40452e
mov eax, dword [0x40dfd0]
test eax, eax
jne 0x4043fb
mov ecx, 0xa2ce093f
call fcn.00403f70
mov edx, 0x320a3d1b
mov ecx, eax
call fcn.00403ed0
mov dword [0x40dfd0], eax
push ebx
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
call eax
mov ebx, eax
test ebx, ebx
je 0x404525
movzx ecx, word [edi + 0x14]
push esi
lea esi, [edi + 0x18]
add esi, ecx
movzx ecx, word [edi + 6]
mov dword [esp + 0x18], esi
lea ecx, [ecx + ecx*4]
lea eax, [esi + ecx*8]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [0x40e5a0]
test eax, eax
jne 0x40445b
mov ecx, 0xff9ecf59
call fcn.00403f70
mov edx, 0x36664426
mov ecx, eax
call fcn.00403ed0
mov dword [0x40e5a0], eax
push dword [esp + 0x10]
push ebp
push ebx
call eax
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp esi, ecx
jae 0x4044de
sub ecx, dword [esp + 0x18]
mov eax, 0xcccccccd
dec ecx
add esi, 0x10
mul ecx
mov ecx, edx
shr ecx, 5
inc ecx
mov edi, ecx
mov ebp, dword [esi]
cmp dword [esi - 8], ebp
mov eax, dword [esi + 4]
cmovb ebp, dword [esi - 8]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esi - 4]
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [0x40e5a0]
test eax, eax
jne 0x4044c6
mov ecx, 0xff9ecf59
call fcn.00403f70
mov edx, 0x36664426
mov ecx, eax
call fcn.00403ed0
mov dword [0x40e5a0], eax
push ebp
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call eax
add esp, 0xc
add esi, 0x28
dec edi
jne 0x404485
mov edi, dword [esp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.00404660
mov edx, edi
mov ecx, ebx
call fcn.00404570
pop esi
test eax, eax
jne 0x404525
mov eax, dword [0x40e3d0]
test eax, eax
jne 0x404519
mov ecx, 0xa2ce093f
call fcn.00403f70
mov edx, 0xf1294406
mov ecx, eax
call fcn.00403ed0
mov dword [0x40e3d0], eax
push 0x8000
push 0
push ebx
call eax
xor ebx, ebx
mov eax, ebx
pop ebx
pop edi
pop ebp
add esp, 0x14
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
Function at 0x401440
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [str.SOFTWAREElaborate_BytesVirtualCloneDriveSettings]
sub esp, 8
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push 0x80000002
call ebx
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x40149f
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push 0x40c6c8
push 0
push 0
push str.LocaleName
push eax
mov dword [esp + 0x28], 0x13
call esi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, dword [str.SOFTWAREElaborate_BytesVirtualCloneDriveSettings]
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push eax
push 0x80000001
call ebx
test eax, eax
jne 0x4014e3
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push 0x40c6c8
push eax
push eax
push str.LocaleName
push edx
mov dword [esp + 0x28], 0x13
call esi
mov eax, dword [esp + 0xc]
push eax
call edi
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x401610
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
lea ecx, [esp + 0xc]
xor esi, esi
call fcn.004015b0
lea eax, [esp + 4]
push eax
push 0x20019
push esi
lea ecx, [esp + 0x18]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401691
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x114]
push eax
push esi
push esi
push str.DeviceDesc
push ecx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401686
push str.Virtual_CloneDrive
lea edx, [esp + 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x210
ret

Function at 0x4016a0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x110
push esi
push eax
lea ecx, [esp + 0x14]
push str.SYSTEMCurrentControlSetServicesClass_s
push ecx
xor esi, esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 8]
push edx
push 0xf003f
push esi
lea eax, [esp + 0x1c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401745
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xb]
push edx
push eax
push eax
mov byte [esp + 0x17], al
mov eax, dword [esp + 0x18]
push str.DigitalAudioPlay
push eax
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40173a
mov al, byte [esp + 7]
test al, 1
jne 0x40173a
mov edx, dword [esp + 8]
mov cl, al
or cl, 1
push 1
mov byte [esp + 0xb], cl
lea ecx, [esp + 0xb]
push ecx
push 3
push esi
push str.DigitalAudioPlay
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x110
ret
Function at 0x401920
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x32c
push ebx
push edi
lea eax, [esp + 0xc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.EnumSCSI
xor edi, edi
push 0x80000002
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401908
mov edx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push esi
push 0x104
lea ecx, [esp + 0x138]
push ecx
push ebx
push edx
xor esi, esi
call ebp
test eax, eax
jne 0x4018fb
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push 0x20019
push ebx
lea ecx, [esp + 0x140]
push ecx
inc esi
push edx
mov dword [esp + 0x40], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4018da
mov ecx, dword [esp + 0x18]
push 0x104
lea eax, [esp + 0x34]
push eax
push ebx
push ecx
xor esi, esi
call ebp
test eax, eax
jne 0x4018cb
push 4
lea edx, [esp + 0x34]
push edx
push str.ROOT
inc esi
call fcn.00408cbc
add esp, 0xc
test eax, eax
jne 0x4018cb
lea eax, [esp + 0x30]
call fcn.00401610
test eax, eax
je 0x4018cb
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push 0x20019
push ebx
lea ecx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4018b1
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x17]
push ecx
push ebx
push ebx
push str.DeviceType
push edx
mov byte [esp + 0x2b], bl
mov dword [esp + 0x3c], 1
call edi
cmp byte [esp + 0x13], 5
jne 0x4018a6
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x23c]
push ecx
push ebx
push ebx
push str.Driver
push edx
mov dword [esp + 0x40], 0x104
call edi
test eax, eax
jne 0x4018a6
lea eax, [esp + 0x238]
call fcn.004016a0
or dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x18]
push 0x104
lea ecx, [esp + 0x34]
push ecx
push esi
push edx
call ebp
test eax, eax
je 0x4017f7
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
push 0x104
lea ecx, [esp + 0x138]
push ecx
push esi
push edx
call ebp
test eax, eax
je 0x4017b0
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
add esp, 0x32c
ret
cmp dword [0x40ca74], 4
jge 0x40192e
jmp 0x401750
mov eax, 1
ret

Function at 0x401940
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [str.SOFTWAREElaborate_BytesVirtualCloneDrive]
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40198f
push 4
lea edx, [esp + 0xc]
push edx
push 4
push eax
mov eax, dword [esp + 0x10]
push str.VCDDriveMask
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret
Function at 0x4019a0
Capabilities:
Query or enumerate registry key

Disassembly:
mov ecx, dword [0x40c73c]
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x10c]
push edi
mov edi, dword [esp + 0x114]
lea eax, [esp + 8]
push eax
or ecx, 0x20019
push ecx
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401a6a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x100
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0x18]
push eax
call esi
test eax, eax
jne 0x401a24
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.004019a0
add esp, 8
test eax, eax
jne 0x401a24
mov ecx, dword [esp + 0xc]
push 0x100
lea eax, [esp + 0x14]
push eax
push 0
push ecx
call esi
test eax, eax
je 0x4019f7
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [0x40c73c]
push str.RegDeleteKeyExA
push str.Advapi32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401a61
push 0
push esi
push edi
push ebx
call eax
pop esi
pop edi
pop ebx
add esp, 0x104
ret
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop esi
pop edi
pop ebx
add esp, 0x104
ret

Function at 0x401af0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x40ca80]
sub esp, 8
test eax, eax
mov dword [0x40c048], 0
je 0x401b55
mov ecx, dword [str.SOFTWAREElaborate_BytesVirtualCloneDrive]
lea eax, [esp]
push eax
push 0x20019
push 0
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401b55
lea edx, [esp + 4]
push edx
push 0x40c048
push eax
push eax
mov eax, dword [esp + 0x10]
push str.VirtualSheep
push eax
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret

Function at 0x401b60
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [str.SOFTWAREElaborate_BytesVirtualCloneDrive]
sub esp, 8
lea eax, [esp]
push eax
push 0x20019
push 0
push ecx
push 0x80000001
mov dword [0x40ca9c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401bbc
lea edx, [esp + 4]
push edx
push 0x40ca9c
push eax
push eax
mov eax, dword [esp + 0x10]
push str.AutoMount
push eax
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret

Function at 0x401bc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [str.SOFTWAREElaborate_BytesVirtualCloneDrive]
sub esp, 8
lea eax, [esp]
push eax
push 0x20019
push 0
push ecx
push 0x80000001
mov dword [0x40c04c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401c1c
lea edx, [esp + 4]
push edx
push 0x40c04c
push eax
push eax
mov eax, dword [esp + 0x10]
push str.ShowTrayIcon
push eax
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret
Function at 0x401c20
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [str.SOFTWAREElaborate_BytesVirtualCloneDrive]
sub esp, 8
lea eax, [esp]
push eax
push 0x20019
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401c72
lea edx, [esp + 4]
push edx
push 0x40ca60
push eax
push eax
mov eax, dword [esp + 0x10]
push str.Version
push eax
mov dword [esp + 0x1c], 0x14
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret

Function at 0x401dc0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x468
test eax, eax
je 0x401de6
push eax
push ecx
push 0x40c848
lea eax, [esp + 0x64]
push 0x409488
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
jmp 0x401dff
push ecx
push 0x40c848
lea ecx, [esp + 0x60]
push 0x409478
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push edi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edx, [esp + 8]
push edx
mov word [esp + 0x4c], ax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [esp + 0x7c]
push ecx
push 0
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x6c], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
je 0x401eb4
mov edx, dword [esp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov al, byte [esp + 0x470]
test al, al
mov dword [esp + 4], 0
je 0x401e8b
mov eax, dword [esp + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 8]
lea ecx, [esp + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test ebx, ebx
je 0x401ea1
mov eax, dword [esp + 8]
mov dword [ebx], eax
mov eax, dword [esp + 4]
pop esi
add esp, 0x468
ret
mov ecx, dword [esp + 8]
push ecx
call esi
mov eax, dword [esp + 4]
pop esi
add esp, 0x468
ret
or eax, 0xffffffff
add esp, 0x468
ret