joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5ce104]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], esi
mov eax, dword [0x5d45d0]
test al, 1
jne 0x40b38e
or eax, 1
mov dword [0x5d45d0], eax
call fcn.00406e20
test eax, eax
je 0x40b48d
mov edx, dword [eax]
cmp edx, vtable.ATL::CAtlStringMgr.0
jne 0x40b497
lock inc dword [eax + 0x14]
add eax, 8
add eax, 0x10
push 0x5909c0
mov dword [0x5d45d4], eax
call fcn.00522774
add esp, 4
mov eax, dword [0x5d45d4]
cmp dword [eax - 0xc], 0
jne 0x40b465
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallDLLRepair
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b465
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00526bd0
add esp, 0xc
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push str.DisplayVersion
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x210], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b444
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, 0x5d45d4
call fcn.00405730
mov ecx, dword [0x5d45d4]
add ecx, 0xfffffff0
push ecx
call fcn.00405650
mov ecx, dword [ebp - 4]
add esp, 4
add eax, 0x10
xor ecx, ebp
mov dword [esi], eax
mov eax, esi
pop esi
call fcn.00522a9a
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004071e0
mov ecx, eax
call dword [edx + 0xc]
jmp 0x40b379
Function at 0x40e960
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57dbc0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x5ce104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x3c]
call fcn.0040e390
mov dword [ebp - 4], 0
call fcn.00454f40
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00454800
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov esi, dword [ebp - 0x10]
mov edi, dword [esi - 0xc]
test edi, edi
je 0x40ead6
cmp dword [esi - 4], 1
jle 0x40e9cf
push edi
lea ecx, [ebp - 0x10]
call fcn.0041df00
mov esi, dword [ebp - 0x10]
push ecx
lea eax, [edi + 1]
mov edx, esi
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043d9b0
mov edi, dword [ebp - 0x1c]
add esp, 8
mov ebx, edi
lea ecx, [ebx + 2]
nop dword [eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x40e9f0
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], SysReAllocStringLen
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5a7448
sub ebx, ecx
mov dword [ebp - 0x18], 0
push SysReAllocStringLen
sar ebx, 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, eax
mov dword [ebp - 0x1c], edx
test edx, edx
jne 0x40ea74
mov eax, dword [ebp - 0x14]
cmp eax, 0x80000001
je 0x40ea4c
push eax
call ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ebx*2 + 2]
push eax
push edi
push 1
push 0
push 0x5a7440
push ecx
mov dword [ebp - 0x14], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0x80000001
je 0x40ea81
push eax
call ecx
xor ebx, ebx
cmp dword [ebp - 0x1c], ebx
sete bl
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40eacb
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x40eac9
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x40eac9
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [ecx + 4]
call edi
or eax, 0xffffffff
jmp 0x40eade
call edx
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
or eax, 0xffffffff
jmp 0x40eade
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40eb18
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x40eb16
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x40eb16
push 0
push dword [ecx + 4]
call edi
jmp 0x40eb18
call edx
lea ecx, [ebp - 0x3c]
call fcn.0040e550
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411a60
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57deb8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5ce104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
mov edx, str.MasterPDF
lea ecx, [ebp - 0x10]
call fcn.0041c710
add esp, 4
mov byte [ebp - 4], 1
call fcn.00406e20
mov ecx, eax
test ecx, ecx
jne 0x411abe
push 0x80004005
call fcn.004071e0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x411ad3
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x411ad5
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push dword [ebp - 0x10]
push str.SoftwareClients_s
push eax
call fcn.00420620
mov esi, dword [ebp - 0x14]
add esp, 0xc
mov edx, esi
mov ecx, edi
call fcn.00412480
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x10]
push str.SOFTWARERegisteredApplications
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
or edi, 0xffffffff
mov byte [ebp - 4], 1
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jg 0x411b5b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x411b59
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x411b59
push 0
push dword [ecx + 4]
call ebx
jmp 0x411b5b
call edx
mov byte [ebp - 4], 0
mov eax, edi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x411b9c
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x411b98
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x411b98
push 0
push dword [edx + 4]
call ebx
jmp 0x411b9c
mov ecx, edx
call esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], edi
dec edi
test edi, edi
jg 0x411bde
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x411bda
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x411bda
push 0
push dword [edx + 4]
call ebx
jmp 0x411bde
mov ecx, edx
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411d50
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57df20
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5ce104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
test edx, edx
mov ecx, str.PdfRecommand
mov eax, str.MasterPDF
cmove eax, ecx
lea ecx, [ebp - 0x10]
push eax
call fcn.00404e80
mov dword [ebp - 4], 0
call fcn.00406e20
mov ecx, eax
test ecx, ecx
jne 0x411dad
push 0x80004005
call fcn.004071e0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x411dc2
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x411dc4
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push dword [ebp - 0x10]
push str.SoftwareClients_s
push eax
call fcn.00420620
mov esi, dword [ebp - 0x14]
add esp, 0xc
mov edx, esi
mov ecx, edi
call fcn.00412480
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x10]
push str.SOFTWARERegisteredApplications
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
or edi, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x411e48
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x411e46
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x411e46
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x411e48
call edx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], edi
dec edi
test edi, edi
jg 0x411e8e
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x411e8a
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x411e8a
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x411e8e
mov ecx, edx
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412350
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x10], edx
push edi
mov dword [ebp - 0xc], eax
xor edi, edi
mov ebx, 0x20019
lea ecx, [ebp - 4]
push ecx
push ebx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4123d6
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x4123cd
mov eax, dword [ebp - 8]
shr eax, 1
inc eax
push 2
push eax
call fcn.00543cad
add esp, 8
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x4123cd
push edi
call fcn.00531606
add esp, 4
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
jne 0x4123fa
mov eax, dword [ebp - 0xc]
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
jne 0x4123fa
cmp ebx, 0x20019
jne 0x4123fa
mov edx, dword [ebp - 0x10]
mov ebx, 0x20119
jmp 0x412368
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4129b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57dff8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x5ce104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
call fcn.00406e20
mov ecx, eax
test ecx, ecx
jne 0x4129f0
push 0x80004005
call fcn.004071e0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x412a05
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x412a07
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
push esi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sUserChoice
push eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0x104
mov dword [ebp - 0x14], 0
call fcn.00420620
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
add esp, 0xc
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push str.Progid
push esi
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x412a63
xor edi, edi
jmp 0x412a77
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.00543b38
add esp, 8
mov edi, eax
neg edi
sbb edi, edi
inc edi
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x412acc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x412aca
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x412aca
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call edx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x417100
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5ce104]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00526bd0
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.00522a9a
mov esp, ebp
pop ebp
ret

Function at 0x417200
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5ce104]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00526bd0
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x41726c
mov eax, dword [ebp - 0x118]
cmp eax, 2
je 0x417259
cmp eax, 3
jne 0x41726c
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00522a9a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00522a9a
mov esp, ebp
pop ebp
ret
Function at 0x419210
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ec60
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x5ce104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 1
push 0
push eax
call fcn.00526bd0
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [ebp + 8]
push 0x104
push eax
push 0x5a8538
push dword [ebp + 0xc]
push str.dllrepair
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 0x2a
cmp ax, word [ebp - 0x218]
je 0x4192bb
lea edx, [ebp - 0x218]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x419296
sub edx, esi
lea eax, [ebp - 0x218]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.00405730
mov esi, 1
jmp 0x4192bd
xor esi, esi
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov ecx, dword [ebp + 8]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jg 0x41932d
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x21c], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x419325
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x21c], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41931b
push 0
push dword [edx + 4]
call ebx
jmp 0x41932d
mov ecx, edx
call dword [ebp - 0x21c]
jmp 0x41932d
mov ecx, edx
call dword [ebp - 0x21c]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x419370
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x41936e
mov eax, dword [ecx + 4]
mov ecx, dword [eax]
mov edi, dword [ecx + 4]
cmp ecx, vtable.ATL::CWin32Heap.0
jne 0x41936c
push 0
push dword [eax + 4]
call ebx
jmp 0x419370
mov ecx, eax
call edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00522a9a
mov esp, ebp
pop ebp
ret
Function at 0x41b710
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x5ce104]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0
push eax
push 0x101
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41b763
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00522a9a
mov esp, ebp
pop ebp
ret
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.00526bd0
add esp, 0xc
mov dword [ebp - 0x210], 0x200
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], 1
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0x5a8938
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41b752
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push SysReAllocString
push str.Microsoft
push ecx
mov edx, 0x200
mov ecx, esi
call fcn.00409420
lea eax, [ebp - 0x20c]
mov edx, 0x200
push eax
mov ecx, esi
call fcn.00409370
test eax, eax
js 0x41b815
push SysReAllocString
lea eax, [ebp - 0x204]
mov edx, 0x200
push eax
mov eax, dword [ebp - 0x20c]
sub edx, eax
push ecx
lea ecx, [esi + eax*2]
call fcn.00409420
lea eax, [ebp - 0x20c]
mov edx, 0x200
push eax
mov ecx, esi
call fcn.00409370
test eax, eax
js 0x41b84c
mov eax, dword [ebp - 0x20c]
mov edx, 0x200
push SysReAllocString
push 0x5a3e20
push ecx
sub edx, eax
lea ecx, [esi + eax*2]
call fcn.00409420
xorps xmm0, xmm0
mov dword [ebp - 0x218], 0
lea eax, [ebp - 0x238]
push eax
movups xmmword [ebp - 0x238], xmm0
movups xmmword [ebp - 0x228], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, 9
mov edx, 0x200
mov ecx, esi
cmp ax, word [ebp - 0x238]
jne 0x41b890
push 0x5a8968
jmp 0x41b895
push 0x5a8970
call fcn.00409310
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00522a9a
mov esp, ebp
pop ebp
ret

Function at 0x421ce0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x421d11
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x421d00
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x427d80
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x427f46
cmp eax, 0x7c
je 0x427f46
cmp eax, 0x29
jne 0x427db8
cmp dword [esi + 0x10], 0
jne 0x427f46
test dword [esi + 0x50], 0x10000000
je 0x427f4c
cmp eax, 0x2e
jne 0x427e0f
push 5
lea ecx, [esi + 0x24]
call fcn.00428160
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x427e03
cmp byte [eax], 0x5c
jne 0x427e01
inc eax
cmp eax, ecx
je 0x427e01
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x427dee
mov dl, byte [eax]
cmp dl, 0x28
je 0x427dff
cmp dl, 0x29
je 0x427dff
test cl, 0x10
jne 0x427e01
mov cl, byte [eax]
cmp cl, 0x7b
je 0x427dff
cmp cl, 0x7d
jne 0x427e01
mov dword [esi], eax
inc dword [esi]
mov ecx, esi
call fcn.00425f90
jmp 0x427f31
cmp eax, 0x5c
jne 0x427e74
mov ecx, esi
call fcn.00427d30
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x427e41
cmp byte [esi + 0x48], 0x62
jne 0x427e41
push 4
lea ecx, [esi + 0x24]
call fcn.00428160
mov ecx, esi
call fcn.00427d30
jmp 0x427f38
test eax, eax
je 0x427e68
cmp byte [esi + 0x48], 0x42
jne 0x427e68
push 4
lea ecx, [esi + 0x24]
call fcn.00428160
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00427d30
jmp 0x427f38
mov ecx, esi
call fcn.00429de0
jmp 0x427f31
cmp eax, 0x5b
jne 0x427e97
mov ecx, esi
call fcn.00427d30
mov ecx, esi
call fcn.00429d50
push 4
push 0x5d
mov ecx, esi
call fcn.00429cf0
jmp 0x427f31
cmp eax, 0x28
jne 0x427ebd
mov ecx, esi
call fcn.00427d30
mov ecx, esi
call fcn.00429ea0
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.00429cf0
test bl, bl
je 0x427f38
jmp 0x427f31
cmp eax, 0x5e
jne 0x427ed5
push 2
lea ecx, [esi + 0x24]
call fcn.00428160
mov ecx, esi
call fcn.00427d30
jmp 0x427f38
cmp eax, 0x24
jne 0x427eed
push 3
lea ecx, [esi + 0x24]
call fcn.00428160
mov ecx, esi
call fcn.00427d30
jmp 0x427f38
cmp eax, 0x2a
je 0x427f61
cmp eax, 0x2b
je 0x427f61
cmp eax, 0x3f
je 0x427f61
cmp eax, 0x7b
je 0x427f61
cmp eax, 0x7d
jne 0x427f0f
test dword [esi + 0x50], 0x10000000
je 0x427f53
cmp eax, 0x5d
jne 0x427f1d
test dword [esi + 0x50], 0x10000000
je 0x427f5a
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0042a0f0
mov ecx, esi
call fcn.00427d30
mov ecx, esi
call fcn.00429f60
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x427d93
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.005088a3
push 6
call fcn.005088a3
push 4
call fcn.005088a3
push 0xa
call fcn.005088a3
int3
Function at 0x4310a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
cmp dword [eax - 0xc], 0
jne 0x4310b1
xor ebx, ebx
jmp 0x4310cd
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
cmp eax, 0x20
mov eax, dword [ebp + 8]
setg bl
lea edx, [eax - 0x10]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43110f
mov ecx, dword [edx]
push esi
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x431116
mov eax, dword [ecx + 4]
mov ecx, dword [eax]
mov esi, dword [ecx + 4]
cmp ecx, vtable.ATL::CWin32Heap.0
jne 0x431114
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
mov ecx, eax
call esi
jmp 0x43110e

Function at 0x433bb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5805c6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5ce104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00522354
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00508d45
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret