joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a2ae4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
test dl, dl
je 0x5a2af8
add esp, 0xfffffff0
call fcn.00404028
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5a2ba5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
call fcn.00479628
mov eax, dword [ebp - 4]
call fcn.004050a0
lea edx, [edi + 4]
call fcn.004afa44
mov edx, eax
mov eax, edi
call fcn.005a3004
mov edx, 0x5a2bd4
mov eax, edi
call fcn.005a3238
mov edx, 0x5a2bf4
mov eax, edi
call fcn.005a3238
mov edx, 0x5a2c1c
mov eax, edi
call fcn.005a3238
mov edx, 0x5a2c90
mov eax, edi
call fcn.005a3238
mov edx, 0x5a2d2c
mov eax, edi
call fcn.005a3238
mov edx, 0x5a2d74
mov eax, edi
call fcn.005a3238
mov edx, 0x5a2df0
mov eax, edi
call fcn.005a3238
mov edx, 0x5a2e84
mov eax, edi
call fcn.005a3238
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a2bac
lea eax, [ebp - 4]
call fcn.00404c00
ret

Function at 0x5a3028
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x5a3051
mov edx, 0x5a30dc
mov eax, dword [ebp - 4]
call fcn.005a3398
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
xor eax, eax
push ebp
push 0x5a30c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov ecx, ebx
mov edx, 1
call fcn.00479090
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a3004
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov ecx, esi
mov edx, 2
call fcn.00479090
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a3004
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.004c69dc
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a3004
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a30cc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.004c6560
ret

Function at 0x5a3420
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x5a3451
mov edx, 0x5a34f4
mov eax, dword [ebp - 4]
call fcn.005a3398
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
xor eax, eax
push ebp
push 0x5a34da
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ecx, ebx
mov edx, 1
call fcn.00479090
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a3004
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ecx, esi
mov edx, 2
call fcn.00479090
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a3004
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.004c69dc
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a3004
cmp eax, 0x64
jne 0x5a34c1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
xor edx, edx
call fcn.004c6d5c
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a34e1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.004c6560
ret
Function at 0x5a3548
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a3666
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0041cf94
xor eax, eax
push ebp
push 0x5a3641
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
jne 0x5a359f
mov edx, 0x5a367c
mov eax, dword [ebp - 4]
call fcn.005a3398
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
xor eax, eax
push ebp
push 0x5a3624
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov ecx, ebx
mov edx, 1
call fcn.00479090
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a3004
jmp 0x5a35f1
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
xor edx, edx
call fcn.00479504
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00404e98
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.004c69dc
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a3004
cmp eax, 0x64
je 0x5a35cb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a362b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.004c6560
ret

Function at 0x5a39b4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.0040542c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x5a39eb
mov edx, 0x5a3a8c
mov eax, dword [ebp - 4]
call fcn.005a3398
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
xor eax, eax
push ebp
push 0x5a3a73
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ecx, esi
mov edx, 1
call fcn.00479090
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a3004
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ecx, edi
mov edx, 2
call fcn.00479090
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a3004
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.004c69dc
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a3004
cmp eax, 0x64
jne 0x5a3a5a
mov ecx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
xor edx, edx
call fcn.00479504
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a3a7a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.004c6560
ret
Function at 0x5a3d4c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
jne 0x5a3d74
mov edx, 0x5a3e30
mov eax, dword [ebp - 4]
call fcn.005a3398
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
xor eax, eax
push ebp
push 0x5a3e14
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov edx, 1
call fcn.004c717c
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a3004
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov ecx, ebx
mov edx, 2
call fcn.00479090
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a3004
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
call fcn.004c69dc
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a3004
cmp eax, 0x64
jne 0x5a3ded
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
xor edx, edx
call fcn.004c6d80
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jmp 0x5a3dfb
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a3e1b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
call fcn.004c6560
ret

Function at 0x5a3e68
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2c], 0
jne 0x5a3e90
mov edx, 0x5a3f2c
mov eax, dword [ebp - 4]
call fcn.005a3398
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
xor eax, eax
push ebp
push 0x5a3f10
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
mov ecx, ebx
mov edx, 1
call fcn.00479090
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a3004
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.004c69dc
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.005a3004
cmp eax, 0x64
jne 0x5a3ee9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
xor edx, edx
call fcn.004c6d80
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jmp 0x5a3ef7
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a3f17
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.004c6560
ret
Function at 0x5a8958
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a8a47
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
lea eax, [ebp - 4]
mov cl, 4
call fcn.004036c0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005a85a8
mov ebx, eax
test ebx, ebx
mov eax, dword [ebp + 8]
setne byte [eax - 9]
mov eax, dword [ebp + 8]
cmp byte [eax - 9], 0
je 0x5a8a24
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xf
lea ecx, [ebp - 0x24]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov eax, dword [eax + 8]
mov dx, 0x27
call fcn.00478cc4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xf
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, ebx
call fcn.005a87e8
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x28]
mov dx, 0x27
call fcn.00478cc4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xf
lea edx, [ebp - 0x20]
mov ecx, 2
mov eax, 0x5a8a58
call fcn.0040b910
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0xffffffe8
call fcn.00405454
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a8a4e
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405408
lea eax, [ebp - 8]
call fcn.004053f0
ret

Function at 0x5a8b3c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x1c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a8c04
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
lea eax, [ebp - 4]
mov cl, 4
call fcn.004036c0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005a85a8
mov ebx, eax
test ebx, ebx
mov eax, dword [ebp + 8]
setne byte [eax - 9]
mov eax, dword [ebp + 8]
cmp byte [eax - 9], 0
je 0x5a8be6
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xf
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, ebx
call fcn.005a87e8
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x1c]
mov dx, 0x27
call fcn.00478cc4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xf
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x5a8c14
call fcn.0040b910
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0xffffffe8
call fcn.00405454
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a8c0b
lea eax, [ebp - 0x1c]
call fcn.004053f0
lea eax, [ebp - 8]
call fcn.004053f0
ret
Function at 0x40160a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
xor ebx, ebx
cmp eax, ebx
je 0x401697
cmp dword [esi + 8], ebx
je 0x401697
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], SysStringLen
call fcn.004014e3
pop ecx
pop ecx
push ebx
lea ecx, [ebp - 4]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401697
cmp dword [ebp - 4], ebx
je 0x401697
cmp dword [esi + 0x14], 1
jne 0x401665
push 4
lea eax, [esi + 0x10]
push eax
push 4
jmp 0x401679
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x40168e
push eax
call fcn.0041de70
pop ecx
push eax
push dword [esi + 0xc]
push 1
push ebx
push dword [esi + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x401f23
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc78
mov eax, dword [0x434450]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, 0x400
push eax
lea ecx, [ebp - 0xc6c]
push ecx
lea ecx, [ebp - 0xc74]
push ecx
lea ecx, [ebp - 0xc78]
push ecx
lea ecx, [ebp - 0xc70]
push ecx
push eax
lea eax, [ebp - 0x86c]
push eax
push 0x429674
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
xor esi, esi
test eax, eax
jne 0x401f78
mov dword [ebp - 0xc70], esi
push str.wrapper
push dword [ebp - 0xc70]
lea eax, [ebp - 0x46c]
push str.game
push str._s_lu_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x6c]
push esi
push eax
call fcn.004132b0
lea eax, [ebp - 0x46c]
push eax
call fcn.0041de70
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.004132f6
lea eax, [ebp - 0x6c]
push eax
call fcn.0041337c
mov edi, dword [ebp + 8]
push str.xxxx_xxxx_xxxx_xxxx
push edi
call fcn.0041e260
push str.ACDEFHJKMNPRSTWXYZ2345679
call fcn.0041de70
add esp, 0x3c
mov ebx, eax
lea ecx, [ebp - 0x14]
cmp esi, 4
je 0x40200a
cmp esi, 9
je 0x40200a
cmp esi, 0xe
je 0x40200a
movzx eax, byte [ecx]
xor edx, edx
div ebx
inc ecx
mov al, byte [edx + str.ACDEFHJKMNPRSTWXYZ2345679]
mov byte [esi + edi], al
inc esi
cmp esi, 0x13
jb 0x401fea
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0041e1ae
leave
ret

Function at 0x40201d
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
push edi
call fcn.0041de70
xor esi, esi
cmp dword [esp + 0x18], esi
pop ecx
mov ebx, eax
jbe 0x40204e
mov eax, dword [esp + 0x10]
lea ecx, [esi + eax]
xor edx, edx
mov eax, esi
div ebx
mov al, byte [edx + edi]
xor byte [ecx], al
inc esi
cmp esi, dword [esp + 0x14]
jb 0x402035
pop edi
pop esi
pop ebx
ret
Function at 0x4029da
Capabilities:
Set current directory
Terminate process

Disassembly:
mov eax, dword [0x52fafc]
test eax, eax
je 0x4029ea
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 4], 0
je 0x4029ff
push 1
push 0x52efe0
call fcn.0040fbf4
pop ecx
pop ecx
mov ecx, dword [0x52faf8]
test ecx, ecx
push esi
mov esi, ecx
je 0x402a18
call fcn.00411fbf
push esi
call fcn.0041de2b
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x402a21
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x4dc]
sub esp, 0x55c
mov eax, dword [0x434450]
push ebx
push esi
push edi
push 0x44
pop esi
push esi
mov dword [ebp + 0x4d8], eax
xor ebx, ebx
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.0041d8e0
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ebp - 0x80], esi
call fcn.0041d8e0
mov esi, 0x52f0e8
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0041e260
push dword [0x52fb6c]
lea eax, [ebp - 0x2c]
push eax
call fcn.0041e270
add esp, 0x28
cmp dword [ebp + 0x4e4], ebx
mov edi, 0x4296ec
je 0x402ab6
push dword [ebp + 0x4e4]
call fcn.0041de70
test eax, eax
pop ecx
jbe 0x402ab6
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.0041e270
push dword [ebp + 0x4e4]
lea eax, [ebp - 0x2c]
push eax
call fcn.0041e270
add esp, 0x10
push dword [0x52fb74]
call fcn.0041de70
test eax, eax
pop ecx
jbe 0x402ae2
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.0041e270
push dword [0x52fb74]
lea eax, [ebp - 0x2c]
push eax
call fcn.0041e270
add esp, 0x10
lea eax, [ebp + 0x3d4]
push esi
push eax
call fcn.0041e260
push dword [0x52fb6c]
lea eax, [ebp + 0x3d4]
push eax
call fcn.0041e270
lea eax, [ebp + 0x3d4]
push 0x5c
push eax
call fcn.0041ebd0
add esp, 0x18
cmp eax, ebx
je 0x402b26
mov byte [eax + 1], bl
lea eax, [ebp + 0x3d4]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 1
call fcn.004029da
int3
Function at 0x40910b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4284a0
call fcn.0041de0c
sub esp, 0x420
mov eax, dword [0x434450]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
call dword [0x433088]
xor ebx, ebx
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x420], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
cmp dword [ebp + 8], ebx
mov byte [ebp - 4], 1
je 0x4091b2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov edi, 0x400
cmp esi, edi
jg 0x409192
push esi
call fcn.0040169d
test al, al
pop ecx
je 0x409192
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.0041e140
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x40919e
push esi
lea ecx, [ebp - 0x420]
call fcn.00404b57
push dword [ebp - 0x41c]
push esi
push dword [ebp + 8]
push eax
call fcn.004017f2
cmp eax, ebx
jne 0x4091d5
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4091cb
lea ecx, [ebp - 0x418]
call fcn.00409308
mov esi, 0x8007000e
jmp 0x4092dc
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
cmp eax, ebx
mov dword [ebp - 0x41c], eax
jne 0x4091f5
call fcn.00405b6c
mov esi, eax
jmp 0x4092c3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
je 0x40921f
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x424], eax
jne 0x409229
call fcn.00405b6c
jmp 0x4092b5
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, edi
mov dword [ebp + 8], esi
mov byte [ebp - 4], 2
jbe 0x40925a
push eax
lea ecx, [ebp - 0x418]
call fcn.00409311
jmp 0x40926d
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x40926d
cmp dword [ebp - 0x418], ebx
mov dword [ebp - 4], 1
jne 0x409283
mov esi, 0x8007000e
jmp 0x4092b7
push esi
push dword [ebp - 0x424]
push dword [ebp - 0x418]
call fcn.0041e740
mov eax, dword [ebp - 0x418]
add esp, 0xc
push dword [ebp + 0x14]
mov byte [esi + eax], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.00409332
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4092dc
lea ecx, [ebp - 0x418]
call fcn.00409308
lea ecx, [ebp - 0x420]
call fcn.004027d2
mov eax, esi
lea esp, [ebp - 0x438]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0041e1ae
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x409fc6
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x434450]
push ebx
push esi
push 0x2001f
push dword [ebp + 0x9c]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp + 0x90], eax
mov dword [ebp - 0x74], esi
call fcn.00409ef7
cmp eax, esi
jne 0x40a04e
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x40a017
lea eax, [ebp - 0x70]
push eax
call fcn.00409fc6
cmp eax, esi
jne 0x40a04d
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x74]
je 0x40a00a
call fcn.00409ee0
push dword [ebp + 0x9c]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.00409ee0
mov ecx, dword [ebp + 0x90]
mov eax, esi
pop esi
pop ebx
call fcn.0041e1ae
add ebp, 0x94
leave
ret 4
Function at 0x40a45e
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x40a469
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x40dbab
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x434450]
push ebx
push esi
push edi
mov dword [ebp + 0x8c], eax
mov byte [ebp - 0x7d], 0
call fcn.0041de70
test eax, eax
pop ecx
jbe 0x40dbe1
cmp byte [eax + edi - 1], 0x5c
mov ebx, 0x42a7e4
jne 0x40dbe6
mov ebx, 0x42a7e0
xor eax, eax
xor esi, esi
test eax, eax
je 0x40dbf5
push eax
call fcn.0041e3a4
pop ecx
push esi
push ebx
push edi
lea eax, [ebp - 0x7c]
push str._s_stemp._d.dat
push eax
call fcn.0041f59d
lea eax, [ebp - 0x7c]
push 0x42a7cc
push eax
inc esi
call fcn.0041e721
add esp, 0x1c
test eax, eax
je 0x40dc23
cmp esi, 0x64
jl 0x40dbea
jmp 0x40dc4c
lea eax, [ebp - 0x7c]
push 0x42a7c8
push eax
call fcn.0041e721
test eax, eax
pop ecx
pop ecx
je 0x40dc4c
push eax
call fcn.0041e3a4
pop ecx
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 0x7d], 1
mov ecx, dword [ebp + 0x8c]
mov al, byte [ebp - 0x7d]
pop esi
pop ebx
call fcn.0041e1ae
add ebp, 0x90
leave
ret

Function at 0x40dc64
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [ebx + 0x70], edi
mov dword [ebp - 4], edi
jne 0x40dc7f
mov eax, 0x400
jmp 0x40dceb
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push str.SoftwareMicrosoftInternet_ExplorerNew_WindowsAllow
push SysReAllocString
mov dword [ebp + 8], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40dce1
mov eax, dword [ebx + 0x70]
cmp dword [eax], edi
je 0x40dcd6
push esi
xor esi, esi
push edi
push edi
push 3
push edi
push dword [esi + eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40dcca
or dword [ebp - 4], 0x20
mov eax, dword [ebx + 0x70]
add esi, 4
cmp dword [esi + eax], edi
jne 0x40dcb1
pop esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40dce8
mov dword [ebp - 4], 0x40
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret