joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4155bb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00414f03
xor edi, edi
inc edi
test al, al
je 0x415658
call fcn.0042aae1
test al, al
je 0x4155f7
push ebx
lcall 0x10df, 0x660e8653
mov ebx, 0x6d8d95d9
out 0xce, eax
fnstcw word [ebx + esi - 1]
xor ebx, ebx
inc edi
call fcn.0042aa57
test al, al
je 0x415618
test byte [ecx], cl
je 0x41565d
mov bh, byte [esi - 0x25]
rcl byte [edx + edi - 0x14], cl
lea esp, [ecx]
mov ch, 0x8c
xchg esp, eax
shl dword [ecx - 0x6f], 1
jg 0x415632
aam 0x33
fisttp dword [ebp + 0x5d89f845]
clc
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
call int.00414d6b
pop ecx
test al, al
je 0x415658
push dword [ebp + 0xc]
push edi
push dword [ebp - 8]
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
adc byte [ebx - 1], dl
adc eax, sym.imp.SHELL32.dll_SHGetFolderPathW
test eax, eax
movzx ebx, bl
cmove ebx, edi
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x4156a3
call fcn.0042ab6b
test al, al
je 0x415680
xchg ebx, eax
clc
sbb eax, 0x6be78782
mov bl, 0xa5
dec ecx
invalid
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edx, dword [ebp - 4]
test eax, eax
push 1
movzx ecx, dl
pop eax
cmovne ecx, eax
mov byte [ebp - 4], cl
call fcn.0042af76
test al, al
je 0x4156c7
dec esi
jg 0x4156f4
add ah, bl
hlt
mov edx, dword [ebp - 4]
mov al, dl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add byte [ebp + 0x460374c0], al
jmp 0x41572c
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415733
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push 0x2a4
mov eax, 0x59cb6d
call fcn.005693c7
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x58]
call fcn.00402a71
mov esi, 0x5a3400
mov byte [ebp - 4], 1
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x58]
call fcn.00408c34
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2ac], eax
call fcn.0042ae62
test al, al
je 0x4157a5
int3
call fcn.0042ab6b
test al, al
je 0x4157cd
sub dword [ebx], esp
popal
sub eax, 0x8f3bbebf
push ebx
aad 0x40
ret 0x4712
call fcn.0042a988
test al, al
je 0x4157ec
std
daa
mul dword [edx]
adc al, 0x85
xchg ebp, eax
and cl, byte [ebp + 0x6da69ddb]
into
ficom word fs:[ebp + 0x16]
add dword [ebx + 0x54858b9d], edx
std
invalid
mov eax, dword [ebp - 0x2ac]
cmp eax, 0xffffffff
je 0x415928
push 0x2e
pop esi
mov edi, 0x5a0a50
lea ecx, [ebp - 0x2a8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x415928
cmp word [ebp - 0x27c], si
je 0x41591d
cmp word [ebp - 0x27a], 0
je 0x41591d
cmp word [ebp - 0x27a], si
jne 0x41584b
cmp word [ebp - 0x278], 0
je 0x41591d
xor eax, eax
mov dword [ebp - 0x2c], 7
xor ebx, ebx
mov word [ebp - 0x40], ax
mov dword [ebp - 0x30], ebx
cmp word [ebp - 0x27c], ax
je 0x415873
lea eax, [ebp - 0x27c]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x40]
call fcn.00403772
test byte [ebp - 0x2a8], 0x10
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
je 0x4158d5
call fcn.00402a71
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28]
call fcn.00408b95
push edi
call fcn.00578706
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00408c34
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00402a71
call int.00415733
jmp 0x415900
call fcn.00402a71
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x28]
call fcn.00408b95
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00402a71
call fcn.004159ca
add esp, 0x18
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00403628
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00403628
mov eax, dword [ebp - 0x2ac]
jmp 0x415803
call fcn.0042ab6b
test al, al
je 0x41594c
retf 0x7553
call fcn.0042aa12
test al, al
je 0x415973
xchg esp, eax
popal
xchg esi, eax
iretd
mov eax, dword [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4159ac
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 4
cmovae eax, dword [ebp + 8]
push 0
Function at 0x4159ca
Capabilities:
Delete file

Disassembly:
or byte [edx], ch
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00403628
push 0
push 1
lea ecx, [ebp + 8]
call fcn.00403628
call fcn.00569382
ret
push 0
mov eax, 0x59c8c5
call fcn.00569393
and dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x415ac9
call fcn.0042ae62
test al, al
je 0x415a0e
xor byte [esi - 0x1f556ba8], dl
test al, 0xc8
arpl word [eax + 0xf], di
dec eax
inc edi
inc dl
push esi
call fcn.0042ab6b
test al, al
je 0x415a36
cwde
mov dl, 0x7a
jp 0x4159a2
xchg ebx, ebp
cmpsd dword [esi], dword es:[edi]
and eax, 0xac7c89ee
jnp 0x415a5a
jmp 0x4159c4
les ebx, [eax + ebp*4 - 0x80]
pop esp
test al, 0x80
jns 0x415a19
invalid
call fcn.0042a988
test al, al
je 0x415a55
sal byte [esi + edx], 0x33
add byte [ebx], dh
pop ebx
mov ch, 0x39
into
mov dh, 0x56
mov dword [0x11741f21], eax
salc
invalid
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call int.00411c46
pop ecx
call fcn.0042af76
test al, al
je 0x415a83
inc ebp
or byte [edi], cl
inc ebx
inc ebp
or byte [eax - 0x18], dl
loopne 0x415a25
invalid
and al, 0xda
outsd dx, dword [esi]
mov edi, 0x99819b9e
jmp 0x415a1a
call fcn.0042aeec
test al, al
je 0x415aa7
jmp 0x415a3c
call fcn.0042aea7
test al, al
je 0x415ac9
mov dh, 3
jno 0x415aae
scasd eax, dword es:[edi]
aaa
repne outsd dx, dword [esi]
lcall 0xb2e5, 0x58d06539
adc al, 0xc3
invalid
push 0
push 1
lea ecx, [ebp + 8]
call fcn.00403628
xor eax, eax
inc eax
call fcn.0056936d
ret
Function at 0x415ade
Capabilities:
Enumerate processes

Disassembly:
push 0x280
mov eax, 0x59cce2
call fcn.005693c7
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x28c], ebx
test eax, eax
je 0x415ccb
push eax
lea ecx, [ebp - 0x40]
call fcn.00402ac4
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call fcn.0041937c
mov edi, 0x22c
lea eax, [ebp - 0x284]
push edi
push 0
push eax
call fcn.0056f390
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x28c], esi
cmp esi, 0xffffffff
je 0x415cbb
call fcn.0042ad4e
test al, al
je 0x415b60
popfd
cmp al, 0x2e
push ss
cmp edi, dword [esi + edx*4]
ror dword [eax + 0x1f], cl
movsd dword es:[edi], dword [esi]
in eax, dx
invalid
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x415c38
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
je 0x415b9f
lea eax, [ebp - 0x260]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403772
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0041937c
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040383c
test eax, eax
je 0x415bf3
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00419a01
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
or ebx, 1
call fcn.0040383c
mov byte [ebp - 0x285], 0
test eax, eax
jne 0x415bfa
mov byte [ebp - 0x285], 1
test bl, 1
je 0x415c0e
push 0
push 1
lea ecx, [ebp - 0x58]
and ebx, 0xfffffffe
call fcn.00403628
cmp byte [ebp - 0x285], 0
jne 0x415cd1
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00403628
lea eax, [ebp - 0x284]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x415b78
call fcn.0042ae62
test al, al
je 0x415c68
stosd dword es:[edi], eax
xor eax, 0x3b058c82
cmpsb byte [esi], byte es:[edi]
pushal
add eax, 0xe9034b76
cmp esi, dword [eax + ebp*2 + 0x6d]
mov bh, 0x31
xor al, 0x58
sar dh, 0xf8
inc esi
mov al, 0x72
add dl, cl
jbe 0x415cc6
call fcn.0042a8fe
test al, al
je 0x415c8a
lodsd eax, dword [esi]
retf 0x124f
call fcn.0042abb0
test al, al
je 0x415caf
insd dword es:[edi], dx
pop ecx
mov dword [0xd9a545fb], eax
cmpsd dword [esi], dword es:[edi]
les edx, [0xaaafc68c]
movsb byte es:[edi], byte [esi]
mov al, byte [0xd664f4f4]
inc ebx
cwde
das
add edi, esp
invalid
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00403628
mov eax, esi
fsin
dec dword [ebx + 0x36b2e8c6]
adc eax, 0xff56c300
adc eax, sym.imp.KERNEL32.dll_CloseHandle
call fcn.00569382
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x27c]
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00403628
jmp 0x415cbd
Function at 0x416241
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call fcn.0056f390
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x2c], eax
mov eax, 0x200
lea ecx, [eax + 0x40]
cmovne eax, ecx
xor edi, edi
mov dword [ebp - 0x38], eax
inc edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], eax
call fcn.0041b7a3
test eax, eax
mov ecx, str.runas
lea eax, [ebp - 0x3c]
cmovne ecx, dword [ebp - 0x30]
push eax
mov dword [ebp - 0x30], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4162b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, edi
cmove eax, ecx
jmp 0x4162c7
cmp dword [ebp + 0x10], 0
je 0x4162c5
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4172f9
Capabilities:
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa38
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x5a06d8
mov dword [ebp - 0xa38], eax
call fcn.00403772
push 0x20a
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x105
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x41735b
xor al, al
jmp 0x417519
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
call ebx
mov esi, eax
test esi, esi
je 0x417354
push edi
xor ecx, ecx
lea eax, [esi + 1]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00569947
mov edi, eax
pop ecx
test edi, edi
je 0x4173d0
lea eax, [esi*2 + 2]
push eax
push 0
push edi
call fcn.0056f390
add esp, 0xc
push edi
push esi
call ebx
test eax, eax
je 0x4173c9
mov eax, dword [0x5a39b4]
mov ebx, 0x208
mov dword [ebp - 0xc], eax
mov ax, word [0x5a39b8]
push ebx
mov word [ebp - 8], ax
call fcn.00569947
mov esi, eax
pop ecx
test esi, esi
jne 0x4173d7
push edi
call fcn.0056947b
pop ecx
xor al, al
jmp 0x417518
push ebx
push 0
push esi
call fcn.0056f390
add esp, 0xc
mov ebx, edi
mov ax, word [ebx]
push 0x104
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x41745c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x417504
push esi
call fcn.0056947b
xor eax, eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00569947
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x417504
push 2
pop eax
push eax
push 0
push esi
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0xc]
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x417504
push esi
call fcn.00578706
push eax
mov dword [ebp - 0xa34], eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0057d1f9
add esp, 0x10
test eax, eax
je 0x417497
push 2
pop ecx
movzx eax, word [ebx]
add ebx, ecx
test ax, ax
jne 0x417480
xor eax, eax
cmp word [ebx], ax
jne 0x4173e5
jmp 0x417504
push 0x800
xor ebx, ebx
lea eax, [ebp - 0xa18]
push ebx
push eax
call fcn.0056f390
mov eax, dword [ebp - 0xa34]
lea ecx, [ebp - 0x218]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x5a0ac0
lea eax, [ebp - 0xa18]
push 0x400
push eax
call fcn.0041796e
add esp, 0x20
lea eax, [ebp - 0xa18]
lea ecx, [ebp - 0xa30]
push eax
call fcn.00402ac4
mov ecx, dword [ebp - 0xa38]
push eax
call fcn.00402b42
push ebx
push 1
lea ecx, [ebp - 0xa30]
call fcn.00403628
push edi
call fcn.0056947b
pop ecx
test esi, esi
je 0x417516
push esi
call fcn.0056947b
pop ecx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret
Function at 0x417529
Capabilities:
Enumerate processes

Disassembly:
push 0x46c
mov eax, 0x59cc76
call fcn.005693c7
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x230]
xor ebx, ebx
mov dword [ebp - 0x21c], 7
push ebx
xor eax, eax
mov dword [ebp - 0x478], ebx
push 0x5a06d8
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
call fcn.00403772
mov esi, 0x22c
mov dword [ebp - 4], ebx
push esi
lea eax, [ebp - 0x474]
push ebx
push eax
call fcn.0056f390
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4175a6
push 0x5a06d8
mov ecx, edi
call fcn.00402ac4
jmp 0x41773c
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], esi
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x417727
mov esi, dword [ebp + 0xc]
and dword [ebp - 0x238], 0
xor eax, eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
cmp word [ebp - 0x450], ax
je 0x4175f4
lea eax, [ebp - 0x450]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x248]
call fcn.00403772
mov byte [ebp - 4], 1
cmp dword [ebp - 0x46c], esi
je 0x41763c
push 0
push 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0
call fcn.00403628
lea eax, [ebp - 0x474]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4175c4
jmp 0x417727
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056f390
add esp, 0xc
push dword [ebp - 0x46c]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x417718
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
cmp word [ebp - 0x218], 0
jne 0x417691
xor eax, eax
jmp 0x41769e
lea eax, [ebp - 0x218]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00403772
push 0x5a06d8
lea ecx, [ebp - 0x230]
call fcn.00408d28
test eax, eax
jne 0x417711
lea eax, [ebp - 0x230]
push eax
push esi
call fcn.004172f9
pop ecx
pop ecx
push 0x5a06d8
lea ecx, [ebp - 0x230]
call fcn.00408d28
test eax, eax
jne 0x417711
cmp word [ebp - 0x450], ax
je 0x4176fe
lea eax, [ebp - 0x450]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x230]
call fcn.00403772
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.00403628
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.00402a4c
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.00403628
mov eax, edi
call fcn.00569382
ret
Function at 0x417829
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x208
push 0
push eax
call fcn.0056f390
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4178ae
lea eax, [ebp - 0x218]
push eax
push 4
lea eax, [ebp - 0x210]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4178a7
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00402ac4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0056935c
mov esp, ebp
pop ebp
ret

Function at 0x417a85
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x244
mov eax, 0x59cd4d
call fcn.005693c7
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
and dword [ebp - 0x24c], 0
push 0x208
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056f390
add esp, 0xc
call fcn.0042ac7f
test al, al
je 0x417ad8
lcall 0x3525, 0xb765d636
jns 0x417ab4
push esi
stc
les esi, [ecx + 0xa]
pushfd
invalid
push 0x104
lea eax, [ebp - 0x218]
xor esi, esi
push eax
push esi
jmp 0x417be0
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x417bd2
call fcn.0042ad4e
test al, al
je 0x417b22
mov esp, 0x4620a6b7
mov byte [esi], dl
into
jno 0x417b57
js 0x417b6d
adc al, 0x1c
cdq
jg 0x417aa6
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x417b52
movsd dword es:[edi], dword [esi]
loopne 0x417b23
invalid
lea eax, [ebp - 0x218]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00403772
and dword [ebp - 4], 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0041a8f3
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.00403628
cmp dword [ebp - 0x234], 0x10
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
push dword [ebp - 0x250]
call fcn.004178ce
pop ecx
pop ecx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
push 0
push 1
call fcn.00404928
invalid
invalid
push 0x104
lea eax, [ebp - 0x218]
inc esi
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x417aec
call fcn.00569382
ret
Function at 0x4180bf
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x59b7a4
call fcn.00569393
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00403ac6
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.00403b8c
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x4180ff
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41815f
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x41813a
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41815f
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.00403ad9
call fcn.0056936d
ret
Function at 0x418daa
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.0042af76
test al, al
je 0x418de4
jge 0x418e2f
xor eax, 0x6e4a2d6a
push ebp
shl ebx, 0x68
mov al, 0xd8
sbb byte [ebx - 0x74], al
and esp, dword [eax - 0x5a]
jns 0x418e2b
sub cl, al
mov al, byte [0xdb3379b8]
lea eax, [ebp - 0xc]
mov esi, 0xf013f
push eax
push esi
push ebx
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418f1a
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x418f11
call fcn.0042add8
test al, al
je 0x418e40
sal byte [edx + edx - 5], 0x4e
sti
dec esi
pop ss
adc edx, esi
mov al, 0xd1
xor al, 0x1e
sbb eax, 0xa5e56638
xor ecx, dword [ebp + 0x6c]
insd dword es:[edi], dx
call fcn.0042aa9c
test al, al
je 0x418e64
jp 0x418e87
sub ecx, dword [edx + 0x7d]
ljmp 0x376a
call fcn.0042aa9c
test al, al
je 0x418e88
cmp esp, dword [ebp - 0x1b]
mov byte [0xf651f5e9], al
cmc
out dx, eax
pushal
stc
invalid
mov cl, 0x33
test byte [ebp + 0x5056fc45], 0x56
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0xf013f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x418eba
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
jmp 0x418f1a
push dword [ebp + 0x14]
call fcn.00578706
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042a9cd
test al, al
je 0x418f08
iretd
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret