joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41471e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
mov dword [ebp - 0x208], 0
cmp dword [0x42a168], 0
jne 0x414748
xor eax, eax
jmp 0x414920
test byte [ebp + 0xc], 0x10
jne 0x414759
xor eax, eax
jmp 0x414920
push 0x200
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x53b48c
lea eax, [ebp - 0x204]
push eax
call fcn.0041bfb0
add esp, 8
cmp dword [ebp + 8], 0
je 0x4147d0
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0041bdf0
add esp, 4
add eax, 0x32
push eax
call fcn.0041cee8
add esp, 8
mov dword [ebp - 0x208], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x208]
push eax
call fcn.0041bfa0
add esp, 8
push 0x53b49c
mov eax, dword [ebp - 0x208]
push eax
call fcn.0041bfb0
add esp, 8
push 0
push 0x4600
push 0x51f018
mov eax, dword [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.00414b28
add esp, 0x14
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x41480e
mov eax, dword [ebp - 0x208]
push eax
call fcn.0041c090
add esp, 4
cmp dword [ebp - 4], 0xffffffff
jne 0x41482f
push 0x2004012
call fcn.004042f8
add esp, 4
mov eax, 0xffffffff
jmp 0x414920
push 0x200
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x53b4ac
lea eax, [ebp - 0x204]
push eax
call fcn.0041bfb0
add esp, 8
push 0x53b4b4
lea eax, [ebp - 0x204]
push eax
call fcn.0041bfb0
add esp, 8
cmp dword [ebp + 8], 0
je 0x4148ba
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0041bdf0
add esp, 4
add eax, 0x32
push eax
call fcn.0041cee8
add esp, 8
mov dword [ebp - 0x208], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x208]
push eax
call fcn.0041bfa0
add esp, 8
push 0x53b4c4
mov eax, dword [ebp - 0x208]
push eax
call fcn.0041bfb0
add esp, 8
push 0
push 0x682
push 0x523618
mov eax, dword [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.00414b28
add esp, 0x14
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x4148f8
mov eax, dword [ebp - 0x208]
push eax
call fcn.0041c090
add esp, 4
cmp dword [ebp - 4], 0xffffffff
jne 0x414919
push 0x2004013
call fcn.004042f8
add esp, 4
mov eax, 0xffffffff
jmp 0x414920
xor eax, eax
jmp 0x414920
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414925
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
mov dword [ebp - 0x208], 0
test byte [ebp + 0xc], 0x10
jne 0x41494c
xor eax, eax
jmp 0x414b23
push 0x200
push 0x5a2020
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x5a2020
lea eax, [ebp - 0x204]
push eax
call fcn.0041bfa0
add esp, 8
push 0x53b4d4
lea eax, [ebp - 0x204]
push eax
call fcn.0041bfb0
add esp, 8
push 0x53b4e8
lea eax, [ebp - 0x204]
push eax
call fcn.0041bfb0
add esp, 8
cmp dword [ebp + 8], 0
je 0x4149e9
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0041bdf0
add esp, 4
add eax, 0x32
push eax
call fcn.0041cee8
add esp, 8
mov dword [ebp - 0x208], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x208]
push eax
call fcn.0041bfa0
add esp, 8
push 0x53b4f4
mov eax, dword [ebp - 0x208]
push eax
call fcn.0041bfb0
add esp, 8
push 0
call fcn.0040607f
push eax
push 0x42a1f8
mov eax, dword [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.00414b28
add esp, 0x14
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x414a28
mov eax, dword [ebp - 0x208]
push eax
call fcn.0041c090
add esp, 4
cmp dword [ebp - 4], 0xffffffff
jne 0x414a3c
mov eax, 0xffffffff
jmp 0x414b23
push 0x5a2020
lea eax, [ebp - 0x204]
push eax
call fcn.0041bfa0
add esp, 8
push 0x53b500
lea eax, [ebp - 0x204]
push eax
call fcn.0041bfb0
add esp, 8
push 0x53b508
lea eax, [ebp - 0x204]
push eax
call fcn.0041bfb0
add esp, 8
cmp dword [ebp + 8], 0
je 0x414ac9
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0041bdf0
add esp, 4
add eax, 0x32
push eax
call fcn.0041cee8
add esp, 8
mov dword [ebp - 0x208], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x208]
push eax
call fcn.0041bfa0
add esp, 8
push 0x53b514
mov eax, dword [ebp - 0x208]
push eax
call fcn.0041bfb0
add esp, 8
push 0
call fcn.004060a9
push eax
push 0x42ebf8
mov eax, dword [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.00414b28
add esp, 0x14
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x414b08
mov eax, dword [ebp - 0x208]
push eax
call fcn.0041c090
add esp, 4
cmp dword [ebp - 4], 0xffffffff
jne 0x414b1c
mov eax, 0xffffffff
jmp 0x414b23
xor eax, eax
jmp 0x414b23
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414cb7
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x5a2424
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5a2000], eax
cmp dword [0x5a2000], 2
jne 0x414cf1
xor eax, eax
jmp 0x414dbc
cmp dword [0x5a2000], 0
je 0x414d15
push 0x10001
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x414dbc
cmp dword [ebp + 0xc], 0
je 0x414d39
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [0x5a2424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [0x5a2000], eax
jmp 0x414d4d
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [0x5a2000], eax
cmp dword [0x5a2000], 0
je 0x414d8a
cmp dword [0x5a2000], 2
je 0x414d8a
mov eax, dword [0x5a2424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10005
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x414dbc
mov eax, dword [0x5a2424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x414db5
push 0x10002
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x414dbc
xor eax, eax
jmp 0x414dbc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x414dc1
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], 0
test byte [ebp + 8], 4
je 0x414e84
push 0x200
push 0x5a2220
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x200
push 0x5a1dc0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x53b59c
push 0x5a2220
call fcn.0041bfb0
add esp, 8
push 0x53b5a8
push 0x5a1dc0
call fcn.0041bfb0
add esp, 8
push 0x53b5b0
push 0x5a1dc0
call fcn.0041bfb0
add esp, 8
push 0x5a2220
call fcn.00406151
add esp, 4
test eax, eax
jne 0x414e84
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x414e84
cmp dword [ebp - 8], 5
jne 0x414e70
push 0x4000b
call fcn.0040435c
add esp, 4
push 0x2004007
call fcn.004042f8
add esp, 4
mov dword [ebp - 4], 0xffffffff
test byte [ebp + 8], 8
je 0x414f56
push 0x200
push 0x5a2220
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x53b5c0
push 0x5a2220
call fcn.0041bfb0
add esp, 8
push 0x5a2220
call fcn.00406151
add esp, 4
test eax, eax
jne 0x414f03
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x414f03
cmp dword [ebp - 8], 5
jne 0x414eef
push 0x4000b
call fcn.0040435c
add esp, 4
push 0x200400f
call fcn.004042f8
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x5a1dc0
call fcn.00406151
add esp, 4
test eax, eax
jne 0x414f56
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x414f56
cmp dword [ebp - 8], 5
jne 0x414f42
push 0x4000b
call fcn.0040435c
add esp, 4
push 0x200401d
call fcn.004042f8
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
jmp 0x414f5e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414f63
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], 0
test byte [ebp + 8], 1
je 0x415079
push 0x200
push 0x5a2220
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x200
push 0x5a1dc0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x53b5d0
push 0x5a1dc0
call fcn.0041bfb0
add esp, 8
push 0x53b5d8
push 0x5a2220
call fcn.0041bfb0
add esp, 8
push 0x5a2220
call fcn.00406151
add esp, 4
test eax, eax
jne 0x415014
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x415014
cmp dword [ebp - 8], 5
jne 0x415000
push 0x4000b
call fcn.0040435c
add esp, 4
push 0x2004017
call fcn.004042f8
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x53b5e8
push 0x5a1dc0
call fcn.0041bfb0
add esp, 8
push 0x5a1dc0
call fcn.00406151
add esp, 4
test eax, eax
jne 0x415079
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x415079
cmp dword [ebp - 8], 5
jne 0x415065
push 0x4000b
call fcn.0040435c
add esp, 4
push 0x200401d
call fcn.004042f8
add esp, 4
mov dword [ebp - 4], 0xffffffff
test byte [ebp + 8], 2
je 0x4150f8
push 0x200
push 0x5a2220
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x53b5f8
push 0x5a2220
call fcn.0041bfb0
add esp, 8
push 0x5a2220
call fcn.00406151
add esp, 4
test eax, eax
jne 0x4150f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x4150f8
cmp dword [ebp - 8], 5
jne 0x4150e4
push 0x4000b
call fcn.0040435c
add esp, 4
push 0x2004019
call fcn.004042f8
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
jmp 0x415100
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415105
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x608
push ebx
push esi
push edi
mov dword [ebp - 0x404], 0
push 0x200
push 0x5a2220
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5a2220
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfa0
add esp, 8
push 0x5a2220
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfa0
add esp, 8
push 0x53b604
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfb0
add esp, 8
push 0x53b610
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfb0
add esp, 8
push 0x200
push 0x5a2020
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x5a2020
lea eax, [ebp - 0x608]
push eax
call fcn.0041bfa0
add esp, 8
push 0x53b61c
lea eax, [ebp - 0x608]
push eax
call fcn.0041bfb0
add esp, 8
push 0x53b630
lea eax, [ebp - 0x608]
push eax
call fcn.0041bfb0
add esp, 8
lea eax, [ebp - 0x400]
push eax
call fcn.00406151
add esp, 4
test eax, eax
jne 0x415228
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 2
je 0x415228
cmp dword [ebp - 0x408], 5
jne 0x415211
push 0x4000b
call fcn.0040435c
add esp, 4
push 0x2004010
call fcn.004042f8
add esp, 4
mov dword [ebp - 0x404], 0xffffffff
lea eax, [ebp - 0x200]
push eax
call fcn.00406151
add esp, 4
test eax, eax
jne 0x415289
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 2
je 0x415289
cmp dword [ebp - 0x408], 5
jne 0x415272
push 0x4000b
call fcn.0040435c
add esp, 4
push 0x2004011
call fcn.004042f8
add esp, 4
mov dword [ebp - 0x404], 0xffffffff
cmp dword [ebp + 8], 0
je 0x41529e
mov eax, dword [ebp - 0x404]
jmp 0x415314
test byte [ebp + 0xc], 0x10
je 0x415309
lea eax, [ebp - 0x608]
push eax
call fcn.00406151
add esp, 4
test eax, eax
jne 0x415309
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 2
je 0x415309
cmp dword [ebp - 0x408], 5
jne 0x4152f2
push 0x4000b
call fcn.0040435c
add esp, 4
push 0x2004010
call fcn.004042f8
add esp, 4
mov dword [ebp - 0x404], 0xffffffff
mov eax, dword [ebp - 0x404]
jmp 0x415314
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415319
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x608
push ebx
push esi
push edi
mov dword [ebp - 0x404], 0
push 0x200
push 0x5a2220
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x200
push 0x5a2020
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x5a2220
lea eax, [ebp - 0x608]
push eax
call fcn.0041bfa0
add esp, 8
push 0x53b63c
lea eax, [ebp - 0x608]
push eax
call fcn.0041bfb0
add esp, 8
push 0x5a2220
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfa0
add esp, 8
push 0x53b64c
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfb0
add esp, 8
push 0x5a2020
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfa0
add esp, 8
push 0x53b65c
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfb0
add esp, 8
push 0x53b664
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfb0
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.00406151
add esp, 4
test eax, eax
jne 0x41543c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 2
je 0x41543c
cmp dword [ebp - 0x408], 5
jne 0x415425
push 0x4000b
call fcn.0040435c
add esp, 4
push 0x2004011
call fcn.004042f8
add esp, 4
mov dword [ebp - 0x404], 0xffffffff
cmp dword [ebp + 8], 0
je 0x415451
mov eax, dword [ebp - 0x404]
jmp 0x415528
test byte [ebp + 0xc], 0x10
je 0x41551d
lea eax, [ebp - 0x608]
push eax
call fcn.00406151
add esp, 4
test eax, eax
jne 0x4154bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 2
je 0x4154bc
cmp dword [ebp - 0x408], 5
jne 0x4154a5
push 0x4000b
call fcn.0040435c
add esp, 4
push 0x2004010
call fcn.004042f8
add esp, 4
mov dword [ebp - 0x404], 0xffffffff
lea eax, [ebp - 0x400]
push eax
call fcn.00406151
add esp, 4
test eax, eax
jne 0x41551d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 2
je 0x41551d
cmp dword [ebp - 0x408], 5
jne 0x415506
push 0x4000b
call fcn.0040435c
add esp, 4
push 0x2004010
call fcn.004042f8
add esp, 4
mov dword [ebp - 0x404], 0xffffffff
mov eax, dword [ebp - 0x404]
jmp 0x415528
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41552d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
push 0x200
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfa0
add esp, 8
push 0x53b674
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfb0
add esp, 8
lea eax, [ebp - 0x400]
push eax
call fcn.00415864
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x20], 0xffffffff
jne 0x4155a1
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], 0
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfa0
add esp, 8
push 0x53b684
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfb0
add esp, 8
lea eax, [ebp - 0x400]
push eax
call fcn.00415864
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 0xffffffff
jne 0x4155f7
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfa0
add esp, 8
push 0x53b690
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfb0
add esp, 8
lea eax, [ebp - 0x400]
push eax
call fcn.004183d3
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xffffffff
jne 0x41564d
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfa0
add esp, 8
push 0x53b6a0
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfb0
add esp, 8
lea eax, [ebp - 0x400]
push eax
call fcn.00418410
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0xffffffff
jne 0x4156a3
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
cmp dword [ebp + 0xc], 0
je 0x4156ec
push 0x200
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x53b6ac
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfb0
add esp, 8
push 0x53b6c0
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfb0
add esp, 8
jmp 0x415716
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfa0
add esp, 8
push 0x53b6cc
lea eax, [ebp - 0x400]
push eax
call fcn.0041bfb0
add esp, 8
lea eax, [ebp - 0x400]
push eax
call fcn.00418410
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x24], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], 0xffffffff
jne 0x415742
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], 0
xor eax, eax
jmp 0x415749
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418c4e
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2f28
call fcn.0041c5f0
push ebx
push esi
push edi
mov dword [ebp - 8], 0x1388
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x818], 0
lea eax, [ebp - 0x814]
push eax
push 0xf003f
push 0
push 0x5a075c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x418cc5
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x10001
mov eax, dword [ebp - 0x80c]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
jmp 0x418ec7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2f28]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x5a0794
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x418d02
mov byte [ebp - 0x2f28], 0
mov eax, dword [ebp - 0x810]
xor ecx, ecx
mov cl, byte [ebp + eax - 0x2f28]
test ecx, ecx
je 0x418dd4
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
lea eax, [ebp - 0x808]
push eax
call fcn.0041bfa0
add esp, 8
lea eax, [ebp - 0x808]
push eax
call fcn.0041c544
add esp, 4
push 0x5a0798
lea eax, [ebp - 0x808]
push eax
call fcn.0041c320
add esp, 8
test eax, eax
jne 0x418daa
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041bfa0
add esp, 8
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041bdf0
add esp, 4
mov ecx, dword [ebp - 0x818]
add ecx, eax
inc ecx
mov dword [ebp - 0x818], ecx
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
call fcn.0041bdf0
add esp, 4
mov ecx, dword [ebp - 0x810]
add ecx, eax
inc ecx
mov dword [ebp - 0x810], ecx
jmp 0x418d02
push 0x5a07a4
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041bfa0
add esp, 8
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041bdf0
add esp, 4
mov ecx, dword [ebp - 0x818]
add ecx, eax
inc ecx
mov dword [ebp - 0x818], ecx
mov eax, dword [ebp - 0x818]
mov byte [ebp + eax - 0x1ba0], 0
mov eax, dword [ebp - 0x818]
inc eax
push eax
lea eax, [ebp - 0x1ba0]
push eax
push 7
push 0
push 0x5a07b0
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x418e82
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x10006
mov eax, dword [ebp - 0x80c]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x418ec7
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x418ebd
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x10002
mov eax, dword [ebp - 0x80c]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
jmp 0x418ec7
mov eax, 1
jmp 0x418ec7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418ecc
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2f28
call fcn.0041c5f0
push ebx
push esi
push edi
mov dword [ebp - 8], 0x1388
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x818], 0
lea eax, [ebp - 0x814]
push eax
push 0xf003f
push 0
push 0x5a07b4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x418f43
mov eax, dword [ebp + 8]
mov dword [eax], 0x10001
mov eax, dword [ebp - 0x80c]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
jmp 0x419126
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2f28]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x5a07ec
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x418fa1
mov eax, dword [ebp + 8]
mov dword [eax], 0x10006
mov eax, dword [ebp - 0x80c]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x419126
mov eax, dword [ebp - 0x810]
xor ecx, ecx
mov cl, byte [ebp + eax - 0x2f28]
test ecx, ecx
je 0x419073
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
lea eax, [ebp - 0x808]
push eax
call fcn.0041bfa0
add esp, 8
lea eax, [ebp - 0x808]
push eax
call fcn.0041c544
add esp, 4
push 0x5a07f0
lea eax, [ebp - 0x808]
push eax
call fcn.0041c320
add esp, 8
test eax, eax
jne 0x419049
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041bfa0
add esp, 8
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041bdf0
add esp, 4
mov ecx, dword [ebp - 0x818]
add ecx, eax
inc ecx
mov dword [ebp - 0x818], ecx
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
call fcn.0041bdf0
add esp, 4
mov ecx, dword [ebp - 0x810]
add ecx, eax
inc ecx
mov dword [ebp - 0x810], ecx
jmp 0x418fa1
mov eax, dword [ebp - 0x818]
mov byte [ebp + eax - 0x1ba0], 0
mov eax, dword [ebp - 0x818]
inc eax
push eax
lea eax, [ebp - 0x1ba0]
push eax
push 7
push 0
push 0x5a07fc
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x4190e1
mov eax, dword [ebp + 8]
mov dword [eax], 0x10006
mov eax, dword [ebp - 0x80c]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x419126
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x41911c
mov eax, dword [ebp + 8]
mov dword [eax], 0x10002
mov eax, dword [ebp - 0x80c]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
jmp 0x419126
mov eax, 1
jmp 0x419126
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41912b
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, 0x5a0800
lea ecx, [ebp - 0xc]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov al, byte [eax + 8]
mov byte [ecx + 8], al
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push 0x5a080c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x419176
xor eax, eax
jmp 0x419284
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0xf003f
push 0
push 0x5a0840
push 0
push 0x5a0844
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4191bb
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x419284
lea eax, [ebp - 0xc]
push eax
call fcn.0041bdf0
add esp, 4
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push 0x5a0864
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0xf003f
push 0
push 0x5a086c
push 0
push 0x5a0870
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41922e
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x419284
lea eax, [ebp - 0xc]
push eax
call fcn.0041bdf0
add esp, 4
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push 0x5a08a0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
je 0x41927a
xor eax, eax
jmp 0x419284
mov eax, 1
jmp 0x419284
pop edi
pop esi
pop ebx
leave
ret