joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4108d1
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
push edi
push 0x20
pop edi
movzx eax, word [esi + 0x454]
mov cl, al
shl dword [esi + 0x450], cl
cmp ax, di
jae 0x41093a
mov ecx, dword [esi + 0x448]
mov edx, dword [esi + 0x444]
mov al, byte [esi + 0x453]
mov byte [edx + ecx], al
inc dword [esi + 0x448]
mov edx, dword [esi + 0x448]
mov ecx, dword [esi + 0x444]
mov al, byte [esi + 0x452]
mov byte [edx + ecx], al
inc dword [esi + 0x448]
shl dword [esi + 0x450], 0x10
add word [esi + 0x454], 0x10
cmp word [esi + 0x454], di
jb 0x4108ec
mov word [esi + 0x454], di
mov ecx, esi
pop edi
pop esi
jmp fcn.004107f5

Function at 0x410d5a
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 8
push 0
lea eax, [esi + 0x44]
push eax
call fcn.004158c0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
pop esi
ret

Function at 0x4118f4
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
test eax, eax
je 0x411913
push esi
mov esi, dword [eax + 0x208]
push eax
call main
mov eax, esi
pop ecx
test esi, esi
jne 0x4118ff
pop esi
push dword [edi + 4]
push 4
push 1
push str.AU3_
call fcn.0041375f
push dword [edi + 4]
push 4
push 1
push 0x43c314
call fcn.0041375f
push dword [edi + 4]
call fcn.00412faf
add esp, 0x24
pop edi
ret
Function at 0x4176ac
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x438e48
call fcn.004186e0
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x417563
xor ebx, ebx
jmp 0x417596
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x41755f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x41755f
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x417596
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.00419f20
test eax, eax
jne 0x4175aa
push 0x1c
call main
pop ecx
call fcn.0041bf44
test eax, eax
jne 0x4175bb
push 0x10
call main
pop ecx
call fcn.00421536
and dword [ebp - 4], 0
call fcn.0041ad0b
test eax, eax
jns 0x4175d5
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov dword [0x440768], eax
call main
mov dword [0x43d24c], eax
call main
test eax, eax
jns 0x4175fb
push 8
call main
pop ecx
call fcn.0042136b
test eax, eax
jns 0x41760c
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x41761f
push eax
call main
pop ecx
call fcn.004215d3
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x417641
push esi
call main
call fcn.00419a7a
jmp 0x417676
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00418725
ret
call main
jmp 0x417535
Function at 0x4013c5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4159d0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x415b7a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
sub byte [esi + ebx], 0x7b
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x6a
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0x89
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xb1
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x25
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
add esp, 0x44
push eax
call fcn.0040616d
add byte [esi + ebx], 0x30
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x41
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xb
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xec
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xa8
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x7d
add esp, 0x40
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xb6
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0xe2
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x2a
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xbf
add esp, 0x30
inc esi
cmp esi, edi
jb 0x4159f0
pop ebx
pop edi
pop esi
ret

Function at 0x4035f3
Capabilities:
Terminate process

Disassembly:
jmp 0x453df9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x453e0a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405948
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40371f
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c842
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c853
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c729
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c87b
push ebx
push esi
push edi
call fcn.0040572c
add esp, 0xc
push 0
call fcn.004062b2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x404c3c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
mov edi, dword [0x417498]
cmp dword [edi + 8], 0
je 0x404c73
lea eax, [ebp - 4]
push eax
push dword [edi + 8]
call sub.kernel32.dll_GetExitCodeThread
push dword [ebp - 4]
push dword [edi + 8]
call sub.kernel32.dll_TerminateThread
push dword [edi + 8]
call sub.kernel32.dll_CloseHandle
add edi, 0x10
jmp 0x404c49
push dword [0x417498]
call sub.kernel32.dll_GlobalFree
mov dword [0x41749c], 0
mov edi, dword [0x417494]
inc edi
cmp dword [edi], 0
je 0x404ca7
push dword [edi]
call fcn.0040defc
push dword [edi]
call sub.user32.dll_DestroyWindow
add edi, 4
jmp 0x404c8f
push dword [0x41746c]
call fcn.0040613e
mov dword [0x41746c], 0
cmp dword [0x417488], 0
je 0x404ce1
push 0x8000
push 0
push dword [0x417488]
call sub.kernel32.dll_VirtualFree
mov dword [0x417488], 0
mov edi, dword [0x417420]
cmp dword [edi + 4], 0
je 0x404d03
push 0x8000
push 0
push dword [edi + 4]
call sub.kernel32.dll_VirtualFree
mov dword [edi + 4], 0
push dword [0x417474]
call fcn.00404227
push dword [0x417478]
call fcn.00404227
push dword [0x417f00]
call sub.gdi32.dll_DeleteObject
push dword [0x417f04]
call sub.gdi32.dll_DeleteObject
push 0x104
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov edi, eax
push edi
push 0x418248
call fcn.00408e8c
push edi
push str.EC2RUNDIALOGBOX
call fcn.00408e8c
push edi
push 0x418260
call fcn.00408e8c
push edi
push 0x418270
call fcn.00408e8c
push edi
push str.EC2RUNWINDOW
call fcn.00408e8c
push edi
push str.EC2RUNMDICHILDWINDOW
call fcn.00408e8c
push edi
push str.EC2RUNMDIWINDOW
call fcn.00408e8c
push edi
call sub.kernel32.dll_GlobalFree
pop edi
leave
ret
Function at 0x406ce8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push edi
push esi
push 1
push 0
push 0
push dword [ebp + 8]
call sub.kernel32.dll_SetFilePointer
mov dword [ebp - 4], eax
xor edi, edi
lea esi, [ebp - 0xc]
push 0
push 0
push 0
push dword [ebp + 8]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 8]
push eax
push 3
push esi
push dword [ebp + 8]
call sub.kernel32.dll_ReadFile
or eax, eax
je 0x406d48
cmp word [esi], 0xbbef
jne 0x406d48
cmp byte [esi + 2], 0xbf
jne 0x406d48
cmp dword [ebp - 4], 3
jae 0x406d43
mov dword [ebp - 4], 3
mov edi, 1
push 0
push 0
push dword [ebp - 4]
push dword [ebp + 8]
call sub.kernel32.dll_SetFilePointer
mov eax, edi
pop esi
pop edi
leave
ret 4

Function at 0x407bfd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
mov eax, dword [ebp + 0xc]
xor edi, edi
and ax, 0xe0
cmp ax, 0xc0
jne 0x407c1b
mov edi, 1
jmp 0x407c2d
mov eax, dword [ebp + 0xc]
and ax, 0xf0
cmp ax, 0xe0
jne 0x407c2d
mov edi, 2
or edi, edi
jne 0x407c3c
mov eax, 0xffffffff
pop esi
pop edi
leave
ret 8
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_ReadFile
mov eax, dword [ebp + 0xc]
xor edx, edx
lea esi, [ebp - 8]
mov ah, byte [edx + esi]
inc edx
xchg ah, al
mov cx, ax
and ch, 0xe0
cmp ch, 0xc0
jne 0x407c90
and cl, 0xc0
cmp cl, 0x80
jne 0x407c89
mov cl, al
xor al, al
and ah, 0x1f
shr ax, 2
and cl, 0x3f
or al, cl
jmp 0x407cc9
dec edx
mov ax, 0xffff
jmp 0x407cc9
mov ch, ah
and ch, 0xf0
cmp ch, 0xe0
jne 0x407c89
and cl, 0xc0
cmp cl, 0x80
jne 0x407c89
mov cl, al
xor al, al
and ah, 0xf
shr ax, 2
and cl, 0x3f
or al, cl
mov cl, byte [edx + esi]
mov ch, cl
and ch, 0xc0
cmp ch, 0x80
jne 0x407c89
inc edx
and cl, 0x3f
shl ax, 6
or al, cl
pop esi
pop edi
leave
ret 8
Function at 0x407ccf
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push ecx
push edx
push edi
push esi
push 0
push dword [ebp + 8]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
or eax, eax
je 0x407cf3
mov word [eax], 0
xor esi, esi
push 1
push 0
push 0
push dword [ebp + 8]
call sub.kernel32.dll_SetFilePointer
cmp eax, dword [ebp - 8]
jge 0x407d0d
mov esi, 1
mov ebx, dword [ebp + 0xc]
or ebx, ebx
jne 0x407d16
mov edi, eax
mov dword [ebp - 0xc], 0
push dword [ebp + 8]
call fcn.00406ce8
mov dword [ebp - 0xc], eax
or eax, eax
je 0x407d33
mov dword [ebp + 0x10], 1
push 1
push 0
push 0
push dword [ebp + 8]
call sub.kernel32.dll_SetFilePointer
cmp eax, dword [ebp - 8]
jge 0x407e86
mov word [ebp - 0xe], 0
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xe]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_ReadFile
or eax, eax
je 0x407e7d
cmp dword [ebp - 4], 0
je 0x407e7d
mov ax, word [ebp - 0xe]
cmp dword [ebp + 0x14], 0
je 0x407d87
cmp dword [ebp - 0xc], 0
je 0x407d89
xor ah, ah
cmp ax, 0xd
jne 0x407dde
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xe]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_ReadFile
or eax, eax
je 0x407dd2
cmp dword [ebp - 4], 0
je 0x407dd2
mov ax, word [ebp - 0xe]
cmp dword [ebp + 0x14], 0
jne 0x407dba
xor ah, ah
cmp ax, 0xa
je 0x407dd2
mov eax, dword [ebp + 0x10]
neg eax
push 1
push 0
push eax
push dword [ebp + 8]
call sub.kernel32.dll_SetFilePointer
mov eax, 1
jmp 0x407e88
cmp ax, 0xa
jne 0x407e2e
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xe]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_ReadFile
or eax, eax
je 0x407e27
cmp dword [ebp - 4], 0
je 0x407e27
mov ax, word [ebp - 0xe]
cmp dword [ebp + 0x14], 0
jne 0x407e0f
xor ah, ah
cmp ax, 0xd
je 0x407e27
mov eax, dword [ebp + 0x10]
neg eax
push 1
push 0
push eax
push dword [ebp + 8]
call sub.kernel32.dll_SetFilePointer
mov eax, 1
jmp 0x407e88
cmp dword [ebp - 0xc], 0
je 0x407e46
cmp ax, 0x7f
jbe 0x407e46
movzx eax, ax
push eax
push dword [ebp + 8]
call fcn.00407bfd
cmp dword [ebp + 0x14], 0
je 0x407e5a
cmp dword [ebp + 0xc], 0
je 0x407e55
mov word [ebx], ax
add ebx, 2
jmp 0x407e63
cmp dword [ebp + 0xc], 0
je 0x407e62
mov byte [ebx], al
inc ebx
or ax, ax
je 0x407e76
mov eax, ebx
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
jl 0x407d33
mov eax, 0xffffffff
jmp 0x407e88
mov eax, 0xffffffff
jmp 0x407e88
mov eax, esi
cmp dword [ebp + 0xc], 0
je 0x407e9d
mov byte [ebx], 0
cmp dword [ebp + 0x14], 0
je 0x407ebd
mov byte [ebx + 1], 0
jmp 0x407ebd
cmp eax, 0xffffffff
jne 0x407ea6
mov ebx, eax
jmp 0x407eae
inc ebx
cmp dword [ebp + 0x14], 0
je 0x407eae
inc ebx
push 0
push 0
push edi
push dword [ebp + 8]
call sub.kernel32.dll_SetFilePointer
mov eax, ebx
pop esi
pop edi
pop edx
pop ecx
pop ebx
leave
ret 0x10
Function at 0x40db76
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ecx
push edx
push edi
push esi
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x40dc78
mov dword [ebp - 8], 0x104
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push dword [0x41748c]
push 0
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0x103
je 0x40dc5a
push dword [0x41748c]
push dword [ebp - 4]
call sub.advapi32.dll_RegDeleteKeyA
cmp eax, 0
je 0x40db9e
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push 0x208
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov edi, eax
push dword [ebp + 0xc]
push edi
call sub.kernel32.dll_lstrcpyA
push edi
call sub.kernel32.dll_lstrlenA
or eax, eax
je 0x40dc1a
cmp byte [eax + edi - 1], 0x5c
je 0x40dc1a
mov byte [eax + edi], 0x5c
mov byte [eax + edi + 1], 0
push dword [0x41748c]
push edi
call sub.kernel32.dll_lstrcatA
push edi
push dword [ebp + 8]
call fcn.0040db76
push eax
push edi
call fcn.0040613e
pop eax
or eax, eax
je 0x40dc5a
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
cmp eax, 0
je 0x40db9e
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegDeleteKeyA
or eax, eax
jne 0x40dc78
mov eax, 1
jmp 0x40dc7a
xor eax, eax
pop esi
pop edi
pop edx
pop ecx
leave
ret 8

Function at 0x40dc82
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ecx
push edx
push edi
push esi
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExW
or eax, eax
jne 0x40dd8b
mov dword [ebp - 8], 0x208
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push dword [0x41748c]
push 0
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExW
cmp eax, 0x103
je 0x40dd6d
push dword [0x41748c]
push dword [ebp - 4]
call sub.advapi32.dll_RegDeleteKeyW
cmp eax, 0
je 0x40dcaa
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push 0x208
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov edi, eax
push dword [ebp + 0xc]
push edi
call sub.kernel32.dll_lstrcpyW
push edi
call sub.kernel32.dll_lstrlenW
or eax, eax
je 0x40dd2d
shl eax, 1
cmp word [eax + edi - 2], 0x5c
je 0x40dd2d
mov word [eax + edi], 0x5c
mov word [eax + edi + 2], 0
push dword [0x41748c]
push edi
call sub.kernel32.dll_lstrcatW
push edi
push dword [ebp + 8]
call fcn.0040dc82
push eax
push edi
call fcn.0040613e
pop eax
or eax, eax
je 0x40dd6d
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExW
cmp eax, 0
je 0x40dcaa
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegDeleteKeyW
or eax, eax
jne 0x40dd8b
mov eax, 1
jmp 0x40dd8d
xor eax, eax
pop esi
pop edi
pop edx
pop ecx
leave
ret 8
Function at 0x40ddba
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ecx
push edx
push esi
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x40ddfd
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegDeleteValueA
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
pop eax
or eax, eax
jne 0x40ddfd
mov eax, 1
jmp 0x40ddff
xor eax, eax
pop esi
pop edx
pop ecx
leave
ret 0xc

Function at 0x40de06
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ecx
push edx
push esi
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExW
or eax, eax
jne 0x40de49
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegDeleteValueW
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
pop eax
or eax, eax
jne 0x40de49
mov eax, 1
jmp 0x40de4b
xor eax, eax
pop esi
pop edx
pop ecx
leave
ret 0xc

Function at 0x40eaba
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ecx
push edx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jl 0x40eb4c
cmp dword [ebp + 8], 0x80000006
jg 0x40eb4c
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x40eb4c
cmp dword [ebp + 0x14], 0
je 0x40eb23
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call sub.advapi32.dll_RegQueryValueExA
jmp 0x40eb39
push 0
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call sub.advapi32.dll_RegQueryValueExA
or eax, eax
jne 0x40eb44
mov dword [ebp - 4], 1
push dword [ebp - 0x10]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 4]
pop edx
pop ecx
leave
ret 0x10

Function at 0x40eb55
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ecx
push edx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jl 0x40ebe7
cmp dword [ebp + 8], 0x80000006
jg 0x40ebe7
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x208
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExW
or eax, eax
jne 0x40ebe7
cmp dword [ebp + 0x14], 0
je 0x40ebbe
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call sub.advapi32.dll_RegQueryValueExW
jmp 0x40ebd4
push 0
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call sub.advapi32.dll_RegQueryValueExW
or eax, eax
jne 0x40ebdf
mov dword [ebp - 4], 1
push dword [ebp - 0x10]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 4]
pop edx
pop ecx
leave
ret 0x10
Function at 0x40ec18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ecx
push edx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jl 0x40ecaa
cmp dword [ebp + 8], 0x80000006
jg 0x40ecaa
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x104
lea eax, [ebp - 0x10]
push eax
push 0x20119
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x40ecaa
cmp dword [ebp + 0x14], 0
je 0x40ec81
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call sub.advapi32.dll_RegQueryValueExA
jmp 0x40ec97
push 0
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call sub.advapi32.dll_RegQueryValueExA
or eax, eax
jne 0x40eca2
mov dword [ebp - 4], 1
push dword [ebp - 0x10]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 4]
pop edx
pop ecx
leave
ret 0x10

Function at 0x40ecb3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ecx
push edx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jl 0x40ed45
cmp dword [ebp + 8], 0x80000006
jg 0x40ed45
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0x208
lea eax, [ebp - 0x10]
push eax
push 0x20119
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExW
or eax, eax
jne 0x40ed45
cmp dword [ebp + 0x14], 0
je 0x40ed1c
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call sub.advapi32.dll_RegQueryValueExW
jmp 0x40ed32
push 0
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call sub.advapi32.dll_RegQueryValueExW
or eax, eax
jne 0x40ed3d
mov dword [ebp - 4], 1
push dword [ebp - 0x10]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 4]
pop edx
pop ecx
leave
ret 0x10

Function at 0x40f866
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ecx
push edx
push esi
mov dword [ebp - 4], 0
mov esi, dword [ebp + 0xc]
or esi, esi
je 0x40f8e7
cmp byte [esi], 0
je 0x40f8e7
cmp dword [ebp + 8], 0x80000000
jl 0x40f8e7
cmp dword [ebp + 8], 0x80000006
jg 0x40f8e7
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2001f
push 0
push str.REG_SZ
push 0
push esi
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
cmp eax, 0
jne 0x40f8e7
push dword [ebp + 0x14]
call sub.kernel32.dll_lstrlenA
inc eax
push eax
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
or eax, eax
jne 0x40f8df
mov dword [ebp - 4], 1
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 4]
pop esi
pop edx
pop ecx
leave
ret 0x10
Function at 0x40f8f1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ecx
push edx
push esi
mov dword [ebp - 4], 0
mov esi, dword [ebp + 0xc]
or esi, esi
je 0x40f972
cmp word [esi], 0
je 0x40f972
cmp dword [ebp + 8], 0x80000000
jl 0x40f972
cmp dword [ebp + 8], 0x80000006
jg 0x40f972
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push esi
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExW
cmp eax, 0
jne 0x40f972
push dword [ebp + 0x14]
call sub.kernel32.dll_lstrlenW
inc eax
shl eax, 1
push eax
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExW
or eax, eax
jne 0x40f96a
mov dword [ebp - 4], 1
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 4]
pop esi
pop edx
pop ecx
leave
ret 0x10

Function at 0x40ffdf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push ecx
push edx
push esi
mov esi, dword [ebp + 0xc]
push dword [ebp + 0xc]
call sub.kernel32.dll_lstrlenA
mov ebx, eax
add esi, eax
or eax, eax
jne 0x410008
mov esi, 2
jmp 0x41008c
cmp eax, 1
jne 0x410024
cmp byte [esi - 1], 0xd
je 0x410019
cmp byte [esi - 1], 0xa
jne 0x410024
mov byte [esi - 1], 0
mov esi, 2
jmp 0x41008c
cmp byte [esi - 1], 0xa
jne 0x410030
cmp byte [esi - 2], 0xd
je 0x41003c
cmp byte [esi - 1], 0xd
jne 0x410040
cmp byte [esi - 2], 0xa
jne 0x410040
xor esi, esi
jmp 0x410052
cmp byte [esi - 1], 0xd
jne 0x41004d
mov esi, 1
jmp 0x410052
mov esi, 2
push 0
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.kernel32.dll_WriteFile
or eax, eax
je 0x4100a1
or esi, esi
je 0x4100a1
cmp esi, 1
jne 0x41008c
mov edx, 0x4186aa
add edx, 1
push 0
lea eax, [ebp - 4]
push eax
push 1
push edx
push dword [ebp + 8]
call sub.kernel32.dll_WriteFile
jmp 0x4100a1
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x4186ad
push dword [ebp + 8]
call sub.kernel32.dll_WriteFile
pop esi
pop edx
pop ecx
pop ebx
leave
ret 8