joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aa8aa
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x509690]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x18], bl
push edi
je 0x4aa91b
cmp dword [esi + 0x10], ebx
je 0x4aa91b
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.0044ef50
cmp esp, ebx
mov dword [ebp - 8], esp
je 0x4aa91b
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push dword [ebp - 8]
add ecx, 0x1b8
call fcn.004955e8
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call sym.setup_Clover.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043db65
leave
ret 0x10

Function at 0x4aee81
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x4d4], ebx
je 0x4aeee9
cmp dword [ebp + 8], 0x100
jne 0x4aeed8
cmp word [ebp + 0xc], 0xd
jne 0x4aeed8
cmp byte [esi + 0x4da], bl
je 0x4aeebf
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4aeed8
cmp byte [esi + 0x4db], bl
jne 0x4aeed8
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x4aeed4
push ebx
push ebx
push ebx
push str.return
push esi
call sym.setup_Clover.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
jmp 0x4aeeec
mov eax, dword [esi + 0x4d4]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4b73c7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x4b73d2
xor eax, eax
ret
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x4b748d
push edi
mov edi, eax
shr edi, 3
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4e2000]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4e2000]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4e2000]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4e2000]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4e2000]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4e2000]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4e2000]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4e2000]
inc edx
sub eax, 8
dec edi
jne 0x4b73f2
pop edi
test eax, eax
je 0x4b74a6
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x4e2000]
inc edx
dec eax
jne 0x4b7491
mov eax, esi
pop esi
not eax
pop ebx
ret

Function at 0x4b7934
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x4b7968
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4b7963
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4b7990
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x4b7979
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.0043d800
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x4b8726
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x509690]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4b87cf
movzx ecx, word [esi]
test cx, cx
je 0x4b87cf
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x4b8764
cmp cx, 0x5c
jne 0x4b8766
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x4b8758
cmp eax, esi
je 0x4b87a3
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0043dedb
and word [ebp + edi*2 - 0x20c], 0
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004b8726
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0043dd4e
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0043dd24
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043db65
leave
ret
Function at 0x4b9d00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4b9d7b
cmp dword [esi + 4], 0xffffffff
jne 0x4b9d7b
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4e31b4
push edi
call fcn.0043dd24
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x4b9d4d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4b9d4d
mov eax, 0x2000000
jmp 0x4b9d80
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b774a
add esp, 0x10
test eax, eax
jne 0x4b9d6b
mov eax, dword [ebp + 0x10]
jmp 0x4b9d80
push eax
call fcn.004b98fc
mov dword [esi], eax
mov eax, dword [0x511fb0]
pop ecx
jmp 0x4b9d80
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x4bcbbf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x4bcbe4
cmp eax, edi
jge 0x4bcbdc
mov eax, esi
call fcn.004bc5b3
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
xor ecx, ecx
cmp dword [esi + 8], ecx
jle 0x4bcc06
mov al, byte [esi + 0xc]
shr dword [esi + 0xc], 8
add dword [esi + 8], 0xfffffff8
mov byte [ebp + ecx - 4], al
inc ecx
cmp dword [esi + 8], 0
jg 0x4bcbeb
cmp ecx, 4
jge 0x4bcc25
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x4bcc13
xor eax, eax
jmp 0x4bcc1b
mov dl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, dl
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x4bcc09
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x4bcc57
mov eax, str.zlib_corrupt
call fcn.004ba1ed
jmp 0x4bcc92
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4bcc67
mov eax, str.read_past_buffer
jmp 0x4bcc50
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x4bcc7c
mov ecx, edi
call fcn.004bc5de
test eax, eax
je 0x4bcc92
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0043d800
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret

Function at 0x4c0f4b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x509690]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004c0ee0
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0043db80
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4c0f9a
cmp dword [ebp - 0x1c], 5
jb 0x4c0fb2
jmp 0x4c0fae
cmp dword [ebp - 0x10], 1
jne 0x4c0fb2
cmp dword [ebp - 0x1c], 4
ja 0x4c0fae
jne 0x4c0fb2
cmp dword [ebp - 0x18], 0
jbe 0x4c0fb2
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4e2ab4
call fcn.00418680
test eax, eax
jge 0x4c0fd3
mov byte [0x512198], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043db65
add ebp, 0x78
leave
ret
Function at 0x401020
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x1c
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x10], edx
call edx
mov edi, eax
sub esp, 0x18
lea ecx, [edi + edi]
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 0x14], edi
mov dword [esp + 8], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
mov edx, dword [ebp - 0x10]
call edx
mov eax, ebx
sub esp, 0x18
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401710
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x84
mov dword [ebp - 0x48], eax
mov eax, edx
call fcn.00401020
mov ebx, eax
mov eax, str.__xml_version_1.0____n_Task_xmlns_http:__schemas.microsoft.com_windows_2004_02_mit_task___n___RegistrationInfo__n_____Description__Task1___Description__n____RegistrationInfo__n___Settings__n_____Enabled_false__Enabled__n_____Hidden_false__Hidden__n____Settings__n___Actions__n_____Exec__n_______Command__task1.exe___Command__n______Exec__n____Actions__n__Task__n
call fcn.00401020
mov esi, eax
mov eax, dword [0x419000]
mov edx, dword [eax]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [edx + 0x3c]
mov eax, dword [0x419000]
mov word [ebp - 0x20], di
xor ecx, ecx
sub esp, 0xc
xor edx, edx
lea edi, [ebp - 0x44]
mov word [ebp - 0x30], cx
mov word [ebp - 0x40], dx
mov edx, dword [eax]
mov dword [esp + 0x44], edi
mov edi, dword [ebp - 0x20]
mov dword [esp + 0x34], edi
mov edi, dword [ebp - 0x1c]
mov dword [esp + 0x38], edi
mov edi, dword [ebp - 0x18]
mov dword [esp + 0x3c], edi
mov edi, dword [ebp - 0x14]
mov dword [esp + 0x30], 0
mov dword [esp + 0x40], edi
mov edi, dword [ebp - 0x30]
mov dword [esp + 0x20], edi
mov edi, dword [ebp - 0x2c]
mov dword [esp + 0x24], edi
mov edi, dword [ebp - 0x28]
mov dword [esp + 0x28], edi
mov edi, dword [ebp - 0x24]
mov dword [esp + 0x2c], edi
mov edi, dword [ebp - 0x40]
mov dword [esp + 0x10], edi
mov edi, dword [ebp - 0x3c]
mov dword [esp + 0x14], edi
mov edi, dword [ebp - 0x38]
mov dword [esp + 0x18], edi
mov edi, dword [ebp - 0x34]
mov dword [esp + 0xc], 2
mov dword [esp + 0x1c], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [edx + 0x40]
sub esp, 0x48
mov edi, eax
call fcn.00402450
mov ecx, dword [ebp - 0x48]
mov dword [eax], 0x40610f
mov dword [eax + 4], ecx
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.RegisterTask_failed:__08lx_n
mov edi, dword fs:[0x18]
call fcn.004016f0
mov dword [esp + 8], ebx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x44]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
Function at 0x401880
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ecx, 0xd
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x44c]
lea esi, [ebp - 0x40c]
push ebx
mov ebx, eax
xor eax, eax
sub esp, 0x480
mov dword [ebp - 0x450], 0x44
rep stosd dword es:[edi], eax
mov dword [ebp - 0x418], 0xffffffff
mov dword [ebp - 0x424], 0x100
mov dword [ebp - 0x414], 0xffffffff
mov dword [ebp - 0x410], 0xffffffff
mov dword [esp + 4], edx
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll_strcpy]
lea eax, [ebp - 0x460]
mov dword [esp + 4], esi
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x450]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
mov esi, eax
call fcn.00402450
mov dword [eax], 0x40610f
mov dword [eax + 4], ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.CreateProcess_failed:__lu_n
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.004016f0
mov eax, 0xffffffff
test esi, esi
je 0x401a3c
mov dword [esp + 4], 0x2710
mov eax, dword [ebp - 0x460]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
mov dword [ebp - 0x464], eax
call fcn.00402450
mov dword [eax], 0x40610f
mov dword [eax + 4], ebx
xor eax, eax
mov dword [esp + 4], str.wait_failed_n
mov edx, dword [ebp - 0x464]
test edx, edx
sete al
mov dword [esp], eax
call fcn.004016f0
cmp dword [ebp - 0x464], 0x102
je 0x401a48
lea eax, [ebp - 0x464]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x460]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
sub esp, 8
mov esi, eax
call fcn.00402450
mov dword [eax + 4], ebx
mov dword [eax], 0x40610f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.GetExitCodeProcess_failed:__lu_n
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.004016f0
mov eax, dword [ebp - 0x45c]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x460]
sub esp, 4
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x464]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x460]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
sub esp, 8
jmp 0x4019cb
Function at 0x4030f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 8]
mov dword [esp + 8], eax
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 0xc], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [ebp - 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004031b0
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
push ebp
mov ebp, esp
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
pop ebp
shl edx, 5
add eax, edx
ret
Function at 0x40a2d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [0x4b09fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
lea edx, [ebp - 0x3f4]
push edx
push 0x20019
push 0
push 0x499ae0
push SysReAllocString
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x400], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push SysReAllocString
mov esi, eax
call edi
test esi, esi
je 0x40a337
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046eb41
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x3f4]
lea eax, [ebp - 0x3f0]
push eax
push 0x20019
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [ebp - 0x3f4]
push edx
mov esi, eax
call edi
test esi, esi
jne 0x40a325
mov edx, dword [ebp - 0x3f0]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x3f8]
push eax
lea ecx, [ebp - 0x3ec]
push ecx
push esi
push edx
mov dword [ebp - 0x3f8], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
mov eax, dword [ebp - 0x3f0]
push eax
call edi
test esi, esi
jne 0x40a325
mov ecx, dword [ebp - 0x400]
mov edx, dword [ebp - 0x3fc]
push ecx
push edx
lea eax, [ebp - 0x3ec]
push 0x499b38
push eax
call fcn.0047157a
mov ecx, dword [ebp - 4]
add esp, 0x10
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.0046eb41
mov esp, ebp
pop ebp
ret
Function at 0x40a3d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2720
call fcn.00486170
mov eax, dword [0x4b09fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x270f
mov esi, ecx
lea ecx, [ebp - 0x2713]
push 0
push ecx
mov ebx, edx
mov dword [ebp - 0x2720], eax
mov byte [ebp - 0x2715], 0
mov byte [ebp - 0x2714], 0
call fcn.004783d0
mov eax, esi
add esp, 0xc
mov ecx, eax
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40a420
push edi
lea edi, [ebp - 0x2714]
sub eax, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40a431
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ebx, ebx
je 0x40a496
lea edi, [ebp - 0x2714]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40a452
mov dx, word [0x499f90]
mov eax, ebx
mov word [edi], dx
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40a468
lea edi, [ebp - 0x2714]
sub eax, ecx
mov esi, ecx
dec edi
lea ebx, [ebx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40a480
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea eax, [ebp - 0x271c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x2714]
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop edi
test eax, eax
jne 0x40a53b
mov esi, dword [ebp - 0x2720]
test esi, esi
je 0x40a4f5
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a4d2
sub eax, edx
mov edx, dword [ebp - 0x271c]
inc eax
push eax
push esi
push 1
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40a516
mov eax, dword [ebp - 0x271c]
push eax
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046eb41
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x271c]
mov bl, byte [ebp - 0x2715]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046eb41
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x2715]
pop esi
xor ecx, ebp
pop ebx
call fcn.0046eb41
mov esp, ebp
pop ebp
ret

Function at 0x40a560
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2714
call fcn.00486170
mov eax, dword [0x4b09fc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x270f
lea eax, [ebp - 0x2713]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x2714], 0
call fcn.004783d0
mov eax, esi
add esp, 0xc
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a5a0
lea edi, [ebp - 0x2714]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40a5b0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2714]
push ecx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov ecx, dword [ebp - 4]
test eax, eax
sete al
pop edi
xor ecx, ebp
pop esi
call fcn.0046eb41
mov esp, ebp
pop ebp
ret
Function at 0x415340
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x493528
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
mov eax, dword [0x4b09fc]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
cmp word [esi], 0xc
jne 0x415384
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [esp + 0xc]
jmp 0x41539b
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dx, word [esi]
mov word [esp + 0xc], dx
lea eax, [esp + 0x14]
mov ecx, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.OLEAUT32.dll_SafeArrayPutElement]
xor ecx, ecx
cmp eax, ecx
jge 0x415408
mov dword [esp + 0x20], vtable.tcomxException.0
mov dword [esp + 0x28], vtable.tStringBuffer.0
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x40], ecx
mov ebx, dword [0x4b1abc]
lea esi, [esp + 0x28]
mov dword [esp + 0x24], ecx
call fcn.0040b420
mov edx, dword [esp + 0x30]
push edx
mov ecx, 0x4985d4
call fcn.00409360
add esp, 4
push 0x4ac5b0
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x48], 0xffffffff
call fcn.0047816e
mov edx, dword [esp + 0x10]
push 0xffff
push ecx
push ecx
mov ecx, dword [esp + 0x18]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 8], ecx
push edi
mov dword [eax + 0xc], edx
call fcn.00412c40
add esp, 0x20
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [edi + 8]
sub eax, dword [edi + 0xc]
sar eax, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret