joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412028
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0xb0]
test bl, 1
je 0x41204d
mov eax, dword [ebp + 8]
test eax, eax
je 0x41204d
cmp byte [eax], 0
je 0x41204d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp + 0xc], 1
je 0x412058
test bl, 2
je 0x412067
cmp dword [esi + 0x18], 0
je 0x412067
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x414aec
Capabilities:
Set environment variable

Disassembly:
push 4
mov eax, 0x48e6bf
call fcn.00458f33
mov edi, ecx
and dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0040d837
and dword [ebp - 4], 0
mov ecx, esi
push str.McAfeeLocaleId
mov dword [ebp - 0x10], 1
call fcn.00414a81
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x414b6f
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x414b4d
cmp dword [0x4c12e0], 0
je 0x414b4d
cmp dword [0x4c3630], 0
je 0x414b4d
mov eax, dword [ecx]
push str.Unable_to_determine_the_locale_id._Defaulting_to_1033
push ecx
call dword [eax + 0x10]
pop ecx
pop ecx
mov edi, str.1033
push edi
call fcn.00461890
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040e292
push dword [esi]
push str.McAfeeLocaleId
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, esi
call fcn.00458efc
ret 4

Function at 0x414b79
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4c143c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
push 0x208
xor esi, esi
mov edi, ecx
push esi
push eax
call fcn.0045b1d0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x26
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov edx, eax
test edx, edx
jns 0x414bee
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x414be9
cmp dword [0x4c12e0], esi
je 0x414be9
cmp dword [0x4c3630], esi
je 0x414be9
mov eax, dword [ecx]
push edx
push str...Could_not_get_the_path_to_Program_Files_folder._hr:__d
push ecx
call dword [eax + 0x10]
add esp, 0xc
push 2
pop esi
jmp 0x414c0a
lea eax, [ebp - 0x20c]
push eax
call fcn.00461890
pop ecx
push eax
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.0040e292
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00458eeb
leave
ret 4
Function at 0x41525c
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x4c143c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x415431
push ebx
lea ebx, [esi + 8]
push edi
lea edi, [esi + 0xc]
cmp dword [ebx], eax
jne 0x41528d
cmp dword [edi], eax
je 0x4152c7
mov eax, edi
mov dword [ebp - 0x318], eax
test ebx, ebx
je 0x4152ab
cmp dword [ebx], 0
je 0x4152ab
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [ebx], 0
mov eax, edi
mov edi, eax
test eax, eax
je 0x4152c7
cmp dword [eax], 0
je 0x4152c7
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [ebp - 0x318]
and dword [edi], 0
test ebx, ebx
je 0x415326
push 0x104
lea eax, [ebp - 0x108]
mov byte [ebp - 0x108], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebx], 0
jne 0x415326
lea eax, [ebp - 0x108]
push eax
push 0x104
lea eax, [ebp - 0x314]
push eax
call fcn.00416bd4
push str._setupapi.dll
push 0x209
lea eax, [ebp - 0x314]
push eax
call fcn.0040e304
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebx], eax
test edi, edi
je 0x415385
push 0x104
lea eax, [ebp - 0x108]
mov byte [ebp - 0x108], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [edi], 0
jne 0x415385
lea eax, [ebp - 0x108]
push eax
push 0x104
lea eax, [ebp - 0x314]
push eax
call fcn.00416bd4
push str._advpack.dll
push 0x209
lea eax, [ebp - 0x314]
push eax
call fcn.0040e304
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [edi], eax
mov eax, dword [edi]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41539c
push str.ExtractFiles
push eax
call edi
mov dword [esi + 0x14], eax
cmp dword [ebx], 0
je 0x415429
push str.SetupOpenInfFileA
push dword [ebx]
call edi
push str.SetupCloseInfFile
push dword [ebx]
mov dword [esi + 0x18], eax
call edi
push str.SetupSetDirectoryIdA
push dword [ebx]
mov dword [esi + 0x1c], eax
call edi
push str.SetupInstallFromInfSectionA
push dword [ebx]
mov dword [esi + 0x20], eax
call edi
push str.SetupGetLineCountA
push dword [ebx]
mov dword [esi + 0x24], eax
call edi
push str.SetupGetLineByIndexA
push dword [ebx]
mov dword [esi + 0x28], eax
call edi
push str.SetupGetFieldCount
push dword [ebx]
mov dword [esi + 0x2c], eax
call edi
push str.SetupGetStringFieldA
push dword [ebx]
mov dword [esi + 0x30], eax
call edi
push str.SetupInitDefaultQueueCallbackEx
push dword [ebx]
mov dword [esi + 0x34], eax
call edi
push str.SetupTermDefaultQueueCallback
push dword [ebx]
mov dword [esi + 0x38], eax
call edi
push str.SetupDefaultQueueCallbackA
push dword [ebx]
mov dword [esi + 0x3c], eax
call edi
mov dword [esi + 0x40], eax
xor eax, eax
inc eax
pop edi
mov dword [esi + 0x10], eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00458eeb
leave
ret
Function at 0x415bff
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret

Function at 0x415cd8
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push esi
push eax
push 0x20006
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 6
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov dword [ebp - 4], eax
test esi, esi
jne 0x415d1a
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
mov eax, dword [ebp - 4]
cmp eax, 6
je 0x415d2e
cmp dword [ebp - 8], 0
je 0x415d2e
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x416577
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
push 0x4b97f8
call fcn.00459a90
mov dword [ebp - 0x24], ecx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x30], ebx
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x41659a
mov eax, dword [edi]
mov dword [ebp - 0x30], eax
mov eax, dword [ecx + 4]
test eax, eax
jne 0x416760
test dword [ebp + 0x18], 1
jne 0x4165d8
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
cmp dword [ebp + 0x1c], ebx
je 0x4165c7
push dword [ebp + 8]
call fcn.004241d5
jmp 0x416760
push ebx
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x416760
test edi, edi
jne 0x4165e9
cmp dword [ebp + 0xc], ebx
jne 0x4165e9
push 0x57
pop eax
jmp 0x416760
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [ebp + 8]
call fcn.00423795
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x416606
mov ecx, dword [ebp - 0x28]
mov dword [edx], ecx
test eax, eax
jne 0x416760
test edi, edi
je 0x416760
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
mov edx, dword [ebp - 0x20]
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x416680
cmp edx, ecx
sbb eax, eax
and eax, ecx
cmp eax, 0x400
ja 0x41665c
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.00459690
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x34], esi
test esi, esi
je 0x416682
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x34], esi
jmp 0x416682
cmp edx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.0045f1f4
pop ecx
mov esi, eax
mov dword [ebp - 0x38], esi
test esi, esi
je 0x416682
mov dword [esi], 0xdddd
add esi, 8
mov dword [ebp - 0x38], esi
jmp 0x416682
mov esi, ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4166b8
test esi, esi
jne 0x4166c3
push 0xe
jmp 0x4165e3
push dword [ebp - 0x20]
push ebx
push esi
call fcn.0045b1d0
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp + 8]
mov ebx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.00423795
mov ecx, eax
mov dword [ebp - 0x24], ecx
test ecx, ecx
jne 0x416749
cmp dword [ebp + 0x1c], eax
je 0x41671b
cmp dword [ebp - 0x28], 1
je 0x416700
cmp dword [ebp - 0x28], 7
jne 0x41671b
mov eax, dword [ebp - 0x30]
mov dword [edi], eax
push edi
push dword [ebp + 0x10]
push esi
push dword [ebp - 0x28]
mov ecx, ebx
call fcn.00424399
mov ecx, eax
mov dword [ebp - 0x24], ecx
jmp 0x416749
cmp dword [ebp + 0x10], 0
je 0x416744
mov eax, dword [ebp - 0x20]
cmp eax, dword [edi]
jbe 0x416732
mov ecx, 0xea
mov dword [ebp - 0x24], ecx
jmp 0x416744
push dword [ebp - 0x20]
push esi
push dword [ebp + 0x10]
call fcn.0045a6d0
add esp, 0xc
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x41675e
push esi
call fcn.0045f1d9
pop ecx
mov ecx, dword [ebp - 0x24]
mov eax, ecx
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x41745d
Capabilities:
Set registry value

Disassembly:
push 0x2c
push 0x4b9818
call fcn.00459a90
mov eax, ecx
mov dword [ebp - 0x30], eax
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov esi, ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], ebx
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41748c
mov eax, ecx
jmp 0x41761a
test dword [ebp + 0x18], 1
jne 0x4174c3
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
cmp dword [ebp + 0x1c], ebx
je 0x4174b2
push dword [ebp + 8]
mov ecx, eax
call fcn.004291c8
jmp 0x41761a
push ebx
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x41761a
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x417617
mov edx, dword [ebp + 0x14]
cmp edx, 1
jb 0x417617
cmp dword [ebp + 0x1c], ebx
je 0x417512
cmp dword [ebp + 0xc], 1
je 0x4174eb
cmp dword [ebp + 0xc], 7
jne 0x417512
lea edi, [ebp - 0x24]
push edi
lea edi, [ebp - 0x20]
push edi
push dword [ebp + 0xc]
push edx
push ecx
mov ecx, eax
call fcn.0042916b
mov edi, eax
test edi, edi
jne 0x4175e8
mov dword [ebp - 0x34], 1
jmp 0x417518
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add eax, 0x20
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], ebx
lea ecx, [eax + 8]
cmp eax, ecx
sbb eax, eax
and eax, ecx
je 0x417577
cmp eax, 0x400
ja 0x417557
call fcn.00459690
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x38], esi
push 8
pop edi
test esi, esi
je 0x41757c
mov dword [esi], 0xcccc
add esi, edi
mov dword [ebp - 0x38], esi
jmp 0x41757c
push eax
call fcn.0045f1f4
pop ecx
mov esi, eax
mov dword [ebp - 0x3c], esi
push 8
pop edi
test esi, esi
je 0x41757c
mov dword [esi], 0xdddd
add esi, edi
mov dword [ebp - 0x3c], esi
jmp 0x41757c
mov esi, ebx
push 8
pop edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4175b2
test esi, esi
je 0x4175fe
push dword [ebp - 0x2c]
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x24]
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x30]
call fcn.00421016
mov edi, eax
test edi, edi
jne 0x4175e8
push dword [ebp - 0x2c]
push esi
push 3
push ebx
push dword [ebp + 8]
mov eax, dword [ebp - 0x30]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test esi, esi
je 0x4175fe
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x4175fe
push esi
call fcn.0045f1d9
pop ecx
cmp dword [ebp - 0x34], 0
je 0x417613
cmp dword [ebp - 0x20], 0
je 0x417613
push dword [ebp - 0x20]
call fcn.0045f1d9
pop ecx
mov eax, edi
jmp 0x41761a
push 0x57
pop eax
lea esp, [ebp - 0x4c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x421016
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x4c143c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, str.E54C3DE0_9E70_4eea_94B6_D069D4E4A9BC
push 1
push esi
mov dword [ebp - 0x24c], edi
call fcn.00461890
pop ecx
push eax
push esi
lea ecx, [ebp - 0x240]
call fcn.00413945
mov eax, dword [ebp + 0xc]
lea esi, [edi + 0x20]
lea ecx, [eax + 0x20]
mov dword [ebp - 0x250], ecx
cmp dword [ebp + 0x18], ecx
jae 0x42106c
push 0x7a
pop esi
jmp 0x42114e
cmp dword [ebp + 8], 0
je 0x421149
test esi, esi
je 0x421149
cmp eax, 1
jb 0x421149
mov edi, dword [ebp + 8]
sub edi, esi
mov dword [ebp - 0x244], eax
mov dword [ebp + 8], edi
mov al, byte [edi + esi]
lea ecx, [ebp - 0x240]
xor byte [ebp - 0x1f], al
call fcn.0041646e
mov bl, al
lea ecx, [ebp - 0x240]
xor bl, byte [ebp - 0x1f]
call fcn.0041646e
mov bh, al
xor eax, eax
inc eax
add bh, bl
cmp dword [ebp - 0x30], eax
jle 0x4210ea
mov edi, eax
lea ecx, [ebp - 0x240]
call fcn.0041646e
lea ecx, [ebp - 0x240]
xor bh, al
call fcn.0041646e
add bh, al
inc edi
cmp edi, dword [ebp - 0x30]
jl 0x4210c4
mov edi, dword [ebp + 8]
xor eax, eax
inc eax
mov byte [esi], bh
inc esi
sub dword [ebp - 0x244], 1
jne 0x421095
mov edi, dword [ebp - 0x24c]
xor esi, esi
push 0x10
push esi
mov dword [edi + 4], eax
lea ebx, [edi + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [edi], 0x4752434d
mov dword [edi + 0xc], eax
call fcn.0045b1d0
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x250]
push edi
call fcn.004149fa
add esp, 0x1c
test eax, eax
jne 0x421149
push 0x10
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.0045a6d0
add esp, 0xc
jmp 0x42114e
mov esi, 0x1770
lea ecx, [ebp - 0x240]
call fcn.00413de8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00458eeb
leave
ret 0x14
Function at 0x423795
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
push 0x4b9880
call fcn.00459a90
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x4237ae
and dword [ecx], 0
and dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x1f4
and dword [ebp - 0x20], 0
and dword [ebp - 4], 0
mov eax, 0x1fc
call fcn.00459690
mov dword [ebp - 0x18], esp
mov eax, esp
mov dword [ebp - 0x30], eax
test eax, eax
je 0x4237e3
mov dword [eax], 0xcccc
add eax, 8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], eax
jmp 0x423803
push 0xfffffffffffffffe
pop ebx
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x20]
test edi, edi
je 0x423956
lea eax, [ebp - 0x28]
push eax
push edi
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, 0xea
jne 0x423908
add edi, 0xfffffff8
cmp dword [edi], 0xdddd
jne 0x42384d
push edi
call fcn.0045f1d9
pop ecx
and dword [ebp - 0x20], 0
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x28]
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x4238ba
cmp edx, ecx
sbb eax, eax
and eax, ecx
cmp eax, 0x400
ja 0x423898
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.00459690
mov dword [ebp - 0x18], esp
mov eax, esp
mov dword [ebp - 0x34], eax
test eax, eax
je 0x4238bc
mov dword [eax], 0xcccc
add eax, 8
mov dword [ebp - 0x34], eax
jmp 0x4238bc
cmp edx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.0045f1f4
pop ecx
mov dword [ebp - 0x38], eax
test eax, eax
je 0x4238bc
mov dword [eax], 0xdddd
add eax, 8
mov dword [ebp - 0x38], eax
jmp 0x4238bc
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], ebx
jmp 0x4238e6
mov edi, dword [ebp - 0x20]
test edi, edi
je 0x423956
lea eax, [ebp - 0x28]
push eax
push edi
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x42393d
cmp dword [ebp - 0x24], 3
je 0x423917
push 0xd
pop esi
jmp 0x42393d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
call fcn.00428b13
mov esi, eax
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x42393d
mov eax, dword [ebp - 0x24]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff8
cmp dword [eax], 0xdddd
jne 0x423952
push eax
call fcn.0045f1d9
pop ecx
mov eax, esi
jmp 0x423959
push 0xe
pop eax
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4241d5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
push 0x4b98a8
call fcn.00459a90
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 1
xor edi, edi
mov dword [ebp - 0x20], edi
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x4241fc
mov eax, dword [ebx]
mov dword [ebp - 0x20], eax
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push eax
push edi
push dword [ebp + 8]
mov eax, ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x42421e
mov ecx, dword [ebp - 0x24]
mov dword [edx], ecx
cmp dword [ebp - 0x24], 1
je 0x42422e
cmp dword [ebp - 0x24], 7
jne 0x424384
test ebx, ebx
je 0x424384
mov ecx, dword [ebx]
test ecx, ecx
je 0x424384
test eax, eax
je 0x42424f
cmp eax, 0xea
jne 0x424384
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
mov dword [ebx], eax
cmp dword [ebp + 0x10], edi
je 0x424269
push eax
push edi
push dword [ebp + 0x10]
call fcn.0045b1d0
add esp, 0xc
mov dword [ebp - 0x2c], edi
mov dword [ebp - 4], edi
mov edx, dword [ebp - 0x20]
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x4242d4
cmp edx, ecx
sbb eax, eax
and eax, ecx
cmp eax, 0x400
ja 0x4242af
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.00459690
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x30], esi
test esi, esi
je 0x4242d6
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x30], esi
jmp 0x4242d6
cmp dword [ebp - 0x20], ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.0045f1f4
pop ecx
mov esi, eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x4242d6
mov dword [esi], 0xdddd
add esi, 8
mov dword [ebp - 0x34], esi
jmp 0x4242d6
mov esi, edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x42430c
test esi, esi
jne 0x424315
push 0xe
pop eax
jmp 0x424384
push dword [ebp - 0x20]
push edi
push esi
call fcn.0045b1d0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push edi
push dword [ebp + 8]
mov eax, dword [ebp - 0x28]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x38], eax
test eax, eax
jne 0x42436d
cmp dword [ebp - 0x24], 1
jne 0x424358
push ebx
push dword [ebp + 0x10]
push esi
mov ecx, dword [ebp - 0x28]
call fcn.0041cd03
mov edi, eax
jmp 0x424370
cmp dword [ebp - 0x24], 7
jne 0x424370
push ebx
push dword [ebp + 0x10]
push esi
mov ecx, dword [ebp - 0x28]
call fcn.0041cbff
jmp 0x424354
mov edi, dword [ebp - 0x38]
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x424382
push esi
call fcn.0045f1d9
pop ecx
mov eax, edi
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x424fbf
Capabilities:
Set registry value

Disassembly:
push 0x20
push 0x4b9860
call fcn.00459a90
mov dword [ebp - 0x30], ecx
xor edi, edi
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebp + 0x10]
push 3
call fcn.004142bc
add esp, 0x10
test eax, eax
jne 0x4250e4
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], edi
mov ebx, dword [ebp - 0x20]
lea ecx, [ebx + 8]
cmp ebx, ecx
sbb eax, eax
test ecx, eax
je 0x425057
cmp ebx, ecx
sbb eax, eax
and eax, ecx
cmp eax, 0x400
ja 0x425033
cmp ebx, ecx
sbb eax, eax
and eax, ecx
call fcn.00459690
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
test esi, esi
je 0x425059
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x28], esi
jmp 0x425059
cmp ebx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.0045f1f4
pop ecx
mov esi, eax
mov dword [ebp - 0x2c], esi
test esi, esi
je 0x425059
mov dword [esi], 0xdddd
add esi, 8
mov dword [ebp - 0x2c], esi
jmp 0x425059
mov esi, edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x42508f
test esi, esi
jne 0x425098
push 0xe
pop eax
jmp 0x4250e4
push ebx
push edi
push esi
call fcn.0045b1d0
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp + 0x10]
push 3
call fcn.004142bc
add esp, 0x1c
mov ebx, eax
test ebx, ebx
jne 0x4250d0
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push edi
push dword [ebp + 8]
mov eax, dword [ebp - 0x30]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x4250e2
push esi
call fcn.0045f1d9
pop ecx
mov eax, ebx
lea esp, [ebp - 0x40]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x42667a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0xc]
mov esi, edx
test edx, edx
je 0x4266ae
cmp dword [0x4c12e0], 0
je 0x4266ae
cmp dword [0x4c3630], 0
je 0x4266ae
mov eax, dword [edx]
push str.In_CInfFile::_RunInfAsync__
push edx
call dword [eax + 0x10]
mov esi, dword [edi + 0xc]
pop ecx
pop ecx
xor ebx, ebx
test esi, esi
je 0x4266d1
cmp dword [0x4c12e0], ebx
je 0x4266d1
cmp dword [0x4c3630], ebx
je 0x4266d1
mov eax, dword [esi]
push str...Kicking_off_A_Thread_for_every_entry_in_this_INF_Section.
push esi
call dword [eax + 0x10]
pop ecx
pop ecx
mov esi, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], edx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x426798
xor eax, eax
push eax
push eax
push dword [ecx + edx*4]
push 0x41e4ff
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x42674c
mov eax, dword [edi + 0xc]
test eax, eax
je 0x42673b
cmp dword [0x4c12e0], 0
je 0x42673b
cmp dword [0x4c3630], 0
je 0x42673b
mov ecx, dword [eax]
mov eax, dword [esi]
mov edx, dword [ebp - 4]
mov eax, dword [eax + edx*4]
push dword [eax + 0x14]
push str...Thread_created_for__s.
push dword [edi + 0xc]
call dword [ecx + 0x10]
add esp, 0xc
lea eax, [ebp + 8]
push eax
lea ecx, [edi + 0x1b0]
call fcn.004133f4
jmp 0x42677f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [edi + 0xc]
test eax, eax
je 0x42677f
cmp dword [0x4c12e0], 0
je 0x42677f
mov edx, dword [eax]
mov ecx, dword [esi]
mov eax, dword [ebp - 4]
mov eax, dword [ecx + eax*4]
push dword [eax + 0x14]
push str...Thread_created_failed_for__s.
push dword [edi + 0xc]
call dword [edx + 0x14]
add esp, 0xc
mov eax, dword [esi + 4]
mov edx, dword [ebp - 4]
mov ecx, dword [esi]
inc edx
sub eax, ecx
mov dword [ebp - 4], edx
sar eax, 2
cmp edx, eax
jb 0x4266eb
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x4267c0
cmp dword [0x4c12e0], 0
je 0x4267c0
cmp dword [0x4c3630], 0
je 0x4267c0
mov eax, dword [ecx]
push ebx
push str...CInfFile::_RunInfAsync___return__d.
push ecx
call dword [eax + 0x10]
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8