joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e10
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x25c
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov dword [esp + 4], eax
mov ecx, 0x40
mov dword [esp + 8], eax
lea edi, [esp + 0x59]
mov dword [esp + 0xc], eax
push 0x104
mov dword [esp + 0x14], eax
mov byte [esp + 0x5c], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x5c]
mov dword [esp + 0x18], 0x44
push ecx
push 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x58]
lea eax, [esp + 0x15c]
push edx
push str.__s___Restart
push 0x104
push eax
call sub.MSVCRT.dll__snprintf
add esp, 0x10
lea ecx, [esp + 4]
lea edx, [esp + 0x14]
lea eax, [esp + 0x15c]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
jne 0x401eb1
add esp, 0x25c
ret
mov ecx, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
mov eax, 1
pop esi
add esp, 0x25c
ret

Function at 0x401ee0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x41a9c8
mov dword [esp + 8], 0
mov dword [esp + 0x10], 4
stosb byte es:[edi], al
call fcn.00402a40
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [esp + 0x118]
lea edx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
push 1
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
jge 0x401f61
xor eax, eax
add esp, 0x110
ret
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push esi
lea eax, [esp + 4]
push edx
push eax
push 0
push 0
push str.Start
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jge 0x401f9b
xor eax, eax
add esp, 0x110
ret
mov ecx, dword [esp]
xor eax, eax
cmp ecx, 3
sete al
add esp, 0x110
ret
Function at 0x401fb0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10c
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x41a9c8
mov dword [esp + 0xc], 2
stosb byte es:[edi], al
call fcn.00402a40
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [esp + 0x114]
lea edx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push eax
push 2
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
jge 0x402029
xor eax, eax
add esp, 0x10c
ret
mov eax, dword [esp]
push esi
lea edx, [esp + 8]
push 4
push edx
push 4
push 0
push str.Start
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 4]
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
setge al
pop esi
add esp, 0x10c
ret

Function at 0x402070
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push esi
push edi
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 8], 0
rep stosd dword es:[edi], eax
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4020a9
pop edi
xor eax, eax
pop esi
add esp, 0x128
ret
lea eax, [esp + 8]
push ebx
push eax
push esi
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x402100
mov ebx, dword [esp + 0x138]
lea ecx, [esp + 0x30]
push ebx
push ecx
call sub.MSVCRT.dll__mbsicmp
add esp, 8
test eax, eax
je 0x4020fb
lea edx, [esp + 0xc]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x402100
lea eax, [esp + 0x30]
push ebx
push eax
call sub.MSVCRT.dll__mbsicmp
add esp, 8
test eax, eax
jne 0x4020da
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x128
ret
Function at 0x402120
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x25c
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x5d]
mov byte [esp + 0x5c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x18], 0x44
rep stosd dword es:[edi], eax
mov dword [esp + 8], eax
lea ecx, [esp + 0x5c]
mov dword [esp + 0xc], eax
push 0x104
mov dword [esp + 0x14], eax
push ecx
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [esp + 0x5c]
push edx
call esi
lea eax, [esp + 0x5c]
push eax
call esi
mov ecx, 0x41a8e8
call fcn.00402a40
lea ecx, [esp + 0x5c]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov ecx, 0x41a958
call fcn.00402a40
push eax
call fcn.00402070
add esp, 4
test eax, eax
jne 0x40223a
mov ecx, 0x41a8f8
call fcn.00402a40
push eax
call fcn.00401ee0
add esp, 4
test eax, eax
je 0x40223a
lea edx, [esp + 0x5c]
lea eax, [esp + 0x160]
push edx
push str.__s___restart
push 0x104
push eax
call sub.MSVCRT.dll__snprintf
add esp, 0x10
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
lea eax, [esp + 0x160]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40223a
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x25c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x25c
ret
Function at 0x402250
Capabilities:
Delete registry key
Move file

Disassembly:
sub esp, 0x208
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x41a918
stosb byte es:[edi], al
call fcn.00402a40
push 0x24
mov ecx, 0x41aa48
mov esi, eax
call fcn.00402a40
push eax
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
cmp eax, 6
pop esi
jne 0x402394
mov ecx, 0x41a948
call fcn.00402a40
push eax
call fcn.004017c0
add esp, 4
mov ecx, 0x41a948
call fcn.00402a40
push eax
call fcn.00401630
add esp, 4
mov ecx, 0x41a8d8
call fcn.00402a40
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
lea eax, [esp + 0x104]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x104]
push 0x104
lea edx, [esp + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [esp]
push str..del
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp]
push 1
lea edx, [esp + 0x108]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [esp]
push 0
push eax
call fcn.00403e40
add esp, 8
mov ecx, 0x41a8f8
call fcn.00402a40
push eax
call fcn.00401ee0
add esp, 4
test eax, eax
je 0x40237c
mov ecx, 0x41a8f8
call fcn.00402a40
push eax
call fcn.00401fb0
add esp, 4
push 2
mov ecx, 0x41c308
call fcn.00404830
mov eax, 1
add esp, 0x208
ret
xor eax, eax
add esp, 0x208
ret

Function at 0x402d70
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x402da4
cmp dword [esp + 4], 5
jne 0x402da4
mov ecx, dword [esp + 8]
mov eax, 1
cmp ecx, eax
je 0x402da6
xor eax, eax
add esp, 0x94
ret

Function at 0x402db0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x402de3
cmp dword [esp + 4], 6
jb 0x402de3
mov eax, 1
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret

Function at 0x402e40
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x402e95
mov eax, dword [esp + 0xc]
test eax, eax
je 0x402e95
dec eax
push esi
mov ecx, 0x41ba78
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
call fcn.00402a40
mov esi, eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push edi
push ecx
mov ecx, 0x41bab8
call fcn.00402a40
push eax
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
neg eax
sbb eax, eax
pop esi
inc eax
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x4030e0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, ecx
push 0
lea ebp, [esi + 0x30]
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x403100
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
push edi
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, ebx
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 8], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 8]
push eax
push ebx
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
pop edi
jne 0x40313a
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00402f60
test eax, eax
jne 0x403151
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
mov eax, dword [esp + 0x14]
push 0x104
mov edx, eax
mov word [esi + 0xe], ax
mov eax, dword [esp + 0x1c]
shr edx, 0x10
mov ecx, eax
mov word [esi + 0x12], ax
mov eax, dword [esp + 0x20]
mov word [esi + 0xc], dx
shr ecx, 0x10
mov edx, eax
mov word [esi + 0x16], ax
mov eax, dword [esp + 0x24]
mov word [esi + 0x10], cx
mov ecx, eax
mov word [esi + 0x1a], ax
mov eax, dword [esp + 0x2c]
shr ecx, 0x10
shr edx, 0x10
mov word [esi + 0x18], cx
mov ecx, dword [esp + 0x30]
mov word [esi + 0x14], dx
mov edx, dword [esp + 0x28]
mov dword [esi + 0x24], ecx
lea ecx, [esi + 0x134]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x38]
push ecx
push str.CompanyName
mov ecx, esi
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], eax
call fcn.00402ff0
test eax, eax
jne 0x4031db
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea edx, [esi + 0x33c]
push 0x104
push edx
push str.FileDescription
mov ecx, esi
call fcn.00402ff0
test eax, eax
jne 0x4031fe
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea eax, [esi + 0x238]
push 0x104
push eax
push str.ProductName
mov ecx, esi
call fcn.00402ff0
neg eax
sbb eax, eax
pop esi
pop ebp
pop ebx
neg eax
add esp, 0x34
ret
Function at 0x4033b0
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x410
test eax, eax
push esi
mov esi, dword [esp + 0x418]
push edi
je 0x4033e0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4033e0
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4033f9
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret
call fcn.00402d60
test eax, eax
je 0x403425
push esi
call fcn.004035e0
add esp, 4
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x410
ret
mov al, byte [0x41bde8]
test al, al
jne 0x40344e
push 0x104
push 0x41bde8
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push 0x41bde8
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10c]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x4035d1
lea ecx, [esp + 0x10c]
push ecx
call fcn.004035e0
lea edx, [esp + 0x110]
lea eax, [esp + 0xc]
push edx
push str.NUL_s_n
push 0x103
push eax
call sub.MSVCRT.dll__snprintf
push 0x4184e4
push 0x41bde8
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x4034f7
push 0x4184e0
push 0x41bde8
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 8
test esi, esi
je 0x4035d1
push esi
call sub.MSVCRT.dll_rewind
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x215]
mov byte [esp + 0x214], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
lea ecx, [esp + 0x218]
push 0x208
push ecx
stosb byte es:[edi], al
call sub.MSVCRT.dll_fgets
add esp, 0x10
test eax, eax
je 0x403572
lea edx, [esp + 0x210]
push edx
call sub.MSVCRT.dll__strlwr
lea eax, [esp + 0x214]
push str._rename_
push eax
call sub.MSVCRT.dll_strstr
add esp, 0xc
test eax, eax
jne 0x4035a2
push esi
lea ecx, [esp + 0x214]
push 0x208
push ecx
call sub.MSVCRT.dll_fgets
add esp, 0xc
test eax, eax
jne 0x403532
push esi
push str._rename__n
call sub.MSVCRT.dll_fputs
lea edx, [esp + 0x10]
push esi
push edx
call sub.MSVCRT.dll_fputs
add esp, 0x10
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x410
ret
push 2
push 0
push esi
call sub.MSVCRT.dll_fseek
lea eax, [esp + 0x14]
push esi
push eax
call sub.MSVCRT.dll_fputs
add esp, 0x14
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x410
ret
pop edi
xor eax, eax
pop esi
add esp, 0x410
ret
Function at 0x403d80
Capabilities:
Check if file exists
Create directory

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
push edi
je 0x403e2a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x403e2a
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x403dc4
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
pop edi
pop esi
add esp, 0x104
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov edi, dword [esp + 0x114]
lea eax, [esp + 8]
push edi
push eax
call fcn.00403d80
add esp, 8
test eax, eax
je 0x403e2a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
add esp, 0x104
ret
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret

Function at 0x403e40
Capabilities:
Move file

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x403e53
push edi
call fcn.004035e0
add esp, 4
mov esi, dword [esp + 0x10]
test esi, esi
je 0x403e64
push esi
call fcn.004035e0
add esp, 4
call fcn.00402d60
test eax, eax
je 0x403e83
xor eax, eax
test esi, esi
setne al
add eax, 4
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
pop edi
pop esi
ret
push esi
push edi
call fcn.00403e90
add esp, 8
pop edi
pop esi
ret
Function at 0x404eb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
call fcn.00402db0
test eax, eax
mov eax, str.SOFTWAREAppDataLowTencentQQToolbarAction
jne 0x404ec6
mov eax, str.SOFTWARETencentQQToolbarAction
lea ecx, [esp]
lea edx, [esp + 8]
push ecx
lea ecx, [esp + 8]
push edx
push ecx
push str.Insttm
push eax
push 0x80000001
mov dword [esp + 0x1c], 3
mov dword [esp + 0x18], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x404f00
xor eax, eax
add esp, 0xc
ret
mov eax, dword [esp + 8]
add esp, 0xc
ret

Function at 0x405050
Capabilities:
Check if file exists
Delete file

Disassembly:
sub esp, 0x104
push esi
mov edx, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
add edx, 4
push eax
push edx
call fcn.00406110
add esp, 0xc
lea ecx, [esp + 8]
mov esi, eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4050b0
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x4050b0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret

Function at 0x405ae0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
je 0x405b9a
mov eax, dword [esp + 0x10]
cmp eax, 1
jne 0x405b2c
cmp dword [esp + 4], 4
jne 0x405b9a
mov eax, 1
add esp, 0x94
ret
cmp eax, 2
jne 0x405b9a
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x405b70
mov eax, dword [esp + 8]
test eax, eax
jne 0x405b4e
mov eax, 2
add esp, 0x94
ret
cmp eax, 1
jne 0x405b5f
mov eax, 3
add esp, 0x94
ret
cmp eax, 2
jne 0x405b9a
mov eax, 4
add esp, 0x94
ret
cmp eax, 6
jne 0x405b9a
mov eax, dword [esp + 8]
test eax, eax
jne 0x405b89
mov eax, 5
add esp, 0x94
ret
cmp eax, 1
jne 0x405b9a
mov eax, 6
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret
Function at 0x405c90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
mov eax, dword [0x4134e4]
mov edx, dword [0x4134ec]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [0x4134e8]
mov eax, dword [0x4134f0]
mov dword [esp + 0x14], ecx
mov ecx, 0x41cb50
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 8], 0x10
call fcn.00402a40
lea ecx, [esp + 8]
mov esi, eax
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, 0x41cb40
call fcn.00402a40
push eax
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x405d2b
mov eax, dword [esp + 0x24]
test eax, eax
je 0x405d1e
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret 8
mov eax, dword [esp + 0x28]
test eax, eax
je 0x405d47
mov eax, dword [esp + 0x24]
mov ecx, edi
push eax
call fcn.00405d60
pop edi
pop esi
add esp, 0x18
ret 8
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret 8

Function at 0x405d60
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
je 0x405d7a
xor eax, eax
add esp, 0x10
ret 4
push esi
mov ecx, 0x41cb50
call fcn.00402a40
lea ecx, [esp + 4]
push 0x10
push ecx
push 3
mov ecx, 0x41cb40
mov esi, eax
call fcn.00402a40
push eax
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov eax, dword [esp + 0x18]
pop esi
test eax, eax
je 0x405dcb
mov edx, dword [esp]
mov ecx, dword [esp + 4]
mov dword [eax], edx
mov edx, dword [esp + 8]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov eax, 1
add esp, 0x10
ret 4

Function at 0x405de0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
mov ecx, 0x41cb50
mov dword [esp + 4], 0
mov dword [esp + 8], 2
call fcn.00402a40
mov esi, eax
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, 0x41cb30
call fcn.00402a40
push eax
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov ax, word [esp + 4]
pop esi
add esp, 0xc
ret
Function at 0x406b40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov dword [esp + 8], 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x21c]
lea ecx, [esp + 0x10]
push eax
push str.CLSID_sInprocServer32
push 0x103
push ecx
call sub.MSVCRT.dll__snprintf
add esp, 0x10
lea edx, [esp + 4]
lea eax, [esp + 0x10]
push edx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x406bc1
xor al, al
pop edi
add esp, 0x214
ret
lea ecx, [esp + 8]
lea edx, [esp + 0x114]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x406bfb
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop edi
add esp, 0x214
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esp + 0x114]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
cmp ecx, 4
setae al
add esp, 0x214
ret

Function at 0x406cd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
lea eax, [esp]
mov ecx, 0x41cc50
push ebx
push eax
xor ebx, ebx
call fcn.00402a40
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x406d48
push edi
mov ecx, 0x40
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
stosb byte es:[edi], al
push ecx
mov ecx, dword [esp + 0x120]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push eax
push ebx
push ecx
push edx
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop edi
jne 0x406d3d
mov bl, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 0x110
ret

Function at 0x406d60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
lea eax, [esp]
mov ecx, 0x41cc40
push ebx
push eax
xor ebx, ebx
call fcn.00402a40
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x406dd8
push edi
mov ecx, 0x40
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
stosb byte es:[edi], al
push ecx
mov ecx, dword [esp + 0x120]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push eax
push ebx
push ecx
push edx
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop edi
jne 0x406dcd
mov bl, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 0x110
ret