joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4201c0
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x551c2b
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x5b3890]
xor eax, esp
mov dword [esp + 0x830], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x848]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x86c]
mov eax, dword [esp + 0x868]
mov ebp, dword [esp + 0x864]
mov esi, dword [esp + 0x860]
mov ebx, dword [esp + 0x85c]
mov edi, dword [esp + 0x858]
push ecx
push eax
push ebp
push 0
push esi
push ebx
push edi
mov dword [esp + 0x5c], eax
mov dword [esp + 0x54], ecx
mov dword [esp + 0x3c], 0
call fcn.0041f980
add esp, 0x1c
cmp eax, 0xffffffff
je 0x42024e
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push 8
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x420378
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x30]
call fcn.0049eff0
mov dword [esp + 0x28], vtable.cWCStr.0
push 0xffffffffffffffff
xor esi, esi
push 0x56b9a8
lea ecx, [esp + 0x30]
mov dword [esp + 0x858], esi
call fcn.0049eeb0
lea ecx, [esp + 0x28]
call fcn.0049e970
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x58]
push edx
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x2c]
push esi
push eax
mov dword [esp + 0x3c], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x38], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x420349
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x2c]
call fcn.0049f100
push 0xffffffffffffffff
lea edx, [esp + 0x48]
push edx
lea ecx, [esp + 0x30]
call fcn.0049eeb0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push ebp
push 0
push edx
push ebx
push edi
call fcn.0041f980
add esp, 0x1c
cmp eax, 0xffffffff
je 0x420314
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
inc eax
lea edx, [esp + 0x58]
push edx
push eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x38], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x4202d1
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x850], 0xffffffff
mov dword [esp + 0x28], vtable.cWCS.0
lea ecx, [esp + 0x28]
cmp esi, 0x103
je 0x42037d
call fcn.0049ee80
or eax, 0xffffffff
jmp 0x420394
mov eax, dword [esp + 0x1c]
cdq
sub eax, edx
mov edx, dword [esp + 0x20]
sar eax, 1
lea esi, [eax + edx]
call fcn.0049ee80
mov eax, esi
mov ecx, dword [esp + 0x848]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x830]
xor ecx, esp
call fcn.0051916c
add esp, 0x840
ret
Function at 0x421590
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0x102
push 0
push str.SOFTWAREMicrosoftWindows_Search
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4215b8
xor al, al
add esp, 8
ret
mov edx, dword [esp]
push esi
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push str.SetupCompletedSuccessfully
push edx
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
add esp, 8
ret

Function at 0x422590
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4225bd
xor al, al
pop ecx
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push esi
push eax
mov eax, dword [esp + 8]
push ecx
push 3
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ecx
ret

Function at 0x422660
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x5b3890]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
push edi
mov edi, dword [esp + 0x21c]
mov esi, 0x5b0898
lea esp, [esp]
mov eax, dword [esi - 4]
push 0
sub esi, 4
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
call ebx
test eax, eax
je 0x4226e7
lea ecx, [esp + 0xc]
mov eax, edi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4226d6
test dx, dx
je 0x4226d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4226d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4226b0
xor eax, eax
jmp 0x4226db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x422701
cmp esi, 0x5b0888
jne 0x422690
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0051916c
add esp, 0x20c
ret
push 0
lea edx, [esp + 0x10]
push edx
push edi
call fcn.004b30d0
add esp, 0xc
test eax, eax
je 0x4226e7
mov ecx, dword [esp + 0x214]
lea eax, [edi + eax*2]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051916c
add esp, 0x20c
ret
Function at 0x423360
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x551e8b
mov eax, dword fs:[0]
push eax
sub esp, 0x838
mov eax, dword [0x5b3890]
xor eax, esp
mov dword [esp + 0x834], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x84c]
mov dword fs:[0], eax
mov edx, dword [esp + 0x864]
mov ecx, dword [esp + 0x860]
mov eax, dword [esp + 0x85c]
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x868]
mov dword [esp + 0x40], edx
lea edx, [esp + 0x14]
push edx
push 0x20007
xor ebx, ebx
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x423577
mov ecx, dword [esp + 0x14]
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x2c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
mov dword [esp + 0x4c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
jne 0x42340c
mov edx, dword [esp + 0x14]
push edx
jmp 0x423528
xor ebp, ebp
cmp eax, ebx
jbe 0x423523
lea eax, [esp + 0x18]
push eax
push ebx
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x20]
push ebx
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x5c]
push eax
push ebp
push ecx
mov dword [esp + 0x5c], 0x400
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebx
jne 0x423518
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
je 0x423518
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], 0x627470
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x858], ebx
call fcn.00420a50
test eax, eax
je 0x423558
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x3c]
push ecx
push ebx
lea edx, [esp + 0x58]
push edx
push eax
call fcn.004b42b0
add esp, 0x18
cmp eax, ebx
jne 0x423504
cmp dword [esp + 0x18], ebx
je 0x423504
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov byte [esp + 0x20], 1
cmp edx, ebx
je 0x4234ec
lea eax, [esp + 0x48]
lea edi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4234d0
sub eax, edi
sar eax, 1
je 0x4234ec
cmp byte [esi], bl
setne cl
inc esi
mov byte [esp + 0x20], cl
dec edx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x20]
push eax
push ecx
push edx
lea edx, [esp + 0x54]
push esi
push edx
call dword [esp + 0x4c]
add esp, 0x14
lea ecx, [esp + 0x24]
mov dword [esp + 0x854], 0xffffffff
call fcn.00420ae0
inc ebp
cmp ebp, dword [esp + 0x1c]
jb 0x423416
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [esp + 0x84c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x834]
xor ecx, esp
call fcn.0051916c
add esp, 0x844
ret
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x24]
mov dword [esp + 0x854], 0xffffffff
call fcn.00420ae0
xor al, al
jmp 0x423530
Function at 0x423700
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x551f28
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x34]
test esi, esi
jne 0x423743
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
mov eax, dword [str.SoftwareJeticoBCWipeTaskManagerStartupRunOnce]
mov edi, dword [esp + 0x30]
push esi
push eax
push edi
call fcn.004236e0
add esp, 0xc
push str.BCWipe.stu
mov ecx, esi
mov bl, al
call fcn.00445f10
push str.BCWipe.stn
mov ecx, esi
call fcn.00445f10
test bl, bl
je 0x423783
mov ecx, dword [str.SoftwareJeticoBCWipeTaskManagerStartupRunOnce]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
call fcn.004dd860
mov edi, eax
test edi, edi
je 0x4237f1
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x18]
call fcn.0049eff0
mov dword [esp + 0x10], vtable.cWCSF.0
push 0
push 1
push 0
push edi
lea edx, [esp + 0x20]
push 0x56fa00
push edx
mov dword [esp + 0x40], 0
call fcn.00403e80
add esp, 0xc
push eax
push str._SystemRestoreDriveMask_
push 0
mov ecx, esi
call fcn.004453c0
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x10], vtable.cWCS.0
call fcn.0049ee80
call fcn.004dd870
cmp dword [esi + 0x8c], 0
setne al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x424e90
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push edi
mov edi, dword [esp + 0x28]
test edi, edi
jne 0x424ea1
lea edi, [esp + 0xc]
call fcn.00424ce0
mov ebx, dword [esp + 0x18]
test al, al
je 0x424ec7
test ebx, ebx
je 0x424ebf
cmp dword [ebx + 4], 0
jne 0x424ebf
mov eax, dword [ebx]
sub eax, 8
je 0x424ec7
pop edi
xor al, al
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x18]
push ecx
push edx
push esi
call fcn.00424db0
add esp, 0xc
test al, al
jne 0x424eea
pop esi
pop edi
pop ebx
add esp, 8
ret
cmp dword [esp + 0x20], 0
jne 0x424efa
pop esi
pop edi
mov al, 1
pop ebx
add esp, 8
ret
mov ecx, dword [0x5b08c0]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.00424ce0
test al, al
je 0x424f21
test ebx, ebx
je 0x424f7d
cmp dword [ebx + 4], 0
jne 0x424f7d
mov eax, dword [ebx]
sub eax, 8
jne 0x424f7d
mov edx, ecx
dec ecx
mov dword [esp + 0x10], ecx
test edx, edx
jle 0x424f6b
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push esi
call fcn.004b5ff0
add esp, 0x1c
mov ebx, eax
call ebp
mov dword [edi], eax
cmp ebx, 0xffffffff
jne 0x424f87
cmp eax, 0xe7
jne 0x424f7d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
jmp 0x424f07
mov eax, dword [esp + 0x2c]
push eax
push esi
mov esi, dword [esp + 0x30]
call fcn.00424d00
add esp, 8
pop ebp
pop esi
pop edi
xor al, al
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x34]
push ecx
push edx
push eax
push ebx
mov dword [esp + 0x44], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
call ebp
push ebx
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x424fc6
mov ecx, dword [esp + 0x24]
cmp ecx, dword [esp + 0x30]
jne 0x424fc6
mov al, 1
jmp 0x424fc8
xor al, al
test esi, esi
je 0x424fd6
mov dword [0x5b08c0], 0xb4
pop ebp
pop esi
pop edi
pop ebx
add esp, 8
ret

Function at 0x425130
Capabilities:
Check if file exists

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
push esi
push ebx
call ebp
test eax, eax
jne 0x425179
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x425185
test esi, esi
je 0x425180
cmp esi, 0xffffffff
je 0x425169
dec esi
push 1
call edi
push 0
call edi
push esi
push ebx
call ebp
test eax, eax
je 0x425154
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, 0x79
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4251e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push ebp
call fcn.00424fe0
add esp, 4
test al, al
je 0x425243
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
call fcn.00425000
add esp, 0x1c
test al, al
jne 0x42520d
pop ebp
ret
cmp byte [esp + 0xc], 0
je 0x425243
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
xor esi, esi
push esi
push ebp
call edi
test eax, eax
jne 0x425239
call ebx
cmp eax, 2
je 0x425240
cmp eax, 0x79
je 0x425225
mov esi, 0x64
jmp 0x425225
pop edi
pop esi
pop ebx
mov al, 1
pop ebp
ret
Function at 0x425c20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x5b3890]
xor eax, esp
mov dword [esp + 0x804], eax
push 0x800
lea eax, [esp + 8]
push 0x20
push eax
mov dword [0x5b6888], 0
mov dword [0x5b688c], 0
call fcn.00519500
mov cx, word [0x570214]
mov dl, byte [0x570216]
add esp, 0xc
push 0
lea eax, [esp + 4]
push eax
mov word [esp + 0xc], cx
push 0x800
lea ecx, [esp + 0x10]
push ecx
push esi
mov byte [esp + 0x1a], dl
mov byte [esp + 0x816], 0xd
mov byte [esp + 0x817], 0xa
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x425cc1
cmp dword [esp], 0x800
jne 0x425cc1
mov eax, 1
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.0051916c
add esp, 0x808
ret
mov ecx, dword [esp + 0x804]
xor ecx, esp
xor eax, eax
call fcn.0051916c
add esp, 0x808
ret

Function at 0x426170
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x5b3890]
xor eax, esp
mov dword [esp + 0x804], eax
mov ecx, dword [0x5b6888]
mov eax, dword [esp + 0x80c]
push eax
mov edx, ecx
push edx
lea eax, [esp + 0xc]
inc ecx
push str.R_d____s
push eax
mov dword [0x5b6888], ecx
call fcn.00425ce0
lea eax, [esp + 0x14]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4261b5
sub eax, edx
push esi
mov esi, eax
mov eax, dword [0x5b688c]
mov ecx, 0x800
sub ecx, eax
cmp ecx, esi
jge 0x4261e9
xor al, al
pop esi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.0051916c
add esp, 0x808
ret
push 0
push 0
add eax, 3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [esp + 8]
push edx
push esi
lea eax, [esp + 0x14]
push eax
push edi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4261d1
mov ecx, dword [esp + 4]
cmp ecx, esi
jne 0x4261d1
add dword [0x5b688c], ecx
mov ecx, dword [esp + 0x808]
pop esi
xor ecx, esp
mov al, 1
call fcn.0051916c
add esp, 0x808
ret

Function at 0x426240
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push 2
push 0
push 0
push esi
call fcn.004b4bb0
mov ecx, eax
and ecx, edx
add esp, 0x10
cmp ecx, 0xffffffff
jne 0x426263
xor al, al
pop esi
pop ecx
ret
or eax, edx
jne 0x42626c
call fcn.00425c20
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, ebp
mov dword [esp + 0xc], 0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x426280
push 0
sub eax, edx
lea edx, [esp + 0x10]
push edx
mov ebx, eax
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4262b5
cmp dword [esp + 0xc], ebx
jne 0x4262b5
push esi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop ebp
mov al, bl
pop ebx
pop esi
pop ecx
ret
push edi
push ebp
mov edi, esi
call fcn.00426170
add esp, 4
mov bl, al
pop edi
test bl, bl
je 0x4262cf
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop ebp
mov al, bl
pop ebx
pop esi
pop ecx
ret
Function at 0x4269f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 4]
jb 0x426a34
mov eax, 6
pop esi
add esp, 8
ret
mov edx, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push edx
push eax
push esi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
jne 0x426a69
pop edi
mov eax, 6
pop esi
add esp, 8
ret
test eax, eax
je 0x426a78
pop edi
mov eax, 7
pop esi
add esp, 8
ret
cmp edi, dword [esp + 0xc]
pop edi
sbb eax, eax
and eax, 8
pop esi
add esp, 8
ret

Function at 0x426d40
Capabilities:
Delete registry value

Disassembly:
push ecx
mov ecx, dword [str.SoftwareJeticoBCWipePatternSchemes]
mov edx, dword [esp + 8]
lea eax, [esp]
push eax
push 2
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x426d66
mov eax, 1
pop ecx
ret
mov eax, dword [esp + 0xc]
mov ecx, dword [esp]
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
neg eax
sbb eax, eax
and eax, 9
pop esi
pop ecx
ret
Function at 0x427c90
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5523f8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c]
push ebp
call fcn.004327c0
add esp, 4
test al, al
je 0x427cec
push ebp
call fcn.00432ef0
add esp, 4
test al, al
jne 0x427cec
mov eax, SysReAllocString
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
mov esi, dword [esp + 0x40]
lea eax, [esp + 0x10]
push eax
push 0
mov ecx, esi
mov dword [esp + 0x18], 0
call fcn.004275f0
cmp eax, 1
je 0x427d23
or eax, 0x80000000
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], 0x627470
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
mov edi, eax
call fcn.00420a50
test eax, eax
jne 0x427d7e
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.00420ae0
mov eax, 3
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.004275f0
test eax, eax
jne 0x427e5c
cmp edi, dword [esp + 0x24]
jne 0x427e5c
mov ecx, dword [str.SoftwareJeticoBCWipePatternSchemes]
mov edx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x427df3
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.00420ae0
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
push eax
push ecx
push 3
push 0
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.00420ae0
test esi, esi
je 0x427e47
mov eax, 5
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
or eax, 0x80000000
lea ecx, [esp + 0x18]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
call fcn.00420ae0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
Function at 0x427ef0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x808
mov eax, dword [0x5b3890]
xor eax, esp
mov dword [esp + 0x804], eax
push ebp
mov ebp, dword [esp + 0x814]
push edi
mov edi, dword [esp + 0x814]
test ebp, ebp
jne 0x427f31
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.0051916c
add esp, 0x808
ret
push ebx
push esi
push 0x400
lea eax, [esp + 0x18]
push eax
xor esi, esi
push esi
push edi
xor ebx, ebx
call fcn.00426bb0
add esp, 0x10
test eax, eax
jne 0x427fa2
nop
mov ecx, ebp
lea eax, [esp + 0x14]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x427f7c
test dx, dx
je 0x427f78
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x427f7c
add eax, 4
add ecx, 4
test dx, dx
jne 0x427f56
xor eax, eax
jmp 0x427f81
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x427fa0
push 0x400
lea ecx, [esp + 0x18]
push ecx
inc esi
push esi
push edi
call fcn.00426bb0
add esp, 0x10
test eax, eax
je 0x427f50
jmp 0x427fa2
mov ebx, esi
push ebx
push 0x56f17c
lea edx, [esp + 0x1c]
push 0x400
push edx
call fcn.004a3180
mov ecx, dword [str.SoftwareJeticoBCWipePatternSchemes]
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x427fd8
mov eax, 1
jmp 0x428023
lea eax, [esp + 0x14]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427fe0
mov ecx, dword [esp + 0x10]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x18]
push eax
push 1
push 0
push 0x56ba1c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
neg eax
sbb eax, eax
and eax, 5
mov ecx, dword [esp + 0x814]
pop esi
pop ebx
pop edi
pop ebp
xor ecx, esp
call fcn.0051916c
add esp, 0x808
ret

Function at 0x429980
Capabilities:
Get common file path

Disassembly:
sub esp, 0x61c
mov eax, dword [0x5b3890]
xor eax, esp
mov dword [esp + 0x618], eax
push esi
mov esi, dword [esp + 0x624]
push 0x104
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x4299c8
xor al, al
pop esi
mov ecx, dword [esp + 0x618]
xor ecx, esp
call fcn.0051916c
add esp, 0x61c
ret
push esi
lea ecx, [esp + 8]
push ecx
push str._s_notepad.exe___s_
lea edx, [esp + 0x218]
push 0x208
push edx
call fcn.004a3180
push 0
mov esi, dword [esp + 0x640]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x250]
push esi
push eax
call fcn.004bde50
add esp, 0x4c
cmp eax, 0xffffffff
je 0x429a25
test esi, esi
jne 0x429a25
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x61c]
pop esi
xor ecx, esp
mov al, 1
call fcn.0051916c
add esp, 0x61c
ret