joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401028
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x405b70
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
xor esi, esi
cmp dword [0x44fe28], 1
lea eax, [esp + 4]
push eax
jne 0x405bc0
cmp dword [esp + 0x28], 1
jne 0x405ba8
push 0x20219
push esi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x405bd8
xor eax, eax
pop esi
pop ecx
ret
push 0x20119
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x405bd8
xor eax, eax
pop esi
pop ecx
ret
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x405bd8
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405c00
lea esi, [eax + 1]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret

Function at 0x401032
Capabilities:
Get common file path
Move file
Read .ini file

Disassembly:
jmp 0x401fe0
mov eax, 0x10210
call fcn.0041be90
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x1020c], eax
mov eax, dword [esp + 0x10218]
push ebp
mov ebp, dword [esp + 0x10218]
test ebp, ebp
mov dword [esp + 4], eax
jne 0x402027
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1020c]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x10210
ret
test eax, eax
je 0x40200f
push ebx
xor ebx, ebx
cmp dword [0x44fe24], 3
jl 0x40204e
push 5
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
jmp 0x402119
push esi
push edi
push 0xfffe
lea esi, [esp + 0x220]
mov eax, esi
push 0
push eax
call fcn.0041be10
add esp, 0xc
push 0x104
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.WinInit.ini
lea edx, [esp + 0x18]
push edx
call edi
lea eax, [esp + 0x14]
push eax
push 0x7fff
mov ecx, esi
push ecx
push 0x435c10
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
cmp word [esp + 0x21c], bx
je 0x4020c0
lea ecx, [ecx]
mov dx, word [esi]
add esi, 2
test dx, dx
jne 0x4020b0
cmp word [esi], bx
jne 0x4020b0
mov eax, dword [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x435c0c
push esi
call edi
push ebp
push esi
call edi
jmp 0x4020e0
mov cx, word [esi]
add esi, 2
test cx, cx
jne 0x4020e0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x220]
push eax
push 0x435c10
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
mov ecx, dword [esp + 0x10214]
mov eax, ebx
pop ebx
pop ebp
xor ecx, esp
call fcn.0041bdf4
add esp, 0x10210
ret
Function at 0x4010b9
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x407b70
sub esp, 0x664
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x660], eax
push ebx
push esi
mov esi, dword [esp + 0x670]
push edi
push 0x208
xor ebx, ebx
lea eax, [esp + 0x468]
push ebx
push eax
call fcn.0041be10
push 0x208
lea ecx, [esp + 0x26c]
push ebx
push ecx
call fcn.0041be10
push 0x250
lea edx, [esp + 0x28]
push ebx
push edx
call fcn.0041be10
push esi
lea eax, [esp + 0x284]
push 0x104
push eax
call fcn.0041c22f
push 0x435bf0
lea ecx, [esp + 0x290]
push 0x104
push ecx
call fcn.0041c1b5
add esp, 0x3c
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x407c7e
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
lea ebx, [ebx]
test byte [esp + 0x10], 0x10
jne 0x407c49
lea ecx, [esp + 0x3c]
push ecx
push esi
lea edx, [esp + 0x470]
push str._s_s
push edx
call ebp
add esp, 0x10
lea eax, [esp + 0x468]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407c20
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x664
ret
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0041bdf4
add esp, 0x664
ret
Function at 0x4010d2
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x40e1a0
sub esp, 0x4c
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
mov esi, dword [esp + 0x54]
test esi, esi
jne 0x40e1c9
xor eax, eax
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x4c
ret
push esi
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
movzx ecx, word [esi]
test cx, cx
mov dword [esp + 0x10], 0
je 0x40e219
movzx ecx, cx
mov edx, 0x450648
cmp cx, 0x20
je 0x40e219
add esi, 2
mov word [edx], cx
movzx ecx, word [esi]
add edx, 2
test cx, cx
jne 0x40e202
lea edx, [eax - 1]
mov eax, edx
test eax, eax
push edi
jbe 0x40e267
mov edi, 0x5f
jmp 0x40e230
movzx ecx, word [eax*2 + 0x450648]
cmp cx, 0x5c
je 0x40e253
cmp cx, 0x20
jne 0x40e24c
mov word [eax*2 + 0x450648], di
sub eax, 1
jne 0x40e230
jmp 0x40e267
cmp eax, edx
jne 0x40e267
push str.Vol_Unknown
push 0x450648
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push 0x450648
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40e29a
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x4c
ret
mov edx, dword [esp + 8]
lea ecx, [esp + 0x14]
push ecx
push 4
push str.APPLICATION_COMPLETED
push edx
call fcn.0040132f
push str.RESIDENCE
lea eax, [esp + 0x3c]
push 0x14
push eax
mov dword [esp + 0x2c], 0x28
mov dword [esp + 0x28], 1
call fcn.0041c22f
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0x1c
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
push 0x46b154
lea edx, [esp + 0x14]
push edx
push 0
lea eax, [esp + 0x38]
push eax
push ecx
call edi
push str.REGION
lea edx, [esp + 0x2c]
push 0x14
push edx
mov dword [esp + 0x1c], 0x14
mov dword [esp + 0x18], 1
call fcn.0041c22f
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push 0x46b17c
lea ecx, [esp + 0x14]
push ecx
push 0
lea edx, [esp + 0x38]
push edx
push eax
call edi
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esi], 0
je 0x40e378
push 0x208
push 0x44f400
push esi
call fcn.004011fe
add esp, 0xc
test eax, eax
jne 0x40e36c
mov dword [0x450c54], 1
jmp 0x40e378
mov dword [0x450c54], 2
mov esi, eax
movzx eax, word [esi]
test ax, ax
je 0x40e3c6
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp ax, 0x2d
jne 0x40e3ae
push 7
push esi
lea edx, [esp + 0x20]
push 8
push edx
call fcn.0041c29b
add esp, 0x10
push str._NOEULA
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
je 0x40e3bc
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x40e386
jmp 0x40e3c6
mov dword [0x44f814], 0
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0041bdf4
add esp, 0x4c
ret
Function at 0x4010d7
Capabilities:
Get common file path

Disassembly:
jmp 0x4060c0
sub esp, 0x690
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x68c], eax
mov eax, dword [esp + 0x694]
push esi
push 0x208
xor esi, esi
lea ecx, [esp + 0x284]
push esi
push ecx
mov dword [esp + 0x10], eax
call fcn.0041be10
push 0x208
lea edx, [esp + 0x498]
push esi
push edx
call fcn.0041be10
push 0x250
lea eax, [esp + 0x24]
push esi
push eax
call fcn.0041be10
xor eax, eax
add esp, 0x24
lea ecx, [esp + 0x280]
push ecx
push 0x104
mov dword [esp + 0x260], eax
mov dword [esp + 0x264], eax
mov dword [esp + 0x268], eax
mov dword [esp + 0x26c], eax
mov dword [esp + 0x270], eax
mov dword [esp + 0x274], eax
mov dword [esp + 0x278], eax
mov dword [esp + 0x27c], eax
mov dword [esp + 0x280], eax
mov dword [esp + 0x284], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x406190
pop esi
mov ecx, dword [esp + 0x68c]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x690
ret
lea eax, [esp + 0x280]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4061a0
sub eax, edx
sar eax, 1
lea edx, [esp + eax*2 + 0x27e]
push edx
lea eax, [esp + 0x284]
push eax
call fcn.00401113
add esp, 8
test eax, eax
jne 0x4061e5
push 0x435bfc
lea ecx, [esp + 0x284]
push 0x104
push ecx
call fcn.0041c22f
add esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindClose]
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea ebx, [ebx]
push esi
lea edx, [esp + 0x268]
push str.IJINS_03d.ini
push edx
call edi
lea eax, [esp + 0x270]
push eax
lea ecx, [esp + 0x29c]
push ecx
lea edx, [esp + 0x4a8]
push 0x435d60
push edx
call edi
add esp, 0x1c
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x498]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x406256
push eax
add esi, 1
call ebp
cmp esi, 0x3e7
jle 0x406200
jmp 0x406269
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x264]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [esp + 0x69c]
pop edi
pop ebp
xor eax, eax
cmp esi, 0x3e8
pop ebx
setne al
pop esi
xor ecx, esp
call fcn.0041bdf4
add esp, 0x690
ret
Function at 0x401163
Capabilities:
Write file on windows

Disassembly:
jmp 0x4064e0
sub esp, 0x418
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, dword [esp + 0x420]
test esi, esi
jne 0x406518
xor eax, eax
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x418
ret
push 0x410
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.0041be10
add esp, 0xc
cmp dword [esp + 0x424], 1
push 0xa
push 0xd
push esi
jne 0x406565
cmp dword [esp + 0x434], 0
je 0x406559
push str.FILEREGI64__s__1c_1c
lea ecx, [esp + 0x18]
push ecx
jmp 0x40656f
push str.FILEREGI__s__1c_1c
lea edx, [esp + 0x18]
push edx
jmp 0x40656f
push str.FILE__s__1c_1c
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [0x486308]
add eax, eax
push eax
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x418]
neg eax
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0041bdf4
add esp, 0x418
ret

Function at 0x401181
Capabilities:
Write file on windows

Disassembly:
jmp 0x407860
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push edi
xor edi, edi
cmp esi, edi
mov dword [esp + 0xc], 0xfeff
mov dword [esp + 8], edi
je 0x4078a5
push 2
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x4078a5
push edi
lea eax, [esp + 0xc]
push eax
push 2
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
lea eax, [edi + 1]
jne 0x4078a7
mov eax, edi
pop edi
pop esi
add esp, 8
ret
Function at 0x4011bd
Capabilities:
Delete registry key

Disassembly:
jmp 0x408330
sub esp, 0x40c
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x408], eax
push 0x200
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.0041be10
push 0x200
lea ecx, [esp + 0x218]
push 0
push ecx
call fcn.0041be10
add esp, 0x18
lea edx, [esp + 4]
push edx
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 1
push 0x435de4
push 0
push str.SYSTEMAPP_Installer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x408409
mov edx, dword [0x486304]
push 0x100
lea ecx, [esp + 0xc]
push ecx
push 0x458
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x44f200
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x210]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0
lea edx, [esp + 0x218]
push edx
push 0
call fcn.004010be
add esp, 0x18
xor eax, eax
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x40c
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SYSTEMAPP_Installer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp + 0x408]
xor ecx, esp
mov eax, 1
call fcn.0041bdf4
add esp, 0x40c
ret

Function at 0x4011c7
Capabilities:
Enumerate processes

Disassembly:
jmp 0x4054b0
sub esp, 0x230
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push edi
mov edi, dword [esp + 0x23c]
push 0x22c
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0041be10
add esp, 0xc
push 0
push 2
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 8]
mov esi, eax
push ecx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x405523
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x230
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push edi
lea edx, [esp + 0x34]
push edx
call ebx
test eax, eax
je 0x405581
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x405560
push edi
lea ecx, [esp + 0x34]
push ecx
call ebx
test eax, eax
je 0x405581
lea edx, [esp + 0xc]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x405545
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x230
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x238]
pop ebx
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0041bdf4
add esp, 0x230
ret
Function at 0x401285
Capabilities:
Shutdown system

Disassembly:
jmp 0x40f000
sub esp, 0x24
xor eax, eax
cmp dword [0x450c54], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
je 0x40f09c
cmp dword [esp + 0x28], eax
jne 0x40f119
lea eax, [esp]
push eax
push 0xf003f
push 0
push 0x450648
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f119
mov edx, dword [esp]
lea ecx, [esp + 8]
push ecx
push 4
push str.REBOOT
push edx
call fcn.0040132f
mov eax, dword [esp + 0x10]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x24
ret
cmp dword [0x44fe24], 3
jl 0x40f10f
lea ecx, [esp + 4]
push ecx
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [esp + 0xc]
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x14]
push 0
mov edx, 2
push ecx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x24
ret
Function at 0x40128a
Capabilities:
Set registry value

Disassembly:
jmp 0x405a00
sub esp, 0x10
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARECanonIJAppInstaller
push 0x80000002
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov eax, dword [esp]
jne 0x405b08
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea edx, [esp + 0xc]
push edx
push 4
push 0
push str.APPLICATION_COMPLETED
push eax
call esi
mov edx, dword [esp + 4]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push str.REBOOT
push edx
call esi
mov eax, 0x46b154
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405a90
mov ecx, dword [esp + 4]
sub eax, edx
sar eax, 1
add eax, eax
push eax
push 0x46b154
push 1
push 0
push str.RESIDENCE
push ecx
call esi
mov eax, 0x46b17c
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405ac0
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov eax, dword [esp + 4]
push edx
push 0x46b17c
push 1
push 0
push str.REGION
push eax
call esi
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x10
ret
test eax, eax
je 0x405b13
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc]
xor ecx, esp
xor eax, eax
call fcn.0041bdf4
add esp, 0x10
ret

Function at 0x40128f
Capabilities:
Hide graphical window

Disassembly:
jmp 0x403890
sub esp, 0x20
push esi
mov esi, dword [esp + 0x28]
test esi, esi
je 0x403931
xor eax, eax
push 0x10
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x10]
sub edx, dword [esp + 8]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub ecx, dword [esp + 4]
sub eax, edx
add eax, dword [esp + 0x18]
push 1
push edx
cdq
sub eax, edx
sar eax, 1
push ecx
push eax
mov eax, dword [esp + 0x2c]
sub eax, ecx
add eax, dword [esp + 0x24]
cdq
sub eax, edx
sar eax, 1
push eax
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
pop esi
add esp, 0x20
ret
Function at 0x4012d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
jmp 0x407130
sub esp, 0x830
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x82c], eax
mov eax, dword [esp + 0x840]
mov ecx, dword [esp + 0x844]
mov edx, dword [esp + 0x848]
push ebx
mov ebx, dword [esp + 0x840]
push ebp
mov ebp, dword [esp + 0x83c]
push esi
push edi
mov edi, dword [esp + 0x848]
push 0x1fe
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x240]
push 0
push eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov esi, 0x20019
mov dword [esp + 0x24], 0
call fcn.0041be10
push 0x400
lea ecx, [esp + 0x44c]
push 0
push ecx
call fcn.0041be10
push 0x200
lea edx, [esp + 0x58]
push 0
push edx
call fcn.0041be10
add esp, 0x24
cmp dword [0x44fe28], 1
jne 0x4071ea
mov esi, dword [esp + 0x85c]
sub esi, 1
neg esi
sbb esi, esi
and esi, 0xffffff00
add esi, 0x20219
lea eax, [esp + 0x14]
push eax
push esi
push 0
push edi
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call ebp
test eax, eax
je 0x407207
xor eax, eax
jmp 0x40732a
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x18]
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x250]
push eax
push 0
push ecx
mov dword [esp + 0x30], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x407304
lea esp, [esp]
lea edx, [esp + 0x23c]
push edx
push edi
lea eax, [esp + 0x444]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [esp + 0x20]
push ecx
push esi
push 0
lea edx, [esp + 0x448]
push edx
push 0x80000002
call ebp
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
push ebx
push eax
mov dword [esp + 0x34], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4072e0
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x250]
add eax, 1
push ecx
push eax
push edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x407240
jmp 0x407304
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x3c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov dword [eax], edx
mov edx, dword [esp + 0x30]
mov dword [edx], ecx
mov eax, dword [esp + 0x14]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x407315
push eax
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x407320
push eax
call esi
xor eax, eax
cmp word [esp + 0x3c], ax
setne al
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041bdf4
add esp, 0x830
ret
Function at 0x4012df
Capabilities:
Create directory

Disassembly:
jmp 0x409a10
sub esp, 0x664
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x660], eax
push edi
mov edi, dword [esp + 0x66c]
test edi, edi
jne 0x409a48
xor eax, eax
pop edi
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x664
ret
push 0x208
lea eax, [esp + 0x258]
push 0
push eax
call fcn.0041be10
push 0x250
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.0041be10
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x409afb
push ebx
push ebp
lea ebx, [esp + 0x25c]
push esi
mov esi, edi
sub ebx, edi
mov ebp, eax
nop
cmp word [esi], 0x5c
jne 0x409ae9
push esi
push edi
call fcn.00401113
add esp, 8
test eax, eax
je 0x409ae9
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x409ae2
push 0
lea ecx, [esp + 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x409ae9
lea edx, [esp + 0x260]
push edx
call fcn.004012c1
add esp, 4
jmp 0x409ae9
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ax, word [esi]
mov word [ebx + esi], ax
add esi, 2
sub ebp, 1
jne 0x409a90
pop esi
pop ebp
pop ebx
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x409b39
push 0
lea eax, [esp + 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x409b40
lea ecx, [esp + 0x254]
push ecx
call fcn.004012c1
add esp, 4
jmp 0x409b40
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x664]
pop edi
xor ecx, esp
mov eax, 1
call fcn.0041bdf4
add esp, 0x664
ret