joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4022c0
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
push 8
xor eax, eax
shl ecx, 1
pop esi
sar ecx, 1
mov edx, eax
xor edx, ecx
test dl, 1
je 0x4022e0
shr eax, 1
xor eax, 0xedb88320
jmp 0x4022e2
shr eax, 1
dec esi
jne 0x4022cc
pop esi
ret 4

Function at 0x402309
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [0x4082a0]
mov edx, ecx
dec ecx
test edx, edx
je 0x40233c
push edi
lea edx, [ecx + 1]
mov ecx, dword [esp + 8]
push esi
movzx esi, byte [ecx]
movzx edi, al
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x407ea0]
xor eax, esi
inc ecx
dec edx
jne 0x402322
pop esi
pop edi
mov dword [0x4082a0], eax
ret

Function at 0x404779
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x40840e]
test eax, eax
jg 0x40478c
and dword [0x4083d4], 0
xor eax, eax
ret
push edi
push esi
mov esi, 0x800
cmp eax, esi
ja 0x404799
mov esi, eax
mov edi, dword [0x4060ac]
push esi
push dword [0x4083d0]
push dword [0x407e04]
call edi
cmp dword [0x407e14], 0
mov ecx, eax
mov dword [0x4083d4], ecx
je 0x404808
cmp ecx, 0xffffffff
je 0x404808
cmp ecx, esi
je 0x404819
test ecx, ecx
jl 0x404808
mov ax, word [0x4078d0]
push dword [0x407e18]
inc ax
push eax
call fcn.00401f2a
mov ecx, dword [0x4083d4]
test ecx, ecx
jne 0x404801
push esi
push dword [0x4083d0]
push dword [0x407e04]
call edi
mov ecx, eax
mov dword [0x4083d4], ecx
cmp ecx, 0xffffffff
je 0x404808
mov esi, ecx
cmp ecx, esi
je 0x404819
push 2
call fcn.00402971
mov ecx, dword [0x4083d4]
sub dword [0x40840e], ecx
mov esi, dword [0x4083d0]
cmp dword [0x407e08], 0
mov dword [0x40841c], esi
je 0x40485b
mov eax, ecx
mov edx, eax
dec eax
test edx, edx
je 0x40485b
lea edi, [eax + 1]
call 0x4060cc
xor byte [esi], al
movzx eax, byte [esi]
push eax
call 0x4060e2
inc esi
dec edi
pop ecx
jne 0x404840
mov ecx, dword [0x4083d4]
mov eax, ecx
dec ecx
pop esi
mov dword [0x4083d4], ecx
pop edi
ret

Function at 0x7319b7
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x402a36
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42ec10]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x407010]
cmp eax, ebx
jne 0x402aca
mov esi, dword [0x407008]
mov edi, 0x105
jmp 0x402a87
cmp dword [ebp + 0x10], ebx
jne 0x402abe
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a36
test eax, eax
jne 0x402a99
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a6e
push dword [ebp - 4]
call dword [0x40701c]
push 2
call fcn.00405d2e
cmp eax, ebx
je 0x402ad1
push ebx
push dword [0x42ec10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402aca
push dword [ebp - 4]
call dword [0x40701c]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42ec10], ebx
jne 0x402ac7
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x407014]
test eax, eax
jne 0x402ac7
jmp 0x402aca

Function at 0x4058f3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x407010]
test eax, eax
jne 0x405964
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [section..rdata]
test eax, eax
jne 0x405953
cmp dword [ebp + 0x14], 1
je 0x405955
cmp dword [ebp + 0x14], 2
je 0x405955
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [0x40701c]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405a2e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
test eax, eax
jge 0x405a4c
mov ecx, dword [0x42e33c]
lea eax, [eax*4 + 4]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, dword [0x42eb98]
mov edx, dword [ebp + 8]
add ecx, eax
mov eax, 0x42db00
push ebx
sub edx, eax
push esi
push edi
cmp edx, 0x800
mov edi, eax
jae 0x405c4b
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405c4b
mov esi, edi
sub esi, eax
cmp esi, 0x400
jge 0x405c55
inc ecx
cmp dl, 0xfc
mov dword [ebp + 0xc], ecx
jbe 0x405c3e
movsx eax, byte [ecx + 1]
movsx ecx, byte [ecx]
mov esi, eax
mov ebx, ecx
and esi, 0x7f
and ebx, 0x7f
shl esi, 7
or esi, ebx
mov ebx, ecx
add dword [ebp + 0xc], 2
or bh, 0x80
mov dword [ebp - 0x18], ebx
mov ebx, ecx
mov ecx, eax
mov dword [ebp - 0x14], ebx
or ch, 0x80
cmp dl, 0xfe
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
jne 0x405be8
push 2
pop esi
call dword [0x4070e8]
test eax, eax
jns 0x405af8
cmp ax, 0x5a04
je 0x405af8
cmp dword [ebp - 0xc], 0x23
je 0x405af8
cmp dword [ebp - 0xc], 0x2e
je 0x405af8
and dword [ebp - 4], 0
jmp 0x405aff
mov dword [ebp - 4], 1
cmp dword [0x42ebe4], 0
je 0x405b0b
push 4
pop esi
test bl, bl
jns 0x405b46
mov eax, ebx
and ebx, 0x3f
add ebx, dword [0x42eb98]
and eax, 0x40
push eax
push edi
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004058f3
cmp byte [edi], 0
jne 0x405bcf
push dword [ebp - 0xc]
push edi
call fcn.00405a2e
jmp 0x405bca
cmp ebx, 0x25
jne 0x405b59
push 0x400
push edi
call dword [0x4070e4]
jmp 0x405bca
cmp ebx, 0x24
jne 0x405bc6
push 0x400
push edi
call dword [0x4070a4]
xor esi, esi
jmp 0x405bc6
mov eax, dword [0x42eb64]
xor ecx, ecx
dec esi
cmp eax, ecx
je 0x405b92
cmp dword [ebp - 4], ecx
je 0x405b92
push edi
push ecx
push ecx
push dword [ebp + esi*4 - 0x18]
push dword [0x42eb68]
call eax
test eax, eax
je 0x405bca
lea eax, [ebp - 8]
push eax
push dword [ebp + esi*4 - 0x18]
push dword [0x42eb68]
call dword [0x407164]
test eax, eax
jne 0x405bc3
push edi
push dword [ebp - 8]
call dword [0x407150]
push dword [ebp - 8]
mov ebx, eax
call dword [0x407278]
test ebx, ebx
jne 0x405bca
and byte [edi], 0
test esi, esi
jne 0x405b6e
cmp byte [edi], 0
je 0x405be0
cmp dword [ebp - 0xc], 0x1a
jne 0x405be0
push str.MicrosoftInternet_ExplorerQuick_Launch
push edi
call fcn.00405a28
push edi
call fcn.00405c6e
jmp 0x405c2c
cmp dl, 0xfd
jne 0x405c1b
cmp esi, 0x1d
jne 0x405c00
push dword [0x42eb68]
push edi
call fcn.0040596a
jmp 0x405c11
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push edi
call fcn.00405a0c
add esi, 0xffffffeb
cmp esi, 7
jae 0x405c2c
jmp 0x405be0
cmp dl, 0xff
jne 0x405c2c
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.00405a2e
push edi
call fcn.00405a22
mov ecx, dword [ebp + 0xc]
add edi, eax
mov eax, 0x42db00
jmp 0x405c4b
jne 0x405c48
mov dl, byte [ecx]
mov byte [edi], dl
inc edi
inc ecx
jmp 0x405c4b
mov byte [edi], dl
inc edi
mov dl, byte [ecx]
test dl, dl
jne 0x405a7b
and byte [edi], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405c6a
push eax
push dword [ebp + 8]
call fcn.00405a0c
leave
ret 8
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x43fa03
Capabilities:
Hash data with crc32

Disassembly:
je 0x43fbf7
jne 0x43fbf7
cmp dword [0x69a7642c], esi
lea edi, [eax + 0xcd0ea8]
cmp dword [0xd0c3a8], ecx
or dword [eax + 0x20], 0x80
mov byte [eax + esi - 1], 0
cmp dword [0xdeb3d8], edi
mov dword [0x112765ac], eax
mov dword [esi], 0xace0bc
movsx eax, word [ebp - reloc.crtdll.dll_vsprintf]
push 0xaab9a8
int1
rcr byte [esi], 1
loop 0x43f2e7
sub eax, 0x22a93090
aaa
out 0x83, al
leave
jmp [eax + reloc.crtdll.dll_sscanf]
movsd dword es:[edi], dword [esi]
add byte [eax + 0x4561b4], bh
mov eax, 0x10d7a2b8
mov edx, 0xb1ced4
push 0xa76714
mov dword [esi], 0x9fb764
push 0x4f0dcc
mov dword [edx + esi + 0x13c], 0x10261f8c
push 0x697a2e6c
mov byte [ebp - 0x132], 0
mov ecx, 0x15
sti
and bh, byte [edi + 0x4232049f]
cmp byte [eax], bl
mov al, byte [0x6b249244]
dec edi
arpl word [eax], bx
cwde
jmp 0x43fa03
not ecx
xor ebx, ebx
je 0x43fafa
jne 0x43fafa
cmp dword [ebp + 0xc], eax
jmp dword [ecx*4 + 0x86d66c]
shr ecx, 8
je 0x43f8c9
jne 0x43f8c9
mov dword [0x112b2da8], eax
neg dword [ebp + 0x12]
push 0xa233fc
push 0x1016adc0
mov dword [0x1124da0c], eax
mov dword [0x111d2de4], eax
cmp dword [ebp + 0x1c], 0x80000000
mov dword [esi], 0xa0e618
pmaddwd xmm6, xmmword [0x69809430]
mov eax, 0x10dab0f8
push 0x100d8c6c
mov ecx, dword [0x42be3c]
movzx eax, word [reloc.crtdll.dll_vsprintf]
add ebp, 0x518
mov dword [esi + 0x5c], 0x42edc0
push 0xaf4520
cmp byte [0xdef019], 0
mov dword [esp + 0xec], 0x1028d9a4
hlt
mov dword [ebp - 0x128], ebx
mov dword [ebp - 4], 0xfffffffe
push 0x43fb85
ret
push eax
push 0x43fe3a
ret
je 0x43f33b
movzx eax, byte [esi]
xor eax, ecx
je 0x43fd59
jne 0x43fd59
mov ecx, dword [0x1152b260]
lock cmpxchg dword [ebx], edx
mov dword [esi + 0x694], 1
mov dword [esi + 4], 0x63eba0
jmp dword [0x49140c]
xor ecx, dword [eax*4 + 0x401240]
push 0x43f5f1
ret
mov eax, edx
dec edx
mov dword [ebp - 0x130], edx
test eax, eax
jmp 0x43f814
mov dword [ebp - 0x124], esi
jmp 0x43f925
cmp ecx, 0x39b5d60d
sete bl
jmp 0x43f464
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4b19b0
push 0x4a41c0
mov eax, dword fs:[0]
jmp 0x43f67a
and eax, 0xff
jmp 0x43f37a
Function at 0xc3c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xc3c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc3c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc3c06a
add dl, dl
jne 0xc3c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc3c0dc
xor eax, eax
add dl, dl
jne 0xc3c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc3c17d
add dl, dl
jne 0xc3c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc3c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc3c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc3c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc3c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc3c075
mov eax, 1
add dl, dl
jne 0xc3c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc3c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc3c0e1
sub eax, ebx
mov ebx, 1
jne 0xc3c128
mov ecx, 1
add dl, dl
jne 0xc3c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc3c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc3c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc3c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc3c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc3c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc3c136
cmp eax, 0x7d00
jae 0xc3c16d
cmp eax, 0x500
jb 0xc3c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc3c075
cmp eax, 0x7f
ja 0xc3c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc3c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc3c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc3c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40aa93
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x40aaa3
push 0xd
pop eax
jmp 0x40aad3
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
push edi
call dword [fcn.004010a4]
inc eax
add edi, eax
add esi, eax
cmp eax, 1
jne 0x40aaaa
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x40b00e
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x418010]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
push edi
or ecx, 0x2001f
push ecx
push eax
push dword [esi]
xor edi, edi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x110], edi
call fcn.0040afc6
mov ebx, eax
cmp ebx, edi
je 0x40b07b
lea ecx, [ebp - 0x114]
call fcn.0040b133
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412315
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x40b099
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x114]
call fcn.0040b00e
cmp eax, edi
jne 0x40b0de
lea eax, [ebp - 0x124]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10c]
push eax
push edi
push dword [ebp - 0x114]
mov dword [ebp - 0x118], 0x100
call ebx
test eax, eax
je 0x40b083
lea ecx, [ebp - 0x114]
call fcn.0040b133
push dword [ebp - 0x11c]
call fcn.0040b155
lea ecx, [ebp - 0x114]
mov esi, eax
call fcn.0040b133
mov eax, esi
jmp 0x40b06a
Function at 0x40c27f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x418010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x218], eax
cmp dword [esi], ecx
jne 0x40c2b3
mov eax, 0x8000ffff
jmp 0x40c3b3
cmp eax, ecx
jne 0x40c2c1
mov eax, 0x80004003
jmp 0x40c3b3
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov dword [eax], ecx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push ecx
push edx
push dword [esi]
mov dword [ebp - 0x214], 0x208
mov dword [ebp - 0x210], ecx
call ebx
mov edi, eax
test edi, edi
je 0x40c308
cmp edi, 0xea
jne 0x40c39f
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x40c39f
cmp dword [ebp - 0x210], 1
je 0x40c338
cmp dword [ebp - 0x210], 7
je 0x40c338
cmp dword [ebp - 0x210], 2
je 0x40c338
mov edi, 0x3f4
jmp 0x40c3a3
xor ecx, ecx
mov word [ebp - 6], cx
test edi, edi
jne 0x40c359
lea eax, [ebp - 0x20c]
push eax
call dword [fcn.0040132c]
mov ecx, dword [ebp - 0x218]
mov dword [ecx], eax
jmp 0x40c3af
shr eax, 1
dec eax
push eax
push 0
call dword [fcn.00401328]
mov dword [ebp - 0x21c], eax
test eax, eax
je 0x40c3c1
lea ecx, [ebp - 0x214]
push ecx
push eax
push 0
push 0
push dword [ebp - 0x220]
push dword [esi]
call ebx
mov edi, eax
test edi, edi
jne 0x40c393
mov eax, dword [ebp - 0x21c]
jmp 0x40c34f
push dword [ebp - 0x21c]
call dword [fcn.00401324]
test edi, edi
jle 0x40c3af
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412315
leave
ret 4
mov eax, 0x8007000e
jmp 0x40c3b1
Function at 0x40d424
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x418010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x402bb0
lea edi, [ebp - 0x21c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x22c], 1
xor esi, esi
push ebx
call dword [0x4013a8]
cmp eax, ebx
mov dword [ebp - 0x224], eax
jge 0x40d489
push 0x1388
call dword [0x401194]
inc esi
cmp esi, 0xf
jl 0x40d462
jmp 0x40d5a6
push 4
pop edi
cmp dword [ebp - 0x220], ebx
je 0x40d56a
lea eax, [ebp - 0x220]
push eax
push 0x20019
push ebx
push dword [ebp - 0x220]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d56a
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x228]
push eax
push ebx
push 0x405c60
push dword [ebp - 0x220]
mov dword [ebp - 0x230], edi
call esi
test eax, eax
jne 0x40d508
cmp dword [ebp - 0x228], edi
jne 0x40d508
cmp dword [ebp - 0x234], ebx
sete al
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x228]
push eax
push ebx
push 0x405c80
push dword [ebp - 0x220]
mov dword [ebp - 0x238], 0x208
call esi
test eax, eax
jne 0x40d556
cmp dword [ebp - 0x228], 1
jne 0x40d556
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [0x40139c]
push dword [ebp - 0x220]
call dword [entry0]
cmp dword [ebp - 0x22c], ebx
je 0x40d5a6
mov ecx, edi
mov edi, 0x402bb0
lea esi, [ebp - 0x21c]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
push ebx
je 0x40d590
push 8
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
jmp 0x40d59a
push ebx
push ebx
push 2
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [0x4013a4]
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x224]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412315
leave
ret 4

Function at 0x40e058
Capabilities:
Parse pe header

Disassembly:
test esi, esi
jne 0x40e05f
xor al, al
ret
cmp dword [esi + 0x10], 0
jne 0x40e093
push dword [esi]
call dword [fcn.004011c4]
test eax, eax
je 0x40e05c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40e05c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40e05c
mov dword [esi + 0xc], eax
mov ecx, dword [ecx + 0x50]
add ecx, eax
mov dword [esi + 0x10], ecx
cmp dword [esi + 0xc], edi
ja 0x40e0a1
cmp edi, dword [esi + 0x10]
jae 0x40e0a1
xor eax, eax
inc eax
ret
xor eax, eax
ret