joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a34f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
push esi
push ebx
call fcn.0041a2e8
mov eax, esi
add esp, 0xc
cdq
sub eax, edx
xor edi, edi
mov esi, eax
mov eax, dword [ebp + 0xc]
sar esi, 1
test esi, esi
mov dword [ebp + 8], eax
jle 0x41a39f
lea eax, [ebp + 8]
push eax
call fcn.0041a333
add al, 0x11
pop ecx
xor al, byte [edi + ebx]
xor al, 2
mov byte [edi + ebx], al
inc edi
cmp edi, esi
jl 0x41a386
and byte [esi + ebx], 0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41a5fb
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowDC]
mov edi, eax
push 0
push edi
call dword [sym.imp.GDI32.dll_GetClipRgn]
mov ebx, dword [sym.imp.GDI32.dll_SelectClipRgn]
push 0
push edi
mov dword [ebp - 0x14], eax
call ebx
lea eax, [ebp - 0x24]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x20]
neg eax
push eax
mov eax, dword [ebp - 0x24]
neg eax
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
push 0x20
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
push dword [ebp - 8]
push edi
call fcn.0041a48d
mov eax, dword [ebp - 8]
neg eax
push eax
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [ebp - 0x20]
push dword [ebp - 4]
add eax, 0x16
push dword [ebp - 4]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov ecx, esi
call fcn.0041a747
mov eax, dword [ebp - 0x18]
push 0xcc0020
sub eax, dword [ebp - 0x20]
push 0
push 0
push dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 8]
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x14]
push edi
call ebx
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41a747
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push dword [ebp + 0xc]
mov esi, ecx
push eax
call dword [sym.imp.USER32.dll_CopyRect]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [esi + 0x1c]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp + 0xc], eax
push eax
call ebx
push 0xcc0020
push 0x16
xor edi, edi
push 0x16
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push edi
push edi
push dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_StretchBlt]
push dword [ebp - 4]
push dword [ebp + 0xc]
call ebx
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
push edi
push edi
push dword [ebp + 8]
mov ecx, esi
call fcn.0041a3f9
push edi
push 1
push dword [ebp + 8]
mov ecx, esi
call fcn.0041a3f9
push edi
push 2
push dword [ebp + 8]
mov ecx, esi
call fcn.0041a3f9
push edi
push 3
push dword [ebp + 8]
mov ecx, esi
call fcn.0041a3f9
push edi
push 4
push dword [ebp + 8]
mov ecx, esi
call fcn.0041a3f9
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x41a820
mov ecx, esi
call fcn.0041ad89
cmp eax, 0xffffffff
je 0x41a820
push 2
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.0041a3f9
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
push edi
push edi
push 0x7f
mov dword [ebp + 0xc], eax
push dword [esi + 4]
mov dword [ebp - 4], 0x10
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, edi
je 0x41a866
push 3
push edi
push edi
push 0x10
push 0x10
push eax
xor eax, eax
cmp dword [ebp + 0xc], edi
setne al
inc eax
inc eax
push eax
push 2
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawIconEx]
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push 1
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
dec eax
push dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
lea eax, [edi + eax + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x60]
sub eax, 0xc
mov dword [ebp - 0x1c], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
push dword [0x475994]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [0x474d44]
push dword [ebp + 8]
call ebx
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x24]
add esi, 0x70
push 0x48824
push eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawTextA]
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x41a95a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov eax, 0x45faa4
push edi
mov edi, dword [esp + 0xc]
push eax
push eax
mov esi, ecx
push edi
call fcn.00425e54
add esp, 0xc
lea eax, [esi + 0x70]
push 0x800
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 1
mov ecx, esi
call fcn.0041a8e0
push 0
push 0
push edi
mov dword [esi + 4], edi
call dword [sym.imp.USER32.dll_SetWindowRgn]
pop edi
pop esi
ret 4
Function at 0x41b0c3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
push ebx
xor ebx, ebx
push edi
push ebx
push dword [0x532da0]
mov dword [ebp - 0x14], ecx
push 0x1000
push dword [ebp + 8]
push 0x12
push 0x36
push ebx
push ebx
push 0x5600b94c
push ebx
push 0x40a9cc
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x10], edi
jne 0x41b10a
xor eax, eax
jmp 0x41b218
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push 0x14
push 0x41e
push edi
call esi
push 0xa000a
push ebx
push 0x420
push edi
call esi
push ebx
push ebx
push 0x421
push edi
call esi
lea eax, [ebp - 0x368]
mov dword [ebp - 8], 1
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
sub dword [ebp - 8], eax
mov byte [ebp + 8], 0x10
mov byte [ebp + 9], 0x10
mov byte [ebp + 0xa], 0x10
mov dword [ebp - 0x20], 0x44d
mov dword [ebp - 0x1c], 0x43d
mov dword [ebp - 0x18], 0x43b
lea edi, [ebp - 0x5c]
cmp ebx, 2
mov dword [edi], ebx
jl 0x41b186
mov eax, dword [ebp - 8]
add eax, ebx
lea eax, [ebp + eax + 8]
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
mov cl, byte [ebp + ebx + 8]
mov eax, dword [eax]
mov dword [edi + 4], eax
mov byte [edi + 8], 4
mov byte [edi + 9], cl
and dword [edi + 0xc], 0
test eax, eax
je 0x41b1be
push 0x104
push dword [ebp - 4]
push eax
push dword [0x532da0]
call dword [sym.imp.USER32.dll_LoadStringA]
mov eax, dword [ebp - 4]
mov dword [edi + 0x10], eax
jmp 0x41b1c2
and dword [edi + 0x10], 0
add dword [ebp - 0xc], 4
add dword [ebp - 4], 0x104
inc ebx
add edi, 0x14
cmp ebx, 3
jl 0x41b174
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
push 1
mov ecx, ebx
mov dword [ebx + 0xa1c], edi
call fcn.0041af96
lea eax, [ebp - 0x5c]
push eax
push 3
push 0x414
push edi
call esi
push 8
push 0
push 0x454
push edi
call esi
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, ebx
call fcn.0041c113
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x41bc41
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
test edi, edi
mov esi, ecx
jl 0x41bc56
cmp edi, dword [esi + 0xa10]
jl 0x41bc58
xor edi, edi
mov eax, dword [esi + 0xa14]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [eax + eax*4]
shl eax, 5
and dword [eax + esi + 0x90], 0
mov eax, dword [esi + 0xa14]
lea eax, [eax + eax*4]
shl eax, 5
mov eax, dword [eax + esi + 0xa4]
test eax, eax
je 0x41bc8e
push 0
push eax
call ebx
lea eax, [edi + edi*4]
mov dword [esi + 0xa14], edi
shl eax, 5
mov dword [eax + esi + 0x90], 1
mov eax, dword [esi + 0xa14]
lea ecx, [eax + eax*4]
shl ecx, 5
cmp dword [ecx + esi + 0xa4], 0
jne 0x41bcd6
push eax
mov ecx, esi
call fcn.0041bb12
mov ecx, dword [esi + 0xa14]
lea ecx, [ecx + ecx*4]
shl ecx, 5
mov dword [ecx + esi + 0xa4], eax
mov ecx, esi
call fcn.0041b4be
mov eax, dword [esi + 0xa14]
push 5
lea eax, [eax + eax*4]
shl eax, 5
push dword [eax + esi + 0xa4]
call ebx
mov eax, dword [esi + 0xa14]
mov ecx, esi
mov dword [0x4736a0], eax
call fcn.0041c06d
pop edi
pop esi
pop ebx
ret 4
Function at 0x420a42
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x45dbbc
call fcn.0045cfc0
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
je 0x420bdf
push esi
call fcn.00428692
test eax, eax
pop ecx
je 0x420a7e
push 0xa
push edi
push edi
push esi
push 0x40a890
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x420bdf
push ebx
push esi
lea ecx, [ebp - 0x10]
call fcn.00414105
mov esi, 0x40ab14
mov dword [ebp - 4], edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x14]
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0041460d
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x14]
inc bl
call fcn.00411a66
test bl, bl
je 0x420afd
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov ebx, 0x40a528
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x14]
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00419749
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004141ed
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
jmp 0x420b6d
mov esi, 0x40ab08
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x14]
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0041460d
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x14]
inc bl
call fcn.00411a66
test bl, bl
je 0x420ba1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov ebx, 0x40a514
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x14]
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00419749
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004141ed
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00411a66
xor edi, edi
cmp ebx, edi
je 0x420ba3
lea ecx, [ebp - 0x10]
call fcn.00414c24
mov esi, eax
cmp esi, edi
je 0x420bd2
mov eax, dword [0x495610]
push ebx
push esi
push dword [eax + 0x10]
call fcn.0042aae2
add esp, 0xc
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x420bd2
xor edi, edi
cmp dword [ebp + 0xc], edi
jne 0x420bc0
cmp dword [0x4736ec], edi
je 0x420bc0
push edi
mov ecx, 0x475a08
push dword [ebp + 8]
call fcn.00415de0
jmp 0x420bd2
push edi
push edi
push edi
push 2
push dword [ebp + 8]
mov ecx, 0x475a08
call fcn.00415cb4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00411a66
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x423ad1
Capabilities:
Delete file
Delete registry key

Disassembly:
push esi
call fcn.004276f4
mov ecx, dword [0x4617d4]
cmp eax, ecx
je 0x423b5e
test ecx, ecx
je 0x423b48
mov esi, SysReAllocString
push esi
push 0xffffffffffffffff
push 0x40ae24
push 0x40ae1c
push 0
call fcn.004242ff
add esp, 0x14
test eax, eax
je 0x423b18
call fcn.00423a36
push 0x40ae08
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
pop esi
ret
and dword [0x4617d4], 0
call fcn.00427704
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x10
push 0x40a37c
push 0xaa
call fcn.00424a93
pop ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
ret
call fcn.00423a36
call fcn.00423814
call fcn.00427704
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret

Function at 0x423b60
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov al, byte [0x45f128]
push ebx
push esi
push edi
push 0x40
mov byte [ebp - 0x108], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
push 0x41
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor ebx, ebx
pop ecx
xor eax, eax
cmp dword [0x4617d4], ebx
lea edi, [ebp - 0x108]
rep stosd dword es:[edi], eax
je 0x423c0e
cmp dword [ebp + 8], ebx
jne 0x423baa
mov dword [ebp + 8], 0x40ae34
push 1
call fcn.004237c9
mov esi, eax
pop ecx
cmp dword [esi], ebx
je 0x423c07
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x20b]
mov byte [ebp - 0x20c], bl
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40ae2c
lea eax, [ebp - 0x20c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [esi]
call fcn.00439d3e
add esp, 0x1c
dec al
neg al
sbb eax, eax
jmp 0x423cb0
xor eax, eax
jmp 0x423cb1
or edx, 0xffffffff
mov edi, 0x40ae08
mov ecx, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [ebp - 0x108]
sub edi, ecx
mov eax, ecx
mov dword [ebp - 4], esi
mov esi, edi
mov edi, dword [ebp - 4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [ebp + 8], ebx
rep movsb byte es:[edi], byte [esi]
je 0x423c99
mov edi, 0x40a0a0
mov ecx, edx
xor eax, eax
lea ebx, [ebp - 0x108]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
mov ecx, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea ebx, [ebp - 0x108]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov ecx, edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
mov ecx, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423cb6
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov al, byte [0x45f128]
push ebx
push esi
push edi
push 0x40
mov byte [ebp - 0x108], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
push 0x41
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor ebx, ebx
pop ecx
xor eax, eax
cmp dword [0x4617d4], ebx
lea edi, [ebp - 0x108]
rep stosd dword es:[edi], eax
je 0x423d61
cmp dword [ebp + 8], ebx
jne 0x423d00
mov dword [ebp + 8], 0x40ae34
push 1
call fcn.004237c9
mov esi, eax
pop ecx
cmp dword [esi], ebx
je 0x423d5a
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x20b]
mov byte [ebp - 0x20c], bl
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40ae2c
lea eax, [ebp - 0x20c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea eax, [ebp - 0x20c]
push eax
push dword [esi]
call fcn.00439c83
add esp, 0x18
dec al
neg al
sbb eax, eax
jmp 0x423e00
xor eax, eax
jmp 0x423e01
or edx, 0xffffffff
mov edi, 0x40ae08
mov ecx, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [ebp - 0x108]
sub edi, ecx
mov eax, ecx
mov dword [ebp - 4], esi
mov esi, edi
mov edi, dword [ebp - 4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [ebp + 8], ebx
rep movsb byte es:[edi], byte [esi]
je 0x423dec
mov edi, 0x40a0a0
mov ecx, edx
xor eax, eax
lea ebx, [ebp - 0x108]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
mov ecx, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea ebx, [ebp - 0x108]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov ecx, edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
mov ecx, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423e06
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa10
mov al, byte [0x45f128]
push ebx
push esi
push edi
push 0x40
mov byte [ebp - 0x10c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
push 3
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop edx
xor ebx, ebx
stosb byte es:[edi], al
push 0x41
xor eax, eax
cmp dword [0x4617d4], ebx
pop ecx
lea edi, [ebp - 0x10c]
mov dword [ebp - 8], edx
rep stosd dword es:[edi], eax
je 0x423f2b
cmp dword [ebp + 8], ebx
jne 0x423e5a
mov dword [ebp + 8], 0x40ae34
push 1
call fcn.004237c9
mov esi, eax
pop ecx
cmp dword [esi], ebx
je 0x423f24
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x20f]
mov byte [ebp - 0x210], bl
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40ae2c
lea eax, [ebp - 0x210]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xa0f]
mov byte [ebp - 0xa10], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xa10]
push 0x7ff
push eax
lea eax, [ebp - 0x210]
push dword [ebp + 0xc]
push eax
push dword [esi]
call fcn.004397a7
add esp, 0x24
cmp al, 1
jne 0x423f24
lea edi, [ebp - 0xa10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, ecx
je 0x423f24
mov esi, dword [ebp + 0x14]
cdq
sub eax, edx
sar eax, 1
lea edi, [eax - 1]
mov eax, dword [esi]
cmp eax, edi
jb 0x423eff
mov eax, edi
push eax
lea eax, [ebp - 0xa10]
push eax
push dword [ebp + 0x10]
call fcn.0044582a
mov eax, dword [esi]
add esp, 0xc
cmp eax, edi
jb 0x423f1a
mov eax, edi
push 1
mov dword [esi], eax
pop eax
jmp 0x423fd7
xor eax, eax
jmp 0x423fd7
mov edi, 0x40ae08
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp - 0x10c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 4], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, edx
cmp dword [ebp + 8], ebx
rep movsb byte es:[edi], byte [esi]
je 0x423fb5
mov edi, 0x40a0a0
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp - 0x10c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea ebx, [ebp - 0x10c]
and ecx, edx
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, edx
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x10c]
push dword [ebp + 0xc]
push eax
push dword [ebp + 0x18]
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423fdc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x120c
call fcn.0045cf90
cmp dword [ebp + 0x14], 0xffe
push ebx
push esi
push edi
jle 0x423ffc
xor eax, eax
jmp 0x42418c
mov al, byte [0x45f128]
push 0x40
mov byte [ebp - 0x108], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x41
xor ebx, ebx
pop ecx
xor eax, eax
cmp dword [0x4617d4], ebx
lea edi, [ebp - 0x108]
rep stosd dword es:[edi], eax
je 0x4240e1
cmp dword [ebp + 8], ebx
jne 0x42403e
mov dword [ebp + 8], 0x40ae34
push 1
call fcn.004237c9
mov esi, eax
pop ecx
cmp dword [esi], ebx
je 0x423ff5
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x20b]
mov byte [ebp - 0x20c], bl
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40ae2c
lea eax, [ebp - 0x20c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
push dword [ebp + 0x14]
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x120c]
push dword [ebp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x120c]
push eax
call fcn.00445875
lea edi, [ebp - 0x120c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x1c
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x423ff5
lea eax, [ebp - 0x120c]
push eax
lea eax, [ebp - 0x20c]
push dword [ebp + 0xc]
push eax
push dword [esi]
call fcn.004399ba
add esp, 0x10
cmp al, 1
jne 0x423ff5
push 1
pop eax
jmp 0x42418c
or edx, 0xffffffff
mov edi, 0x40ae08
mov ecx, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [ebp - 0x108]
sub edi, ecx
mov eax, ecx
mov dword [ebp - 4], esi
mov esi, edi
mov edi, dword [ebp - 4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [ebp + 8], ebx
rep movsb byte es:[edi], byte [esi]
je 0x42416c
mov edi, 0x40a0a0
mov ecx, edx
xor eax, eax
lea ebx, [ebp - 0x108]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
mov ecx, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea ebx, [ebp - 0x108]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov ecx, edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebx
mov ebx, ecx
mov ecx, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0x14]
lea eax, [ebp - 0x108]
push dword [ebp + 0x10]
push 3
push dword [ebp + 0xc]
push eax
push dword [ebp + 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret