joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407f80
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x144]
push esi
push edi
push ecx
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x407fdd
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [ebp - 0x144], 0x10
je 0x407fd0
lea eax, [ebp - 0x144]
push eax
push esi
call ebx
cmp eax, 1
je 0x407fb6
jmp 0x407fd5
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 4

Function at 0x408610
Capabilities:
Open clipboard
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x2001f
push 0
push 0x478a2c
push SysReAllocString
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x478a4c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x478a4c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x408790
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x2001f
push 0
push 0x478a2c
push SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
push esi
push 4
push 0
push 0x478a4c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40afb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474bcd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4d9770]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
push 0x10000
push 0
push 0x40c6d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [ebp - 0x10]
xor esi, esi
mov dword [ebp - 0x14], eax
mov eax, dword [0x52a67c]
mov ecx, eax
mov dword [ebp - 0x18], eax
mov edi, dword [eax + 4]
cmp byte [edi + 0xd], 0
jne 0x40b02d
mov eax, edi
nop
mov edi, eax
cmp dword [eax + 0x10], ebx
jae 0x40b01e
mov eax, dword [eax + 8]
xor esi, esi
jmp 0x40b027
mov ecx, eax
mov esi, 1
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x40b010
cmp byte [ecx + 0xd], 0
jne 0x40b038
cmp ebx, dword [ecx + 0x10]
jae 0x40b08a
cmp dword [0x52a680], 0xaaaaaaa
je 0x40b09c
mov dword [ebp - 0x20], 0x52a67c
push 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.0044d32b
mov ecx, dword [ebp - 0x14]
add esp, 4
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x10], ebx
mov dword [eax], ecx
push eax
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov ecx, 0x52a67c
push esi
push edi
mov word [eax + 0xc], 0
call fcn.0040cde0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0040d700
int3
Function at 0x40b0b0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc38
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4a76bc], 1
push esi
push edi
jne 0x40b0db
cmp dword [0x521200], 0
je 0x40b329
mov eax, dword [0x514990]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x40b0ed
push eax
call esi
push dword [0x527204]
call esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.0040ea20
add esp, 0xc
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push 0x55e620
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0045e4b4
push 0x479574
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004532c3
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004532c3
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0045e4b4
push 0x479574
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004532c3
push 0x479578
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004532c3
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x414]
add esp, 0x48
push eax
call edi
push 0x560d68
call edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.0045e4b4
push 0x47a680
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.004532c3
add esp, 0x18
lea eax, [ebp - 0x824]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
push 0x104
push eax
call fcn.0045e4b4
push str._spinner.gif
push 0x104
lea eax, [ebp - 0xa2c]
push eax
call fcn.004532c3
add esp, 0x18
lea eax, [ebp - 0xa2c]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc34]
push 0x104
push eax
call fcn.0045e4b4
push 0x47a6c8
lea eax, [ebp - 0xc34]
push 0x104
push eax
call fcn.004532c3
add esp, 0x18
lea eax, [ebp - 0xc34]
push eax
call edi
mov eax, dword [0x514990]
test eax, eax
je 0x40b293
push eax
call esi
push 0x52a458
call edi
test eax, eax
jne 0x40b2a5
push 0x52a458
call edi
sub esp, 0x18
mov eax, 0x55e854
mov edx, esp
lea esi, [eax + 2]
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b2c6
sub eax, esi
mov ecx, edx
sar eax, 1
push eax
push 0x55e854
call fcn.0040da40
mov ecx, 0x52abf8
call fcn.00418b00
test al, al
je 0x40b2fa
mov ecx, 0x52abf8
call fcn.00418490
lea eax, [ebp - 0x20c]
push eax
call fcn.0040b340
add esp, 4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b329
lea eax, [ebp - 0x20c]
push eax
call fcn.0040b340
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044d06d
mov esp, ebp
pop ebp
ret
Function at 0x40b9e0
Capabilities:
Create directory
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 0x61c]
push edi
mov edi, dword [ebp + 8]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040ea20
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x414]
lea eax, [eax + 2]
mov word [ebp + eax - 0x20e], cx
test cx, cx
jne 0x40ba34
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
mov esi, dword [ebp + 0xc]
push esi
push edi
call fcn.0045e4b4
push 0x479574
push esi
push edi
call fcn.004532c3
lea eax, [ebp - 0x20c]
push eax
push esi
push edi
call fcn.004532c3
add esp, 0x24
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x479574
push esi
push edi
call fcn.004532c3
add esp, 0xc
mov ecx, 0x52a6a0
push edi
call fcn.00416790
lea eax, [ebp - 0x414]
push eax
push esi
push edi
call fcn.004532c3
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x47a67c
push 0xb0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push edi
mov dword [ebp - 0x620], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x40bb2e
push 0
lea eax, [ebp - 0x624]
push eax
push dword [ebp - 0x620]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044d06d
mov esp, ebp
pop ebp
ret
Function at 0x40bff0
Capabilities:
Delete file
Delete registry value
Get common file path
Write file on windows

Disassembly:
cmp dword [0x52b018], 0
je 0x40c069
push ebx
mov ebx, dword [0x55ec70]
push esi
push edi
push 0
push 0
push 0xffffffffffffffff
push 0x479784
push 0
push 3
mov dword [0x55e828], 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
lea ecx, [edi - 1]
push ecx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
je 0x40c055
push edi
push esi
push 0xffffffffffffffff
push 0x479784
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x40c055
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x14]
mov ecx, 0x52abf8
call fcn.00418b70
pop edi
pop esi
pop ebx
push 0
push 0
push 2
push 4
push 0x47a244
mov ecx, 0x52abf8
call fcn.0041c080
cmp dword [0x52b018], 0
je 0x40c0da
push 0x47a260
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
mov ecx, 0x52abf8
call fcn.00418b70
push 0x47a280
push 0x47a334
mov ecx, 0x52abf8
call fcn.00420960
mov dword [0x53b6b0], 9
mov ecx, 0x52abf8
mov dword [0x5162c8], 1
jmp fcn.004186d0
push str.Shutdown__System_:_Hotkey_ViolationURL_
push 1
push dword [0x514990]
call fcn.00449450
add esp, 0xc
ret
Function at 0x40c530
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x7c], 1
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40c568
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044d06d
mov esp, ebp
pop ebp
ret
push ebx
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, eax
cmp edi, ebx
je 0x40c6a6
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 3
push 0
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x40c6a6
test ebx, ebx
jne 0x40c5bb
push ebx
push 0x47a760
call dword [sym.imp.USER32.dll_FindWindowA]
mov ebx, eax
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push ebx
call esi
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x80]
push eax
push edi
call esi
push 1
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x84], eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call esi
test eax, eax
jne 0x40c68f
push 0x70
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.004500f0
add esp, 0xc
mov dword [ebp - 0x20], 1
mov eax, 0x12
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x1c], ax
mov word [ebp - 0x38], ax
mov word [ebp - 0x54], ax
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x74]
push 0x1c
push eax
push 4
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x50], 3
call dword [sym.imp.USER32.dll_SendInput]
push edi
call esi
test eax, eax
jne 0x40c68f
push 0x13
push eax
push eax
push eax
push eax
push 1
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [ebp - 0x80], 0
je 0x40c682
push 6
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call esi
neg eax
sbb eax, eax
and eax, 1
mov dword [ebp - 0x7c], eax
push 0
push dword [ebp - 0x84]
push dword [ebp - 0x78]
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x40c6b5
push 9
jmp 0x40c6b7
push 5
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x7c]
xor ecx, ebp
pop esi
pop ebx
pop edi
call fcn.0044d06d
mov esp, ebp
pop ebp
ret
Function at 0x4133d0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
pop ebp
ret
Function at 0x414b60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SoftwareITSAutomation
push SysReAllocString
mov esi, ecx
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x1e8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.HandleId
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x414bd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x404]
push 0x47a8f0
push 0x400
push eax
call fcn.00453332
add esp, 0xc
mov dword [ebp - 0x808], 0x400
lea eax, [ebp - 0x80c]
push eax
push 0x20019
push 0
push 0x47a8fc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414cf6
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x810]
push eax
push 0
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x414c66
cmp dword [ebp - 0x808], eax
jne 0x414ca9
push 0x47a924
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.00453332
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x810]
push eax
push 0
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x804]
push 0x47886c
push eax
call fcn.00450270
add esp, 8
test eax, eax
je 0x414ce3
inc eax
push 0x47886c
push eax
call fcn.00450270
add esp, 8
test eax, eax
je 0x414ce3
mov byte [eax], 0
lea eax, [ebp - 0x804]
push eax
push dword [ebp + 0xc]
push esi
call fcn.00453332
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 8

Function at 0x414d10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push 0x47a978
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], 0x64
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x47a9a8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414d70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x80c]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push ecx
push 0x20019
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x808], 0x800
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414e0e
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x810]
push eax
push esi
push edi
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x414e02
mov eax, dword [ebp - 0x808]
inc eax
push eax
call fcn.004534d7
mov ecx, dword [ebp - 0x808]
mov esi, eax
lea eax, [ebp - 0x804]
inc ecx
push eax
push ecx
push esi
call fcn.00453332
add esp, 0x10
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 8
Function at 0x414e30
Capabilities:
Persist via appinit_dlls registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREWOW6432NodeMicrosoftWindows_NTCurrentVersionWindows
mov ebx, ecx
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], 4
call edi
test eax, eax
je 0x414e88
push 0
push 0
cmp eax, 2
mov ecx, str.key_not_found
push 1
mov edx, str.Access_Denied
cmovne ecx, edx
push 0x12
push ecx
jmp 0x414ebd
lea eax, [ebp - 8]
push eax
lea esi, [ebx + 0x2b4]
push esi
lea eax, [ebp - 0x14]
push eax
push 0
push str.LoadAppInit_DLLs
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x414ee9
cmp eax, 2
jne 0x414ed9
push 0
push 0
push 1
push 0x12
push str.key_not_found
mov ecx, 0x52abf8
call fcn.0041c080
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 1
mov ecx, str.Access_Denied
push 0x12
push ecx
jmp 0x414ebd
cmp dword [esi], 1
jne 0x414ec7
push 0x47ab60
lea eax, [ebp - 0x18]
push 2
push eax
call fcn.0040ea20
add esp, 0xc
mov dword [ebp - 0xc], 0xff
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREWOW6432NodeMicrosoftWindows_NTCurrentVersionWindows
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea eax, [ebp - 0xc]
add ebx, 0x2b8
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0
push str.AppInit_DLLs
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0
push 0
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xfde9
call ebx
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
mov eax, dword [ebp - 0x10]
push edi
push 0xffffffffffffffff
add eax, 0x2b8
push eax
push 0
push 0xfde9
call ebx
push 0
push 0
push 1
push 0x12
push edi
mov ecx, 0x52abf8
call fcn.0041c080
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414fa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20119
push 0
push 0x47a9cc
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], 0xff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0xe4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x47a9ec
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415000
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x2001f
push 0
push 0x47a92c
push SysReAllocString
mov esi, ecx
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x47a96c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x47a96c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415090
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x2001f
push 0
push 0x47a81c
push SysReAllocString
mov esi, ecx
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
mov dword [ebp - 0x10], 0xa00
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x47a858
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x47a858
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415110
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x2001f
push 0
push 0x47a868
push SysReAllocString
mov esi, ecx
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x47a8a8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x47a8a8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4151a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push 0x47aa80
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], 0x64
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x1ec]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x47aa7c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret