joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418830
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x439160], 0
push ebx
push esi
push edi
mov ebx, 0x400
jne 0x41887b
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x455e2c], ax
xor eax, eax
mov word [0x455e2e], ax
mov dword [0x439160], 0x455e2c
push 0x32
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040e767
mov edi, dword [ebp + 0x10]
xor eax, eax
mov esi, dword [ebp + 0x14]
push esi
push edi
push 0x439150
mov word [edi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
mov word [edi + esi*2 - 2], ax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x418bd1
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2004
call fcn.0041c240
mov ecx, dword [esp + 0x2014]
push ebx
xor ebx, ebx
push esi
test ecx, ecx
je 0x418bec
mov byte [ecx], bl
mov edx, dword [esp + 0x2020]
test edx, edx
je 0x418bf9
mov byte [edx], bl
mov esi, dword [esp + 0x2010]
test esi, esi
je 0x418cbc
movzx eax, word [esi]
test ax, ax
je 0x418cbc
push ebp
mov ebp, dword [esp + 0x2018]
push edi
mov edi, dword [esp + 0x2020]
mov dword [esp + 0x10], ebx
movzx eax, ax
add esi, 2
cmp eax, 0x3d
jne 0x418c46
test edi, edi
je 0x418c50
test ebx, ebx
jne 0x418c50
test ecx, ecx
je 0x418c42
mov byte [ecx], 1
mov ebx, ebp
jmp 0x418c67
cmp eax, 0xd
je 0x418c7a
cmp eax, 0xa
je 0x418c7d
mov word [ebp], ax
add ebp, 2
mov eax, dword [esp + 0x202c]
add eax, 0xfffffffe
cmp dword [esp + 0x10], eax
jge 0x418c75
movzx eax, word [esi]
inc dword [esp + 0x10]
test ax, ax
jne 0x418c28
jmp 0x418c7d
mov byte [edx], 1
jmp 0x418c7d
add esi, 2
xor eax, eax
mov word [ebp], ax
test edi, edi
je 0x418cb6
mov word [edi], ax
test ebx, ebx
je 0x418cb6
push 0x1000
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [esp + 0x202c]
lea eax, [esp + 0x18]
push eax
push edi
call fcn.0040e847
xor eax, eax
mov word [ebx], ax
pop edi
mov eax, esi
pop ebp
jmp 0x418cbe
xor eax, eax
pop esi
pop ebx
add esp, 0x2004
ret 0x18

Function at 0x418cc9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov ebx, eax
neg ebx
sbb bl, bl
add bl, 1
je 0x418d18
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 4]
dec eax
neg eax
sbb al, al
lea ebx, [eax + 1]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
jmp 0x418d20
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x419e5a
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
mov eax, 0x42ef70
call fcn.0041c16c
mov eax, 0x1bc80
call fcn.0041c240
cmp dword [ebp + 0xc], 0
je 0x41aa54
push 0x1000
lea eax, [ebp - 0xe]
push eax
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp - 0x5c84]
push eax
lea eax, [ebp - 0xfc8c]
push eax
push dword [ebp + 0xc]
call fcn.00418bd1
mov ecx, eax
mov dword [ebp + 0xc], ecx
test ecx, ecx
je 0x41aa54
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push 6
lea eax, [ebp - 0x5c84]
lea esi, [ebp - 0x1bc8c]
pop edi
push esi
push eax
call fcn.004188bb
add esi, 0x2000
sub edi, 1
jne 0x419ebd
mov esi, edi
push dword [esi*4 + 0x439168]
lea eax, [ebp - 0xfc8c]
push eax
call fcn.004100df
test eax, eax
je 0x419ef3
inc esi
cmp esi, 0xe
jb 0x419ed1
jmp case.default.0x419efc
cmp esi, 0xd
ja case.default.0x419efc
jmp dword [esi*4 + 0x41aa66]
cmp ebx, 2
jne case.default.0x419efc
mov esi, 0x800
lea eax, [ebp - 0x7c84]
push esi
push eax
call fcn.004181bc
push esi
lea eax, [ebp - 0xdc8c]
push eax
lea eax, [ebp - 0x5c84]
push eax
lea eax, [ebp - 0x7c84]
push eax
call fcn.0040af10
lea ecx, [ebp - 0x8c8c]
call fcn.00409b3d
lea eax, [ebp - 0xdc8c]
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x8c8c]
call fcn.00409c77
invalid
invalid
invalid
Function at 0x41afeb
Capabilities:
Hide graphical window

Disassembly:
and dword [0x441728], 0
push 1
push dword [esp + 8]
mov byte [0x441725], 1
mov byte [0x441726], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.004014c3
cmp dword [0x448734], 0
jne 0x41b02b
cmp byte [0x44874d], 0
je 0x41b034
cmp dword [0x448748], 0
jne 0x41b047
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x41b1d7
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0041c240
push esi
push dword [ebp + 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call fcn.0040e63c
mov esi, eax
test esi, esi
je 0x41b22f
movzx ecx, word [esi]
push ecx
jmp 0x41b21a
add esi, 2
movzx eax, word [esi]
push eax
call fcn.0040e733
test al, al
jne 0x41b213
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x421517
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov eax, dword [0x4391b8]
and eax, 0x1f
push 0x20
pop ecx
sub ecx, eax
xor eax, eax
ror eax, cl
xor eax, dword [0x4391b8]
mov dword [0x458260], eax
ror edx, 6
cmp dword [0x4395ea], 0x54548201
jbe 0x421547
call fcn.00417240
test dword [0x439afb], edi
jp 0x421551
not edi
rol ebx, 0x17
cmp dword [0x439205], esi
ja 0x42155e
and edi, ebp
or esi, edi
inc edi
xchg esi, eax
and dword [0x458a65], eax
mov edx, 0x75fd3aa4
and eax, 0x39346f70
xor edi, dword [0x43959f]
call fcn.0041c5ee
add edx, ebp
call fcn.00415429
xor edx, esi
mov dword [0x458935], eax
and eax, eax
xor edi, 0xc2b8a8dc
mov ebx, eax
sub edx, edx
mov ecx, 0x79e31054
neg edi
ror edx, 1
dec edx
shl eax, 2
xor eax, 0xc465c7a1
sub edi, dword [0x4399e3]
or edi, esp
shl eax, 0x1b
neg edi
add dword [0x458b65], esi
dec ecx
jne 0x42159f
ror edi, 0xd
xor edi, ebp
test ebp, ebx
jb 0x4215d0
not edi
inc esi
and eax, dword [0x439482]
or ebx, 0x8f6c4f3b
neg eax
dec ebx
shl edx, 0xd
add edi, edi
sub dword [0x45890b], ebx
inc esi
add ecx, ecx
call fcn.0041812f
cmp dword [0x439214], 0x25d2221e
jne 0x421605
and ecx, 0x616339b2
sub esi, esp
call fcn.0041812f
add ecx, 0xb710dd33
or edx, 0x3de0157b
not edx
call fcn.0041feb5
rol esi, 7
mov ecx, 0x46847d6e

Function at 0x421560
Capabilities:
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov eax, dword [0x4391b8]
and eax, 0x1f
push 0x20
pop ecx
sub ecx, eax
xor eax, eax
ror eax, cl
xor eax, dword [0x4391b8]
mov dword [0x458260], eax
ror edx, 6
cmp dword [0x4395ea], 0x54548201
jbe 0x421547
call fcn.00417240
test dword [0x439afb], edi
jp 0x421551
not edi
rol ebx, 0x17
cmp dword [0x439205], esi
ja 0x42155e
and edi, ebp
or esi, edi
inc edi
xchg esi, eax
and dword [0x458a65], eax
mov edx, 0x75fd3aa4
and eax, 0x39346f70
xor edi, dword [0x43959f]
call fcn.0041c5ee
add edx, ebp
call fcn.00415429
xor edx, esi
mov dword [0x458935], eax
and eax, eax
xor edi, 0xc2b8a8dc
mov ebx, eax
sub edx, edx
mov ecx, 0x79e31054
neg edi
ror edx, 1
dec edx
shl eax, 2
xor eax, 0xc465c7a1
sub edi, dword [0x4399e3]
or edi, esp
shl eax, 0x1b
neg edi
add dword [0x458b65], esi
dec ecx
jne 0x42159f
ror edi, 0xd
xor edi, ebp
test ebp, ebx
jb 0x4215d0
not edi
inc esi
and eax, dword [0x439482]
or ebx, 0x8f6c4f3b
neg eax
dec ebx
shl edx, 0xd
add edi, edi
sub dword [0x45890b], ebx
inc esi
add ecx, ecx
call fcn.0041812f
cmp dword [0x439214], 0x25d2221e
jne 0x421605
and ecx, 0x616339b2
sub esi, esp
call fcn.0041812f
add ecx, 0xb710dd33
or edx, 0x3de0157b
not edx
call fcn.0041feb5
rol esi, 7
mov ecx, 0x46847d6e
Function at 0x421655
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xor dword [0x458be4], ecx
not edi
sub edx, 0x10577b3
mov ebx, dword [str.SavePath]
sub dword [0x458ada], edx
xor eax, 0xc5d2c71a
or ebx, 0x408e619f
inc eax
inc eax
cmp dword [0x439552], 0xdc3cca1d
ja 0x42165b
add esi, esp
mov eax, edx
xchg ebx, esi
neg edx
dec ecx
jne 0x421627
inc ebx
ror edx, 0xe
neg esi
dec ebx
xchg edx, esi
mov ecx, 0x926a17fe
not esi
salc
shl ecx, 0x1b
shr esi, 0x1a
xchg ebx, edx
call fcn.004246d7
ror ecx, 0x1b
add edx, edi
mov ecx, 0x76c53127

Function at 0x421674
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xor dword [0x458be4], ecx
not edi
sub edx, 0x10577b3
mov ebx, dword [str.SavePath]
sub dword [0x458ada], edx
xor eax, 0xc5d2c71a
or ebx, 0x408e619f
inc eax
inc eax
cmp dword [0x439552], 0xdc3cca1d
ja 0x42165b
add esi, esp
mov eax, edx
xchg ebx, esi
neg edx
dec ecx
jne 0x421627
inc ebx
ror edx, 0xe
neg esi
dec ebx
xchg edx, esi
mov ecx, 0x926a17fe
not esi
salc
shl ecx, 0x1b
shr esi, 0x1a
xchg ebx, edx
call fcn.004246d7
ror ecx, 0x1b
add edx, edi
mov ecx, 0x76c53127

Function at 0x421677
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xor dword [0x458be4], ecx
not edi
sub edx, 0x10577b3
mov ebx, dword [str.SavePath]
sub dword [0x458ada], edx
xor eax, 0xc5d2c71a
or ebx, 0x408e619f
inc eax
inc eax
cmp dword [0x439552], 0xdc3cca1d
ja 0x42165b
add esi, esp
mov eax, edx
xchg ebx, esi
neg edx
dec ecx
jne 0x421627
inc ebx
ror edx, 0xe
neg esi
dec ebx
xchg edx, esi
mov ecx, 0x926a17fe
not esi
salc
shl ecx, 0x1b
shr esi, 0x1a
xchg ebx, edx
call fcn.004246d7
ror ecx, 0x1b
add edx, edi
mov ecx, 0x76c53127

Function at 0x4216b5
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
rol ebx, 0x1f
mov edi, 0x8f067755
invalid
neg esi
shr esi, 0xd
not esi
dec ecx
jne 0x42168c
mov edx, 0xf457ea47
mov esi, ecx
not edx
add edi, 0x352dd94
neg esi
fidivr word [eax + 0x55c62a66]
cmp dword [0x43917a], ebp
jl 0x4216e1
rol edi, 2
and edx, 0x109479f0
xchg edi, eax
ror edi, 0x13
mov ecx, 0x6cf2dc72

Function at 0x4216e0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
rol ebx, 0x1f
mov edi, 0x8f067755
invalid
neg esi
shr esi, 0xd
not esi
dec ecx
jne 0x42168c
mov edx, 0xf457ea47
mov esi, ecx
not edx
add edi, 0x352dd94
neg esi
fidivr word [eax + 0x55c62a66]
cmp dword [0x43917a], ebp
jl 0x4216e1
rol edi, 2
and edx, 0x109479f0
xchg edi, eax
ror edi, 0x13
mov ecx, 0x6cf2dc72
Function at 0x42fe70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x23000]
push edi
jmp 0x42fe8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42fe91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42fe80
mov eax, 1
add ebx, ebx
jne 0x42fea3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42fe98
jne 0x42feb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42fe98
xor ecx, ecx
sub eax, 3
jb 0x42fec8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42ff3a
mov ebp, eax
add ebx, ebx
jne 0x42fed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42fee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42ff04
inc ecx
add ebx, ebx
jne 0x42fef0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42fee5
jne 0x42ff01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42fee5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42ff24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42ff15
jmp 0x42fe86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42ff24
add edi, ecx
jmp 0x42fe86
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42ff42
cmp byte [edi], 9
jne 0x42ff42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42ff47
lea edi, [esi + 0x2d000]
mov eax, dword [edi]
or eax, eax
je 0x42ffbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x41980]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x41a60]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42ff74
mov ecx, edi
jns 0x42ffa3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x41a68]
or eax, eax
je 0x42ffb9
mov dword [ebx], eax
add ebx, 4
jmp 0x42ff91
call dword [esi + 0x41a64]
mov ebp, dword [esi + 0x41a6c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42fff3
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x401c80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401c99
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401cd4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401cd0
lea ebx, [ebx]
cmp esi, eax
jae 0x401cd4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401cc0
cmp esi, eax
jb 0x401cda
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401e30
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x90
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x8c], eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [esp + 8]
push eax
push 0xf013f
xor edi, edi
push edi
push str.SYSTEMCurrentControlSetServices_bcfnt
push closesocket
mov dword [esp + 0x1c], 0
call esi
test eax, eax
je 0x401ea5
lea ecx, [esp + 8]
push ecx
push 0xf003f
push edi
push str.SYSTEMCurrentControlSetServices_bcfnt
push closesocket
call esi
test eax, eax
je 0x401ea5
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.00524d83
add esp, 0x90
ret
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0x54fd94
push edx
mov dword [esp + 0x24], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401f46
cmp dword [esp + 0x10], 1
jne 0x401f46
lea eax, [esp + 0x14]
push str.WdfLoadGroup
push eax
call fcn.00525745
add esp, 8
test eax, eax
je 0x401f41
xor eax, eax
movzx ecx, word [eax + str.WdfLoadGroup]
mov word [esp + eax + 0x14], cx
add eax, 2
test cx, cx
jne 0x401ef1
lea eax, [esp + 0x14]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401f10
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 4]
mov eax, dword [esp + 8]
push ecx
lea edx, [esp + 0x18]
push edx
push 1
push 0
push 0x54fd94
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x401f46
mov edi, 1
mov eax, dword [esp + 8]
test eax, eax
je 0x401f55
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x94]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00524d83
add esp, 0x90
ret
Function at 0x402320
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x402398
push ebx
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ebx, dword [esp + 8]
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402340
push esi
sub eax, edx
push edi
sar eax, 1
lea edi, [eax + eax + 2]
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x40236d
pop edi
pop esi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push ebx
push eax
call fcn.005257e0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
ret

Function at 0x402990
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push edi
xor edi, edi
mov dword [esi], edi
cmp dword [0x5b2904], edi
jne 0x4029b2
mov eax, 0x20019
cmp dword [0x5b2908], edi
je 0x4029b7
mov eax, 0x20119
mov edx, dword [str.SoftwareJeticoBestCrypt_Volume_Encryption]
lea ecx, [esp + 0x14]
push ecx
push eax
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402a28
mov edx, dword [esp + 0x14]
mov eax, 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push esi
lea ecx, [esp + 0x14]
push ecx
push 0
push str.DosMask
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x402a18
mov eax, dword [esp + 0x14]
push eax
mov dword [esi], edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x14]
push eax
mov edi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 8
ret

Function at 0x402a30
Capabilities:
Set registry value

Disassembly:
push ecx
cmp dword [0x5b2904], 0
jne 0x402a48
cmp dword [0x5b2908], 0
mov eax, 0xf003f
je 0x402a4d
mov eax, 0xf013f
mov edx, dword [str.SoftwareJeticoBestCrypt_Volume_Encryption]
lea ecx, [esp]
push ecx
push eax
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402a92
mov ecx, dword [esp]
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push str.DosMask
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x402a96
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret
Function at 0x4030e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4030fd
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push edi
push esi
call fcn.00401bb0
mov edi, dword [esp + 0x1c]
add esp, 4
mov dword [edi], eax
test eax, eax
je 0x403142
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x403137
mov edx, dword [edi]
push eax
lea ecx, [esp + 0x10]
push ecx
push esi
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403149
mov eax, dword [edi]
push eax
call fcn.00401bc0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
pop edi
pop esi
mov dword [ecx], edx
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x403ce0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
cmp dword [0x5b2904], 0
push edi
mov edi, ecx
jne 0x403cfd
cmp dword [0x5b2908], 0
mov eax, 0xf003f
je 0x403d02
mov eax, 0xf013f
mov edx, dword [str.SoftwareJeticoBestCrypt_Volume_Encryption]
lea ecx, [esp + 4]
push ecx
push eax
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x403d29
xor eax, eax
pop edi
add esp, 8
ret 4
mov edx, dword [str.UseSecureTyping]
push esi
mov esi, dword [esp + 0x14]
xor eax, eax
push 4
test esi, esi
setne al
lea ecx, [esp + 0x10]
push ecx
push 4
push 0
push edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x403d6f
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
pop edi
add esp, 8
ret 4
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi + 0xa4], esi
mov eax, 1
pop esi
mov dword [edi + 0xa8], eax
pop edi
add esp, 8
ret 4

Function at 0x403da0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [0x5b2904], edi
jne 0x403dbe
mov eax, 0x20019
cmp dword [0x5b2908], edi
je 0x403dc3
mov eax, 0x20119
cmp dword [esi + 0xa8], edi
je 0x403dd7
mov eax, dword [esi + 0xa4]
pop edi
pop esi
add esp, 0x10
ret
mov edx, dword [str.SoftwareJeticoBestCrypt_Volume_Encryption]
lea ecx, [esp + 8]
push ecx
push eax
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403e4d
mov eax, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [str.UseSecureTyping]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403e32
cmp dword [esp + 0x14], 1
jne 0x403e32
lea edi, [eax + 1]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], 1
mov eax, edi
pop edi
pop esi
add esp, 0x10
ret
Function at 0x403e60
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
setne al
mov esi, ecx
push eax
push 1
mov dword [esp + 0x10], eax
call fcn.00414830
add esp, 8
test eax, eax
je 0x403ee9
cmp dword [0x5b2904], 0
jne 0x403e9a
cmp dword [0x5b2908], 0
mov eax, 0xf003f
je 0x403e9f
mov eax, 0xf013f
mov edx, dword [str.SoftwareJeticoBestCrypt_Volume_Encryption]
lea ecx, [esp + 0x10]
push ecx
push eax
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403ee9
mov ecx, dword [str.UseAesHardwareAcceleration]
mov edx, dword [esp + 0x10]
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x403ef1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
pop ecx
ret 4
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 0xac], edi
pop edi
mov dword [esi + 0xb0], 1
mov eax, 1
pop esi
pop ecx
ret 4

Function at 0x403f20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
cmp dword [0x5b2904], 0
push esi
push edi
mov esi, ecx
mov edi, 1
jne 0x403f43
cmp dword [0x5b2908], 0
mov eax, 0x20019
je 0x403f48
mov eax, 0x20119
cmp dword [esi + 0xb0], 0
je 0x403f5d
mov eax, dword [esi + 0xac]
pop edi
pop esi
add esp, 0x10
ret
mov edx, dword [str.SoftwareJeticoBestCrypt_Volume_Encryption]
lea ecx, [esp + 8]
push ecx
push eax
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403fd1
mov eax, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [str.UseAesHardwareAcceleration]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403fb6
cmp dword [esp + 0x14], edi
je 0x403fb6
xor edi, edi
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], 1
mov eax, edi
pop edi
pop esi
add esp, 0x10
ret