joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a24d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x34], 0
push 0x200
push 0x5a6060
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5a6060
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfa0
add esp, 8
push 0x4a19a8
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfb0
add esp, 8
push 0x4a19ac
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfb0
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.004183d3
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x28], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x28], 0xffffffff
jne 0x40a2f9
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
push 0x5a6060
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfa0
add esp, 8
push 0x4a19bc
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfb0
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.00418410
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2c], 0xffffffff
jne 0x40a34d
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040a365
add esp, 4
xor eax, eax
jmp 0x40a360
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a6ed
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
push 0x200
push 0x5a6480
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4a1a08
push 0x5a6480
call fcn.0041bfb0
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x40a73e
push 0x4a1a14
lea eax, [ebp - 0x88]
push eax
call fcn.0041bfa0
add esp, 8
jmp 0x40a752
push 0x4a1a1c
lea eax, [ebp - 0x88]
push eax
call fcn.0041bfa0
add esp, 8
mov dword [0x5a3050], 0
jmp 0x40a767
inc dword [0x5a3050]
cmp dword [0x5a3050], 0x3000
jge 0x40a788
mov eax, dword [0x5a3050]
mov byte [eax + 0x5a3060], 0
jmp 0x40a761
push 0x5a98c0
push 0x5a3060
push 0x5a6480
call fcn.00409b53
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40a7b2
mov eax, 0xffffffff
jmp 0x40a909
push 0x5a6684
mov ax, word [0x5a98c0]
push eax
push 0x5a3060
lea eax, [ebp - 0x88]
push eax
call fcn.00407518
add esp, 0x10
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jne 0x40a7fc
push 0x80002
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40a909
push 0x5a9b30
xor eax, eax
mov ax, word [0x5a98c0]
xor ecx, ecx
mov cx, word [0x5a6684]
sub eax, ecx
push eax
mov eax, dword [ebp - 0x8c]
inc eax
push eax
push 0x4a1a28
call fcn.00407518
add esp, 0x10
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x40a84c
mov ax, word [0x5a9b30]
mov word [ebp - 4], ax
jmp 0x40a863
xor eax, eax
mov ax, word [0x5a98c0]
xor ecx, ecx
mov cx, word [0x5a6684]
sub eax, ecx
mov word [ebp - 4], ax
push 0x5a6686
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00407518
add esp, 0x10
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x40a8f1
push 0x80
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041bdf0
add esp, 4
mov ecx, dword [ebp - 0x90]
add ecx, eax
inc ecx
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0041cdc0
add esp, 0xc
push 0x4a1168
mov eax, dword [ebp + 8]
push eax
call fcn.0041c320
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40a8e2
mov eax, dword [ebp - 8]
mov byte [eax], 0
jmp 0x40a8ec
mov eax, dword [ebp + 8]
mov byte [eax + 0x80], 0
jmp 0x40a902
push 0x4a1a2c
mov eax, dword [ebp + 8]
push eax
call fcn.0041bfa0
add esp, 8
xor eax, eax
jmp 0x40a909
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40aa6d
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40aaa6
push 0x180
mov eax, dword [ebp + 0xc]
push eax
call fcn.00424f39
add esp, 8
mov eax, dword [ebp - 4]
jmp 0x40aaae
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b561
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
push 0x5a2860
push 0xf003f
push 0
push 0x51dc08
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5a2a84], eax
cmp dword [0x5a2a84], 0
je 0x40b5cc
cmp dword [0x5a2a84], 2
je 0x40b5ca
push 0x2002000
call fcn.004042f8
add esp, 4
push 0x10001
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40b7df
jmp 0x40b60f
mov dword [ebp - 0x10], 1
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5a2a84], eax
cmp dword [0x5a2a84], 0
je 0x40b60f
push 0x2002000
call fcn.004042f8
add esp, 4
push 0x10002
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40b7df
push 0x5a2860
push 0xf003f
push 0
push 0x51dc40
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5a2a84], eax
cmp dword [0x5a2a84], 0
je 0x40b678
cmp dword [0x5a2a84], 2
je 0x40b664
push 0x2002000
call fcn.004042f8
add esp, 4
push 0x10001
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40b7df
cmp dword [ebp - 0x10], 1
jne 0x40b673
mov ecx, dword [ebp - 0x20]
or ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x40b7dc
mov edx, dword [ebp - 0x20]
or edx, 1
mov dword [ebp - 0x20], edx
mov dword [ebp - 0xc], 0xc
push 0x51dc6c
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0x5a2d00
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x5a2a84], eax
cmp dword [0x5a2a84], 0
je 0x40b6df
push 0x51dc74
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0041bfa0
add esp, 8
lea edx, [ebp - 0x1c]
push edx
push 0x5a98d0
call fcn.0041bfa0
add esp, 8
push 0x51dc7c
lea eax, [ebp - 0x1c]
push eax
call fcn.0041c3a0
add esp, 8
test eax, eax
jge 0x40b719
cmp dword [ebp - 0x10], 1
jne 0x40b714
mov ecx, dword [ebp - 0x20]
or ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x40b7a2
push 0x51dc84
lea edx, [ebp - 0x1c]
push edx
call fcn.0041c3a0
add esp, 8
test eax, eax
jg 0x40b738
mov eax, dword [ebp - 0x20]
or al, 2
mov dword [ebp - 0x20], eax
jmp 0x40b7a2
push 0x51dc8c
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], 4
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0x5a2d00
mov ecx, dword [0x5a2860]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x5a2a84], eax
cmp dword [0x5a2a84], 0
je 0x40b78f
mov edx, dword [ebp - 0x20]
or edx, 2
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 4]
and eax, 2
test eax, eax
je 0x40b7a2
mov ecx, dword [ebp - 0x20]
or ecx, 2
mov dword [ebp - 0x20], ecx
mov edx, dword [0x5a2860]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5a2a84], eax
cmp dword [0x5a2a84], 0
je 0x40b7dc
push 0x2002000
call fcn.004042f8
add esp, 4
push 0x10002
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40b7df
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret
Function at 0x40b7e3
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x5a2860
push 0xf003f
push 0
push 0x51dc94
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5a2a84], eax
cmp dword [0x5a2a84], 0
je 0x40b835
push 0x2002007
call fcn.004042f8
add esp, 4
push 0x10001
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40b956
mov dword [ebp - 0xc], 0xc
push 0x51dcc0
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0x5a2d00
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x5a2a84], eax
cmp dword [0x5a2a84], 0
je 0x40b8a4
push 0x2002000
call fcn.004042f8
add esp, 4
push 0x10006
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40b956
push 0x51dcc8
lea ecx, [ebp - 0x18]
push ecx
call fcn.0041c3a0
add esp, 8
test eax, eax
jl 0x40b91a
push 0x51dcd0
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
mov edx, dword [ebp + 8]
mov dword [ebp - 4], edx
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x5a2d00
mov ecx, dword [0x5a2860]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x5a2a84], eax
cmp dword [0x5a2a84], 0
je 0x40b91a
push 0x2002007
call fcn.004042f8
add esp, 4
push 0x10003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40b956
mov edx, dword [0x5a2860]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5a2a84], eax
cmp dword [0x5a2a84], 0
je 0x40b954
push 0x2002007
call fcn.004042f8
add esp, 4
push 0x10002
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40b956
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40c79a
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0
cmp dword [0x42a164], 0
je 0x40c87a
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push 0
push 0x51de6c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40c87a
mov dword [ebp - 0xc], 4
push 0x51dea4
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
mov dword [ebp - 4], 4
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0x5a2d00
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40c870
push 0x51dec4
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
mov dword [ebp - 8], 0
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push 0x5a2d00
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40c864
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40c87a
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x40c881
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x42a164], 0
je 0x40c8f8
cmp dword [ebp + 8], 1
jne 0x40c8f8
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push 0x51dee4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40c8f8
push 0x51df1c
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push 0x5a2d00
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x40d268
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push 0x51e264
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40d294
xor eax, eax
jmp 0x40d39c
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0xf003f
push 0
push 0x5a1a30
push 0
push 0x51e298
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40d2d5
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40d39c
push 0x51e2b8
call fcn.0041bdf0
add esp, 4
push eax
push 0x51e2c4
push 1
push 0
push 0x51e2d0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x40d315
xor eax, eax
jmp 0x40d39c
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0xf003f
push 0
push 0x5a1a34
push 0
push 0x51e2d8
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40d353
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40d39c
push 0x51e308
call fcn.0041bdf0
add esp, 4
push eax
push 0x51e314
push 1
push 0
push 0x51e320
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x40d39a
xor eax, eax
jmp 0x40d39c
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40db8d
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
jmp 0x40dba7
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, 3
cmp edx, dword [ebp + 8]
jbe 0x40dbc5
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0xc]
mov dl, byte [ecx - 4]
mov byte [eax], dl
jmp 0x40db9e
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 8]
mov byte [eax], 0x52
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp + 8]
mov byte [ecx + 1], 0x45
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 8]
mov byte [edx + 2], 0x4d
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 8]
mov byte [eax + 3], 0x20
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp + 8], ecx
push 0x200
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x51e394
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x51e398
push 0x5a2660
call fcn.0041bfb0
add esp, 8
push 0x5a2660
call fcn.00406151
add esp, 4
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x5a2660
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x40dc6e
push 0x40003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40dccd
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40dcab
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40004
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40dccd
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40dccb
push 0x40005
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40dccd
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40e0fb
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.0040e08b
cmp eax, 0xffffffff
jne 0x40e113
or eax, 0xffffffff
jmp 0x40e348
mov eax, dword [0x5a2860]
push eax
call fcn.0040546f
add esp, 4
cmp eax, 0xffffffff
jne 0x40e13b
mov ecx, dword [0x5a2860]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x40e348
push 0x51e4e4
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
push 4
push 0x51e4f4
push 1
push 0
push 0x5a2d00
mov edx, dword [0x5a2860]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40e194
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e348
mov dword [ebp - 0xc], 0xffff
push 0x51e4f8
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
push 0x5a2d00
mov edx, dword [0x5a2860]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40e1f3
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e348
mov dword [ebp - 0x10], 3
push 0x51e504
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push 0x5a2d00
mov edx, dword [0x5a2860]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40e252
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e348
mov dword [ebp - 4], 1
push 0x51e518
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push 0x5a2d00
mov edx, dword [0x5a2860]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40e2b1
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e348
mov ecx, dword [0x5a2860]
push ecx
call fcn.00404f0b
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x40e2db
mov edx, dword [0x5a2860]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x40e348
cmp dword [0x42a168], 0
je 0x40e304
push 0xd
push 0x51e530
push 1
push 0x51e540
push 0x51e54c
call fcn.004058f6
add esp, 0x14
mov dword [ebp - 8], eax
jmp 0x40e322
push 9
push 0x51e580
push 1
push 0x51e58c
push 0x51e598
call fcn.004058f6
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x40e339
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x40e348
mov ecx, dword [0x5a2860]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40e34c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x5a2860
push 0x5a2440
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e380
push 0x10001
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e3f3
push 0x51e5cc
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
push 0xd
push 0x51e5d4
push 1
push 0
push 0x5a2d00
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e3c9
push 0x10003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e3f3
mov ecx, dword [0x5a2860]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e3f1
push 0x10002
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e3f3
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40e4ac
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x51e644
push 0x5a2440
call fcn.0041bfa0
add esp, 8
push 0x51e684
push 0x5a2cc0
call fcn.0041bfa0
add esp, 8
push 0x5a2860
push 0x5a2440
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40e509
push 0x10001
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e597
push 0x51e698
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
push 0
push 0
push 0x5a2f40
push 0
push 0x5a2d00
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40e56d
push 0x5a2d00
mov ecx, dword [0x5a2860]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40e56d
push 0x10004
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e597
mov edx, dword [0x5a2860]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40e595
push 0x10002
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e597
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40e59b
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov ecx, 7
mov esi, 0x51e6a0
lea edi, [ebp - 0x208]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x78
xor eax, eax
lea edi, [ebp - 0x1e9]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x51e6c0
lea eax, [ebp - 0x208]
push eax
call fcn.0041bfb0
add esp, 8
push 0x51e6c8
lea ecx, [ebp - 0x208]
push ecx
call fcn.0041bfb0
add esp, 8
cmp dword [ebp + 8], 0
je 0x40e648
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x208]
push eax
call fcn.0041bfa0
add esp, 8
push 0x51e6d0
lea ecx, [ebp - 0x208]
push ecx
call fcn.0041bfb0
add esp, 8
push 0x51e6d4
lea edx, [ebp - 0x208]
push edx
call fcn.0041bfb0
add esp, 8
push 0x51e6dc
lea eax, [ebp - 0x208]
push eax
call fcn.0041bfb0
add esp, 8
push 0x51e6e4
push 0x5a2aa0
call fcn.0041bfa0
add esp, 8
push 0x51e718
push 0x5a2aa0
call fcn.0041bfb0
add esp, 8
push 0x5a2860
push 0x5a2aa0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e69f
push 0x10007
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e773
push 0x51e720
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
lea ecx, [ebp - 0x208]
push ecx
call fcn.0041bdf0
add esp, 4
add eax, 1
push eax
lea edx, [ebp - 0x208]
push edx
push 2
push 0
push 0x5a2d00
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e708
mov ecx, dword [0x5a2860]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e773
push 0x51e734
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
mov dword [ebp - 8], 7
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push 0x5a2d00
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e764
mov ecx, dword [0x5a2860]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e773
mov edx, dword [0x5a2860]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret