joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x54397cb2
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x5aae0052
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x408950
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov esi, 0x4085d8
and ebx, ebx
call fcn.0040897c
push edx
pop edx
xor dword [edi], esi
inc edi
sub edx, 0xc1e8d9b
add edx, 0xd85f40e7
cmp edi, ecx
jne fcn.00408950
sub ebx, 0x487477b2
and ebx, ebx
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x7fbf36fa
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0xeef73c3
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x78bc47e3
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2c8819e3
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x9cb5a5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9cb5cc
call fcn.0096daf8
mov dword [eax], esi
call fcn.0096dae5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0096e73a
mov eax, esi
jmp 0x9cb621
test dword [ebp + 0xc], 0xfffffff9
jne 0x9cb5b2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9cb5f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0096db0b
pop ecx
call fcn.0096dae5
mov eax, dword [eax]
jmp 0x9cb621
test al, 0x10
jne 0x9cb61f
test al, 1
je 0x9cb61f
test byte [ebp + 0xc], 2
je 0x9cb61f
call fcn.0096daf8
mov dword [eax], 5
call fcn.0096dae5
mov dword [eax], 0xd
jmp 0x9cb5f0
xor eax, eax
pop esi
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x3ed00264
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x3c980823
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x8ccba7
Capabilities:
Encode data using xor

Disassembly:
push 0x8cc92e
pop ecx
add edx, edi
call fcn.008ccbce
inc edi
sub edx, edx
or edi, edi
xor dword [eax], ecx
sub edx, edx
sub edx, edi
or edx, edi
inc eax
dec edx
cmp eax, esi
jne fcn.008ccba7
sub edi, edi
ret
Function at 0x4010f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4263d0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4269c2], 0
je 0x401113
cmp byte [ebp + 8], 0
je 0x401216
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push 0x41e550
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40120f
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40120f
cmp byte [0x4269c2], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 4
jne 0x40118d
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x41e5a8
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40118d
cmp dword [ebp - 0xc], 4
jne 0x40118d
cmp dword [ebp - 8], eax
setne byte [0x4269c1]
cmp byte [0x4269c1], 0
je 0x401206
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x41e5d0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4011cd
cmp dword [ebp - 0xc], 4
jne 0x4011cd
cmp dword [ebp - 8], eax
setne byte [0x4269c0]
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x41e5fc
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401206
mov eax, dword [section..data]
cmp dword [ebp - 0xc], 4
cmove eax, dword [ebp - 8]
mov dword [section..data], eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x4269c2], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041b330
mov esp, ebp
pop ebp
ret

Function at 0x401340
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x426e20], ecx
inc eax
cmp eax, 0x100
jb 0x401342
cmp eax, 0x800
jae 0x401413
nop word [eax + eax]
mov edx, dword [eax*4 + 0x426a20]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x426e20]
mov dword [eax*4 + 0x426e20], edx
inc eax
cmp eax, 0x800
jb 0x4013f0
mov dword [0x4269c4], 0x401440
call fcn.00405880
mov ecx, dword [0x4269c4]
test eax, eax
mov edx, 0x401440
cmove ecx, edx
mov dword [0x4269c4], ecx
ret
Function at 0x40afe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4263d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x20a
call fcn.0041b8b8
push 0x20a
mov edi, eax
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov dword [ebp - 8], 0x20a
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x41e810
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b088
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x41e87c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40b077
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b060
sub ecx, edx
sar ecx, 1
cmp ecx, 0x208
jb 0x40b07f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.0041b8c1
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0041b330
mov esp, ebp
pop ebp
ret

Function at 0x40b0b0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4263d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x14]
xor esi, esi
push eax
push 0x20008
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40b181
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push esi
push esi
push 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40b178
push edi
push dword [ebp - 0x10]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40b177
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push edi
push 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40b167
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x12
push 1
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40b167
push dword [edi]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
mov ecx, 1
cmovne esi, ecx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041b330
mov esp, ebp
pop ebp
ret
Function at 0x40dc40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d1a8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x4263d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push 0x40
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.0041b38f
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edi], eax
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x41eb54
mov esi, eax
push 0x66
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, eax
mov dword [ebp - 0x1c], 0
mov ecx, edx
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40dce0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.0040e350
push 1
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00412ac2
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004125e1
mov ebx, eax
cmp edi, ebx
je 0x40dda7
mov esi, dword [edi]
mov ecx, edi
push dword [esi + 4]
push edi
call fcn.0040b5f0
push dword [ebp - 0x14]
mov dword [esi + 4], esi
mov ecx, edi
mov dword [esi], esi
mov dword [esi + 8], esi
push dword [edi]
mov dword [edi + 4], 0
mov eax, dword [ebx]
push dword [eax + 4]
call fcn.0040d990
mov ecx, eax
mov eax, dword [edi]
mov dword [eax + 4], ecx
mov esi, dword [edi]
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov edx, dword [esi + 4]
cmp byte [edx + 0xd], 0
jne 0x40dda0
mov ecx, dword [edx]
cmp byte [ecx + 0xd], 0
jne 0x40dd7c
nop dword [eax + eax]
mov eax, dword [ecx]
mov edx, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x40dd70
mov dword [esi], edx
mov edx, dword [edi]
mov ecx, dword [edx + 4]
mov eax, dword [ecx + 8]
cmp byte [eax + 0xd], 0
jne 0x40dd9b
nop dword [eax]
mov ecx, eax
mov eax, dword [ecx + 8]
cmp byte [eax + 0xd], 0
je 0x40dd90
mov dword [edx + 8], ecx
jmp 0x40dda7
mov dword [esi], esi
mov ecx, dword [edi]
mov dword [ecx + 8], ecx
lea ecx, [ebp - 0x44]
call fcn.0040b870
lea ecx, [ebp - 0x2c]
call fcn.00408650
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d26b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4263d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x234]
push 0x426078
call fcn.0040b680
push 0x1e
push 0x41ec40
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0
call fcn.0040ba30
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
cmp dword [ebp - 0x220], 8
lea ecx, [ebp - 0x238]
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push ecx
push 1
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e885
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e885
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x41ec80
lea eax, [ebp - 0x218]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40e878
test dx, dx
je 0x40e874
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40e878
add eax, 4
add ecx, 4
test dx, dx
jne 0x40e852
xor eax, eax
jmp 0x40e87d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40e885
xor esi, esi
jmp 0x40e897
cmp dword [esi + 0x10], 0
je 0x40e894
push esi
call fcn.0040f400
add esp, 4
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 4], 1
cmp ecx, 8
jb 0x40e8bc
inc ecx
push ecx
push dword [ebp - 0x234]
lea ecx, [ebp - 0x234]
call fcn.0040a160
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041b330
mov esp, ebp
pop ebp
ret

Function at 0x40ea10
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d2a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4263d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x426078
lea ecx, [ebp - 0x28]
xor esi, esi
call fcn.0040b680
push 0xb
push 0x41ebc4
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.0040ba30
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 1
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push esi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ea9d
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
mov ecx, 1
cmove esi, ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 1
cmp ecx, 8
jb 0x40eab9
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.0040a160
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041b330
mov esp, ebp
pop ebp
ret
Function at 0x40f860
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x40f871
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f889
test al, 0x10
je 0x40f889
mov eax, 1
pop esi
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x40f891
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
pop ebp
ret

Function at 0x40f8a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x40f8ae
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f8c5
test al, 0x10
jne 0x40f8c5
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40f8d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d3fb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4263d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x234]
push 0x426078
mov dword [ebp - 0x21c], esi
call fcn.0040b680
push 0xb
push 0x41eb90
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0
call fcn.0040ba30
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
cmp dword [ebp - 0x220], 8
lea ecx, [ebp - 0x238]
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push ecx
push 1
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f9e3
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40f9d7
xor eax, eax
mov dword [esi + 0x10], 0
push eax
mov dword [esi + 0x14], 7
mov ecx, esi
push 0x41e948
mov word [esi], ax
call fcn.00409fa0
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 4], 1
cmp ecx, 8
jb 0x40fa43
inc ecx
push ecx
jmp 0x40fa32
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x218]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40fa00
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00409fa0
mov eax, dword [ebp - 0x220]
mov dword [ebp - 4], 2
cmp eax, 8
jb 0x40fa43
inc eax
push eax
push dword [ebp - 0x234]
lea ecx, [ebp - 0x234]
call fcn.0040a160
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041b330
mov esp, ebp
pop ebp
ret
Function at 0x410390
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d51b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4263d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x234]
push 0x426078
call fcn.0040b680
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x104
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
add esp, 0x18
lea ecx, [ebp - 0x234]
push 0xb
push 0x41ebc4
call fcn.0040ba30
cmp dword [ebp - 0x220], 8
lea ecx, [ebp - 0x238]
push 0
push ecx
push 0
push 2
push 0
push 0
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x410533
mov eax, dword [esi]
mov dword [ebp - 0x21c], eax
cmp eax, 0xffffffff
je 0x410482
push 4
lea eax, [ebp - 0x21c]
push eax
push 4
push 0
push 0x41ec20
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x410527
mov eax, dword [esi + 4]
mov dword [ebp - 0x21c], eax
cmp eax, 0xffffffff
je 0x4104b2
push 4
lea eax, [ebp - 0x21c]
push eax
push 4
push 0
push 0x41ec0c
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x410527
mov ecx, 0x41ec84
lea eax, [ebp - 0x218]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4104e6
test dx, dx
je 0x4104e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4104e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4104c0
xor eax, eax
jmp 0x4104eb
sbb eax, eax
or eax, 1
test eax, eax
je 0x410514
push 0x208
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x41ebdc
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x410527
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
jmp 0x410535
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 4], 1
cmp ecx, 8
jb 0x41055a
inc ecx
push ecx
push dword [ebp - 0x234]
lea ecx, [ebp - 0x234]
call fcn.0040a160
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041b330
mov esp, ebp
pop ebp
ret
Function at 0x410700
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d55b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x4263d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x23c]
push 0x426078
call fcn.0040b680
push 0xb
push 0x41ebc4
lea ecx, [ebp - 0x23c]
mov dword [ebp - 4], 0
call fcn.0040ba30
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 0xffffffff
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x220], 4
cmp dword [ebp - 0x228], 8
lea ecx, [ebp - 0x240]
lea eax, [ebp - 0x23c]
cmovae eax, dword [ebp - 0x23c]
push ecx
push 1
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41088f
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x41ec20
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or esi, 0xffffffff
test eax, eax
lea eax, [ebp - 0x220]
mov ecx, esi
cmove ecx, dword [ebp - 0x21c]
push eax
lea eax, [ebp - 0x21c]
mov dword [edi], ecx
push eax
push 0
push 0
push 0x41ec0c
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [ebp - 0x224], 0x208
lea eax, [ebp - 0x224]
cmove esi, dword [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
mov dword [edi + 4], esi
push eax
push 0
push 0
push 0x41ebdc
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [edi + 8]
test eax, eax
jne 0x410872
lea eax, [ebp - 0x218]
mov ecx, eax
sub edx, ecx
nop word [eax + eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x410860
jmp 0x410883
push 5
push 0x41ec84
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
add esp, 0xc
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x228]
mov dword [ebp - 4], 1
cmp eax, 8
jb 0x4108b4
inc eax
lea ecx, [ebp - 0x23c]
push eax
push dword [ebp - 0x23c]
call fcn.0040a160
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041b330
mov esp, ebp
pop ebp
ret