joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c6c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433dd0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x45106c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], vtable.StringStorage.0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00409b70
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x44785c
push ecx
call fcn.00419ff0
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], vtable.StringStorage.0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00409b70
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x44785c
push ecx
call fcn.00419ff0
add esp, 0xc
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
push edi
mov byte [ebp - 4], 3
call fcn.0040c0b0
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.0040c190
push ecx
push 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x48]
push dword [esi + 4]
call fcn.00415c70
mov ebx, dword [ebp - 0x44]
test ebx, ebx
jne 0x40c7c2
xor bl, bl
mov dword [ebp - 0x48], vtable.RegistryKey.0
jmp 0x40c81a
mov edx, dword [ebp + 0xc]
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c7d0
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov dword [ebp - 0x48], vtable.RegistryKey.0
mov eax, dword [ebp - 0x44]
sete bl
test eax, eax
je 0x40c81a
cmp eax, dword [ebp - 0x40]
je 0x40c813
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x3c]
call fcn.00412c10
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.StringStorage.0
test edx, edx
je 0x40c871
mov ecx, dword [ebp - 0x10]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40c852
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c8c1
push ecx
push edx
call fcn.00418878
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], vtable.StringStorage.0
test edx, edx
je 0x40c8ab
mov ecx, dword [ebp - 0x20]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40c8a1
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c8c6
push ecx
push edx
call fcn.00418878
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00420563
call fcn.00420563
int3
Function at 0x40c8d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433e10
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push edi
mov eax, dword [0x45106c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x30], vtable.StringStorage.0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00409b70
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x44785c
push ecx
call fcn.00419ff0
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], vtable.StringStorage.0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00409b70
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x44785c
push ecx
call fcn.00419ff0
add esp, 0xc
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 3
push eax
push dword [ebp + 8]
call fcn.0040c0b0
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call fcn.0040c190
push ecx
push 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x4c]
push dword [edi + 4]
call fcn.00415c70
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x40c9d2
xor bl, bl
mov dword [ebp - 0x4c], vtable.RegistryKey.0
jmp 0x40ca1d
lea ecx, [ebp + 8]
mov dword [ebp - 0x10], 0xb
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
mov dword [ebp + 8], 8
push ecx
push 0
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [ebp - 0x4c], vtable.RegistryKey.0
mov eax, dword [ebp - 0x48]
sete bl
test eax, eax
je 0x40ca1d
cmp eax, dword [ebp - 0x44]
je 0x40ca16
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x40]
call fcn.00412c10
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], vtable.StringStorage.0
test edx, edx
je 0x40ca74
mov ecx, dword [ebp - 0x14]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40ca55
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cac3
push ecx
push edx
call fcn.00418878
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], vtable.StringStorage.0
test edx, edx
je 0x40caae
mov ecx, dword [ebp - 0x24]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40caa4
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cac8
push ecx
push edx
call fcn.00418878
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00420563
call fcn.00420563
int3
Function at 0x40cad0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433dd0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x45106c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], vtable.StringStorage.0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00409b70
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x44785c
push ecx
call fcn.00419ff0
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], vtable.StringStorage.0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00409b70
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x44785c
push ecx
call fcn.00419ff0
add esp, 0xc
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
mov edi, dword [ebp + 8]
push eax
push edi
call fcn.0040c0b0
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.0040c190
push ecx
push 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x48]
push dword [esi + 4]
call fcn.00415c70
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x40cbd8
xor bl, bl
mov dword [ebp - 0x48], vtable.RegistryKey.0
jmp 0x40cc10
push 4
lea ecx, [ebp + 8]
push ecx
push 0xb
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov dword [ebp - 0x48], vtable.RegistryKey.0
mov eax, dword [ebp - 0x44]
sete bl
test eax, eax
je 0x40cc10
cmp eax, dword [ebp - 0x40]
je 0x40cc09
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x3c]
call fcn.00412c10
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.StringStorage.0
test edx, edx
je 0x40cc67
mov ecx, dword [ebp - 0x10]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40cc48
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ccb7
push ecx
push edx
call fcn.00418878
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], vtable.StringStorage.0
test edx, edx
je 0x40cca1
mov ecx, dword [ebp - 0x20]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40cc97
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ccbc
push ecx
push edx
call fcn.00418878
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00420563
call fcn.00420563
int3
Function at 0x40cd30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433e10
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push edi
mov eax, dword [0x45106c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x30], vtable.StringStorage.0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00409b70
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x44785c
push ecx
call fcn.00419ff0
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], vtable.StringStorage.0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00409b70
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x44785c
push ecx
call fcn.00419ff0
add esp, 0xc
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 3
push eax
push dword [ebp + 8]
call fcn.0040c0b0
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call fcn.0040c190
push ecx
push 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x4c]
push dword [edi + 4]
call fcn.00415c70
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x40ce32
xor bl, bl
mov dword [ebp - 0x4c], vtable.RegistryKey.0
jmp 0x40ce7d
lea ecx, [ebp + 8]
mov dword [ebp - 0x10], 4
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
mov dword [ebp + 8], 4
push ecx
push 0
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [ebp - 0x4c], vtable.RegistryKey.0
mov eax, dword [ebp - 0x48]
sete bl
test eax, eax
je 0x40ce7d
cmp eax, dword [ebp - 0x44]
je 0x40ce76
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x40]
call fcn.00412c10
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], vtable.StringStorage.0
test edx, edx
je 0x40ced4
mov ecx, dword [ebp - 0x14]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40ceb5
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf23
push ecx
push edx
call fcn.00418878
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], vtable.StringStorage.0
test edx, edx
je 0x40cf0e
mov ecx, dword [ebp - 0x24]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40cf04
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf28
push ecx
push edx
call fcn.00418878
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00420563
call fcn.00420563
int3
Function at 0x40cf30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433dd0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x45106c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], vtable.StringStorage.0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00409b70
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x44785c
push ecx
call fcn.00419ff0
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], vtable.StringStorage.0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00409b70
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x44785c
push ecx
call fcn.00419ff0
add esp, 0xc
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
mov edi, dword [ebp + 8]
push eax
push edi
call fcn.0040c0b0
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.0040c190
push ecx
push 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x48]
push dword [esi + 4]
call fcn.00415c70
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x40d038
xor bl, bl
mov dword [ebp - 0x48], vtable.RegistryKey.0
jmp 0x40d070
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov dword [ebp - 0x48], vtable.RegistryKey.0
mov eax, dword [ebp - 0x44]
sete bl
test eax, eax
je 0x40d070
cmp eax, dword [ebp - 0x40]
je 0x40d069
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x3c]
call fcn.00412c10
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.StringStorage.0
test edx, edx
je 0x40d0c7
mov ecx, dword [ebp - 0x10]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40d0a8
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d117
push ecx
push edx
call fcn.00418878
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], vtable.StringStorage.0
test edx, edx
je 0x40d101
mov ecx, dword [ebp - 0x20]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40d0f7
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d11c
push ecx
push edx
call fcn.00418878
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00420563
call fcn.00420563
int3
Function at 0x40d130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433e50
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x45106c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x30], vtable.StringStorage.0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00409b70
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x44785c
push ecx
call fcn.00419ff0
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], vtable.StringStorage.0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00409b70
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x44785c
push ecx
call fcn.00419ff0
add esp, 0xc
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 3
mov edi, dword [ebp + 8]
push eax
push edi
call fcn.0040c0b0
lea eax, [ebp - 0x20]
push eax
push edi
call fcn.0040c190
push ecx
push 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x4c]
push dword [esi + 4]
call fcn.00415c70
mov ecx, dword [ebp - 0x48]
test ecx, ecx
jne 0x40d232
xor bl, bl
mov dword [ebp - 0x4c], vtable.RegistryKey.0
jmp 0x40d286
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], 3
mov eax, dword [esi]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40d25e
xor bl, bl
jmp 0x40d265
mov eax, dword [ebp + 8]
mov bl, 1
mov dword [esi], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], vtable.RegistryKey.0
test eax, eax
je 0x40d286
cmp eax, dword [ebp - 0x44]
je 0x40d27f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x40]
call fcn.00412c10
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], vtable.StringStorage.0
test edx, edx
je 0x40d2dd
mov ecx, dword [ebp - 0x14]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40d2be
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d32d
push ecx
push edx
call fcn.00418878
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], vtable.StringStorage.0
test edx, edx
je 0x40d317
mov ecx, dword [ebp - 0x24]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40d30d
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d332
push ecx
push edx
call fcn.00418878
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.00420563
call fcn.00420563
int3
Function at 0x40d340
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433dd0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x45106c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], vtable.StringStorage.0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push 1
mov ecx, eax
call fcn.00409b70
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x44785c
push ecx
call fcn.00419ff0
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], vtable.StringStorage.0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
push 1
mov ecx, eax
call fcn.00409b70
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x44785c
push ecx
call fcn.00419ff0
add esp, 0xc
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
push edi
mov byte [ebp - 4], 3
call fcn.0040c0b0
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.0040c190
push ecx
push 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x48]
push dword [esi + 4]
call fcn.00415c70
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x40d442
xor bl, bl
mov dword [ebp - 0x48], vtable.RegistryKey.0
jmp 0x40d47a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 3
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov dword [ebp - 0x48], vtable.RegistryKey.0
mov eax, dword [ebp - 0x44]
sete bl
test eax, eax
je 0x40d47a
cmp eax, dword [ebp - 0x40]
je 0x40d473
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x3c]
call fcn.00412c10
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.StringStorage.0
test edx, edx
je 0x40d4d1
mov ecx, dword [ebp - 0x10]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40d4b2
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d521
push ecx
push edx
call fcn.00418878
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], vtable.StringStorage.0
test edx, edx
je 0x40d50b
mov ecx, dword [ebp - 0x20]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40d501
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d526
push ecx
push edx
call fcn.00418878
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.00420563
call fcn.00420563
int3
Function at 0x415160
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4345b8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x45106c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
lea edi, [ebx + 8]
mov dword [ebx], vtable.WinProcessCommandLine.0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x10
mov byte [ebp - 4], 2
call fcn.00418d43
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov ecx, esi
call fcn.004169c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
mov dword [ebx + 4], eax
add eax, 4
cmp ecx, eax
je 0x41521e
push dword [ebp - 0x14]
push dword [eax + 4]
push dword [eax]
call fcn.00417240
mov eax, dword [ebp - 0x1c]
xor esi, esi
mov ecx, dword [ebp - 0x20]
sub eax, ecx
sar eax, 4
test eax, eax
je 0x4152a4
xor ebx, ebx
mov eax, dword [ebx + ecx + 4]
lea edx, [ebx + ecx]
cmp word [eax], 0x2d
je 0x415285
mov ecx, dword [edi + 4]
cmp dword [edi + 8], ecx
je 0x41527a
mov dword [ecx], vtable.StringStorage.0
mov dword [ebp - 0x14], ecx
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov byte [ebp - 4], 4
mov eax, dword [ecx]
push dword [edx + 4]
call dword [eax + 4]
mov byte [ebp - 4], 2
add dword [edi + 4], 0x10
jmp 0x41528e
push edx
push ecx
mov ecx, edi
call fcn.0040b520
jmp 0x41528e
mov ecx, dword [ebp - 0x10]
push edx
call fcn.00415300
mov eax, dword [ebp - 0x1c]
inc esi
mov ecx, dword [ebp - 0x20]
add ebx, 0x10
sub eax, ecx
sar eax, 4
cmp esi, eax
jb 0x415231
mov ebx, dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.0040b440
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415d50
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434760
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x45106c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp dword [edi + 4], 0
jne 0x415d99
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ecx
push 1
push dword [ebp + 8]
lea ecx, [ebp - 0x3c]
mov bl, 1
push edi
call fcn.00415c70
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], 0
call fcn.00415fa0
test al, al
je 0x415e1f
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x415e1f
push ecx
push esi
lea ecx, [ebp - 0x20]
call fcn.004162b0
push 0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c]
push dword [ebp - 0x20]
call fcn.00415fa0
test esi, esi
je 0x415e11
xor edi, edi
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x3c]
push dword [edi + eax + 4]
call fcn.00415d50
neg al
lea edi, [edi + 0x10]
sbb al, al
and bl, al
sub esi, 1
jne 0x415df1
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.0040b440
jmp 0x415e21
xor bl, bl
mov eax, dword [edi + 4]
test eax, eax
jne 0x415e2c
xor dl, dl
jmp 0x415e3b
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
sete dl
xor ecx, ecx
movzx eax, bl
test dl, dl
mov dword [ebp - 0x3c], vtable.RegistryKey.0
cmovne ecx, eax
mov dword [ebp + 8], ecx
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x415e69
cmp ecx, dword [ebp - 0x34]
je 0x415e62
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x30]
call fcn.00412c10
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4