joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a16f0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x20], 0
mov dword [esi], vtable.ArchiveExtractor.0
je 0x5a170e
push 2
push dword [esi + 0x7c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov byte [esi + 0x20], 0
mov ecx, dword [esi + 0x78]
cmp ecx, 0x10
jb 0x5a1742
mov eax, dword [esi + 0x64]
inc ecx
cmp ecx, 0x1000
jb 0x5a1738
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5a17da
mov eax, edx
push ecx
push eax
call fcn.00663ac7
add esp, 8
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0xf
mov byte [esi + 0x64], 0
mov ecx, dword [esi + 0x58]
cmp ecx, 0x10
jb 0x5a1784
mov eax, dword [esi + 0x44]
inc ecx
cmp ecx, 0x1000
jb 0x5a177a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5a17da
mov eax, edx
push ecx
push eax
call fcn.00663ac7
add esp, 8
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0xf
mov byte [esi + 0x44], 0
mov ecx, dword [esi + 0x38]
cmp ecx, 0x10
jb 0x5a17c6
mov eax, dword [esi + 0x24]
inc ecx
cmp ecx, 0x1000
jb 0x5a17bc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5a17da
mov eax, edx
push ecx
push eax
call fcn.00663ac7
add esp, 8
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0xf
mov byte [esi + 0x24], 0
pop esi
ret
call fcn.0066a5fb
int3

Function at 0x5a17e0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x20], 0
je 0x5a17f8
push 2
push dword [esi + 0x7c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov byte [esi + 0x20], 0
pop esi
ret

Function at 0x5a1800
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
lea ecx, [esi + 0x44]
mov dword [esi + 0x40], 1
cmp ecx, eax
je 0x5a182a
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x5a1821
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.004484a0
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x64]
cmp ecx, eax
je 0x5a1847
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x5a183e
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.004484a0
lea eax, [ebp + 8]
mov byte [esi + 0x20], 1
push eax
push 0
push esi
push 0x5a0130
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x7c], eax
pop esi
pop ebp
ret 8

Function at 0x5a1870
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
lea ecx, [esi + 0x44]
mov dword [esi + 0x40], 0
cmp ecx, eax
je 0x5a189a
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x5a1891
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.004484a0
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x64]
cmp ecx, eax
je 0x5a18b7
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x5a18ae
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.004484a0
lea eax, [ebp + 8]
mov byte [esi + 0x20], 1
push eax
push 0
push esi
push 0x5a0130
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x7c], eax
pop esi
pop ebp
ret 8
Function at 0x5a18e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, ecx
lea ecx, [esi + 0x64]
mov dword [esi + 0x40], 2
cmp ecx, eax
je 0x5a190a
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x5a1901
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.004484a0
mov eax, dword [ebp + 8]
mov dword [esi + 0x5c], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x60], eax
lea eax, [ebp + 0x10]
push eax
push 0
push esi
push 0x5a0130
push 0
push 0
mov byte [esi + 0x20], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x7c], eax
pop esi
pop ebp
ret 0xc
Function at 0x5c47d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0
call fcn.005c34c0
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 8]
add esp, 8
push eax
lea eax, [ebp - 4]
push eax
push 0
push 2
push 0
push 0
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x5c481c
xor bl, bl
jmp 0x5c4850
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
call fcn.005c34c0
mov esi, dword [ebp - 0x10]
lea eax, [ebp + 0x14]
add esp, 8
push 4
push eax
push 4
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
test eax, eax
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x5c485d
push esi
call fcn.0066a657
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5c4c80
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6917f1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x74e694]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5c4d37
push 0x7d0
push eax
mov dword [ebp - 0x14], 0x3e8
call fcn.0066a672
mov esi, eax
add esp, 8
mov dword [ebp - 0x18], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push 0x3e8
push esi
push 0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x5c4d21
nop word [eax + eax]
push esi
push dword [ebp - 0x10]
call fcn.005c4c80
add esp, 8
test al, al
je 0x5c4d59
push 0x3e8
push esi
push 0
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x5c4d00
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x5c4d37
push esi
call fcn.0066a657
add esp, 4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x5c4d66
push esi
call fcn.0066a657
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0xda2058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xda21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xda207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda206a
add dl, dl
jne 0xda2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda20dc
xor eax, eax
add dl, dl
jne 0xda2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda217d
add dl, dl
jne 0xda20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xda20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xda2075
mov eax, 1
add dl, dl
jne 0xda20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda20e1
sub eax, ebx
mov ebx, 1
jne 0xda2128
mov ecx, 1
add dl, dl
jne 0xda210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xda2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xda213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xda214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda2136
cmp eax, 0x7d00
jae 0xda216d
cmp eax, 0x500
jb 0xda2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda2075
cmp eax, 0x7f
ja 0xda2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xda219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xda2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401946
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push str.InitApplication
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
push str.UnErase_Process
push str.NU9:UEProcClass
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4019cd
push 0
push 0x41b070
call dword [0x420588]
test eax, eax
je 0x401998
push 0
push 1
push 0x111
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x4019bb
push 0
push 0x41b080
call dword [0x420588]
test eax, eax
je 0x4019bb
push 0
push 0xb
push 0x111
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_PostMessageA]
push str.InitApplication__found_previous_instance__exiting
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
xor eax, eax
jmp 0x401ae5
push str.SYSTEM.INI
push 0x104
lea eax, [ebp - 0x108]
push eax
push str.EXPLORER.EXE
push str.shell
push str.BOOT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x401a21
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
push str.setup.exe
lea eax, [ebp - 0x108]
push eax
call dword [0x4205d8]
test eax, eax
je 0x401a21
xor eax, eax
jmp 0x401ae5
call fcn.0040d10f
test eax, eax
jne 0x401a3f
push 0x41b3b8
lea eax, [ebp - 0x20c]
push eax
call fcn.0040e950
pop ecx
pop ecx
jmp 0x401a52
push 0x41b3cc
lea eax, [ebp - 0x20c]
push eax
call fcn.0040e950
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [0x422038], eax
mov dword [ebp - 0x210], str.NU9:UEProcClass
mov dword [ebp - 0x234], 3
mov dword [ebp - 0x230], 0x401c54
and dword [ebp - 0x22c], 0
and dword [ebp - 0x228], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x224], eax
push 0x64
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x220], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], 6
and dword [ebp - 0x214], 0
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
leave
ret
Function at 0x401ae7
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x4166d2
call fcn.0040e8c4
sub esp, 0xc
push str.InitInstance
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
mov eax, dword [ebp + 8]
mov dword [0x42203c], eax
push 0
push dword [ebp + 8]
push 0
push 0
push 0xa0
push 0xaf
push 0
push 0x80000000
push 0xcf0000
push str.UnErase_Process
push str.NU9:UEProcClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x422040], eax
cmp dword [0x422040], 0
jne 0x401b58
push str.InitInstance__CreateWindow_failed.
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
xor eax, eax
jmp 0x401c48
call fcn.0040d10f
test eax, eax
je 0x401b71
call fcn.004016a1
test eax, eax
jne 0x401b71
xor eax, eax
jmp 0x401c48
push 0
push dword [0x422040]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x422040]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x6c
push 0
push 0x421f48
call fcn.0040e8f0
add esp, 0xc
call sym.NPROTECT.EXE__NPSystemGetWindowsType_0
cmp eax, 2
jne 0x401c0e
push 0x21
call fcn.0040e453
pop ecx
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0
je 0x401bc8
mov ecx, dword [ebp - 0x14]
call fcn.0040ce02
mov dword [ebp - 0x18], eax
jmp 0x401bcc
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [0x4220d8], eax
cmp dword [0x422064], 0
jne 0x401c0c
push str.Launching_Free_Space_Timer
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
push 0
push 0x7530
push 2
push dword [0x422040]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x422064], eax
jmp 0x401c45
cmp dword [0x42205c], 0
jne 0x401c45
cmp dword [0x422060], 0
jne 0x401c45
push str.Launching_timer
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
push 0
push 0x7d0
push 1
push dword [0x422040]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x422060], eax
push 1
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x402304
Capabilities:
Create thread
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
call sym.NPROTECT.EXE__NPSystemGetWindowsType_0
cmp eax, 2
jne 0x4023ab
cmp dword [0x421fb8], 0
je 0x40239b
call fcn.004027b9
mov byte [ebp - 4], al
mov al, byte [ebp - 4]
mov byte [ebp - 0x10], al
cmp byte [ebp - 0x10], 0
je 0x402344
cmp byte [ebp - 0x10], 1
je 0x402351
cmp byte [ebp - 0x10], 2
je 0x40235e
jmp 0x40236b
push str.Updating_Icon__SC_STATE_ENABLED_NO_FILES_
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
jmp 0x40237c
push str.Updating_Icon__SC_STATE_ENABLED_WITH_FILES_
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
jmp 0x40237c
push str.Updating_Icon__SC_STATE_DISABLED_
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
jmp 0x40237c
movzx eax, byte [ebp - 4]
push eax
push str.Updating_Icon__SC_STATE_UNKNOWN_____d__
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
pop ecx
movzx eax, byte [ebp - 4]
push eax
push dword [0x421fc4]
push dword [0x421fc0]
push dword [0x421fb8]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x4023a6
push str.Could_not_find_NPICON_to_post_message________
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
jmp 0x402452
cmp dword [0x422034], 0
je 0x4023bb
xor eax, eax
jmp 0x402454
cmp dword [0x42205c], 0
jne 0x4023f1
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x4023e7
push str.No_desktop_detected._No_Icon_update_for_now.
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
mov eax, 0xffff
jmp 0x402454
mov dword [0x42205c], 1
cmp dword [ebp + 8], 0
je 0x40242f
movzx esi, byte [0x41b0cc]
call fcn.004027b9
movzx eax, al
cmp esi, eax
je 0x40242d
cmp dword [0x422090], 0
jne 0x40242d
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x40275f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
jmp 0x402452
movzx esi, byte [0x41b0cc]
call fcn.004027b9
movzx eax, al
cmp esi, eax
je 0x402452
push 0
call fcn.00402495
pop ecx
test eax, eax
jne 0x402450
jmp 0x402452
jmp 0x40242f
xor eax, eax
pop esi
leave
ret
Function at 0x403148
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
and dword [ebp - 4], 0
movzx eax, byte [ebp + 0x10]
push eax
movzx eax, byte [ebp + 0xc]
push eax
movzx eax, byte [ebp + 8]
push eax
push str._________________RegistryEnableDrive__c:__Enable_d__Available_d_
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
add esp, 0x10
push str.Switches
movzx eax, byte [ebp + 8]
push eax
push str.SoftwareSymantecNorton_UtilitiesNorton_Protection
push str._sDrive__c:_s
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 4]
push eax
push 3
push 0
lea eax, [ebp - 0xcc]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4031f1
push 1
lea eax, [ebp + 0xc]
push eax
push 3
push 0
push str.Enabled
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
lea eax, [ebp + 0x10]
push eax
push 3
push 0
push str.Available
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
jmp 0x4031f3
xor eax, eax
leave
ret 0xc

Function at 0x4031f7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push str.______________________InitializeAllDrives__
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
lea eax, [ebp - 0x108]
push eax
push 0
call fcn.0040abe6
pop ecx
pop ecx
push str.Rules
lea eax, [ebp - 0x108]
push eax
push str._sAll_Drives_s
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
and dword [ebp - 0x214], 0
lea eax, [ebp - 0x214]
push eax
push 1
push 0
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403269
call fcn.0040496e
lea eax, [ebp - 0x10c]
push eax
push 0
push dword [ebp + 8]
push 0x4033ab
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], 0
setne al
leave
ret
Function at 0x403292
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
and dword [ebp - 0x10], 0
mov dword [ebp - 4], 3
mov dword [ebp - 0xc], 1
push dword [ebp + 8]
call fcn.004037a6
pop ecx
test eax, eax
jne 0x4032c1
xor eax, eax
jmp 0x4033a7
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0xdc]
push eax
push dword [ebp + 8]
call dword [0x4205a0]
push str.Switches
movsx eax, byte [ebp + 8]
push eax
push str.SoftwareSymantecNorton_UtilitiesNorton_Protection
push str._sDrive__c:_s
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
and dword [ebp - 8], 0
lea eax, [ebp - 0x10]
push eax
push 1
push 0
lea eax, [ebp - 0xd8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403386
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push str.Enabled
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x403345
mov dword [ebp - 8], 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x403384
cmp dword [ebp - 0xdc], 0xd
je 0x403366
cmp dword [ebp - 0xdc], 0x14
jne 0x403374
push 1
push 1
push dword [ebp + 8]
call fcn.00403148
jmp 0x403384
and dword [ebp - 8], 0
push 0
push 1
push dword [ebp + 8]
call fcn.00403148
jmp 0x4033a4
cmp dword [ebp - 0xdc], 0xd
je 0x403398
cmp dword [ebp - 0xdc], 0x14
jne 0x4033a4
push dword [ebp + 8]
call fcn.0040a8ad
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
leave
ret 4
Function at 0x4038a6
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [0x41b100], 0
je 0x403a26
and dword [0x422094], 0
push 0
push 0x41b108
call dword [0x420588]
test eax, eax
je 0x4038e0
mov eax, dword [0x422094]
or al, 1
mov dword [0x422094], eax
push 0
push 0x41b060
call dword [0x420588]
test eax, eax
je 0x4038fd
mov eax, dword [0x422094]
or al, 6
mov dword [0x422094], eax
push 0
push 0x41b118
call dword [0x420588]
test eax, eax
je 0x40391a
mov eax, dword [0x422094]
or al, 8
mov dword [0x422094], eax
cmp dword [0x422094], 0
jne 0x403988
mov dword [ebp - 0x110], 4
mov dword [ebp - 0x10c], 4
lea eax, [ebp - 0x114]
push eax
push 1
push 0
push str.SoftwareSymantecNorton_UtilitiesNorton_Protection
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403988
lea eax, [ebp - 0x110]
push eax
push 0x422094
lea eax, [ebp - 0x10c]
push eax
push 0
push str.Debug
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x422094]
and eax, 1
neg eax
sbb eax, eax
neg eax
mov dword [0x4220a4], eax
mov eax, dword [0x422094]
and eax, 2
neg eax
sbb eax, eax
neg eax
mov dword [0x4220a0], eax
mov eax, dword [0x422094]
and eax, 8
neg eax
sbb eax, eax
neg eax
mov dword [0x4220a8], eax
push 0x104
push 0x421e44
push 0x41b118
call dword [0x420584]
test eax, eax
jne 0x4039eb
push str.C:NPDEBUG.TXT
push 0x421e44
call fcn.0040e950
pop ecx
pop ecx
cmp dword [0x4220a8], 0
je 0x4039ff
push 0x421e44
call fcn.0040efad
pop ecx
cmp dword [0x4220a0], 0
je 0x403a1f
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 3
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
and dword [0x41b100], 0
cmp dword [0x4220a4], 0
jne 0x403a45
cmp dword [0x4220a0], 0
jne 0x403a45
cmp dword [0x4220a8], 0
je 0x403b1f
lea eax, [ebp + 0xc]
mov dword [ebp - 0x118], eax
push dword [ebp - 0x118]
push dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
and dword [ebp - 0x118], 0
push 0x41bca4
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.NPROTECTw32:
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x4220a8], 0
je 0x403ae4
push 0x41bcb8
push 0x421e44
call fcn.0040ef9a
pop ecx
pop ecx
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x403ae4
lea eax, [ebp - 0x100]
push eax
push str.NPROTECTw32:__s
push dword [ebp - 0x104]
call fcn.0040ef2d
add esp, 0xc
push dword [ebp - 0x104]
call fcn.0040eeb0
pop ecx
cmp dword [0x4220a0], 0
je 0x403b1a
push 0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x100]
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push 1
pop eax
jmp 0x403b21
xor eax, eax
leave
ret