joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fbf4
Capabilities:
Get user security identifier

Disassembly:
push 0x10
mov eax, 0x414b69
call fcn.00413ee9
mov edi, edx
mov esi, ecx
test edi, edi
jne 0x40fc12
mov eax, 0x80004003
jmp 0x40fcda
test esi, esi
jne 0x40fc20
mov eax, 0x80070057
jmp 0x40fcda
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
lea eax, [ebp - 0x14]
mov dword [edi], ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], ebx
push eax
push ebx
push esi
push ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountNameW]
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x40fccf
xor ecx, ecx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x14]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040b447
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40fcc8
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_malloc]
mov dword [edi], eax
pop ecx
test eax, eax
je 0x40fcb4
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push ebx
lea ecx, [ebp - 0x18]
push ecx
push eax
push esi
push 0
call dword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountNameW]
test eax, eax
je 0x40fc9f
xor esi, esi
jmp 0x40fcb9
call fcn.004074b1
push dword [edi]
mov esi, eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_free]
and dword [edi], 0
pop ecx
jmp 0x40fcb9
mov esi, 0x8007000e
push ebx
call fcn.0040b458
pop ecx
jmp 0x40fcd8
mov esi, 0x8007000e
jmp 0x40fcd8
mov ecx, eax
call fcn.00417c23
mov esi, eax
mov eax, esi
call fcn.00413e30
ret
Function at 0x41072d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x414d34
call fcn.00413f25
mov edx, dword [ebp + 0x10]
xor esi, esi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x41078e
call fcn.004074b1
mov esi, eax
jmp 0x410867
push esi
push ebx
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FindResourceExW]
mov ebx, eax
test ebx, ebx
jne 0x4107ad
call fcn.004074b1
jmp 0x41085e
push ebx
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
mov dword [ebp - 0x424], eax
test eax, eax
je 0x4107a3
push ebx
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x4107e0
mov esi, 0x8007000e
jmp 0x410867
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0040ef95
jmp 0x410806
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x41081d
mov esi, 0x8007000e
jmp 0x410860
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x424]
push esi
push 3
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x4107a3
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.004105de
mov esi, eax
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
lea ecx, [ebp - 0x418]
call fcn.0040e534
lea ecx, [ebp - 0x428]
call fcn.00417276
mov eax, esi
call fcn.00413e5f
ret 0x10
Function at 0x4110de
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
push esi
push edi
test edx, edx
je 0x411138
xor eax, eax
mov edi, edx
mov dword [ebp - 4], eax
mov esi, eax
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x411102
sub ecx, dword [ebp - 8]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x4110fa
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
leave
ret 8
mov ecx, 0x80004005
call fcn.00417c39
int3

Function at 0x411149
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
push edi
test edx, edx
je 0x41118e
mov ecx, edx
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x411161
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov ecx, 0x80004005
call fcn.00417c39
int3
Function at 0x412acb
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x21c
mov eax, 0x4150a3
call fcn.00413f25
mov edi, ecx
mov ebx, dword [ebp + 0xc]
push 0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, dword [edi + 0x9c]
test eax, eax
jne 0x412b03
push 6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
call fcn.00413e5f
ret 8
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x224], 0x208
push ecx
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x228]
push ecx
push 0
push 0x402e68
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
mov eax, 0xea
test esi, esi
je 0x412b3f
cmp esi, eax
jne 0x412b54
mov ecx, dword [ebp - 0x228]
cmp ecx, 1
je 0x412b57
cmp ecx, 7
je 0x412b57
cmp ecx, 2
je 0x412b57
push esi
jmp 0x412af3
and dword [ebp - 4], 0
cmp ecx, 2
jne 0x412bc9
cmp esi, eax
je 0x412c79
mov edi, 0x104
mov ecx, ebx
push edi
call fcn.004125cb
push edi
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x224], eax
lea ecx, [eax - 1]
cmp ecx, 0x102
ja 0x412bb5
add eax, eax
mov dword [ebp - 0x224], eax
test esi, esi
je 0x412c2f
push esi
push 0x403174
mov edx, 0x2fd
jmp 0x412c88
push 0xce
push 0x403174
mov edx, 0x2e9
jmp 0x412c88
mov ecx, ebx
cmp esi, eax
jne 0x412c03
mov eax, dword [ebp - 0x224]
shr eax, 1
push eax
call fcn.004125cb
lea ecx, [ebp - 0x224]
push ecx
push eax
lea eax, [ebp - 0x228]
push eax
push 0
push 0x402e68
push dword [edi + 0x9c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
jmp 0x412b9d
mov edi, dword [ebp - 0x224]
mov eax, edi
shr eax, 1
push eax
call fcn.004125cb
lea ecx, [ebp - 0x220]
mov edx, edi
push ecx
mov ecx, eax
call fcn.00411290
mov ecx, dword [ebp + 4]
test eax, eax
js 0x412c90
jmp 0x412b9d
or dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x224]
shr edx, 1
mov dword [ebp - 0x224], edx
lea ecx, [edx - 1]
neg edx
sbb edx, edx
and edx, ecx
mov ecx, ebx
push edx
call fcn.0041b20e
xor eax, eax
inc eax
jmp 0x412afb
push 0xce
push 0x403174
mov edx, 0x2e3
mov ecx, dword [ebp + 4]
call fcn.0041b1f2
push eax
push ecx
call fcn.0041b4f4
int3

Function at 0x412fc8
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
mov edi, 0x403230
movzx eax, word [esi + 4]
push eax
push 1
push 0x4032f0
push 0x3e
push edi
call fcn.00413056
add esp, 0x18
push dword [ebp + 8]
call fcn.0041bd63
test al, al
jne 0x413032
call fcn.0040c113
test al, al
je 0x413032
xor eax, eax
push eax
push dword [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
movzx eax, word [esi + 4]
push eax
push 1
push dword [esi]
call dword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_ReportEventW]
mov esi, eax
call fcn.004074b1
test esi, esi
jne 0x413048
jmp 0x413037
mov eax, 0x800003f7
push eax
push 0x403390
push 0x62
push edi
call fcn.0040f445
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x41358f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x41f7d0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 0x28]
xor ebx, ebx
push dword [edi + 0x14]
push 0x403420
push 0x10
push eax
call fcn.0040d469
add esp, 0x10
test eax, eax
js 0x413629
push ecx
lea eax, [ebp - 0x234]
mov esi, 0x403430
push eax
push esi
mov edx, 0x80000002
call fcn.00413805
test al, al
je 0x4135e7
lea esi, [ebp - 0x234]
lea eax, [ebp - 0x238]
push eax
push 2
push ebx
push esi
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x413629
push 0x14
push edi
push 3
push ebx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x238]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test eax, eax
jne 0x41361d
mov bl, 1
push dword [ebp - 0x238]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040aec0
leave
ret 4
Function at 0x419b4b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
jns 0x419cb5
cmp ecx, dword [eax + 0x48]
jne 0x419cb5
lea edi, [eax + 0x40]
test edi, edi
je 0x419cb5
mov ecx, esi
call fcn.0041ac87
push 0x40da70
call fcn.004079d0
mov ecx, dword [eax + 4]
cmp dword [ecx], 5
jbe 0x419d34
push 0x4000
push ebx
call fcn.00407a3e
test al, al
je 0x419d34
mov eax, dword [ebp + 8]
mov edx, 0x404628
mov dword [esp + 0x10], eax
movzx eax, byte [ebp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x3c]
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0x38]
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esp + 0x30], eax
mov eax, dword [edi + 0x18]
mov dword [esp + 0x34], eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x38], eax
mov eax, dword [edi]
mov dword [esp + 0x3c], eax
mov eax, dword [edi + 0x4c]
mov dword [esp + 0x40], eax
mov eax, dword [edi + 0x28]
mov dword [esp + 0x44], eax
mov eax, dword [edi + 0x24]
mov dword [esp + 0x48], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x50], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x5c], 0x1000000
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x64], ebx
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x60], 0x404d70
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x98]
push eax
mov eax, dword [esi + 0x18]
push ecx
add eax, 8
push eax
call fcn.00405a5d
jmp 0x419d34
mov ecx, esi
call fcn.0041ac87
push 0x40da70
call fcn.004079d0
mov edi, dword [eax + 4]
cmp dword [edi], 5
jbe 0x419d34
push 0x4000
push ebx
mov ecx, edi
call fcn.00407a3e
test al, al
je 0x419d34
mov eax, dword [ebp + 8]
mov dword [esp + 0x54], eax
movzx eax, byte [ebp + 0xc]
mov dword [esp + 0x50], eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov edx, dword [esi + 0x18]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x44], 0x404d70
mov eax, dword [edx + 0x3c]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x54]
push eax
push ecx
lea eax, [edx + 8]
mov ecx, edi
push eax
mov edx, 0x4045aa
call fcn.00416efc
cmp dword [esi + 0x10], ebx
je 0x419d41
lea ecx, [esi + 4]
call fcn.00419f49
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41bba5
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x180
mov eax, dword [0x41f7d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi], 2
jne 0x41bd4f
xor edi, edi
cmp dword [esi + 0x10], edi
jle 0x41bd4f
mov eax, dword [esi + 0x14]
lea ecx, [ebp - 0x170]
push 0x404e38
mov dword [ebp - 0x170], edi
mov dword [ebp - 0x16c], edi
mov dword [ebp - 0x168], edi
mov dword [ebp - 0x164], edi
mov dword [ebp - 0x160], edi
mov dword [ebp - 0x15c], eax
call fcn.004134f4
test al, al
je 0x41bc3c
mov eax, dword [ebp - 0x170]
cmp eax, dword [esi]
jne 0x41bc3c
mov eax, dword [ebp - 0x16c]
cmp eax, dword [esi + 4]
jne 0x41bc3c
mov eax, dword [ebp - 0x168]
cmp eax, dword [esi + 8]
jne 0x41bc3c
mov eax, dword [ebp - 0x160]
cmp eax, dword [esi + 0x10]
je 0x41bd4f
push dword [esi + 0x14]
lea eax, [ebp - 0x24]
push 0x404ec0
push 0x10
push eax
call fcn.0040d469
add esp, 0x10
test eax, eax
js 0x41bd4f
push dword [esi + 0x10]
lea eax, [ebp - 0x44]
push 0x404ec8
push 0x10
push eax
call fcn.0040d469
add esp, 0x10
test eax, eax
js 0x41bd4f
push edi
push 0x2710
push dword [esi + 8]
push dword [esi + 4]
call fcn.00414020
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x150]
mov dword [ebp - 0x14c], edx
push eax
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_FileTimeToSystemTime]
test eax, eax
je 0x41bd4f
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x180]
push eax
push edi
call dword [sym.imp.api_ms_win_core_timezone_l1_1_0.dll_SystemTimeToTzSpecificLocalTime]
test eax, eax
je 0x41bd4f
push 0x80
lea eax, [ebp - 0x148]
push eax
push edi
lea eax, [ebp - 0x168]
push eax
push edi
push 0x800
call dword [sym.imp.api_ms_win_core_datetime_l1_1_0.dll_GetTimeFormatW]
test eax, eax
jle 0x41bd4f
lea eax, [ebp - 0x24]
mov dword [ebp - 0x158], 0x402d20
mov dword [ebp - 0x154], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x148]
push 0x4027a8
push edi
mov dword [ebp - 0x14c], eax
call dword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x41bd4f
push edi
lea eax, [ebp - 0x158]
push eax
push edi
push 4
push edi
push 0x800003f7
push 1
push 2
push esi
call dword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_ReportEventW]
push esi
call dword [sym.imp.ext_ms_win_advapi32_eventlog_l1_1_0.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040aec0
leave
ret

Function at 0x41bf7a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x41f7d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
mov esi, 0xc04
push eax
push 8
push 0x404
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
test eax, eax
je 0x41bfc8
push 3
lea eax, [ebp - 0x44]
push 0x405018
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffff800
add esi, eax
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.0040aec0
leave
ret
Function at 0x401120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401139
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401174
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401170
lea ebx, [ebx]
cmp esi, eax
jae 0x401174
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401160
cmp esi, eax
jb 0x40117a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4011d0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push esi
push 0xa28
call fcn.004245b7
add esp, 4
cmp byte [esp + 0x1c], 0
mov ebx, eax
mov dword [esp + 0xc], 0xa28
je 0x401208
lea eax, [esp + 8]
push eax
push 3
push 0
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push 0x80000002
jmp 0x40121b
lea ecx, [esp + 8]
push ecx
push 3
push 0
push str.Environment
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x401264
mov ecx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
push ebx
lea eax, [esp + 0x1c]
push eax
push esi
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x401258
mov edx, dword [esp + 0xc]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
push ebx
call fcn.004244da
add esp, 4
xor eax, eax
test esi, esi
pop esi
sete al
pop ebx
add esp, 0xc
ret

Function at 0x401280
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
push 0x410
call fcn.004245b7
add esp, 4
cmp byte [esp + 0x18], 0
mov esi, eax
mov dword [esp + 8], 0xa28
je 0x4012b7
lea eax, [esp + 4]
push eax
push 3
push 0
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push 0x80000002
jmp 0x4012ca
lea ecx, [esp + 4]
push ecx
push 3
push 0
push str.Environment
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401308
mov ecx, dword [esp + 0x14]
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
push esi
lea eax, [esp + 0x14]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401308
mov eax, dword [esp + 8]
test eax, eax
jle 0x401308
mov byte [eax + esi], 0
mov eax, esi
pop esi
add esp, 0xc
ret
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x403190
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4031c9
test al, 0x10
je 0x4031c9
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4031c4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
ret 4
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4031e9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
ret 4
Function at 0x404d60
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x43e03b
mov eax, dword fs:[0]
push eax
sub esp, 0x164
mov eax, dword [0x44ef30]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push esi
push edi
mov eax, dword [0x44ef30]
xor eax, esp
push eax
lea eax, [esp + 0x174]
mov dword fs:[0], eax
mov edi, dword [esp + 0x184]
mov esi, dword [esp + 0x188]
mov ebx, dword [esp + 0x18c]
lea eax, [esp + 0x6c]
push 0x104
push eax
call fcn.0042688e
add esp, 8
test esi, esi
je 0x404de4
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404dd0
sub eax, edx
je 0x404de4
push esi
call fcn.004265e6
add esp, 4
push 0x44
lea ecx, [esp + 0x2c]
push 0
push ecx
call fcn.00425480
add esp, 0xc
cmp dword [esp + 0x190], 0
mov dword [esp + 0x28], 0x44
je 0x404e13
mov edx, 1
mov word [esp + 0x58], dx
jmp 0x404e1a
xor eax, eax
mov word [esp + 0x58], ax
or dword [esp + 0x54], 1
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call fcn.00417947
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404e4b
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
push ebx
push edi
lea ecx, [esp + 0x18]
push str._s__s
push ecx
mov dword [esp + 0x18c], 0
call fcn.00404d40
mov esi, dword [esp + 0x20]
add esp, 0x10
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [esp + 0x14], eax
test eax, eax
je 0x404ed3
cmp dword [esp + 0x194], 0
je 0x404ed3
mov ecx, dword [esp + 0x18]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea eax, [esp + 0x6c]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404ee0
sub eax, edx
je 0x404ef8
lea ecx, [esp + 0x6c]
push ecx
call fcn.004265e6
add esp, 4
mov edi, dword [esp + 0x14]
lea eax, [esi - 0x10]
mov dword [esp + 0x17c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404f23
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x174]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x160]
xor ecx, esp
call fcn.00425da1
add esp, 0x170
ret