joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Disable system features via registry on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 1
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401080
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 8]
push 4
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0xc]
call esi
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.DisableCMD
push dword [ebp - 0xc]
call esi
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.DisableRegistryTools
push dword [ebp - 0xc]
call esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00401090
mov esp, ebp
pop ebp
ret

Function at 0x401895
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4018d4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4018d4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4018d4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4018d4
cmp dword [ecx + 0x74], 0xe
jbe 0x4018d4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40394d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4362b6
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x44c054]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x44c054]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x403a87
cmp byte [esi + 0x45], bl
je 0x403a87
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4039ad
pop es
xor al, al
jmp 0x403a89
push ebx
push 8
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00403c99
mov dword [esp + 0x40], ebx
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x2c]
cmp edi, 0x10
lea edx, [esp + 0x1c]
cmovae edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
cmovae ecx, dword [esp + 0x1c]
add eax, edx
push eax
push ecx
mov ecx, dword [esi + 0x40]
lea eax, [esi + 0x48]
push eax
call dword [sym.imp.MSVCP110.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, ebx
je 0x403a0e
dec eax
je 0x403a11
dec eax
dec eax
jne 0x403a7a
inc eax
jmp 0x403a78
mov byte [esi + 0x45], bl
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
cmp edi, 0x10
lea eax, [esp + 0x18]
cmovae eax, ecx
sub edx, eax
mov dword [esp + 0x10], edx
je 0x403a55
push dword [esi + 0x50]
lea eax, [esp + 0x1c]
push edx
cmp edi, 0x10
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.MSVCR110.dll_fwrite]
mov edx, dword [esp + 0x20]
add esp, 0x10
cmp edx, eax
jne 0x403a76
mov edi, dword [esp + 0x2c]
cmp byte [esi + 0x45], 0
je 0x403a74
test edx, edx
jne 0x4039d1
push ebx
push 8
lea ecx, [esp + 0x20]
call fcn.0040343c
jmp 0x4039cd
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [esp + 0x18]
call fcn.004023b1
mov al, bl
jmp 0x403a89
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0041d508
mov esp, ebp
pop ebp
ret
Function at 0x53fb40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0053ff00
add esp, 4
test eax, eax
je 0x53fb5c
mov eax, 0xfffffffe
pop esi
pop ebp
ret
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x53fb95
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
push 0
mov edx, 0x39
cmove eax, edx
push 0
mov dword [edi + 4], eax
push 0
jne 0x53fbb7
call fcn.0053ad00
jmp 0x53fbbc
call fcn.0053d7e0
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0xfffffffe
push edi
call fcn.00541890
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.00546c70
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x5d8f0a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x5d8f08]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x5d8f0c]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x5d8f0e]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
pop ebp
ret

Function at 0x57b56c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057b164

Function at 0x57b577
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057b2ee

Function at 0x58179a
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0058166e

Function at 0x5823e5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00581de3

Function at 0x588e51
Capabilities:
Hash data using murmur3

Disassembly:
js 0x588eb1
enter 0x306, 0xffffffffffffffd5
jp 0x588e3f
lea eax, [ebx]
adc eax, 0x61bf04
or eax, 0xf033d1f7

Function at 0x588e83
Capabilities:
Hash data using murmur3

Disassembly:
add esi, 0x7f695a3
inc ecx
or dword [0x61bdd2], 0xb5d7632
xor ecx, esi
mov dword [0x61be4c], 0x5de4640
neg esi
xor esi, eax
not ecx
xor esi, 0xd875cd2
xor esi, 0xd875cd2
not ecx
xor esi, eax
neg esi
mov dword [0x61be3c], 0x3026040
xor ecx, esi
sub dword [0x61be4e], 0x524614
dec ecx
sub esi, 0x7f695a3
sub eax, 0xb83a28
neg esi
xor esi, edi
Function at 0x4051a5
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
and dword [ebp - 4], edi
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [esi + 0x10], 1
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x4051f2
cmp dword [esi], edi
je 0x4051d5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEvent]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [esi + 8]
je 0x4051eb
mov eax, dword [esi + 0xc]
mov edi, dword [esi + 4]
mov dword [ebp - 4], eax
jmp 0x4051fa
push dword [esi + 4]
call ebx
jmp 0x4051fa
cmp dword [esi + 0x10], edi
jge 0x4051fa
and dword [esi + 0x10], edi
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x405222
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40521f
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call ebx
mov eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40522c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 4], ebx
push esi
push edi
test eax, eax
je 0x4052d4
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4052d4
mov edi, dword [ebp + 0x10]
cmp edi, 1
jb 0x4052d4
test edi, edi
je 0x4052cf
sub eax, esi
mov dword [ebp + 8], eax
mov al, byte [eax + esi]
mov ecx, ebx
xor byte [ebx + 0x221], al
call fcn.00405f8c
mov ecx, dword [ebp - 4]
mov bl, al
xor bl, byte [ecx + 0x221]
call fcn.00405f8c
mov dword [ebp - 8], 1
lea ecx, [ebx + eax]
mov ebx, dword [ebp - 4]
mov byte [ebp + 0xf], cl
cmp dword [ebx + 0x210], 1
jle 0x4052c1
mov edi, dword [ebp - 8]
mov ecx, ebx
call fcn.00405f8c
xor byte [ebp + 0xf], al
mov ecx, ebx
call fcn.00405f8c
mov cl, byte [ebp + 0xf]
add cl, al
inc edi
mov byte [ebp + 0xf], cl
cmp edi, dword [ebx + 0x210]
jl 0x40529c
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov byte [esi], cl
inc esi
sub edi, 1
mov dword [ebp + 0x10], edi
jne 0x405260
xor eax, eax
inc eax
jmp 0x4052d6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4053fd
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x254], esi
call fcn.004079de
test eax, eax
jne 0x405435
mov ecx, ebx
call fcn.004057f2
test eax, eax
jne 0x4055b9
test esi, esi
jne 0x405441
push 0x57
pop eax
jmp 0x4055b9
push edi
or edi, 0xffffffff
mov ecx, ebx
mov dword [esi], edi
call fcn.004085b8
test eax, eax
jne 0x4055b8
push 0x198
xor esi, esi
lea eax, [ebp - 0x23c]
push esi
push eax
call fcn.0043f630
add esp, 0xc
mov dword [ebp - 0x24c], esi
mov eax, 0x19c
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x240], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x24c]
push eax
jb 0x40549f
push esi
jmp 0x4054a6
lea eax, [ebp - 0x240]
push eax
call dword [ebx + 0x30]
cmp eax, 8
je 0x4054b9
cmp eax, 0x25b
jne 0x4055b8
mov eax, dword [ebp - 0x24c]
xor edx, edx
mov ecx, 0x19c
div ecx
test eax, eax
jg 0x4054d3
xor edi, edi
jmp 0x4055ae
imul eax, eax, 0x19c
push eax
mov dword [ebp - 0x248], eax
call fcn.00443bd6
mov esi, eax
mov dword [ebp - 0x250], esi
pop ecx
test esi, esi
jne 0x4054fa
push 0xe
pop esi
jmp 0x4055ae
push dword [ebp - 0x248]
push 0
push esi
call fcn.0043f630
add esp, 0xc
mov eax, 0x19c
mov dword [esi], eax
lea eax, [ebp - 0x244]
and dword [ebp - 0x244], 0
push eax
lea eax, [ebp - 0x24c]
push eax
push esi
call dword [ebx + 0x30]
mov esi, eax
test esi, esi
jne 0x4055a2
xor edi, edi
cmp dword [ebp - 0x244], edi
jbe 0x4055a0
mov esi, dword [ebp - 0x250]
add esi, 4
mov dword [ebp - 0x248], esi
jmp 0x405552
mov esi, dword [ebp - 0x248]
push 0x9c
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.0043f630
add esp, 0xc
mov dword [ebp - 0xa4], 0xa0
lea eax, [ebp - 0xa4]
push eax
push dword [esi]
call dword [ebx + 0x34]
cmp dword [ebp - 0xa0], 0x2000
mov esi, eax
je 0x4055cb
mov eax, 0x19c
inc edi
add dword [ebp - 0x248], eax
cmp edi, dword [ebp - 0x244]
jb 0x40554c
xor edi, edi
push dword [ebp - 0x250]
call fcn.00443bd1
pop ecx
mov eax, dword [ebp - 0x254]
mov dword [eax], edi
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret 4
xor edi, edi
xor esi, esi
inc edi
jmp 0x4055a2
Function at 0x405d3c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret

Function at 0x40600c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
push 0x4e2a38
call fcn.0043d380
mov dword [ebp - 0x28], ecx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x30], ebx
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x40602f
mov eax, dword [edi]
mov dword [ebp - 0x30], eax
mov eax, dword [ecx + 4]
test eax, eax
jne 0x4061ed
test dword [ebp + 0x18], 1
jne 0x40606d
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
cmp dword [ebp + 0x1c], ebx
je 0x40605c
push dword [ebp + 8]
call fcn.00407f5b
jmp 0x4061ed
push ebx
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x4061ed
test edi, edi
jne 0x40607e
cmp dword [ebp + 0xc], ebx
jne 0x40607e
push 0x57
pop eax
jmp 0x4061ed
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [ebp + 8]
call fcn.00407d56
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x40609b
mov ecx, dword [ebp - 0x24]
mov dword [edx], ecx
test eax, eax
jne 0x4061ed
test edi, edi
je 0x4061ed
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
mov edx, dword [ebp - 0x20]
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x406115
cmp edx, ecx
sbb eax, eax
and eax, ecx
cmp eax, 0x400
ja 0x4060f1
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.0043d3e0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x34], esi
test esi, esi
je 0x406117
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x34], esi
jmp 0x406117
cmp edx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.00443bd6
pop ecx
mov esi, eax
mov dword [ebp - 0x38], esi
test esi, esi
je 0x406117
mov dword [esi], 0xdddd
add esi, 8
mov dword [ebp - 0x38], esi
jmp 0x406117
mov esi, ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x40614d
test esi, esi
jne 0x406158
push 0xe
jmp 0x406078
push dword [ebp - 0x20]
push ebx
push esi
call fcn.0043f630
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp + 8]
mov ebx, dword [ebp - 0x28]
mov ecx, ebx
call fcn.00407d56
mov ecx, eax
mov dword [ebp - 0x28], ecx
test ecx, ecx
je 0x40618f
push esi
call fcn.00408ccb
mov eax, dword [ebp - 0x28]
jmp 0x4061ec
cmp dword [ebp + 0x1c], 0
je 0x4061b9
cmp dword [ebp - 0x24], 1
je 0x4061a1
cmp dword [ebp - 0x24], 7
jne 0x4061b9
mov eax, dword [ebp - 0x30]
mov dword [edi], eax
push edi
push dword [ebp + 0x10]
push esi
push dword [ebp - 0x24]
mov ecx, ebx
call fcn.004080ea
mov ebx, eax
jmp 0x4061e4
cmp dword [ebp + 0x10], 0
je 0x4061dc
mov eax, dword [ebp - 0x20]
cmp eax, dword [edi]
jbe 0x4061cd
mov ebx, 0xea
jmp 0x4061df
push dword [ebp - 0x20]
push esi
push dword [ebp + 0x10]
call fcn.0043eb30
add esp, 0xc
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
push esi
call fcn.00408ccb
mov eax, ebx
pop ecx
lea esp, [ebp - 0x48]
call fcn.0043d3c9
ret 0x18
Function at 0x406a03
Capabilities:
Set registry value

Disassembly:
push 0x2c
push 0x4e2a58
call fcn.0043d380
mov eax, ecx
mov dword [ebp - 0x30], eax
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov esi, ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], ebx
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x406a32
mov eax, ecx
jmp 0x406bc7
test dword [ebp + 0x18], 1
jne 0x406a69
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
cmp dword [ebp + 0x1c], ebx
je 0x406a58
push dword [ebp + 8]
mov ecx, eax
call fcn.004088a6
jmp 0x406bc7
push ebx
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x406bc7
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x406bc4
mov edx, dword [ebp + 0x14]
cmp edx, 1
jb 0x406bc4
cmp dword [ebp + 0x1c], ebx
je 0x406ab8
cmp dword [ebp + 0xc], 1
je 0x406a91
cmp dword [ebp + 0xc], 7
jne 0x406ab8
lea edi, [ebp - 0x24]
push edi
lea edi, [ebp - 0x20]
push edi
push dword [ebp + 0xc]
push edx
push ecx
mov ecx, eax
call fcn.00408802
mov edi, eax
test edi, edi
jne 0x406ba0
mov dword [ebp - 0x34], 1
jmp 0x406abe
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x24]
add ecx, 0x20
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ebx
lea edx, [ecx + 8]
cmp ecx, edx
sbb eax, eax
test edx, eax
je 0x406b2f
cmp ecx, edx
sbb eax, eax
and eax, edx
cmp eax, 0x400
ja 0x406b09
cmp ecx, edx
sbb eax, eax
and eax, edx
call fcn.0043d3e0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x38], esi
push 8
pop edi
test esi, esi
je 0x406b34
mov dword [esi], 0xcccc
add esi, edi
mov dword [ebp - 0x38], esi
jmp 0x406b34
cmp ecx, edx
sbb eax, eax
and eax, edx
push eax
call fcn.00443bd6
pop ecx
mov esi, eax
mov dword [ebp - 0x3c], esi
push 8
pop edi
test esi, esi
je 0x406b34
mov dword [esi], 0xdddd
add esi, edi
mov dword [ebp - 0x3c], esi
jmp 0x406b34
mov esi, ebx
push 8
pop edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x406b6a
test esi, esi
je 0x406bab
push dword [ebp - 0x2c]
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x24]
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x30]
call fcn.00407c82
mov edi, eax
test edi, edi
jne 0x406ba0
push dword [ebp - 0x2c]
push esi
push 3
push ebx
push dword [ebp + 8]
mov eax, dword [ebp - 0x30]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test esi, esi
je 0x406bab
push esi
call fcn.00408ccb
pop ecx
cmp dword [ebp - 0x34], 0
je 0x406bc0
cmp dword [ebp - 0x20], 0
je 0x406bc0
push dword [ebp - 0x20]
call fcn.00443bd1
pop ecx
mov eax, edi
jmp 0x406bc7
push 0x57
pop eax
lea esp, [ebp - 0x4c]
call fcn.0043d3c9
ret 0x18
Function at 0x4071f4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x90
xor edi, edi
lea eax, [ebp - 0x94]
push edi
push eax
mov esi, ecx
call fcn.0043f630
add esp, 0xc
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x407245
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40729f
cmp dword [ebp - 0x88], 1
jne 0x40726c
cmp dword [ebp - 0x90], edi
jne 0x40725b
mov dword [esi + 8], edi
jmp 0x40729d
cmp dword [ebp - 0x90], 0x5a
sbb eax, eax
add eax, 2
mov dword [esi + 8], eax
jmp 0x40729d
cmp dword [ebp - 0x88], 2
jne 0x407298
cmp dword [ebp - 0x94], 4
jbe 0x40728f
xor eax, eax
cmp dword [ebp - 0x94], 5
setne al
add eax, 4
jmp 0x407267
mov dword [esi + 8], 3
jmp 0x40729d
mov edi, 0x2728
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret

Function at 0x4079fa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor edx, edx
lea eax, [ebp - 4]
push eax
inc edx
xor ecx, ecx
push edx
push ecx
push str.SOFTWAREMcAfeeMSCUpdateWinHTTP
push 0x80000002
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407a5b
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push str.AutoConfigUrl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
je 0x407a57
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x407aa0
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407aa0
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push str.AutoConfigURL
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 4], 0
je 0x407aa0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
cmp eax, dword [ebp - 8]
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret
Function at 0x407d56
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
push 0x4e2ac0
call fcn.0043d380
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x407d6f
and dword [ecx], 0
and dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x1f4
and dword [ebp - 0x20], 0
and dword [ebp - 4], 0
mov eax, 0x1fc
call fcn.0043d3e0
mov dword [ebp - 0x18], esp
mov eax, esp
mov dword [ebp - 0x30], eax
test eax, eax
je 0x407da4
mov dword [eax], 0xcccc
add eax, 8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], eax
jmp 0x407dc4
push 0xfffffffffffffffe
pop edi
mov dword [ebp - 4], edi
cmp dword [ebp - 0x20], 0
jne 0x407dd8
push 0xe
pop eax
jmp 0x407f0a
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, 0xea
jne 0x407eca
push dword [ebp - 0x20]
call fcn.00408ccb
pop ecx
and dword [ebp - 0x20], 0
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x28]
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x407e77
cmp edx, ecx
sbb eax, eax
and eax, ecx
cmp eax, 0x400
ja 0x407e55
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.0043d3e0
mov dword [ebp - 0x18], esp
mov eax, esp
mov dword [ebp - 0x34], eax
test eax, eax
je 0x407e79
mov dword [eax], 0xcccc
add eax, 8
mov dword [ebp - 0x34], eax
jmp 0x407e79
cmp edx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.00443bd6
pop ecx
mov dword [ebp - 0x38], eax
test eax, eax
je 0x407e79
mov dword [eax], 0xdddd
add eax, 8
mov dword [ebp - 0x38], eax
jmp 0x407e79
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], edi
jmp 0x407ea3
cmp dword [ebp - 0x20], 0
je 0x407dd0
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x407eff
cmp dword [ebp - 0x24], 3
je 0x407ed9
push 0xd
pop esi
jmp 0x407eff
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
call fcn.00408484
mov esi, eax
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x407eff
mov eax, dword [ebp - 0x24]
mov dword [ecx], eax
push dword [ebp - 0x20]
call fcn.00408ccb
pop ecx
mov eax, esi
lea esp, [ebp - 0x48]
call fcn.0043d3c9
ret 0x10
Function at 0x407f5b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x24
push 0x4e2ae8
call fcn.0043d380
mov dword [ebp - 0x28], ecx
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
xor edi, edi
mov dword [ebp - 0x20], edi
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x407f81
mov eax, dword [ebx]
mov dword [ebp - 0x20], eax
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push eax
push edi
push dword [ebp + 8]
mov eax, ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x407fa3
mov ecx, dword [ebp - 0x24]
mov dword [edx], ecx
cmp dword [ebp - 0x24], esi
je 0x407fb2
cmp dword [ebp - 0x24], 7
jne 0x4080df
test ebx, ebx
je 0x4080df
cmp dword [ebx], edi
je 0x4080df
test eax, eax
je 0x407fd1
cmp eax, 0xea
jne 0x4080df
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov dword [ebp - 0x20], eax
mov dword [ebx], ecx
cmp dword [ebp + 0x10], edi
je 0x407fed
push ecx
push edi
push dword [ebp + 0x10]
call fcn.0043f630
add esp, 0xc
mov dword [ebp - 0x2c], edi
mov dword [ebp - 4], edi
mov edx, dword [ebp - 0x20]
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x408058
cmp edx, ecx
sbb eax, eax
and eax, ecx
cmp eax, 0x400
ja 0x408033
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.0043d3e0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x30], esi
test esi, esi
je 0x40805a
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x30], esi
jmp 0x40805a
cmp dword [ebp - 0x20], ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.00443bd6
pop ecx
mov esi, eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x40805a
mov dword [esi], 0xdddd
add esi, 8
mov dword [ebp - 0x34], esi
jmp 0x40805a
mov esi, edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x408090
test esi, esi
jne 0x408099
push 0xe
pop eax
jmp 0x4080df
push dword [ebp - 0x20]
push edi
push esi
call fcn.0043f630
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push edi
push dword [ebp + 8]
mov eax, dword [ebp - 0x28]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x4080d6
push ebx
push dword [ebp + 0x10]
push esi
push dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
call fcn.004080ea
mov edi, eax
push esi
call fcn.00408ccb
pop ecx
mov eax, edi
lea esp, [ebp - 0x44]
call fcn.0043d3c9
ret 0x10