joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4032d1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
push ebx
push esi
push edi
mov ebx, 0x208
lea eax, [ebp - 0x418]
push ebx
xor edi, edi
push edi
push eax
call fcn.0049a3b0
push dword [ebp + 0xc]
mov esi, 0x104
mov dword [ebp - 4], edi
push str.__s____1
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.0040450a
add esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x4caeb0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4033f2
push ebx
lea eax, [ebp - 0x210]
push edi
push eax
call fcn.0049a3b0
add esp, 0xc
mov dword [ebp + 0xc], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push edi
push edi
push dword [ebp - 4]
call esi
test eax, eax
lea eax, [ebp - 0x418]
push eax
jne 0x4033df
lea eax, [ebp - 0x210]
push eax
call fcn.0049e71a
pop ecx
pop ecx
test eax, eax
je 0x4033e9
push ebx
lea eax, [ebp - 0x620]
push edi
push eax
call fcn.0049a3b0
add esp, 0xc
mov dword [ebp - 8], 0x104
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x620]
push eax
push edi
push edi
mov edi, str.Winamp_Back
push edi
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4033c5
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x620]
push eax
call fcn.0049e71a
pop ecx
pop ecx
test eax, eax
je 0x4033d8
lea eax, [ebp - 0x210]
push eax
push edi
push dword [ebp - 4]
call fcn.004040cc
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 4]
call fcn.00404104
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8

Function at 0x4033fb
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 6
call fcn.00402fe4
add esp, 0xc
test al, al
je 0x403453
push dword [ebp + 0xc]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.CapabilitiesFileAssociations
call fcn.0040324d
add esp, 0xc
test eax, eax
jne 0x403453
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp - 4]
call fcn.004040cc
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
leave
ret 0x10
Function at 0x403459
Capabilities:
Persist via autoplayhandlers registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
push ebx
push esi
push edi
mov edi, 0x308
lea eax, [ebp - 0x514]
push edi
xor ebx, ebx
push ebx
push eax
call fcn.0049a3b0
mov esi, 0x208
lea eax, [ebp - 0x20c]
push esi
push ebx
push eax
call fcn.0049a3b0
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
push str.__s____d
push esi
push eax
call fcn.0040433e
push dword [ebp + 0xc]
lea eax, [ebp - 0x514]
push str.__s___1
push edi
push eax
call fcn.0040433e
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea eax, [ebp - 4]
add esp, 0x3c
push eax
push str.DVD_shell
push SysReAllocStringLen
call ebx
mov edi, dword [ebp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4034f3
push edi
push dword [ebp - 4]
call fcn.00404104
pop ecx
pop ecx
push dword [ebp - 4]
call esi
lea eax, [ebp - 4]
push eax
push edi
push str.DVD_shell_
push SysReAllocStringLen
call fcn.00403154
add esp, 0x10
test eax, eax
jne 0x403520
push dword [ebp + 0x20]
push dword [ebp - 4]
call fcn.00404104
pop ecx
pop ecx
push dword [ebp - 4]
call esi
lea eax, [ebp - 4]
push eax
push str.command
push edi
push str.DVD_shell_
push SysReAllocStringLen
call fcn.004031a4
add esp, 0x14
test eax, eax
jne 0x403556
lea eax, [ebp - 0x514]
push eax
push dword [ebp - 4]
call fcn.00404104
pop ecx
pop ecx
push dword [ebp - 4]
call esi
lea eax, [ebp - 4]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAutoplayHandlersEventHandlersPlayDVDMovieOnArrival
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x403580
push eax
push eax
push 1
push eax
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAutoplayHandlersHandlers_
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00403154
add esp, 0x10
test eax, eax
jne 0x4035f9
push dword [ebp + 0x20]
push str.Action
push dword [ebp - 4]
call fcn.004040cc
lea eax, [ebp - 0x20c]
push eax
push 0x4cb124
push dword [ebp - 4]
call fcn.004040cc
push 0x4cb744
push str.InvokeProgID
push dword [ebp - 4]
call fcn.004040cc
push edi
push str.InvokeVerb
push dword [ebp - 4]
call fcn.004040cc
push dword [ebp + 0x1c]
push str.Provider
push dword [ebp - 4]
call fcn.004040cc
add esp, 0x3c
push dword [ebp - 4]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x1c
Function at 0x4036a1
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
and dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
mov esi, dword [ebp + 0xc]
push edi
jne 0x40375e
push 0x208
lea eax, [ebp - 0x2d4]
push 0
push eax
call fcn.0049a3b0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea eax, [ebp - 4]
add esp, 0xc
push eax
push dword [ebp + 0x14]
push SysReAllocStringLen
call edi
test eax, eax
jne 0x403708
push esi
push str.Content_Type
push dword [ebp - 4]
call fcn.004040cc
add esp, 0xc
push dword [ebp - 4]
call ebx
push esi
push str.MIMEDatabaseContent_Type_s
lea eax, [ebp - 0x2d4]
push 0x104
push eax
call fcn.0040450a
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2d4]
push eax
push SysReAllocStringLen
call edi
test eax, eax
jne 0x40375e
push str.CLSID
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 0x14]
push str.Extension
push dword [ebp - 4]
call fcn.004040cc
add esp, 0xc
push dword [ebp - 4]
call ebx
lea eax, [ebp - 4]
push eax
push str.SoftwareNetscapeNetscape_NavigatorViewers
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x403852
push dword [ebp + 0x10]
push esi
push dword [ebp - 4]
call fcn.004040cc
add esp, 0xc
xor edi, edi
push 0xc8
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.0049a3b0
push 0x100
lea eax, [ebp - 0x1cc]
mov dword [ebp + 0x14], 0x80
push 0
push eax
call fcn.0049a3b0
push edi
push str.TYPE_d
lea eax, [ebp - 0xcc]
push 0x64
push eax
call fcn.0040450a
add esp, 0x28
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp + 0x18]
push eax
push 0
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40383a
mov ecx, esi
lea eax, [ebp - 0x1cc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403822
test dx, dx
je 0x40381e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403822
add eax, 4
add ecx, 4
test dx, dx
jne 0x4037fc
xor eax, eax
jmp 0x403827
sbb eax, eax
or eax, 1
test eax, eax
je 0x40384d
inc edi
cmp edi, 0x3e7
jl 0x40378b
jmp 0x40384d
push esi
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 4]
call fcn.004040cc
add esp, 0xc
push dword [ebp - 4]
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x14
Function at 0x403c66
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
xor eax, eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push SysReAllocStringLen
call ebx
test eax, eax
jne 0x403d3d
push 0x100
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.0049a3b0
add esp, 0xc
mov dword [ebp - 8], 0x80
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403d21
lea ecx, [ebp - 0x10c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xc]
jne 0x403cd6
sub ecx, edx
lea eax, [ebp - 0x10c]
sar ecx, 1
push ecx
push dword [ebp + 0x10]
push eax
call fcn.0049e664
add esp, 0xc
test eax, eax
je 0x403d2e
lea eax, [ebp - 0x10c]
push eax
push str.Winamp_Back
push dword [ebp - 4]
call fcn.004040cc
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.00404104
add esp, 0x14
jmp 0x403d2e
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.00404104
pop ecx
pop ecx
cmp dword [ebp - 4], 0
je 0x403d3d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push eax
push eax
push 6
call fcn.00402fe4
add esp, 0xc
test al, al
je 0x403df0
xor eax, eax
push 0x200
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0049a3b0
push dword [ebp + 0x14]
lea eax, [ebp - 0x20c]
push 0x4caf10
push 0x200
push eax
call fcn.0040433e
add esp, 0x1c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x403df0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004040cc
add esp, 0xc
lea eax, [ebp + 0x10]
xor ebx, ebx
mov dword [ebp + 0x10], ebx
push eax
push str._n_vSN
push 3
push ebx
push 0x4d8060
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x403de7
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x403de7
mov eax, dword [ecx]
push ebx
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push ecx
call dword [eax + 0x18]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x403df7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov edi, SysReAllocStringLen
push eax
push dword [ebp + 0x10]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x403e55
push dword [ebp + 0x14]
push dword [ebp - 4]
call fcn.00404104
pop ecx
pop ecx
push 4
lea eax, [ebp + 0x14]
mov dword [ebp + 0x14], 0x10000
push eax
push 3
push ebx
push str.EditFlags
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call esi
lea eax, [ebp - 4]
push eax
push str.DefaultIcon
push dword [ebp + 0x10]
push edi
call fcn.00403154
add esp, 0x10
test eax, eax
jne 0x403eb3
push 0x248
lea eax, [ebp - 0x24c]
push ebx
push eax
call fcn.0049a3b0
push dword [ebp + 0x18]
lea eax, [ebp - 0x24c]
push dword [ebp + 0xc]
push str._s__d
push 0x124
push eax
call fcn.0040450a
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 4]
call fcn.00404104
add esp, 0x28
push dword [ebp - 4]
call esi
lea eax, [ebp - 4]
push eax
push str._shell
push dword [ebp + 0x10]
push edi
call fcn.00403154
add esp, 0x10
test eax, eax
jne 0x403ede
push dword [ebp + 0x1c]
push dword [ebp - 4]
call fcn.00404104
pop ecx
pop ecx
push dword [ebp - 4]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x18

Function at 0x403ef8
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
push str.WinampAgentMain
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x403f1d
push esi
push esi
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 4]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
pop esi
test eax, eax
jne 0x403f4d
push str.WinampAgent
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
leave
ret 4

Function at 0x4040cc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push esi
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4040d8
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp + 0x10]
push 1
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop ebp
ret

Function at 0x404104
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x404110
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp + 0xc]
push 1
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop ebp
ret
Function at 0x404699
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push edi
mov ebx, 0x208
lea eax, [ebp - 0x414]
push ebx
xor edi, edi
push edi
push eax
call fcn.0049a3b0
push dword [ebp + 0xc]
mov esi, 0x104
mov dword [ebp - 4], edi
push str.__s____1
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0040450a
add esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x4caeb0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4047e9
push ebx
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0049a3b0
add esp, 0xc
mov dword [ebp + 0xc], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push edi
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4047e0
lea ecx, [ebp - 0x414]
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40475d
test dx, dx
je 0x404759
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40475d
add eax, 4
add ecx, 4
test dx, dx
jne 0x404737
mov eax, edi
jmp 0x404762
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4047e0
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
mov edi, str.Winamp_Back
push edi
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4047c6
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0049e71a
pop ecx
pop ecx
test eax, eax
jne 0x4047a5
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
call fcn.00404104
pop ecx
pop ecx
test eax, eax
jne 0x4047e0
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x4047e0
xor eax, eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 4]
call fcn.00404104
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8

Function at 0x4047f2
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
push eax
push eax
push 6
mov dword [ebp - 4], eax
call fcn.00402fe4
add esp, 0xc
test al, al
je 0x404838
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push str.CapabilitiesURLAssociations
call fcn.0040324d
add esp, 0xc
test eax, eax
jne 0x404838
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
leave
ret 0xc
Function at 0x40483e
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push SysReAllocStringLen
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4049a0
push 0x100
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.0049a3b0
add esp, 0xc
mov dword [ebp - 0xc], 0x80
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [ebp + 0x10]
test eax, eax
jne 0x404980
lea ecx, [ebp - 0x10c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x4048bf
sub ecx, edx
mov edx, ebx
sar ecx, 1
lea eax, [edx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 8]
jne 0x4048d7
sub edx, dword [ebp + 0x10]
sar edx, 1
cmp ecx, edx
jb 0x404901
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x4048f1
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.0049e664
add esp, 0xc
test eax, eax
jne 0x404980
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x80
push eax
lea eax, [ebp - 0x10c]
push eax
xor eax, eax
push eax
push eax
push str.Winamp_Back
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40495f
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00404104
pop ecx
pop ecx
test eax, eax
jne 0x404980
push str.Winamp_Back
push dword [ebp - 4]
call esi
jmp 0x404980
xor eax, eax
push eax
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
push dword [ebp + 0xc]
xor eax, eax
push SysReAllocStringLen
mov dword [ebp - 4], eax
call fcn.00404b98
pop ecx
pop ecx
cmp dword [ebp - 4], 0
je 0x40498b
push dword [ebp - 4]
call edi
cmp dword [ebp + 0x18], 0
jne 0x40499e
push ebx
push SysReAllocStringLen
call fcn.00404b98
pop ecx
pop ecx
xor ebx, ebx
push ebx
push ebx
push 6
call fcn.00402fe4
add esp, 0xc
test al, al
je 0x404a04
mov ebx, 0x200
xor eax, eax
push ebx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0049a3b0
push dword [ebp + 0x14]
lea eax, [ebp - 0x20c]
push 0x4caf10
push ebx
push eax
call fcn.0040433e
add esp, 0x1c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x404a04
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x14
Function at 0x404a5f
Capabilities:
Delete registry value
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SOFTWARENullsoftWinamp
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x404b8e
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edi
cmp word [eax], bx
je 0x404ab4
push eax
push str.regname
push dword [ebp - 4]
call fcn.004040cc
add esp, 0xc
jmp 0x404abe
push str.regname
push dword [ebp - 4]
call esi
mov edi, dword [ebp + 0x10]
cmp word [edi], bx
je 0x404b75
push 0x42
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.0049a3b0
add esp, 0xc
lea eax, [ebp - 0x46]
push edi
push 0x20
push eax
call fcn.004044cb
push 0x7e
pop eax
xor edi, edi
mov word [ebp - 0x48], ax
mov ax, word [ebp - 0x46]
inc edi
test ax, ax
je 0x404b5f
push 0x1b
lea esi, [ebp - 0x46]
movzx ecx, ax
pop ebx
push ecx
call fcn.0049e651
pop ecx
movzx ecx, ax
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x404b24
lea eax, [ecx - 0x41]
add eax, edi
push 0x1a
cdq
pop ecx
idiv ecx
add edx, 0x41
jmp 0x404b3b
lea eax, [ecx - 0x30]
cmp ax, 9
ja 0x404b40
lea eax, [ecx - 0x30]
add eax, ebx
push 0xa
cdq
pop ecx
idiv ecx
add edx, 0x61
mov word [esi], dx
jmp 0x404b4b
cmp ecx, 0x2d
jne 0x404b4b
push 0x2f
pop eax
mov word [esi], ax
inc edi
lea esi, [ebp - 0x48]
add ebx, 0x1b
lea esi, [esi + edi*2]
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x404b01
lea eax, [ebp - 0x48]
push eax
push str.regkey
push dword [ebp - 4]
call fcn.004040cc
add esp, 0xc
jmp 0x404b7f
push str.regkey
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
jmp 0x404b93
mov eax, 0x80004005
pop ebx
leave
ret 0xc

Function at 0x404b98
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x404c19
push ebx
push 0x800
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.0049a3b0
add esp, 0xc
mov ebx, 0x400
jmp 0x404bed
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 4]
call fcn.00404b98
pop ecx
pop ecx
test eax, eax
jne 0x404c03
push ebx
lea eax, [ebp - 0x804]
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x404bd8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop ebx
pop edi
leave
ret
Function at 0x405952
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4000
call fcn.004990f0
push ebx
push esi
push edi
mov ebx, 0x4000
lea eax, [ebp - 0x4000]
push ebx
xor edi, edi
mov esi, ecx
push edi
push eax
call fcn.0049a3b0
add esp, 0xc
lea eax, [ebp - 0x4000]
push dword [esi + 0x18]
push ebx
push eax
mov ebx, str.__emptee__
push ebx
push dword [ebp + 8]
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x4000]
push eax
push edi
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x405a0a
push edi
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x4000]
push eax
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
test ebx, ebx
je 0x405a0a
lea ecx, [ebx - 1]
push ecx
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
je 0x405a1c
push ebx
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x4000]
push eax
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x405a03
mov eax, esi
jmp 0x405a1c
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp + 0xc], edi
je 0x405a1a
push dword [ebp + 0xc]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40738e
Capabilities:
Create thread

Disassembly:
mov eax, 0x4c6c63
call fcn.0049911c
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x20]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.00406fb2
and dword [ebp - 4], 0
lea ecx, [edi + 0x64]
push 1
call fcn.00406fb2
lea ebx, [edi + 0xb4]
xor eax, eax
mov dword [ebx], vtable.Vector_void___32__1_.0
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov byte [edi + 0x60], al
lea eax, [edi + 0xc4]
push eax
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp + 0x24]
mov ecx, ebx
push dword [ebp + 0xc]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0xe4], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x50], esi
mov dword [edi + 0x58], eax
call fcn.00407867
xor esi, esi
push esi
push 0x400
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push eax
mov ecx, ebx
mov dword [edi + 0xe0], eax
call fcn.00407867
cmp dword [edi + 0x50], esi
je 0x407433
mov eax, dword [edi + 0x4c]
jmp 0x407436
mov eax, dword [ebp + 0x10]
push eax
mov ecx, ebx
call fcn.00407867
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
jmp 0x407451
push dword [esi]
mov ecx, ebx
call fcn.00407867
mov esi, dword [esi + 4]
test esi, esi
jne 0x407445
xor eax, eax
push eax
push eax
push edi
push 0x4078e9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0xdc], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x20