joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f93f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48f080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00461357
mov dword [ebp - 0x14], eax
cmp dword [0x49e274], esi
jne 0x46fa32
push 0x800
push esi
push 0x483fa0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x46f9bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x46fb12
push esi
push esi
push 0x483fa0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x46fb12
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46fb12
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x49e274], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x49e278], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x49e27c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49e284], eax
test eax, eax
je 0x46fa2f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49e280], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x46fa57
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46fa4a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x46fa6c
push 4
pop eax
jmp 0x46fb14
cmp dword [ebp - 0x14], esi
je 0x46fa6c
push dword [0x49e274]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x46fa51
mov eax, dword [0x49e280]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x46faca
cmp dword [0x49e284], edi
je 0x46faca
push eax
call ebx
push dword [0x49e284]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x46faca
test eax, eax
je 0x46faca
call ecx
test eax, eax
je 0x46fabf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x46fabf
test byte [ebp - 8], 1
jne 0x46faca
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x46fafa
mov eax, dword [0x49e278]
cmp eax, edi
je 0x46faf7
push eax
call ebx
test eax, eax
je 0x46faf7
call eax
mov esi, eax
test esi, esi
je 0x46faf7
mov eax, dword [0x49e27c]
cmp eax, edi
je 0x46faf7
push eax
call ebx
test eax, eax
je 0x46faf7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x49e274]
call ebx
test eax, eax
je 0x46fb12
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x46fb14
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046b276
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov eax, 0x42b038
lea ecx, [ebp - 0x24]
mov edx, dword [eax]
mov dword [ecx], edx
mov ax, word [eax + 4]
mov word [ecx + 4], ax
mov dword [0x5a8900], 0
mov eax, dword [ebp + 8]
mov dword [0x5aa0c0], eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.0041e7b0
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40105c
lea eax, [ebp - 0x24]
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], 0
jmp 0x40106b
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x14], eax
jle 0x401099
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
movsx eax, byte [eax + ecx]
cmp eax, 0x3d
jne 0x401094
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
mov byte [eax + ecx], 0x20
jmp 0x401068
push 0x100
call fcn.0041e731
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.00401476
add esp, 0xc
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00403a28
add esp, 8
push 0x5aa0e0
call fcn.00403890
add esp, 4
call fcn.00427034
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40110e
mov eax, dword [ebp + 8]
push eax
call fcn.00401d45
add esp, 4
push 0
call fcn.0041e65c
add esp, 4
cmp dword [0x5a8064], 0
je 0x401131
mov eax, dword [ebp + 8]
push eax
call fcn.00401d45
add esp, 4
push 0
call fcn.0041e65c
add esp, 4
call fcn.00403b23
test eax, eax
jne 0x401154
mov eax, dword [ebp + 8]
push eax
call fcn.00401d45
add esp, 4
push 0xffffffffffffffff
call fcn.0041e65c
add esp, 4
call fcn.00404a84
test eax, eax
je 0x40117a
cmp dword [0x5a839c], 0
jne 0x40117a
mov eax, dword [ebp + 8]
push eax
call fcn.00401228
add esp, 4
push 0x5a7f40
call fcn.00402090
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4011cf
xor eax, eax
mov al, byte [0x5a8921]
test eax, eax
je 0x4011cf
call fcn.00404a84
test eax, eax
je 0x4011be
push 0
mov eax, dword [0x5a8900]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00401b70
mov eax, dword [0x5a8900]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00405858
mov dword [ebp - 0x10], eax
jmp 0x4011eb
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0
je 0x40120d
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + eax*4 - 4]
push eax
call fcn.0041e600
add esp, 4
jmp 0x4011e8
mov eax, dword [ebp - 4]
push eax
call fcn.0041e600
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x401221
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x401c46
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
cmp dword [0x5a839c], 0
jne 0x401d40
call fcn.00404a84
test eax, eax
je 0x401c77
push 0
mov eax, dword [0x5a8900]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
jmp 0x401d11
push 0x42b304
push 0x5a8700
call fcn.0041eaec
add esp, 8
push 0
push 0x5a8700
mov eax, dword [ebp + 8]
push eax
mov eax, dword [0x5a8900]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401d34
push 0x42b33c
push 0x5a8700
call fcn.0041eaec
add esp, 8
push 0
push 0x5a8700
mov eax, dword [ebp + 8]
push eax
mov eax, dword [0x5a8900]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401d34
push 0x42b374
push 0x5a8700
call fcn.0041eaec
add esp, 8
push 0
push 0x5a8700
mov eax, dword [ebp + 8]
push eax
mov eax, dword [0x5a8900]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401d34
cmp dword [ebp - 4], 0
je 0x401cde
cmp dword [ebp - 4], 1
je 0x401cb0
cmp dword [ebp - 4], 2
je 0x401c82
jmp 0x401d34
mov eax, dword [0x5a8900]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407ddf
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
call fcn.00407757
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
jmp 0x407e2c
push 0x479050
lea eax, [ebp - 0xc]
push eax
call fcn.0041e930
add esp, 8
jmp 0x407e45
push 0x479054
lea eax, [ebp - 0xc]
push eax
call fcn.0041e930
add esp, 8
jmp 0x407e45
cmp dword [ebp - 0x58], 1
je 0x407dfb
cmp dword [ebp - 0x58], 2
je 0x407e11
jmp 0x407e45
push 0x479058
lea eax, [ebp - 0x50]
push eax
call fcn.0041e930
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x407ee6
cmp dword [ebp - 0x10], 2
jne 0x407ecf
lea eax, [ebp - 0xc]
push eax
call fcn.0041e7b0
add esp, 4
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x407eca
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407eed
jmp 0x407ee6
push 0x10006
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407eed
xor eax, eax
jmp 0x407eed
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4080d1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40814e
cmp dword [ebp - 8], 2
jne 0x40812a
push 0x479068
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call fcn.0041e930
add esp, 8
xor eax, eax
jmp 0x408261
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10001
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x408261
mov dword [ebp - 8], 0xea
mov dword [ebp - 0xc], 0x80
jmp 0x408168
add dword [ebp - 0xc], 0x80
cmp dword [ebp - 8], 0xea
jne 0x4081c5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xea
jne 0x4081c0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call fcn.0041f054
add esp, 8
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x408161
cmp dword [ebp - 8], 0
je 0x40821f
cmp dword [ebp - 8], 2
jne 0x4081f1
push 0x47906c
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
call fcn.0041e930
add esp, 8
jmp 0x40821f
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10006
call fcn.00406ccc
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x408261
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40825a
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x408261
xor eax, eax
jmp 0x408261
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408266
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4082ba
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10001
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x408353
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x408311
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x408353
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40834c
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x408353
xor eax, eax
jmp 0x408353
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408358
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4083ac
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10001
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40844b
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x408409
cmp dword [ebp - 4], 2
je 0x408409
cmp dword [ebp - 4], 3
je 0x408409
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10004
call fcn.00406ccc
add esp, 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x40844b
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x408444
push 0x2002007
call fcn.00406c68
add esp, 4
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40844b
xor eax, eax
jmp 0x40844b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408450
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2f28
call fcn.0041ec60
push ebx
push esi
push edi
mov dword [ebp - 8], 0x1388
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x818], 0
lea eax, [ebp - 0x814]
push eax
push 0xf003f
push 0
push 0x479070
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x4084d0
push 0x10001
call fcn.00406ccc
add esp, 4
push 0x2002012
call fcn.00406c68
add esp, 4
mov eax, 0xffffffff
jmp 0x4086cb
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2f28]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x4790a8
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x408537
push 0x10006
call fcn.00406ccc
add esp, 4
push 0x2002012
call fcn.00406c68
add esp, 4
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x4086cb
mov eax, dword [ebp - 0x810]
xor ecx, ecx
mov cl, byte [ebp + eax - 0x2f28]
test ecx, ecx
je 0x408609
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
lea eax, [ebp - 0x808]
push eax
call fcn.0041e930
add esp, 8
lea eax, [ebp - 0x808]
push eax
call fcn.0041f174
add esp, 4
push 0x4790ac
lea eax, [ebp - 0x808]
push eax
call fcn.0041ef50
add esp, 8
test eax, eax
jne 0x4085df
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041e930
add esp, 8
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041e7b0
add esp, 4
mov ecx, dword [ebp - 0x818]
add ecx, eax
inc ecx
mov dword [ebp - 0x818], ecx
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
call fcn.0041e7b0
add esp, 4
mov ecx, dword [ebp - 0x810]
add ecx, eax
inc ecx
mov dword [ebp - 0x810], ecx
jmp 0x408537
mov eax, dword [ebp - 0x818]
mov byte [ebp + eax - 0x1ba0], 0
mov eax, dword [ebp - 0x818]
inc eax
push eax
lea eax, [ebp - 0x1ba0]
push eax
push 7
push 0
push 0x4790b8
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x408680
push 0x10006
call fcn.00406ccc
add esp, 4
push 0x2002012
call fcn.00406c68
add esp, 4
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x4086cb
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x4086c4
push 0x10002
call fcn.00406ccc
add esp, 4
push 0x2002012
call fcn.00406c68
add esp, 4
mov eax, 0xffffffff
jmp 0x4086cb
xor eax, eax
jmp 0x4086cb
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4086d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2f28
call fcn.0041ec60
push ebx
push esi
push edi
mov dword [ebp - 8], 0x1388
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x818], 0
lea eax, [ebp - 0x814]
push eax
push 0xf003f
push 0
push 0x4790bc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x408750
push 0x10001
call fcn.00406ccc
add esp, 4
push 0x2002011
call fcn.00406c68
add esp, 4
mov eax, 0xffffffff
jmp 0x408961
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2f28]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x4790f4
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x40878d
mov byte [ebp - 0x2f28], 0
mov eax, dword [ebp - 0x810]
xor ecx, ecx
mov cl, byte [ebp + eax - 0x2f28]
test ecx, ecx
je 0x40885f
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
lea eax, [ebp - 0x808]
push eax
call fcn.0041e930
add esp, 8
lea eax, [ebp - 0x808]
push eax
call fcn.0041f174
add esp, 4
push 0x4790f8
lea eax, [ebp - 0x808]
push eax
call fcn.0041ef50
add esp, 8
test eax, eax
jne 0x408835
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041e930
add esp, 8
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041e7b0
add esp, 4
mov ecx, dword [ebp - 0x818]
add ecx, eax
inc ecx
mov dword [ebp - 0x818], ecx
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
call fcn.0041e7b0
add esp, 4
mov ecx, dword [ebp - 0x810]
add ecx, eax
inc ecx
mov dword [ebp - 0x810], ecx
jmp 0x40878d
push 0x479104
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041e930
add esp, 8
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041e7b0
add esp, 4
mov ecx, dword [ebp - 0x818]
add ecx, eax
inc ecx
mov dword [ebp - 0x818], ecx
mov eax, dword [ebp - 0x818]
mov byte [ebp + eax - 0x1ba0], 0
mov eax, dword [ebp - 0x818]
inc eax
push eax
lea eax, [ebp - 0x1ba0]
push eax
push 7
push 0
push 0x479110
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x408916
push 0x10006
call fcn.00406ccc
add esp, 4
push 0x2002011
call fcn.00406c68
add esp, 4
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x408961
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x40895a
push 0x10002
call fcn.00406ccc
add esp, 4
push 0x2002011
call fcn.00406c68
add esp, 4
mov eax, 0xffffffff
jmp 0x408961
xor eax, eax
jmp 0x408961
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408ac1
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x408ae2
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408ae7
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x408b1b
push 0x20
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 4]
jmp 0x408b23
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408fcd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x200
push 0x5afb80
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4a4fd0
push 0x5afb80
call fcn.0041e940
add esp, 8
mov dword [0x5ac750], 0
jmp 0x40900d
inc dword [0x5ac750]
cmp dword [0x5ac750], 0x3000
jge 0x40903a
mov eax, dword [0x5ac750]
mov byte [eax + 0x5affc0], 0
mov eax, dword [0x5ac750]
mov byte [eax + 0x5ac760], 0
jmp 0x409007
lea eax, [ebp - 4]
push eax
push 0x5ac760
push 0x5afb80
call fcn.0040c4c3
add esp, 0xc
cmp eax, 0xffffffff
jne 0x409063
mov eax, 0xffffffff
jmp 0x409271
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x5ac760
push 0x4a4fdc
call fcn.00409e88
add esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x409091
xor eax, eax
jmp 0x409271
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x5ac760
push 0x4a4fe8
call fcn.00409e88
add esp, 0x10
test eax, eax
jne 0x40918a
mov ebx, dword [ebp - 4]
and ebx, 0xffff
mov eax, dword [ebp - 0xc]
and eax, 0xffff
sub ebx, eax
push 0x4a4ff0
call fcn.0041e7b0
add esp, 4
add ebx, eax
push ebx
push 0x4a4ffc
call fcn.0041e7b0
add esp, 4
mov ecx, dword [ebp - 0x1c]
add ecx, eax
push ecx
push 0x5affc0
call fcn.0041f220
add esp, 0xc
push 0x4a5008
call fcn.0041e7b0
add esp, 4
mov ecx, dword [ebp - 4]
and ecx, 0xffff
mov edx, dword [ebp - 0xc]
and edx, 0xffff
sub ecx, edx
add eax, ecx
push eax
push 0x5affc0
push 0x4a5014
call fcn.0041e7b0
add esp, 4
mov ecx, dword [ebp - 0x1c]
add ecx, eax
push ecx
call fcn.0041f220
add esp, 0xc
push 0x4a501c
call fcn.0041e7b0
add esp, 4
push eax
push 0x4a5024
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0041f220
add esp, 0xc
push 0x4a502c
call fcn.0041e7b0
add esp, 4
mov ecx, dword [ebp - 4]
and ecx, 0xffff
lea ebx, [ecx + eax]
push 0x4a5034
call fcn.0041e7b0
add esp, 4
sub ebx, eax
mov word [ebp - 4], bx
jmp 0x409250
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp - 0xc]
and ecx, 0xffff
sub eax, ecx
dec eax
push eax
mov eax, dword [ebp - 0x1c]
inc eax
push eax
push 0x4a5040
call fcn.00409e88
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x409241
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp - 0xc]
and ecx, 0xffff
sub eax, ecx
mov ecx, dword [ebp - 8]
and ecx, 0xffff
sub eax, ecx
dec eax
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0x5affc0
call fcn.0041f220
add esp, 0xc
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp - 0xc]
and ecx, 0xffff
sub eax, ecx
mov ecx, dword [ebp - 8]
and ecx, 0xffff
sub eax, ecx
dec eax
push eax
push 0x5affc0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0041f220
add esp, 0xc
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp - 8]
and ecx, 0xffff
inc ecx
sub eax, ecx
mov word [ebp - 4], ax
jmp 0x409250
mov eax, dword [ebp - 0xc]
and eax, 0xffff
sub eax, 2
mov word [ebp - 4], ax
lea eax, [ebp - 4]
push eax
push 0x5ac760
push 0x5afb80
call fcn.0040c60c
add esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x409271
pop edi
pop esi
pop ebx
leave
ret