joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451138
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x451184
mov eax, esi
call fcn.00439014
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x451184
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x451184
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x4512c8
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x4511c4
cmp eax, 0x108
ja 0x4511c4
mov eax, esi
call fcn.00439014
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4512bf
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xec]
test al, al
jne 0x4512c8
jmp 0x4512bf
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x4512a6
cmp eax, 0x20a
ja 0x4512a6
test byte [esi + 0x50], 0x80
jne 0x4511f6
sub eax, 0x203
je 0x4511f3
sub eax, 3
je 0x4511f3
sub eax, 3
jne 0x4511f6
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x45120a
dec eax
je 0x45121f
dec eax
je 0x45123f
dec eax
je 0x45121f
jmp 0x451246
mov ecx, ebx
mov eax, dword [0x48f3f4]
mov eax, dword [eax]
mov edx, esi
call fcn.0044256c
jmp 0x4512bf
cmp byte [esi + 0x5d], 1
jne 0x451235
mov eax, esi
mov si, 0xffed
call fcn.00403920
jmp 0x4512c8
or word [esi + 0x54], 1
jmp 0x4512bf
and word [esi + 0x54], 0xfffe
jmp 0x4512bf
mov eax, dword [0x490bd4]
cmp byte [eax + 0x20], 0
je 0x4512bf
mov eax, dword [0x490bd4]
cmp dword [eax + 0x1c], 0
je 0x4512bf
mov eax, dword [ebx]
mov edx, dword [0x490bd4]
cmp eax, dword [edx + 0x1c]
jne 0x4512bf
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00438f58
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403920
jmp 0x4512c8
mov eax, dword [ebx]
cmp eax, 0xb00b
jne 0x4512bf
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0044fa4c
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x454768
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x454784
cmp dword [esi + 4], 0
je 0x4547b1
test byte [ebx + 0x55], 1
jne 0x4547a3
mov eax, ebx
call fcn.004533c0
test eax, eax
jne 0x4547a3
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4548c1
mov edx, esi
mov eax, ebx
call fcn.00454288
jmp 0x4548c1
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4548ba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00456538
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0045106c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00454768
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00456538
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4548c1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ade8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x48f5bc]
cmp byte [eax + 0xc], 0
je 0x45af55
push 0x8000
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45af4e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x490c28], 0
jne 0x45ae3c
push 0x45af5c
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
push 0x45af64
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x490c28], eax
cmp dword [0x48ecdc], 0
jne 0x45af37
push 0x45af74
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x48ecdc], eax
cmp dword [0x48ecdc], 0
je 0x45af37
push 0x45af80
mov eax, dword [0x48ecdc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x490c2c], eax
push 0x45af90
mov eax, dword [0x48ecdc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x490c30], eax
push 0x45afa4
mov eax, dword [0x48ecdc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x490c34], eax
push 0x45afbc
mov eax, dword [0x48ecdc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x490c38], eax
push 0x45afd4
mov eax, dword [0x48ecdc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x490c3c], eax
push 0x45afe8
mov eax, dword [0x48ecdc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x490c40], eax
push 0x45b000
mov eax, dword [0x48ecdc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x490c44], eax
push 0x45b018
mov eax, dword [0x48ecdc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x490c48], eax
push 0x45b034
mov eax, dword [0x48ecdc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x490c4c], eax
push 0x45b040
mov eax, dword [0x48ecdc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x490c50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45af55
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x45b7a4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x45b7f5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x45b7dc
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x45b7cc
jmp 0x45b7f5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x45b7dd
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47e674
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
test byte [ebx + 0x1c], 0x10
je 0x47e7ca
cmp dword [ebx + 0x30], 0
je 0x47e7ca
mov eax, dword [ebx + 0x30]
call fcn.0040366c
mov edx, 0x47e7e0
call fcn.0045ebe0
test al, al
je 0x47e7ca
mov edi, dword [ebx + 0x30]
mov eax, dword [esi]
sub eax, 0x201
je 0x47e6fe
sub eax, 2
je 0x47e762
dec eax
jne 0x47e7bf
mov eax, dword [esi + 8]
call fcn.004076f8
mov edx, eax
add dx, word [ebx + 0x44]
mov ax, word [esi + 8]
add ax, word [ebx + 0x40]
call fcn.004077a4
push eax
mov ecx, dword [esi + 4]
mov edx, 0x201
mov eax, edi
call fcn.0045106c
mov edx, esi
mov eax, edi
mov ecx, dword [eax]
call dword [ecx - 0x14]
jmp 0x47e7d3
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x47e718
mov edx, esi
mov eax, ebx
call fcn.00453fe8
jmp 0x47e7d3
mov edx, esi
mov eax, edi
mov ecx, dword [eax]
call dword [ecx - 0x14]
mov eax, dword [esi + 8]
call fcn.004076f8
mov edx, eax
add dx, word [ebx + 0x44]
mov ax, word [esi + 8]
add ax, word [ebx + 0x40]
call fcn.004077a4
push eax
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov eax, edi
call fcn.0045106c
mov eax, edi
call fcn.00456538
mov ebx, eax
call sub.user32.dll_GetCapture
cmp ebx, eax
jne 0x47e7d3
call sub.user32.dll_ReleaseCapture
jmp 0x47e7d3
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x47e779
mov edx, esi
mov eax, ebx
call fcn.00453fe8
jmp 0x47e7d3
mov eax, dword [esi + 8]
call fcn.004076f8
mov edx, eax
add dx, word [ebx + 0x44]
mov ax, word [esi + 8]
add ax, word [ebx + 0x40]
call fcn.004077a4
push eax
mov ecx, dword [esi + 4]
mov edx, 0x201
mov eax, edi
call fcn.0045106c
mov edx, esi
mov eax, edi
mov ecx, dword [eax]
call dword [ecx - 0x14]
mov eax, dword [esi + 8]
push eax
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov eax, edi
call fcn.0045106c
jmp 0x47e7d3
mov edx, esi
mov eax, ebx
call fcn.00453fe8
jmp 0x47e7d3
mov edx, esi
mov eax, ebx
call fcn.00453fe8
pop edi
pop esi
pop ebx
ret
Function at 0x40852c
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd4
mov esi, edx
mov edi, eax
push 0x200
push 8
call fcn.00408180
push eax
call sub.ntdll.dll_RtlAllocateHeap
mov ebx, eax
push edi
push ebx
call sub.ntdll.dll_wcscpy
add esp, 8
push ebx
call sub.ntdll.dll_wcslen
pop ecx
dec eax
test eax, eax
jle 0x408574
cmp word [ebx + eax*2], 0x5c
jne 0x40856f
mov word [ebx + eax*2], 0
jmp 0x408574
dec eax
test eax, eax
jg 0x408560
test eax, eax
jg 0x40857f
xor ebx, ebx
jmp 0x408605
mov edx, esi
mov eax, ebx
call fcn.0040852c
push edi
lea eax, [esp + 4]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 8]
lea eax, [esp + 0x1c]
mov ecx, 0x40
call fcn.00407d20
push 0
push 0
push 1
push 3
push 3
push esi
push 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x34]
push eax
push 0x100021
lea eax, [esp + 0x30]
push eax
call sub.ntdll.dll_NtCreateFile
push ebx
push 1
call fcn.00408180
push eax
call sub.ntdll.dll_RtlFreeHeap
cmp dword [esp + 8], 0
je 0x4085ee
mov eax, dword [esp + 8]
push eax
call sub.ntdll.dll_NtClose
cmp dword [esp + 8], 0
setne bl
test bl, bl
jne 0x408605
push 0x408610
call sub.ntdll.dll_DbgPrint
pop ecx
mov eax, ebx
add esp, 0x2c
pop edi
pop esi
pop ebx
ret

Function at 0x408634
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov esi, 0xc0000023
xor ebx, ebx
mov ebp, 0x10
mov eax, ebp
call fcn.00408b1c
mov edi, eax
cmp esi, 0xc0000023
jne 0x4086b4
lea eax, [esp + 0xc]
push eax
push ebp
push edi
push 2
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.ntdll.dll_NtQueryValueKey
mov esi, eax
cmp esi, 0xc0000023
jne 0x4086a7
test edi, edi
je 0x408690
mov eax, edi
call fcn.00408b30
mov eax, dword [esp + 0xc]
call fcn.00408b1c
mov edi, eax
mov ebp, dword [esp + 0xc]
test edi, edi
jne 0x4086a7
xor ebx, ebx
jmp 0x4086ef
test esi, esi
sete bl
cmp esi, 0xc0000023
je 0x408663
test bl, bl
jne 0x4086c5
test edi, edi
je 0x4086ef
mov eax, edi
call fcn.00408b30
jmp 0x4086ef
cmp dword [edi + 4], 4
je 0x4086d4
mov eax, edi
call fcn.00408b30
jmp 0x4086ef
mov eax, dword [edi + 8]
push eax
lea eax, [edi + 0xc]
push eax
mov eax, dword [esp + 0x10]
push eax
call fcn.00407f80
mov eax, edi
call fcn.00408b30
mov bl, 1
mov eax, ebx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4086fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov edi, 0xc0000023
xor ebx, ebx
mov ebp, 0xc
mov eax, ebp
call fcn.00408b1c
mov esi, eax
cmp edi, 0xc0000023
jne 0x408789
lea eax, [esp + 0xc]
push eax
push ebp
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.ntdll.dll_NtQueryValueKey
mov edi, eax
cmp edi, 0xc0000023
je 0x408755
cmp edi, 0x80000005
jne 0x40877c
test esi, esi
je 0x408760
mov eax, esi
call fcn.00408b30
mov eax, dword [esp + 0xc]
call fcn.00408b1c
mov esi, eax
mov ebp, dword [esp + 0xc]
mov edi, 0xc0000023
test esi, esi
jne 0x40877c
xor ebx, ebx
jmp 0x4087d6
test edi, edi
sete bl
cmp edi, 0xc0000023
je 0x40872b
test bl, bl
jne 0x40879a
test esi, esi
je 0x4087d6
mov eax, esi
call fcn.00408b30
jmp 0x4087d6
mov eax, dword [esi + 4]
cmp eax, 1
je 0x4087bb
cmp eax, 2
je 0x4087bb
cmp dword [esi + 8], 0
jne 0x4087bb
cmp eax, 7
je 0x4087bb
mov eax, esi
call fcn.00408b30
jmp 0x4087d6
mov eax, dword [esi + 8]
push eax
lea eax, [esi + 0xc]
push eax
mov eax, dword [esp + 0x10]
push eax
call fcn.00407f80
mov eax, esi
call fcn.00408b30
mov bl, 1
mov eax, ebx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4087e0
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov dword [esp], ecx
mov esi, edx
push eax
lea eax, [esp + 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
mov ecx, 0x40
call fcn.00407d20
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0x2001f
lea eax, [esp + 0x1c]
push eax
call sub.ntdll.dll_NtCreateKey
mov ebx, eax
test ebx, ebx
jne 0x40885e
push esi
lea eax, [esp + 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_NtSetValueKey
mov eax, dword [esp + 4]
push eax
call sub.ntdll.dll_NtClose
jmp 0x408878
mov eax, 0x408880
xor edx, edx
call fcn.004081ec
mov cl, 1
mov edx, 0x10
mov eax, ebx
call fcn.004083b4
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x4088ac
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov esi, ecx
mov edi, edx
xor edx, edx
mov dword [esi], edx
xor ebx, ebx
push eax
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0xc]
lea eax, [esp + 0x14]
mov ecx, 0x40
call fcn.00407d20
lea eax, [esp + 0xc]
push eax
push 0x20019
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_NtOpenKey
test eax, eax
jne 0x408930
push edi
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
mov ecx, esi
lea edx, [esp + 4]
mov eax, dword [esp]
call fcn.00408634
test al, al
je 0x408916
mov bl, 1
jmp 0x408927
push edi
mov eax, dword [esi]
push eax
push 0x40893c
call sub.ntdll.dll_DbgPrint
add esp, 0xc
mov eax, dword [esp]
push eax
call sub.ntdll.dll_NtClose
mov eax, ebx
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x408968
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov edi, ecx
mov esi, edx
xor ebx, ebx
push eax
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0xc]
lea eax, [esp + 0x14]
mov ecx, 0x40
call fcn.00407d20
lea eax, [esp + 0xc]
push eax
push 0x20019
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_NtOpenKey
test eax, eax
jne 0x4089d7
push esi
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
lea edx, [esp + 4]
mov ecx, edi
mov eax, dword [esp]
call fcn.004086fc
test al, al
je 0x4089cc
mov bl, 1
mov eax, dword [esp]
push eax
call sub.ntdll.dll_NtClose
jmp 0x4089e5
push eax
push 0x4089f0
call sub.ntdll.dll_DbgPrint
add esp, 8
mov eax, ebx
add esp, 0x24
pop edi
pop esi
pop ebx
ret

Function at 0x408a10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov esi, ecx
mov ebx, edx
push eax
lea eax, [ebp - 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x2c]
mov ecx, 0x40
call fcn.00407d20
lea eax, [ebp - 0x2c]
push eax
push 0x20006
lea eax, [ebp - 4]
push eax
call sub.ntdll.dll_NtOpenKey
test eax, eax
jne 0x408aa9
push ebx
lea eax, [ebp - 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push esi
lea eax, [ebp - 0x14]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
cmp byte [ebp + 8], 0
jne 0x408a86
movzx eax, word [ebp - 0x12]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 1
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ntdll.dll_NtSetValueKey
jmp 0x408aa0
movzx eax, word [ebp - 0x12]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 2
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.ntdll.dll_NtSetValueKey
mov eax, dword [ebp - 4]
push eax
call sub.ntdll.dll_NtClose
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408ab4
Capabilities:
Delete registry value

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, edx
push eax
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0xc]
lea eax, [esp + 0x14]
mov ecx, 0x40
call fcn.00407d20
lea eax, [esp + 0xc]
push eax
push 0x20006
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_NtOpenKey
test eax, eax
jne 0x408b16
push ebx
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.ntdll.dll_NtDeleteValueKey
mov eax, dword [esp]
push eax
call sub.ntdll.dll_NtClose
add esp, 0x24
pop ebx
ret
Function at 0x408b88
Capabilities:
Get file attributes

Disassembly:
add esp, 0xffffffa0
mov dword [esp], 0
mov dword [esp + 4], 0
push eax
lea eax, [esp + 0x10]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0x14]
lea eax, [esp + 0x50]
mov ecx, 0x40
call fcn.00407d20
push 0x28
lea eax, [esp + 0x24]
push eax
call sub.ntdll.dll_RtlZeroMemory
push 0x20
push 1
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x54]
push eax
push 0x120089
lea eax, [esp + 0x1c]
push eax
call sub.ntdll.dll_NtOpenFile
test eax, eax
jne 0x408c1d
push 4
push 0x28
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_NtQueryInformationFile
test eax, eax
jne 0x408c13
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
push eax
call sub.ntdll.dll_NtClose
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0x60
ret

Function at 0x408c2c
Capabilities:
Print debug messages
Set file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa8
mov edi, edx
push eax
lea eax, [esp + 4]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 8]
lea eax, [esp + 0x1c]
mov ecx, 0x40
call fcn.00407d20
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x18]
push eax
call sub.ntdll.dll_NtQueryAttributesFile
mov esi, eax
test esi, esi
je 0x408c80
xor ebx, ebx
push esi
push 0x408d20
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x408d16
xor eax, eax
mov dword [esp + 0x10], eax
push 0
push 0
push 1
push 1
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x34]
push eax
push 0x1f01ff
lea eax, [esp + 0x38]
push eax
call sub.ntdll.dll_NtCreateFile
mov esi, eax
test esi, esi
jne 0x408cff
push edi
call sub.ntdll.dll_wcslen
pop ecx
mov esi, eax
add esi, esi
lea ebp, [esi + 0x10]
mov eax, ebp
call fcn.00408b1c
mov ebx, eax
mov byte [ebx], 0
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], esi
push esi
push edi
lea eax, [ebx + 0xc]
push eax
call fcn.00407f80
push 0xa
push ebp
push ebx
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push eax
call sub.ntdll.dll_NtSetInformationFile
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call sub.ntdll.dll_NtClose
test esi, esi
sete bl
test bl, bl
jne 0x408d16
push esi
push 0x408d40
call sub.ntdll.dll_DbgPrint
add esp, 8
mov eax, ebx
add esp, 0x58
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x408dbc
Capabilities:
Get file attributes
Print debug messages
Set file attributes

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffa8
mov byte [esp], cl
mov edi, edx
xor ebx, ebx
push eax
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0xc]
lea eax, [esp + 0x20]
mov ecx, 0x40
call fcn.00407d20
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x1c]
push eax
call sub.ntdll.dll_NtQueryAttributesFile
mov esi, eax
test esi, esi
jne 0x408eb0
cmp byte [esp], 0
je 0x408e10
mov eax, 1
jmp 0x408e12
xor eax, eax
xor edx, edx
mov dword [esp + 0x14], edx
push 0
push 0
push eax
push 1
push 7
push 0
push 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x38]
push eax
push 0x180
lea eax, [esp + 0x3c]
push eax
call sub.ntdll.dll_NtCreateFile
mov esi, eax
mov eax, esi
call fcn.00407d14
test eax, eax
je 0x408e91
push 4
push 0x28
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x24]
push eax
call sub.ntdll.dll_NtQueryInformationFile
mov esi, eax
test esi, esi
jne 0x408e87
or dword [esp + 0x50], edi
push 4
push 0x28
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x24]
push eax
call sub.ntdll.dll_NtSetInformationFile
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
call sub.ntdll.dll_NtClose
mov eax, esi
call fcn.00407d14
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x408eb0
push esi
push 0x408ebc
call sub.ntdll.dll_DbgPrint
add esp, 8
mov eax, ebx
add esp, 0x58
pop edi
pop esi
pop ebx
ret

Function at 0x4090d4
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa0
mov ebp, edx
mov edi, eax
xor ebx, ebx
push 0x4091cc
lea eax, [esp + 4]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 8]
lea eax, [esp + 0x20]
mov ecx, 0x40
call fcn.00407d20
lea eax, [esp + 0x18]
push eax
push 0x2000000
lea eax, [esp + 0x18]
push eax
call sub.ntdll.dll_NtOpenKey
mov esi, eax
mov eax, esi
call fcn.00407d14
test eax, eax
jne 0x40913a
push esi
push 0x4091f0
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x4091c0
push edi
lea eax, [esp + 4]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
mov eax, dword [esp + 0x10]
push eax
push 0
lea edx, [esp + 8]
lea eax, [esp + 0x38]
mov ecx, 0x40
call fcn.00407d20
push ebp
lea eax, [esp + 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0x10]
lea eax, [esp + 0x50]
mov ecx, 0x40
call fcn.00407d20
lea eax, [esp + 0x14]
push eax
push 0
push 1
push 0x12
call sub.ntdll.dll_RtlAdjustPrivilege
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x34]
push eax
call sub.ntdll.dll_NtLoadKey
mov esi, eax
test esi, esi
je 0x4091b4
push esi
push 0x409208
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x4091b6
mov bl, 1
mov eax, dword [esp + 0x10]
push eax
call sub.ntdll.dll_NtClose
mov eax, ebx
add esp, 0x60
pop ebp
pop edi
pop esi
pop ebx
ret