joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x970]
add eax, 1
mov dword [ebp - 0x970], eax
mov ecx, dword [ebp - 0x96c]
mov edx, dword [ebp - 0x970]
cmp edx, dword [ecx + 0x18]
jae 0x417711
mov eax, dword [ebp - 0x970]
mov ecx, dword [ebp - 0x1f68]
mov edx, dword [ebp - 0x3cc]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x974], edx
xchg ebp, eax
invalid
idiv bh
dec dword [ebx - 0x96f7b]
dec dword [ebx - 0x1f6b73]
dec dword [edi]
mov bh, 0x14
inc ecx
mov eax, dword [ebp - 0x1f70]
mov ecx, dword [ebp - 0x3cc]
inc dword [ebx]
or al, 0x90
mov dword [ebp - 0x1f74], ecx
mov dword [ebp - 0x1d8], 0
jmp 0x417575
mov edx, dword [ebp - 0x1d8]
add edx, 1
mov dword [ebp - 0x1d8], edx
xchg ebp, eax
sub dh, bh
invalid
invalid
mov eax, dword [ebp - 0x974]
add eax, dword [ebp - 0x1d8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x417627
mov edx, dword [ebp - 0x1d8]
movsx eax, byte [ebp + edx - 0xafc]
test eax, eax
je 0x417627
push eax
add eax, 0x5d77
jmp 0x4175af
and eax, 0x17347
or eax, 0x15192
pop eax
push edx
push ebx
add esp, 4
add edx, 0x6c36
or edx, 0x11bb6
xor edx, 0x7605
pop edx
mov ecx, dword [ebp - 0x974]
add ecx, dword [ebp - 0x1d8]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1d8]
movsx ecx, byte [ebp + eax - 0xafc]
cmp edx, ecx
je 0x417619
mov edx, dword [ebp - 0x974]
add edx, dword [ebp - 0x1d8]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1d8]
movsx edx, byte [ebp + ecx - 0xafc]
cmp eax, edx
jne 0x417620
jmp 0x417566
jmp 0x417627
push ecx
push edx
add esp, 4
jmp 0x417631
and ecx, 0x12e1b
call 0x417647
add byte [edx], dh
xor eax, 0x43473e3b
inc esi
inc ebx
inc eax
cmp eax, dword [ebx - 0x167efb3c]
retf
movsx ecx, byte [ebp + eax - 0xafc]
or ecx, 0x20
cmp edx, ecx
jge 0x4176eb
mov dword [ebp - 0x1008], 0xffffffff
jmp 0x4176f5
mov dword [ebp - 0x1008], 1
cmp dword [ebp - 0x1008], 0
jne 0x41770c
mov edx, dword [ebp - 0x1f74]
mov dword [ebp - 0x4c8], edx
jmp 0x41771d
jmp 0x4174f6
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x4c8], eax
Function at 0x417647
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x970]
add eax, 1
mov dword [ebp - 0x970], eax
mov ecx, dword [ebp - 0x96c]
mov edx, dword [ebp - 0x970]
cmp edx, dword [ecx + 0x18]
jae 0x417711
mov eax, dword [ebp - 0x970]
mov ecx, dword [ebp - 0x1f68]
mov edx, dword [ebp - 0x3cc]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x974], edx
xchg ebp, eax
invalid
idiv bh
dec dword [ebx - 0x96f7b]
dec dword [ebx - 0x1f6b73]
dec dword [edi]
mov bh, 0x14
inc ecx
mov eax, dword [ebp - 0x1f70]
mov ecx, dword [ebp - 0x3cc]
inc dword [ebx]
or al, 0x90
mov dword [ebp - 0x1f74], ecx
mov dword [ebp - 0x1d8], 0
jmp 0x417575
mov edx, dword [ebp - 0x1d8]
add edx, 1
mov dword [ebp - 0x1d8], edx
xchg ebp, eax
sub dh, bh
invalid
invalid
mov eax, dword [ebp - 0x974]
add eax, dword [ebp - 0x1d8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x417627
mov edx, dword [ebp - 0x1d8]
movsx eax, byte [ebp + edx - 0xafc]
test eax, eax
je 0x417627
push eax
add eax, 0x5d77
jmp 0x4175af
and eax, 0x17347
or eax, 0x15192
pop eax
push edx
push ebx
add esp, 4
add edx, 0x6c36
or edx, 0x11bb6
xor edx, 0x7605
pop edx
mov ecx, dword [ebp - 0x974]
add ecx, dword [ebp - 0x1d8]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1d8]
movsx ecx, byte [ebp + eax - 0xafc]
cmp edx, ecx
je 0x417619
mov edx, dword [ebp - 0x974]
add edx, dword [ebp - 0x1d8]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1d8]
movsx edx, byte [ebp + ecx - 0xafc]
cmp eax, edx
jne 0x417620
jmp 0x417566
jmp 0x417627
push ecx
push edx
add esp, 4
jmp 0x417631
and ecx, 0x12e1b
call 0x417647
add byte [edx], dh
xor eax, 0x43473e3b
inc esi
inc ebx
inc eax
cmp eax, dword [ebx - 0x167efb3c]
retf
movsx ecx, byte [ebp + eax - 0xafc]
or ecx, 0x20
cmp edx, ecx
jge 0x4176eb
mov dword [ebp - 0x1008], 0xffffffff
jmp 0x4176f5
mov dword [ebp - 0x1008], 1
cmp dword [ebp - 0x1008], 0
jne 0x41770c
mov edx, dword [ebp - 0x1f74]
mov dword [ebp - 0x4c8], edx
jmp 0x41771d
jmp 0x4174f6
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x4c8], eax

Function at 0x4176a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
or edi, 0x18bb
xor edi, 0x11e19
xor edi, 0x164b9
pop edi
mov ecx, dword [ebp - 0x974]
add ecx, dword [ebp - 0x1d8]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1d8]
Function at 0x4176d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x970]
add eax, 1
mov dword [ebp - 0x970], eax
mov ecx, dword [ebp - 0x96c]
mov edx, dword [ebp - 0x970]
cmp edx, dword [ecx + 0x18]
jae 0x417711
mov eax, dword [ebp - 0x970]
mov ecx, dword [ebp - 0x1f68]
mov edx, dword [ebp - 0x3cc]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x974], edx
xchg ebp, eax
invalid
idiv bh
dec dword [ebx - 0x96f7b]
dec dword [ebx - 0x1f6b73]
dec dword [edi]
mov bh, 0x14
inc ecx
mov eax, dword [ebp - 0x1f70]
mov ecx, dword [ebp - 0x3cc]
inc dword [ebx]
or al, 0x90
mov dword [ebp - 0x1f74], ecx
mov dword [ebp - 0x1d8], 0
jmp 0x417575
mov edx, dword [ebp - 0x1d8]
add edx, 1
mov dword [ebp - 0x1d8], edx
xchg ebp, eax
sub dh, bh
invalid
invalid
mov eax, dword [ebp - 0x974]
add eax, dword [ebp - 0x1d8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x417627
mov edx, dword [ebp - 0x1d8]
movsx eax, byte [ebp + edx - 0xafc]
test eax, eax
je 0x417627
push eax
add eax, 0x5d77
jmp 0x4175af
and eax, 0x17347
or eax, 0x15192
pop eax
push edx
push ebx
add esp, 4
add edx, 0x6c36
or edx, 0x11bb6
xor edx, 0x7605
pop edx
mov ecx, dword [ebp - 0x974]
add ecx, dword [ebp - 0x1d8]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1d8]
movsx ecx, byte [ebp + eax - 0xafc]
cmp edx, ecx
je 0x417619
mov edx, dword [ebp - 0x974]
add edx, dword [ebp - 0x1d8]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1d8]
movsx edx, byte [ebp + ecx - 0xafc]
cmp eax, edx
jne 0x417620
jmp 0x417566
jmp 0x417627
push ecx
push edx
add esp, 4
jmp 0x417631
and ecx, 0x12e1b
call 0x417647
add byte [edx], dh
xor eax, 0x43473e3b
inc esi
inc ebx
inc eax
cmp eax, dword [ebx - 0x167efb3c]
retf
movsx ecx, byte [ebp + eax - 0xafc]
or ecx, 0x20
cmp edx, ecx
jge 0x4176eb
mov dword [ebp - 0x1008], 0xffffffff
jmp 0x4176f5
mov dword [ebp - 0x1008], 1
cmp dword [ebp - 0x1008], 0
jne 0x41770c
mov edx, dword [ebp - 0x1f74]
mov dword [ebp - 0x4c8], edx
jmp 0x41771d
jmp 0x4174f6
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x4c8], eax

Function at 0x417779
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x417788
add byte [ebp + edi + 0x4c], cl
dec ecx
dec edi
inc esi
add esp, 4
pop edi
push ecx
add ecx, 0xea1b
and ecx, 0x16866
pop ecx
mov edx, dword [ebp - 0x1f78]
mov dword [ebp - 0x1f7c], edx
lea eax, [ebp - 0x1ba8]
push eax
call dword [ebp - 0x1f7c]
test eax, eax
jne 0x4177f8
push esi
sub esi, 0x16759
sub esi, 0xc75c
xor esi, 0x7110
xor esi, 0x1428a
pop esi
push esi
push edi
add esp, 4
and esi, 0x1227d
or esi, 0x86ec
xor esi, 0x16217
pop esi
mov dword [ebp - 0xc44], 0
jmp 0x417ee3
Function at 0x417788
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x417788
add byte [ebp + edi + 0x4c], cl
dec ecx
dec edi
inc esi
add esp, 4
pop edi
push ecx
add ecx, 0xea1b
and ecx, 0x16866
pop ecx
mov edx, dword [ebp - 0x1f78]
mov dword [ebp - 0x1f7c], edx
lea eax, [ebp - 0x1ba8]
push eax
call dword [ebp - 0x1f7c]
test eax, eax
jne 0x4177f8
push esi
sub esi, 0x16759
sub esi, 0xc75c
xor esi, 0x7110
xor esi, 0x1428a
pop esi
push esi
push edi
add esp, 4
and esi, 0x1227d
or esi, 0x86ec
xor esi, 0x16217
pop esi
mov dword [ebp - 0xc44], 0
jmp 0x417ee3

Function at 0x417830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not byte [edi]
bound eax, qword [ecx]
add byte [esi - 0x39], bl
test dword [ebx + esi*8 + 0xffff], edi
add byte [eax], al
jmp 0x4177e3
add byte [ecx - 0x1f7f73], cl
dec dword [ebx - 0x1f7f6b]
dec dword [ebx - 0x7a76cfbe]
jl 0x417824
invalid
push edi
push ecx
add esp, 4
jmp 0x417eed
sub edi, 0x6693
sub edi, 0x17477
jmp 0x417f02
pop edi
push esi
push eax
add esp, 4
and esi, 0x13e88
and esi, 0x175f0
invalid
jne 0x417f14
add byte [esi - 0x75], bl
xchg ebp, eax
mov esp, 0x89fffff3
xchg ebp, eax
push 0x8dffffe0
dec dword [ebp - 0x101b7b]
call dword [eax + 0x6a]
inc eax
mov ecx, dword [ebp - 0x1584]
push ecx
mov edx, dword [ebp - 0x4cc]
push edx
call dword [ebp - 0x1f98]
test eax, eax
jne 0x417f88
Function at 0x41791f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
and ecx, 0x12848
pop ecx
push ebx
push eax
add esp, 4
call 0x41791f
add byte [ecx + 0x45], cl
dec ebp
cmp byte [0x8334503f], bh
push edi
push eax
add esp, 4
and edi, 0x3836
pop edi
push ebx
push ecx
add esp, 4
sub ebx, 0x828f
add ebx, 0x16426
pop ebx
push ebx
push esi
add esp, 4
jmp 0x41798b
xor ebx, 0x3f3e
pop ebx
mov edx, dword [ebp - 0x100c]
mov ax, word [edx]
mov word [ebp - 0x1422], ax
mov ecx, dword [ebp - 0x100c]
add ecx, 2
mov dword [ebp - 0x100c], ecx
mov dx, word [ebp - 0x1422]
mov word [ebp - 0x2b8], dx
mov eax, dword [ebp - 0x1010]
mov cx, word [eax]
mov word [ebp - 0x1424], cx
mov edx, dword [ebp - 0x1010]
add edx, 2
mov dword [ebp - 0x1010], edx
mov ax, word [ebp - 0x1424]
mov word [ebp - 0x74], ax
push eax
push ecx
add esp, 4
add eax, 0x13758
pop eax
push eax
push ecx
add esp, 4
or eax, 0xf0f2
pop eax
push edi
sub edi, 0x22ea
add edi, 0xa99
pop edi
push edi
push esi
add esp, 4
xor edi, 0xde7
pop edi
movzx ecx, word [ebp - 0x74]
test ecx, ecx
jne 0x417a38
movzx edx, word [ebp - 0x2b8]
movzx eax, word [ebp - 0x74]
sub edx, eax
mov dword [ebp - 0x1574], edx
jmp 0x417a92
movzx ecx, word [ebp - 0x2b8]
movzx edx, word [ebp - 0x74]
cmp ecx, edx
je 0x417960
movzx eax, word [ebp - 0x2b8]
xor eax, 0x20
movzx ecx, word [ebp - 0x74]
cmp eax, ecx
je 0x417960
movzx edx, word [ebp - 0x2b8]
movzx eax, word [ebp - 0x74]
cmp edx, eax
jge 0x417a7c
mov dword [ebp - 0x1570], 0xffffffff
jmp 0x417a86
mov dword [ebp - 0x1570], 1
mov ecx, dword [ebp - 0x1570]
mov dword [ebp - 0x1574], ecx
invalid
cmp dword [ebp - 0x1574], 0
jne 0x417adb
push ebx
push esi
add esp, 4
add ebx, 0xc9d7
pop ebx
push eax
push ebx
add esp, 4
or eax, 0x1e63
pop eax
push esi
push edi
add esp, 4
jmp fcn.00417ac0
push edx
jmp 0x417ae3
jmp 0x417aea
add edx, 0x146c2
pop edx
push esi
add esi, 0x1f8
or esi, 0x182fd
jmp 0x417b06
dec ecx
inc esp
xor eax, 0x8139414b
mul byte [edx + 0x5e000111]
xor esi, 0x111a2
pop esi
mov eax, dword [ebp - 0x644]
mov ecx, dword [eax]
mov dword [ebp - 0x644], ecx
mov edx, dword [ebp - 0x644]
cmp edx, dword [ebp - 0x1014]
je 0x417b39
mov eax, dword [ebp - 0x644]
cmp dword [eax + 0x30], 0
jne 0x417904
mov dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x980]
add eax, 1
mov dword [ebp - 0x980], eax
Function at 0x417b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
and ecx, 0x12848
pop ecx
push ebx
push eax
add esp, 4
call 0x41791f
add byte [ecx + 0x45], cl
dec ebp
cmp byte [0x8334503f], bh
push edi
push eax
add esp, 4
and edi, 0x3836
pop edi
push ebx
push ecx
add esp, 4
sub ebx, 0x828f
add ebx, 0x16426
pop ebx
push ebx
push esi
add esp, 4
jmp 0x41798b
xor ebx, 0x3f3e
pop ebx
mov edx, dword [ebp - 0x100c]
mov ax, word [edx]
mov word [ebp - 0x1422], ax
mov ecx, dword [ebp - 0x100c]
add ecx, 2
mov dword [ebp - 0x100c], ecx
mov dx, word [ebp - 0x1422]
mov word [ebp - 0x2b8], dx
mov eax, dword [ebp - 0x1010]
mov cx, word [eax]
mov word [ebp - 0x1424], cx
mov edx, dword [ebp - 0x1010]
add edx, 2
mov dword [ebp - 0x1010], edx
mov ax, word [ebp - 0x1424]
mov word [ebp - 0x74], ax
push eax
push ecx
add esp, 4
add eax, 0x13758
pop eax
push eax
push ecx
add esp, 4
or eax, 0xf0f2
pop eax
push edi
sub edi, 0x22ea
add edi, 0xa99
pop edi
push edi
push esi
add esp, 4
xor edi, 0xde7
pop edi
movzx ecx, word [ebp - 0x74]
test ecx, ecx
jne 0x417a38
movzx edx, word [ebp - 0x2b8]
movzx eax, word [ebp - 0x74]
sub edx, eax
mov dword [ebp - 0x1574], edx
jmp 0x417a92
movzx ecx, word [ebp - 0x2b8]
movzx edx, word [ebp - 0x74]
cmp ecx, edx
je 0x417960
movzx eax, word [ebp - 0x2b8]
xor eax, 0x20
movzx ecx, word [ebp - 0x74]
cmp eax, ecx
je 0x417960
movzx edx, word [ebp - 0x2b8]
movzx eax, word [ebp - 0x74]
cmp edx, eax
jge 0x417a7c
mov dword [ebp - 0x1570], 0xffffffff
jmp 0x417a86
mov dword [ebp - 0x1570], 1
mov ecx, dword [ebp - 0x1570]
mov dword [ebp - 0x1574], ecx
invalid
cmp dword [ebp - 0x1574], 0
jne 0x417adb
push ebx
push esi
add esp, 4
add ebx, 0xc9d7
pop ebx
push eax
push ebx
add esp, 4
or eax, 0x1e63
pop eax
push esi
push edi
add esp, 4
jmp fcn.00417ac0
push edx
jmp 0x417ae3
jmp 0x417aea
add edx, 0x146c2
pop edx
push esi
add esi, 0x1f8
or esi, 0x182fd
jmp 0x417b06
dec ecx
inc esp
xor eax, 0x8139414b
mul byte [edx + 0x5e000111]
xor esi, 0x111a2
pop esi
mov eax, dword [ebp - 0x644]
mov ecx, dword [eax]
mov dword [ebp - 0x644], ecx
mov edx, dword [ebp - 0x644]
cmp edx, dword [ebp - 0x1014]
je 0x417b39
mov eax, dword [ebp - 0x644]
cmp dword [eax + 0x30], 0
jne 0x417904
mov dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x980]
add eax, 1
mov dword [ebp - 0x980], eax

Function at 0x41b550
Capabilities:
Encode data using xor

Disassembly:
add al, 0x85
out dx, eax
sbb al, 0x4c
add eax, 0x5a545f04
xchg eax, ecx
or byte [ebp + 0x4a030e4], al
add al, 0x85
in al, dx
enter 0xffffffffffff8508, 0xffffffffffffffe4
xor byte [eax - 0x137afbfc], ah
push ecx
and eax, dword [0x29e48504]
push ss
add al, 4
test esp, ebp
in al, dx
jbe 0x41b55b
add al, 4
pop esp
adc edi, dword [ebx + 0x3f74099]
add edx, ebp
out dx, al
push 0xffffffffffffff8d
pop ecx
add byte [esi + 0x54], dl
xchg eax, ecx
or bh, ch
pop es
inc eax
cmp eax, dword [ebp + 0x5e]
pop ebx
invalid
Function at 0x435990
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5973cc]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.0040c910
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0040c970
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4359fb
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.0040c920
mov eax, dword [ebp - 0x224]
jmp 0x435a8c
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x435a61
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00435990
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x435a58
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.0040c920
mov eax, dword [ebp - 0x228]
jmp 0x435a8c
mov dword [ebp - 4], 0x100
jmp 0x435a02
lea ecx, [ebp - 0x14]
call fcn.0040c940
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00435930
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.0040c920
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005060ef
mov esp, ebp
pop ebp
ret 4
Function at 0x435ff0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x435ff9
xor ecx, ecx
jne 0x435ff9
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x43601a
mov eax, 0xd
jmp 0x436075
xor eax, eax
jne 0x436001
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x43602b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x439fa0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
push ecx
call fcn.00451270
add esp, 4
push 9
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x30]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
push ecx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x30]
push edx
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esp, ebp
pop ebp
ret
Function at 0x448a30
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x5973cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x828], ecx
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x81c], 0x55a710
mov dword [ebp - 0xc], str.ProcessorNameString
mov dword [ebp - 8], 0x400
mov dword [ebp - 0x10], 0x40
mov dword [ebp - 4], 1
xor eax, eax
mov word [ebp - 0x818], ax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x818]
push edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x81c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x820], 0
jne 0x448ae6
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov word [ebp + ecx*2 - 0x81a], ax
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp + 8]
call fcn.004073f0
mov eax, dword [ebp - 0x824]
or eax, 1
mov dword [ebp - 0x824], eax
mov eax, dword [ebp + 8]
jmp 0x448b05
push 0x55a798
mov ecx, dword [ebp + 8]
call fcn.004073f0
mov ecx, dword [ebp - 0x824]
or ecx, 1
mov dword [ebp - 0x824], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005060ef
mov esp, ebp
pop ebp
ret 4

Function at 0x448c00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545966
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x5973cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0x14], 0
je 0x448c37
cmp dword [ebp + 8], 0
je 0x448c37
cmp dword [ebp + 0xc], 0
jne 0x448c3e
xor al, al
jmp 0x448cc2
lea ecx, [ebp - 0x1c]
call fcn.00402980
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0x55a7b0
lea edx, [ebp - 0x1c]
push edx
call fcn.00449990
add esp, 0x10
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 4
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041b240
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x448ca6
cmp dword [ebp - 0x14], 4
je 0x448caa
mov byte [ebp - 0xd], 0
mov cl, byte [ebp - 0xd]
mov byte [ebp - 0x1d], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00417530
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4ad270
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ca5e
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5973cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x240], 0
mov eax, dword [0x59bc0c]
and eax, 1
jne 0x4ad2e3
mov ecx, dword [0x59bc0c]
or ecx, 1
mov dword [0x59bc0c], ecx
mov dword [ebp - 4], 0
mov ecx, 0x59bbf0
call fcn.004045f0
push 0x556680
call fcn.00506331
add esp, 4
mov dword [ebp - 4], 0xffffffff
movzx edx, byte [0x59bbec]
cmp edx, 1
jne 0x4ad313
push 0x59bbf0
mov ecx, dword [ebp + 8]
call fcn.00404640
mov eax, dword [ebp - 0x240]
or eax, 1
mov dword [ebp - 0x240], eax
mov eax, dword [ebp + 8]
jmp 0x4ad3e8
xor ecx, ecx
mov word [ebp - 0x21c], cx
push 0x206
push 0
lea edx, [ebp - 0x21a]
push edx
call fcn.00506190
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4ad3c2
mov dword [ebp - 0x23c], 0
lea ecx, [ebp - 0x238]
call fcn.004045f0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x23c]
push ecx
movzx edx, word [ebp - 0x21c]
push edx
call fcn.00411720
add esp, 8
movzx eax, al
test eax, eax
je 0x4ad3b0
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call 0x411db0
add esp, 8
movzx eax, al
test eax, eax
je 0x4ad3b0
lea ecx, [ebp - 0x238]
push ecx
mov ecx, 0x59bbf0
call fcn.00404670
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.00402b00
mov byte [0x59bbec], 1
push 0x59bbf0
mov ecx, dword [ebp + 8]
call fcn.00404640
mov edx, dword [ebp - 0x240]
or edx, 1
mov dword [ebp - 0x240], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005060ef
mov esp, ebp
pop ebp
ret
Function at 0x4ad410
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ca9f
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5973cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x240], 0
mov eax, dword [0x59bc30]
and eax, 1
jne 0x4ad483
mov ecx, dword [0x59bc30]
or ecx, 1
mov dword [0x59bc30], ecx
mov dword [ebp - 4], 0
mov ecx, 0x59bc14
call fcn.004045f0
push 0x556690
call fcn.00506331
add esp, 4
mov dword [ebp - 4], 0xffffffff
movzx edx, byte [0x59bc10]
cmp edx, 1
jne 0x4ad4b3
push 0x59bc14
mov ecx, dword [ebp + 8]
call fcn.00404640
mov eax, dword [ebp - 0x240]
or eax, 1
mov dword [ebp - 0x240], eax
mov eax, dword [ebp + 8]
jmp 0x4ad588
xor ecx, ecx
mov word [ebp - 0x21c], cx
push 0x206
push 0
lea edx, [ebp - 0x21a]
push edx
call fcn.00506190
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4ad562
mov dword [ebp - 0x23c], 0
lea ecx, [ebp - 0x238]
call fcn.004045f0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x23c]
push ecx
movzx edx, word [ebp - 0x21c]
push edx
call fcn.00411720
add esp, 8
movzx eax, al
test eax, eax
je 0x4ad550
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call 0x411b30
add esp, 8
movzx eax, al
test eax, eax
je 0x4ad550
lea ecx, [ebp - 0x238]
push ecx
mov ecx, 0x59bc14
call fcn.00404670
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.00402b00
mov byte [0x59bc10], 1
push 0x59bc14
mov ecx, dword [ebp + 8]
call fcn.00404640
mov edx, dword [ebp - 0x240]
or edx, 1
mov dword [ebp - 0x240], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005060ef
mov esp, ebp
pop ebp
ret