joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1049600
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x64], ah
pushal
pushfd
pushal
pushfd
call 0x1049607
pop ebp
sub ebp, 0x401007
lea esi, [ebp + 0x40105a]
push esi
push 0x12c
push dword [ebp + 0x401056]
call fcn.01049627
jmp 0x104965a
lds esi, [ecx - 0x472fdbd5]
fcomp qword [esi]
popfd
in eax, dx
push ds
sti
inc ebx
push edi
inc edi
js 0x104967a
jg 0x10495f7
int 0x35
mov dword [ecx + eax - 0x1ddc044a], edx
les esp, [0x77342835]
sub byte [edi + esi*2], dh
pop ebx
xchg byte [ebx], al
pop ss
nop
add byte [esi + 0x20], al
add dword [edx], eax
jg 0x1049697
or byte [edi], bl
sbb al, 0xc1
rcl edi, 1
and eax, 0xa8bd6725
cld
out dx, al
std
fist dword [ebx]
pushal
adc eax, 0x3e268c08
leave
or byte [eax], bl
cld
fldcw word ds:[0xb8d2ba81]
jne 0x1049694
loop 0x10496b2
scasb al, byte es:[edi]
fnsave dword [edx + 0x7b]
pop edi
stosd dword es:[edi], eax
call 0x49366c3b
pop ebp
out dx, al
jo 0x1049665
pop ss
or ecx, dword [edx + 0x790c9256]
xchg bx, ax
and byte [esi + ebp - 0x184b4955], dl
inc esp
popfd
fnstsw word [esi + 0x24]
fnstsw word [di - 0x3c8]
rcr byte gs:[eax], 0x94
out dx, al
adc al, 0xb0
xchg edi, eax
cmp bl, bh
mov ebp, 0xc065fc38
sbb byte [esi + ebp*8 + 0x3897b014], dl
sti
xor byte [eax], dh
aas
sbb al, 0x95
cmp dword [ebp - 0x5afc8cd8], edi
and esp, dword [esi + 0x167f78be]
imul esp, dword [ebx + 0x7b9269dd], 0x7186b621
sub al, 0x6d
pop ecx
test al, 0xba
add byte [eax + esi*8], bl
dec eax
and ch, byte [edi + eax*8 + 0x2e]
test eax, 0x3316301a
clc
outsd dx, dword [esi]
adc al, 0xa4
jl 0x10496d4
adc al, 0x19
out 0x6a, al
dec eax
retf

Function at 0x1049627
Capabilities:
Encode data using xor

Disassembly:
enter 0, 0
pushal
mov ebx, 0x7fffffff
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, esi
imul eax, edx, 0x10dcd
add eax, 0x116c5
xor edx, edx
div ebx
lodsd eax, dword [esi]
xor eax, edx
stosd dword es:[edi], eax
loop 0x104963c
popal
leave
ret 0xc
Function at 0x405909
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x805c74]
jne 0x405913
repz ret
jmp fcn.0040830c

Function at 0x407bbf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402b52
and dword [ebp - 4], 0
cmp dword [0x80a234], 0
mov ebx, eax
jne 0x407c70
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407d21
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407d21
push eax
call fcn.00402ae0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x80a234], eax
call esi
push eax
call fcn.00402ae0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x80a238], eax
call esi
push eax
call fcn.00402ae0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x80a23c], eax
call esi
push eax
call fcn.00402ae0
pop ecx
mov dword [0x80a244], eax
test eax, eax
je 0x407c70
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402ae0
pop ecx
mov dword [0x80a240], eax
inc eax
invalid
invalid
invalid
mov eax, dword [0x80a240]
cmp eax, ebx
je 0x407cc8
cmp dword [0x80a244], ebx
je 0x407cc8
push eax
call fcn.00402b5b
push dword [0x80a244]
mov esi, eax
call fcn.00402b5b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407cc8
test edi, edi
je 0x407cc8
call esi
test eax, eax
je 0x407cbf
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407cbf
test byte [ebp - 0xc], 1
jne 0x407cc8
or dword [ebp + 0x10], 0x200000
jmp 0x407d01
mov eax, dword [0x80a238]
cmp eax, ebx
je 0x407d01
push eax
call fcn.00402b5b
pop ecx
test eax, eax
je 0x407d01
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407d01
mov eax, dword [0x80a23c]
cmp eax, ebx
je 0x407d01
push eax
call fcn.00402b5b
pop ecx
test eax, eax
je 0x407d01
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x80a234]
call fcn.00402b5b
pop ecx
test eax, eax
je 0x407d21
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407d23
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x429eea
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x429ef9
pop dword [ebp - 0x4c]
mov eax, 0x6ee95504
add eax, 0x915949f5
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x4d747
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x3d72
xor edx, edx
add edx, eax
mov edi, 0x774d98c3
sub edi, 0x77063ac3
add edi, dword [ebp - 0x4c]
mov esi, 0x9da31d1f
sub esi, 0xa62bb8cb
sub dword [ebp - 0x34], 0x2cc630db
mov ebx, dword [edi]
sub dword [ebp - 0x10], 0x37ccd800
add ebx, esi
xor dword [ebp - 0x48], 0x5c8a9acc
mov dword [edx], ebx
sub dword [ebp - 0x48], edx
add edx, 0x89d9a0da
sub edx, 0x89d9a0d6
add edi, 0x1482a51d
add edi, 0xeb7d5ae7
loop 0x429f4f
add eax, 0x5245ced5
add eax, 0xadbb19c6
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe229f8d5
sub ecx, 0xe1e9f8d5
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x4017a0
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x91c]
test eax, eax
jne 0x40180b
test byte [esi], 2
je 0x4017de
cmp byte [esi + 1], al
jne 0x4017de
push dword [esi + 0x920]
call sub.KERNEL32.dll_SetEndOfFile
test al, al
jne 0x4017de
push 0
push 0x4346bc
push str.truncate
push 0x42e4f0
call sym.find_string.exe__sys_sys_error_bomb_16
cmp byte [esi + 1], 6
je 0x401818
push dword [esi + 0x920]
call fcn.00408444
test al, al
jne 0x401818
push 0
push 0x4346bc
push str.close
push 0x42e4f0
call sym.find_string.exe__sys_sys_error_bomb_16
jmp 0x401818
push esi
call eax
mov dword [esi + 0x91c], 0
add esi, 0x918
cmp dword [esi], 0
je 0x401829
push esi
call sym.find_string.exe__sys_mem_dealloc_4
pop esi
ret 4

Function at 0x401840
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
call sym.find_string.exe__sys_error_none_4
mov edi, dword [esp + 0x10]
test edi, edi
je 0x4018d9
push ebx
push dword [0x4346c0]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
push edi
push dword [esp + 0x24]
push dword [eax + 0x920]
call sub.KERNEL32.dll_ReadFile
mov ebx, dword [esp + 0x1c]
test al, al
jne 0x40189b
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x6d
je 0x4018a5
mov dword [esi + 0xc], eax
mov eax, ebx
pop ebx
pop edi
pop esi
mov dword [eax], 0
ret 0x14
mov eax, dword [esp + 0x20]
mov dword [ebx], eax
test eax, eax
jne 0x4018bb
push esi
push 1
push 0xfffffffffffffffd
mov dword [ebx], 0
call sym.find_string.exe__sys_stat_set_12
pop ebx
pop edi
pop esi
ret 0x14
cmp eax, edi
jae 0x4018d8
push esi
push 0xa
push 0xfffffffffffffffd
call sym.find_string.exe__sys_stat_set_12
push esi
push edi
call sym.find_string.exe__sys_stat_parm_int_8
push esi
push dword [ebx]
call sym.find_string.exe__sys_stat_parm_int_8
pop ebx
pop edi
pop esi
ret 0x14

Function at 0x402040
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x1070
call fcn.00407b20
call sym.find_string.exe__sys_init_0
call sym.find_string.exe__util_init_0
mov eax, 4
mov dword [0x437764], 0x400
mov word [esp], ax
movzx eax, word [0x42e868]
push eax
push dword [esp + 0x1080]
mov dword [0x437b68], 0x100
push 0x437b68
mov dword [0x437c6c], 0x20
mov dword [0x435740], 0x2000
call sym.find_string.exe__string_vstring_12
mov byte [0x4346e0], 1
call sub.KERNEL32.dll_GetCommandLineA
test eax, eax
je 0x4020c1
movzx ecx, word [0x42e868]
push ecx
push eax
push 0x435740
call sym.find_string.exe__string_vstring_12
mov eax, 1
mov word [0x437744], ax
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x437744
push 0x435740
call sym.find_string.exe__string_token_16
mov ax, word [0x437744]
mov word [0x437746], ax
mov dword [0x437760], 1
mov byte [0x437c90], 0
add esp, 0x1070
ret 0xc
Function at 0x4045c0
Capabilities:
Get disk information

Disassembly:
push ecx
cmp byte [0x4348f0], 0
jne 0x40469f
mov al, byte [0x4348f1]
push ebx
mov ebx, 0x41
mov dword [0x4348f4], 0x30004
mov word [0x4348f9], 0x5c3a
mov byte [0x4348fb], al
mov byte [0x4348f0], 1
mov byte [esp + 7], 0x20
mov byte [esp + 6], 0x20
mov byte [0x4348f8], bl
nop dword [eax + eax]
push 0x4348f8
call sub.KERNEL32.dll_GetDriveTypeA
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x404622
jmp dword [eax*4 + 0x4046b4]
mov al, byte [esp + 7]
mov dl, byte [esp + 6]
cmp al, 0x20
jne 0x404662
mov al, byte [0x4348f8]
mov byte [esp + 7], al
jmp 0x404662
cmp byte [esp + 6], 0x20
movzx edx, byte [esp + 6]
movzx eax, byte [0x4348f8]
cmove edx, eax
mov byte [esp + 6], dl
jmp 0x40465e
mov dl, byte [esp + 6]
mov al, byte [esp + 7]
inc ebx
mov byte [0x4348f8], bl
cmp ebx, 0x5a
jle 0x404610
cmp al, 0x20
je 0x40468a
pop ebx
push dword [esp + 8]
mov byte [0x4348f8], al
push 0x4348f4
call sym.find_string.exe__string_copy_8
pop ecx
ret 4
cmp dl, 0x20
movzx eax, dl
mov ecx, 0x43
cmovne ecx, eax
mov byte [0x4348f8], cl
pop ebx
push dword [esp + 8]
push 0x4348f4
call sym.find_string.exe__string_copy_8
pop ecx
ret 4
Function at 0x404a90
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x106c
call fcn.00407b20
cmp byte [0x434750], 0
jne 0x404bb9
lea eax, [esp + 4]
push eax
call sym.find_string.exe__sys_error_none_4
push 0x434754
mov word [esp + 4], 0x7f7f
push dword [esp + 4]
mov word [0x434756], 0
call sub.WS2_32.dll_WSAStartup
mov dword [esp + 0x10], eax
lea eax, [esp + 4]
push eax
call sym.find_string.exe__sys_error_4
test al, al
je 0x404bb2
push ebx
mov word [esp + 4], 1
mov ebx, 1
push 0x434754
push dword [esp + 8]
call sub.WS2_32.dll_WSAStartup
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
push eax
call sym.find_string.exe__sys_error_4
test al, al
jne 0x404b3f
call sub.WS2_32.dll_WSACleanup
test eax, eax
je 0x404b3f
call sub.WS2_32.dll_WSAGetLastError
push 0
push 0x4348fc
push str.err_netclose
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push 0x42eba0
push eax
call sym.find_string.exe__sys_error_abort_20
mov al, byte [0x434756]
test al, al
jne 0x404b77
inc ebx
mov byte [esp + 4], bl
cmp ebx, 0x7f
jle 0x404af2
push 0
push 0x4348fc
push str.err_netversion
push 0x42eba0
call sym.find_string.exe__sys_message_bomb_16
pop ebx
mov byte [0x434750], 1
add esp, 0x106c
ret
mov byte [esp + 4], al
mov al, byte [0x434757]
push 0x434754
mov byte [esp + 9], al
push dword [esp + 8]
call sub.WS2_32.dll_WSAStartup
push 0
push 0x4348fc
push str.err_netstart
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push 0x42eba0
push eax
call sym.find_string.exe__sys_error_abort_20
pop ebx
mov byte [0x434750], 1
add esp, 0x106c
ret

Function at 0x404fb0
Capabilities:
Write file on windows

Disassembly:
push 1
call fcn.0040af0c
push eax
push 0x21
push 1
push str._Program_aborted_on_error._
call fcn.0040b1a1
push 0x42eeb8
call fcn.00401410
add esp, 0x18
jmp sym.find_string.exe__sys_exit_error_0
Function at 0x4052f0
Capabilities:
Write file on windows

Disassembly:
push 0x42ef18
call sym.find_string.exe__string_upcase_4
push 0x42eec0
call sym.find_string.exe__string_upcase_4
push 1
call fcn.0040af0c
push eax
push 8
push 1
push str.Status__
call fcn.0040b1a1
mov ax, word [0x42eec2]
add esp, 0x14
cmp ax, 0x50
jle 0x405346
cwde
push 0x434969
sub eax, 0x50
push eax
push 0x42f4fc
call fcn.00401410
mov ax, word [0x42eec2]
add esp, 0xc
push esi
test ax, ax
jle 0x40535e
cmp ax, 0x50
jge 0x405357
movsx esi, ax
jmp 0x405360
mov esi, 0x50
jmp 0x405360
xor esi, esi
push 1
call fcn.0040af0c
push eax
push esi
push 1
push 0x42eec4
call fcn.0040b1a1
push 1
call fcn.0040af0c
push eax
push 0x10
push 1
push str.__in_subsystem__
call fcn.0040b1a1
mov ax, word [0x42ef1a]
mov esi, 0x400
add esp, 0x28
cmp ax, si
jle 0x4053ba
cwde
push 0x43496a
sub eax, esi
push eax
push 0x42f514
call fcn.00401410
mov ax, word [0x42ef1a]
add esp, 0xc
test ax, ax
jle 0x4053c9
cmp ax, si
jge 0x4053cb
movsx esi, ax
jmp 0x4053cb
xor esi, esi
push 1
call fcn.0040af0c
push eax
push esi
push 1
push 0x42ef1c
call fcn.0040b1a1
push 1
call fcn.0040af0c
push eax
push 2
push 1
push 0x42f518
call fcn.0040b1a1
push 0x42f51c
call fcn.00401410
add esp, 0x2c
mov byte [0x42ef14], 1
pop esi
ret
Function at 0x405e70
Capabilities:
Get hostname

Disassembly:
mov eax, 0x146c
call fcn.00407b20
lea eax, [esp]
mov dword [esp], 0x400
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_GetComputerNameA
test al, al
jne 0x405eca
lea eax, [esp + 0x404]
push eax
call sym.find_string.exe__sys_error_none_4
call sub.KERNEL32.dll_GetLastError
push 0
push 0x43496c
push str.node_name_get
mov dword [esp + 0x41c], eax
lea eax, [esp + 0x410]
push 0x430e28
push eax
call sym.find_string.exe__sys_error_abort_20
push dword [esp]
lea eax, [esp + 8]
push eax
push dword [esp + 0x1478]
call sym.find_string.exe__string_vstring_12
push dword [esp + 0x1470]
call sym.find_string.exe__string_downcase_4
add esp, 0x146c
ret 4

Function at 0x405f00
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x884
lea eax, [esp]
push dword [0x430ecc]
push eax
push dword [esp + 0x890]
call sym.find_string.exe__string_t_c_12
push dword [0x430ed0]
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableA
test eax, eax
jne 0x405f64
push dword [esp + 0x890]
push 2
push 0xffffffffffffffff
call sym.find_string.exe__sys_stat_set_12
push dword [esp + 0x890]
push dword [esp + 0x88c]
call sym.find_string.exe__sys_stat_parm_vstr_8
add esp, 0x884
ret 0xc
movzx eax, word [0x430ed4]
push eax
lea eax, [esp + 0x88]
push eax
push dword [esp + 0x894]
call sym.find_string.exe__string_vstring_12
push dword [esp + 0x890]
call sym.find_string.exe__sys_error_none_4
add esp, 0x884
ret 0xc

Function at 0x405fa0
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x884
push esi
mov esi, dword [esp + 0x894]
push esi
call sym.find_string.exe__sys_error_none_4
push 0x84
lea eax, [esp + 8]
push eax
push dword [esp + 0x894]
call sym.find_string.exe__string_t_c_12
push 0x800
lea eax, [esp + 0x8c]
push eax
push dword [esp + 0x898]
call sym.find_string.exe__string_t_c_12
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 8]
push eax
call sub.KERNEL32.dll_SetEnvironmentVariableA
test al, al
jne 0x406001
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x884
ret 0xc

Function at 0x406010
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x88
push esi
push dword [0x430ec8]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x98]
call sym.find_string.exe__string_t_c_12
mov al, byte [0x434970]
mov esi, dword [esp + 0x94]
push esi
mov byte [esp + 0xb], al
call sym.find_string.exe__sys_error_none_4
lea eax, [esp + 7]
push eax
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_SetEnvironmentVariableA
test al, al
jne 0x40605f
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
add esp, 0x88
ret 8
Function at 0x406070
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x58
push esi
mov esi, dword [esp + 0x68]
mov eax, 0x50
push edi
mov word [esp + 0xc], ax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x68]
mov byte [esi], 0
call sym.find_string.exe__string_copy_8
lea eax, [esp + 0xc]
push eax
call sym.find_string.exe__string_terminate_null_4
mov edi, dword [esp + 0x70]
lea eax, [esp + 0x64]
push edi
push eax
push 1
call fcn.00406160
push edi
call sym.find_string.exe__sys_error_4
test al, al
jne 0x40614e
push ebx
mov ebx, dword [esp + 0x6c]
movsx eax, word [ebx]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x70]
push eax
lea eax, [ebx + 4]
push eax
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x7c]
call sub.ADVAPI32.dll_RegQueryValueExA
mov ecx, dword [esp + 0x70]
mov dword [edi + 0xc], eax
mov word [ebx + 2], cx
cmp dword [edi + 0xc], 0xea
jne 0x406103
push edi
call sym.find_string.exe__sys_error_none_4
jmp 0x40611e
test cx, cx
jle 0x40611e
movsx eax, cx
mov al, byte [eax + ebx + 3]
cmp al, byte [0x434971]
jne 0x40611e
lea eax, [ecx - 1]
mov word [ebx + 2], ax
push dword [esp + 0x68]
call sub.ADVAPI32.dll_RegCloseKey
push edi
call sym.find_string.exe__sys_error_4
pop ebx
test al, al
jne 0x40614e
mov eax, dword [esp + 8]
sub eax, 1
je 0x40614b
sub eax, 1
jne 0x40614e
or byte [esi], 2
pop edi
pop esi
add esp, 0x58
ret 0x10
or byte [esi], 1
pop edi
pop esi
add esp, 0x58
ret 0x10

Function at 0x406250
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x54
mov eax, 0x50
push esi
mov word [esp + 4], ax
lea eax, [esp + 4]
push eax
push dword [esp + 0x60]
call sym.find_string.exe__string_copy_8
lea eax, [esp + 4]
push eax
call sym.find_string.exe__string_terminate_null_4
mov esi, dword [esp + 0x60]
lea eax, [esp + 0x5c]
push esi
push eax
push 2
call fcn.00406160
push esi
call sym.find_string.exe__sys_error_4
test al, al
jne 0x4062a8
push esi
call sym.find_string.exe__sys_error_none_4
lea eax, [esp + 8]
push eax
push dword [esp + 0x60]
call sub.ADVAPI32.dll_RegDeleteValueA
mov dword [esi + 0xc], eax
pop esi
add esp, 0x54
ret 8
Function at 0x4062b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x2068
call fcn.00407b20
mov eax, 0x50
mov byte [esp + 3], 0
push ebx
mov bh, byte [esp + 0x2078]
mov word [esp + 0x14], ax
mov eax, 0x2000
push esi
mov word [esp + 0x6c], ax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x2078]
call sym.find_string.exe__string_copy_8
lea eax, [esp + 0x18]
push eax
call sym.find_string.exe__string_terminate_null_4
mov esi, dword [esp + 0x2080]
lea eax, [esp + 0xc]
push esi
push eax
push 3
call fcn.00406160
push esi
call sym.find_string.exe__sys_error_4
test al, al
jne 0x40647c
movsx eax, word [esp + 0x6c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x18]
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegQueryValueExA
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov word [esp + 0x6e], cx
cmp eax, 0xea
jne 0x40635c
push esi
call sym.find_string.exe__sys_error_none_4
jmp 0x406378
test cx, cx
jle 0x406378
movsx eax, cx
mov al, byte [esp + eax + 0x6f]
cmp al, byte [0x434972]
jne 0x406378
lea eax, [ecx - 1]
mov word [esp + 0x6e], ax
mov bl, bh
push esi
and bl, 1
call sym.find_string.exe__sys_error_4
test al, al
je 0x406391
mov dword [esp + 0x10], 1
jmp 0x4063c1
mov eax, dword [esp + 0x10]
test bl, bl
je 0x40639e
cmp eax, 1
jne 0x4063c1
test bh, 2
je 0x4063a8
cmp eax, 2
jne 0x4063c1
push dword [esp + 0x2078]
lea eax, [esp + 0x70]
push eax
call sym.find_string.exe__string_equal_8
test al, al
jne 0x406473
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x207c]
call sym.find_string.exe__string_copy_8
lea eax, [esp + 0x6c]
push eax
call sym.find_string.exe__string_terminate_null_4
mov ecx, dword [esp + 0x10]
test bl, bl
mov eax, 1
cmovne ecx, eax
test bh, 2
mov eax, 2
cmovne ecx, eax
movsx eax, word [esp + 0x6e]
inc eax
mov dword [esp + 0x10], ecx
push eax
lea eax, [esp + 0x74]
push eax
push ecx
push dword [0x434974]
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegSetValueExA
push esi
mov dword [esi + 0xc], eax
call sym.find_string.exe__sys_error_4
test al, al
jne 0x40645b
push dword [esp + 0xc]
mov byte [esp + 0xf], 1
call sub.ADVAPI32.dll_RegFlushKey
push esi
mov dword [esi + 0xc], eax
call sym.find_string.exe__sys_error_4
test al, al
jne 0x40645b
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
mov dword [esi + 0xc], eax
mov al, 1
pop esi
pop ebx
add esp, 0x2068
ret 0x10
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
mov al, byte [esp + 0xb]
pop esi
pop ebx
add esp, 0x2068
ret 0x10
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
pop esi
xor al, al
pop ebx
add esp, 0x2068
ret 0x10

Function at 0x406920
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push esi
call sym.find_string.exe__sys_error_none_4
push dword [0x430fe4]
push dword [esp + 0xc]
call sub.KERNEL32.dll_TerminateProcess
test al, al
jne 0x406946
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
pop esi
ret 8
Function at 0x406950
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x480c
call fcn.00407b20
push esi
mov esi, dword [esp + 0x4818]
mov eax, 0x400
push edi
mov edi, dword [esp + 0x4818]
mov word [esp + 0xc], ax
mov eax, 0x2000
mov word [esp + 0x2810], ax
lea eax, [esp + 0xc]
push esi
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push edi
call sym.find_string.exe__string_token_16
push esi
call sym.find_string.exe__sys_error_4
test al, al
jne 0x406a99
lea eax, [esp + 0x2810]
push eax
lea eax, [esp + 0x10]
push eax
call sym.find_string.exe__string_treename_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2814]
push eax
call sym.find_string.exe__string_token_make_8
push 0x400
lea eax, [esp + 0x414]
push eax
lea eax, [esp + 0x14]
push eax
call sym.find_string.exe__string_t_c_12
xor eax, eax
mov word [esp + 0x2812], ax
lea eax, [esp + 0xc]
push esi
push eax
lea eax, [esp + 0x10]
push eax
push edi
call sym.find_string.exe__string_token_16
push esi
call sym.find_string.exe__string_eos_4
test al, al
jne 0x406a43
push esi
call sym.find_string.exe__sys_error_4
test al, al
jne 0x406a99
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2814]
push eax
call sym.find_string.exe__string_append_token_8
push esi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push edi
call sym.find_string.exe__string_token_16
push esi
call sym.find_string.exe__string_eos_4
test al, al
je 0x406a08
push 0x2000
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x2818]
push eax
call sym.find_string.exe__string_t_c_12
push dword [0x4310e8]
lea eax, [esp + 0x814]
push 0x434988
push eax
lea eax, [esp + 0x41c]
push eax
push 0x434988
push dword [0x434984]
call sub.SHELL32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x406a99
push esi
add eax, 0x64
push eax
push 0xffffffffffffffff
call sym.find_string.exe__sys_stat_set_12
pop edi
pop esi
add esp, 0x480c
ret 8