joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017ba
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 1
lea eax, [esp + 0x14]
pop edi
xor ebx, ebx
mov esi, ecx
push eax
push ebx
push esi
push 0x401bd9
push ebx
push ebx
mov dword [esi + 0x803c8], ebx
mov dword [esi + 0x803cc], ebx
mov dword [esi + 0x803d0], ebx
mov dword [esi + 0x803d4], ebx
mov dword [esi + 0x803c4], edi
call fcn.0040ed45
mov ebp, dword [sym.imp.USER32.dll_EndDialog]
add esp, 0x18
cmp eax, ebx
mov dword [esi + 0x803c0], eax
jne 0x401826
mov eax, 0x80010001
mov dword [esi + 0x803c8], edi
push eax
mov dword [esi + 0x803cc], eax
push dword [esi]
mov dword [esi + 0x803d4], edi
call ebp
mov dword [esp + 0x10], edi
push ebx
push 0x64
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.USER32.dll_SetTimer]
cmp eax, ebx
mov dword [esi + 0x803d8], eax
jne 0x401869
inc dword [esp + 0x10]
jne 0x40182a
cmp eax, ebx
jne 0x401869
mov eax, 0x80110001
mov dword [esi + 0x803c8], edi
push eax
mov dword [esi + 0x803cc], eax
push dword [esi]
mov dword [esi + 0x803d4], edi
call ebp
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x402bea
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x770
push ebx
xor ebx, ebx
cmp dword [0x432378], ebx
push esi
push dword [ebp + 8]
je 0x402cb0
lea eax, [ebp - 0x770]
push eax
call fcn.0040e743
cmp word [ebp - 0x770], bx
pop ecx
pop ecx
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
lea esi, [ebp - 0x770]
je 0x402ca9
lea eax, [ebp - 0x770]
cmp esi, eax
jbe 0x402c93
cmp word [esi - 2], 0x3a
je 0x402c93
cmp word [esi], 0x5c
jne 0x402c93
lea eax, [ebp - 0x360]
mov word [esi], bx
push eax
lea eax, [ebp - 0x770]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x402c73
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x360], 0x10
jne 0x402c8c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x770]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x402d51
mov word [esi], 0x5c
jmp 0x402ca2
mov ax, word [esi]
and ax, 0xfc00
cmp ax, 0xd800
jne 0x402ca2
inc esi
inc esi
inc esi
inc esi
cmp word [esi], bx
jne 0x402c30
push 1
pop eax
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00401535
add esp, 0xc
cmp byte [ebp - 0x110], bl
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
lea esi, [ebp - 0x110]
je 0x402ca9
lea eax, [ebp - 0x110]
cmp esi, eax
jbe 0x402d39
cmp byte [esi - 1], 0x3a
je 0x402d39
cmp byte [esi], 0x5c
jne 0x402d39
lea eax, [ebp - 0x250]
mov byte [esi], bl
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x402d1f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x250], 0x10
jne 0x402d34
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x402d51
mov byte [esi], 0x5c
jmp 0x402d47
mov al, byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x402d47
inc esi
inc esi
cmp byte [esi], bl
jne 0x402cdf
jmp 0x402ca9
xor eax, eax
jmp 0x402cac
Function at 0x402d58
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x770
push ebx
xor ebx, ebx
cmp dword [0x432378], ebx
push esi
push dword [ebp + 8]
je 0x402e24
lea eax, [ebp - 0x770]
push 0x410
push eax
call fcn.00401472
add esp, 0xc
cmp word [ebp - 0x770], bx
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
lea esi, [ebp - 0x770]
je 0x402e1d
lea eax, [ebp - 0x770]
cmp esi, eax
jbe 0x402e07
cmp word [esi - 2], 0x3a
je 0x402e07
cmp word [esi], 0x5c
jne 0x402e07
lea eax, [ebp - 0x360]
mov word [esi], bx
push eax
lea eax, [ebp - 0x770]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x402de7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x360], 0x10
jne 0x402e00
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x770]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x402ebf
mov word [esi], 0x5c
jmp 0x402e16
mov ax, word [esi]
and ax, 0xfc00
cmp ax, 0xd800
jne 0x402e16
inc esi
inc esi
inc esi
inc esi
cmp word [esi], bx
jne 0x402da4
push 1
pop eax
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x110]
push eax
call fcn.0040e770
cmp byte [ebp - 0x110], bl
pop ecx
pop ecx
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
lea esi, [ebp - 0x110]
je 0x402e1d
lea eax, [ebp - 0x110]
cmp esi, eax
jbe 0x402ea7
cmp byte [esi - 1], 0x3a
je 0x402ea7
cmp byte [esi], 0x5c
jne 0x402ea7
lea eax, [ebp - 0x250]
mov byte [esi], bl
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x402e8d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x250], 0x10
jne 0x402ea2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x402ebf
mov byte [esi], 0x5c
jmp 0x402eb5
mov al, byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x402eb5
inc esi
inc esi
cmp byte [esi], bl
jne 0x402e4d
jmp 0x402e1d
xor eax, eax
jmp 0x402e20
Function at 0x402ec6
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
push ebx
xor ebx, ebx
cmp dword [0x432378], ebx
push dword [ebp + 8]
je 0x402f37
lea eax, [ebp - 0x514]
push eax
call fcn.0040e743
cmp word [ebp - 0x514], bx
pop ecx
pop ecx
lea eax, [ebp - 0x514]
je 0x402f28
lea ecx, [ebp - 0x514]
cmp eax, ecx
jbe 0x402f0a
cmp word [eax], 0x5c
je 0x402f24
mov cx, word [eax]
and cx, 0xfc00
cmp cx, 0xd800
jne 0x402f1b
inc eax
inc eax
inc eax
inc eax
cmp word [eax], bx
jne 0x402efa
jmp 0x402f28
mov word [eax + 2], bx
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x402f90
lea eax, [ebp - 0x104]
push 0x104
push eax
call fcn.00401535
add esp, 0xc
cmp byte [ebp - 0x104], bl
lea eax, [ebp - 0x104]
je 0x402f83
lea ecx, [ebp - 0x104]
cmp eax, ecx
jbe 0x402f68
cmp byte [eax], 0x5c
je 0x402f80
movsx cx, byte [eax]
and cx, 0xfc00
cmp cx, 0xd800
jne 0x402f79
inc eax
inc eax
cmp byte [eax], bl
jne 0x402f59
jmp 0x402f83
mov byte [eax + 1], bl
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
dec eax
je 0x402fb4
dec eax
je 0x402fb0
dec eax
je 0x402fac
dec eax
je 0x402fa8
dec eax
je 0x402fa4
xor eax, eax
jmp 0x402fb7
push 4
jmp 0x402fb6
push 3
jmp 0x402fb6
push 2
jmp 0x402fb6
push 1
jmp 0x402fb6
push 5
pop eax
pop ebx
leave
ret

Function at 0x402fba
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
push ebx
xor ebx, ebx
cmp dword [0x432378], ebx
push dword [ebp + 8]
je 0x403031
lea eax, [ebp - 0x514]
push 0x410
push eax
call fcn.00401472
add esp, 0xc
cmp word [ebp - 0x514], bx
lea eax, [ebp - 0x514]
je 0x403022
lea ecx, [ebp - 0x514]
cmp eax, ecx
jbe 0x403004
cmp word [eax], 0x5c
je 0x40301e
mov cx, word [eax]
and cx, 0xfc00
cmp cx, 0xd800
jne 0x403015
inc eax
inc eax
inc eax
inc eax
cmp word [eax], bx
jne 0x402ff4
jmp 0x403022
mov word [eax + 2], bx
lea eax, [ebp - 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x403084
lea eax, [ebp - 0x104]
push eax
call fcn.0040e770
cmp byte [ebp - 0x104], bl
pop ecx
pop ecx
lea eax, [ebp - 0x104]
je 0x403077
lea ecx, [ebp - 0x104]
cmp eax, ecx
jbe 0x40305c
cmp byte [eax], 0x5c
je 0x403074
movsx cx, byte [eax]
and cx, 0xfc00
cmp cx, 0xd800
jne 0x40306d
inc eax
inc eax
cmp byte [eax], bl
jne 0x40304d
jmp 0x403077
mov byte [eax + 1], bl
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
dec eax
je 0x4030a8
dec eax
je 0x4030a4
dec eax
je 0x4030a0
dec eax
je 0x40309c
dec eax
je 0x403098
xor eax, eax
jmp 0x4030ab
push 4
jmp 0x4030aa
push 3
jmp 0x4030aa
push 2
jmp 0x4030aa
push 1
jmp 0x4030aa
push 5
pop eax
pop ebx
leave
ret
Function at 0x403b5c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
lea eax, [esi + 8]
mov dword [esi], 0x424688
push eax
call fcn.0040e743
push dword [ebp + 0xc]
lea edi, [esi + 0x314]
push edi
call fcn.0040e743
mov eax, dword [ebp + 0x10]
add esp, 0x10
mov dword [esi + 0x620], eax
xor eax, eax
push eax
push 0x80
push 3
push eax
push 1
push 0x80000000
mov dword [esi + 0x628], eax
push edi
mov dword [esi + 0x630], eax
mov dword [esi + 0x634], eax
mov dword [esi + 0x638], eax
mov dword [esi + 0x63c], eax
mov dword [esi + 0x640], eax
mov dword [esi + 0x62c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x403c05
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x403bfe
mov dword [esi + 0x628], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x62c], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
leave
ret 0xc

Function at 0x403c0d
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
lea eax, [esi + 0x210]
mov dword [esi], 0x424688
push eax
call fcn.0040e770
push dword [ebp + 0xc]
lea edi, [esi + 0x51c]
push edi
call fcn.0040e770
mov eax, dword [ebp + 0x10]
add esp, 0x10
mov dword [esi + 0x620], eax
xor eax, eax
push eax
push 0x80
push 3
push eax
push 1
push 0x80000000
mov dword [esi + 0x628], eax
push edi
mov dword [esi + 0x630], eax
mov dword [esi + 0x634], eax
mov dword [esi + 0x638], eax
mov dword [esi + 0x63c], eax
mov dword [esi + 0x640], eax
mov dword [esi + 0x62c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x403cb9
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x403cb2
mov dword [esi + 0x628], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x62c], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
leave
ret 0xc
Function at 0x40521c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
push esi
mov esi, ecx
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x84]
sub eax, 0
je 0x40530f
dec eax
je 0x4052c7
dec eax
jne 0x405315
cmp dword [ebp - 0x90], 5
jb 0x4052bf
cmp dword [ebp - 0x8c], 1
jb 0x4052a4
lea eax, [ebp - 0x80]
push str.Service_Pack_2
push eax
call fcn.0040e8f8
pop ecx
test eax, eax
pop ecx
jne 0x405289
mov dword [esi], 0x30303
jmp 0x405315
lea eax, [ebp - 0x80]
push str.Service_Pack_1
push eax
call fcn.0040e8f8
neg eax
pop ecx
sbb eax, eax
pop ecx
add eax, 0x30302
jmp 0x4052f5
lea eax, [ebp - 0x80]
push str.Service_Pack_1
push eax
call fcn.0040e8f8
neg eax
pop ecx
sbb eax, eax
pop ecx
add eax, 0x30202
jmp 0x4052f5
mov dword [esi], 0x30101
jmp 0x405315
cmp dword [ebp - 0x8c], 0x5a
jb 0x4052d8
mov dword [esi], 0x20301
jmp 0x405315
cmp dword [ebp - 0x8c], 0
jbe 0x4052f9
mov eax, 0x7d0
cmp eax, dword [ebp - 0x88]
sbb eax, eax
neg eax
add eax, 0x20201
mov dword [esi], eax
jmp 0x405315
mov eax, 0x3e8
cmp eax, dword [ebp - 0x88]
sbb eax, eax
neg eax
add eax, 0x20101
jmp 0x4052f5
mov dword [esi], 0x101
push 0x40000
lea eax, [esi + 4]
push 0
push eax
call fcn.0040e9b0
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x408084
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x201c
call fcn.0040ef00
and dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
push ebx
je 0x4081af
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x201c]
push eax
call fcn.0040e743
pop ecx
mov ebx, 0x80000001
pop ecx
mov dword [ebp + 8], ebx
xor ecx, ecx
lea edi, [ebp - 0x201c]
cmp word [ebp - 0x201c], cx
lea esi, [ebp - 0x201c]
je 0x4080f1
mov ax, word [esi]
cmp ax, 0x5c
je 0x4080f1
and ax, 0xfc00
cmp ax, 0xd800
jne 0x4080ea
add esi, 4
jmp 0x4080ec
inc esi
inc esi
cmp word [esi], cx
jne 0x4080d2
cmp word [esi], 0x5c
jne 0x408105
mov word [esi], cx
inc esi
inc esi
mov dword [ebp - 8], 1
jmp 0x408108
mov dword [ebp - 8], ecx
lea eax, [ebp - 0x201c]
push 0x42b3cc
push eax
call fcn.0040f634
pop ecx
test eax, eax
pop ecx
jne 0x40812c
mov dword [ebp + 8], 0x80000000
mov edi, esi
xor ebx, ebx
jmp 0x408195
lea eax, [ebp - 0x201c]
push 0x42b3a8
push eax
call fcn.0040f634
pop ecx
test eax, eax
pop ecx
jne 0x408148
mov dword [ebp + 8], ebx
jmp 0x408126
lea eax, [ebp - 0x201c]
push 0x42b380
push eax
call fcn.0040f634
pop ecx
test eax, eax
pop ecx
jne 0x408168
mov dword [ebp + 8], 0x80000002
jmp 0x408126
lea eax, [ebp - 0x201c]
push 0x42b368
push eax
call fcn.0040f634
pop ecx
test eax, eax
pop ecx
jne 0x408188
mov dword [ebp + 8], 0x80000003
jmp 0x408126
xor ebx, ebx
cmp dword [ebp - 8], ebx
je 0x408195
mov word [esi - 2], 0x5c
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop edi
pop esi
test eax, eax
je 0x4081b3
xor eax, eax
jmp 0x4081f9
push ebx
lea eax, [ebp - 0x18]
push ebx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x10], ebx
ja 0x4081ed
push 1
pop eax
cmp dword [ebp - 0x1c], eax
ja 0x4081ed
cmp dword [ebp - 0x14], ebx
ja 0x4081ed
cmp dword [ebp - 0x18], ebx
ja 0x4081ed
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop ebx
leave
ret
Function at 0x4081fc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040ef00
and dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
push ebx
je 0x40831e
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x101c]
push eax
call fcn.0040e770
cmp byte [ebp - 0x101c], 0
pop ecx
mov ebx, 0x80000001
pop ecx
mov dword [ebp + 8], ebx
lea edi, [ebp - 0x101c]
lea esi, [ebp - 0x101c]
je 0x408263
mov al, byte [esi]
cmp al, 0x5c
je 0x408263
push eax
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x40825d
inc esi
inc esi
jmp 0x40825e
inc esi
cmp byte [esi], 0
jne 0x408248
cmp byte [esi], 0x5c
jne 0x408275
and byte [esi], 0
inc esi
mov dword [ebp - 8], 1
jmp 0x408279
and dword [ebp - 8], 0
lea eax, [ebp - 0x101c]
push str.HKEY_CLASSES_ROOT
push eax
call fcn.0040f5b0
pop ecx
test eax, eax
pop ecx
jne 0x40829d
mov dword [ebp + 8], 0x80000000
mov edi, esi
xor ebx, ebx
jmp 0x408304
lea eax, [ebp - 0x101c]
push str.HKEY_CURRENT_USER
push eax
call fcn.0040f5b0
pop ecx
test eax, eax
pop ecx
jne 0x4082b9
mov dword [ebp + 8], ebx
jmp 0x408297
lea eax, [ebp - 0x101c]
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.0040f5b0
pop ecx
test eax, eax
pop ecx
jne 0x4082d9
mov dword [ebp + 8], 0x80000002
jmp 0x408297
lea eax, [ebp - 0x101c]
push str.HKEY_USERS
push eax
call fcn.0040f5b0
pop ecx
test eax, eax
pop ecx
jne 0x4082f9
mov dword [ebp + 8], 0x80000003
jmp 0x408297
xor ebx, ebx
cmp dword [ebp - 8], ebx
je 0x408304
mov byte [esi - 1], 0x5c
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
test eax, eax
je 0x408322
xor eax, eax
jmp 0x408368
push ebx
lea eax, [ebp - 0x18]
push ebx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x10], ebx
ja 0x40835c
push 1
pop eax
cmp dword [ebp - 0x1c], eax
ja 0x40835c
cmp dword [ebp - 0x14], ebx
ja 0x40835c
cmp dword [ebp - 0x18], ebx
ja 0x40835c
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop ebx
leave
ret
Function at 0x4086fc
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.0040ef00
and dword [ebp - 8], 0
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x40889c
push dword [ebp + 8]
lea eax, [ebp - 0x2010]
push eax
call fcn.0040e743
lea eax, [ebp - 0x2010]
push eax
call fcn.00408084
add esp, 0xc
test eax, eax
jne 0x408744
push 1
pop eax
jmp 0x4088ec
xor ecx, ecx
mov ebx, 0x80000001
cmp word [ebp - 0x2010], cx
mov dword [ebp + 8], ebx
lea edi, [ebp - 0x2010]
lea esi, [ebp - 0x2010]
je 0x408782
mov ax, word [esi]
cmp ax, 0x5c
je 0x408782
and ax, 0xfc00
cmp ax, 0xd800
jne 0x40877b
add esi, 4
jmp 0x40877d
inc esi
inc esi
cmp word [esi], cx
jne 0x408763
cmp word [esi], 0x5c
jne 0x408799
mov dword [ebp - 0x10], esi
mov word [esi], cx
inc esi
mov dword [ebp - 4], 1
inc esi
jmp 0x40879c
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x2010]
push 0x42b3cc
push eax
call fcn.0040f634
pop ecx
test eax, eax
pop ecx
jne 0x4087be
mov dword [ebp + 8], 0x80000000
mov edi, esi
jmp 0x40882a
lea eax, [ebp - 0x2010]
push 0x42b3a8
push eax
call fcn.0040f634
pop ecx
test eax, eax
pop ecx
jne 0x4087da
mov dword [ebp + 8], ebx
jmp 0x4087ba
lea eax, [ebp - 0x2010]
push 0x42b380
push eax
call fcn.0040f634
pop ecx
test eax, eax
pop ecx
jne 0x4087fa
mov dword [ebp + 8], 0x80000002
jmp 0x4087ba
lea eax, [ebp - 0x2010]
push 0x42b368
push eax
call fcn.0040f634
pop ecx
test eax, eax
pop ecx
jne 0x40881a
mov dword [ebp + 8], 0x80000003
jmp 0x4087ba
cmp dword [ebp - 4], 0
je 0x40882a
and dword [ebp - 4], 0
mov word [esi - 2], 0x5c
push edi
call fcn.0040e8db
pop ecx
lea eax, [edi + eax*2]
cmp eax, edi
jbe 0x408849
cmp word [eax], 0x5c
je 0x40884f
push edi
push eax
call fcn.00403136
pop ecx
pop ecx
jmp 0x408834
cmp word [eax], 0x5c
jne 0x408859
xor ebx, ebx
lea esi, [eax + 2]
mov word [eax], bx
jmp 0x40885d
mov esi, eax
xor ebx, ebx
cmp esi, edi
jbe 0x40889c
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40889c
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x40888e
mov dword [ebp - 8], 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
jne 0x4088a0
xor eax, eax
jmp 0x4088ec
push edi
call fcn.0040e8db
pop ecx
lea eax, [edi + eax*2]
cmp eax, edi
jbe 0x4088bf
cmp word [eax], 0x5c
je 0x4088c5
push edi
push eax
call fcn.00403136
pop ecx
pop ecx
jmp 0x4088aa
cmp word [eax], 0x5c
jne 0x4088e9
cmp dword [ebp - 4], ebx
mov word [eax], bx
je 0x4088d5
mov eax, dword [ebp - 0x10]
mov word [eax], 0x5c
lea eax, [ebp - 0x2010]
push eax
call fcn.004086fc
test eax, eax
pop ecx
jne 0x4088e9
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4088f1
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0040ef00
and dword [ebp - 8], 0
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x408a83
push dword [ebp + 8]
lea eax, [ebp - 0x1010]
push eax
call fcn.0040e770
lea eax, [ebp - 0x1010]
push eax
call fcn.004081fc
add esp, 0xc
test eax, eax
jne 0x408939
push 1
pop eax
jmp 0x408ace
cmp byte [ebp - 0x1010], 0
mov ebx, 0x80000001
mov dword [ebp + 8], ebx
lea edi, [ebp - 0x1010]
lea esi, [ebp - 0x1010]
je 0x408971
mov al, byte [esi]
cmp al, 0x5c
je 0x408971
push eax
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x40896b
inc esi
inc esi
jmp 0x40896c
inc esi
cmp byte [esi], 0
jne 0x408956
cmp byte [esi], 0x5c
jne 0x408986
and byte [esi], 0
mov dword [ebp - 0x10], esi
inc esi
mov dword [ebp - 4], 1
jmp 0x40898a
and dword [ebp - 4], 0
lea eax, [ebp - 0x1010]
push str.HKEY_CLASSES_ROOT
push eax
call fcn.0040f5b0
pop ecx
test eax, eax
pop ecx
jne 0x4089ac
mov dword [ebp + 8], 0x80000000
mov edi, esi
jmp 0x408a16
lea eax, [ebp - 0x1010]
push str.HKEY_CURRENT_USER
push eax
call fcn.0040f5b0
pop ecx
test eax, eax
pop ecx
jne 0x4089c8
mov dword [ebp + 8], ebx
jmp 0x4089a8
lea eax, [ebp - 0x1010]
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.0040f5b0
pop ecx
test eax, eax
pop ecx
jne 0x4089e8
mov dword [ebp + 8], 0x80000002
jmp 0x4089a8
lea eax, [ebp - 0x1010]
push str.HKEY_USERS
push eax
call fcn.0040f5b0
pop ecx
test eax, eax
pop ecx
jne 0x408a08
mov dword [ebp + 8], 0x80000003
jmp 0x4089a8
cmp dword [ebp - 4], 0
je 0x408a16
and dword [ebp - 4], 0
mov byte [esi - 1], 0x5c
push edi
call fcn.0040e860
pop ecx
add eax, edi
cmp eax, edi
jbe 0x408a33
cmp byte [eax], 0x5c
je 0x408a38
push edi
push eax
call fcn.004031aa
pop ecx
pop ecx
jmp 0x408a1f
cmp byte [eax], 0x5c
jne 0x408a40
and byte [eax], 0
lea esi, [eax + 1]
jmp 0x408a42
mov esi, eax
cmp esi, edi
jbe 0x408a83
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
push 0x20019
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408a83
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x408a75
mov dword [ebp - 8], 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
jne 0x408a87
xor eax, eax
jmp 0x408ace
push edi
call fcn.0040e860
pop ecx
add eax, edi
cmp eax, edi
jbe 0x408aa4
cmp byte [eax], 0x5c
je 0x408aa9
push edi
push eax
call fcn.004031aa
pop ecx
pop ecx
jmp 0x408a90
cmp byte [eax], 0x5c
jne 0x408acb
and byte [eax], 0
cmp dword [ebp - 4], ebx
je 0x408ab7
mov eax, dword [ebp - 0x10]
mov byte [eax], 0x5c
lea eax, [ebp - 0x1010]
push eax
call fcn.004088f1
test eax, eax
pop ecx
jne 0x408acb
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408ad3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0040ef00
and dword [ebp - 8], 0
cmp dword [ebp + 0x14], 0
push esi
push edi
je 0x408c30
push dword [ebp + 0x14]
lea eax, [ebp - 0x200c]
push eax
call fcn.0040e743
pop ecx
mov dword [ebp + 0x14], 0x80000001
pop ecx
lea edi, [ebp - 0x200c]
xor ecx, ecx
lea esi, [ebp - 0x200c]
cmp word [ebp - 0x200c], cx
je 0x408b3e
mov ax, word [esi]
cmp ax, 0x5c
je 0x408b3e
and ax, 0xfc00
cmp ax, 0xd800
jne 0x408b37
add esi, 4
jmp 0x408b39
inc esi
inc esi
cmp word [esi], cx
jne 0x408b1f
cmp word [esi], 0x5c
jne 0x408b52
mov word [esi], cx
inc esi
inc esi
mov dword [ebp - 0xc], 1
jmp 0x408b55
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0x200c]
push 0x42b3cc
push eax
call fcn.0040f634
pop ecx
test eax, eax
pop ecx
jne 0x408b77
mov dword [ebp + 0x14], 0x80000000
mov edi, esi
jmp 0x408be3
lea eax, [ebp - 0x200c]
push 0x42b3a8
push eax
call fcn.0040f634
pop ecx
test eax, eax
pop ecx
jne 0x408b97
mov dword [ebp + 0x14], 0x80000001
jmp 0x408b73
lea eax, [ebp - 0x200c]
push 0x42b380
push eax
call fcn.0040f634
pop ecx
test eax, eax
pop ecx
jne 0x408bb7
mov dword [ebp + 0x14], 0x80000002
jmp 0x408b73
lea eax, [ebp - 0x200c]
push 0x42b368
push eax
call fcn.0040f634
pop ecx
test eax, eax
pop ecx
jne 0x408bd7
mov dword [ebp + 0x14], 0x80000003
jmp 0x408b73
cmp dword [ebp - 0xc], 0
je 0x408be3
mov word [esi - 2], 0x5c
push edi
call fcn.0040e8db
pop ecx
lea eax, [edi + eax*2]
cmp eax, edi
jbe 0x408c02
cmp word [eax], 0x5c
je 0x408c08
push edi
push eax
call fcn.00403136
pop ecx
pop ecx
jmp 0x408bed
cmp word [eax], 0x5c
jne 0x408c11
and word [eax], 0
lea esi, [eax + 2]
jmp 0x408c13
mov esi, eax
cmp esi, edi
jbe 0x408c30
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push edi
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x408c34
xor eax, eax
jmp 0x408c60
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408c54
mov dword [ebp - 8], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret