joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411820
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
mov dword [ebp - 4], 0xbed
mov eax, dword [0x75a400]
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x75a404]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0x2d16
mov dword [ebp - 0x1c], 0x3377
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
movzx edx, byte [ebp - 0x24]
add edx, 0x30d0
sub edx, dword [ebp - 0x14]
and edx, dword [ebp - 0x18]
mov eax, 0x4af4
sub eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 4]
movzx ecx, word [ebp - 4]
add eax, ecx
or edx, eax
mov dword [ebp - 8], edx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
movzx eax, byte [ebp - 0x24]
movzx ecx, word [ebp - 8]
sub ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
lea ecx, [ecx + esi + 0x1e5b]
and eax, ecx
or edx, eax
movzx eax, byte [ebp - 0x20]
add eax, dword [ebp - 0x28]
or edx, eax
mov dword [ebp - 0x1c], edx
movzx ecx, word [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x28]
movzx edx, word [ebp - 0xc]
add edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
or ecx, edx
mov dword [ebp - 0x2c], ecx
movzx eax, byte [ebp - 0x24]
add eax, dword [ebp - 4]
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
mov ecx, 0x158e
sub ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
and ecx, dword [ebp - 0x20]
or eax, ecx
mov dword [ebp - 0x2c], eax
call fcn.004119d0
cmp dword [ebp - 0x20], 0x1d64
jb 0x41195b
push 0
push 0
push 0
push 0
push 0x12c
push 4
push 2
push str.gadrenhd
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [ebp - 0xc], eax
movzx edx, word [ebp - 0x28]
movzx eax, byte [ebp - 0x18]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x14]
add eax, ecx
movzx ecx, byte [ebp - 0xc]
add eax, dword [ebp - 0xc]
lea eax, [ecx + eax - 0x32c1]
movzx ecx, byte [ebp - 0x10]
sub eax, ecx
or edx, eax
or edx, dword [ebp - 4]
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x18]
imul edx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
sub eax, edx
add eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x14]
movzx ecx, byte [ebp - 8]
sub eax, ecx
sub eax, dword [ebp - 8]
and eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
push str.fnsaeeae
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 4]
xor edx, 0x1994
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
or edx, eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x20]
movzx eax, word [ebp - 0x14]
lea ecx, [ecx + eax - 0x11af]
and ecx, 0x2f0a
or edx, ecx
mov dword [ebp - 0xc], edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10840058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x108401a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1084007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1084006a
add dl, dl
jne 0x10840089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x108400dc
xor eax, eax
add dl, dl
jne 0x10840096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1084017d
add dl, dl
jne 0x108400a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108400b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108400bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108400c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x108400d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10840075
mov eax, 1
add dl, dl
jne 0x108400ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108400f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x108400e1
sub eax, ebx
mov ebx, 1
jne 0x10840128
mov ecx, 1
add dl, dl
jne 0x1084010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10840119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10840105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10840075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1084013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1084014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10840136
cmp eax, 0x7d00
jae 0x1084016d
cmp eax, 0x500
jb 0x10840168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10840075
cmp eax, 0x7f
ja 0x10840170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10840075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1084019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10840075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x1d6c760b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x285d700b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40141b
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x401408
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x401438
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret

Function at 0x401845
Capabilities:
Get file size

Disassembly:
mov eax, 0x10014
call fcn.0040c840
mov eax, dword [0x421050]
xor eax, esp
mov dword [esp + 0x10010], eax
mov eax, dword [esp + 0x10018]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ebp, ebp
push edi
push ebp
push ebp
push 3
push ebp
push 1
push 0x80000000
push ecx
mov ebx, edx
mov dword [esp + 0x38], eax
mov dword [eax], ebp
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x401a0a
push ebp
push ebp
push 3
push ebp
push 1
push 0x80000000
push ebx
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x4019f1
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebp
push edi
call ebx
push ebp
push esi
mov dword [esp + 0x1c], eax
call ebx
mov ebx, dword [esp + 0x14]
cmp ebx, 0xffffffff
je 0x4019f1
cmp eax, 0xffffffff
je 0x4019f1
cmp ebx, eax
jne 0x4019e1
mov eax, ebx
mov dword [esp + 0x14], ebp
shr eax, 0xf
and ebx, 0x7fff
mov dword [esp + 0x18], eax
test eax, eax
je 0x401986
push ebp
lea eax, [esp + 0x14]
push eax
push 0x8000
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4019f1
mov ecx, 0x8000
cmp dword [esp + 0x10], ecx
jne 0x4019f1
push ebp
lea eax, [esp + 0x14]
push eax
push ecx
lea eax, [esp + 0x802c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4019f1
cmp dword [esp + 0x10], 0x8000
jne 0x4019f1
lea edx, [esp + 0x20]
mov ecx, ebp
mov eax, dword [edx + ecx*4]
lea edx, [esp + 0x8020]
cmp eax, dword [edx + ecx*4]
lea edx, [esp + 0x20]
jne 0x4019e1
inc ecx
cmp ecx, 0x2000
jne 0x401957
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x18]
jb 0x4018f7
test ebx, ebx
je 0x4019e6
push ebp
lea eax, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4019f1
cmp dword [esp + 0x10], ebx
jne 0x4019f1
push ebp
lea eax, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x802c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4019f1
cmp dword [esp + 0x10], ebx
jne 0x4019f1
push ebx
lea eax, [esp + 0x8024]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004100ee
add esp, 0xc
test eax, eax
je 0x4019e6
xor ebp, ebp
inc ebp
jmp 0x4019f1
mov eax, dword [esp + 0x1c]
xor ecx, ecx
inc ecx
mov ebp, ecx
mov dword [eax], ecx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x401a03
cmp esi, 0xffffffff
je 0x401a03
push esi
call ebx
test edi, edi
je 0x401a0a
push edi
call ebx
mov ecx, dword [esp + 0x10020]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00404d91
add esp, 0x10014
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x374f46b2
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x2840378d
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
nop
mov ecx, 0x266874d9
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x12d93066
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4060b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov byte [ebp - 1], 0
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4060df
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x80
je 0x4060dd
mov byte [ebp - 1], 1
jmp 0x4060f6
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x80
je 0x4060f6
mov byte [ebp - 1], 1
movzx edx, byte [ebp - 1]
test edx, edx
je 0x406112
push 0
push 0xf012
push 0x112
mov ecx, dword [ebp - 8]
call fcn.00408b40
mov esp, ebp
pop ebp
ret

Function at 0x407aa0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e1368
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x56f734]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
push 0
push str.CUH:_CheckCuhMutex_called
call fcn.004313d0
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
push str.corel.cuh.msg
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x78], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb7
jne 0x407b5a
push 0xffffffffffffffff
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x78], 0
je 0x407b4f
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x78], 0
mov ecx, dword [ebp - 0x14]
call fcn.00407aa0
mov dword [ebp - 0x18], eax
jmp 0x407b62
mov dword [ebp - 4], 0xffffffff
jmp 0x407b72
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409040
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e148b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x56f734]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x18]
call fcn.00414370
mov dword [ebp - 4], 0
push 3
mov ecx, dword [ebp + 0x10]
push ecx
push 0x4fe200
lea ecx, [ebp - 0x18]
call fcn.004147c0
push eax
push 0x4fe204
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004142e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x409340
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e14b1
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x56f734]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x219], 1
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x228], 0
push 0x4fe220
lea ecx, [ebp - 0x238]
call fcn.00414370
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.004147c0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x409416
push 0x4fe23c
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x409409
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0x8023
push 0
call dword [ebp - 0x228]
test eax, eax
jl 0x409409
mov dword [ebp - 0x220], 1
mov byte [ebp - 0x219], 0
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, byte [ebp - 0x219]
test eax, eax
je 0x409472
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Common_Application_Data
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov dword [ebp - 0x220], 1
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.004142e0
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004df9ac
mov esp, ebp
pop ebp
ret 4
Function at 0x409cb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x409d2e
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.MSVCR120.dll_wcslen]
add esp, 4
shl eax, 1
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 1
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x409d24
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x409d40
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x409da6
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x409d9c
mov dword [ebp - 0xc], 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x409db0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e1657
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x56f734]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x30]
call fcn.004142b0
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 0x1000
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
call fcn.00414860
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x409e39
cmp dword [ebp - 0x14], 1
je 0x409e48
cmp dword [ebp - 0x14], 2
je 0x409e48
push 0x4fe2d4
lea ecx, [ebp - 0x30]
call fcn.00414580
jmp 0x409ebb
push 0xffffffffffffffff
lea ecx, [ebp - 0x30]
call fcn.00414900
lea ecx, [ebp - 0x30]
call fcn.00414af0
cmp dword [ebp - 0x14], 2
jne 0x409ebb
mov dword [ebp - 0x10], 0x1000
lea ecx, [ebp - 0x3c]
call fcn.004142b0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00414860
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
lea ecx, [ebp - 0x30]
call fcn.004147c0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c]
call fcn.00414900
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x30]
call fcn.004145d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
call fcn.004142e0
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00414300
mov edx, dword [ebp - 0x18]
or edx, 1
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004142e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x409ff0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40a05b
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40a051
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40a1d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
jbe 0x40a243
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40a243
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 3
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40a239
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x40a250
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40a2a9
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x40a29f
mov dword [ebp - 8], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40abf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e17a5
mov eax, dword fs:[0]
push eax
mov eax, 0x102c
call fcn.004dfa50
mov eax, dword [0x56f734]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x1038]
call fcn.004142b0
mov dword [ebp - 4], 0
mov dword [ebp - 0x1020], 0
lea eax, [ebp - 0x1020]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x102c], eax
cmp dword [ebp - 0x102c], 0
je 0x40ac8a
mov byte [ebp - 0x1016], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1038]
call fcn.004142e0
mov al, byte [ebp - 0x1016]
jmp 0x40ad59
mov dword [ebp - 0x1028], 0x800
mov dword [ebp - 0x1024], 0
mov dword [ebp - 0x101c], 0
jmp 0x40acb9
mov eax, dword [ebp - 0x101c]
add eax, 1
mov dword [ebp - 0x101c], eax
cmp dword [ebp - 0x1024], 0
jne 0x40ad3a
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x1028]
push ecx
lea edx, [ebp - 0x1014]
push edx
mov eax, dword [ebp - 0x101c]
push eax
mov ecx, dword [ebp - 0x1020]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x1024], eax
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.MSVCR120.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x40ad2b
mov byte [ebp - 0x1017], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1038]
call fcn.004142e0
mov al, byte [ebp - 0x1017]
jmp 0x40ad59
mov dword [ebp - 0x1028], 0x800
jmp 0x40acaa
mov byte [ebp - 0x1015], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1038]
call fcn.004142e0
mov al, byte [ebp - 0x1015]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004df9ac
mov esp, ebp
pop ebp
ret