joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5061
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5374e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0
mov dword [ebp - 0x228], esi
push dword [ecx + 0x34]
push eax
call fcn.004296e0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0049a810
add esp, 0xc
mov dword [ebp - 0x224], 1
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push str.latest_click
push dword [ebp - 0x21c]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x428ef5
call fcn.0040db10
mov ecx, eax
test ecx, ecx
je 0x428f7b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
test eax, 0xffff0000
jne 0x428ea2
movzx eax, ax
mov ecx, esi
push eax
call fcn.00414690
jmp 0x428ece
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428eb0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040dd50
mov edi, dword [ebp - 0x21c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x428f5c
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x428f5c
call fcn.0040db10
mov ecx, eax
test ecx, ecx
je 0x428f85
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, 0x502788
mov byte [ebp - 4], 2
mov ecx, esi
test eax, 0xffff0000
jne 0x428f2b
movzx eax, ax
push eax
call fcn.00414690
jmp 0x428f37
push 0
push 0x502788
call fcn.0040dd50
mov edx, dword [ebp - 0x21c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x428f5c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004034a0
push 0x80004005
call fcn.004034a0
int3
Function at 0x428f90
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f50bc
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5374e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x228], edi
call fcn.0049a810
add esp, 0xc
call fcn.0040db10
mov ecx, eax
test ecx, ecx
je 0x4291a0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov eax, str.SOFTWARELuDaShi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
test eax, 0xffff0000
jne 0x42901d
movzx eax, ax
push eax
call fcn.00414690
jmp 0x429029
push 0x10
push str.SOFTWARELuDaShi
call fcn.0040dd50
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 1
push eax
push str.Setup_Path
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x220], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
je 0x429120
push str.Utilsmininews.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x429120
call fcn.0040db10
mov ecx, eax
test ecx, ecx
je 0x4291aa
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
test eax, 0xffff0000
jne 0x4290d8
movzx eax, ax
mov ecx, edi
push eax
call fcn.00414690
jmp 0x4290ff
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4290e1
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.0040dd50
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x429181
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x429181
call fcn.0040db10
mov ecx, eax
test ecx, ecx
je 0x4291b4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, 0x502788
mov byte [ebp - 4], 3
mov ecx, edi
test eax, 0xffff0000
jne 0x429156
movzx eax, ax
push eax
call fcn.00414690
jmp 0x429162
push 0
push 0x502788
call fcn.0040dd50
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x429181
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004034a0
push 0x80004005
call fcn.004034a0
push 0x80004005
call fcn.004034a0
int3
Function at 0x4291c0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f511c
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5374e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x228], edi
call fcn.0049a810
add esp, 0xc
call fcn.0040db10
mov ecx, eax
test ecx, ecx
je 0x4293d0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov eax, str.SOFTWARELdsLite
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
test eax, 0xffff0000
jne 0x42924d
movzx eax, ax
push eax
call fcn.00414690
jmp 0x429259
push 0x10
push str.SOFTWARELdsLite
call fcn.0040dd50
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 1
push eax
push str.Setup_Path
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x220], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
je 0x429350
push str.Utilsmininews.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x429350
call fcn.0040db10
mov ecx, eax
test ecx, ecx
je 0x4293da
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
test eax, 0xffff0000
jne 0x429308
movzx eax, ax
mov ecx, edi
push eax
call fcn.00414690
jmp 0x42932f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x429311
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.0040dd50
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4293b1
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x4293b1
call fcn.0040db10
mov ecx, eax
test ecx, ecx
je 0x4293e4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, 0x502788
mov byte [ebp - 4], 3
mov ecx, edi
test eax, 0xffff0000
jne 0x429386
movzx eax, ax
push eax
call fcn.00414690
jmp 0x429392
push 0
push 0x502788
call fcn.0040dd50
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4293b1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004034a0
push 0x80004005
call fcn.004034a0
push 0x80004005
call fcn.004034a0
int3
Function at 0x4298f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5211
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5374e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0
mov dword [ebp - 0x228], esi
push dword [ecx + 0x34]
push eax
call fcn.004296e0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0049a810
add esp, 0xc
mov dword [ebp - 0x224], 1
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push str.repop_time_slot
push dword [ebp - 0x21c]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x429a25
call fcn.0040db10
mov ecx, eax
test ecx, ecx
je 0x429aab
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
test eax, 0xffff0000
jne 0x4299d2
movzx eax, ax
mov ecx, esi
push eax
call fcn.00414690
jmp 0x4299fe
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4299e0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040dd50
mov edi, dword [ebp - 0x21c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x429a8c
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x429a8c
call fcn.0040db10
mov ecx, eax
test ecx, ecx
je 0x429ab5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, 0x502788
mov byte [ebp - 4], 2
mov ecx, esi
test eax, 0xffff0000
jne 0x429a5b
movzx eax, ax
push eax
call fcn.00414690
jmp 0x429a67
push 0
push 0x502788
call fcn.0040dd50
mov edx, dword [ebp - 0x21c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x429a8c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004034a0
push 0x80004005
call fcn.004034a0
int3
Function at 0x429af0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5253
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push ebx
push esi
push edi
mov eax, dword [0x5374e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x90]
xor ebx, ebx
call fcn.004267a0
push ebx
lea ecx, [ebp - 0x90]
mov dword [ebp - 4], ebx
call fcn.0042a9d0
test eax, eax
je 0x429cad
mov dword [ebp - 0x14], ebx
call fcn.0040db10
mov ecx, eax
test ecx, ecx
je 0x429ccc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, str.SOFTWAREQiLu_Inc.mininews_lite
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x10]
test eax, 0xffff0000
jne 0x429b7a
movzx eax, ax
push eax
call fcn.00414690
jmp 0x429b86
push 0x20
push str.SOFTWAREQiLu_Inc.mininews_lite
call fcn.0040dd50
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 4
push eax
push str.lite_show
push esi
push SysReAllocStringLen
mov dword [ebp - 0x18], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edi, eax
neg edi
sbb edi, edi
add esi, 0xfffffff0
inc edi
or ecx, 0xffffffff
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x429bd7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x429be5
cmp dword [ebp - 0x14], 0
je 0x429cad
push 1
lea ecx, [ebp - 0x90]
call fcn.0042a9d0
lea ecx, [ebp - 0x90]
test eax, eax
je 0x429cb3
push 0
push 3
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
call fcn.004296e0
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], 4
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], 4
push ecx
push str.desktop_show
push dword [eax]
push SysReAllocStringLen
call edi
mov edx, dword [ebp - 0x10]
neg eax
sbb esi, esi
add edx, 0xfffffff0
inc esi
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x429c62
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x429c6c
cmp dword [ebp - 0x14], 0
je 0x429cad
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x28], 4
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 4
push eax
push str.Mask_Flag
push str.SOFTWARELuDaShi
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x429ca8
test byte [ebp - 0x20], 1
jne 0x429cad
mov ebx, 1
lea ecx, [ebp - 0x90]
call fcn.00426d40
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004034a0
int3
Function at 0x42a6d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5398
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5374e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
push 0
mov edi, 0x12c
mov dword [ebp - 0x10], 0
mov dword [ebx], 0x493e0
mov dword [ebx + 4], 0
push dword [eax + 0x34]
push ecx
mov ecx, eax
call fcn.004296e0
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x18]
mov dword [ebp + 8], 4
push eax
push str.auto_elapse
push dword [ebp - 0x1c]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jle 0x42a77d
mov eax, ecx
cdq
mov dword [ebx], eax
mov eax, 0x10624dd3
mov dword [ebx + 4], edx
imul ecx
sar edx, 6
mov edi, edx
shr edi, 0x1f
add edi, edx
call fcn.0040db10
mov ecx, eax
test ecx, ecx
je 0x42a8b5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
mov eax, str.mininews.exe
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
test eax, 0xffff0000
jne 0x42a7b5
movzx eax, ax
push eax
call fcn.00414690
jmp 0x42a7c1
push 0xc
push str.mininews.exe
call fcn.0040dd50
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
push eax
call fcn.0042afc0
mov edx, dword [ebp + 8]
or esi, 0xffffffff
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov ecx, esi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x42a7f8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x42a86a
mov ecx, dword [ebp - 0x14]
call fcn.00428bd0
mov ecx, edx
mov dword [ebp + 8], eax
push ecx
push eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
push dword [eax + 0x34]
push str._mini_utils_from__d___elapseColseTime__d
push eax
call fcn.0042c1f0
mov eax, edi
add esp, 0x14
cdq
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
cmp eax, edx
jg 0x42a8a1
mov ecx, dword [ebp + 8]
jl 0x42a839
cmp ecx, dword [ebp - 0x14]
jae 0x42a8a1
test eax, eax
jl 0x42a8a1
jg 0x42a843
test ecx, ecx
je 0x42a8a1
push 0
imul eax, edi, 0x3e8
push 0x3e8
push dword [ebp - 0x18]
push ecx
cdq
mov esi, eax
mov edi, edx
call fcn.0046ad40
sub esi, eax
mov dword [ebx], esi
sbb edi, edx
or esi, 0xffffffff
mov dword [ebx + 4], edi
xor edi, edi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x42a88b
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebx], 0
mov edi, 1
mov dword [ebx + 4], 0
jmp 0x42a86c
push 0x80004005
call fcn.004034a0
int3
Function at 0x42afc0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f54bb
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x5374e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
push eax
push 0
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.00425f30
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x42b03b
xor ebx, ebx
jmp 0x42b0d0
push 0x228
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.0049a810
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x42b077
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x42b0d0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
nop
cmp ebx, dword [ebp - 0x234]
je 0x42b0b6
mov esi, dword [ebp - 0x248]
cmp esi, dword [ebp - 0x244]
je 0x42b0b6
lea eax, [ebp - 0x218]
push eax
push dword [esi]
call fcn.004c7d36
add esp, 8
test eax, eax
je 0x42b120
add esi, 4
cmp esi, dword [ebp - 0x244]
jne 0x42b096
lea eax, [ebp - 0x23c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42b080
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x248]
mov dword [ebp - 4], 1
test eax, eax
je 0x42b131
push dword [ebp - 0x244]
lea ecx, [ebp - 0x248]
push eax
call fcn.00423000
mov ecx, dword [ebp - 0x240]
mov edx, dword [ebp - 0x248]
sub ecx, edx
and ecx, 0xfffffffc
mov eax, edx
cmp ecx, 0x1000
jb 0x42b127
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42b14f
jmp 0x42b127
mov ebx, 1
jmp 0x42b0c9
push ecx
push edx
call fcn.0046a786
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret
call fcn.004a5748
int3
Function at 0x42bc10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push esi
mov edi, ecx
call fcn.0042dca0
test esi, esi
mov esi, dword [sym.imp.USER32.dll_KillTimer]
jne 0x42bcc2
push 0
push dword [edi + 0x34]
lea eax, [ebp - 4]
mov dword [ebp + 8], 0
push eax
mov ecx, edi
call fcn.004296e0
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp + 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push str.auto_24_elapse
push dword [ebp - 4]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp + 8]
mov ecx, 0x5265c00
mov edx, dword [ebp - 4]
test eax, eax
cmovle eax, ecx
add edx, 0xfffffff0
mov dword [ebp - 0x10], eax
mov dword [ebp + 8], eax
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42bca5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x17d5
push dword [edi + 4]
call esi
push 0
push dword [ebp - 0x10]
push 0x17d5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [edi + 0x50], 0
mov eax, dword [edi + 4]
je 0x42bce3
push str.Has_pop_second_times__will_NOT_pop_again.
push dword [edi + 0x48]
call fcn.0042c1f0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x19c8
push eax
mov dword [edi + 0x44], eax
call esi
push 0
lea ecx, [edi + 0x40]
call fcn.004282f0
push eax
push 0x19c8
push dword [edi + 0x44]
call dword [sym.imp.USER32.dll_SetTimer]
lea ecx, [edi + 0x40]
call fcn.004282f0
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
push edx
push str.start_timer_to_check_repop__seconds_d
push dword [edi + 0x48]
call fcn.0042c1f0
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42c1f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5716
mov eax, dword fs:[0]
push eax
sub esp, 0x408
mov eax, dword [0x5374e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x30], 0
je 0x42c32e
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.0049a810
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x410]
push 0x1ff
push eax
call fcn.0040d250
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004b8b28
or edi, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, edi
test eax, eax
js 0x42c280
cmp eax, 0x1ff
ja 0x42c280
jne 0x42c286
xor eax, eax
mov word [ebp - 0x12], ax
call fcn.0040db10
mov ecx, eax
test ecx, ecx
je 0x42c349
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x414], eax
mov eax, 0x507b4c
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x414]
test eax, 0xffff0000
jne 0x42c2c7
movzx eax, ax
push eax
call fcn.00414690
jmp 0x42c2d3
push 0xd
push 0x507b4c
call fcn.0040dd50
lea ecx, [ebp - 0x410]
mov dword [ebp - 4], 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42c2e3
sub ecx, edx
lea eax, [ebp - 0x410]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x414]
call fcn.0041db20
mov esi, dword [ebp - 0x414]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x42c32e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046a581
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004034a0
int3