joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406128
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406358
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4061ab
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406358
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4061ab
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406374
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x406234
xor eax, eax
push ebp
push 0x40622d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405f70
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406212
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406394
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x406212
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406234
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40634e
cmp byte [ebp - 0xd], 0
jne 0x40627b
cmp byte [ebp - 0x12], 0
je 0x40634e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406294
dec ebx
cmp byte [ebx], 0x2e
je 0x4062a3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406293
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40634e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4062e0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40634e
cmp byte [ebp - 0xd], 0
je 0x40634e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40634e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406a80
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406ae6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404c00
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403374
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406ad0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406aed
lea eax, [ebp - 0x10]
call fcn.00404980
ret

Function at 0x409220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404e50
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409239
test al, 0x10
jne 0x40923d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40932c
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404e50
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x409340
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404e50
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x409362
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40c1d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c209
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404a70
jmp 0x40c212
mov eax, ebx
mov edx, esi
call fcn.004049d4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c21c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c23d
mov al, byte [esp]
jmp 0x40c23f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40c8c4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c73c
mov eax, dword [0x47bd38]
cmp byte [eax], 0
je 0x40c940
mov eax, dword [0x47bb78]
call fcn.00402f48
call fcn.004028b4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00409888
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c988
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c976
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x47bb34]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x47c668]
call fcn.00405f34
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40d818
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d87c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404c00
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408d90
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d883
lea eax, [ebp - 0xc]
call fcn.00404980
ret

Function at 0x417be4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x417c78
push 0
mov eax, ebx
call fcn.00404e50
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x417c53
mov eax, esi
call fcn.00404c50
inc eax
push eax
mov eax, esi
call fcn.00404e50
push eax
push 1
push 0
mov eax, edi
call fcn.00404e50
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x417c6e
mov ecx, dword [0x47bb88]
mov dl, 1
mov eax, dword [0x4162b4]
call fcn.0040ca48
call fcn.004042d4
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x420e60
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00420cb8
dec esi
jne 0x420e82
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x425258
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.004031d4
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x47be34]
cmp byte [edx + 0xc], 0
je 0x4252bc
mov edx, dword [0x47be2c]
cmp dword [edx], 2
jne 0x4252bc
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret

Function at 0x4252c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x425378
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00425258
test al, al
je 0x42535a
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00404a70
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x42535a
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404e50
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.00404e50
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00404b88
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x425313
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42537f
lea eax, [ebp - 0x2c]
call fcn.00404980
lea eax, [ebp - 0xc]
call fcn.00404980
ret

Function at 0x425540
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00424f7c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404e50
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x42559e
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x47bc64]
mov dl, 1
mov eax, dword [0x424e74]
call fcn.0040cb18
call fcn.004042d4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4255a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404e50
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x425600
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x47be44]
mov dl, 1
mov eax, dword [0x424e74]
call fcn.0040cb18
call fcn.004042d4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00424fac
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42689c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
call fcn.00404b88
cmp dword [ebx], 0
je 0x4268da
mov eax, dword [ebx]
call fcn.00404c50
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4268da
mov eax, ebx
mov edx, 0x4268ec
call fcn.00404c58
add esp, 0x108
pop ebx
ret

Function at 0x427aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e40
xor eax, eax
push ebp
push 0x427b5c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x427b34
push dword fs:[esi]
mov dword fs:[esi], esp
test bl, bl
je 0x427af6
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00408a2c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00404a18
mov ebx, 1
mov eax, dword [ebp - 4]
call fcn.00404c50
test eax, eax
jle 0x427b27
mov edx, 1
imul ecx, ebx, 0x5517e877
mov ebx, ecx
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx - 1]
xor ebx, dword [ecx*4 + 0x4795a8]
inc edx
dec eax
jne 0x427b0c
mov dword [ebp - 8], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427b3e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427b63
lea eax, [ebp - 0xc]
call fcn.00404980
lea eax, [ebp - 4]
call fcn.00404980
ret
Function at 0x427b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e40
xor eax, eax
push ebp
push 0x427c6c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor eax, eax
push ebp
push 0x427c44
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x427bcf
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00408a2c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00404a18
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
call fcn.00404c50
mov ebx, eax
test ebx, ebx
jle 0x427c2e
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00405a38
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x4799ac]
mov eax, dword [eax*8 + 0x4799a8]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x427bf0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427c4e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427c73
lea eax, [ebp - 0x1c]
call fcn.00404980
lea eax, [ebp - 4]
call fcn.00404980
ret

Function at 0x428c70
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x428cae
call sub.kernel32.dll_GetLastError_1
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
jmp 0x428cff
lea eax, [ebp - 0xc]
push eax
mov ax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x428ce2
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x428ce2
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle_1
mov ax, word [ebp + 0xc]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x429d14
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, esi
mov edx, dword [ebp + 0xc]
call fcn.004049d4
xor edx, edx
push ebp
push 0x429e3c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x110]
mov ecx, 0xff
mov edx, edi
call fcn.00409930
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
je 0x429d76
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x429e46
lea eax, [ebp - 0x210]
mov ecx, 0xff
mov edx, dword [ebp - 4]
call fcn.00409930
xor edx, edx
push ebp
push 0x429e2b
push dword fs:[edx]
mov dword fs:[edx], esp
lea ebx, [ebp - 0x405]
mov dword [ebp - 8], 0x1f4
mov byte [ebx], 0
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x429dd1
mov edx, esi
mov eax, ebx
call fcn.004099fc
jmp 0x429e14
cmp eax, 0xea
jne 0x429e14
mov eax, dword [ebp - 8]
call fcn.004088b8
mov ebx, eax
mov byte [ebx], 0
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x429e0d
mov edx, esi
mov eax, ebx
call fcn.004099fc
mov eax, ebx
call fcn.0040278c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429e32
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x429e50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x400], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x42a02f
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x42a00c
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x400]
mov eax, dword [ebp - 4]
call fcn.00429a58
mov edx, dword [ebp - 0x400]
lea eax, [ebp - 0x205]
call fcn.0040990c
cmp byte [ebp + 0xc], 0
je 0x429ec5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x205]
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyA
mov dword [ebp - 0xc], eax
jmp 0x429ed9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x205]
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x429eec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42a016
xor edx, edx
push ebp
push 0x429ffb
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x429fce
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, edi
call fcn.00404c50
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, 0x1f4
jge 0x429f26
lea eax, [ebp - 0x205]
mov dword [ebp - 0x10], eax
jmp 0x429f2e
call fcn.004088b8
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x429f9f
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, edi
mov eax, dword [ebp - 0x10]
call fcn.0040990c
mov byte [ebp - 0x3fa], 0
lea eax, [ebp - 0x3fa]
mov edx, esi
call fcn.0040990c
test esi, esi
jne 0x429f62
xor eax, eax
jmp 0x429f68
lea eax, [ebp - 0x3fa]
push ebx
mov edx, dword [ebp - 0x10]
push edx
push 1
push 0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429fa6
lea eax, [ebp - 0x205]
cmp eax, dword [ebp - 0x10]
je 0x429f9e
mov eax, dword [ebp - 0x10]
call fcn.0040278c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a036
lea eax, [ebp - 0x400]
call fcn.00404980
ret
Function at 0x42a488
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00404e40
xor eax, eax
push ebp
push 0x42a595
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [ebp - 8]
call fcn.00404c50
test eax, eax
jle 0x42a4da
mov eax, dword [ebp - 8]
call fcn.00404c50
mov edx, dword [ebp - 8]
cmp byte [edx + eax - 1], 0x5c
je 0x42a4da
lea eax, [ebp - 8]
mov edx, 0x42a5b0
call fcn.00404c58
push ebp
mov eax, dword [ebp - 8]
call fcn.0042a214
pop ecx
mov eax, dword [ebp - 4]
call fcn.00405c8c
mov esi, eax
dec esi
test esi, esi
jl 0x42a55e
inc esi
xor edi, edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + edi*4]
call fcn.00404e50
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.00404b88
mov eax, dword [ebp - 0xc]
call fcn.00409870
test al, al
jne 0x42a55a
push 0x80
mov eax, dword [ebp - 4]
mov eax, dword [eax + edi*4]
call fcn.00404e50
push eax
call sub.kernel32.dll_SetFileAttributesA
test bl, bl
je 0x42a552
mov eax, dword [ebp - 4]
mov eax, dword [eax + edi*4]
call fcn.00404e50
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00404b88
mov eax, dword [ebp - 0x10]
call fcn.00409870
test al, al
jne 0x42a556
xor eax, eax
jmp 0x42a558
mov al, 1
mov ebx, eax
inc edi
dec esi
jne 0x42a4f6
lea eax, [ebp - 4]
mov edx, dword [0x42a1e0]
call fcn.00405e54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a59c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004049a4
lea eax, [ebp - 4]
mov edx, dword [0x42a1e0]
call fcn.00405e54
ret

Function at 0x42d16c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
call fcn.00404b88
cmp dword [ebx], 0
je 0x42d1aa
mov eax, dword [ebx]
call fcn.00404c50
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x42d1aa
mov eax, ebx
mov edx, 0x42d1bc
call fcn.00404c58
add esp, 0x108
pop ebx
ret

Function at 0x42f858
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x808], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42f90b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x5c3], 0
jne 0x42f8a2
lea edx, [ebp - 0x808]
mov eax, ebx
call fcn.0042fa48
mov edx, dword [ebp - 0x808]
mov eax, esi
call fcn.004051b8
jmp 0x42f8f2
mov eax, dword [ebx + 0x407]
test eax, eax
je 0x42f8f2
cmp byte [ebx + 0x431], 0
jne 0x42f8f2
push eax
call sub.user32.dll_GetWindowTextLengthW
cmp eax, 0x400
jle 0x42f8c7
mov eax, 0x400
test eax, eax
jle 0x42f8f2
inc eax
push eax
lea eax, [ebp - 0x802]
push eax
mov eax, dword [ebx + 0x407]
push eax
call sub.user32.dll_GetWindowTextW
mov eax, esi
lea edx, [ebp - 0x802]
mov ecx, 0x401
call fcn.0040519c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f912
lea eax, [ebp - 0x808]
call fcn.00404980
ret
Function at 0x42fa48
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42fb03
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x5c3], 0
je 0x42fa87
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0042f858
mov eax, dword [ebp - 8]
mov edx, edi
call fcn.0042f9e0
jmp 0x42faed
mov eax, dword [ebx + 0x407]
test eax, eax
je 0x42fae0
cmp byte [ebx + 0x431], 0
jne 0x42fae0
push eax
call sub.user32.dll_GetWindowTextLengthA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42faad
xor esi, esi
jmp 0x42faca
mov eax, dword [ebp - 4]
inc eax
call fcn.0040276c
mov esi, eax
mov eax, dword [ebp - 4]
inc eax
push eax
push esi
mov eax, dword [ebx + 0x407]
push eax
call sub.user32.dll_GetWindowTextA
mov eax, edi
mov edx, esi
call fcn.00404b88
test esi, esi
je 0x42faed
mov eax, esi
call fcn.0040278c
jmp 0x42faed
mov eax, edi
mov edx, dword [ebx + 0x425]
call fcn.00404b88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fb0a
lea eax, [ebp - 8]
call fcn.0040503c
ret