joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40
cmp byte [0x450df8], 0
je 0x4014f9
push ebx
push ebp
push esi
mov esi, dword [esp + 0x50]
push edi
mov edi, dword [sym.imp.USER32.dll_GetMenu]
lea eax, [esp + 0x20]
push eax
push 1
push 2
push esi
mov dword [esp + 0x30], 0x30
mov dword [esp + 0x34], 0x10
mov dword [esp + 0x38], 0x800
call edi
mov ebx, dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_GetMenuItemCount]
push eax
call ebp
push eax
push 2
push esi
call edi
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_InsertMenuItemA]
lea ecx, [esp + 0x20]
push ecx
push 1
push 2
push esi
mov dword [esp + 0x34], 0x12
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x9c78
mov dword [esp + 0x54], str.Log_Boot
call edi
push eax
call ebx
push eax
call ebp
push eax
push 2
push esi
call edi
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_InsertMenuItemA]
lea edx, [esp + 0x10]
push edx
push str.SystemCurrentControlSetServicesDbgv
mov ebx, 3
push reloc.WS2_32.dll_bind
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4014bc
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push 0x4345cc
push eax
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x14], ebx
setne al
mov byte [0x4534f4], al
test al, al
jne 0x4014db
push 0
call fcn.00401000
mov al, byte [0x4534f4]
add esp, 4
movzx edx, al
neg edx
sbb edx, edx
and edx, 8
push edx
push 0x9c78
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret

Function at 0x401cb0
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
mov eax, 0x1024
call fcn.00412900
mov eax, dword [0x43d68c]
xor eax, esp
mov dword [esp + 0x1020], eax
cmp byte [0x43d365], 0
push esi
mov esi, dword [esp + 0x102c]
push edi
mov eax, 0x434820
jne 0x401ce4
mov eax, 0x434810
push eax
mov eax, dword [0x44ba00]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x1020
lea ecx, [esp + 0xc]
push ecx
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
push edi
push 1
push esi
call fcn.00401b90
add esp, 0x10
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x1028]
pop edi
pop esi
xor ecx, esp
call fcn.004126a4
add esp, 0x1024
ret
Function at 0x403f00
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x440c28]
mov ecx, dword [0x449734]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetSubMenu]
push 0
add eax, 0xc350
push eax
push 4
push ecx
call edi
mov ebx, dword [sym.imp.USER32.dll_CheckMenuItem]
push eax
call ebx
mov esi, dword [esp + 0x14]
mov eax, dword [0x449734]
push 8
lea edx, [esi + 0xc350]
push edx
push 4
push eax
call edi
push eax
call ebx
mov ecx, dword [0x440c28]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
imul ecx, ecx, 0x160
mov edx, dword [ecx + 0x450024]
push 0
push edx
call ebx
mov eax, esi
imul eax, eax, 0x160
mov ecx, dword [eax + 0x450024]
lea edi, [eax + 0x450024]
push 5
push ecx
call ebx
mov edx, dword [0x440c28]
mov ebx, dword [esp + 0x10]
push esi
push edx
push ebx
call fcn.00403550
push esi
push ebx
call fcn.00401870
mov eax, dword [edi]
add esp, 0x14
mov dword [0x440c28], esi
mov dword [0x449850], eax
test esi, esi
jne 0x403fb4
cmp byte [0x43d364], 0
jne 0x403fb4
push 1
jmp 0x403fb6
push 0
push 0x9c63
push ebx
call dword [sym.imp.USER32.dll_GetMenu]
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
push eax
call esi
cmp dword [0x440c28], 0
jne 0x403fe1
cmp byte [0x43d364], 0
je 0x403fe1
xor eax, eax
jmp 0x403fe6
mov eax, 1
mov ecx, dword [0x449734]
push eax
push 0x9c78
push ecx
call esi
mov edx, dword [0x449850]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
ret

Function at 0x404090
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, edi
imul esi, esi, 0x160
mov ecx, dword [esi + 0x450130]
push 0x10
push eax
push ecx
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x4040d3
call sub.WS2_32.dll_WSAGetLastError
sub eax, 0x274c
neg eax
sbb eax, eax
and eax, 0xfffffff9
pop edi
add eax, 8
pop esi
add esp, 8
ret
push ebx
mov ebx, dword [esp + 0x18]
push 0
push 1
lea edx, [esp + 0x14]
push edx
push 4
lea eax, [esp + 0x2c]
push eax
push edi
push ebx
mov dword [esp + 0x38], 0x83050024
call fcn.004113c0
add esp, 0x1c
test eax, eax
je 0x40416a
push 0x7d0
push 1
lea ecx, [esp + 0x14]
push ecx
push 4
lea edx, [esp + 0x20]
push edx
push edi
push ebx
call fcn.00411570
add esp, 0x1c
test eax, eax
je 0x40416a
mov eax, dword [esp + 0x10]
mov byte [esi + 0x450023], 0
cmp eax, 0x7fffffff
jne 0x40414e
mov byte [esi + 0x450023], 1
shr eax, 0x1f
not al
pop ebx
and al, 1
mov byte [esi + 0x450021], al
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov ecx, eax
and ecx, 0x7fffffff
cmp ecx, 0x320
je 0x404138
pop ebx
pop edi
mov eax, 2
pop esi
add esp, 8
ret
call sub.WS2_32.dll_WSAGetLastError
pop ebx
pop edi
mov eax, 7
pop esi
add esp, 8
ret
Function at 0x404580
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x43d68c]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, ebp
push edi
imul esi, esi, 0x160
mov edi, 0x7e4
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi + 0x450130], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x45012c]
mov ecx, 2
push edi
mov dword [esp + 0x18], eax
mov word [esp + 0x14], cx
call sub.WS2_32.dll_htons
lea edx, [esp + 0x10]
push edx
push ebp
push ebx
mov word [esp + 0x1e], ax
call fcn.00404090
add esp, 0xc
test eax, eax
je 0x40465f
cmp eax, 2
je 0x404674
cmp eax, 1
je 0x40462c
cmp eax, 8
je 0x404698
mov eax, dword [esi + 0x450130]
push eax
call sub.WS2_32.dll_closesocket
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi + 0x450130], eax
mov ecx, dword [esi + 0x450130]
push ecx
call sub.WS2_32.dll_closesocket
inc edi
mov edx, 0x7ee
cmp di, dx
jl 0x4045a7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004126a4
add esp, 0x14
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004126a4
add esp, 0x14
ret
mov eax, dword [esi + 0x450130]
push eax
call sub.WS2_32.dll_closesocket
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004126a4
add esp, 0x14
ret
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 8
call fcn.004126a4
add esp, 0x14
ret
Function at 0x4050b0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x310
mov eax, dword [0x43d68c]
xor eax, esp
mov dword [esp + 0x30c], eax
push edi
mov edi, dword [esp + 0x318]
lea eax, [esp + 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x4345ac
lea ecx, [esp + 0x210]
push ecx
lea edx, [esp + 0xc]
push str._s_s
push edx
call fcn.004124f2
push 0x43d370
lea eax, [esp + 0x18]
push eax
push 0x43506c
call fcn.0040a730
add esp, 0x1c
test eax, eax
jne 0x405291
push 0x104
lea ecx, [esp + 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4345ac
lea edx, [esp + 0x210]
push edx
lea eax, [esp + 0xc]
push str._sDrivers_s
push eax
call fcn.004124f2
mov eax, dword [0x440bf4]
add esp, 0x10
test eax, eax
je 0x405159
push 0
call eax
cmp dword [0x44a8a8], 0
mov eax, str.RCDBGSYS64
jne 0x40516c
mov eax, str.RCDBGSYS
lea ecx, [esp + 4]
push ecx
push eax
call fcn.0040a600
add esp, 8
test al, al
jne 0x4051c8
mov eax, dword [0x440bf4]
test eax, eax
je 0x40518b
push 1
call eax
lea edx, [esp + 0x108]
push edx
call fcn.00401960
push eax
lea eax, [esp + 0xc]
push eax
push str.Could_not_extract_DebugView_driver_to__s_s_nKernel_debug_output_capture_will_be_unavailable.
push 0x4524c0
call fcn.004124f2
add esp, 0x14
push 0x10
push 0x4346e4
push 0x4524c0
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x405284
push 0x43d370
lea ecx, [esp + 8]
push ecx
push 0x43506c
call fcn.0040a730
add esp, 0xc
test eax, eax
jne 0x405284
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x490
jne 0x4051fe
push str.File_Not_Found
jmp 0x40524b
call esi
cmp eax, 5
je 0x405246
call esi
cmp eax, 3
je 0x405246
call esi
cmp eax, 0x570
jne 0x405224
push str.This_version_of_DebugView_will_not_capture_kernel_debug_output_for_this_version_of_Windows._nCheck_the_Sysinternals_site_for_updates.
lea eax, [esp + 0x110]
push eax
jmp 0x405253
push 0x4524c0
call fcn.00401960
push eax
lea ecx, [esp + 0x114]
push str.Error_loading_DebugView_driver_s_nMake_sure_that_you_have_the_Load_Drivers_and_Debug_privileges_in_order_to__nmonitor_kernel_mode_debug_prints.
push ecx
call fcn.004124f2
add esp, 0x10
jmp 0x40525b
push str.Cannot_connect_to_local_system_because_it_is_already_nconnected_to_another_instance_of_DebugView.
lea edx, [esp + 0x110]
push edx
call fcn.004124f2
add esp, 8
lea eax, [esp + 0x10c]
push eax
push 0x4524c0
call fcn.004124f2
add esp, 8
push 0x10
push 0x4346e4
push 0x4524c0
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
mov eax, dword [0x440bf4]
test eax, eax
je 0x405291
push 1
call eax
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x310]
pop edi
xor ecx, esp
call fcn.004126a4
add esp, 0x310
ret
Function at 0x4061e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x45350c]
mov edx, dword [0x453508]
push 0
push eax
push 0
push 0
mov dword [0x44ba00], eax
mov eax, dword [0x453510]
push eax
mov eax, dword [0x453504]
push ecx
push edx
push eax
push 0xcf0000
push 0x4347d6
push str.dbgviewClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x44f9e0], eax
test eax, eax
jne 0x40622b
ret
push 0
push eax
call fcn.00401870
add esp, 8
cmp byte [0x440bf2], 0
je 0x406243
xor eax, eax
jmp 0x406247
mov eax, dword [esp + 8]
mov ecx, dword [0x44f9e0]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
push ecx
call edi
mov edx, dword [0x44f9e0]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [0x450df4]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
cmp byte [0x43d367], al
sete al
add eax, 9
push eax
push 0x9c5a
push 0x42b
push ecx
call esi
mov eax, dword [0x450df4]
xor edx, edx
cmp byte [0x43d376], dl
sete dl
add edx, 0x11
push edx
push 0x9c5f
push 0x42b
push eax
call esi
mov edx, dword [0x450df4]
xor ecx, ecx
cmp byte [0x43d374], cl
sete cl
add ecx, 0xc
push ecx
push 0x9c5c
push 0x42b
push edx
call esi
mov ecx, dword [0x450df4]
xor eax, eax
cmp byte [0x43d378], al
sete al
add eax, 0xe
push eax
push 0x9c5d
push 0x42b
push ecx
call esi
mov edx, dword [0x450df4]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp byte [0x453525], 0
je 0x406320
cmp byte [0x440bf2], 0
jne 0x406320
mov eax, dword [0x44f9e0]
push 3
push eax
call edi
cmp byte [0x440c07], 0
pop edi
pop esi
je 0x406364
mov ecx, dword [0x44f9e0]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
movzx edx, byte [0x440c07]
mov eax, dword [0x449734]
neg edx
sbb edx, edx
and edx, 8
push edx
push 0x9c61
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [0x44f9e0]
ret
Function at 0x40a600
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x436100
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x40a61d
xor al, al
pop esi
ret
push ebx
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x4360fc
push ecx
mov edi, eax
call fcn.00413387
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a65c
pop edi
pop ebx
xor al, al
pop esi
ret
push esi
push ebx
push 1
push edi
call fcn.004146d0
push esi
call fcn.00412f6d
add esp, 0x14
pop edi
pop ebx
mov al, 1
pop esi
ret
Function at 0x40b400
Capabilities:
Accept command line arguments

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
xor ebp, ebp
push edi
test ebx, ebx
je 0x40b416
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x40b444
push 0x4386fc
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40b4a1
mov ebx, 0x443d48
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call esi
mov edi, eax
xor esi, esi
cmp dword [ebx], ebp
jle 0x40b4a1
xor ebp, ebp
lea esp, [esp]
mov eax, dword [edi + esi*4]
push str._accepteula
push eax
call fcn.00414863
add esp, 8
test eax, eax
je 0x40b481
mov ecx, dword [edi + esi*4]
push 0x4386c0
push ecx
call fcn.00414863
add esp, 8
test eax, eax
je 0x40b481
inc esi
cmp esi, dword [ebx]
jl 0x40b450
jmp 0x40b4a1
mov edx, dword [ebx]
dec edx
cmp esi, edx
mov ebp, 1
jge 0x40b49f
lea ecx, [ecx]
mov eax, dword [edi + esi*4 + 4]
mov dword [edi + esi*4], eax
mov ecx, dword [ebx]
inc esi
dec ecx
cmp esi, ecx
jl 0x40b490
dec dword [ebx]
mov edx, dword [esp + 0x14]
push ebp
push edx
call fcn.0040b070
add esp, 8
test eax, eax
je 0x40b4b8
mov ebp, 1
pop edi
xor eax, eax
pop esi
test ebp, ebp
pop ebp
setne al
pop ebx
ret

Function at 0x40ccc0
Capabilities:
Create service

Disassembly:
mov eax, dword [esp + 0xc]
push 0
mov ecx, dword [esp + 8]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x20]
push 1
push 3
push 0x10
push 0xf01ff
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x40ccf0
ret
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
ret

Function at 0x40cd00
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
sub esp, 0x1c
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebx, eax
mov eax, dword [0x44657c]
test eax, eax
je 0x40cd1f
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [0x44657c], eax
test eax, eax
jne 0x40cd43
pop edi
pop ebx
add esp, 0x1c
ret
push esi
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x40cd64
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x40cd64
xor esi, esi
jmp 0x40cdbc
mov eax, dword [0x44657c]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea edx, [esp + 0x10]
push edx
push eax
mov esi, 1
call ebp
test eax, eax
je 0x40cdb9
mov eax, dword [esp + 0x14]
cmp eax, 4
je 0x40cdbb
cmp eax, 1
je 0x40cdb9
call edi
sub eax, ebx
cmp eax, 0xea60
ja 0x40cdae
mov edx, dword [0x44657c]
lea ecx, [esp + 0x10]
push ecx
push edx
call ebp
test eax, eax
jne 0x40cd81
jmp 0x40cdb9
push 0x41d
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
pop ebp
mov eax, dword [0x44657c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop esi
pop edi
mov dword [0x44657c], 0
pop ebx
add esp, 0x1c
ret
Function at 0x40cde0
Capabilities:
Query service status
Stop service

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub esp, 0x1c
push esi
push 0xf01ff
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40ce04
pop esi
add esp, 0x1c
ret
push ebx
push edi
lea edx, [esp + 0xc]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, eax
lea eax, [esp + 0xc]
push eax
push esi
call edi
test eax, eax
je 0x40ce3b
cmp dword [esp + 0x10], 1
je 0x40ce3b
lea ecx, [esp + 0xc]
push ecx
push esi
call edi
test eax, eax
jne 0x40ce28
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, ebx
pop ebx
pop esi
add esp, 0x1c
ret
Function at 0x4113c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x14
call fcn.00412d99
mov edi, eax
xor eax, eax
add esp, 4
push eax
mov dword [edi], eax
push eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
push 1
mov dword [edi + 0xc], eax
push eax
mov dword [edi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp byte [esp + 0x2c], 0
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov dword [edi + 0x10], eax
mov eax, dword [esp + 0x24]
mov esi, ebp
je 0x411421
imul esi, esi, 0x160
mov edx, dword [esi + 0x450130]
push edi
push ebx
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x41143c
imul esi, esi, 0x160
mov edx, dword [esi + 0x450130]
push 0x4113a0
push edi
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x41153a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x41147d
cmp byte [esp + 0x2c], 0
je 0x41155e
mov eax, dword [esi + 0x450130]
push 1
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x41153a
cmp byte [esi + 0x450022], 0
jne 0x41153a
lea ecx, [esi + 0x450028]
push ecx
push str.The_connection_with__s_was_broken
push 0x4524c0
mov byte [esi + 0x450022], 1
call fcn.004124f2
mov esi, dword [esp + 0x24]
add esp, 0xc
cmp dword [0x440c28], ebp
jne 0x4114d9
push ebp
push esi
call fcn.00401870
add esp, 8
cmp ebp, dword [0x440c28]
jne 0x4114d9
mov edx, dword [0x44f9e0]
push ebp
push ebp
push edx
call fcn.00403550
add esp, 0xc
mov bl, byte [esp + 0x30]
test bl, bl
je 0x4114ec
push 0x452380
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x30
push 0x4346e4
push 0x4524c0
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x44cf60]
mov ecx, dword [0x449078]
mov edx, dword [0x449734]
push eax
push ecx
push 0
add ebp, 0xc350
push ebp
push 4
push edx
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
test bl, bl
je 0x41153a
push 0x452380
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x2c], 0
je 0x411554
push edi
call fcn.00412c42
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x411570
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, ebx
imul esi, esi, 0x160
xor eax, eax
mov dword [esi + 0x450160], eax
push edi
lea edi, [esi + 0x450160]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x450174]
push eax
mov dword [esi + 0x450170], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push edi
push eax
mov eax, dword [esi + 0x450130]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, eax
test ebp, ebp
jne 0x4116c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x411626
cmp byte [esp + 0x28], 0
je 0x411605
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x41160c
mov ecx, dword [esi + 0x450174]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41160c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edx, dword [esp + 0x24]
mov eax, dword [esi + 0x450130]
push 1
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp byte [esi + 0x450022], 0
jne 0x4116c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [esp + 0x14]
mov byte [esi + 0x450022], 1
cmp dword [0x440c28], ebx
jne 0x411656
push ebx
push edi
call fcn.00401870
add esp, 8
lea ecx, [esi + 0x450028]
push ecx
push str.The_connection_with__s_was_broken
push 0x4524c0
call fcn.004124f2
add esp, 0xc
cmp ebx, dword [0x440c28]
jne 0x411688
mov edx, dword [0x44f9e0]
push ebx
push ebx
push edx
call fcn.00403550
add esp, 0xc
push 0x30
push 0x4346e4
push 0x4524c0
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x44cf60]
mov ecx, dword [0x449078]
mov edx, dword [0x449734]
push eax
push ecx
push 0
add ebx, 0xc350
push ebx
push 4
push edx
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x411d38
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x43d68c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x411e0d
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411dfc
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x411de6
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x411dfc
push eax
push edi
push dword [ebp - 0x110]
call fcn.00411cd5
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x411e0f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004126a4
leave
ret 4

Function at 0x4126a4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43d68c]
jne 0x4126ae
repz ret
jmp fcn.00416c8e