joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4025cc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00402572
test eax, eax
je 0x4027d4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
test edx, edx
jne 0x402660
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
and eax, 0x8000
test eax, eax
jne 0x402660
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x8000
test ecx, ecx
jne 0x402660
push 0x5b
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
test edx, edx
jne 0x402660
push 0x5c
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
and eax, 0x8000
test eax, eax
jne 0x402660
mov ecx, dword [ebp - 4]
xor edx, edx
mov dl, byte [ecx + 8]
test edx, edx
je 0x40266c
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
jmp 0x402676
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], 1
cmp dword [ebp + 8], 0x74
jne 0x40269b
mov edx, dword [ebp + 0xc]
and edx, 0x80000000
test edx, edx
jne 0x40269b
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp dword [eax + 0x18], 0
sete cl
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
je 0x4027be
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xc], 0
je 0x4026bc
push 0
mov edx, dword [ebp - 4]
call dword [edx + 0xc]
add esp, 4
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x43
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x17
ja case.0x4026e0.10
mov eax, dword [ebp - 8]
xor edx, edx
mov dl, byte [eax + 0x40281a]
jmp dword [edx*4 + 0x4027ee]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], 1
mov dword [ebp + 8], 0x51
jmp case.0x4026e0.10
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], 1
mov dword [ebp + 8], 0x57
jmp case.0x4026e0.10
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], 1
mov dword [ebp + 8], 0x45
jmp case.0x4026e0.10
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], 1
mov dword [ebp + 8], 0x52
jmp case.0x4026e0.10
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], 1
mov dword [ebp + 8], 0x54
jmp case.0x4026e0.10
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], 1
mov dword [ebp + 8], 0x59
jmp case.0x4026e0.10
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], 1
mov dword [ebp + 8], 0x55
jmp case.0x4026e0.10
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], 1
mov dword [ebp + 8], 0x49
jmp case.0x4026e0.10
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], 1
mov dword [ebp + 8], 0x4f
jmp case.0x4026e0.10
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], 1
mov dword [ebp + 8], 0x50
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00402281
jmp 0x4027d2
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xc], 0
je 0x4027d2
push 1
mov edx, dword [ebp - 4]
call dword [edx + 0xc]
add esp, 4
jmp 0x4027e8
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4027e8
push 1
mov ecx, dword [ebp - 4]
call dword [ecx + 0xc]
add esp, 4
mov esp, ebp
pop ebp
ret 8
Function at 0x4041f3
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push edi
mov dword [ebp - 0x44], 0
mov byte [ebp - 0x5c], 0
xor eax, eax
mov dword [ebp - 0x5b], eax
mov dword [ebp - 0x57], eax
mov dword [ebp - 0x53], eax
mov dword [ebp - 0x4f], eax
mov word [ebp - 0x4b], ax
mov byte [ebp - 0x49], al
mov byte [ebp - 0x130], 0
xor ecx, ecx
mov dword [ebp - 0x12f], ecx
mov dword [ebp - 0x12b], ecx
mov word [ebp - 0x127], cx
mov byte [ebp - 0x125], cl
mov byte [ebp - 0x124], 0
mov ecx, 0x31
xor eax, eax
lea edi, [ebp - 0x123]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x40], 0
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x3f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
push 0x40d1a4
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffff
je 0x404373
push 0xc8
push 0
lea ecx, [ebp - 0x124]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0xc
push 0
lea edx, [ebp - 0x130]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x40
push 0
lea eax, [ebp - 0x40]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
lea ecx, [ebp - 0x44]
push ecx
push 0xc8
lea edx, [ebp - 0x124]
push edx
push 0xc
lea eax, [ebp - 0x130]
push eax
push 0x2d1400
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x404323
push 0x20
lea edx, [ebp - 0xd8]
push edx
lea eax, [ebp - 0x40]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x404333
push 0x40
push 0
lea ecx, [ebp - 0x40]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x134], 0
jmp 0x40434e
mov edx, dword [ebp - 0x134]
add edx, 1
mov dword [ebp - 0x134], edx
cmp dword [ebp - 0x134], 0x20
jge 0x404373
mov eax, dword [ebp - 0x134]
movsx ecx, byte [ebp + eax - 0x40]
test ecx, ecx
jne 0x404371
mov edx, dword [ebp - 0x134]
mov byte [ebp + edx - 0x40], 0x33
jmp 0x40433f
push 0x20
lea eax, [ebp - 0x40]
push eax
call fcn.0040416a
add esp, 8
mov dword [0x40dd2c], eax
mov ecx, dword [0x40dd2c]
or ecx, 0x80000000
mov dword [0x40dd2c], ecx
mov edx, dword [0x40dd2c]
push edx
push 0x40d1b8
push 0x40e130
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x20
push 0
push 0x40e150
call sub.MSVCRT.dll_memset
add esp, 0xc
push 5
push 0x40e130
push 0x40e150
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
push 0x40d1bc
push 0x40e150
call sub.MSVCRT.dll_strcat
add esp, 8
push 5
push 0x40e135
push 0x40e150
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0xc
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4046e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
push edi
call fcn.004077c7
jmp 0x404707
mov dword [ebp - 4], 0
cmp dword [0x40e178], 0
je 0x4047da
mov byte [ebp - 0xa0], 0
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x9f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x40d25c]
mov dword [ebp - 0x60], eax
mov ecx, dword [0x40d260]
mov dword [ebp - 0x5c], ecx
mov edx, dword [0x40d264]
mov dword [ebp - 0x58], edx
mov ax, word [0x40d268]
mov word [ebp - 0x54], ax
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x52]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 8], 0x40
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x10]
push ecx
push 0x40d26c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x40d288
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0x60]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
push 0x40d28c
lea eax, [ebp - 0x60]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4047fd
push 0
push 0x404468
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
push 0x3e9
mov ecx, dword [0x40e3a8]
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov dword [ebp - 4], eax
jmp 0x40480d
call fcn.00407835
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405bd0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40d390
push 0x5c
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40d398
push 0x5c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x104]
push edx
push 0x20
lea eax, [ebp - 0x124]
push eax
push 0x40e390
mov ecx, dword [ebp + 0x10]
push ecx
push 0x40d39c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x405ca7
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x124]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x124]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x124]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push str.Option
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x405cba
lea eax, [ebp - 0x124]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x406f9f
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0x10]
push eax
push 0x40d5a4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x406ffb
lea ecx, [ebp - 0x10]
push ecx
push 0x40d5b8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 4
lea edx, [ebp - 4]
push edx
push 4
push 0
push 0x40d5cc
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0xc]
push ecx
push 0x40e474
lea edx, [ebp - 8]
push edx
push 0
push 0x40d5d4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x40e474], 0
jne 0x407038
mov dword [0x40e3fc], 0x40d454
jmp 0x407042
mov dword [0x40e3fc], 0x40d440
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.00407071
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.004070ee
test eax, eax
jne 0x407066
xor eax, eax
jmp 0x40706b
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x4077c7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push edi
mov byte [0x40d9f0], 1
push 0
mov eax, dword [0x40e3e0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x58], 0
mov ecx, 0x15
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x58], 0x58
mov ecx, dword [0x40e3e0]
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x48], 0x7a8
mov edx, dword [0x40e3f8]
mov dword [ebp - 0x44], edx
lea eax, [ebp - 0x58]
push eax
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x407835
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push edi
mov byte [0x40d9f0], 0
push 5
mov eax, dword [0x40e3e0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x58], 0
mov ecx, 0x15
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x58], 0x58
mov ecx, dword [0x40e3e0]
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x48], 0x7a8
mov edx, dword [0x40e404]
mov dword [ebp - 0x44], edx
lea eax, [ebp - 0x58]
push eax
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4078a3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
je 0x4078ca
cmp dword [ebp - 0x1c], 2
je 0x4078e4
cmp dword [ebp - 0x1c], 3
je 0x40794c
jmp 0x407951
push 5
push 0
push 0
push 0x40d5f0
push 0x40d608
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x407951
mov dword [ebp - 0x10], 0
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
push 0x6d
mov edx, dword [0x40e3a8]
push edx
call dword [sym.imp.USER32.dll_LoadMenuA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40794a
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
sub edx, 0x50
push edx
push 0x22
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_TrackPopupMenu]
jmp 0x407951
call fcn.004077c7
mov esp, ebp
pop ebp
ret
Function at 0x4038b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x100
je 0x4038cd
jmp 0x4039a4
push 0x407110
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetPropA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4039a4
mov eax, dword [ebp + 0xc]
cmp dword [eax + 8], 9
jne 0x4039a4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x8000
test ecx, ecx
je 0x4039a4
push 0
push 0
push 0x130b
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], eax
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x8000
test ecx, ecx
je 0x403962
cmp dword [ebp - 4], 0
jle 0x40394e
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 0x10], edx
jmp 0x40395a
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x28]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
jmp 0x403988
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x28]
sub ecx, 1
cmp dword [ebp - 4], ecx
jge 0x40397b
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x403982
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x14e0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
jmp 0x4039a6
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x403abf
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x40715c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetPropA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x403b92
mov dword [ebp - 4], 0
jmp 0x403af3
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 0x28]
jge 0x403b38
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x20
push edx
call fcn.00404f81
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x403b36
mov eax, dword [ebp - 8]
cmp dword [eax + 0x108], 0
je 0x403b36
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x108]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x403aea
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
jne 0x403b83
mov ecx, dword [ebp - 0xc]
cmp dword [ecx], 0
jne 0x403b83
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x10], 0
je 0x403b61
push 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x10], 0
je 0x403b83
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [ebp - 0xc]
add eax, 0x20
push eax
call fcn.00404f01
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x404680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x10c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push 0x407338
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404777
mov dword [ebp - 0x108], 0x104
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x104]
push edx
push 0
push 0
push 0x407368
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x407378
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40471c
mov edx, dword [ebp + 8]
mov dword [edx], 1
mov dword [ebp - 0x108], 0x104
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 0
push 0
push 0x40737c
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x40738c
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40476a
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 1
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push 0x407390
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40481f
mov dword [ebp - 0x108], 0x104
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x4073c0
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4047fe
mov edx, dword [ebp - 0x108]
mov byte [ebp + edx - 0x104], 0
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
jmp 0x404812
push str.dbnmpntw
mov edx, dword [ebp + 8]
add edx, 8
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x404823
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x3c]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftMSSQLServerClientDB_Lib
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404903
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x404867
mov dword [ebp - 0x44], 0x407404
jmp 0x40486e
mov dword [ebp - 0x44], 0x407408
mov eax, dword [ebp - 0x44]
push eax
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
push eax
lea ecx, [ebp - 0x34]
push ecx
push 1
push 0
push str.AutoAnsiToOem
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x4048b9
mov dword [ebp - 0x48], 0x40741c
jmp 0x4048c0
mov dword [ebp - 0x48], 0x407420
mov ecx, dword [ebp - 0x48]
push ecx
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
push ecx
lea edx, [ebp - 0x34]
push edx
push 1
push 0
push str.UseIntlSettings
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push 0x407434
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404967
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp + 8]
add eax, 8
push eax
push 1
push 0
push 0x407464
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x40496b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
mov dword [ebp - 0x3f0], 0
mov dword [ebp - 0x630], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
lea edx, [ebp - 0x628]
push edx
lea eax, [ebp - 0x620]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push 0x40746c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4049ce
jmp 0x404bdd
mov dword [ebp - 0x3f8], 0x100
mov dword [ebp - 0x3ec], 0x3e8
lea ecx, [ebp - 0x3ec]
push ecx
lea edx, [ebp - 0x3e8]
push edx
lea eax, [ebp - 0x624]
push eax
push 0
lea ecx, [ebp - 0x3f8]
push ecx
lea edx, [ebp - 0x61c]
push edx
mov eax, dword [ebp - 0x3f0]
push eax
mov ecx, dword [ebp - 0x620]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0
je 0x404a3a
cmp dword [ebp - 0x3fc], 0xea
jne 0x404bd0
mov edx, dword [ebp - 0x3ec]
mov byte [ebp + edx - 0x3e8], 0
lea eax, [ebp - 0x3e8]
mov dword [ebp - 0x3f4], eax
push str.DSQUERY
lea ecx, [ebp - 0x61c]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x404ba8
mov edx, dword [ebp - 0x3f4]
movsx eax, byte [edx]
test eax, eax
je 0x404abc
mov ecx, dword [ebp - 0x3f4]
movsx edx, byte [ecx]
cmp edx, 0x2c
jne 0x404aa5
mov eax, dword [ebp - 0x3f4]
mov byte [eax], 0
mov ecx, dword [ebp - 0x3f4]
add ecx, 1
mov dword [ebp - 0x630], ecx
jmp 0x404abc
mov edx, dword [ebp - 0x3f4]
push edx
call fcn.00402080
add esp, 4
mov dword [ebp - 0x3f4], eax
jmp 0x404a70
cmp dword [ebp - 0x630], 0
je 0x404ad3
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x634], eax
jmp 0x404add
mov dword [ebp - 0x634], 0x407538
mov ecx, dword [ebp - 0x634]
push ecx
lea edx, [ebp - 0x4fd]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x3e8]
push eax
lea ecx, [ebp - 0x51c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx]
add eax, 1
imul eax, eax, 0x21f
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 0
je 0x404ba8
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], 0
je 0x404b68
mov edx, dword [ebp + 8]
mov eax, dword [edx]
imul eax, eax, 0x21f
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x62c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
push 0x21f
lea eax, [ebp - 0x61c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
imul edx, edx, 0x21f
mov eax, dword [ebp - 0x62c]
add eax, edx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x62c]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0x3f0]
add eax, 1
mov dword [ebp - 0x3f0], eax
mov dword [ebp - 0x3f8], 0x100
mov dword [ebp - 0x3ec], 0x3e8
jmp 0x4049e2
mov ecx, dword [ebp - 0x620]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret