joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417676
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, ecx
mov dword [ebp - 8], edx
test edi, edi
jne 0x41768a
or eax, 0xffffffff
jmp 0x417708
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
call fcn.00417641
push ebx
push ebx
push ebx
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov ebx, eax
jmp 0x4176d1
cmp dword [ebp - 4], 0xa28
jge 0x4176d6
cmp esi, 0x2000
jge 0x4176d6
cmp esi, 0xffffffff
je 0x4176e5
mov ecx, edi
call fcn.00417641
inc dword [ebp - 4]
mov esi, eax
push 1
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp esi, dword [ebp + 8]
jl 0x4176a6
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
jne 0x4176f1
xor eax, eax
jmp 0x417706
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
or eax, 0xffffffff
jmp 0x417706
mov eax, dword [ebp + 8]
cmp eax, esi
push 0
cmovg eax, esi
push eax
push dword [ebp - 8]
push edi
call dword [sym.imp.WS2_32.dll_recv]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x417ac0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x617ff0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x104]
xor ebx, ebx
push str.SOFTWAREMicrosoftClipboard
push eax
mov dword [ebp - 0x10c], ebx
call fcn.00589e60
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
xor esi, esi
push eax
inc esi
lea eax, [ebp - 0x104]
push esi
push ebx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x417b19
xor eax, eax
jmp 0x417ba2
push 4
pop eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], ebx
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push str.EnableClipboardHistory
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x417b8a
lea eax, [ebp - 0x110]
mov dword [ebp - 0x108], ebx
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push str.CloudClipboardAutomaticUpload
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417b92
cmp dword [ebp - 0x108], ebx
jne 0x417b94
mov esi, ebx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00580b5b
mov esp, ebp
pop ebp
ret
Function at 0x41a9f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x623aac], 0
push esi
mov esi, ecx
jne 0x41aa1a
push 0
push 0x6188b4
push 0x623aac
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
push 0x5ef3b0
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
je 0x41ab1c
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x41aa5b
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
jne 0x41aa62
xor eax, eax
jmp 0x41ab1b
push edi
push ebx
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x41ab18
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
test eax, eax
je 0x41ab11
push ebx
push esi
push eax
call fcn.00583330
and dword [ebp + 8], 0
lea eax, [ebp + 8]
add esp, 0xc
push eax
push 0
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x41ab0a
mov ebx, dword [ebp + 8]
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x41aad6
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push ebx
mov dword [esi], vtable.Gdiplus::Bitmap.0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
jmp 0x41aad8
xor esi, esi
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
je 0x41ab0a
mov ecx, dword [esi + 8]
and dword [esi + 8], 0
test ecx, ecx
jne 0x41ab02
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov eax, esi
jmp 0x41ab1a
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41af04
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
call fcn.00448f8f
lea ecx, [edi + 0x788]
call fcn.0040ae21
lea ecx, [edi + 0x5d8]
call fcn.0040ad36
lea ecx, [edi + 0x668]
call fcn.0040ad36
lea ecx, [edi + 0xc8]
call fcn.0040ad36
push 0xa
pop esi
lea ecx, [edi + 0x6f8]
mov dword [edi + 0x154], esi
call fcn.0040ad36
lea ecx, [edi + 0x308]
call fcn.0040ad36
lea ecx, [edi + 0x818]
mov dword [edi + 0x394], esi
call fcn.0040ad36
lea ecx, [edi + 0x158]
call fcn.0040ad36
lea ecx, [edi + 0x1e8]
mov dword [edi + 0x1e4], esi
call fcn.0040ad36
lea ecx, [edi + 0x278]
mov dword [edi + 0x274], esi
call fcn.0040ad36
lea ecx, [edi + 0x398]
mov dword [edi + 0x304], esi
call fcn.0040ad36
lea ecx, [edi + 0x428]
mov dword [edi + 0x424], esi
call fcn.0040ad36
lea ecx, [edi + 0x4b8]
mov dword [edi + 0x4b4], esi
call fcn.0040ad36
lea ecx, [edi + 0x548]
mov dword [edi + 0x544], esi
call fcn.0040ad36
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3e8
push dword [edi + 0x20]
mov dword [edi + 0x5d4], esi
mov dword [edi + 0xc0], 1
call ebx
push 0x4367cc
mov esi, eax
push 0xfffffffffffffffc
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push eax
push str.Back_WND
push esi
call dword [sym.imp.USER32.dll_SetPropA]
mov ecx, 0x5e7de4
mov edx, str.CheckForUpdates
push ecx
push 1
call fcn.00434e91
cmp eax, 1
jne 0x41b043
lea ecx, [edi + 0x788]
mov eax, dword [ecx]
push 1
call dword [eax + 0x170]
call fcn.00426899
test eax, eax
je 0x41b09a
push 0x3eb
push dword [edi + 0x20]
call ebx
push str.Deactivate...
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp dword [0x618878], 0
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
jne 0x41b07b
push 0
push dword [ebp - 4]
call esi
call fcn.0041e8e4
test eax, eax
jne 0x41b089
call fcn.0041e5f7
push 0x3ed
push dword [edi + 0x20]
call ebx
push 0
push eax
call esi
jmp 0x41b0ad
push 0x3ed
push dword [edi + 0x20]
call ebx
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x4b5
push dword [edi + 0x20]
call ebx
push 1
push dword [0x6240b4]
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41de32
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x617ff0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push edi
push 0
push 0
mov edi, ecx
push 0x188
push edi
call ebx
push 0
push 0
push 0x184
push edi
mov dword [ebp - 0x614], eax
call ebx
lea eax, [ebp - 0x208]
xor esi, esi
and dword [ebp - 0x60c], esi
push str.SOFTWAREStardockMultiplicity2
push eax
call fcn.00589e60
lea eax, [ebp - 0x208]
push 0x5e60a0
push eax
call fcn.00589e70
lea eax, [ebp - 0x208]
push str.Machines
push eax
call fcn.00589e70
add esp, 0x18
lea eax, [ebp - 0x60c]
push eax
lea eax, [ebp - 0x208]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, 0xff
mov dword [ebp - 0x610], 1
push eax
lea eax, [ebp - 0x408]
push eax
push esi
push dword [ebp - 0x60c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x41e058
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.005838b0
lea eax, [ebp - 0x408]
push eax
call fcn.00589e3d
mov ecx, eax
add esp, 0x10
mov eax, 0xff
cmp ecx, eax
cmovg ecx, eax
xor edx, edx
test ecx, ecx
jle 0x41df35
mov al, byte [ebp + edx*2 - 0x408]
mov byte [ebp + edx - 0x108], al
inc edx
cmp edx, ecx
jl 0x41df22
cmp ecx, 0x104
jae 0x41e0a7
mov byte [ebp + ecx - 0x108], 0
call fcn.0041e7a0
test eax, eax
je 0x41df59
xor eax, eax
cmp esi, 0x31
jmp 0x41df97
call fcn.0041e721
test eax, eax
je 0x41df69
xor eax, eax
cmp esi, 0x1f
jmp 0x41df97
call fcn.0041e6a2
test eax, eax
je 0x41df79
xor eax, eax
cmp esi, 0xf
jmp 0x41df97
call fcn.0041e555
test eax, eax
je 0x41df89
xor eax, eax
cmp esi, 1
jmp 0x41df97
call fcn.0041e5f7
test eax, eax
je 0x41df9c
xor eax, eax
cmp esi, 8
setle al
jmp 0x41dfab
call fcn.0041e8e4
test eax, eax
je 0x41dfb3
test esi, esi
jle 0x41dfb3
xor eax, eax
test eax, eax
je 0x41e034
push ecx
push str.Machines
push 0
mov edx, str.VideoMode
lea ecx, [ebp - 0x108]
call fcn.004386d9
cmp eax, 1
jne 0x41e034
push ecx
push str.Machines
push 0
mov edx, str.InternalOnly
lea ecx, [ebp - 0x108]
call fcn.004386d9
test eax, eax
jne 0x41e034
mov byte [ebp - 0xa], al
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x608]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
lea eax, [ebp - 0x608]
push eax
push 0
push 0x180
push edi
call ebx
push esi
push eax
push 0x19a
push edi
call ebx
inc esi
push 0xff
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x610]
push dword [ebp - 0x60c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc dword [ebp - 0x610]
test eax, eax
je 0x41deee
push dword [ebp - 0x60c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push dword [ebp - 0x614]
mov esi, 0x186
push esi
push edi
call ebx
push 0
push 0
push 0x188
push edi
call ebx
cmp eax, 0xffffffff
jne 0x41e096
push 0
push 0
push esi
push edi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00580b5b
mov esp, ebp
pop ebp
ret
call fcn.0058106a
int3
Function at 0x4215cd
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, ecx
push esi
xor esi, esi
cmp dword [ebx + 0xc0], esi
jne 0x4216db
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3e8
push dword [ebx + 0x20]
mov dword [0x623ab8], esi
call edi
push esi
push esi
mov esi, dword [sym.imp.USER32.dll_InvalidateRect]
push eax
call esi
push 0x3ea
push dword [ebx + 0x20]
call edi
push 0
push 0
push eax
call esi
push 0x4b6
push dword [ebx + 0x20]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x3ef
push dword [ebx + 0x20]
call edi
push 0
push eax
call esi
push 0x3f6
push dword [ebx + 0x20]
call edi
push 0
push eax
call esi
push 0x405
push dword [ebx + 0x20]
call edi
push 0
push eax
call esi
push 0x406
push dword [ebx + 0x20]
call edi
push 0
push eax
call esi
push 0x452
push dword [ebx + 0x20]
call edi
push 0
push eax
call esi
push 0x45c
push dword [ebx + 0x20]
call edi
push 5
push eax
call esi
push 0x453
push dword [ebx + 0x20]
call edi
push 5
push eax
call esi
push ecx
push str.Remote.ini
push 0
mov edx, str.Remote
mov ecx, str.RemoteAudio
call fcn.00407367
pop edi
test eax, eax
je 0x4216db
cmp dword [ebx + 0x940], 0
jne 0x4216db
call fcn.00427a74
mov esi, eax
test esi, esi
je 0x4216db
push 2
pop edx
mov ecx, esi
call fcn.00427b1a
xor edx, edx
mov ecx, esi
inc edx
call fcn.00427b1a
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop ebx
ret
Function at 0x424b10
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x617ff0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x108]
push esi
push 0
push eax
call fcn.005838b0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push esi
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov edi, eax
test edi, edi
je 0x424bfb
lea ecx, [edi + 1]
push ecx
call fcn.0058b06c
mov esi, eax
pop ecx
test esi, esi
je 0x424bfb
push esi
push edi
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x424bf4
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x30c]
push eax
push 0x5e60a0
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x424bf4
mov ecx, dword [ebp - 0x30c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0x308]
push 0x5ebea0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x308]
mov ecx, 0x6b5adc
push eax
call fcn.00406b7c
push esi
call fcn.0058b077
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00580b5b
mov esp, ebp
pop ebp
ret
Function at 0x424c0b
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push 0x224
mov eax, 0x5a2c9d
call fcn.0058141a
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x220], edi
xor eax, eax
push eax
push eax
push eax
push 1
push str.Start8
mov dword [ebp - 0x230], eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, eax
mov dword [ebp - 0x224], 0x1f40
mov dword [ebp - 0x22c], ebx
test ebx, ebx
jne 0x424c69
push 0x5e6d2c
mov ecx, edi
call fcn.0040820c
jmp 0x424dc3
push 4
lea eax, [ebp - 0x224]
push eax
push 2
push ebx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
lea eax, [ebp - 0x210]
push str.Accept:___r_n_r_n
push eax
call fcn.0058bd82
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x210]
push 0x4000000
push eax
call fcn.00589e3d
pop ecx
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0x214], eax
test eax, eax
jne 0x424cc5
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x424c58
push 0x100000
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
push eax
mov dword [ebp - 0x220], eax
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], eax
push ecx
push 0x3ff
push eax
push dword [ebp - 0x214]
xor esi, esi
and dword [ebp - 0x218], esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x424d50
mov edi, dword [ebp - 0x21c]
mov ebx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x424d44
add esi, eax
add edi, eax
cmp esi, 0xff800
jg 0x424d44
lea eax, [ebp - 0x218]
push eax
push 0x3ff
push edi
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x424d16
mov edi, dword [ebp - 0x228]
mov ebx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x21c]
push dword [ebp - 0x214]
mov word [esi + eax], 0
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
call fcn.0044a3d6
push eax
lea ecx, [ebp - 0x214]
call fcn.00403f59
push dword [ebp - 0x21c]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x214]
call fcn.00403e04
mov esi, dword [ebp - 0x220]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov esi, dword [ebp - 0x214]
add esi, 0xfffffff0
push esi
call fcn.00403e98
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00404048
mov eax, edi
call fcn.005813c4
ret
Function at 0x426899
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x617ff0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.005838b0
add esp, 0xc
lea ecx, [ebp - 0x108]
call fcn.0041d882
lea eax, [ebp - 0x108]
push str._steam_api.dll
push eax
call fcn.00589e70
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00580b5b
mov esp, ebp
pop ebp
ret
Function at 0x427b1a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x617ff0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xa
lea eax, [ebp - 0x104]
mov esi, ecx
push eax
push edx
call fcn.0058b78d
add esp, 0xc
xor eax, eax
mov byte [ebp - 0x100], al
mov dword [ebp - 0x108], eax
push eax
lea eax, [ebp - 0x108]
push eax
push 4
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00580b5b
mov esp, ebp
pop ebp
ret

Function at 0x427b77
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x617ff0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0xa
lea eax, [ebp - 0x104]
mov edi, ecx
push eax
push 4
call fcn.0058b78d
add esp, 0xc
lea eax, [ebp - 0x108]
xor ebx, ebx
mov byte [ebp - 0x100], bl
mov dword [ebp - 0x108], ebx
push ebx
push eax
push 4
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0xa
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.0058b78d
add esp, 0xc
mov byte [ebp - 0x100], bl
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], ebx
push ebx
push eax
push 4
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00580b5b
mov esp, ebp
pop ebp
ret 4

Function at 0x427c11
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x617ff0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x104]
push 0xa
push eax
push edx
mov ebx, ecx
call fcn.0058b78d
add esp, 0xc
xor eax, eax
mov byte [ebp - 0x100], al
mov dword [ebp - 0x208], eax
push eax
lea eax, [ebp - 0x208]
push eax
push 4
lea eax, [ebp - 0x104]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
lea eax, [ebp - 0x204]
push edi
push eax
call fcn.00589e60
and dword [ebp - 0x208], 0
lea eax, [ebp - 0x208]
pop ecx
pop ecx
push 0
push eax
push 0xff
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00580b5b
mov esp, ebp
pop ebp
ret 4

Function at 0x427ca7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x617ff0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0xa
lea eax, [ebp - 0x104]
mov edi, ecx
push eax
push 8
call fcn.0058b78d
add esp, 0xc
lea eax, [ebp - 0x108]
xor ebx, ebx
mov byte [ebp - 0x100], bl
mov dword [ebp - 0x108], ebx
push ebx
push eax
push 4
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0xa
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.0058b78d
add esp, 0xc
mov byte [ebp - 0xfc], bl
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], ebx
push ebx
push eax
push 8
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00580b5b
mov esp, ebp
pop ebp
ret 4
Function at 0x429f5e
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x617ff0]
xor eax, ebp
mov dword [ebp - 4], eax
push str.SetWindowRgnEx
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x429f8d
xor eax, eax
jmp 0x429fdf
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x429fde
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00580b5b
mov esp, ebp
pop ebp
ret

Function at 0x42a33f
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x617ff0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x20c], 0
lea eax, [ebp - 0x104]
push ebx
mov ebx, dword [ebp + 8]
push esi
push str.SOFTWAREStardockMultiplicity2
push eax
call fcn.00589e60
mov esi, 0x5e60a0
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.00589e70
lea eax, [ebp - 0x104]
push str.Multiplicity.ini
push eax
call fcn.00589e70
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.00589e70
lea eax, [ebp - 0x104]
push str.Lock
push eax
call fcn.00589e70
add esp, 0x28
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test ebx, ebx
jne 0x42a3e4
mov esi, str.LockReg
push esi
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x42a41e
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.00589e60
lea eax, [ebp - 0x208]
push eax
call fcn.0058b5a0
add esp, 0xc
mov esi, str.LockReg
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push 0
push esi
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042b3a5
test eax, eax
je 0x42a4b2
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
xor eax, eax
push eax
push 0xf013f
push eax
push eax
push eax
lea eax, [ebp - 0x104]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test ebx, ebx
jne 0x42a471
push esi
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x42a4a6
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.00589e60
lea eax, [ebp - 0x208]
push eax
call fcn.0058b5a0
add esp, 0xc
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push 0
push esi
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.00580b5b
mov esp, ebp
pop ebp
ret 8