joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42df7d
Capabilities:
Read file on windows

Disassembly:
push 0x2c
mov eax, 0x464504
call fcn.0043a465
mov eax, edx
mov edi, ecx
mov dword [ebp - 0x14], edi
push ecx
mov edx, 0x47cb40
mov ecx, eax
call fcn.00430d0f
mov esi, eax
mov ecx, esi
call fcn.0042f0cc
pop ecx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], 1
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push 0x100001
mov ecx, eax
call fcn.0041727b
push esi
mov ebx, 0x100000
push ebx
push 1
push dword [ebp - 0x28]
call fcn.00444305
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp eax, ebx
ja 0x42e058
push esi
call fcn.0044a283
pop ecx
test eax, eax
je 0x42dffd
push 0x133
jmp 0x42e05d
push esi
call fcn.0044a257
pop ecx
test eax, eax
jne 0x42e00f
push 0x13b
jmp 0x42e05d
mov ebx, dword [ebp - 0x28]
mov ecx, ebx
mov edx, dword [ebp - 0x10]
call fcn.0042df49
mov ecx, dword [ebp - 0x10]
and dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea eax, [ebx + ecx]
cmp ebx, eax
je 0x42e03d
push ecx
push ebx
mov ecx, edi
call fcn.00406baa
lea ecx, [ebp - 0x28]
call fcn.004115b2
test esi, esi
je 0x42e050
push esi
call fcn.00443728
pop ecx
mov eax, edi
call fcn.0043a42e
ret
push 0xc8
lea ecx, [ebp - 0x38]
call fcn.0040d141
push 0x489ff8
lea eax, [ebp - 0x38]
push eax
call fcn.0043d85d
int3

Function at 0x433ee5
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebx, ecx
push edi
mov edi, dword [esp + 0x24]
mov ebp, SysReAllocString
test edi, edi
jl 0x433f68
jg 0x433f11
test esi, esi
je 0x433f68
test edi, edi
jg 0x433f11
jl 0x433f0d
cmp esi, ebp
jae 0x433f11
mov eax, esi
jmp 0x433f13
mov eax, ebp
and dword [esp + 0x20], 0
cmp dword [esp + 0x18], 0xffffffff
je 0x433f59
push 0
lea ecx, [esp + 0x24]
push ecx
push eax
push ebx
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x433f43
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x433f63
jmp 0x433f59
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x433f54
add ebx, eax
cdq
sub esi, eax
sbb edi, edx
jmp 0x433ef9
cmp eax, 0xffffffff
jne 0x433f63
call fcn.00442004
cmp dword [eax], 4
je 0x433ef9
or eax, 0xffffffff
jmp 0x433f6a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4010e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4010fb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401132
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40112e
jmp 0x401120
cmp esi, eax
jae 0x401132
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401120
cmp esi, eax
jb 0x401139
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x401af0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x657b44
push 0x66
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x401b18
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 1
push 2
push 0
push 7
push 0x40000000
push str.C:Program_Files__x86_Fonsdkxgl.rar
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401b80
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x657b70
push 0x65
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x401ba8
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 1
push 2
push 0
push 7
push 0x40000000
push str.C:Program_Files__x86_FonsdRar.exe
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push ebx
push edi
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401c10
Capabilities:
Create directory
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push esi
push edi
nop
nop
nop
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call esi
push 0
push str.C:Program_Files__x86_Fonsd
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.00401af0
call fcn.00401b80
push 0x3e8
call esi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 5
push 0
push str._y_x__pq121__C:Program_Files__x86_Fonsdkxgl.rar___C:Program_Files__x86_Fonsd_
push str.C:Program_Files__x86_FonsdRar.exe
push str.open
push 0
call edi
push 0x7d0
call esi
push 1
push 0
push 0
push str.C:Program_Files__x86_Fonsdupdate.exe
push str.open
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x425360
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x4253e8
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4253a8
push str.hAdvAPI32___0
push 0
push 0x28c
push str.f:dd_vctools_vc7libs_ship_atlmfcinclude_atltransactionmanager.h
push 2
call fcn.005d4f20
add esp, 0x14
cmp eax, 1
jne 0x4253a8
int3
cmp dword [ebp - 8], 0
jne 0x4253b5
mov eax, 1
jmp 0x425406
push str.RegDeleteKeyTransactedA
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4253e6
push 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x425406
jmp 0x425401
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 4], 0
je 0x425401
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x425406
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x42ee70
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x42eea0
push 0x477
push 0x622688
call fcn.00429610
test eax, eax
je 0x42eea0
int3
mov eax, dword [ebp - 8]
cmp dword [eax + 0x6c], 0
jne 0x42eee6
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004023f0
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
call fcn.00402420
jmp 0x42ef00
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x6c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x6c]
mov edx, dword [eax]
mov eax, dword [edx + 0x94]
call eax
mov esp, ebp
pop ebp
ret 4
Function at 0x42ef10
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x42ef40
push 0x48c
push 0x622688
call fcn.00429610
test eax, eax
je 0x42ef40
int3
push 0x61e834
mov ecx, dword [ebp + 0xc]
call fcn.00401350
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x68], 0
jne 0x42efa7
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42efa5
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
add edx, 1
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004023f0
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.00402420
jmp 0x42efc8
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.004397c0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42efc8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.0042ee70
mov ecx, dword [ebp + 0xc]
call fcn.00401480
mov esp, ebp
pop ebp
ret 8

Function at 0x4367c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x436845
call fcn.0041cfa0
mov dword [ebp - 0x10], eax
push 0xf0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x436845
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43681e
xor eax, eax
jmp 0x436876
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x436845
push 0x117f
push 0x622688
call fcn.00429610
test eax, eax
je 0x436845
int3
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00436880
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x436873
cmp dword [ebp - 0xc], 0
je 0x436873
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004087a0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x439c20
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60f6e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x6790c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x439c78
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x6c], 0
jne 0x439c78
push 0x100
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcwinocc.cpp
call fcn.00429610
test eax, eax
je 0x439c78
int3
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x6c], 0
jne 0x439c9a
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x439cfd
lea ecx, [ebp - 0x10]
call fcn.00401d90
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x6c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x6c]
mov edx, dword [edx]
mov eax, dword [edx + 0x94]
call eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00401d70
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00403f50
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401620
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x442620
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
call fcn.00401d80
movzx eax, al
test eax, eax
jne 0x44265d
mov ecx, dword [ebp + 8]
call fcn.00401d70
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x44265d
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x90
call fcn.00516f90
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x445a70
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x445aa4
push str.m_hKey___0
push 0
push 0x1629
push 0x623b70
push 2
call fcn.005d4f20
add esp, 0x14
cmp eax, 1
jne 0x445aa4
int3
xor edx, edx
jne 0x445aa4
xor eax, eax
jne 0x445a7b
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], 0
je 0x445acc
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 8]
call fcn.00425360
jmp 0x445b3a
movzx eax, byte [0x67c868]
test eax, eax
jne 0x445b06
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x445aff
push str.RegDeleteKeyExA
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x67c864], eax
mov byte [0x67c868], 1
cmp dword [0x67c864], 0
je 0x445b2a
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [0x67c864]
jmp 0x445b3a
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret 4
Function at 0x491950
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 0xc], 0
jne 0x491969
call fcn.0041cfa0
mov dword [ebp + 0xc], eax
mov ecx, 0x67d788
call fcn.00401d70
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x49198f
xor eax, eax
jmp 0x4919ff
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4919aa
xor eax, eax
jmp 0x4919ff
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4919cb
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x4919ff
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.00493220
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004087a0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x504150
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
je 0x504171
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
jmp 0x5041cc
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x504195
call fcn.0042c2a0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5041b4
call fcn.0042c2a0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5041cc
call fcn.0042c2a0
call fcn.0043d120
cmp dword [eax + 0x3c], 0
je 0x5041e6
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.005040f0
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00503fa0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x7c], 0
je 0x504216
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x7c], 0
cmp dword [ebp - 4], 0
je 0x50422b
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov dword [edx + 0x7c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x515f20
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.00515b70
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x515f76
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.004023f0
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.00402420
jmp 0x515f88
mov ecx, dword [ebp + 0x10]
call fcn.00401d70
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00441050
mov esp, ebp
pop ebp
ret 0xc
Function at 0x516070
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
call fcn.00439830
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 3
cmp eax, 3
je 0x5160ad
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00515b70
jmp 0x5160b9
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.00515ba0
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x51611d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x5160f4
mov edx, dword [ebp - 8]
add edx, 1
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004023f0
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x516111
push 0x100
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.00401670
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.00402420
jmp 0x51614e
mov ecx, dword [ebp + 0x10]
call fcn.00401d70
push eax
push 0xffffffffffffffff
push 0x14d
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x51614e
mov ecx, dword [ebp + 0x10]
call fcn.00401d70
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00441050
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5168f0
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x516922
push str.m_hKey___0
push 0
push 0x164f
push 0x623b70
push 2
call fcn.005d4f20
add esp, 0x14
cmp eax, 1
jne 0x516922
int3
xor edx, edx
jne 0x516922
xor eax, eax
jne 0x5168f9
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret 4

Function at 0x52c4d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jne 0x52c504
push str.m_hKey___0
push 0
push 0x170a
push 0x623b70
push 2
call fcn.005d4f20
add esp, 0x14
cmp eax, 1
jne 0x52c504
int3
xor edx, edx
jne 0x52c504
xor eax, eax
jne 0x52c4db
mov dword [ebp - 8], 4
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x52c53f
mov eax, dword [ebp - 0xc]
jmp 0x52c54e
cmp dword [ebp - 4], 4
je 0x52c54c
mov eax, 0xd
jmp 0x52c54e
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x52c560
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0x10], 0
jne 0x52c592
push str.pnBytes___0
push 0
push 0x1733
push 0x623b70
push 2
call fcn.005d4f20
add esp, 0x14
cmp eax, 1
jne 0x52c592
int3
mov ecx, dword [ebp - 0xc]
cmp dword [ecx], 0
jne 0x52c5bb
push str.m_hKey___0
push 0
push 0x1734
push 0x623b70
push 2
call fcn.005d4f20
add esp, 0x14
cmp eax, 1
jne 0x52c5bb
int3
xor eax, eax
jne 0x52c5bb
xor ecx, ecx
jne 0x52c592
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x52c5ef
mov eax, dword [ebp - 8]
jmp 0x52c5fe
cmp dword [ebp - 4], 3
je 0x52c5fc
mov eax, 0xd
jmp 0x52c5fe
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x52c610
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x52c642
push str.m_hKey___0
push 0
push 0x1805
push 0x623b70
push 2
call fcn.005d4f20
add esp, 0x14
cmp eax, 1
jne 0x52c642
int3
xor edx, edx
jne 0x52c642
xor eax, eax
jne 0x52c619
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 3
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x52c670
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x52c6a2
push str.m_hKey___0
push 0
push 0x180d
push 0x623b70
push 2
call fcn.005d4f20
add esp, 0x14
cmp eax, 1
jne 0x52c6a2
int3
xor edx, edx
jne 0x52c6a2
xor eax, eax
jne 0x52c679
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 8