joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408a30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4581e4
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x47b154]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0x45fe14
push 0x3ee
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0
push 0x406
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_CheckDlgButton]
lea ecx, [ebp - 0x6c]
call fcn.00438fe0
mov dword [ebp - 4], 0
push 0x3ef
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.00409450
mov dword [ebp - 0x10], eax
push 0x407
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
jne 0x408add
push 1
mov ecx, dword [ebp - 0x10]
push ecx
push 0x43b080
lea ecx, [ebp - 0x6c]
call fcn.00430030
jmp 0x408aee
mov edx, dword [ebp - 0x10]
push edx
push 0x43b080
lea ecx, [ebp - 0x6c]
call fcn.00430010
push 5
push 0x406
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push 0x407
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3ef
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0xffff8000
mov ecx, dword [ebp - 0x14]
call fcn.00409580
push 0
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.00439060
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x408b90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458211
mov eax, dword fs:[0]
push eax
sub esp, 0x344
mov eax, dword [0x47b154]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x350], ecx
lea ecx, [ebp - 0x348]
call fcn.00436910
mov dword [ebp - 4], 0
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0x45fe18
push 0x3ee
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x3ef
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x350]
call fcn.00409450
mov dword [ebp - 0x34c], eax
push 0x407
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
jne 0x408c44
push 1
mov eax, dword [ebp - 0x34c]
push eax
push 0x43b080
lea ecx, [ebp - 0x348]
call fcn.00430030
jmp 0x408c5b
mov ecx, dword [ebp - 0x34c]
push ecx
push 0x43b080
lea ecx, [ebp - 0x348]
call fcn.00430010
push 0
push 0x406
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push 0x407
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x348]
call fcn.00436a10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00453754
mov esp, ebp
pop ebp
ret 4
Function at 0x408cf0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458248
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x47b154]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0x45fe1c
push 0x3ee
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x3ef
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00409450
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x20]
call fcn.0043a030
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
push edx
push 0x43aed0
lea ecx, [ebp - 0x20]
call fcn.0042fe10
push 0
push 0x406
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x407
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0043a050
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40b294
xor eax, eax
jmp 0x40b314
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40b2ab
xor eax, eax
jmp 0x40b314
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x40b2f7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x40b2f7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x40b2ce
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x40b303
xor eax, eax
jmp 0x40b314
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x40b311
xor eax, eax
jmp 0x40b314
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x41a9e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x47b154]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], 0x100
push 0x47be38
push 0x100
lea eax, [ebp - 0x208]
push eax
push 0x462cb4
push 0x462db4
push 0x463140
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x854
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041ab50
add esp, 0xc
push 0x47be38
push 0x100
lea eax, [ebp - 0x208]
push eax
push 0x463148
push 0x46314c
push 0x463160
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x85a
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041ab50
add esp, 0xc
push 0x47be38
push 0x100
lea eax, [ebp - 0x208]
push eax
push 0x463168
push 0x46316c
push 0x463180
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x865
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041ab50
add esp, 0xc
push 0x47be38
push 0x100
lea eax, [ebp - 0x208]
push eax
push 0x463188
push 0x46318c
push 0x46319c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x857
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041ab50
add esp, 0xc
push 0x47be38
push 0x100
lea eax, [ebp - 0x208]
push eax
push 0x4631a4
push 0x4631a8
push 0x4631b4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x85f
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041ab50
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00453754
mov esp, ebp
pop ebp
ret
Function at 0x424af0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x459ab9
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x47b154]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
mov dword [ebp - 0x18], eax
push 0x401
push 1
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_EnableMenuItem]
cmp dword [0x47be34], 0
jne 0x424b5a
push 0
push 0x4235c0
mov edx, dword [ebp + 8]
push edx
push 0x70
mov eax, dword [0x47bc70]
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov dword [0x47be34], eax
cmp dword [0x47be34], 0
jne 0x424b67
xor eax, eax
jmp 0x424bcc
push 5
mov ecx, dword [0x47be34]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x47c09c], 0
jne 0x424bc5
push 0x234
call sub.mfc140u.dll_operator
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x424ba9
mov ecx, dword [ebp - 0x10]
call fcn.00434610
mov dword [ebp - 0x14], eax
jmp 0x424bb0
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [0x47c09c], eax
call fcn.00426160
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42da20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45a8fe
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x47b154]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx], 0
jne 0x42db1d
call fcn.0041d870
mov dword [ebp - 0x54], eax
call fcn.0041d880
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [0x47c098], 0
jne 0x42da8e
xor eax, eax
jmp 0x42dba0
mov ecx, dword [0x47c098]
call fcn.0041e1b0
mov dword [ebp - 0x40], eax
mov ecx, 0x47c0b8
call fcn.0042dcf0
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
push edx
mov ecx, dword [0x47c098]
call fcn.0041e200
mov dword [ebp - 0x3c], eax
mov ecx, dword [0x47c098]
call fcn.0041e1d0
mov dword [ebp - 0x38], eax
mov ecx, 0x47c0b8
call fcn.0042dcf0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [0x47c098]
call fcn.0041e270
mov dword [ebp - 0x34], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x40]
push eax
push 0x46c00000
push 0
push str.RESPONSEGRAPH
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov dword [0x47c088], eax
push 0x466b30
lea ecx, [ebp - 0x78]
call dword [sym.imp.VasDBFrame.dll_public:_void___thiscall_CVasSysString::constructor_wchar_t_const__]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x48]
call dword [sym.imp.VasDBFrame.dll_public:_wchar_t_const____thiscall_CVasSysString::operator_wchar_t_const__void_]
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x4c]
push ecx
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call dword [sym.imp.VasDBFrame.dll_public_virtual:_void___thiscall_CVasSysString::destructor_void_]
push 5
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0x24]
cmp dword [edx], 0
je 0x42db96
mov dword [ebp - 0x28], 1
jmp 0x42db9d
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00453754
mov esp, ebp
pop ebp
ret 8
Function at 0x43d2c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x47b154]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], 0x100
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x210], 0
movsd xmm0, qword [0x45f9d0]
movsd qword [ebp - 0x218], xmm0
push 0x46b024
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x43d502
push 0x47be38
push 0x100
lea ecx, [ebp - 0x208]
push ecx
push 0x46b084
mov edx, dword [ebp + 0xc]
push edx
push 0x46b088
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x46b090
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x43d502
lea ecx, [ebp - 0x210]
push ecx
push 0x46b094
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x43d3ae
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xf
jle 0x43d3ae
mov ecx, 2
imul edx, ecx, 0xf
xor eax, eax
mov ecx, dword [ebp - 0x20c]
mov word [ecx + edx], ax
cmp dword [ebp - 0x20c], 0
je 0x43d407
mov edx, dword [ebp - 0x20c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x43d407
lea ecx, [ebp - 0x210]
push ecx
push 0x46b098
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
mov dword [ebp - 0x20c], eax
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x20c]
push eax
call fcn.0043c570
add esp, 8
jmp 0x43d502
lea ecx, [ebp - 0x210]
push ecx
push 0x46b09c
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x43d502
cmp dword [ebp - 0x20c], 0
je 0x43d502
push 0x46b0a0
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x43d502
lea eax, [ebp - 0x210]
push eax
push 0x46b0a4
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x43d4a7
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xf
jle 0x43d4a7
mov edx, 2
imul eax, edx, 0xf
xor ecx, ecx
mov edx, dword [ebp - 0x20c]
mov word [edx + eax], cx
cmp dword [ebp - 0x20c], 0
je 0x43d4fd
mov eax, dword [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x43d4fd
lea edx, [ebp - 0x210]
push edx
push 0x46b0a8
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
mov dword [ebp - 0x20c], eax
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x20c]
push ecx
call fcn.0043c570
add esp, 8
jmp 0x43d502
jmp 0x43d431
fld qword [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00453754
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x110ffc0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x110ffca
pushal
call 0x110ffd0
pop ebp
sub ebp, 0x10
sub ebp, 0xd0ffc0
jmp 0x110ffe6
mov eax, 0xd0ffc0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c4
mov edx, 0x3229f126
xor byte [eax], dl
inc eax
dec ecx
jne 0x110fffd
jmp 0x1110010
lodsd eax, dword [esi]
jmp entry0
Function at 0x401510
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [esp + 0x114]
push ebx
push ebp
mov ebx, ecx
mov ecx, dword [esp + 0x118]
push esi
push edi
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x20], ebx
call fcn.004012b0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftSourceSafe
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
xor ecx, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete cl
mov esi, ecx
test esi, esi
je 0x4015eb
mov ebx, dword [ebx + 0x68]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
call ebp
mov edx, dword [esp + 0x10]
push eax
push ebx
push 1
push 0
push str.SCCServerName
push edx
call edi
xor ecx, ecx
lea edx, [esp + 0x18]
test eax, eax
sete cl
push edx
and esi, ecx
call ebp
mov ecx, dword [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push str.SCCServerPath
push ecx
call edi
xor edx, edx
test eax, eax
lea eax, [esp + 0x18]
sete dl
push eax
and esi, edx
call ebp
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
push 1
push 0
push str.SCCServerPathDebug
push edx
call edi
mov edx, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
sete cl
push edx
and esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [esp + 0x14]
test esi, esi
je 0x401640
lea eax, [esp + 0x10]
push eax
push str.SoftwareSourceCodeControlProvider
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
xor ecx, ecx
test eax, eax
sete cl
mov esi, ecx
test esi, esi
je 0x401640
mov edx, dword [esp + 0x10]
push 0x1d
push str.SoftwareMicrosoftSourceSafe
push 1
push 0
push str.ProviderRegKey
push edx
call edi
mov edx, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
sete cl
push edx
and esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40164e
push 0x30
push 0xfa4
mov ecx, ebx
call fcn.00401b20
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 8
Function at 0x402aa0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417f50
push 0x405e48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x420c50], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x420c4c], ecx
shl ecx, 8
add ecx, edx
mov dword [0x420c48], ecx
shr eax, 0x10
mov dword [0x420c44], eax
call fcn.00405e00
test eax, eax
jne 0x402b0a
push 0x1c
call fcn.00402c50
add esp, 4
call fcn.00404fc0
test eax, eax
jne 0x402b1d
push 0x10
call fcn.00402c50
add esp, 4
mov dword [ebp - 4], 0
call fcn.00405bf0
call fcn.00403f10
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x422230], eax
call fcn.00405a90
mov dword [0x420c34], eax
test eax, eax
je 0x402b50
mov eax, dword [0x422230]
test eax, eax
jne 0x402b5a
push 0xffffffffffffffff
call fcn.00402d20
add esp, 4
call fcn.004057e0
call fcn.004056f0
call fcn.00402cf0
mov esi, dword [0x422230]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x402c39
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x402ba1
test al, al
je 0x402ba1
and eax, 0xff
push eax
call fcn.00405690
add esp, 4
test eax, eax
je 0x402b7b
inc esi
mov dword [ebp - 0x64], esi
jmp 0x402b7b
cmp byte [esi], 0x22
jne 0x402baa
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x402bba
cmp al, 0x20
ja 0x402bba
inc esi
mov dword [ebp - 0x64], esi
jmp 0x402baa
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x402bdb
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x402be0
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.00402d20
jmp 0x402c1e
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x402baa
inc esi
mov dword [ebp - 0x64], esi
jmp 0x402c39

Function at 0x402d60
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
call fcn.00402e20
mov eax, dword [0x420c80]
mov ebp, dword [esp + 0x10]
cmp eax, 1
jne 0x402d84
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x420c7c], 1
mov byte [0x420c78], bl
jne 0x402dde
mov ecx, dword [0x422228]
test ecx, ecx
je 0x402dcc
mov esi, dword [0x422224]
sub esi, 4
cmp esi, ecx
jb 0x402dcc
mov eax, dword [esi]
test eax, eax
je 0x402dc5
call eax
mov ecx, dword [0x422228]
sub esi, 4
cmp esi, ecx
jae 0x402db7
push 0x41b074
push 0x41b06c
call fcn.00402e40
add esp, 8
push 0x41b080
push 0x41b078
call fcn.00402e40
add esp, 8
test ebx, ebx
je 0x402dfd
call fcn.00402e30
pop esi
pop ebp
pop ebx
ret
push ebp
mov dword [0x420c80], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x404fc0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.00405290
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x41bb60], eax
je 0x405018
push 0x74
push 1
call fcn.00406930
mov esi, eax
add esp, 8
test esi, esi
je 0x405018
mov eax, dword [0x41bb60]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x405018
push esi
call fcn.00405020
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x405040
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x41bb60]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x4050ae
push 0x74
push 1
call fcn.00406930
mov esi, eax
add esp, 8
test esi, esi
je 0x4050a4
mov ecx, dword [0x41bb60]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4050a4
push esi
call fcn.00405020
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
push 0x10
call fcn.00402c50
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret