joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4095f0
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4abf5c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4f3168]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00409900
push 0
call dword [0x4b43c8]
test eax, eax
je 0x409792
xor edi, edi
nop
push edi
call dword [0x4b43c0]
mov edi, eax
test edi, edi
je 0x40978c
cmp edi, 0xd
jne 0x409669
push 8
call fcn.0048bcd0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x409690
mov ecx, eax
call fcn.004221a0
mov esi, eax
jmp 0x409692
cmp edi, 8
jne 0x4096c2
push edi
call fcn.0048bcd0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x409690
mov ecx, eax
call fcn.00421980
mov esi, eax
jmp 0x409692
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4096c2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test eax, eax
je 0x4096b9
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 4]
mov dword [ebp - 0x10], esi
call fcn.0040e100
jmp 0x4096c2
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0xc]
cmp edi, dword [0x4f6424]
jne 0x40971f
push 8
call fcn.0048bcd0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x4096ed
mov ecx, eax
call fcn.00421ca0
mov esi, eax
jmp 0x4096ef
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x40971f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test eax, eax
je 0x409716
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 4]
mov dword [ebp - 0x10], esi
call fcn.0040e100
jmp 0x40971f
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0xc]
cmp edi, dword [0x4f63a8]
jne 0x409630
push 8
call fcn.0048bcd0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 3
test eax, eax
je 0x40974e
mov ecx, eax
call fcn.004213c0
mov esi, eax
jmp 0x409750
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x409630
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test eax, eax
je 0x40977e
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 4]
mov dword [ebp - 0x10], esi
call fcn.0040e100
jmp 0x409630
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0xc]
jmp 0x409630
call dword [0x4b43c4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409e10
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
mov esi, ecx
call dword [0x4b43c8]
test eax, eax
je 0x409e8c
push ebx
push edi
call dword [0x4b43bc]
mov eax, dword [esi + 4]
sub eax, dword [esi]
mov ebx, dword [ebp + 8]
sar eax, 2
xor edi, edi
test eax, eax
je 0x409e5b
jmp 0x409e40
mov eax, dword [esi]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x409e4e
mov eax, dword [ecx]
push ebx
call dword [eax]
mov eax, dword [esi + 4]
sub eax, dword [esi]
inc edi
sar eax, 2
cmp edi, eax
jb 0x409e40
mov ecx, dword [esi + 0xc]
pop edi
mov eax, dword [ecx]
test ebx, ebx
pop ebx
je 0x409e6d
push 0x4b48d0
jmp 0x409e70
push dword [ebp + 0xc]
call dword [eax]
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x10]
push 0
call dword [eax]
call dword [0x4b43c4]
mov eax, 1
pop esi
pop ebp
ret 8
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x40c1b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4f3168]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x2c]
push eax
mov esi, ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
call dword [0x4b43f8]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push dword [esi + 4]
call dword [0x4b43f4]
mov eax, dword [ebp + 0xc]
cmp eax, 0x3ec
jne 0x40c301
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 8], 0
call dword [0x4b4390]
push dword [ebp - 0x28]
lea eax, [ebp - 0x14]
push dword [ebp - 0x2c]
push eax
call dword [0x4b43ec]
test eax, eax
jne 0x40c272
push 1
call dword [0x4b43b8]
mov ecx, 0xff00
and ax, cx
cmp ax, cx
je 0x40c272
push 0x3ec
push dword [esi + 4]
call dword [0x4b43a4]
jmp 0x40c27e
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call dword [0x4b43f0]
cmp dword [esi + 0x1e0], 0
je 0x40c2aa
push 1
call dword [0x4b43b8]
mov ecx, 0xff00
and ax, cx
cmp ax, cx
mov ecx, esi
je 0x40c2a5
call fcn.00409ea0
jmp 0x40c2aa
call fcn.00409ad0
push dword [ebp - 0x30]
lea eax, [ebp - 0x24]
push dword [ebp - 0x34]
mov dword [ebp - 0x24], 0xba
push eax
mov dword [ebp - 0x20], 0x1c
mov dword [ebp - 0x1c], 0x175
mov dword [ebp - 0x18], 0xc9
call dword [0x4b43ec]
test eax, eax
jne 0x40c3b5
cmp dword [esi + 0x1c4], eax
je 0x40c3b5
push 1
push eax
push dword [esi + 4]
mov dword [esi + 0x1c4], eax
call dword [0x4b4400]
jmp 0x40c3b5
cmp eax, 0xc
jne 0x40c33a
cmp dword [esi + 0x1ac], 1
jne 0x40c32d
mov ecx, esi
call fcn.00409950
push 1
push 0
push dword [esi + 4]
mov dword [esi + 0x1ac], 2
call dword [0x4b4400]
push 0xc
push dword [esi + 4]
call dword [0x4b43a4]
jmp 0x40c3b5
cmp eax, 0xd
jne 0x40c348
mov ecx, esi
call fcn.0040bf30
jmp 0x40c3b5
cmp eax, 0xb
jne 0x40c364
push eax
push dword [esi + 4]
call dword [0x4b43a4]
lea ecx, [esi + 0x20ac]
call fcn.0040d570
jmp 0x40c3b5
cmp eax, 0xe
jne 0x40c3b5
push 0
call fcn.00455d10
mov ecx, eax
call fcn.00455ce0
mov ecx, dword [0x4f4c28]
mov edx, eax
cmp ecx, dword [edx + 0xcf4]
jne 0x40c395
mov ecx, dword [0x4f4c24]
cmp ecx, dword [edx + 0xcf0]
je 0x40c3b5
mov eax, dword [edx + 0xcf0]
mov dword [0x4f4c24], eax
mov eax, dword [edx + 0xcf4]
mov ecx, 0x4f73b8
mov dword [0x4f4c28], eax
call fcn.004680e0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 4]
mov dword [eax], 0
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0048caf4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40d570
Capabilities:
Open clipboard

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
sub eax, dword [esi + 4]
sar eax, 2
test eax, eax
je 0x40d5dc
push 0
call dword [0x4b43c8]
test eax, eax
je 0x40d5dc
call dword [0x4b43bc]
mov eax, dword [esi + 8]
sub eax, dword [esi + 4]
xor edi, edi
sar eax, 2
test eax, eax
je 0x40d5bf
mov eax, dword [esi + 4]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x40d5b1
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [esi + 8]
sub eax, dword [esi + 4]
inc edi
sar eax, 2
cmp edi, eax
jb 0x40d5a2
mov eax, dword [esi + 8]
sub eax, dword [esi + 4]
sar eax, 2
test eax, eax
je 0x40d5d6
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x10]
push 0
call dword [eax]
call dword [0x4b43c4]
mov eax, dword [esi + 8]
sub eax, dword [esi + 4]
xor edi, edi
sar eax, 2
test eax, eax
je 0x40d61b
jmp 0x40d5f0
mov eax, dword [esi + 4]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x40d60d
push eax
call fcn.0048bbcf
mov eax, dword [esi + 4]
add esp, 4
mov dword [eax + edi*4], 0
mov eax, dword [esi + 8]
sub eax, dword [esi + 4]
inc edi
sar eax, 2
cmp edi, eax
jb 0x40d5f0
pop edi
pop esi
ret

Function at 0x4124f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac366
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4f3168]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi], vtable.CSkinButton2.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [0x4f2efc]
mov ecx, 0x4f2efc
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov eax, dword [0x4f2efc]
mov ecx, 0x4f2efc
mov dword [ebp - 4], 0
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x24], eax
xorps xmm0, xmm0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
movq qword [esi + 0x30], xmm0
mov ecx, esi
mov byte [ebp - 4], 1
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
call fcn.00412b40
mov eax, dword [esi + 0x28]
test eax, eax
je 0x4125c1
push eax
call dword [0x4b40b8]
mov dword [esi + 0x28], 0
push 0
push 0
push 0xc
push 0x4b4f9c
call fcn.0040e6e0
mov dword [esi + 0x28], eax
add esp, 0x10
mov dword [esi + 0x2c], 0
inc dword [0x4f4d18]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413f30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4f3168]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4f4d90]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x214], 0
test al, 1
jne 0x413f84
or eax, 1
mov dword [0x4f4d90], eax
mov eax, dword [0x4f2efc]
mov ecx, 0x4f2efc
call dword [eax + 0xc]
add eax, 0x10
push 0x4b37e0
mov dword [0x4f4d8c], eax
call fcn.0048be44
add esp, 4
mov eax, dword [0x4f4d8c]
cmp dword [eax - 0xc], 0
jne 0x413ff6
xor eax, eax
push 0x20a
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0048d890
add esp, 0xc
lea eax, [ebp - 0x210]
push 1
push 0x25
push eax
push 0
call dword [0x4b42c0]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413fd0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x210]
push eax
mov ecx, 0x4f4d8c
call fcn.004040d0
mov eax, dword [0x4f4d8c]
add eax, 0xfffffff0
push eax
call fcn.00402420
mov ecx, dword [ebp - 4]
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0048caf4
mov esp, ebp
pop ebp
ret

Function at 0x414020
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4f3168]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4f4d98]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x214], 0
test al, 1
jne 0x414074
or eax, 1
mov dword [0x4f4d98], eax
mov eax, dword [0x4f2efc]
mov ecx, 0x4f2efc
call dword [eax + 0xc]
add eax, 0x10
push 0x4b3810
mov dword [0x4f4d94], eax
call fcn.0048be44
add esp, 4
mov eax, dword [0x4f4d94]
cmp dword [eax - 0xc], 0
jne 0x4140e6
xor eax, eax
push 0x20a
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0048d890
add esp, 0xc
lea eax, [ebp - 0x210]
push 1
push 0x24
push eax
push 0
call dword [0x4b42c0]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4140c0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x210]
push eax
mov ecx, 0x4f4d94
call fcn.004040d0
mov eax, dword [0x4f4d94]
add eax, 0xfffffff0
push eax
call fcn.00402420
mov ecx, dword [ebp - 4]
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0048caf4
mov esp, ebp
pop ebp
ret
Function at 0x4145e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
test edx, edx
je 0x4146f3
mov esi, dword [ebp + 0x10]
test esi, esi
jle 0x4146f3
mov eax, dword [ebp + 8]
not eax
cmp esi, 8
jl 0x4146cf
push edi
mov edi, esi
shr edi, 3
mov ecx, edi
neg ecx
lea esi, [esi + ecx*8]
movzx ecx, byte [edx]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4b5468]
movzx ecx, byte [edx + 1]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4b5468]
movzx ecx, byte [edx + 2]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4b5468]
movzx ecx, byte [edx + 3]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4b5468]
movzx ecx, byte [edx + 4]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4b5468]
movzx ecx, byte [edx + 5]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4b5468]
movzx ecx, byte [edx + 6]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4b5468]
movzx ecx, byte [edx + 7]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4b5468]
add edx, 8
dec edi
jne 0x414615
pop edi
test esi, esi
je 0x4146ee
movzx ecx, byte [edx]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4b5468]
lea edx, [edx + 1]
dec esi
jne 0x4146d3
not eax
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret

Function at 0x4149e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x4f3168]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x802
push eax
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x806]
push eax
call fcn.0048d890
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
push 0
push 0
push 0x1a
push 0
call dword [0x4b42c8]
lea edx, [ebp - 0x808]
mov edi, eax
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x414a36
sub edx, ecx
sar edx, 1
push edx
lea eax, [ebp - 0x808]
push eax
mov ecx, esi
call fcn.004040d0
mov ecx, dword [ebp - 4]
xor eax, eax
test edi, edi
setns al
pop edi
xor ecx, ebp
pop esi
call fcn.0048caf4
mov esp, ebp
pop ebp
ret
Function at 0x4165f0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac672
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4f3168]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x4f4e18
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], 0
call fcn.00401930
mov eax, dword [esi]
mov dword [ebp - 4], 0
cmp dword [eax - 0xc], 0
mov dword [ebp - 0x220], 1
jne 0x416729
xor eax, eax
push 0x20a
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.0048d890
add esp, 0xc
lea eax, [ebp - 0x21c]
push 1
push 0x1a
push eax
push 0
call dword [0x4b42c0]
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4166a0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.004040d0
mov edx, dword [esi]
mov ecx, dword [edx - 0xc]
test ecx, ecx
jle 0x416729
lea eax, [ecx - 1]
test eax, eax
js 0x416746
cmp eax, ecx
jg 0x416746
cmp word [edx + eax*2], 0x5c
je 0x4166e2
push 0x5c
mov ecx, esi
call fcn.004020b0
push 0x11
push str.TencentQQPinyin_
mov ecx, esi
call fcn.00402200
push dword [esi]
call dword [0x4b42d0]
test eax, eax
jne 0x416706
push eax
push dword [esi]
push eax
call dword [0x4b42bc]
mov eax, dword [esi]
cmp dword [eax - 4], 1
mov edi, dword [eax - 0xc]
jle 0x416719
push edi
mov ecx, esi
call fcn.004028f0
push edi
push dword [esi]
push 0x4f4e18
call fcn.0048f326
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048caf4
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402400
int3

Function at 0x416bb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac672
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4f3168]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x4f5028
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], 0
call fcn.00401930
mov eax, dword [esi]
mov dword [ebp - 4], 0
cmp dword [eax - 0xc], 0
mov dword [ebp - 0x220], 1
jne 0x416c97
xor eax, eax
push 0x20a
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.0048d890
add esp, 0xc
lea eax, [ebp - 0x21c]
push 1
push 0x25
push eax
push 0
call dword [0x4b42c0]
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416c56
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.004040d0
mov eax, dword [esi]
cmp dword [eax - 4], 1
mov edi, dword [eax - 0xc]
jle 0x416c87
push edi
mov ecx, esi
call fcn.004028f0
push edi
push dword [esi]
push 0x4f5028
call fcn.0048f326
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048caf4
mov esp, ebp
pop ebp
ret
Function at 0x416f10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
push eax
call fcn.00416cc0
add esp, 0x10
push dword [ebp - 4]
call dword [0x4b42d0]
mov edi, dword [ebp - 4]
mov ecx, 1
test eax, eax
cmovne esi, ecx
add edi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x416f5d
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4170b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x417143
mov esi, dword [ebp + 8]
push edi
push esi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp + 0x10], 0
push dword [ecx]
call dword [0x4b403c]
test esi, esi
je 0x41713d
mov ecx, dword [edi]
test ecx, ecx
je 0x417138
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x417128
cmp edx, 2
jbe 0x417119
cmp edx, 7
jne 0x417128
test cl, 1
jne 0x417128
shr ecx, 1
cmp ecx, 1
jb 0x417128
cmp word [esi + ecx*2 - 2], 0
jne 0x417128
cmp ecx, 1
jbe 0x41713d
cmp word [esi + ecx*2 - 4], 0
jmp 0x417126
test cl, 1
jne 0x417128
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x41713d
xor eax, eax
mov word [esi], ax
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor ecx, ecx
mov word [esi], cx
pop edi
pop esi
pop ebp
ret 0xc
push 0x80004005
call fcn.00402400
int3

Function at 0x417150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
mov dword [ebp - 8], 4
call dword [0x4b403c]
cmp dword [ebp - 4], 4
jne 0x41718b
mov ecx, 1
test eax, eax
cmove esi, ecx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4171a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac750
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4f3168]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], edi
call fcn.00416f70
mov ebx, dword [0x4b4040]
test eax, eax
jne 0x417257
call fcn.00417010
test eax, eax
jne 0x417257
lea eax, [ebp - 0x44]
push eax
push 0x20019
push edi
push esi
push 0x80000001
call dword [0x4b4004]
test eax, eax
jne 0x417385
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x50]
lea eax, [ebp - 0x48]
push eax
push edi
push dword [ebp - 0x4c]
mov dword [ebp - 0x48], 4
push dword [ebp - 0x44]
mov dword [ebp - 0x54], 4
call dword [0x4b403c]
push dword [ebp - 0x44]
mov esi, eax
call ebx
xor ebx, ebx
test esi, esi
sete bl
jmp 0x417387
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 1
call fcn.00417f90
mov edi, eax
lea eax, [ebp - 0x28]
add esp, 4
cmp eax, edi
je 0x4172b2
cmp dword [ebp - 0x14], 8
jb 0x417295
push dword [ebp - 0x28]
call fcn.0048bbcf
add esp, 4
xor eax, eax
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00415110
cmp dword [ebp - 0x2c], 8
jb 0x4172c3
push dword [ebp - 0x40]
call fcn.0048bbcf
add esp, 4
push 1
push 0x4b48c0
lea ecx, [ebp - 0x28]
call fcn.00415500
cmp word [esi], 0
jne 0x4172dc
xor ecx, ecx
jmp 0x4172f0
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4172e1
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00415500
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0x2001f
push eax
push 0x80000003
lea ecx, [ebp - 0x60]
call fcn.00415010
test eax, eax
jne 0x417371
mov edi, dword [ebp - 0x60]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x50]
lea eax, [ebp - 0x44]
push eax
push 0
push dword [ebp - 0x4c]
mov dword [ebp - 0x48], 4
push edi
call dword [0x4b403c]
cmp dword [ebp - 0x44], 4
mov esi, eax
mov eax, 0xd
cmovne esi, eax
test edi, edi
je 0x417357
push edi
call ebx
xor edi, edi
xor ebx, ebx
test esi, esi
sete bl
cmp dword [ebp - 0x14], 8
jb 0x417387
push dword [ebp - 0x28]
call fcn.0048bbcf
add esp, 4
jmp 0x417387
cmp dword [ebp - 0x14], 8
jb 0x417382
push dword [ebp - 0x28]
call fcn.0048bbcf
add esp, 4
mov edi, dword [ebp - 0x60]
xor ebx, ebx
test edi, edi
je 0x417392
push edi
call dword [0x4b4040]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048caf4
mov esp, ebp
pop ebp
ret

Function at 0x417490
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004175a0
Function at 0x4174a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4f3168]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x417589
lea ecx, [ebp - 0x214]
push ecx
push 0x20019
push 0
push eax
push 0x80000002
mov dword [ebp - 0x214], 0
call dword [0x4b4004]
test eax, eax
jne 0x417589
cmp dword [ebp - 0x214], eax
je 0x417589
push 0x20a
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0048d890
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push ebx
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x20b
call dword [0x4b403c]
test eax, eax
jne 0x41757d
push 0x103
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.0048f326
add esp, 0xc
push dword [ebp - 0x214]
call dword [0x4b4040]
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048caf4
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x214]
call dword [0x4b4040]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0048caf4
mov esp, ebp
pop ebp
ret