joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47bc01
Capabilities:
Encode data using xor

Disassembly:
invalid
imul byte [esi]
push esi
rol eax, 1
jbe 0x47bbca
mov esp, dword [ebp + 0x16a2b12d]
ljmp 0x76b2

Function at 0x4bd4d1
Capabilities:
Authenticate hmac

Disassembly:
inc ebx
leave
in eax, dx
sbb ebp, dword [edi - 0x7a]
and al, 0x20
cmp ebp, dword [edi + 0x6c29bab6]
mov byte [0x4339824a], al
and eax, 0x1c77186
invalid

Function at 0x4c2c21
Capabilities:
Encode data using xor

Disassembly:
jne 0x4c2c69
or al, dh
out dx, eax
xchg esi, eax
out dx, eax
push ds
cmpps xmm0, xmmword [ecx + 0x1b], 0x57
out 0x3a, al
adc byte [ecx + 0x2ea856d6], cl
sahf
push edi
push esp
pushal
xchg byte [ebx], bh
cmp ah, byte [esi - 0x4ff26007]
adc edx, ecx
pop es
sub byte [edx - 0x34], ch
retf 0x5b3
cdq
cmp ebx, dword [edi + 0x2ff4c3fe]
adc bl, byte [esi + 0x17]
wait
add eax, 0x646f15ee
xlatb
inc ecx
push esp
cmp bh, dl
xchg edx, eax
test byte [ebp + 0x38], ah
outsd dx, dword [esi]
cmpsb byte [esi], byte es:[edi]
sbb ebx, esi
sub byte [edi + 0x49], 0xf0
sbb dword [edx + 0x2177a6cd], edx
scasd eax, dword es:[edi]
salc
push esi
adc byte [edx], cl
xor al, 0xaf
adc byte [edi - 0x740874a7], 0x52
cmc
sahf
das
and al, byte [ecx - 0x6a]
sub eax, 0xc24a9fca
sar byte [ebx], 0x2b
ja 0x4c2c74
sbb al, 0xa5
div dword [ecx]
push edx
cmp al, 0xb5
mov eax, 0xb354a347
lodsb al, byte [esi]
add eax, 0x8e02c7bf
mov edx, 0x73bb252
fdivr dword [esi - 0x49]
ret

Function at 0x578e91
Capabilities:
Encode data using xor

Disassembly:
push cs
add byte [edi + 0x7a], 0x30
mov dword [0x5fe9d5a], eax
sub esi, edi
add eax, esi
clc
pop edi
mov dword [esi - 0x64], ecx
inc esp
test al, 0xe8
inc ebx
lahf
das
mov bh, 0x96
xchg esi, eax
mov dword [0x52e15ca0], eax
xor dword [eax - 0x208b5741], edx
mov ebx, 0xc0a177b1
mov dl, byte [eax - 0x56]
push es
test eax, 0x2d3879a0
xor dl, byte [esi + 0x74]
enter 0xa65, 0xffffffffffffffd0
mov al, 0xee
jle 0x578eab
sbb eax, 0x37556719
dec ecx
daa
shr byte [ebp + 0x2f913265], 0xe0
sub ch, byte [eax - 0x23]
mov al, 0xe1
inc esi
invalid
Function at 0x59dbc1
Capabilities:
Encode data using xor

Disassembly:
salc
ror byte [edx + 0x56cc0b96], 0xbd
clc
retf
fld xword [edi + 0x51]
sti
xchg ebx, eax
or al, 0xe4
jp 0x59db9d
fild word [edx - 0x45]
loope 0x59dc37
hlt
mov edx, 0xcd7e2483
sub byte [edi - 0x4a], 0x6e
int 0x80
outsd dx, dword [esi]
mov dh, 0x6e
xchg esi, eax
xor dh, al
test al, 0xf0
aaa
push ebp
out dx, eax
psllw mm7, mm3
mov byte [0xe9a97920], ah
mov ch, 0x70
or edx, dword [ebx + 0x38bf24f8]
std
xchg dword [ecx + 0x6a7d794b], esi
jge 0x59dc10
fcomp st(7)
inc edi
xor bl, dl
fcom qword [esi]
fild word [edi + 0x32]
fcmovu st(0), st(4)
push ss
jl 0x59dc93
adc ch, byte ds:[ecx + 0x6bcfdb40]
add bh, dh
mov bl, 0x12
sar byte [edx + eax*8 + 0x4fdde0aa], 1
mov esp, 0xdde0aac2
dec edi
aaa
add dword [ebx + 0x23], edi
cli
out dx, eax
dec esp
inc ecx
dec esp
pop edi
and eax, 0xa673906b
lea edi, [ecx]
jecxz 0x59dc0c
lea ebp, [edx + ebx*2]
push ebp
les ebx, [ebx]
xchg esp, eax
mov ebp, 0x97dcadcc
invalid
int3
cmp al, 0x32
test dword [ebx + 0x3c], 0xf416598a
or eax, 0x20c53055
dec ecx
loope 0x59dc4c
pop ss
mov dh, ah
sub eax, 0xb00a79af
xor eax, 0x522f003a
or dh, byte [eax + 0x2f003a35]
push edx
pop ss
inc esi
mov ah, 0x2f
jno 0x59dc6d
sub byte [edi - 0x7fa31561], 0xd4
pop dword [ebx - 0xf069c02]
rcr edi, 0x7a
push ss
and ah, byte [ebx + 0x13]
mov eax, dword [0x11c9a4b]
dec ecx
jns 0x59dc7c
mov edi, 0xbfbee8f3
in al, 0x7f
call 0x803e9c81
xchg ecx, eax
xchg ebp, eax
xchg byte [edi - 0x7c3e506c], cl
jnp 0x59dcbc
cli
invalid

Function at 0x63d501
Capabilities:
Encode data using xor

Disassembly:
enter 0xffffffffffffd38e, 0x7a
inc edi
mov eax, dword [0xc8b59841]
inc ebp
mov ebx, 0xdae6a912
xchg esp, eax
ficom word [ebx - 0x56]
pop ebp
adc byte [edi], al
xor eax, 0x4c7c3f10
or dword [edx], esp
cwde
xlatb
arpl word [edx], ax
invalid
Function at 0x10032d98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10032da7
pop dword [ebp - 0x2c]
mov eax, 0x25f49370
sub eax, 0x15f165c9
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x71668605
sub dword [ebp - 0x3c], 0x231440ba
mov dword [ebp - 0x38], 0x1cf6c24d
add dword [ebp - 0x38], 0x153c89f8
mov dword [ebp - 0x34], 0xda4bfb94
add dword [ebp - 0x34], 0x7200489a
mov dword [ebp - 0x30], 0x5f59dd4a
add dword [ebp - 0x30], 0xa0a622b6
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x778555c
add dword [ebp - 0x3c], 0x6cfa13fa
mov dword [ebp - 0x38], 0xe762ca35
sub dword [ebp - 0x38], 0xa5f668c0
mov dword [ebp - 0x34], 0x43438784
sub dword [ebp - 0x34], 0xdfd41b18
mov dword [ebp - 0x30], 0xab38f7e9
add dword [ebp - 0x30], 0x54c70817
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x3719b595
sub eax, 0x27166431
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x396fc
push 0
call eax
mov ecx, 0xd8c6b997
sub ecx, 0xd8c67822
mov edx, eax
mov esi, 0x10088400
add esi, dword [ebp - 0x2c]
mov ebx, 0x50023563
sub ebx, 0x93c130ca
sub dword [ebp - 0x24], 0x1bf70467
mov edi, dword [esi]
sub dword [ebp - 0xc], 0x254fa8fd
add edi, ebx
xor dword [ebp - 0x18], 0xa2750531
mov dword [edx], edi
sub dword [ebp - 0x14], ecx
add edx, 4
add esi, 0x69ac7b63
add esi, 0x965384a1
loop 0x10032ebe
add eax, 0xf8a7
xor ebx, ebx
add ebx, eax
add eax, 0xa9db6f75
sub eax, 0xa9db6f70
mov ecx, 0xfa4c4240
sub ecx, 0xea4c4240
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x1003384b
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 0x50]
cmp eax, dword [esi + 0x54]
jae 0x10033862
mov bl, byte [eax]
inc eax
mov dword [esi + 0x50], eax
jmp 0x100338ce
cmp dword [esi + 0x4c], 0
jl 0x100338cc
mov edi, dword [esi + 0x58]
push 0xfa0
push edi
push dword [esi + 0x4c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x1003389a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
je 0x1003386b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0xb
je 0x1003386b
cmp ebx, 1
jge 0x100338a7
or dword [esi + 0x4c], 0xffffffff
xor bl, bl
jmp 0x100338ec
lea eax, [edi + 1]
mov dword [esi + 0x50], eax
lea eax, [ebx + edi]
mov dword [esi + 0x54], eax
mov bl, byte [edi]
test bl, bl
jne 0x100338ce
push esi
call fcn.100348ff
mov eax, dword [esi + 0x50]
or dword [esi + 0x4c], 0xffffffff
pop ecx
mov dword [esi + 0x54], eax
jmp 0x100338ce
xor bl, bl
cmp bl, 0xa
jne 0x100338e2
mov eax, dword [esp + 0x18]
and dword [eax], 0
mov eax, dword [esp + 0x14]
inc dword [eax]
jmp 0x100338ec
test bl, bl
je 0x100338ec
mov ecx, dword [esp + 0x18]
inc dword [ecx]
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x403e59
pop dword [ebp - 0x48]
mov eax, 0xe64cb167
add eax, 0x19f38cf2
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xbb56067b
add dword [ebp - 0x58], 0x92fc3ed0
mov dword [ebp - 0x54], 0xd37df850
sub dword [ebp - 0x54], 0xa14aac0b
mov dword [ebp - 0x50], 0x67bc4be7
add dword [ebp - 0x50], 0xe48ff847
mov dword [ebp - 0x4c], 0xd3efe11
add dword [ebp - 0x4c], 0xf2c101ef
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xeb15c858
add dword [ebp - 0x58], 0x895ca0fe
mov dword [ebp - 0x54], 0x92876ab2
add dword [ebp - 0x54], 0xaee4f6c3
mov dword [ebp - 0x50], 0x41544465
sub dword [ebp - 0x50], 0xdde4d7f9
mov dword [ebp - 0x4c], 0x1738a0a9
add dword [ebp - 0x4c], 0xe8c75f57
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x885dd438
sub eax, 0x881d5364
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x37961
push 0
call eax
mov ecx, 0x4b5b
xor esi, esi
add esi, eax
mov edx, 0x70ec453b
add edx, 0x8f54cac5
add edx, dword [ebp - 0x48]
mov edi, 0x7dda28bf
sub edi, 0xf2d48ee8
add dword [ebp - 0x40], esi
mov ebx, dword [edx]
add dword [ebp - 4], 0x716ae0cb
xor ebx, edi
sub dword [ebp - 0x28], ecx
mov dword [esi], ebx
sub dword [ebp - 0x14], 0x6e3b5375
add esi, 0x7f627a99
sub esi, 0x7f627a95
add edx, 0x3be287f1
sub edx, 0x3be287ed
loop 0x403f72
add eax, 0x1203f
mov ebx, eax
add eax, 0x9a19c7e2
sub eax, 0x9a19c7dd
mov ecx, 0x48eee92f
sub ecx, 0x48aee92f
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x4019c0
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x417b18
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42202c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
xor edi, edi
cmp esi, edi
mov dword [esp + 0x14], esi
je 0x401aad
cmp word [esi], di
je 0x401aad
call fcn.00407b20
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x30], edi
push esi
mov dword [esp + 0x3c], edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [esp + 0x34]
push eax
push ecx
lea ebx, [esp + 0x20]
call fcn.00407850
lea edi, [ebp + 0xc]
mov esi, ebx
call fcn.00407a60
mov dx, word [edi]
mov word [ebp + 0x388], dx
mov dword [ebp + 0x10], 0
call fcn.0040aad0
cmp byte [eax + 0x39], 0
je 0x401a8e
call fcn.0040aad0
call fcn.0040a090
test al, al
je 0x401a8e
mov eax, dword [ebp + 0x10]
mov ecx, dword [edi]
mov edx, dword [esp + 0x14]
push eax
push ecx
push edx
push str.ParseCommandLine_Cmdline_s_m_nFrom_d_m_nJumpPage_d
push 0xe
push str..AutoUpdateApp.cpp
call fcn.0040a920
add esp, 0x18
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x30], 0xffffffff
call fcn.00402340
mov ecx, dword [esp + 0x1c]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4

Function at 0x401af0
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x416e99
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x42202c]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x42202c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
push str.Mutex:F6D0C038_588E_46D2_BA85_936D3725734A_AutoUpdateApp
lea ecx, [esp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
cmp dword [esp + 0x1c], 8
mov eax, dword [esp + 8]
jae 0x401b3c
lea eax, [esp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
mov dword [esi + 0x14], eax
je 0x401b82
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401b82
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 4]
mov dword [esi + 0x14], 0
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor eax, eax
jmp 0x401b99
lea ecx, [esp + 4]
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004158da
add esp, 0x2c
ret
Function at 0x402190
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x210
mov eax, dword [0x42202c]
xor eax, esp
mov dword [esp + 0x20c], eax
push 0x208
lea eax, [esp + 6]
push 0
push eax
mov word [esp + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.QMNetWorkMgr.dll
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402218
test al, 0x10
jne 0x402218
mov eax, 1
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004158da
add esp, 0x210
ret
mov ecx, dword [esp + 0x20c]
xor ecx, esp
xor eax, eax
call fcn.004158da
add esp, 0x210
ret

Function at 0x402540
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4172e4
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x42202c]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [0x42202c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
push str.masterconn11.qq.com
lea ecx, [esi + 0x10]
mov dword [esp + 8], esi
mov word [esi + 4], 0x1388
mov dword [esi + 8], 0x1bb
mov dword [esi + 0xc], 0x1f40
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [esi + 0x10]
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov byte [esp + 0x30], 1
cmp dword [esp + 0x20], 0x10
movzx eax, word [esi + 8]
mov ecx, dword [esp + 0xc]
jae 0x4025c2
lea ecx, [esp + 0xc]
push 1
push eax
push ecx
call dword [0x4242c4]
lea ecx, [esp + 8]
mov dword [esi], eax
mov byte [esp + 0x30], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004158da
add esp, 0x30
ret
Function at 0x404000
Capabilities:
Delete file

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 0x25c]
push edi
xor edi, edi
cmp eax, dword [esp + 0x10]
je 0x40403b
mov dword [esi + 0x260], 0x66
cmp dword [esi + 0x280], 8
jb 0x404096
mov esi, dword [esi + 0x26c]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
pop edi
pop esi
pop ecx
ret 8
cmp dword [esp + 0x14], edi
je 0x40404d
mov dword [esi + 0x260], 0x65
jmp 0x40401d
lea edx, [esi + 0x2c4]
lea ecx, [esi + 0x268]
call fcn.00408b40
test eax, eax
jne 0x40406e
mov dword [esi + 0x260], 0x67
jmp 0x40401d
mov eax, esi
call fcn.00404760
test eax, eax
jne 0x404085
mov dword [esi + 0x260], 0x68
jmp 0x40401d
mov eax, 1
mov dword [esi + 0x260], eax
pop edi
pop esi
pop ecx
ret 8
add esi, 0x26c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
pop edi
pop esi
pop ecx
ret 8
Function at 0x404270
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4175ec
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x42202c]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42202c]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
xor esi, esi
push 0x20a
lea eax, [esp + 0x5a]
push esi
push eax
xor ebp, ebp
mov dword [esp + 0x3c], esi
mov dword [esp + 0x24], esi
mov word [esp + 0x60], si
call sub.MSVCR80.dll_memset
mov eax, 1
add esp, 0xc
test byte [0x424384], al
mov edi, 0x20019
jne 0x404318
or dword [0x424384], eax
push 0x4184c0
mov dword [0x424390], esi
mov dword [0x424388], esi
mov dword [0x42438c], esi
mov dword [0x424394], esi
mov dword [0x424398], esi
mov dword [0x42439c], esi
call fcn.004159f1
add esp, 4
call fcn.00408d60
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
cmp ebx, esi
mov dword [esp + 0x14], esi
je 0x40435b
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x40435b
cmp dword [esp + 0x14], esi
je 0x40435b
mov edi, 0x20219
lea ecx, [esp + 0x38]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea edx, [esp + 0x18]
push edx
push edi
push esi
push str.SoftwareTencentQMStart
push closesocket
mov dword [esp + 0x284], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4043c9
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x58]
push ecx
push esi
push esi
push str.InstallTime
push edx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4043be
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x3c]
call dword [0x4191dc]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x4c], esi
je 0x404434
cmp dword [esp + 0x50], 8
mov eax, dword [esp + 0x3c]
mov word [esp + 0x1c], si
mov dword [esp + 0x1e], esi
mov dword [esp + 0x22], esi
mov dword [esp + 0x26], esi
mov word [esp + 0x2a], si
jae 0x4043f4
lea eax, [esp + 0x3c]
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x2a]
push ecx
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x2e]
push ecx
lea edx, [esp + 0x2e]
push edx
lea ecx, [esp + 0x30]
push ecx
push str._04d__02d__02d__02d:_02d:_02d
push eax
call dword [sym.imp.MSVCR80.dll_swscanf_s]
add esp, 0x20
test eax, eax
je 0x404434
lea ecx, [esp + 0x1c]
call fcn.00404480
mov ebp, eax
mov esi, edx
jmp 0x404438
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x38]
mov dword [esp + 0x270], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, ebp
mov edx, esi
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.004158da
add esp, 0x260
ret
Function at 0x404760
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
push esi
mov esi, eax
cmp dword [esi + 0x27c], 0
push edi
je 0x4047d1
mov edi, 8
cmp dword [esi + 0x280], edi
jb 0x404783
mov eax, dword [esi + 0x26c]
jmp 0x404789
lea eax, [esi + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4047d1
test al, 0x10
jne 0x4047d1
cmp dword [esi + 0x280], edi
jb 0x4047b9
mov esi, dword [esi + 0x26c]
call fcn.00404fc0
mov edi, esi
mov esi, eax
call fcn.0040cd30
pop edi
pop esi
pop ecx
ret
add esi, 0x26c
call fcn.00404fc0
mov edi, esi
mov esi, eax
call fcn.0040cd30
pop edi
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret

Function at 0x4048c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x84
mov eax, dword [0x42202c]
xor eax, esp
mov dword [esp + 0x80], eax
push esi
mov esi, ecx
cmp dword [esi + 0x280], 8
jb 0x4048e8
mov eax, dword [esi + 0x26c]
jmp 0x4048ee
lea eax, [esi + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4048fe
test al, 0x10
je 0x404916
xor eax, eax
pop esi
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.004158da
add esp, 0x84
ret
push 0x7e
lea eax, [esp + 0xa]
push 0
push eax
mov word [esp + 0x10], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
call fcn.00408e30
cmp eax, 5
jl 0x404965
cmp dword [esi + 0x280], 8
jb 0x404953
mov esi, dword [esi + 0x26c]
push str.runas
lea ecx, [esp + 8]
push ecx
jmp 0x404983
push str.runas
lea ecx, [esp + 8]
add esi, 0x26c
push ecx
jmp 0x404983
cmp dword [esi + 0x280], 8
jb 0x404976
mov esi, dword [esi + 0x26c]
jmp 0x40497c
add esi, 0x26c
push 0
lea edx, [esp + 8]
push edx
call fcn.00409030
mov ecx, dword [esp + 0x8c]
add esp, 8
pop esi
xor ecx, esp
call fcn.004158da
add esp, 0x84
ret
Function at 0x4050b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x417a61
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42202c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
xor ebx, ebx
lea edi, [esi + 0xc]
mov dword [esi], vtable.svrlib::KVResultSet_unsigned_short_int_.0
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [esp + 0x1c], ebx
call fcn.00406a70
mov dword [esi + 0x20], eax
mov byte [eax + 0x15], 1
mov eax, dword [esi + 0x20]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x20]
mov dword [eax], eax
mov eax, dword [esi + 0x20]
mov dword [eax + 8], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], vtable.svrlib::DataBuf.0
mov byte [esi + 0x38], bl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov ebp, dword [edi + 4]
mov dword [esi + 0x48], ebx
cmp dword [edi + 4], ebp
ja 0x40513f
cmp ebp, dword [edi + 8]
jbe 0x405145
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], ebp
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4

Function at 0x405f70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4179ab
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x42202c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
xor eax, eax
mov dword [edi], vtable.svrlib::KVResultRow_unsigned_short_int_.0
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], vtable.svrlib::DataBuf.0
mov byte [edi + 0x24], al
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x28], eax
lea esi, [edi + 0x34]
mov dword [esp + 0x14], eax
call fcn.004049b0
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4