joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406da1
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x40c9c8], ebx
push esi
push edi
jne 0x406e21
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x406e5c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x40c9c8], eax
je 0x406e5c
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x40c9cc], eax
call esi
cmp dword [0x40c860], 2
mov dword [0x40c9d0], eax
jne 0x406e21
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x40c9d8], eax
je 0x406e21
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x40c9d4], eax
mov eax, dword [0x40c9d4]
test eax, eax
je 0x406e66
call eax
test eax, eax
je 0x406e4d
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x40c9d8]
test eax, eax
je 0x406e4d
test byte [ebp - 8], 1
jne 0x406e66
cmp dword [0x40c86c], 4
jb 0x406e60
or byte [ebp + 0x12], 0x20
jmp 0x406e85
xor eax, eax
jmp 0x406e95
or byte [ebp + 0x12], 4
jmp 0x406e85
mov eax, dword [0x40c9cc]
test eax, eax
je 0x406e85
call eax
mov ebx, eax
test ebx, ebx
je 0x406e85
mov eax, dword [0x40c9d0]
test eax, eax
je 0x406e85
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x40c9c8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4071bf
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x4071ed
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x4071f4
cmp ebx, dword [eax + 4]
jae 0x4071f4
xor eax, eax
jmp 0x4073e4
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x407205
xor eax, eax
inc eax
jmp 0x4073e3
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x40721b
cmp ecx, edx
jae 0x407360
cmp dword [eax + 4], 0
je 0x407224
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x40720c
cmp dword [ebp + 8], 0
je 0x407246
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x407360
cmp eax, esi
jae 0x407360
mov eax, dword [0x40c9e0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x40726b
cmp dword [esi*4 + 0x40c9e8], edi
je 0x407364
inc esi
cmp esi, eax
jl 0x407259
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4073e0
cmp dword [ebp - 8], 0x1000000
jne 0x4073e0
test byte [ebp - 0xc], 0xcc
je 0x4072e9
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x4073e0
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4073e0
cmp word [eax + 0x18], 0x10b
jne 0x4073e0
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x4073e0
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x4072e9
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x4072e9
test byte [ecx + 0x27], 0x80
jne 0x407360
push 1
push 0x40ca28
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x4071fd
mov ecx, dword [0x40c9e0]
test ecx, ecx
mov edx, ecx
jle 0x40731d
lea eax, [ecx*4 + 0x40c9e4]
cmp dword [eax], edi
je 0x40731d
dec edx
sub eax, 4
test edx, edx
jg 0x407311
test edx, edx
jne 0x40734e
push 0xf
pop ebx
cmp ecx, ebx
jg 0x40732a
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x407342
lea eax, [edx*4 + 0x40c9e8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x407330
cmp ecx, 0x10
jge 0x40734e
inc ecx
mov dword [0x40c9e0], ecx
push 0
push 0x40ca28
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x4071fd
xor eax, eax
jmp 0x4073e3
test esi, esi
jle 0x4071fd
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x40ca28
call ebx
test eax, eax
jne 0x4071fd
cmp dword [esi*4 + 0x40c9e8], edi
je 0x4073ba
mov eax, dword [0x40c9e0]
lea esi, [eax - 1]
test esi, esi
jl 0x4073a8
cmp dword [esi*4 + 0x40c9e8], edi
je 0x4073a4
dec esi
jns 0x407398
test esi, esi
jge 0x4073b8
cmp eax, 0x10
jge 0x4073b3
inc eax
mov dword [0x40c9e0], eax
lea esi, [eax - 1]
jmp 0x4073ba
je 0x4073d2
xor ecx, ecx
test esi, esi
jl 0x4073d2
lea eax, [ecx*4 + 0x40c9e8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4073c0
push 0
push 0x40ca28
call ebx
jmp 0x4071fd
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408434
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00402820
mov eax, dword [0x40c2c0]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x40ccc8]
mov dword [ebp - 4], eax
jae 0x40857d
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x40cce0]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x40857d
push 1
push esi
push ebx
call fcn.0040667a
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 0x1008], eax
je 0x408587
push 2
push esi
push ebx
call fcn.0040667a
add esp, 0xc
cmp eax, 0xffffffff
je 0x408587
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x408527
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00406ce0
push 0x8000
push ebx
call fcn.00408ffd
add esp, 0x14
mov dword [ebp - 0x100c], eax
mov eax, 0x1000
cmp edi, eax
jge 0x4084e3
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push ebx
call fcn.0040670b
add esp, 0xc
cmp eax, 0xffffffff
je 0x408501
sub edi, eax
test edi, edi
jg 0x4084d8
jmp 0x408517
cmp dword [0x40c858], 5
jne 0x408514
mov dword [0x40c854], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push ebx
call fcn.00408ffd
pop ecx
pop ecx
jmp 0x408567
jge 0x408567
push 0
push dword [ebp + 0xc]
push ebx
call fcn.0040667a
push ebx
call fcn.00407ae3
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x408567
mov dword [0x40c854], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x40c858], eax
push 0
push dword [ebp - 0x1008]
push ebx
call fcn.0040667a
add esp, 0xc
mov eax, esi
pop edi
jmp 0x40858a
mov dword [0x40c854], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0040273a
leave
ret
Function at 0x40859b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x40ccc8]
push edi
jae 0x408770
mov eax, esi
sar eax, 5
lea edi, [eax*4 + 0x40cce0]
mov eax, dword [edi]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x408770
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
je 0x408646
test dl, 2
jne 0x408646
test dl, 0x48
je 0x408610
cmp byte [eax + 5], 0xa
je 0x408610
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea ecx, [ebx + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x408659
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x408641
mov dword [0x40c858], ecx
jmp 0x408777
cmp eax, 0x6d
jne 0x40864d
xor eax, eax
jmp 0x408784
push eax
call fcn.004078e2
pop ecx
jmp 0x408781
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
add dword [ebp - 0xc], eax
test byte [ecx + esi + 4], 0x80
je 0x40876b
test eax, eax
je 0x408680
cmp byte [ebx], 0xa
jne 0x408680
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x408689
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x408765
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x408755
cmp al, 0xd
je 0x4086bb
mov byte [ebx], al
inc ebx
inc dword [ebp - 8]
jmp 0x408747
dec ecx
cmp dword [ebp - 8], ecx
jae 0x4086d5
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x4086d0
add dword [ebp - 8], 2
jmp 0x408729
mov dword [ebp - 8], eax
jmp 0x408743
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4086fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x408743
cmp dword [ebp - 0x10], 0
je 0x408743
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x40871e
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x408729
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x408746
cmp ebx, dword [ebp + 0xc]
jne 0x40872e
cmp byte [ebp - 1], 0xa
jne 0x40872e
mov byte [ebx], 0xa
jmp 0x408746
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040667a
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x408747
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x40869f
jmp 0x408765
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x408765
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
jmp 0x408784
and dword [0x40c858], 0
mov dword [0x40c854], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4092a7
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00402820
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x409342
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x40c860]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x409342
cmp eax, 1
je 0x409363
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x409342
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x40930f
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x40933e
xor eax, eax
inc eax
jmp 0x409382
cmp edi, eax
jae 0x409346
xor eax, eax
jmp 0x409382
cmp eax, esi
jae 0x40934d
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x40c860]
jmp 0x409366
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401bd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x41a8bb
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x423018]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], bl
mov dword [esp + 0x14], ebx
call fcn.00410f20
mov dword [esi + 0x2c], eax
mov byte [eax + 0x15], 1
mov eax, dword [esi + 0x2c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x2c]
mov dword [eax], eax
mov eax, dword [esi + 0x2c]
mov dword [eax + 8], eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x402a70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41a86b
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x423018]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
xor ebx, ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov byte [esi + 0x44], bl
lea eax, [esi + 8]
push eax
mov dword [esp + 0x18], ebx
call fcn.00402af0
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0xa0], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x407ee0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41a598
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x423018]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
xor edi, edi
cmp esi, edi
je 0x408079
push esi
call dword [0x41b224]
test eax, eax
je 0x408079
push esi
mov esi, dword [0x41b228]
call esi
cmp eax, edi
mov dword [esp + 0x14], eax
jne 0x407f43
push 0x8007000e
call fcn.00405f30
mov eax, dword [ebp + 0x10]
cmp eax, edi
mov dword [esp + 0x38], edi
jne 0x408000
mov dword [esp + 0x10], edi
mov ebx, dword [ebp + 8]
mov byte [esp + 0x38], 1
cmp dword [ebx + 0x20], edi
je 0x408019
lea eax, [esp + 0x20]
push eax
lea esi, [ebx + 0x18]
lea eax, [esp + 0x18]
call fcn.00408e20
mov ecx, dword [eax]
test ecx, ecx
mov edi, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], edx
je 0x407f94
cmp ecx, esi
je 0x407f9a
call dword [0x41b178]
cmp edi, dword [esp + 0x24]
je 0x408019
lea esi, [esp + 0x18]
call fcn.00408e90
mov ebx, dword [0x41b220]
add eax, 4
cmp dword [eax], 0
je 0x407fc4
call fcn.00408e90
add eax, 4
mov eax, dword [eax]
push eax
call ebx
lea esi, [esp + 0x18]
call fcn.00408e90
mov edi, eax
add edi, 4
lea esi, [esp + 0x10]
call fcn.0040a990
mov ecx, dword [esp + 0x10]
push ecx
call ebx
mov edx, dword [esp + 0x14]
push edx
call ebx
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push eax
call esi
cmp eax, edi
mov dword [esp + 0x10], eax
jne 0x407f56
push 0x8007000e
call fcn.00405f30
lea eax, [esp + 0x18]
push eax
lea edi, [esp + 0x14]
lea esi, [esp + 0x18]
call fcn.00409010
lea ecx, [esp + 0x20]
push ecx
add ebx, 0x18
push ebx
mov ebx, eax
mov byte [esp + 0x40], 2
call fcn.00408cb0
mov edx, dword [esp + 0x1c]
mov ebx, dword [0x41b220]
push edx
call ebx
mov eax, dword [esp + 0x18]
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call ebx
mov edx, dword [esp + 0x14]
push edx
call ebx
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x80070057
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4105d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x419560
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x423018]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0x41b880
push 0x17
push 0
push 0x41b870
mov dword [esp + 0x30], 0
call dword [0x41b270]
mov ebx, eax
test ebx, ebx
jl 0x41067b
push str.Poller
call dword [0x41b228]
mov esi, eax
test esi, esi
mov dword [esp + 0x10], esi
jne 0x410643
push 0x8007000e
call fcn.00405f30
mov edx, dword [esp + 0x24]
push edx
mov byte [esp + 0x20], 1
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push esi
push 1
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x410674
mov dword [esp + 0xc], 0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push esi
call dword [0x41b220]
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0xc]
test eax, eax
je 0x410693
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret 4

Function at 0x411d40
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
mov edx, dword [ecx]
push 0
push eax
push edx
mov dword [esp + 0x18], 4
call dword [0x41b00c]
test eax, eax
jne 0x411d79
mov eax, dword [esp + 0xc]
sub eax, 4
neg eax
sbb eax, eax
and eax, 0xd
pop ecx
ret 8

Function at 0x4137c0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x419bf8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x423018]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
xor edi, edi
cmp eax, edi
jne 0x4137f4
xor eax, eax
jmp 0x413805
push eax
call dword [0x41b230]
push eax
mov eax, dword [esi]
push eax
call dword [0x41b22c]
cmp dword [esi], edi
mov dword [esp + 0x10], eax
je 0x41381b
cmp eax, edi
jne 0x41381b
push 0x8007000e
call fcn.00405f30
push str.WebServicesCommunicationCenter
mov dword [esp + 0x24], edi
call dword [0x41b0b4]
push eax
push str.WebServicesCommunicationCenter
lea ecx, [esp + 0x18]
push ecx
call fcn.00401fc0
cmp eax, edi
jge 0x413844
push eax
call fcn.00405f30
mov ebx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x2001f
push edi
push ebx
push 0x80000001
mov dword [esp + 0x28], edi
call dword [0x41b010]
cmp eax, edi
jne 0x413896
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
push 4
lea ecx, [esp + 0x2c]
push ecx
push 4
push edi
push 0x41d0f4
push esi
mov dword [esp + 0x40], eax
call dword [0x41b004]
cmp esi, edi
je 0x41389b
push esi
call dword [0x41b008]
jmp 0x41389b
mov edi, 0x80004005
push ebx
call dword [0x41b220]
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
Function at 0x4138c0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x419f98
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push esi
mov eax, dword [0x423018]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
test eax, eax
mov dword [esp + 0xc], 0
je 0x413906
push eax
call dword [0x41b230]
push eax
mov eax, dword [esi]
push eax
call dword [0x41b22c]
cmp dword [esi], 0
mov dword [esp + 0x10], eax
je 0x41391d
test eax, eax
jne 0x41391d
push 0x8007000e
call fcn.00405f30
push str.WebServicesCommunicationCenter
mov dword [esp + 0x2c], 0
call dword [0x41b0b4]
push eax
push str.WebServicesCommunicationCenter
lea ecx, [esp + 0x18]
push ecx
call fcn.00401fc0
test eax, eax
jge 0x41394a
push eax
call fcn.00405f30
mov ebp, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x20019
push 0
push ebp
push 0x80000001
mov dword [esp + 0x28], 0
call dword [0x41b010]
test eax, eax
jne 0x4139db
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x24]
push ecx
push 0
push 0x41d0f4
push eax
mov esi, eax
mov dword [esp + 0x28], 0x18
mov dword [esp + 0x30], 4
call dword [0x41b00c]
test eax, eax
jne 0x4139bc
cmp dword [esp + 0x1c], 4
jne 0x4139bc
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov dword [eax], edx
jmp 0x4139ce
mov ecx, dword [esp + 0x30]
mov dword [ecx], 0x18
mov dword [esp + 0xc], 0x80004005
test esi, esi
je 0x4139e3
push esi
call dword [0x41b008]
jmp 0x4139e3
mov dword [esp + 0xc], 0x80004005
push ebp
call dword [0x41b220]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x20
ret 4
Function at 0x413a10
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x419f68
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x423018]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
test eax, eax
mov dword [esp + 0x18], 0
je 0x413a57
push eax
call dword [0x41b230]
push eax
mov eax, dword [esi]
push eax
call dword [0x41b22c]
cmp dword [esi], 0
mov dword [esp + 0x10], eax
je 0x413a6e
test eax, eax
jne 0x413a6e
push 0x8007000e
call fcn.00405f30
push str.WebServicesCommunicationCenter
mov dword [esp + 0x28], 0
call dword [0x41b0b4]
push eax
push str.WebServicesCommunicationCenter
lea ecx, [esp + 0x18]
push ecx
call fcn.00401fc0
test eax, eax
jge 0x413a9b
push eax
call fcn.00405f30
mov ebp, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x2001f
push 0
push ebp
push 0x80000001
mov dword [esp + 0x28], 0
call dword [0x41b010]
test eax, eax
jne 0x413b10
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov edi, dword [0x41b004]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push 0
push str.LastUpdateTimeLoWord
push esi
mov dword [esp + 0x28], eax
call edi
mov edx, dword [esp + 0x30]
push 4
lea eax, [esp + 0x30]
push eax
push 4
push 0
push str.LastUpdateTimeHiWord
push esi
mov dword [esp + 0x44], edx
call edi
test esi, esi
je 0x413b18
push esi
call dword [0x41b008]
jmp 0x413b18
mov dword [esp + 0x18], 0x80004005
push ebp
call dword [0x41b220]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret 8

Function at 0x413cb0
Capabilities:
Get geographical location
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x419bf8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x423018]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
xor ebp, ebp
cmp eax, ebp
jne 0x413ce4
xor eax, eax
jmp 0x413cf5
push eax
call dword [0x41b230]
push eax
mov eax, dword [esi]
push eax
call dword [0x41b22c]
cmp dword [esi], ebp
mov dword [esp + 0x10], eax
je 0x413d0b
cmp eax, ebp
jne 0x413d0b
push 0x8007000e
call fcn.00405f30
mov dword [esp + 0x20], ebp
mov edi, dword [0x41b0b4]
push str.WebServices
call edi
push eax
push str.WebServices
lea ecx, [esp + 0x18]
push ecx
call fcn.00401fc0
cmp eax, ebp
jge 0x413d36
push eax
call fcn.00405f30
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x2001f
push ebp
push eax
push 0x80000001
mov dword [esp + 0x28], ebp
call dword [0x41b010]
cmp eax, ebp
jne 0x413d90
cmp ebx, ebp
mov esi, dword [esp + 0x14]
jne 0x413d6b
push 0x80004005
call fcn.00405f30
push ebx
call edi
lea ecx, [eax + eax + 2]
push ecx
push ebx
push 1
push ebp
push str.CountryCode
push esi
call dword [0x41b004]
cmp esi, ebp
je 0x413d95
push esi
call dword [0x41b008]
jmp 0x413d95
mov ebp, 0x80004005
mov edx, dword [esp + 0x10]
push edx
call dword [0x41b220]
mov eax, ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x416c40
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [0x41b00c]
test eax, eax
jne 0x416cae
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x416c7f
cmp eax, 2
jne 0x416c9a
test esi, esi
mov eax, dword [esp]
je 0x416ca8
test eax, eax
je 0x416ca3
test al, 1
jne 0x416c9a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x416ca8
mov eax, 0xd
pop ecx
ret 8
mov word [esi], 0
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8