joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a3a4
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
cmp edx, dword [ebp + 0x18]
jne 0x42a3bf
mov cl, byte [eax]
cmp cl, 0x6a
je 0x42a3e0
cmp cl, 0x6b
je 0x42a3e0
push 0x72
push 0x495d68
push 0x89
push 0x80
push 4
call fcn.004344a8
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
mov cl, byte [eax]
inc eax
cmp cl, 0x6b
jne 0x42a451
lea esi, [edx - 3]
xor ecx, ecx
cmp esi, ecx
jle 0x42a427
mov dl, byte [eax]
inc eax
cmp dl, 0xba
je 0x42a427
cmp dl, 0xbb
je 0x42a422
push 0x81
push 0x495d80
push 0x8a
push 0x80
push 4
call fcn.004344a8
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
inc ecx
cmp esi, ecx
jg 0x42a3f1
sub esi, ecx
test ecx, ecx
jne 0x42a454
push 0x8a
push 0x495d98
push 0x8a
push 0x80
push 4
call fcn.004344a8
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
lea esi, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x42a47e
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.004344a8
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
push esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004051b8
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
Function at 0x433bfd
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov ebx, 0x10
call sub.KERNEL32.DLL_GetVersion
cmp eax, 0x80000000
jae 0x433d2f
call fcn.0040faac
test eax, eax
je 0x433d2f
push 0
push 0
push 0
push str.DISPLAY
call sub.GDI32.DLL_CreateDCA
mov esi, eax
push esi
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [esp], eax
push 8
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [esp + 0x10], eax
push 0xa
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [esp + 0x14], eax
push ebx
mov eax, dword [esp + 0x14]
push eax
push esi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov edi, eax
push edi
mov eax, dword [esp + 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [esp + 4], eax
lea edx, [esp + 0x18]
push edx
push 0x18
push edi
call sub.GDI32.DLL_GetObjectA
mov ecx, dword [esp + 0x24]
imul ecx, dword [esp + 0x20]
movzx eax, word [esp + 0x28]
imul ecx, eax
mov dword [esp + 8], ecx
push 0x2d5
push str..crypto_rand_rand_win.c
mov edx, dword [esp + 0x10]
push edx
call fcn.00410140
add esp, 0xc
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x433d09
xor ebp, ebp
jmp 0x433cf4
push 0xcc0020
push ebp
push 0
push esi
push ebx
mov eax, dword [esp + 0x24]
push eax
push 0
push 0
mov edx, dword [esp + 0x20]
push edx
call sub.GDI32.DLL_BitBlt
mov ecx, dword [esp + 0xc]
push ecx
mov eax, dword [esp + 0xc]
push eax
push edi
call sub.GDI32.DLL_GetBitmapBits
push 0
call fcn.00436358
push eax
push 0
lea edx, [esp + 0x3c]
push edx
mov ecx, dword [esp + 0x18]
push ecx
mov eax, dword [esp + 0x20]
push eax
call fcn.00436208
add esp, 0x18
push 0
push 0
push 0x14
lea edx, [esp + 0x3c]
push edx
call fcn.004332a8
add esp, 0x10
add ebp, ebx
mov ecx, dword [esp + 0x14]
sub ecx, ebx
cmp ebp, ecx
jl 0x433c91
mov eax, dword [esp + 0xc]
push eax
call fcn.00410300
pop ecx
mov edx, dword [esp + 4]
push edx
mov ecx, dword [esp + 4]
push ecx
call sub.GDI32.DLL_SelectObject
mov edi, eax
push edi
call sub.GDI32.DLL_DeleteObject
mov eax, dword [esp]
push eax
call sub.GDI32.DLL_DeleteDC
push esi
call sub.GDI32.DLL_DeleteDC
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x436f8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x436fa5
cmp dword [esi + 8], 0
jne 0x436fac
xor eax, eax
jmp 0x43709f
mov edx, dword [esi + 4]
and edx, 0x100
mov dword [ebp - 8], edx
mov eax, dword [esi]
test eax, eax
jne 0x436fc7
mov dword [ebp - 4], 1
jmp 0x437024
mov dword [ebp - 4], eax
xor eax, eax
mov edx, dword [esi + 8]
cmp dword [ebp - 8], 0
mov al, byte [edx]
jne 0x436fe5
cmp eax, 0x7f
jle 0x436fe5
mov ebx, 1
xor ecx, ecx
jmp 0x437021
cmp dword [ebp - 8], 0
je 0x437021
cmp eax, 0x80
jle 0x436ffb
mov ebx, 1
mov cl, 0xff
jmp 0x437021
cmp eax, 0x80
jne 0x437021
mov eax, 1
mov edx, dword [esi + 8]
inc edx
jmp 0x43701d
cmp byte [edx], 0
je 0x43701b
mov ebx, 1
mov cl, 0xff
jmp 0x437021
inc eax
inc edx
cmp eax, dword [esi]
jl 0x43700d
add dword [ebp - 4], ebx
cmp dword [ebp + 0xc], 0
jne 0x43702f
mov eax, dword [ebp - 4]
jmp 0x43709f
mov edx, dword [ebp + 0xc]
test ebx, ebx
mov edx, dword [edx]
je 0x43703b
mov byte [edx], cl
inc edx
cmp dword [esi], 0
jne 0x437045
mov byte [edx], 0
jmp 0x437094
cmp dword [ebp - 8], 0
jne 0x43705d
mov eax, dword [esi]
push eax
mov ecx, dword [esi + 8]
push ecx
push edx
call fcn.004051b8
add esp, 0xc
jmp 0x437094
mov eax, dword [esi]
mov ecx, dword [esi + 8]
add ecx, eax
mov ebx, eax
dec ebx
dec ecx
add edx, ebx
jmp 0x437072
mov byte [edx], 0
dec edx
dec ecx
dec eax
cmp byte [ecx], 0
je 0x43706c
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
inc ebx
mov byte [edx], bl
dec edx
test eax, eax
jle 0x437094
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
mov byte [edx], bl
dec edx
test eax, eax
jg 0x437086
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
add dword [eax], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4370a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
cmp dword [ebp + 8], 0
je 0x4370be
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x4370dc
push 2
call fcn.0043b3d8
pop ecx
mov esi, eax
test eax, eax
jne 0x4370d3
xor eax, eax
jmp 0x437226
mov dword [esi + 4], 2
jmp 0x4370e1
mov edx, dword [ebp + 8]
mov esi, dword [edx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
add eax, ebx
mov dword [ebp - 4], eax
push 0xc7
push 0x4a631c
mov edx, dword [ebp + 0x10]
inc edx
push edx
call fcn.00410140
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x437118
mov eax, 0x41
jmp 0x4371f2
cmp dword [ebp + 0x10], 0
mov edx, dword [ebp - 8]
jne 0x43712d
mov dword [esi + 4], 2
jmp 0x4371c2
test byte [ebx], 0x80
je 0x43719b
mov dword [esi + 4], 0x102
cmp byte [ebx], 0xff
jne 0x437148
cmp dword [ebp + 0x10], 1
je 0x437148
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
lea ecx, [eax - 1]
add ebx, ecx
add edx, ecx
jmp 0x43715a
mov byte [edx], 0
dec edx
dec eax
dec ebx
cmp byte [ebx], 0
jne 0x437163
test eax, eax
jne 0x437154
test eax, eax
jne 0x43717c
mov edx, dword [ebp - 8]
mov byte [edx], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
mov byte [eax + edx], 0
inc dword [ebp + 0x10]
jmp 0x4371c2
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
inc ecx
mov byte [edx], cl
dec edx
test eax, eax
jle 0x4371c2
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
mov byte [edx], cl
dec edx
test eax, eax
jg 0x43718b
jmp 0x4371c2
mov dword [esi + 4], 2
cmp byte [ebx], 0
jne 0x4371b1
cmp dword [ebp + 0x10], 1
je 0x4371b1
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
push eax
push ebx
mov edx, dword [ebp - 8]
push edx
call fcn.004051b8
add esp, 0xc
mov eax, dword [esi + 8]
test eax, eax
je 0x4371d0
push eax
call fcn.00410300
pop ecx
mov edx, dword [ebp - 8]
mov dword [esi + 8], edx
mov ecx, dword [ebp + 0x10]
mov dword [esi], ecx
cmp dword [ebp + 8], 0
je 0x4371e6
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, esi
jmp 0x437226
push 0x103
push 0x4a6332
push eax
push 0xc2
push 0xd
call fcn.004344a8
add esp, 0x14
test esi, esi
je 0x437224
cmp dword [ebp + 8], 0
je 0x43721d
mov edx, dword [ebp + 8]
cmp esi, dword [edx]
je 0x437224
push esi
call fcn.0043b428
pop ecx
xor eax, eax
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x43e520
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov esi, dword [ebx]
mov eax, dword [eax]
mov edx, dword [edx + 4]
mov dword [ebp - 4], esi
mov esi, dword [ebx + 4]
mov dword [ebp - 8], esi
mov esi, dword [ebx + 8]
mov dword [ebp - 0xc], esi
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, 0x20
jmp 0x43e58f
add ecx, 0x9e3779b9
mov esi, edx
shl esi, 4
add esi, dword [ebp - 4]
lea edi, [ecx + edx]
xor esi, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor esi, edi
add eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 0xc]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0x10]
xor esi, edi
add edx, esi
mov esi, ebx
add ebx, 0xffffffff
test esi, esi
jg 0x43e557
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43ece8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push esi
push edi
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x43ed87
mov dword [ebp - 0xc], 0xc8
push str.HIDVid_3689Pid_8762
call fcn.004053a8
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
push 0x4a8462
call fcn.00405628
add esp, 0xc
test eax, eax
jne 0x43ed87
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jne 0x43ed84
mov ecx, dword [ebp + 0x10]
mov esi, 0x4a848e
mov edi, ecx
lea edx, [ebp - 0x110]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004052cc
add esp, 8
mov eax, 1
jmp 0x43ed92
inc dword [ebp - 0x10]
inc esi
test ebx, ebx
je 0x43ed07
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401050
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x40107b
push 0
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [ebp - 0x18], 0x3a
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0xb9
mov byte [ebp - 0x15], 0x88
mov byte [ebp - 0x14], 0x7e
mov byte [ebp - 0x13], 0x67
mov byte [ebp - 0x12], 8
mov byte [ebp - 0x11], 0xc6
mov byte [ebp - 0x10], 0x38
mov byte [ebp - 0xf], 0x13
mov byte [ebp - 0xe], 0x4e
mov byte [ebp - 0xd], 0x89
mov byte [ebp - 0xc], 0xe0
mov byte [ebp - 0xb], 0x40
mov byte [ebp - 0xa], 0x42
mov byte [ebp - 9], 0x26
mov byte [ebp - 0x2c], 0x77
mov byte [ebp - 0x2b], 0x2e
mov byte [ebp - 0x2a], 0xfc
mov byte [ebp - 0x29], 0xda
mov byte [ebp - 0x28], 0x96
mov byte [ebp - 0x27], 0x67
mov byte [ebp - 0x26], 8
mov byte [ebp - 0x25], 0xc6
mov byte [ebp - 0x24], 0x38
mov byte [ebp - 0x23], 0x4b
mov byte [ebp - 0x22], 0xcd
mov byte [ebp - 0x21], 0x61
mov byte [ebp - 0x20], 0xe9
mov byte [ebp - 0x1f], 0x10
mov byte [ebp - 0x1e], 0x47
mov dword [ebp - 0x1c], 0xf
push 0x40
push 0x1000
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00401160
add esp, 0xc
push 0x10
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call section..text
add esp, 0x10
call dword [ebp - 4]
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004014c1
mov esp, ebp
pop ebp
ret

Function at 0x4014c1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x4014cb
repz ret
jmp fcn.00401777
Function at 0x40360b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402569
and dword [ebp - 0x14], 0
cmp dword [0x409744], 0
mov dword [ebp - 0x18], eax
jne 0x4036be
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x403766
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x403766
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x409744], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x409748], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40974c], eax
call edi
push eax
call esi
mov dword [0x409754], eax
test eax, eax
je 0x4036be
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x409750], eax
mov eax, dword [0x409750]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x403717
cmp dword [0x409754], ecx
je 0x403717
push eax
call esi
push dword [0x409754]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x403717
test ebx, ebx
je 0x403717
call edi
test eax, eax
je 0x40370e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40370e
test byte [ebp - 8], 1
jne 0x403717
or dword [ebp + 0x10], 0x200000
jmp 0x40374a
mov eax, dword [0x409748]
cmp eax, dword [ebp - 0x18]
je 0x40374a
push eax
call esi
test eax, eax
je 0x40374a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40374a
mov eax, dword [0x40974c]
cmp eax, dword [ebp - 0x18]
je 0x40374a
push eax
call esi
test eax, eax
je 0x40374a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x409744]
call esi
test eax, eax
je 0x403766
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x403768
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004014c1
leave
ret
Function at 0x406270
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434e9f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
push 0x447650
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], edi
call fcn.00428ca0
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 4], 1
push ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], 2
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x406369
push esi
call fcn.00428973
mov edi, eax
add esp, 4
test edi, edi
mov dword [ebp - 0x1c], edi
je 0x406369
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x406369
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x18]
push ecx
push edx
push 0x442ac0
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x406369
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov edx, ecx
mov esi, eax
shr edx, 0x10
shr esi, 0x10
and eax, 0xffff
and ecx, 0xffff
test edx, edx
jne 0x406349
test ecx, ecx
jne 0x406349
test esi, esi
jne 0x406334
test eax, eax
je 0x406369
push eax
push esi
lea eax, [ebp - 0x14]
push str._d._d
push eax
call fcn.00428167
add esp, 0x10
jmp 0x406369
push ecx
push edx
push eax
push esi
lea ecx, [ebp - 0x14]
push str._d._d._d._d
push ecx
call fcn.00428167
add esp, 0x18
jmp 0x406369
mov ebx, 1
test edi, edi
mov dword [ebp - 4], ebx
je 0x40637e
push edi
call fcn.0042899c
add esp, 4
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x14]
push edx
mov ecx, esi
call fcn.004289a7
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00428c32
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4082a0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43509f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
push 0x40
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], 0
call fcn.00428973
mov esi, eax
mov ecx, 0x10
xor eax, eax
mov edi, esi
add esp, 4
rep stosd dword es:[edi], eax
push 0x443130
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x18], 4
call fcn.00428ca0
lea eax, [esp + 0xc]
mov edi, 1
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40832f
push 0x4430f4
jmp 0x408358
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push esi
push edx
push 0
push str.Version
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x408357
push 0x4430f4
jmp 0x408358
push esi
lea ecx, [esp + 0xc]
call fcn.00428dbb
mov eax, dword [esp + 0xc]
test eax, eax
je 0x408370
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40837d
push esi
call fcn.0042899c
add esp, 4
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.004289a7
mov dword [esp + 0x18], edi
lea ecx, [esp + 8]
mov byte [esp + 0x24], 0
call fcn.00428c32
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x4083c0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4350cf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push 0x10
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
call fcn.00428973
mov esi, eax
xor eax, eax
mov ecx, esi
add esp, 4
mov dword [ecx], eax
push 0x443200
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea ecx, [esp + 8]
mov dword [esp + 0x10], 0x10
mov dword [esp + 0x14], 4
call fcn.00428ca0
lea edx, [esp + 8]
mov dword [esp + 0x20], 1
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones2
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x408451
push 0x4431a8
jmp 0x4084c6
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push str.CurrentLevel
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x408479
push 0x4431a8
jmp 0x4084c6
mov eax, dword [esi]
cmp eax, 0x12000
jne 0x408489
push 0x443188
jmp 0x4084c6
cmp eax, 0x11500
jne 0x408497
push 0x443178
jmp 0x4084c6
cmp eax, 0x11000
jne 0x4084a5
push 0x443168
jmp 0x4084c6
cmp eax, 0x10500
jne 0x4084b3
push 0x443158
jmp 0x4084c6
cmp eax, 0x10000
jne 0x4084c1
push 0x443148
jmp 0x4084c6
push 0x44313c
lea ecx, [esp + 8]
call fcn.00428dbb
mov eax, dword [esp + 8]
test eax, eax
je 0x4084de
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4084eb
push esi
call fcn.0042899c
add esp, 4
mov esi, dword [esp + 0x28]
lea eax, [esp + 4]
push eax
mov ecx, esi
call fcn.004289a7
mov dword [esp + 0x14], 1
lea ecx, [esp + 4]
mov byte [esp + 0x20], 0
call fcn.00428c32
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x408530
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x435107
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push 0x10
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 0
call fcn.00428973
mov esi, eax
xor eax, eax
mov ecx, esi
add esp, 4
mov dword [ecx], eax
push 0x4432bc
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea ecx, [esp + 8]
mov dword [esp + 0x10], 0x10
mov dword [esp + 0x14], 4
call fcn.00428ca0
lea edx, [esp + 8]
mov dword [esp + 0x24], 1
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408679
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push str.SecureProtocols
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408679
mov eax, dword [esi]
cmp eax, 0x20
jne 0x4085f1
push str.SSL3.0
jmp 0x40863f
cmp eax, 8
jne 0x4085fd
push str.SSL2.0
jmp 0x40863f
cmp eax, 0x80
jne 0x40860b
push str.TLS1.0
jmp 0x40863f
cmp eax, 0xa0
jne 0x408619
push str.SSL3.0_TLS1.0
jmp 0x40863f
cmp eax, 0x28
jne 0x408625
push str.SSL3.0_SSL2.0
jmp 0x40863f
cmp eax, 0x88
jne 0x408633
push str.SSL2.0_TLS1.0
jmp 0x40863f
cmp eax, 0xa8
jne 0x408648
push str.SSL3.0_SSL2.0_TLS1.0
lea ecx, [esp + 8]
call fcn.00428dbb
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
push eax
push 0x44320c
push ecx
call fcn.00428f3b
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x28], 2
call fcn.00428d6b
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call fcn.00428c32
test esi, esi
je 0x408686
push esi
call fcn.0042899c
add esp, 4
mov eax, dword [esp + 8]
test eax, eax
je 0x408695
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x2c]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.004289a7
mov dword [esp + 0x18], 1
lea ecx, [esp + 4]
mov byte [esp + 0x24], 0
call fcn.00428c32
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x4086d0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43513f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push 0x10
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
call fcn.00428973
mov esi, eax
xor eax, eax
mov ecx, esi
add esp, 4
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov edx, dword [0x44373c]
mov dword [esp + 0xc], 0x10
mov dword [esp + 0x10], 4
mov dword [esp + 4], edx
lea eax, [esp + 8]
mov dword [esp + 0x20], 1
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40875d
push 0x4432e8
jmp 0x4087af
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push esi
push edx
push 0
push str.1A10
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x408785
push 0x4432e8
jmp 0x4087af
mov eax, dword [esi]
test eax, eax
jne 0x408792
push 0x442284
jmp 0x4087af
cmp eax, 1
jne 0x40879e
push 0x44227c
jmp 0x4087af
cmp eax, 3
jne 0x4087aa
push 0x4432d8
jmp 0x4087af
push 0x4432c8
lea ecx, [esp + 8]
call fcn.00428dbb
mov eax, dword [esp + 8]
test eax, eax
je 0x4087c7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4087d4
push esi
call fcn.0042899c
add esp, 4
mov esi, dword [esp + 0x28]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.004289a7
mov dword [esp + 0x14], 1
lea ecx, [esp + 4]
mov byte [esp + 0x20], 0
call fcn.00428c32
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4