joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443370
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x499e8b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push edi
mov eax, dword [0x4ba700]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, ecx
lea ecx, [edi + 8]
push ecx
push 0
push str.UseRegistry
push str.admin
mov dword [edi + 0x10c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
dec eax
neg eax
sbb eax, eax
add eax, 1
mov dword [edi + 4], eax
mov ecx, edi
je 0x4433e8
push 1
call fcn.00445f70
jmp 0x4433ed
call fcn.00447d40
mov ecx, dword [edi + 0x10c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x120]
lea eax, [esp + 0x14]
push eax
call edx
push str.c:dataultravncultravnc_project_rootultravncwinvncwinvnc_vncPasswd.h_:_PASSWD_:_ToText_called_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
push 9
call fcn.0047da45
add esp, 4
push 1
mov ecx, 0x4bbf04
mov esi, eax
call fcn.00401e20
add esp, 4
lea eax, [esp + 0x14]
call fcn.004023e0
mov byte [esi + 8], 0
mov dword [esp + 0xc], esi
mov eax, esi
mov dword [esp + 0x138], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x443455
sub eax, edx
jne 0x44355c
cmp dword [edi + 0x114], eax
je 0x443516
call fcn.0040af30
test al, al
je 0x443516
mov ecx, dword [edi + 0x10c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x188]
call edx
test eax, eax
je 0x44355c
lea eax, [esp + 0x1c]
call fcn.00451550
test eax, eax
jne 0x4434b2
lea edi, [esp + 0xc]
call fcn.004146d0
xor eax, eax
jmp 0x443587
mov edx, 0x4a3fbe
lea ecx, [esp + 0x1c]
jmp 0x4434c0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4434e0
test al, al
je 0x4434dc
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4434e0
add ecx, 2
add edx, 2
test al, al
jne 0x4434c0
xor eax, eax
jmp 0x4434e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x44350c
push 0x30
push 0x4f2360
push 0x4f31b0
push eax
mov byte [edi], 1
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push edi
call fcn.004435b0
mov byte [edi], 0
jmp 0x44355c
push 1
push edi
call fcn.004435b0
jmp 0x44355c
mov ecx, dword [edi + 0x10c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x188]
call edx
test eax, eax
je 0x443548
push 0x10
push 0x4f2360
push 0x4f3408
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x44355c
push 0x30
push 0x4f2360
push 0x4f2838
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x443561
sub eax, edx
push eax
push 0
push esi
call fcn.004858b0
add esp, 0xc
push esi
call fcn.0047d643
add esp, 4
mov byte [edi], 0
mov eax, 1
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0047c3ff
mov esp, ebp
pop ebp
ret 4
Function at 0x445bf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
push 0
push eax
mov esi, 4
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x445c2f
mov eax, edi
pop esi
add esp, 8
ret 8
cmp dword [esp + 4], esi
jne 0x445c26
mov eax, edi
cmp dword [esp + 8], esi
jne 0x445c41
mov eax, dword [esp + 0x14]
pop esi
add esp, 8
ret 8

Function at 0x445c50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push ecx
push 0
push str.Password
push eax
mov dword [esp + 0x20], 3
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x445ca7
cmp dword [esp + 4], 8
jg 0x445ca7
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x18
ret 4

Function at 0x445cc0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push ecx
push 0
push str.Password2
push eax
mov dword [esp + 0x20], 3
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x445d17
cmp dword [esp + 4], 8
jg 0x445d17
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x18
ret 4

Function at 0x445d30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 8]
push eax
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push str.AuthHosts
push edi
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0
call ebx
test eax, eax
je 0x445d6b
xor eax, eax
pop ebx
add esp, 8
ret
cmp dword [esp + 4], 1
jne 0x445d64
mov edx, dword [esp + 8]
push esi
push edx
call fcn.0047cc97
mov esi, eax
add esp, 4
test esi, esi
je 0x445daf
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x10]
push ecx
push 0
push str.AuthHosts
push edi
call ebx
test eax, eax
jne 0x445da6
cmp dword [esp + 8], 1
je 0x445db7
push esi
call fcn.0047d0a1
add esp, 4
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4473b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x110]
push esi
push edi
mov edi, ecx
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x14]
push ecx
push 0
push str.DSMPlugin
mov esi, 0x100
push eax
mov dword [esp + 0x24], 3
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x447412
cmp dword [esp + 8], esi
jg 0x447412
mov ecx, 0x40
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x110]
pop edi
pop esi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x10c
ret 4
Function at 0x448f90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x110
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push esi
push edi
lea eax, [esp + 0xc]
mov esi, ecx
call fcn.00451550
test eax, eax
jne 0x448fe3
lea ecx, [eax + 9]
push str.._vncproperties.cpp_:__DBG___NO_current_user_n
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x110
ret
mov edx, 0x4a3fbe
lea ecx, [esp + 0xc]
lea esp, [esp]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x449010
test al, al
je 0x44900c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x449010
add ecx, 2
add edx, 2
test al, al
jne 0x448ff0
xor eax, eax
jmp 0x449015
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x44904d
lea ecx, [eax + 9]
push str.._vncproperties.cpp_:__DBG___Force_USER_SYSTEM_2_n
mov eax, 0x4bc990
call fcn.00401110
mov eax, dword [str.SYSTEM]
mov cx, word [0x4a9884]
mov dl, byte [0x4a9886]
add esp, 4
mov dword [esp + 0xc], eax
mov word [esp + 0x10], cx
mov byte [esp + 0x12], dl
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esi, 8
push esi
push 0
push str.DebugMode
push str.admin
call edi
mov ebx, eax
call fcn.0043dbc0
push esi
push 0
push str.DebugLevel
push str.admin
call edi
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebx
xor ecx, esp
mov dword [0x4bc9a0], eax
call fcn.0047c3ff
add esp, 0x110
ret

Function at 0x4490a0
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 4]
push ecx
push 0
push str.UseRegistry
push str.admin
mov dword [esi + 0x108], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
dec eax
neg eax
sbb eax, eax
add eax, 1
mov dword [esi], eax
je 0x4490db
push 1
mov ecx, esi
call fcn.00449e90
mov eax, 1
pop esi
ret
call fcn.0044a980
mov eax, 1
pop esi
ret
Function at 0x449c50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x2c
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push edi
mov edi, ecx
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push ecx
push 0
push str.SingleWindowName
push eax
mov dword [esp + 0x20], 3
mov dword [esp + 0x1c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x449cad
cmp dword [esp + 4], 0x100
jg 0x449cad
push esi
mov ecx, 8
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
pop esi
mov ecx, dword [esp + 0x2c]
pop edi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x2c
ret 4
Function at 0x44aa10
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push esi
push edi
mov esi, eax
mov eax, dword [esi + 0x118]
lea edi, [esi + 4]
push edi
push eax
push str.TurboMode
push str.poll
call ebx
push edi
mov dword [esi + 0x118], eax
mov eax, dword [esi + 0x11c]
push eax
push str.PollUnderCursor
push str.poll
call ebx
push edi
mov dword [esi + 0x11c], eax
mov eax, dword [esi + 0x120]
push eax
push str.PollForeground
push str.poll
call ebx
push edi
mov dword [esi + 0x120], eax
mov eax, dword [esi + 0x124]
push eax
push str.PollFullScreen
push str.poll
call ebx
push edi
mov dword [esi + 0x124], eax
mov eax, dword [esi + 0x128]
push eax
push str.OnlyPollConsole
push str.poll
call ebx
push edi
mov dword [esi + 0x128], eax
mov eax, dword [esi + 0x12c]
push eax
push str.OnlyPollOnEvent
push str.poll
call ebx
push edi
mov dword [esi + 0x12c], eax
mov eax, dword [esi + 0x130]
push eax
push str.MaxCpu
push str.poll
call ebx
mov dword [esi + 0x130], eax
test eax, eax
jne 0x44aae2
mov dword [esi + 0x130], 0x64
mov eax, dword [esi + 0x134]
push edi
push eax
push str.EnableDriver
push str.poll
call ebx
mov dword [esi + 0x134], eax
test eax, eax
je 0x44ab13
push 0
call fcn.00410900
movzx eax, al
add esp, 4
mov dword [esi + 0x134], eax
mov eax, dword [esi + 0x138]
push edi
push eax
push str.EnableHook
push str.poll
call ebx
push edi
mov dword [esi + 0x138], eax
mov eax, dword [esi + 0x13c]
push eax
push str.EnableVirtual
push str.poll
call ebx
push edi
mov dword [esi + 0x13c], eax
mov eax, dword [esi + 0x140]
push eax
push str.SingleWindow
push str.poll
call ebx
push edi
push 0x20
mov dword [esi + 0x140], eax
add esi, 0x144
push esi
push 0x4a3fbe
push str.SingleWindowName
push str.poll
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop esi
pop ebx
ret
Function at 0x44f02b
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub esp, 0x15c
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x158], eax
mov eax, dword [esp + 0x160]
push esi
mov esi, ecx
mov dword [esi + 0x44], eax
test eax, eax
je 0x44f126
cmp dword [esi + 0x34], 0
je 0x44f126
cmp dword [esi + 0x3c], 0
jne 0x44f13d
push 0x104
lea eax, [esp + 0x5c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x44f0ca
lea ecx, [esp + 0x58]
push 0x5c
push ecx
call fcn.0047c410
add esp, 8
test eax, eax
jne 0x44f08e
pop esi
mov ecx, dword [esp + 0x158]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x15c
ret 4
mov byte [eax], 0
lea eax, [esp + 0x58]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x44f096
mov edx, dword [str.xdmcpxdmcp.exe]
mov ecx, dword [0x4b116c]
mov dword [eax], edx
mov edx, dword [0x4b1170]
mov dword [eax + 4], ecx
mov ecx, dword [0x4b1174]
mov dword [eax + 8], edx
mov dl, byte [0x4b1178]
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], dl
push 0x44
lea eax, [esp + 0x18]
push 0
push eax
call fcn.004858b0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x18]
push edx
push str..xdmcp
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x78]
push eax
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x44f136
mov ecx, dword [esp + 4]
push 0x2710
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov edx, dword [esp + 4]
mov dword [esi + 0x3c], edx
jmp 0x44f13d
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44f13d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esi + 0x3c], 0
mov ecx, dword [esp + 0x15c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0047c3ff
add esp, 0x15c
ret 4
Function at 0x451100
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x13c
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x138], eax
push ebx
push esi
push edi
xor eax, eax
push str.kernel32.dll
mov dword [esp + 0x18], eax
mov dword [0x4f3798], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push str.WTSGetActiveConsoleSessionId
push ebx
call edi
push str.ProcessIdToSessionId
push ebx
mov esi, eax
call edi
mov dword [0x4f3798], eax
test esi, esi
je 0x45115c
call esi
mov edi, eax
jmp 0x45115e
xor edi, edi
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x451194
cmp dword [0x4f3798], 0
je 0x451194
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esp + 0x10]
push ecx
push eax
mov dword [esp + 0x18], 0xffffffff
call dword [0x4f3798]
mov edi, dword [esp + 0x10]
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4511c2
lea edx, [esp + 0x18]
push edx
push esi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4511e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x138]
xor ecx, esp
call fcn.0047c3ff
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x3c]
push str.explorer.exe
push eax
call fcn.0047d85e
add esp, 8
test eax, eax
jne 0x451250
mov dword [esp + 0x10], eax
mov eax, dword [0x4f3798]
test eax, eax
je 0x451248
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call eax
test eax, eax
je 0x451250
cmp dword [esp + 0x10], edi
jne 0x451250
mov edx, dword [esp + 0x20]
mov dword [esp + 0x14], edx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x144]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047c3ff
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x18]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4511e0
jmp 0x451221
Function at 0x4513f0
Capabilities:
Check for sandbox username or hostname
Get session user name

Disassembly:
mov eax, dword [0x4f3794]
sub esp, 8
push edi
test eax, eax
je 0x451407
mov dword [0x4f3790], 1
cmp dword [0x4ee094], 2
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4514b4
test eax, eax
je 0x4514b4
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
test eax, eax
jne 0x451436
push str.._vncservice.cpp_:_______________GetCurrentUser___ERROR_:_No_window_station__n
jmp 0x451535
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 4
push eax
call dword [sym.imp.USER32.dll_GetUserObjectInformationA]
call edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [esp + 8], 0
jne 0x45148a
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push str.._vncservice.cpp_:_______________GetCurrentUser___Error:_Usersize_0_n
xor ecx, ecx
mov eax, 0x4bc990
mov dword [0x4f3790], 0
mov byte [esi], 0
call fcn.00401110
add esp, 4
mov eax, 1
pop edi
add esp, 8
ret
cmp dword [0x4f3790], 0
jne 0x4514b4
push str.._vncservice.cpp_:_______________GetCurrentUser___Error:_NOT_impersonating_user__n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
mov byte [esi], 0
mov eax, 1
pop edi
add esp, 8
ret
mov edx, dword [0x4ee094]
dec edx
cmp edx, 1
ja 0x451530
mov ecx, esi
mov dword [esp + 8], 0x101
call fcn.00451270
test al, al
jne 0x451511
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x451511
call edi
cmp eax, 0x4dd
jne 0x4514f3
push str.._vncservice.cpp_:_______________GetCurrentUser___Error:_No_user_logged_on__n
jmp 0x451498
call edi
push eax
push str.._vncservice.cpp_:_getusername_error__d_n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 8
xor eax, eax
pop edi
add esp, 8
ret
push esi
push str.._vncservice.cpp_:_______________GetCurrentUser___UserNAme_found:__s__n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 8
mov eax, 1
pop edi
add esp, 8
ret
push str.._vncservice.cpp_:_______________GetCurrentUser___Error:_Unknown_OS__n
xor ecx, ecx
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
xor eax, eax
pop edi
add esp, 8
ret

Function at 0x451df0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 8
cmp dword [eax + 0x42c], 0
je 0x451e4b
push esi
lea eax, [esp + 8]
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push ecx
mov ecx, dword [esp + 0x24]
mov esi, 4
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x451e37
cmp dword [esp + 4], esi
jne 0x451e37
cmp dword [esp + 8], esi
je 0x451e40
mov eax, edi
pop esi
add esp, 8
ret 4
mov eax, dword [esp + 0x10]
pop esi
add esp, 8
ret 4
add eax, 0x430
push eax
push edi
push ecx
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 8
ret 4
Function at 0x451e70
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, eax
cmp dword [ebx + 0x42c], 0
push esi
je 0x451ef8
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0xc]
push eax
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push edi
mov esi, 0x100
push ebp
mov dword [esp + 0x2c], 1
mov dword [esp + 0x24], esi
call ebx
test eax, eax
jne 0x451eef
cmp dword [esp + 0x14], 3
jne 0x451eef
push esi
mov dword [esp + 0x10], esi
call fcn.0047cc97
mov esi, eax
add esp, 4
test esi, esi
je 0x451eef
lea edx, [esp + 0xc]
push edx
push esi
lea eax, [esp + 0x1c]
push eax
push 0
push edi
push ebp
call ebx
test eax, eax
jne 0x451ee6
cmp dword [esp + 0x14], 3
je 0x451f25
push esi
call fcn.0047d0a1
add esp, 4
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
push 0x96
call fcn.0047cc97
add esp, 4
add ebx, 0x430
push ebx
push 0x96
mov esi, eax
push esi
push 0x4a3fbe
push edi
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x451f30
Capabilities:
Set registry value

Disassembly:
sub esp, 0x24
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
push esi
mov esi, ecx
cmp dword [esi + 0x42c], 0
je 0x451f73
push 4
lea ecx, [esp + 0x34]
push ecx
push 4
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0047c3ff
add esp, 0x24
ret 8
mov edx, dword [esp + 0x30]
push edx
lea eax, [esp + 8]
push 0x4a99bc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
add esi, 0x430
push esi
lea ecx, [esp + 8]
push ecx
push edi
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [esp + 0x24]
pop esi
xor ecx, esp
call fcn.0047c3ff
add esp, 0x24
ret 8

Function at 0x451fc0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x42c], 0
push edi
mov edi, eax
je 0x452056
mov eax, esi
call fcn.00451d80
mov eax, dword [esi + 0x108]
test eax, eax
je 0x45201d
cmp dword [esi + 0x42c], 0
je 0x452005
push 0xfe
push edi
push 3
push 0
push str.group1
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x45201d
lea eax, [esi + 0x430]
push eax
push edi
push str.group1
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [esi + 0x42c], 0
je 0x45206e
mov eax, dword [esi + 0x108]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x452039
push eax
call edi
mov eax, dword [esi + 0x10c]
test eax, eax
je 0x452046
push eax
call edi
mov esi, dword [esi + 0x104]
test esi, esi
je 0x45206e
push esi
call edi
pop edi
pop esi
ret
add esi, 0x430
push esi
push edi
push str.group1
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
ret
Function at 0x452100
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x42c], 0
push edi
mov edi, eax
je 0x452196
mov eax, esi
call fcn.00451d80
mov eax, dword [esi + 0x108]
test eax, eax
je 0x45215d
cmp dword [esi + 0x42c], 0
je 0x452145
push 0xfe
push edi
push 3
push 0
push str.group2
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x45215d
lea eax, [esi + 0x430]
push eax
push edi
push str.group2
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [esi + 0x42c], 0
je 0x4521ae
mov eax, dword [esi + 0x108]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x452179
push eax
call edi
mov eax, dword [esi + 0x10c]
test eax, eax
je 0x452186
push eax
call edi
mov esi, dword [esi + 0x104]
test esi, esi
je 0x4521ae
push esi
call edi
pop edi
pop esi
ret
add esi, 0x430
push esi
push edi
push str.group2
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
ret

Function at 0x452240
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x42c], 0
push edi
mov edi, eax
je 0x4522d6
mov eax, esi
call fcn.00451d80
mov eax, dword [esi + 0x108]
test eax, eax
je 0x45229d
cmp dword [esi + 0x42c], 0
je 0x452285
push 0xfe
push edi
push 3
push 0
push str.group3
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x45229d
lea eax, [esi + 0x430]
push eax
push edi
push str.group3
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [esi + 0x42c], 0
je 0x4522ee
mov eax, dword [esi + 0x108]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4522b9
push eax
call edi
mov eax, dword [esi + 0x10c]
test eax, eax
je 0x4522c6
push eax
call edi
mov esi, dword [esi + 0x104]
test esi, esi
je 0x4522ee
push esi
call edi
pop edi
pop esi
ret
add esi, 0x430
push esi
push edi
push str.group3
push str.admin_auth
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
ret