joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003155
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
cmp dword [0x10051f4], esi
push edi
mov edi, dword [0x1001130]
jne 0x10031cd
cmp dword [0x10051f8], esi
jne 0x10031cd
cmp ebx, 0x10
je 0x1003305
cmp ebx, 0x8000
je 0x10032e5
cmp dword [0x10051fc], esi
jne 0x10031cd
mov eax, 0x104
cmp ebx, eax
ja 0x100321c
je 0x1003259
cmp ebx, 0x18
je 0x100320e
cmp ebx, 0x1c
je 0x1003209
cmp ebx, 0x20
je 0x10031fa
cmp ebx, 0x48
je 0x10031c3
cmp ebx, 0x100
jmp 0x10031c7
cmp dword [ebp + 0x10], 3
je 0x1003259
cmp ebx, dword [0x100520c]
jne 0x1003330
cmp ebx, esi
je 0x1003330
push esi
push esi
push 0x10
push dword [ebp + 8]
call edi
xor eax, eax
cmp dword [0x1005204], esi
setne al
jmp 0x1003340
push esi
call dword [0x1001138]
xor eax, eax
inc eax
jmp 0x1003340
cmp dword [ebp + 0x10], esi
jmp 0x10031c7
cmp dword [ebp + 0x10], esi
je 0x10031cd
push esi
call dword [0x1001138]
jmp 0x10031cd
mov eax, ebx
sub eax, 0x200
je 0x100328d
dec eax
je 0x1003259
sub eax, 3
je 0x1003259
sub eax, 3
je 0x1003259
sub eax, 0x11
jne 0x10031cd
cmp dword [ebp + 0x10], 6
jb 0x1003259
cmp dword [ebp + 0x10], 8
jbe 0x100324f
cmp dword [ebp + 0x10], 0xa
je 0x1003267
cmp dword [ebp + 0x10], 0x12
jne 0x1003259
test byte [ebp + 0x14], 1
jne 0x10031cd
push esi
push esi
push 0x10
push dword [ebp + 8]
call edi
jmp 0x10031cd
lea eax, [ebp - 0x14]
push eax
call fcn.01003af4
test eax, eax
je 0x1003279
mov al, byte [ebp - 0x14]
jmp 0x100327b
or al, 0xff
cmp al, byte [0x1005180]
mov byte [0x1005180], al
jne 0x1003259
jmp 0x10031cd
lea eax, [ebp - 8]
push eax
call dword [0x1001190]
mov ecx, dword [ebp - 8]
sub ecx, dword [0x1009900]
je 0x10032a8
cmp ecx, esi
jge 0x10032a8
neg ecx
mov eax, dword [ebp - 4]
sub eax, dword [0x1009904]
je 0x10032b9
cmp eax, esi
jge 0x10032b9
neg eax
add eax, ecx
cmp eax, dword [0x100517c]
jbe 0x10031cd
push esi
push esi
push 0x10
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 8]
mov dword [0x1009900], eax
mov eax, dword [ebp - 4]
mov dword [0x1009904], eax
jmp 0x10031cd
cmp dword [0x100521c], esi
je 0x10031cd
mov eax, dword [0x1005204]
cmp eax, esi
je 0x1003201
push dword [ebp + 8]
call eax
jmp 0x1003340
cmp dword [0x100521c], esi
je 0x10031cd
push dword [ebp + 8]
call fcn.01003033
test eax, eax
jne 0x10031cd
push 0x1009900
call dword [0x1001190]
xor eax, eax
jmp 0x1003340
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [0x1001134]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x100334c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [0x100521c], esi
je 0x10033f0
cmp dword [0x1005200], esi
je 0x1003370
call fcn.01003117
lea eax, [ebp - 4]
push eax
push 0x1001234
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10033f0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push str.ScreenSaveUsePassword
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10033e7
cmp dword [ebp - 0xc], esi
je 0x10033e7
push str.PASSWORD.CPL
call dword [fcn.010010c8]
cmp eax, esi
mov dword [0x1005200], eax
je 0x10033e7
push str.VerifyScreenSavePwd
push eax
call dword [fcn.010010bc]
cmp eax, esi
mov dword [0x1005204], eax
je 0x10033e2
push 1
call fcn.01002dab
jmp 0x10033e7
call fcn.01003117
push dword [ebp - 4]
call dword [entry0]
pop esi
leave
ret
Function at 0x43a000
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
jne 0x43a018
xor eax, eax
jmp 0x43a044
push 0x101c
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x43a02d
xor eax, eax
jmp 0x43a044
mov eax, 0x40b3e8
sub eax, 0x51615
mov dword [0x401308], eax
mov eax, dword [0x401308]
add eax, 4
pop ebp
ret
Function at 0x402954
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x48f030], 0x8088405
inc edx
mov dword [0x48f030], edx
mul edx
mov eax, edx
ret

Function at 0x406f3c
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x407180
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004034ac
cmp dword [0x48e0dc], 1
je 0x406fbd
mov dword [ebp - 0x14], 0x400
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
mov eax, dword [ebp - 4]
call fcn.00403750
push eax
call fcn.00405b64
test eax, eax
jne 0x407162
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x420]
mov edx, dword [edx]
call fcn.00403544
jmp 0x407162
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.004027b4
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0x41
jb 0x407162
cmp byte [ebp - 0x15], 0x5a
ja 0x407162
mov eax, dword [ebp - 4]
call fcn.0040358c
cmp eax, 3
jl 0x407162
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x3a
jne 0x407162
mov eax, dword [ebp - 4]
cmp byte [eax + 2], 0x5c
jne 0x407162
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 1
push 1
call fcn.00405b6c
test eax, eax
jne 0x407162
xor edx, edx
push ebp
push 0x40715b
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x10], 0x640
mov eax, dword [ebp - 0x10]
call fcn.00402648
mov dword [ebp - 0x20], eax
xor edx, edx
push ebp
push 0x40713d
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00405b54
cmp eax, 0xea
jne 0x40708c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x10]
call fcn.00402678
jmp 0x407050
test eax, eax
je 0x40709f
call fcn.004031d4
call fcn.004031d4
jmp 0x407162
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x407050
inc esi
xor edi, edi
mov eax, edi
shl eax, 2
mov edx, dword [ebp - 0x20]
lea ebx, [edx + eax*8]
cmp dword [ebx + 0x10], 0
je 0x40711b
mov eax, dword [ebx + 0x10]
mov al, byte [eax]
call fcn.004027b4
cmp al, byte [ebp - 0x15]
jne 0x40711b
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp - 4]
call fcn.0040358c
mov ecx, eax
sub ecx, 2
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.00403790
mov eax, dword [ebp - 0x424]
push eax
lea eax, [ebp - 0x428]
mov edx, dword [ebx + 0x14]
call fcn.00403544
mov edx, dword [ebp - 0x428]
mov eax, dword [ebp - 8]
pop ecx
call fcn.004035d8
call fcn.004031d4
call fcn.004031d4
jmp 0x407162
inc edi
dec esi
jne 0x4070aa
jmp 0x407050
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407187
lea eax, [ebp - 0x428]
mov edx, 2
call fcn.00403438
ret
Function at 0x407218
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call fcn.004058d4
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004034f8
add esp, 0x104
pop ebx
ret

Function at 0x408500
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call fcn.00405944
test eax, eax
jle 0x408539
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004034f8
jmp 0x408542
mov eax, ebx
mov edx, esi
call fcn.004034ac
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40854c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call fcn.00405944
test eax, eax
jle 0x40856d
mov al, byte [esp]
jmp 0x40856f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x411054
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403418
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call fcn.0040608c
shl eax, 0x10
test eax, eax
je 0x4110b5
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call fcn.00405f4c
cmp byte [ebp - 0x101], 0
jne 0x4110b5
cmp byte [ebp - 0x102], 0
je 0x4110b5
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00403574
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4122f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x24], 0
je 0x412375
xor eax, eax
mov al, byte [ebx + 4]
mov word [ebp - 6], ax
push 0x10
call fcn.00405f54
test ax, ax
jge 0x412326
add word [ebp - 6], 0x2000
push 0x11
call fcn.00405f54
test ax, ax
jge 0x412338
add word [ebp - 6], 0x4000
test byte [ebx + 0xb], 0x20
je 0x412344
add word [ebp - 6], 0x8000
xor ebx, ebx
movzx edx, word [ebp - 6]
mov cl, 2
mov eax, dword [ebp - 0xc]
call fcn.004121cc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x412369
push ebp
mov eax, dword [ebp - 4]
call fcn.00412268
pop ecx
mov ebx, eax
cmp bl, 2
je 0x412344
cmp dword [ebp - 4], 0
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419ae8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x419aee
ret
Function at 0x41f3a8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x48f650
cmp dword [edi], 0
jne 0x41f424
push 0x40
push 0x1000
push 0x1000
push 0
call fcn.00405b14
mov esi, eax
mov eax, dword [0x48f64c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x48e594
mov ecx, 2
call fcn.00402738
mov edx, 0x41f380
lea eax, [esi + 5]
call fcn.0041f3a0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041f3a0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41f3f9
mov dword [0x48f64c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41f528
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41f578]
test si, 4
je 0x41f53c
or bl, 1
test si, 8
je 0x41f546
or bl, 4
test si, 1
je 0x41f550
or bl, 8
test si, 2
je 0x41f55a
or bl, 0x10
test si, 0x10
je 0x41f564
or bl, 0x20
push 0x12
call fcn.00405f54
test ax, ax
jge 0x41f573
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x41f57c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41f5b4]
push 0x10
call fcn.00405f54
test ax, ax
jge 0x41f595
or bl, 1
push 0x11
call fcn.00405f54
test ax, ax
jge 0x41f5a4
or bl, 4
test esi, 0x20000000
je 0x41f5af
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x423548
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x48f628]
cmp byte [eax + 0x7f], 0
jne 0x42359b
cmp dword [0x48f654], 0
jne 0x423577
call fcn.004058f4
push eax
push 0
mov eax, 0x423504
push eax
push 3
call fcn.004061d4
mov dword [0x48f654], eax
cmp dword [0x48f658], 0
jne 0x42359b
push esp
push 0
push 0
push 0x4234b4
push 0x3e8
push 0
call fcn.00405854
mov dword [0x48f658], eax
pop edx
ret

Function at 0x4235a0
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x48f654], 0
je 0x4235b4
mov eax, dword [0x48f654]
push eax
call fcn.0040621c
xor eax, eax
mov dword [0x48f654], eax
cmp dword [0x48f658], 0
je 0x4235d1
push 0
mov eax, dword [0x48f658]
push eax
call fcn.00405afc
xor eax, eax
mov dword [0x48f658], eax
ret

Function at 0x423670
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x423687
add esp, 0xfffffff0
call fcn.00402d48
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00410204
mov dl, 1
mov eax, 0x40a4a8
call fcn.00402b48
mov dword [ebx + 0x70], eax
mov dl, 1
mov eax, 0x40a4a8
call fcn.00402b48
mov dword [ebx + 0x80], eax
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x3c], 0x80000018
mov dword [ebx + 0x54], 0x1f4
mov dword [ebx + 0x58], 0x32
mov dword [ebx + 0x5c], 0x9c4
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x7d], 1
mov dl, 1
mov eax, 0x4199e0
call fcn.0041d9f8
mov esi, eax
mov dword [ebx + 0x78], esi
push 0x4237c8
mov eax, dword [0x48f014]
push eax
call fcn.0040607c
mov edx, eax
mov eax, esi
call fcn.0041dd84
mov eax, dword [ebx + 0x78]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x424a88
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x48f014]
push eax
call fcn.00405954
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call fcn.004060b4
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.00407458
test eax, eax
je 0x423764
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004072c0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.00407438
test eax, eax
je 0x423778
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call fcn.00405d8c
lea eax, [ebx + 0x6c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403574
cmp byte [0x48f034], 0
jne 0x4237a8
mov eax, ebx
call fcn.00423858
mov byte [ebx + 0x39], 1
mov byte [ebx + 0x3a], 1
cmp byte [ebp - 1], 0
je 0x4237c0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x424260
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x7e], 0
je 0x424292
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x20]
push eax
call fcn.00405ff4
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004034f8
jmp 0x42429c
mov eax, esi
mov edx, dword [ebx + 0x6c]
call fcn.004034ac
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x424c60
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x60]
test esi, esi
je 0x424c98
mov eax, esi
call fcn.0041835c
test al, al
je 0x424c98
mov eax, dword [ebx + 0x60]
call fcn.004181c4
push eax
call fcn.00406054
test eax, eax
je 0x424c98
push 0
mov eax, dword [ebx + 0x60]
call fcn.004181c4
push eax
call fcn.004061f4
pop esi
pop ebx
ret

Function at 0x42cbec
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x42cc34
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0042cae0
mov eax, dword [ebp - 4]
call fcn.00403750
push eax
call fcn.0040591c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42cc3b
lea eax, [ebp - 4]
call fcn.00403418
ret

Function at 0x42cc44
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403750
push eax
call fcn.0040591c
cmp eax, 0xffffffff
je 0x42cc5d
test al, 0x10
je 0x42cc61
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x42cc8c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403750
push eax
call fcn.0040591c
cmp eax, 0xffffffff
je 0x42ccaa
test al, 0x10
je 0x42ccaa
test ah, 4
je 0x42ccae
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x42ccb4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
call fcn.00403740
xor eax, eax
push ebp
push 0x42cda6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0040375c
mov ebx, pe_nt_image_headers32
mov eax, esi
mov ecx, ebx
xor edx, edx
call fcn.004034f8
cmp dword [ebp + 0xc], 0
je 0x42cd31
mov eax, dword [ebp + 0xc]
call fcn.00403750
push eax
push ebx
mov eax, esi
call fcn.0040375c
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403750
push eax
mov eax, dword [ebp - 8]
call fcn.00403750
push eax
mov eax, dword [ebp - 4]
call fcn.00403750
push eax
call fcn.0040596c
jmp 0x42cd5a
push ebx
mov eax, esi
call fcn.0040375c
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403750
push eax
mov eax, dword [ebp - 8]
call fcn.00403750
push eax
mov eax, dword [ebp - 4]
call fcn.00403750
push eax
call fcn.0040597c
test eax, eax
je 0x42cd6a
mov eax, dword [esi]
call fcn.00403750
call fcn.00407258
mov edx, ebx
sub edx, 8
cmp eax, edx
jl 0x42cd7b
cmp ebx, 0x10000
jl 0x42cd85
mov edx, esi
xchg edx, eax
call fcn.004038bc
jmp 0x42cd90
mov eax, ebx
add eax, eax
mov ebx, eax
jmp 0x42ccec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42cdad
lea eax, [ebp - 0xc]
call fcn.00403418
ret
Function at 0x42ce7c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov byte [ebp - 8], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x42cec4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00403750
push eax
push 8
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00403750
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00403750
push eax
call fcn.0040596c
jmp 0x42cee8
push 8
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00403750
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00403750
push eax
call fcn.0040597c
push ebx
lea eax, [ebp - 8]
push eax
call fcn.00405b44
test eax, eax
sete al
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x42cf48
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov ebx, edx
mov esi, eax
mov byte [esp], 0
test ebx, ebx
je 0x42cf84
mov eax, ebx
call fcn.00403750
push eax
push pe_nt_image_headers32
lea eax, [esp + 8]
push eax
push 0x42cfb4
push 0
mov eax, esi
call fcn.00403750
push eax
call fcn.0040596c
jmp 0x42cfa2
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push 0x42cfb4
push 0
mov eax, esi
call fcn.00403750
push eax
call fcn.0040597c
cmp byte [esp], 0
sete al
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x42d754
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call fcn.004059cc
mov edx, ebx
mov eax, esp
call fcn.0040747c
add esp, 0x104
pop ebx
ret

Function at 0x42d780
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call fcn.00405994
mov edx, ebx
mov eax, esp
call fcn.0040747c
add esp, 0x104
pop ebx
ret
Function at 0x42da18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x42db39
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call fcn.004057ec
test eax, eax
jne 0x42db23
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x42da71
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x42db23
cmp dword [ebp - 0xc], 0
jne 0x42da86
mov eax, dword [ebp - 4]
call fcn.00403418
mov bl, 1
jmp 0x42db23
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.004034f8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.0040375c
push eax
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call fcn.004057ec
cmp eax, 0xea
je 0x42da3d
test eax, eax
jne 0x42db23
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x42dacd
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x42db23
jmp 0x42dacd
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
je 0x42dae0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp byte [eax + edx - 1], 0
je 0x42daca
cmp dword [ebp - 8], 7
jne 0x42daef
cmp dword [ebp - 0xc], 0
je 0x42daef
inc dword [ebp - 0xc]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004038bc
cmp dword [ebp - 8], 7
jne 0x42db16
cmp dword [ebp - 0xc], 0
je 0x42db16
lea eax, [ebp - 0x10]
call fcn.0040375c
mov edx, dword [ebp - 0xc]
mov byte [eax + edx - 1], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00403468
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42db40
lea eax, [ebp - 0x10]
call fcn.00403418
ret

Function at 0x42db64
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
mov edi, eax
push 0
push 0
push 0
push 0
push esi
push edi
call fcn.004057ec
test eax, eax
sete bl
test bl, bl
je 0x42dbd9
test esi, esi
je 0x42db8f
cmp byte [esi], 0
jne 0x42dbd9
cmp dword [0x48e0dc], 2
je 0x42dbd9
xor ebx, ebx
xor esi, esi
mov dword [esp + 4], 2
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push esi
push edi
call fcn.004057d4
test eax, eax
je 0x42dbc8
cmp eax, 0xea
jne 0x42dbd9
test eax, eax
jne 0x42dbd6
cmp byte [esp], 0
jne 0x42dbd6
mov bl, 1
jmp 0x42dbd9
inc esi
jmp 0x42db9c
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x42dc44
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp al, 2
je 0x42dc58
push esi
push ebx
call fcn.004057bc
pop esi
pop ebx
ret
cmp dword [0x48f65c], 0
jne 0x42dc7b
push 0x42dca0
push 0x42dcb0
call fcn.0040595c
push eax
call fcn.00405974
mov dword [0x48f65c], eax
cmp dword [0x48f65c], 0
je 0x42dc95
push 0
push pe_nt_image_headers32
push esi
push ebx
call dword [0x48f65c]
jmp 0x42dc9a
mov eax, 0x7f
pop esi
pop ebx
ret