joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401130
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0c
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push esi
lea eax, [ebp - 0xa0c]
push 0x427b64
push eax
call fcn.00401080
add esp, 0x10
lea eax, [ebp - 0xa0c]
push 5
push 0
push eax
lea eax, [ebp - 0x20c]
push eax
push str.runas
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.0040bac1
mov esp, ebp
pop ebp
ret

Function at 0x4011b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
lea eax, [ebp - 4]
push edi
push eax
push 0x401240
mov edi, edx
mov dword [ebp - 4], 0
mov ebx, ecx
call esi
cmp dword [ebp - 4], 0
je 0x401213
cmp dword [ebp + 0xc], 0
jne 0x4011ff
push 1
push str.UnInstall
push edi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x4011ff
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x401240
call esi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x401240
call esi
mov eax, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 2
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401930
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421313
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x42f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
sub esp, 8
call fcn.004073e0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x78]
push edi
mov dword [edi], vtable.TUninstDlg.0
call fcn.004072e0
mov byte [ebp - 4], 1
mov dword [edi + 0xe0], 0
mov dword [edi + 0x74], 0
call fcn.00404f70
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [ebp - 0x10]
mov ecx, eax
call fcn.004049b0
mov dword [ebp - 0x10], eax
mov ebx, 1
mov esi, dword [eax + 4]
test esi, esi
je 0x401a46
jmp 0x4019c0
push str._SILENT
push esi
call fcn.0041577d
add esp, 8
test eax, eax
jne 0x4019de
mov dword [edi + 0xe0], 1
jmp 0x401a37
push 7
push str._runas
push esi
call fcn.004155c4
add esp, 0xc
test eax, eax
jne 0x401a06
push 0x10
push eax
add esi, 0xe
push esi
call fcn.00413268
add esp, 0xc
mov dword [edi + 0x74], eax
jmp 0x401a37
push 0x427cf8
push esi
call fcn.0041577d
add esp, 8
test eax, eax
je 0x401a26
push esi
push str.Unrecognized_option:__s
call fcn.00405360
add esp, 8
push eax
push ecx
mov ecx, edi
call fcn.00401ac0
or ecx, 0xffffffff
call fcn.00404d60
mov eax, dword [ebp - 0x10]
inc ebx
mov esi, dword [eax + ebx*4]
test esi, esi
jne 0x4019c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4020b0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42136b
mov eax, dword fs:[0]
push eax
sub esp, 0x6a4
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
push 0x80000001
lea ecx, [ebp - 0x6b0]
call fcn.00407eb0
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov dword [ebp - 4], 0
call fcn.00408060
test eax, eax
je 0x4021d4
push ecx
lea eax, [ebp - 0x31c]
push eax
push str.Startup
lea ecx, [ebp - 0x6b0]
call fcn.004082d0
test eax, eax
je 0x402152
lea ecx, [ebp - 0x31c]
call fcn.004014b0
push ecx
push str.IPMSG_for_Win.lnk
lea edx, [ebp - 0x31c]
lea ecx, [ebp - 0x628]
call fcn.004045d0
add esp, 8
lea ecx, [ebp - 0x628]
call fcn.00401310
push ecx
lea eax, [ebp - 0x31c]
push eax
push str.Desktop
lea ecx, [ebp - 0x6b0]
call fcn.004082d0
test eax, eax
je 0x402193
push ecx
push str.IPMSG_for_Win.lnk
lea edx, [ebp - 0x31c]
lea ecx, [ebp - 0x628]
call fcn.004045d0
add esp, 8
lea ecx, [ebp - 0x628]
call fcn.00401310
push ecx
lea eax, [ebp - 0x31c]
push eax
push str.Programs
lea ecx, [ebp - 0x6b0]
call fcn.004082d0
test eax, eax
je 0x4021d4
push ecx
push str.IP_Messenger_for_Win
lea edx, [ebp - 0x31c]
lea ecx, [ebp - 0x628]
call fcn.004045d0
add esp, 8
lea ecx, [ebp - 0x628]
call fcn.00401390
lea ecx, [ebp - 0x6b0]
call fcn.00407ee0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040bac1
mov esp, ebp
pop ebp
ret
Function at 0x4022e0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x620]
mov dword [ebp - 0x620], 0x30c
push eax
lea eax, [ebp - 0x61c]
mov esi, 1
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x310]
push str.ipmsg.rsa2048._s
push eax
call fcn.004010e0
push 0x20
lea edx, [ebp - 0x310]
mov ecx, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
call fcn.00401e50
add esp, 0x10
test eax, eax
je 0x402361
push 0
lea edx, [ebp - 0x310]
mov ecx, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
call fcn.00401e50
add esp, 4
test eax, eax
jne 0x402363
xor esi, esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x310]
push str.ipmsg.rsa1024._s
push eax
call fcn.004010e0
push 0x20
lea edx, [ebp - 0x310]
mov ecx, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
call fcn.00401e50
add esp, 0x10
test eax, eax
je 0x4023ad
push 0
lea edx, [ebp - 0x310]
mov ecx, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
call fcn.00401e50
add esp, 4
test eax, eax
jne 0x4023af
xor esi, esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x310]
push str.ipmsg.rsa512._s
push eax
call fcn.004010e0
push 0x20
lea edx, [ebp - 0x310]
mov ecx, str.Microsoft_Base_Cryptographic_Provider_v1.0
call fcn.00401e50
add esp, 0x10
test eax, eax
je 0x40240a
push 0
lea edx, [ebp - 0x310]
mov ecx, str.Microsoft_Base_Cryptographic_Provider_v1.0
call fcn.00401e50
add esp, 4
test eax, eax
je 0x40240a
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bac1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0040bac1
mov esp, ebp
pop ebp
ret
Function at 0x402ab0
Capabilities:
Delete file

Disassembly:
push esi
push edi
test ecx, ecx
je 0x402ac3
call fcn.00403080
mov esi, eax
test esi, esi
je 0x402ac5
jmp 0x402aca
xor esi, esi
mov eax, 0x427b5c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test esi, esi
je 0x402ae0
push esi
call fcn.0040bad2
add esp, 4
mov eax, edi
pop edi
pop esi
ret

Function at 0x402af0
Capabilities:
Delete directory

Disassembly:
push esi
push edi
test ecx, ecx
je 0x402b03
call fcn.00403080
mov esi, eax
test esi, esi
je 0x402b05
jmp 0x402b0a
xor esi, esi
mov eax, 0x427b5c
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test esi, esi
je 0x402b20
push esi
call fcn.0040bad2
add esp, 4
mov eax, edi
pop edi
pop esi
ret

Function at 0x402c40
Capabilities:
Get file attributes

Disassembly:
push esi
push edi
test ecx, ecx
je 0x402c53
call fcn.00403080
mov esi, eax
test esi, esi
je 0x402c55
jmp 0x402c5a
xor esi, esi
mov eax, 0x427b5c
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
test esi, esi
je 0x402c70
push esi
call fcn.0040bad2
add esp, 4
mov eax, edi
pop edi
pop esi
ret

Function at 0x402c80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421428
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x42f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xffffffff
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x402ccc
call fcn.00403080
mov esi, eax
jmp 0x402cce
xor esi, esi
push 5
push 0x427b5c
test esi, esi
mov eax, 0x427b5c
push 0x427b5c
cmovne eax, esi
push eax
push 0x427b5c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
test esi, esi
je 0x402d01
push esi
call fcn.0040bad2
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402d20
Capabilities:
Set current directory

Disassembly:
push esi
push edi
test ecx, ecx
je 0x402d33
call fcn.00403080
mov esi, eax
test esi, esi
je 0x402d35
jmp 0x402d3a
xor esi, esi
mov eax, 0x427b5c
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edi, eax
test esi, esi
je 0x402d50
push esi
call fcn.0040bad2
add esp, 4
mov eax, edi
pop edi
pop esi
ret
Function at 0x403a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x42f954], 6
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x224], edi
jb 0x403b78
mov dword [ebp - 0x220], 0x24
mov ebx, 0x24
mov dword [ebp - 0x21c], 0x26
mov dword [ebp - 0x218], 0x2a
mov dword [ebp - 0x214], 0x23
mov dword [ebp - 0x210], 0xffffffff
mov dword [ebp - 0x228], 0
lea esp, [esp]
push 0
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x403b5b
lea ebx, [ebx]
lea esi, [ebp - 0x20c]
lea ecx, [esi + 2]
lea esp, [esp]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x403ab0
sub esi, ecx
lea eax, [ebp - 0x20c]
sar esi, 1
push esi
push edi
push eax
call fcn.004155c4
add esp, 0xc
test eax, eax
jne 0x403af3
movzx eax, word [edi + esi*2]
test ax, ax
je 0x403b8b
cmp eax, 0x5c
je 0x403b8b
cmp eax, 0x2f
je 0x403b8b
cmp ebx, 0x26
jne 0x403b5b
lea esi, [esi*2 - 0xc]
mov ecx, str.__x86_
lea edi, [ebp - 0x20c]
add edi, esi
mov eax, edi
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403b36
test dx, dx
je 0x403b32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403b36
add eax, 4
add ecx, 4
test dx, dx
jne 0x403b10
xor eax, eax
jmp 0x403b3b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x403b55
cmp esi, 0x208
jae 0x403ba1
mov word [edi], ax
mov edi, dword [ebp - 0x224]
jmp 0x403aa0
mov edi, dword [ebp - 0x224]
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
mov ebx, dword [ebp + eax*4 - 0x220]
cmp ebx, 0xffffffff
jne 0x403a80
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bac1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bac1
mov esp, ebp
pop ebp
ret
call fcn.0040bd35
int3

Function at 0x404040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x430a04]
cmp eax, dword [ecx + 4]
jg 0x40407b
mov ecx, dword [ebp - 4]
mov eax, dword [0x4309f8]
xor ecx, ebp
call fcn.0040bac1
mov esp, ebp
pop ebp
ret
push 0x430a04
call fcn.0040bffc
add esp, 4
cmp dword [0x430a04], 0xffffffff
jne 0x404068
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0040d600
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00415948
push 0x430a04
mov dword [0x4309f8], eax
call fcn.0040bfb2
add esp, 8
jmp 0x404068
Function at 0x404fa0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.00421140
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
call sub.KERNEL32.dll_GetTickCount
mov edi, eax
mov eax, 0x10624dd3
sub edi, dword [0x430860]
mul edi
mov eax, 0xcccccccd
mov esi, edx
shr esi, 6
imul ecx, esi, 0x3e8
sub edi, ecx
mul edi
lea eax, [ebp - 0x200c]
shr edx, 3
push edx
push esi
push str._04d._02d:
push eax
call fcn.004010e0
mov esi, eax
lea ecx, [ebp - 0x200c]
lea eax, [ebp + 0xc]
mov edx, 0x1fff
push eax
push dword [ebp + 8]
sub edx, esi
add ecx, esi
call fcn.004046a0
add esp, 0x18
add esi, eax
lea eax, [ebp - 0x200c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x430868]
test eax, eax
je 0x40504d
push 0
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2010], esi
push ecx
push esi
lea ecx, [ebp - 0x200c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov eax, dword [0x430844]
test eax, eax
je 0x405074
push 0
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x2014], esi
push ecx
push esi
lea ecx, [ebp - 0x200c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.0040bac1
mov esp, ebp
pop ebp
ret

Function at 0x405090
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2010
call fcn.00421140
mov eax, dword [0x42f00c]
xor eax, esp
mov dword [esp + 0x200c], eax
push esi
push edi
call sub.KERNEL32.dll_GetTickCount
mov edi, eax
mov eax, 0x10624dd3
sub edi, dword [0x430860]
mul edi
mov eax, 0xcccccccd
mov esi, edx
shr esi, 6
imul ecx, esi, 0x3e8
sub edi, ecx
mul edi
lea eax, [esp + 0x10]
shr edx, 3
push edx
push esi
push str._04d._02d:
push eax
call fcn.004010e0
mov edi, eax
lea ecx, [esp + 0x20]
lea eax, [ebp + 0xc]
mov edx, 0x2000
push eax
push dword [ebp + 8]
sub edx, edi
add ecx, edi
call fcn.004046a0
add esp, 0x18
lea ecx, [esp + 0x10]
add edi, eax
call fcn.00403080
mov esi, eax
mov ecx, 0x427b5c
test esi, esi
cmovne ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x430868], 0
je 0x40516d
test esi, esi
jne 0x40513e
xor ecx, ecx
mov eax, 0x427b5c
jmp 0x405154
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405143
sub ecx, edx
mov eax, esi
sar ecx, 1
push 0
lea edx, [esp + 0xc]
mov dword [esp + 0xc], ecx
push edx
push ecx
push eax
push dword [0x430868]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov eax, dword [0x430844]
test eax, eax
je 0x40518e
push 0
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], edi
push ecx
push edi
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x40519b
push esi
call fcn.0040bad2
add esp, 4
mov ecx, dword [esp + 0x2014]
pop edi
pop esi
xor ecx, esp
call fcn.0040bac1
mov esp, ebp
pop ebp
ret
Function at 0x4051b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4216e0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x42f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x430868], 0
je 0x40534a
lea eax, [ebp + 0xc]
xor edx, edx
push eax
push dword [ebp + 8]
xor ecx, ecx
call fcn.00404720
mov esi, eax
add esp, 8
add esi, 1
je 0x405224
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040c33b
mov edi, eax
add esp, 4
xor eax, eax
mov word [edi], ax
jmp 0x405226
xor edi, edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
mov edx, esi
mov dword [ebp - 0x18], 0xffffffff
mov ecx, edi
call fcn.00404720
add esp, 8
test edi, edi
jne 0x405257
xor ecx, ecx
mov eax, 0x427b5c
jmp 0x405274
mov ecx, edi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405260
sub ecx, edx
mov eax, edi
sar ecx, 1
mov dword [ebp - 0x18], ecx
push 0
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], ecx
push edx
push ecx
push eax
push dword [0x430868]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x40533d
test edi, edi
je 0x4052a3
cmp word [edi], ax
je 0x4052a3
mov eax, 1
jmp 0x4052a5
xor eax, eax
test eax, eax
je 0x4052ba
inc eax
push eax
call fcn.0040c33b
mov ebx, eax
add esp, 4
mov byte [ebx], 0
jmp 0x4052bc
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0xffffffff
mov byte [ebp - 4], 1
test ebx, ebx
jne 0x4052d2
xor ecx, ecx
jmp 0x4052e3
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4052d7
sub ecx, edx
mov dword [ebp - 0x20], ecx
lea eax, [ecx*2 + 1]
mov dword [ebp - 0x10], eax
inc eax
push eax
call fcn.0040c33b
mov esi, eax
test ebx, ebx
mov ecx, 0x427b58
mov edx, esi
cmovne ecx, ebx
mov byte [esi], 0
push dword [ebp - 0x10]
call fcn.00404520
add esp, 8
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
push 0
push ecx
push eax
push esi
push dword [0x430868]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.0040bad2
add esp, 4
test ebx, ebx
je 0x40533d
push ebx
call fcn.0040bad2
add esp, 4
test edi, edi
je 0x40534a
push edi
call fcn.0040bad2
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406d50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
test edi, edi
je 0x406d7f
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040c33b
add esp, 4
mov esi, eax
jmp 0x406d81
xor esi, esi
push edi
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx + 0x54]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jns 0x406daa
push esi
or edi, 0xffffffff
call fcn.0040bad2
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov edx, dword [ebp + 8]
push ecx
push edi
mov ecx, esi
call fcn.00402dd0
add esp, 8
mov edi, eax
push esi
call fcn.0040bad2
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x408200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xd0]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push eax
push edi
lea eax, [ebp - 0xd4]
mov dword [ebp - 0xd4], 4
push eax
mov eax, dword [esi + 4]
push 0
push ebx
mov dword [ebp - 0xd0], 4
push dword [esi + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4082a9
lea eax, [ebp - 0xd8]
mov dword [ebp - 0xd8], 0xc8
push eax
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [esi + 4]
push ebx
push dword [esi + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x408294
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040bac1
mov esp, ebp
pop ebp
ret 8
push 0xa
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.00413210
add esp, 0xc
mov dword [edi], eax
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bac1
mov esp, ebp
pop ebp
ret 8

Function at 0x4083c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x618
push eax
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 8], 1
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [esi + 4]
push dword [ebp + 8]
push dword [esi + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40841c
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov eax, dword [esi + 4]
push dword [ebp + 8]
push dword [esi + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x40841c
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x408490
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
push dword [ebp + 8]
push dword [ecx + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
sbb eax, eax
inc eax
pop ebp
ret 4

Function at 0x4084b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
push dword [ebp + 8]
push dword [ecx + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
neg eax
sbb eax, eax
inc eax
pop ebp
ret 4

Function at 0x4084d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x100
push eax
push dword [ebp + 0xc]
mov eax, dword [ecx + 4]
push 0
push dword [ecx + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
neg eax
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x408510
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x100
push eax
push dword [ebp + 0xc]
mov eax, dword [ecx + 4]
push 0
push dword [ecx + eax*4 + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
neg eax
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40aef0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x40aefb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0040af10

Function at 0x40c33b
Capabilities:
Encode data using xor

Disassembly:
imul ecx, ebp, 0xbcb16938
mov al, 0xfb
sti
mov cl, 0x3d
adc cl, dl
test ebp, eax
sub dh, ch
jno 0x40c34c
sub edi, 0x3ff90194
mov ebx, ebp
mov ebp, 0x109e4377
mov dh, 0xce
call 0x40c3a2
push 0
pop ebx
test ebx, edx
movsx ebp, dh
lea ebp, [0xa52bf9e2]
mov al, 0x90
movzx esi, ah
mov cl, 0x8d
mov ebp, ebp
add ebx, 0xfffffcb0
cmp eax, edx
add ebx, 0x351
movzx ecx, cl
xchg dh, dh
mov dh, 0x6a
push 0xffffffffffffff80
cmc
mov esp, 0xc7d2b70f
shr dword [ebp - 0x40], 0x72
out dx, eax
cmp ebx, 0x239
jl 0x40c35f
imul ebx, ebx, 0
imul edi, ebp, 0xe542d2a6
test esi, 0xcaf85cbd
test dh, 0xea
mov ebp, edi
test ebp, ebx
add ebx, 0x4a1
add ebx, 0x4a1
test edi, ebp
jbe 0x40c3c9
test ch, bh
mov cl, 0xd1
sub ebx, 0x4a0
mov edx, ebp
test eax, 0x408e5941
cmp al, ah
lea eax, [0xb0698063]
lea eax, [0xe044b265]
imul eax, edx, 0xb196c30f
cmp ebx, 0x8fc
invalid
invalid