joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c930
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x469403
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0045cdb0
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00462448
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00463964
test eax, eax
je 0x43ca4c
mov ecx, dword [esp + 0x3c]
call fcn.00462475
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43ca10
push edi
mov ecx, esi
call fcn.0045fadf
mov ecx, esi
call fcn.0043cbb0
cmp dword [esp + 0x38], 1
jne 0x43ca45
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0045fc1a
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x43f480
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43f4b3
push esi
call fcn.00442570
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43f4ac
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43f539
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43f522
mov eax, dword [esi + 8]
test eax, eax
je 0x43f4d7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43f51e
cmp eax, 2
je 0x43f522
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43f4ca
cmp eax, 3
je 0x43f4fd
cmp eax, 1
jne 0x43f4ca
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43f4ca
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43f4ca
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043f560
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43f548
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043f560
add esp, 4
pop esi
ret

Function at 0x45dba5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45dbdd
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045bc5c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045bc34
jmp 0x45dbe9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45f29c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45f2de
call fcn.00464d54
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45f2de
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45f2d5
xor eax, eax
jmp 0x45f2e6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045f2ec
pop edi
pop esi
pop ebx
ret 4

Function at 0x465284
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4652b2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4652d0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004651ea
jmp 0x4652d0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4652d0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004651ea
test edi, edi
mov eax, edi
jne 0x4652ba
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401ef0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x401f06
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
call fcn.00401db0
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop esi
ret

Function at 0x402940
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040bfe0
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x42d130
lea ecx, [ebp - 8]
push ecx
push 0
push str.pcolwidth
push esi
mov dword [ebp - 4], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402982
mov dword [0x42d130], 0xffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x42d130], 0
jge 0x4029c1
push 0x10
lea edx, [ebp - 0x18]
push edx
push 0x42d130
mov dword [ebp - 0x18], 0x3c
mov dword [ebp - 0x14], 0xbe
mov dword [ebp - 0x10], 0x37
mov dword [ebp - 0xc], 0x4a
call fcn.00414520
add esp, 0xc
mov eax, dword [edi + 4]
push 0x460
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov dword [ebp - 0x38], 0xf
xor esi, esi
mov ecx, dword [esi*4 + 0x42d140]
mov edx, dword [esi*4 + 0x42d130]
lea eax, [ebp - 0x38]
push eax
push esi
push 0x101b
push edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], 0
call ebx
add esi, 1
cmp esi, 4
jl 0x4029e1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402cc0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx + 4]
push ebx
push esi
push edi
push 0x460
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
xor esi, esi
lea esp, [esp]
push 0
push esi
push 0x101d
push edi
call ebx
mov dword [esi*4 + 0x42d130], eax
add esi, 1
cmp esi, 4
jl 0x402a40
call fcn.0040bfe0
push 0x10
push 0x42d130
push 3
push 0
mov esi, eax
push str.pcolwidth
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
ret
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push 1
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, esi
pop esi
jmp 0x402a20
Function at 0x403800
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040bfe0
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x42d16c
lea ecx, [ebp - 8]
push ecx
push 0
push str.rcolwidth
mov ebx, 0x18
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40383e
cmp dword [ebp - 4], ebx
je 0x403848
mov dword [0x42d16c], 0xffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x42d16c], 0
jge 0x403894
push ebx
lea edx, [ebp - 0x20]
push edx
push 0x42d16c
mov dword [ebp - 0x20], 0x28
mov dword [ebp - 0x1c], 0x6e
mov dword [ebp - 0x18], 0x4b
mov dword [ebp - 0x14], 0x32
mov dword [ebp - 0x10], 0x41
mov dword [ebp - 0xc], 0x46
call fcn.00414520
add esp, 0xc
mov eax, dword [edi + 4]
push 0x46a
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov dword [ebp - 0x40], 0xf
xor esi, esi
jmp 0x4038c0
mov ecx, dword [esi*4 + 0x42d184]
mov edx, dword [esi*4 + 0x42d16c]
lea eax, [ebp - 0x40]
push eax
push esi
push 0x101b
push edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], 0
call ebx
add esi, 1
cmp esi, 6
jl 0x4038c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404000
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx + 4]
push ebx
push esi
push edi
push 0x46a
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
xor esi, esi
lea esp, [esp]
push 0
push esi
push 0x101d
push edi
call ebx
mov dword [esi*4 + 0x42d16c], eax
add esi, 1
cmp esi, 6
jl 0x403920
call fcn.0040bfe0
push 0x18
push 0x42d16c
push 3
push 0
mov esi, eax
push str.rcolwidth
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
ret
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push 1
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, esi
pop esi
jmp 0x403900

Function at 0x405d60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040bfe0
mov edi, eax
lea eax, [ebp - 4]
push eax
lea ebx, [esi + 0x44]
push ebx
push 0
push 0
push str.AutoStart
push edi
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x405d99
mov dword [ebx], 1
lea ecx, [ebp - 4]
push ecx
add esi, 0x48
push esi
push 0
push 0
push str.ReportCrash
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x405dbb
mov dword [esi], 1
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405dd0
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040bfe0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
mov esi, eax
lea eax, [edi + 0x44]
push eax
push 4
push 0
push str.AutoStart
push esi
call ebx
push 4
add edi, 0x48
push edi
push 4
push 0
push str.ReportCrash
push esi
call ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
ret

Function at 0x407430
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4242a8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push esi
push edi
mov eax, dword [0x42fab0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x74]
call fcn.00406fd0
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], 0
call fcn.0040d120
cmp eax, 1
jne 0x407533
cmp dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x10]
jne 0x407489
mov ecx, 0x425480
cmp dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x24]
jne 0x407497
mov eax, 0x425480
push ecx
push eax
call fcn.00407100
add esp, 8
test eax, eax
je 0x407533
call fcn.00407300
mov esi, eax
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4074bf
lea ecx, [eax - 1]
mov eax, dword [ebp - 0x24]
jmp 0x4074c6
xor ecx, ecx
mov eax, 0x425480
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add ecx, 1
push ecx
push eax
push 1
push 0
push str.Name
push esi
call edi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4074ec
lea ecx, [eax - 1]
mov eax, dword [ebp - 0x10]
jmp 0x4074f3
xor ecx, ecx
mov eax, 0x425480
add ecx, 1
push ecx
push eax
push 1
push 0
push str.Serial
push esi
call edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x24]
jne 0x407519
mov ecx, 0x425480
mov edx, 0x430ec0
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x407520
call fcn.004070e0
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], 0xffffffff
call fcn.00407020
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407880
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
call fcn.00407300
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push str.ExpDate
push esi
mov dword [ebp - 4], 8
call edi
test eax, eax
je 0x4078e2
mov dword [0x430f98], 1
call fcn.00407600
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push str.ExpDate
push esi
mov dword [ebp - 4], 8
call edi
cmp dword [ebp - 4], 8
jne 0x40797b
lea eax, [ebp - 0x10]
push eax
push str.iopjfrp_kiss_ee
call fcn.00411b60
add esp, 8
cmp dword [ebp - 0x10], 1
je 0x40797b
push 0
call fcn.004149ca
add esp, 4
cmp eax, dword [ebp - 0xc]
jb 0x40797b
mov ecx, dword [ebp - 0x10]
cmp eax, ecx
jbe 0x40792d
mov edx, eax
sub edx, ecx
cmp edx, 0x1e13380
ja 0x40792b
mov dword [0x430f94], ecx
cmp eax, ecx
jae 0x40797b
mov edx, ecx
sub edx, eax
cmp edx, 0x278d00
ja 0x40797b
mov dword [0x430f90], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push str.iopjfrp_kiss_ee
mov dword [0x430f94], ecx
call fcn.00411ae0
add esp, 8
push 8
lea ecx, [ebp - 0x10]
push ecx
push 3
push 0
push str.ExpDate
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x407990
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x42fab0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.00407300
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x124]
push edx
push 0
push str.Name
push esi
mov dword [ebp - 0x120], 0xc8
mov byte [ebp - 0x11c], 0
call edi
xor eax, eax
jmp 0x4079f0
mov cl, byte [ebp + eax - 0x11c]
mov byte [eax + 0x430ec0], cl
add eax, 1
test cl, cl
jne 0x4079f0
lea eax, [ebp - 0x120]
push eax
mov byte [ebp - 0x54], cl
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x124]
push edx
push 0
push str.Serial
push esi
mov dword [ebp - 0x120], 0x50
call edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x11c], 0
pop edi
pop esi
jne 0x407a61
cmp byte [ebp - 0x54], 0
jne 0x407a61
call fcn.00407880
test eax, eax
je 0x407a7d
call fcn.004070f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041449d
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call fcn.00407100
add esp, 8
test eax, eax
je 0x407a7d
call fcn.004070e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041449d
mov esp, ebp
pop ebp
ret
Function at 0x409120
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424478
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x42fab0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x40]
push 0x425480
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [esi + 0x9c]
test eax, eax
jl 0x409185
cmp eax, 3
jge 0x409185
shl eax, 5
mov ecx, dword [eax + esi + 0xcc]
mov edx, dword [ecx + 4]
lea eax, [eax + esi + 0xcc]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [ebp + 8]
cmp ebx, 2
ja 0x409318
shl ebx, 5
add ebx, esi
lea eax, [ebx + 0xd0]
push eax
lea ecx, [ebp - 0x20]
call fcn.004073a0
mov eax, dword [ebx + 0xe8]
cmp eax, 0xffffffff
mov dword [ebp - 4], 0
je 0x40925f
jmp 0x4091c0
shl eax, 5
push 0x426064
lea ecx, [ebp - 0x48]
lea edi, [eax + esi]
push ecx
lea ecx, [edi + 0xd0]
call fcn.0040db90
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x34]
push ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040d910
mov ecx, dword [eax + 4]
test ecx, ecx
mov byte [ebp - 4], 2
je 0x40920a
mov edx, dword [eax + 0x10]
add ecx, 0xffffffff
push ecx
push edx
lea ecx, [ebp - 0x20]
call fcn.0040d680
jmp 0x409214
push 0
lea ecx, [ebp - 0x20]
call fcn.004011f0
mov dword [ebp - 0x34], vtable.CArraySimpleObj_char__char_.0
push 0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.00401160
mov dword [ebp - 0x34], vtable.CArrayObjBase_char__char_.0
mov dword [ebp - 0x48], vtable.CArraySimpleObj_char__char_.0
push 0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.00401160
mov eax, dword [edi + 0xe8]
cmp eax, 0xffffffff
mov byte [ebp - 4], 0
mov dword [ebp - 0x48], vtable.CArrayObjBase_char__char_.0
jne 0x4091c0
cmp dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x10]
jne 0x40926d
mov eax, 0x425480
push eax
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [esi + 0x90]
mov edx, dword [esi + 0x98]
mov ecx, dword [esi + 0x8c]
push 1
sub edx, eax
push edx
mov edx, dword [esi + 0x94]
sub edx, ecx
push edx
push eax
mov eax, dword [ebx + 0xcc]
push ecx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov edx, dword [ebx + 0xcc]
mov eax, dword [edx + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebx + 0xcc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebx + 0xe4]
mov ecx, dword [esi + 4]
push eax
push 9
push 0x110b
push 0x44c
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.004013f0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a230
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424590
mov eax, dword fs:[0]
push eax
sub esp, 0x170
mov eax, dword [0x42fab0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov edx, dword [ebx + 4]
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x158]
push ecx
push 0x2003
mov dword [ebp - 0x160], 4
mov eax, dword [edx]
push 0xffff
push eax
mov dword [ebp - 0x154], ebx
call sub.WS2_32.dll_getsockopt
cmp eax, 0xffffffff
jne 0x40a2bd
call sub.WS2_32.dll_WSAGetLastError
movzx ecx, ax
push 0x42a9ac
lea edx, [ebp - 0x164]
shl ecx, 0x10
push edx
mov dword [ebp - 0x164], ecx
call fcn.00414dd0
cmp dword [ebp - 0x158], 0x127
jae 0x40a2ea
push str.SO_MAX_MSG_SIZE_is_too_small
lea ecx, [ebp - 0x17c]
call fcn.00401460
push 0x42a99c
lea eax, [ebp - 0x17c]
push eax
call fcn.00414dd0
push 0x7f000001
mov word [ebp - 0x14c], 2
call sub.WS2_32.dll_htonl
push 0
mov dword [ebp - 0x148], eax
call sub.WS2_32.dll_htons
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, ebx
mov word [ebp - 0x14a], ax
call fcn.0040f740
mov dword [ebp - 0x15c], eax
call fcn.0040bfe0
push 4
lea edx, [ebp - 0x15c]
push edx
push 4
push 0
mov esi, eax
push str.Port
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [esp]
push 0
push 0x127
lea eax, [ebp - 0x13c]
push eax
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.0040f6d0
cmp eax, 8
mov dword [ebp - 4], 0xffffffff
jbe 0x40a350
cmp dword [ebp - 0x13c], 0x6a
jne 0x40a350
cmp eax, dword [ebp - 0x138]
jne 0x40a350
lea eax, [ebp - 0x13c]
push eax
call fcn.0040a560
add esp, 4
test eax, eax
je 0x40a350
mov edi, dword [ebp - 0x138]
call fcn.0040a200
mov esi, eax
test esi, esi
je 0x40a350
mov ecx, dword [ebp - 0x138]
push ecx
lea edx, [ebp - 0x13c]
push edx
push esi
call fcn.00414520
push 0
call fcn.004149ca
add esp, 0x10
push 0x430f9c
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
call dword [0x425214]
push esi
mov ecx, 0x42f4e8
call fcn.0040c0f0
push 0x430f9c
call dword [0x425218]
mov eax, dword [0x430e08]
push 0
push 0
push 0x402
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x40a350
Function at 0x40abd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x42696c
push str.SoftwareProxy_LabsProxyCapRules
push reloc.WS2_32.dll_accept
call fcn.004107a0
add esp, 0xc
test eax, eax
jne 0x40abf5
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
call fcn.0040c020
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 0x42696c
push esi
mov dword [ebp - 4], 4
call edi
push esi
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x40ac5a
call fcn.0040c060
mov esi, eax
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x42696c
push esi
mov dword [ebp - 4], 4
call edi
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x40ac63
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 8], 0
jne 0x40ac6f
cmp dword [ebp - 0xc], 0
je 0x40ac5a
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b300
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4246eb
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x42fab0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0x1a
call fcn.00410fc0
add esp, 0xc
test eax, eax
jne 0x40b364
test esi, esi
je 0x40b35d
push 0x4269c4
mov ecx, esi
call fcn.004012f0
xor eax, eax
jmp 0x40b498
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x128]
call fcn.00401460
lea edx, [ebp - 0x128]
push edx
mov dword [ebp - 4], 0
call fcn.0040ddd0
mov eax, dword [ebp - 0x128]
mov edx, dword [eax + 0x10]
add esp, 4
push 8
push 0x42579c
lea ecx, [ebp - 0x128]
call edx
cmp dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x118]
jne 0x40b3b8
mov eax, 0x425480
push 0
push eax
call dword [0x425200]
mov eax, dword [ebp - 0x128]
mov edx, dword [eax + 0x10]
push 9
push str.user.prs
lea ecx, [ebp - 0x128]
call edx
cmp dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x118]
jne 0x40b3ed
mov eax, 0x425480
push esi
push edi
push eax
call fcn.0040afb0
add esp, 0xc
test eax, eax
jne 0x40b415
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0xffffffff
call fcn.004013f0
xor eax, eax
jmp 0x40b498
call fcn.0040ab90
mov esi, eax
mov eax, dword [ebp - 0x124]
test eax, eax
je 0x40b431
lea ecx, [eax - 1]
mov eax, dword [ebp - 0x118]
jmp 0x40b438
xor ecx, ecx
mov eax, 0x425480
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add ecx, 1
push ecx
push eax
push 1
push 0
push 0x4269b4
push esi
call edi
push 0
call fcn.004149ca
add esp, 4
push 8
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x130]
push eax
push 3
push 0
push str.modified
push esi
mov dword [ebp - 0x12c], edx
call edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0xffffffff
call fcn.004013f0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041449d
mov esp, ebp
pop ebp
ret