joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e870
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0xc]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x40e88e
mov eax, dword [esi + 0x10]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 4], ecx
mov eax, dword [esp + 8]
test eax, eax
je 0x40e8a6
push eax
mov ecx, esi
call fcn.00407200
test al, al
jne 0x40e8a6
pop esi
ret 4
mov al, 1
pop esi
ret 4

Function at 0x40f1d0
Capabilities:
Check os version
Get common file path
Get geographical location
Get system information on windows

Disassembly:
mov ecx, dword [0x4e23f4]
mov eax, dword fs:[0x2c]
push esi
mov esi, dword [eax + ecx*4]
cmp dword [esi + 8], 0
jne 0x40f226
push 0x2e8
call fcn.004206fc
add esp, 4
test eax, eax
je 0x40f21e
push 0x1000
push 0x444e4746
push str.Foreground
push 0
mov ecx, eax
call fcn.00405500
mov dword [esi + 8], eax
pop esi
jmp fcn.0040de40
xor eax, eax
mov dword [esi + 8], eax
pop esi
jmp fcn.0040de40

Function at 0x40fb90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x228
mov eax, dword [0x45e068]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0x22c]
lea ecx, [esp + 0x14]
push ebx
mov dword [esp + 0x14], ecx
xor ecx, ecx
push 0x45b4e0
mov word [esp + 0x1c], cx
lea ecx, [esp + 8]
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], pe_nt_image_headers32
call fcn.00413850
test al, al
je 0x40fc05
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40fc05
test al, 1
je 0x40fc05
mov bl, 1
jmp 0x40fc07
xor bl, bl
lea ecx, [esp + 4]
call fcn.0040bea0
mov ecx, dword [esp + 0x228]
mov al, bl
pop ebx
xor ecx, esp
call fcn.00420bdf
add esp, 0x228
ret

Function at 0x40fd80
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x45e068]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.00423110
add esp, 0xc
mov dword [esp], 0x114
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
jb 0x40fdde
cmp dword [esp + 8], 2
jb 0x40fdde
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00420bdf
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor al, al
xor ecx, esp
call fcn.00420bdf
add esp, 0x118
ret
Function at 0x410dc0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
xorps xmm0, xmm0
push ebx
movups xmmword [esp + 4], xmm0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
push esi
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x18], 0
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
push 0
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
sete bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x410e40
cmp eax, 0x3e5
jne 0x410e40
push 0xffffffffffffffff
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
test bl, bl
jne 0x410e52
pop esi
xor al, al
pop ebx
add esp, 0x14
ret 0x14
test bl, bl
jne 0x410e36
test eax, eax
jne 0x410e36
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov eax, dword [esp + 8]
test eax, eax
je 0x410e65
cmp eax, 0x103
je 0x410e65
test ecx, ecx
je 0x410e36
pop esi
mov al, 1
pop ebx
add esp, 0x14
ret 0x14

Function at 0x411490
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, ecx
mov dword [esp + 8], 0
push edi
mov dword [esp + 0x10], 0
mov eax, dword [esi + 0xc]
mov edx, dword [esi]
or eax, 0x20019
mov edi, dword [esi + 4]
cmp edx, 0x80000004
je 0x4114f6
cmp edx, 0x80000050
je 0x4114f6
lea ecx, [esp + 0xc]
push ecx
push eax
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4114f0
push 0
push edi
push eax
mov ecx, ebx
call fcn.00414ca0
test al, al
jne 0x4114f0
xor bl, bl
jmp 0x411538
mov edx, dword [esp + 0xc]
jmp 0x4114fa
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x28]
push eax
push 0
push dword [esp + 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x411536
push 0
push dword [esi + 4]
mov ecx, ebx
push eax
call fcn.00414ca0
test al, al
jne 0x411536
xor bl, bl
jmp 0x411538
mov bl, 1
mov eax, dword [esp + 0xc]
test eax, eax
je 0x411547
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
add esp, 8
ret 0x10
Function at 0x411780
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x20
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0x284]
lea ecx, [ebp + 0x284]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41189d
push 0
push dword [ebp + 0x288]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 4], eax
test eax, eax
je 0x41189d
push ebx
push esi
push edi
xor esi, esi
mov dword [esp + 0x18], 0
mov ebx, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov edi, 0x441510
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], esi
test ebx, ebx
je 0x411816
push esi
push eax
lea ecx, [esp + 0x24]
call fcn.00410850
mov esi, eax
mov dword [esp + 0x2c], esi
test esi, esi
je 0x41186a
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], ebx
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], ebx
push ecx
push eax
push esi
push dword [ebp + 0x288]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x411835
mov byte [esi], al
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
inc eax
push eax
call fcn.00412c30
test eax, eax
je 0x411874
mov ecx, dword [esp + 0x10]
push ecx
push esi
inc ecx
push ecx
push eax
call fcn.0040bf10
mov edi, dword [esp + 0x24]
lea ecx, [ebp + 0x34]
add esp, 0x10
push edi
call fcn.00406e50
mov bl, al
jmp 0x41187a
mov dword [esp + 0x28], 0
jmp 0x411878
mov edi, dword [esp + 0x14]
xor bl, bl
lea ecx, [esp + 0x1c]
call fcn.0040bea0
cmp dword [esp + 0x18], 0
je 0x411893
push edi
call fcn.00426f61
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
add esp, 0x20
ret
mov al, 1
pop ebp
add esp, 0x20
ret
Function at 0x412740
Capabilities:
Delete file
Set file attributes

Disassembly:
sub esp, 0x228
mov eax, dword [0x45e068]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
mov ebx, dword [esp + 0x234]
push esi
mov esi, dword [esp + 0x234]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x41282a
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 3
je 0x412795
sub eax, 2
je 0x412813
sub eax, 0xc9
jne 0x41284d
lea eax, [esp + 0x20]
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0xc]
push ebx
xor eax, eax
mov dword [esp + 0x14], 0
push esi
mov dword [esp + 0x1c], 2
mov dword [esp + 0x20], pe_nt_image_headers32
mov word [esp + 0x28], ax
call fcn.00413850
test al, al
je 0x412844
push 0x80
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x412844
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x412844
lea ecx, [esp + 0xc]
call fcn.0040bea0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00420bdf
add esp, 0x228
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x41284d
push esi
call edi
test eax, eax
je 0x41284d
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00420bdf
add esp, 0x228
ret
lea ecx, [esp + 0xc]
call fcn.0040bea0
test esi, esi
mov edi, str.Function
cmovne edi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x412888
mov eax, dword [ebx]
push edi
push str.Error_in___s_
push ebx
call dword [eax + 0x20]
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00420bdf
add esp, 0x228
ret
push 0
push edi
push eax
mov ecx, ebx
call fcn.00414ca0
mov ecx, dword [esp + 0x230]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00420bdf
add esp, 0x228
ret
Function at 0x414350
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x194
mov eax, dword [0x45e068]
xor eax, esp
mov dword [esp + 0x190], eax
push ebp
mov ebp, dword [esp + 0x1ac]
push esi
mov esi, dword [esp + 0x1a0]
push edi
mov edi, dword [esp + 0x1b0]
call fcn.0041b500
test al, al
je 0x4143fc
test esi, esi
jne 0x414395
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
test esi, esi
je 0x4143b4
test edi, edi
je 0x41439f
cmp word [edi], 0
jne 0x4143b4
push 0xc8
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edi, [esp + 0xc]
push ebx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esp + 0x1ac]
mov ebx, eax
or ecx, 0x10000
push ecx
push edi
push ebp
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
test ebx, ebx
je 0x4143e1
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00420bdf
add esp, 0x194
ret
mov eax, dword [esp + 0x1ac]
test eax, eax
jne 0x41443f
mov ecx, dword [esp + 0x1a8]
and ecx, 0xf
cmp ecx, 4
je 0x41443a
cmp ecx, 3
je 0x41443a
cmp ecx, 5
pop edi
sete al
pop esi
inc eax
pop ebp
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00420bdf
add esp, 0x194
ret
mov eax, 6
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00420bdf
add esp, 0x194
ret

Function at 0x414d80
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x1bc]
lea ecx, [esi + 0x1bc]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x414da6
push 0
push dword [esi + 0x1c0]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
ret
Function at 0x415230
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
mov edx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [esp + 0x10], edi
cmp ebp, 0xffffffff
jne 0x415252
xor ebx, ebx
jmp 0x41526b
call edx
mov edx, dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ebx, [eax + ebp]
cmp ebx, eax
jae 0x41526b
mov edi, eax
mov ebx, ebp
neg edi
mov dword [esp + 0x10], edi
mov ecx, dword [0x4e23f4]
mov eax, dword fs:[0x2c]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x14], eax
nop
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x5c]
cmp dword [eax], 0
je 0x41534d
cmp ebp, 0xffffffff
jne 0x41529e
mov edi, 0x7d0
jmp 0x4152d0
call edx
add eax, edi
cmp eax, ebx
jae 0x4152b6
mov ecx, ebx
mov edi, 0x1f4
sub ecx, eax
cmp ecx, edi
cmovb edi, ecx
jmp 0x4152d0
mov eax, dword [vtable.ErrorClass.0]
mov ecx, 0x45b4e0
push str.Command_time_out
xor edi, edi
mov eax, dword [eax + 4]
call eax
test al, al
je 0x41534d
cmp dword [esi + 0x294], 0xffffffff
je 0x41534d
mov ecx, esi
call fcn.00411780
test al, al
je 0x41534d
push edi
push dword [esi + 0x294]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push dword [esi + 0x294]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x415312
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x264], ecx
test edi, edi
je 0x415341
cmp edi, 0xffffffff
je 0x415373
cmp edi, 0x80
je 0x415373
cmp dword [esi + 0x264], 0x103
mov edi, dword [esp + 0x10]
mov edx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [esp + 0x14]
je 0x415280
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 4
lea eax, [esp + 0x1c]
push eax
push dword [esi + 0x294]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x41536c
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x264], eax
mov ecx, esi
call fcn.0040a730
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 4
Function at 0x415560
Capabilities:
Get disk size
Get file size
Write file on windows

Disassembly:
sub esp, 0x258
mov eax, dword [0x45e068]
xor eax, esp
mov dword [esp + 0x254], eax
push ebx
mov ebx, dword [esp + 0x264]
lea eax, [esp + 0x48]
push ebp
push esi
push edi
mov edi, dword [esp + 0x26c]
lea ecx, [esp + 0x40]
mov dword [esp + 0x50], eax
xor eax, eax
push edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], vtable.RawDiskFileClass.0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 2
mov dword [esp + 0x50], pe_nt_image_headers32
mov word [esp + 0x58], ax
call fcn.004134f0
push 0
push 0
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x60]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x4156ed
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x10]
mov ebp, dword [esp + 0x24]
imul ebp, dword [esp + 0x28]
push 0
mov eax, dword [eax + 0x30]
push 3
push 3
push 0xc0000000
push edi
call eax
test al, al
je 0x4156ed
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, 0xffffffff
jne 0x415656
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x415652
xorps xmm0, xmm0
movlpd qword [esp + 0x1c], xmm0
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
lea ecx, [esp + 0x2c]
push 1
push ebp
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
call fcn.00408ce0
test al, al
je 0x4156e0
mov eax, esi
or eax, ebx
je 0x4156c9
test ebx, ebx
jl 0x4156a6
jg 0x4156a2
cmp esi, ebp
jbe 0x4156a6
mov edi, ebp
jmp 0x4156a8
mov edi, esi
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push dword [esp + 0x48]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, edi
mov eax, esi
sbb ebx, 0
or eax, ebx
jne 0x415698
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea ecx, [esp + 0x2c]
call fcn.0040bea0
mov bl, 1
jmp 0x41571f
lea ecx, [esp + 0x2c]
call fcn.0040bea0
mov ebx, dword [esp + 0x18]
test edi, edi
mov esi, str.Function
cmovne esi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x415712
mov eax, dword [ebx]
push esi
push str.Error_in___s_
push ebx
call dword [eax + 0x20]
add esp, 0xc
jmp 0x41571d
push 0
push esi
push eax
mov ecx, ebx
call fcn.00414ca0
mov bl, al
lea ecx, [esp + 0x40]
call fcn.0040bea0
and dword [esp + 0x40], 0xfffffffc
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x10], vtable.HandleClass.0
call fcn.0040fd40
test al, al
je 0x415767
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x10]
call dword [eax + 0x1c]
mov ecx, dword [esp + 0x264]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00420bdf
add esp, 0x258
ret
Function at 0x416480
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov edx, dword [ecx + 0xc]
mov eax, dword [ecx]
or edx, 0x20006
mov dword [esp], 0
mov dword [esp + 4], 0
push ebx
push esi
mov esi, dword [ecx + 4]
cmp eax, 0x80000004
je 0x4164d7
cmp eax, 0x80000050
je 0x4164d7
lea ecx, [esp + 8]
push ecx
push edx
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4164db
mov ecx, dword [esp + 0x20]
push 0
push esi
push eax
call fcn.00414ca0
test al, al
je 0x41650d
jmp 0x4164db
mov dword [esp + 8], eax
push dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
push dword [esp + 0x1c]
push dword [esp + 0x2c]
push 0
push esi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x416511
mov ecx, dword [esp + 0x20]
push 0
push esi
push eax
call fcn.00414ca0
test al, al
jne 0x416511
xor bl, bl
jmp 0x416513
mov bl, 1
mov eax, dword [esp + 8]
test eax, eax
je 0x416522
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
add esp, 8
ret 0x14
Function at 0x416860
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
push edi
mov edx, dword [ebx + 0x20]
mov ebp, ecx
cmp edx, 1
je 0x416997
cmp edx, 2
je 0x416997
cmp edx, 7
jne 0x416979
mov edx, dword [ebx + 0x28]
xor esi, esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
test edx, edx
je 0x416918
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4168c0
sub ecx, edi
sar ecx, 1
lea edi, [ecx*2 + 2]
test edi, edi
je 0x41691a
push 0
push edi
lea ecx, [esp + 0x18]
call fcn.00410850
mov esi, eax
mov dword [esp + 0x20], esi
test esi, esi
je 0x4168f9
mov edx, dword [ebx + 0x28]
mov dword [esp + 0x1c], edi
jmp 0x41691a
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
xor bl, bl
call fcn.0040bea0
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x14
ret 0xc
xor edi, edi
push edi
push edx
push esi
mov dword [esp + 0x20], edi
call fcn.00422b90
movzx eax, word [esi]
add esp, 0xc
mov ecx, esi
test ax, ax
je 0x41694e
mov edx, eax
cmp dx, 0xa
jne 0x416940
xor eax, eax
mov word [ecx], ax
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x416935
push dword [esp + 0x30]
mov ecx, ebp
push edi
push esi
push dword [ebx + 0x20]
push dword [esp + 0x38]
call fcn.00416440
lea ecx, [esp + 0x10]
mov bl, al
call fcn.0040bea0
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x14
ret 0xc
push dword [esp + 0x30]
push dword [ebx + 0x1c]
push dword [ebx + 0x28]
push edx
push dword [esp + 0x38]
call fcn.00416440
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
mov esi, dword [ebx + 0x28]
test esi, esi
je 0x4169bb
mov ecx, esi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4169a3
sub ecx, edi
sar ecx, 1
lea ecx, [ecx*2 + 2]
jmp 0x4169bd
xor ecx, ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edx
push 0
push esi
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4169ef
mov ecx, dword [esp + 0x30]
push 0
push esi
push eax
call fcn.00414ca0
test al, al
jne 0x4169ef
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x14
ret 0xc

Function at 0x416d70
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov edi, ecx
push 0
lea esi, [edi + 0x80050]
push esi
call fcn.0040f8f0
add esp, 8
test eax, eax
je 0x416dba
cmp dword [edi + 0x8000c], 0
je 0x416daf
push 0
push esi
call fcn.0040f8f0
push eax
push 0x449068
push 0
push 0xffffffffffffffff
push edi
call fcn.00417390
add esp, 0x1c
jmp 0x416dba
push str.Messages_missed__likely_during_startup._r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [edi + 0x8003c]
call fcn.00405f20
lea ecx, [edi + 0x80020]
call fcn.00405cf0
lea ecx, [edi + 0x80008]
call fcn.00416df0
lea ecx, [edi + 0x80008]
call fcn.00408250
mov ecx, edi
pop edi
pop esi
jmp fcn.00405640
Function at 0x4181f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov ebx, ecx
mov ecx, 0x4e04e0
push edi
mov dword [esp + 0x18], ebx
call fcn.0040abd0
cmp dword [0x4e04f4], 0
mov byte [esp + 0x13], al
jne 0x41823c
push dword [0x45dc20]
mov ecx, 0x4e04e8
call fcn.00417e80
test al, al
jne 0x418238
push dword [0x45dc24]
mov ecx, 0x4e04e8
call fcn.00417e80
mov al, byte [esp + 0x13]
test al, al
je 0x41824a
mov ecx, 0x4e04e0
call fcn.0040fe80
mov eax, dword [ebx + 0x14]
mov ebp, dword [0x4e04f4]
shr eax, 9
and eax, 0xffffff01
mov dword [esp + 0x14], eax
test ebp, ebp
je 0x418425
test al, al
je 0x418372
mov ebx, dword [ebx + 0x28]
mov edi, dword [ebp + 0x28]
test ebx, ebx
je 0x41840c
test edi, edi
je 0x41840c
test edi, edi
je 0x4182ff
mov eax, dword [edi + 0x18]
cmp eax, dword [ebx + 0x18]
jne 0x418412
mov eax, dword [edi + 0x1c]
cmp eax, dword [ebx + 0x1c]
jne 0x418412
mov eax, dword [edi + 0x20]
cmp eax, dword [ebx + 0x20]
jne 0x418412
lea edx, [ebx + 0x28]
mov esi, 0xc
lea ecx, [edi + 0x28]
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x418412
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4182c0
lea eax, [ebx + 0x38]
mov esi, 0xc
lea edx, [edi + 0x38]
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x418412
add edx, 4
add eax, 4
sub esi, 4
jae 0x4182e0
mov ebx, dword [ebx + 4]
mov edi, dword [edi + 4]
test ebx, ebx
jne 0x418285
mov ebx, dword [esp + 0x18]
mov eax, dword [ebp + 0x64]
mov ecx, ebp
mov dword [ebx + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [ebx + 0x68], eax
call fcn.0040c9b0
mov dword [ebx + 0x88], eax
mov ecx, ebx
mov eax, dword [ebx]
push dword [ebp + 0x18]
call dword [eax + 0x10]
push dword [ebp + 0x70]
lea ecx, [ebx + 0x70]
call fcn.004131f0
push 0
lea ecx, [ebx + 0x78]
call fcn.004078d0
push 0
lea ecx, [ebx + 0x80]
call fcn.004078d0
cmp byte [esp + 0x14], 0
jne 0x418368
push 1
lea ecx, [ebx + 0x1c]
call fcn.004086b0
mov edx, dword [ebx + 0x1c]
lea eax, [ebp + 0x1c]
push 1
push eax
lea ecx, [ebx + 0x1c]
call dword [edx + 4]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret
mov eax, dword [ebx + 0x70]
cmp word [eax], 0
je 0x4183f6
push dword [ebp + 0x70]
push eax
call fcn.0040f990
add esp, 8
test al, al
je 0x418416
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebx + 0x1c]
call fcn.00417c90
test al, al
jne 0x418303
mov eax, dword [ebp + 0x34]
cmp eax, dword [ebx + 0x34]
jne 0x418416
mov eax, dword [ebp + 0x3c]
cmp eax, dword [ebx + 0x3c]
jne 0x418416
lea edx, [ebx + 0x44]
mov esi, 0xc
lea ecx, [ebp + 0x44]
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x418416
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4183c0
lea edx, [ebx + 0x54]
mov esi, 0xc
lea ecx, [ebp + 0x54]
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x418416
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4183e0
jmp 0x418303
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebx + 0x1c]
call fcn.00417c90
test al, al
jne 0x418303
jmp 0x418416
mov ebx, dword [esp + 0x18]
jmp 0x41841a
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ebp, dword [ebp + 4]
test ebp, ebp
jne 0x418267
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret