joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100092b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100190e0]
test eax, eax
je 0x10009368
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x100092f0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x100092dc
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1000939d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x100190e0], eax
sub esp, 8
test eax, eax
jne 0x100092cd
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x100092de
Function at 0x100093b0
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x10009540
mov eax, dword [esi]
test eax, eax
je 0x10009528
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x1000954c
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x10009518
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0xc]
not eax
pop ebx
pop esi
shr eax, 0x1f
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x100094dc
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x10009416
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x10009542
Function at 0x439fb0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x43a05a
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x43a076
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x43a076
sub dx, 0x20
je 0x43a050
sub dx, 0x80
je 0x43a050
sub dx, 0x1f62
jb 0x43a076
sub dx, 1
jbe 0x43a050
sub dx, 6
je 0x43a050
sub dx, 0x26
jne 0x43a076
nop
jmp 0x43a050
cmp eax, dword [ebp - 0x20]
jg 0x439ff8
lea esi, [esi]
jmp 0x43a076
cmp dword [ebp - 0x1c], 2
jne 0x43a06a
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x43a076
mov al, byte [ebp - 0xc]
call fcn.0040ea10
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x43a0f4
sub ax, 0x21
je 0x43a108
sub ax, 0x17
je 0x43a114
sub ax, 0x222
je 0x43a120
sub ax, 0x392
je 0x43a128
sub ax, 1
je 0x43a130
sub ax, 0x1996
je 0x43a138
sub ax, 1
je 0x43a140
sub ax, 6
je 0x43a148
sub ax, 0xb
je 0x43a158
sub ax, 0x1b
je 0x43a150
sub ax, 0x367
je 0x43a160
jmp 0x43a168
mov ax, word [ebp - 0x24]
call fcn.0040ea80
mov byte [ebp - 0x10], al
jmp 0x43a170
mov byte [ebp - 0x10], 0x20
jmp 0x43a170
mov byte [ebp - 0x10], 0x2e
jmp 0x43a170
mov byte [ebp - 0x10], 0x27
jmp 0x43a170
mov byte [ebp - 0x10], 0x2c
jmp 0x43a170
mov byte [ebp - 0x10], 0x27
jmp 0x43a170
mov byte [ebp - 0x10], 0x20
jmp 0x43a170
mov byte [ebp - 0x10], 0x20
jmp 0x43a170
mov byte [ebp - 0x10], 0x20
jmp 0x43a170
mov byte [ebp - 0x10], 0x20
jmp 0x43a170
mov byte [ebp - 0x10], 0x2d
jmp 0x43a170
mov byte [ebp - 0x10], 0x27
jmp 0x43a170
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov esi, esi
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x450240
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret

Function at 0x915acc
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00915b4b
jae 0x915ad8
xor ecx, ecx
call fcn.00915b4b
jae 0x915b02
xor eax, eax
call fcn.00915b4b
jae 0x915b13
mov al, 0x10
call fcn.00915b4b
adc al, al
jae 0x915af4
jne 0x915b40
stosb byte es:[edi], al
jmp 0x915ad9
call fcn.00915b57
dec ecx
loop 0x915b1f
mov eax, ebp
call fcn.00915b55
jmp 0x915b41
lodsb al, byte [esi]
shr eax, 1
je 0x915b67
adc ecx, 2
mov ebp, eax
jmp 0x915b41
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00915b55
cmp eax, 0x7d00
jae 0x915b3f
cmp eax, 0x500
jae 0x915b40
cmp eax, 0x7f
ja 0x915b41
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x915ad9
pop ebp
ret 8
Function at 0x402eb9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x728
mov eax, dword [0x6a2c70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x724], esi
mov dword [ebp - 0x728], eax
push edi
mov edi, ecx
test esi, esi
jne 0x402eed
xor eax, eax
jmp 0x402fe8
test eax, eax
je 0x402ee6
push esi
push 1
lea eax, [ebp - 0x71d]
push 1
push eax
call fcn.0054eab8
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.0054f520
add esp, 0x1c
add edi, 0x10
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402f20
push ebx
sub ecx, edx
lea eax, [ebp - 0x204]
push ecx
push edi
push eax
call fcn.0054eed0
push 0x100
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x71c]
push eax
call fcn.00403cca
mov ebx, dword [ebp + 0x14]
xor edi, edi
add esp, 0x18
cmp dword [ebp + 0x10], edi
jle 0x402fba
push esi
push 0x10
lea eax, [ebp - 0x604]
push 1
push eax
call fcn.0054eab8
add esp, 0x10
cmp eax, 0x10
jne 0x402fe5
lea eax, [ebp - 0x604]
push eax
push eax
lea eax, [ebp - 0x71c]
push 0
push eax
call fcn.004030bb
mov esi, dword [ebp - 0x728]
add esp, 0x10
xor edx, edx
mov cl, byte [ebp + edx - 0x604]
lea eax, [esi + edx]
add bl, cl
mov byte [eax + edi], cl
inc edx
cmp edx, 0x10
jl 0x402f97
mov esi, dword [ebp - 0x724]
add edi, 0x10
cmp edi, dword [ebp + 0x10]
jl 0x402f5d
push esi
push 1
lea eax, [ebp - 0x71e]
push 1
push eax
call fcn.0054eab8
mov cl, byte [ebp - 0x71d]
add esp, 0x10
cmp cl, byte [ebp - 0x71e]
jne 0x402fe5
cmp cl, bl
jne 0x402fe5
xor eax, eax
inc eax
jmp 0x402fe7
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0054ee82
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403a88
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x6a2c70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
xor esi, esi
inc ebx
push edi
mov dword [ebp - 0x808], ebx
mov edx, ebx
mov edi, 0xff
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movsx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
xor edx, ecx
and edx, edi
inc esi
cmp esi, 0x100
jl 0x403ab0
mov esi, ebx
mov edx, 0x6abae8
mov eax, esi
mov dword [edx], esi
and al, 0x80
movsx ecx, al
neg ecx
sbb ecx, ecx
add esi, esi
and ecx, 0x1b
add edx, 4
xor esi, ecx
and esi, edi
cmp edx, 0x6abb10
jl 0x403ae5
mov byte [0x6a98e8], 0x63
mov byte [0x6aaa4b], 0
mov ecx, dword [ebp + ebx*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
and ecx, edi
mov edx, ecx
xor ebx, ecx
sar edx, 7
lea eax, [ecx + ecx]
or edx, eax
and edx, edi
mov esi, edx
xor ebx, edx
sar esi, 7
lea eax, [edx + edx]
or esi, eax
and esi, edi
mov ecx, esi
sar ecx, 7
lea eax, [esi + esi]
or ecx, eax
mov eax, dword [ebp - 0x808]
xor ecx, 0x63
and ecx, edi
xor ecx, esi
xor ebx, ecx
mov byte [eax + 0x6a98e8], bl
mov byte [ebx + 0x6aa9e8], al
mov ebx, eax
inc ebx
mov dword [ebp - 0x808], ebx
cmp ebx, 0x100
jl 0x403b14
xor esi, esi
movzx edx, byte [esi + 0x6a98e8]
mov eax, edx
and al, 0x80
movsx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
and ecx, edi
mov eax, ecx
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, ecx
movzx ecx, byte [esi + 0x6aa9e8]
mov dword [esi*4 + 0x6a99e8], eax
rol eax, 8
mov dword [esi*4 + 0x6a9de8], eax
rol eax, 8
mov dword [esi*4 + 0x6aa1e8], eax
rol eax, 8
mov dword [esi*4 + 0x6aa5e8], eax
test ecx, ecx
je 0x403c06
mov eax, dword [ebp + ecx*4 - 0x404]
add eax, dword [ebp - 0x3cc]
cdq
idiv edi
mov eax, dword [ebp + edx*4 - 0x804]
mov dword [ebp - 0x808], eax
jmp 0x403c0d
and dword [ebp - 0x808], 0
test ecx, ecx
je 0x403c2a
mov eax, dword [ebp + ecx*4 - 0x404]
add eax, dword [ebp - 0x3e0]
cdq
idiv edi
mov ebx, dword [ebp + edx*4 - 0x804]
jmp 0x403c2c
xor ebx, ebx
test ecx, ecx
je 0x403c49
mov eax, dword [ebp + ecx*4 - 0x404]
add eax, dword [ebp - 0x3d0]
cdq
idiv edi
mov edi, dword [ebp + edx*4 - 0x804]
jmp 0x403c4b
xor edi, edi
test ecx, ecx
je 0x403c6d
mov eax, dword [ebp + ecx*4 - 0x404]
mov ecx, 0xff
add eax, dword [ebp - 0x3d8]
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x403c6f
xor eax, eax
shl eax, 8
xor eax, edi
mov edi, 0xff
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, dword [ebp - 0x808]
mov dword [esi*4 + 0x6aaae8], eax
rol eax, 8
mov dword [esi*4 + 0x6aaee8], eax
rol eax, 8
mov dword [esi*4 + 0x6ab2e8], eax
rol eax, 8
mov dword [esi*4 + 0x6ab6e8], eax
inc esi
cmp esi, 0x100
jl 0x403b88
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054ee82
mov esp, ebp
pop ebp
ret
Function at 0x403cca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x6a2c70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
sub eax, 0x80
je 0x403d0c
sub eax, 0x40
je 0x403d04
sub eax, 0x40
jne 0x403de0
mov dword [edi], 0xe
jmp 0x403d12
mov dword [edi], 0xc
jmp 0x403d12
mov dword [edi], 0xa
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x11c]
push ecx
lea esi, [edi + 8]
push eax
mov dword [edi + 4], esi
call fcn.00403def
mov edx, dword [ebp - 0x11c]
add esp, 0xc
shl edx, 4
add edx, dword [ebp - 0x118]
push 4
pop ecx
mov eax, dword [edx]
add edx, ecx
mov dword [esi], eax
add esi, ecx
mov eax, dword [edx]
add edx, ecx
mov dword [esi], eax
add esi, ecx
mov eax, dword [edx]
add edx, ecx
mov dword [esi], eax
add esi, ecx
mov eax, dword [edx]
sub edx, 0x1c
mov dword [esi], eax
add esi, ecx
mov edi, dword [edi]
dec edi
test edi, edi
jle 0x403dc5
push ebx
mov ebx, ecx
movzx eax, byte [edx + 3]
push 4
movzx ecx, byte [eax + 0x6a98e8]
movzx eax, byte [edx + 2]
mov ecx, dword [ecx*4 + 0x6ab6e8]
movzx eax, byte [eax + 0x6a98e8]
xor ecx, dword [eax*4 + 0x6ab2e8]
movzx eax, byte [edx + 1]
movzx eax, byte [eax + 0x6a98e8]
xor ecx, dword [eax*4 + 0x6aaee8]
movzx eax, byte [edx]
movzx eax, byte [eax + 0x6a98e8]
xor ecx, dword [eax*4 + 0x6aaae8]
mov dword [esi], ecx
pop ecx
add esi, ecx
add edx, ecx
dec ebx
jne 0x403d69
dec edi
sub edx, 0x20
test edi, edi
jg 0x403d67
pop ebx
mov eax, dword [edx]
mov dword [esi], eax
add esi, ecx
add edx, ecx
mov eax, dword [edx]
mov dword [esi], eax
mov eax, dword [edx + ecx]
mov dword [esi + ecx], eax
mov eax, dword [edx + ecx + 4]
mov dword [esi + ecx + 4], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0054ee82
mov esp, ebp
pop ebp
ret
Function at 0x404f9a
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x56fcaf
call fcn.00550a12
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x40], ebx
je 0x4050be
cmp byte [edi + 0x45], bl
je 0x4050be
call fcn.00405da7
mov esi, eax
mov ecx, edi
mov eax, dword [edi]
push esi
call dword [eax + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], esi
push eax
call fcn.00405db6
pop ecx
pop ecx
test al, al
je 0x404feb
xor al, al
jmp 0x4050c0
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.00404412
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00405ada
mov ecx, eax
call fcn.005312a8
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0044670e
add esi, eax
lea ecx, [ebp - 0x28]
push esi
lea eax, [ebp - 0x30]
push eax
call fcn.00405ada
mov ecx, eax
call fcn.005312a8
mov ecx, dword [edi + 0x40]
push eax
lea eax, [edi + 0x48]
push eax
call fcn.00406b03
sub eax, ebx
je 0x40504b
dec eax
je 0x40504e
dec eax
dec eax
jne 0x4050b2
inc eax
jmp 0x4050b0
mov byte [edi + 0x45], bl
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00405ada
mov ecx, eax
call fcn.005312a8
mov esi, dword [ebp - 0x34]
sub esi, eax
je 0x40508e
push dword [edi + 0x50]
lea eax, [ebp - 0x38]
push esi
push 1
push eax
lea ecx, [ebp - 0x28]
call fcn.00405ada
mov ecx, eax
call fcn.005312a8
push eax
call fcn.0054edcf
add esp, 0x10
cmp esi, eax
jne 0x4050ae
cmp byte [edi + 0x45], 0
je 0x4050ac
test esi, esi
jne 0x404ff9
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.00405877
jmp 0x404ff9
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.0040498c
mov al, bl
jmp 0x4050c0
mov al, 1
call fcn.005509c1
ret
Function at 0x4061ee
Capabilities:
Write file on windows

Disassembly:
push 0x38
mov eax, 0x56fdba
call fcn.00550a12
mov ebx, ecx
call fcn.00405da7
mov edi, eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], edi
push eax
call fcn.00405db6
pop ecx
pop ecx
test al, al
je 0x406228
lea eax, [ebp + 8]
push eax
call fcn.00406123
pop ecx
jmp 0x4063b2
mov ecx, ebx
call fcn.004064d0
test eax, eax
je 0x406264
mov ecx, ebx
call fcn.00405dab
mov ecx, ebx
mov esi, eax
call fcn.004064d0
cmp eax, esi
jae 0x406264
mov ecx, ebx
call fcn.00405691
mov esi, eax
lea eax, [ebp + 8]
push eax
call fcn.0040685d
mov byte [esi], al
mov eax, dword [ebp + 8]
pop ecx
jmp 0x4063b2
xor esi, esi
cmp dword [ebx + 0x50], esi
je 0x4063b0
mov ecx, ebx
call fcn.004056a1
lea eax, [ebp + 8]
cmp dword [ebx + 0x40], esi
jne 0x40629e
push dword [ebx + 0x50]
push eax
call fcn.0040685d
pop ecx
movzx eax, al
push eax
call fcn.004040ab
test al, al
pop ecx
cmovne edi, dword [ebp + 8]
pop ecx
jmp 0x4063b0
push eax
call fcn.0040685d
pop ecx
push esi
push 8
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x2c], al
call fcn.00404412
mov dword [ebp - 4], esi
jmp 0x406331
cmp eax, 1
jg 0x406390
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x28]
call fcn.00405ada
mov ecx, eax
call fcn.005312a8
mov esi, dword [ebp - 0x34]
sub esi, eax
je 0x406305
push dword [ebx + 0x50]
lea eax, [ebp - 0x40]
push esi
push 1
push eax
lea ecx, [ebp - 0x28]
call fcn.00405ada
mov ecx, eax
call fcn.005312a8
push eax
call fcn.0054edcf
add esp, 0x10
cmp esi, eax
jne 0x4063a8
lea eax, [ebp - 0x2c]
mov byte [ebx + 0x45], 1
cmp dword [ebp - 0x30], eax
jne 0x40638b
test esi, esi
jne 0x406331
lea ecx, [ebp - 0x28]
call fcn.0044670e
cmp eax, 0x20
jae 0x4063a8
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00405877
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x28]
call fcn.00405ada
mov ecx, eax
call fcn.005312a8
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.0044670e
add esi, eax
lea ecx, [ebp - 0x28]
push esi
lea eax, [ebp - 0x3c]
push eax
call fcn.00405ada
mov ecx, eax
call fcn.005312a8
mov ecx, dword [ebx + 0x40]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2b]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebx + 0x48]
push eax
call fcn.004061e5
test eax, eax
jns 0x4062b8
jmp 0x4063a8
mov edi, dword [ebp + 8]
jmp 0x4063a8
cmp eax, 3
jne 0x4063a8
push dword [ebx + 0x50]
push dword [ebp - 0x2c]
call fcn.004040ab
test al, al
pop ecx
cmovne edi, dword [ebp + 8]
pop ecx
lea ecx, [ebp - 0x28]
call fcn.0040498c
mov eax, edi
call fcn.005509c1
ret 4
Function at 0x40888e
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [0x6ad840], 0x398
mov byte [0x6ad1e9], 1
push esi
push edi
xor edi, edi
mov dword [0x6ad83c], edi
call fcn.004082a1
push str.._Log_Debug.txt
mov dword [0x6ad834], edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
push 0x579ba8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, 0x6d70e8
call fcn.004fafe5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x6f0d6e
push str._s__PID__d_
mov esi, 0x6ad3f8
push esi
call fcn.00550fcb
add esp, 0x10
cmp dword [0x6ad834], edi
je 0x40891c
dec esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x408903
mov ax, word [0x579bb8]
mov word [esi], ax
mov al, byte [0x579bba]
mov byte [esi + 2], al
mov ecx, edi
mov al, byte [ecx + 0x6ad3f8]
mov byte [ecx + 0x6ad5f8], al
inc ecx
test al, al
jne 0x40891e
push dword [ebp + 8]
call fcn.004085cb
mov esi, 0x6d3878
mov dword [esp], str.._Resource_QuestScript_QuestString.bin
mov ecx, esi
call fcn.004d8600
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, esi
call fcn.004d8509
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, esi
call fcn.004d83d5
mov ecx, 0x6bebb0
call fcn.0043416e
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0040831e
pop ecx
pop ecx
test eax, eax
jne 0x408986
call fcn.00408556
xor eax, eax
jmp 0x4089dc
push 1
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4089af
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x408986
call fcn.00408516
mov ecx, eax
call fcn.004b20ba
fld1
mov ecx, 0x6aedac
fsubp st(1)
fstp qword [0x6ad1d0]
call fcn.00409eb3
cmp eax, 0xffffffff
jne 0x408986
call fcn.00408556
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x409489
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x6a2c70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x108]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push 0xf023f
push 0
push eax
push 0x80000002
mov dword [ebp - 0x10c], 0xff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp + 0x10]
push eax
push 0
push esi
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
lea ecx, [ebp - 0x104]
mov edx, 0x5796cc
cmovne ecx, edx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0054ee82
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40950b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf023f
push 0
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp + 0x14]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40952e
sub ecx, edx
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41813b
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x6a2c70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4182f4
cmp byte [edi], 0
je 0x4182f4
lea eax, [ebp - 0x118]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [ebp - 0x118], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4182f4
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], ebx
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ecx, dword [ebp - 0x11c]
test eax, eax
push 0x64
pop edx
cmovne ecx, edx
mov eax, ebx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x128], eax
test ecx, ecx
je 0x4182e4
push esi
push eax
push str._04u
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push 5
push eax
mov byte [ebp - 8], bl
call fcn.0041a451
add esp, 0x10
mov dword [ebp - 0x114], ebx
lea eax, [ebp - 0x114]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4182c2
lea eax, [ebp - 0x120]
mov dword [ebp - 0x124], ebx
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x120], 0x104
push eax
lea eax, [ebp - 0x124]
push eax
push ebx
push str.NetCfgInstanceId
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x418267
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4182c2
push edi
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x418259
lea eax, [ebp - 0x120]
mov dword [ebp - 0x12c], ebx
push eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x120], 4
push eax
lea eax, [ebp - 0x124]
push eax
push ebx
push str.Characteristics
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x114]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4182dd
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp eax, dword [ebp - 0x11c]
jb 0x4181d9
jmp 0x4182e3
mov ebx, dword [ebp - 0x12c]
pop esi
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x4182f6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0054ee82
mov esp, ebp
pop ebp
ret 4