joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401340
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x15c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x16c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x188
push esi
call edi
lea ecx, [esp + 0x6c]
push ecx
push eax
push 0x189
push esi
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.local.dll_Ordinal_2
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0x50
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x78]
push 0
push eax
push ecx
call ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4013da
push 0
lea edx, [esp + 0x20]
push 0x4150cc
push edx
jmp 0x401422
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push Ordinal_2
call edi
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x78]
push 0
push edx
push eax
call ebx
push 0
lea ecx, [esp + 0x20]
push 0x4150cc
push ecx
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esp + 0x10]
push edx
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x15c
ret

Function at 0x401440
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
push 4
call fcn.0040a1df
mov esi, dword [esp + 0x11c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 4
push 0
push 0
push 0x188
push esi
call edi
lea ecx, [esp + 0x14]
push ecx
push eax
push 0x189
push esi
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x10]
push edx
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.local.dll_Ordinal_2
call ebx
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [esp + 0x14]
push eax
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push Ordinal_2
call ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 0x184
push esi
call edi
push 1
push Ordinal_2
push esi
call fcn.00401200
push 2
push reloc.local.dll_Ordinal_2
push esi
call fcn.00401200
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x401520
Capabilities:
Delete registry key

Disassembly:
push ecx
push esi
push 4
call fcn.0040a1df
add esp, 4
lea eax, [esp + 4]
push eax
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServices
push reloc.local.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.MYPORTEnum
push ecx
call esi
mov edx, dword [esp + 4]
push str.MYPORTSecurity
push edx
call esi
mov eax, dword [esp + 4]
push str.MYPORT
push eax
call esi
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ecx
ret

Function at 0x401590
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
push 0
call esi
cdq
sub eax, edx
push 1
sar eax, 1
mov dword [0x418e9c], eax
call esi
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x64
mov esi, dword [esp + 0x1bc]
push 0x418f28
cdq
sub eax, edx
push 0x67
sar eax, 1
push esi
mov dword [0x418e98], eax
call edi
push 0x64
push 0x418ec4
push 0x6d
push esi
call edi
push esi
call fcn.004016b0
add esp, 4
lea eax, [esp + 0x24]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x1c4]
push ecx
push esi
call fcn.00401740
add esp, 8
test eax, eax
jne 0x401618
pop edi
pop esi
add esp, 0x1ac
ret 0x10
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov esi, eax
call fcn.004081b0
cmp eax, 0x62
mov dword [0x418e8c], eax
jne 0x40163c
push 1
call fcn.004081f0
add esp, 4
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
lea edx, [esp + 0x10]
push 0
push edx
call edi
test eax, eax
je 0x401697
push ebx
mov ebx, dword [sym.imp.USER32.dll_TranslateAcceleratorA]
push ebp
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
push esi
push ecx
call ebx
test eax, eax
jne 0x401684
lea edx, [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
lea ecx, [esp + 0x18]
push 0
push ecx
call edi
test eax, eax
jne 0x401661
pop ebp
pop ebx
mov eax, dword [esp + 0x10]
pop edi
pop esi
add esp, 0x1ac
ret 0x10
Function at 0x405870
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
push edi
push 8
call fcn.0040a1df
add esp, 4
mov edi, eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 3
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push Ordinal_2
mov dword [esp + 0x20], 8
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edi
push edx
push 0
push str.Nodrives
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405983
mov al, byte [edi]
test al, al
jne 0x4058f1
mov cl, byte [edi + 1]
test cl, cl
jne 0x4058f1
mov cl, byte [edi + 2]
test cl, cl
jne 0x4058f1
mov cl, byte [edi + 3]
test cl, cl
je 0x405983
xor ecx, ecx
xor edx, edx
mov cl, byte [edi + 3]
mov dl, byte [edi + 2]
mov esi, ecx
xor ecx, ecx
mov cl, byte [edi + 1]
and eax, 0xff
shl esi, 8
add esi, edx
shl esi, 8
add esi, ecx
shl esi, 8
add esi, eax
cmp esi, 1
jne 0x40592b
push 0
call fcn.00405ab0
add esp, 4
pop edi
pop esi
add esp, 0x10
ret
jle 0x405983
push esi
call fcn.004061d0
add esp, 4
test eax, eax
jne 0x405955
push eax
call fcn.00405ab0
push esi
call fcn.004061b0
push eax
mov dword [esp + 0x14], eax
call fcn.00405ab0
add esp, 0xc
jmp 0x405968
push esi
call fcn.004061b0
push eax
mov dword [esp + 0x10], eax
call fcn.00405ab0
add esp, 8
fld qword [0x4132b0]
fild dword [esp + 8]
call fcn.0040a2c0
call fcn.0040a290
sub esi, eax
cmp esi, 1
jg 0x40592d
pop edi
pop esi
add esp, 0x10
ret

Function at 0x405990
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
push edi
push 8
call fcn.0040a1df
add esp, 4
mov edi, eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 3
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push Ordinal_2
mov dword [esp + 0x20], 8
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edi
push edx
push 0
push str.NoViewondrive
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405aa3
mov al, byte [edi]
test al, al
jne 0x405a11
mov cl, byte [edi + 1]
test cl, cl
jne 0x405a11
mov cl, byte [edi + 2]
test cl, cl
jne 0x405a11
mov cl, byte [edi + 3]
test cl, cl
je 0x405aa3
xor ecx, ecx
xor edx, edx
mov cl, byte [edi + 3]
mov dl, byte [edi + 2]
mov esi, ecx
xor ecx, ecx
mov cl, byte [edi + 1]
and eax, 0xff
shl esi, 8
add esi, edx
shl esi, 8
add esi, ecx
shl esi, 8
add esi, eax
cmp esi, 1
jne 0x405a4b
push 0
call fcn.00405e30
add esp, 4
pop edi
pop esi
add esp, 0x10
ret
jle 0x405aa3
push esi
call fcn.004061d0
add esp, 4
test eax, eax
jne 0x405a75
push eax
call fcn.00405e30
push esi
call fcn.004061b0
push eax
mov dword [esp + 0x14], eax
call fcn.00405e30
add esp, 0xc
jmp 0x405a88
push esi
call fcn.004061b0
push eax
mov dword [esp + 0x10], eax
call fcn.00405e30
add esp, 8
fld qword [0x4132b0]
fild dword [esp + 8]
call fcn.0040a2c0
call fcn.0040a290
sub esi, eax
cmp esi, 1
jg 0x405a4d
pop edi
pop esi
add esp, 0x10
ret
Function at 0x407810
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x5c
push esi
push 0x50
call fcn.0040a1df
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
mov dword [esp + 8], 1
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionSetup
push reloc.local.dll_Ordinal_2
mov dword [esp + 0x18], 0x50
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push esi
push edx
push 0
push str.SourcePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40789d
push esi
lea ecx, [esp + 0x14]
push 0x415614
push ecx
call fcn.0040a1ed
mov eax, dword [0x418ebc]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0x41c
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop esi
add esp, 0x5c
ret
Function at 0x407b60
Capabilities:
Get graphical window text
Set registry value

Disassembly:
sub esp, 0x54
push 0x50
call fcn.0040a1df
add esp, 4
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionSetup
push reloc.local.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [0x418ebc]
lea ecx, [esp + 4]
push 0x50
push ecx
push 0x41c
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp]
lea eax, [esp + 4]
push 0x50
push eax
push 1
push 0
push str.SourcePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 0x54
ret

Function at 0x407c10
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
sub esp, 0x5c
push esi
push 0x50
call fcn.0040a1df
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
mov dword [esp + 8], 1
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.local.dll_Ordinal_2
mov dword [esp + 0x18], 0x50
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push esi
push edx
push 0
push str.Identifier
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407c9d
push esi
lea ecx, [esp + 0x14]
push 0x415614
push ecx
call fcn.0040a1ed
mov eax, dword [0x418ebc]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0x421
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop esi
add esp, 0x5c
ret

Function at 0x407cb0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x58
mov eax, dword [0x418f8c]
push esi
mov esi, dword [esp + 0x60]
push 0x89
push eax
mov dword [esp + 0xc], 0x58
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 7
mov dword [esp + 0x1c], 0x7d0
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0x1c]
push 0x58
push ecx
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [esp + 0x64]
lea edx, [esp + 4]
push edx
push eax
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
pop esi
add esp, 0x58
ret
Function at 0x407d20
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x415c00]
xor ecx, ecx
lea edx, [esp + 0x10]
mov dword [esp + 8], ecx
push 0x104
push edx
push ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x50
call fcn.0040a1df
add esp, 4
lea eax, [esp]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.local.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x114]
push 0x50
test eax, eax
je 0x407d9c
mov edx, dword [esp + 4]
lea ecx, [esp + 0x14]
push ecx
push 1
push 0
push str.windows
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
push 1
jmp 0x407db9
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push 1
push 0
push str.windows
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
push 0
mov eax, dword [0x418eb8]
push 0xf1
push 0x42f
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0x110
ret
Function at 0x407de0
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x200
lea eax, [esp + 0x100]
push ebx
push esi
push edi
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str._syschg.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x210]
mov ecx, ebx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
jne 0x407ea1
lea eax, [esp + 0x10c]
lea ecx, [esp + 0xc]
push eax
push 0xff
push ecx
push 0
push 0x41572c
push str.boot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x407f79
mov esi, 0x4151ac
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x407f61
test cl, cl
je 0x407e9a
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x407f61
add eax, 2
add esi, 2
test cl, cl
jne 0x407e6e
xor eax, eax
jmp 0x407f66
cmp eax, 2
jne 0x407f03
lea eax, [esp + 0x10c]
lea ecx, [esp + 0xc]
push eax
push 0xff
push ecx
push 0
push str.hidetask
push str.ICON
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x407f79
mov esi, 0x4151ac
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x407f61
test cl, cl
je 0x407eff
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x407f61
add eax, 2
add esi, 2
test cl, cl
jne 0x407edb
xor eax, eax
jmp 0x407f66
cmp eax, 3
jne 0x407f79
lea eax, [esp + 0x10c]
lea ecx, [esp + 0xc]
push eax
push 0xff
push ecx
push 0
push str.pass
push str.boot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x407f79
mov esi, 0x4151ac
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x407f61
test cl, cl
je 0x407f5d
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x407f61
add eax, 2
add esi, 2
test cl, cl
jne 0x407f39
xor eax, eax
jmp 0x407f66
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x407f79
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x200
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x200
ret

Function at 0x407f90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
push 0x50
call fcn.0040a1df
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
mov dword [esp + 8], 1
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.local.dll_Ordinal_2
mov dword [esp + 0x18], 0x50
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push esi
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
not eax
and eax, esi
pop esi
add esp, 0xc
ret
Function at 0x408000
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
push 0x50
call fcn.0040a1df
mov ecx, dword [esp + 0x18]
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push Ordinal_2
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0x50
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, esi
je 0x408064
mov eax, str.Microsoft_Internet_Explorer
pop esi
add esp, 0xc
ret

Function at 0x408070
Capabilities:
Set registry value

Disassembly:
push ecx
push 0x50
call fcn.0040a1df
mov ecx, dword [esp + 0xc]
add esp, 4
lea eax, [esp]
push eax
push 0x20006
push 0
push ecx
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp]
push 0x50
push edx
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop ecx
ret

Function at 0x4080c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
push 0x50
call fcn.0040a1df
mov ecx, dword [esp + 0x18]
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push Ordinal_2
mov dword [esp + 0x1c], 4
mov dword [esp + 0x18], 0x50
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x408120
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
push edi
push 4
call fcn.0040a1df
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
cmp eax, 1
jne 0x40813d
mov byte [esi], 1
jmp 0x40814c
mov byte [esi], 0
mov byte [esi + 1], 0
mov byte [esi + 2], 0
mov byte [esi + 3], 0
mov edi, dword [esp + 0x10]
lea eax, [esp + 8]
push eax
push 0x20006
push 0
push edi
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x408189
lea ecx, [esp + 8]
push 0
push ecx
push 0
push 4
push 0
push 0
push 0
push edi
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 8]
push 4
push esi
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ecx
ret
Function at 0x408230
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x1c
call fcn.004081b0
cmp eax, 0x7d0
jne 0x40829d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp]
push ecx
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [esp + 4]
mov dword [esp + 0xc], 1
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
lea edx, [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 8]
push 0
push edx
push 0
push eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x1c
ret
Function at 0x408aa0
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push 0
push 0x1042
push 0x2710
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0x12
ja case.default.0x408aca
jmp dword [eax*4 + 0x408cac]
mov eax, dword [0x418f8c]
push 0
push 0x401f50
push esi
push 0x67
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop esi
ret
push str.ProceModul.dll
call fcn.00407bd0
add esp, 4
pop esi
ret
push 0x40
push 0x4151ec
push 0x415db8
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
ret
mov ecx, dword [0x418f8c]
push 0
push 0x403990
push esi
push 0x91
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop esi
ret
push str.ViewIP.dll
call fcn.00407bd0
add esp, 4
pop esi
ret
push str.Testcpu.dll
call fcn.00407bd0
add esp, 4
pop esi
ret
mov edx, dword [0x418f8c]
push 0
push 0x403b40
push esi
push 0x9a
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop esi
ret
mov eax, dword [0x418f8c]
push 0
push 0x404610
push esi
push 0x9d
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop esi
ret
cmp dword [0x418e8c], 0x62
jne 0x408ba3
mov ecx, dword [0x418f8c]
push 0
push 0x404370
push esi
push 0x9f
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop esi
ret
push 0x10
push 0x415ce4
push 0x415d88
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
ret
mov edx, dword [0x418f8c]
push 0
push 0x4046e0
push esi
push 0xa3
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop esi
ret
mov eax, dword [0x418f8c]
push 0
push 0x402990
push esi
push 0xa8
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop esi
ret
mov ecx, dword [0x418f8c]
push 0
push 0x402ea0
push esi
push 0xaa
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop esi
ret
mov edx, dword [0x418f8c]
push 0
push 0x403290
push esi
push 0xac
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop esi
ret
mov eax, dword [0x418f8c]
push 0
push 0x4036f0
push esi
push 0xda
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop esi
ret
push 0x40
push 0x41560c
push 0x415d70
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
ret
mov ecx, dword [0x418f8c]
push 0
push 0x409c90
push esi
push 0xe6
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop esi
ret
push 5
push str.LisenPack.dll
call dword [sym.imp.KERNEL32.dll_WinExec]
pop esi
ret
cmp dword [0x418e8c], 0x62
je case.default.0x408aca
push 5
push str.ShareEnum.dll
call dword [sym.imp.KERNEL32.dll_WinExec]
pop esi
ret
push 5
push str.scndv.dll
call dword [sym.imp.KERNEL32.dll_WinExec]
pop esi
ret
Function at 0x409470
Capabilities:
Create process on windows
Get common file path
Manipulate cd-rom drive
Read .ini file

Disassembly:
sub esp, 0x23c
lea eax, [esp + 0x100]
push ebx
push esi
push edi
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str._syschg.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x250]
mov ecx, ebx
add eax, 0xfffff448
and ecx, 3
cmp eax, 0xc
rep movsb byte es:[edi], byte [esi]
ja case.default.0x4094d2
jmp dword [eax*4 + 0x4096c8]
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
push eax
call fcn.00409ea0
mov esi, eax
push str.screen.bmp
push esi
call fcn.00409f30
add esp, 0xc
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebx
add esp, 0x23c
ret
mov eax, dword [0x41517c]
push 0
test eax, eax
push 0x3c
je 0x40952d
lea ecx, [esp + 0x214]
push ecx
push str.set_cdaudio_door_open
jmp 0x40953a
lea edx, [esp + 0x214]
push edx
push str.set_cdaudio_door_closed
call dword [sym.imp.WINMM.dll_mciSendStringA]
mov ecx, dword [0x41517c]
xor eax, eax
test ecx, ecx
sete al
pop edi
pop esi
mov dword [0x41517c], eax
pop ebx
add esp, 0x23c
ret
mov esi, dword [esp + 0x24c]
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
add esp, 0x23c
ret
lea ecx, [esp + 0x10c]
lea edx, [esp + 0xc]
push ecx
push 0xff
push edx
push 0
push 0x4151ac
jmp 0x409698
lea ecx, [esp + 0x10c]
lea edx, [esp + 0xc]
push ecx
push 0xff
push edx
push 0
push 0x41558c
jmp 0x409698
lea ecx, [esp + 0x10c]
lea edx, [esp + 0xc]
push ecx
push 0xff
push edx
push 0
push 0x415588
jmp 0x409698
lea ecx, [esp + 0x10c]
lea edx, [esp + 0xc]
push ecx
push 0xff
push edx
push 0
push 0x415584
jmp 0x409698
lea ecx, [esp + 0x10c]
lea edx, [esp + 0xc]
push ecx
push 0xff
push edx
push 0
push 0x415580
jmp 0x409698
lea ecx, [esp + 0x10c]
lea edx, [esp + 0xc]
push ecx
push 0xff
push edx
push 0
push 0x41557c
jmp 0x409698
lea ecx, [esp + 0x10c]
lea edx, [esp + 0xc]
push ecx
push 0xff
push edx
push 0
push 0x415578
jmp 0x409698
lea ecx, [esp + 0x10c]
lea edx, [esp + 0xc]
push ecx
push 0xff
push edx
push 0
push 0x415574
jmp 0x409698
lea ecx, [esp + 0x10c]
lea edx, [esp + 0xc]
push ecx
push 0xff
push edx
push 0
push 0x415570
jmp 0x409698
lea ecx, [esp + 0x10c]
lea edx, [esp + 0xc]
push ecx
push 0xff
push edx
push 0
push str.098765432
push 0x415590
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 5
push 0
lea eax, [esp + 0x14]
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
add esp, 0x23c
ret