joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c5d0
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor esi, esi
call edi
cwde
test eax, eax
jns 0x41c5ec
mov esi, 1
push 0x11
call edi
test ax, ax
jns 0x41c5f8
or esi, 2
test esi, esi
je 0x41c626
mov eax, dword [0x509e1c]
test eax, eax
je 0x41c626
movzx ecx, byte [ebp + 8]
lea esp, [esp]
movsx edx, word [eax]
cmp edx, ecx
jne 0x41c61f
movsx edx, word [eax + 2]
cmp edx, esi
je 0x41c62e
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x41c610
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [0x509e18], 0
jne 0x41c727
movsx edx, word [eax + 8]
mov esi, dword [eax + 4]
mov eax, dword [0x513238]
mov dword [ebp - 4], edx
test eax, eax
je 0x41c6c1
test edx, edx
jle 0x41c6c1
test al, 2
je 0x41c70a
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call sub.mfc100u.dll_CWnd::FromHandle
mov edi, eax
test edi, edi
je 0x41c72c
mov eax, dword [esi]
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x41c69d
lea ecx, [ecx]
dec dword [ebp - 4]
js 0x41c69d
push 0
push eax
mov eax, dword [edi + 0x20]
push 0x102
push eax
call ebx
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jg 0x41c680
cmp dword [ebp - 4], 1
jl 0x41c6bd
cmp dword [esi], 0
jne 0x41c701
mov ecx, dword [edi + 0x20]
dec dword [ebp - 4]
push 0
push 0xd
push 0x102
push ecx
add esi, 4
call ebx
mov edx, dword [ebp - 4]
pop ebx
dec edx
js 0x41c72c
mov eax, dword [0x4fac30]
mov ecx, eax
add eax, 4
mov dword [0x4fac30], eax
cmp eax, 0x513200
jb 0x41c6e4
mov eax, 0x512200
mov dword [0x4fac30], eax
cmp eax, dword [0x4fac2c]
je 0x41c721
mov eax, dword [esi]
add esi, 4
dec edx
mov dword [ecx], eax
jns 0x41c6c4
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
or dword [0x51323c], 8
jmp 0x41c6bd
cmp dword [esi], 0
jg 0x41c718
or dword [0x51323c], 8
jmp 0x41c6c1
or dword [0x51323c], 4
jmp 0x41c6c1
mov dword [0x4fac30], ecx
call fcn.0040c5a0
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41dbe0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x4ff94c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xd0]
push ecx
push 0
push 0x2001f
push 0
push 0x4dab4c
push 0
push str.SoftwarePRONTOTemp
push closesocket
mov dword [ebp - 0xd4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x41dc51
push 0x30
push str.Pronto_Xi
push str.Cant_create_open_temp_registry_key_for_login_info
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0x50ed48
lea edi, [ebp - 0xcc]
call fcn.0041daf0
mov eax, edi
add esp, 4
lea edx, [eax + 1]
jmp 0x41dc70
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41dc70
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
inc eax
push eax
mov eax, dword [ebp - 0xd0]
lea edx, [ebp - 0xcc]
push edx
push 1
push 0
push str.tmp_log_1
push eax
call esi
push 0x50ed7c
lea edi, [ebp - 0xcc]
call fcn.0041daf0
mov eax, edi
add esp, 4
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41dcb2
mov edx, dword [ebp - 0xd0]
sub eax, ecx
inc eax
push eax
lea ecx, [ebp - 0xcc]
push ecx
push 1
push 0
push str.tmp_log_2
push edx
call esi
push 0x509e2c
lea edi, [ebp - 0xcc]
call fcn.0041daf0
mov eax, edi
add esp, 4
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41dcf0
sub eax, ecx
mov ecx, dword [ebp - 0xd0]
inc eax
push eax
lea eax, [ebp - 0xcc]
push eax
push 1
push 0
push str.tmp_log_3
push ecx
call esi
mov edx, dword [ebp - 0xd0]
push 3
push 0x4d123c
push 1
push 0
push str.tmp_log_4
push edx
call esi
mov eax, 0x50f19c
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41dd35
sub eax, ecx
inc eax
push eax
mov eax, dword [ebp - 0xd0]
push 0x50f19c
push 1
push 0
push str.tmp_host
push eax
call esi
mov eax, dword [0x4fac14]
cmp eax, 0x3e5
jne 0x41dd6f
mov dword [ebp - 0xcc], 0x687373
jmp 0x41ddbc
cmp eax, 0x3e6
jne 0x41dd97
mov edx, dword [0x4d121c]
mov ax, word [0x4d1220]
mov ecx, dword [0x4d1218]
mov dword [ebp - 0xc8], edx
mov word [ebp - 0xc4], ax
jmp 0x41ddb6
mov dx, word [0x4d1214]
mov al, byte [0x4d1216]
mov ecx, dword [0x4d1210]
mov word [ebp - 0xc8], dx
mov byte [ebp - 0xc6], al
mov dword [ebp - 0xcc], ecx
lea eax, [ebp - 0xcc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ddc5
sub eax, edx
mov edx, dword [ebp - 0xd0]
inc eax
push eax
lea ecx, [ebp - 0xcc]
push ecx
push 1
push 0
push str.tmp_conn
push edx
call esi
mov eax, dword [ebp - 0xd0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
Function at 0x420410
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4ff94c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x58], ecx
mov ecx, dword [ecx + 0x74]
mov edx, dword [ecx + 0x98]
push 0x1e
lea eax, [ebp - 0x24]
push eax
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jle 0x4205d4
xor eax, eax
cmp byte [ebp - 0x24], 0x20
push esi
mov byte [ebp - 7], 0
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
lea esi, [ebp - 0x24]
jne 0x420466
inc esi
cmp byte [esi], 0x20
je 0x420460
mov al, byte [esi]
xor ecx, ecx
mov word [ebp - 0x4e], cx
cmp al, 0x30
jl 0x4205d3
cmp al, 0x39
jg 0x420497
mov ecx, dword [ebp - 0x4e]
cbw
lea edx, [ecx + ecx*4]
add edx, edx
add dx, ax
mov al, byte [esi + 1]
inc esi
sub dx, 0x30
mov word [ebp - 0x4e], dx
cmp al, 0x30
jge 0x420476
mov ecx, dword [ebp - 0x4e]
dec ecx
cmp cx, 0x1e
ja 0x4205d3
mov al, byte [esi]
cmp al, 0x20
je 0x4204b3
cmp al, 0x2d
je 0x4204b3
cmp al, 0x2f
jne 0x4204b6
inc esi
jmp 0x4204a5
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_toupper]
push edi
lea edi, [ebp - 0x44]
mov al, byte [esi]
cmp al, 0x61
jl 0x4204cb
cmp al, 0x7a
jle 0x4204d3
cmp al, 0x41
jl 0x4204e2
cmp al, 0x5a
jg 0x4204e2
movsx edx, al
push edx
call ebx
mov byte [edi], al
add esp, 4
inc edi
inc esi
jmp 0x4204c1
xor eax, eax
mov byte [edi], 0
mov edi, dword [sym.imp.MSVCR100.dll_strncmp]
mov word [ebp - 0x52], ax
movzx eax, ax
mov ecx, dword [eax*4 + 0x4f87cc]
push 3
push ecx
lea edx, [ebp - 0x44]
push edx
call edi
add esp, 0xc
test eax, eax
mov ax, word [ebp - 0x52]
je 0x42051b
inc ax
mov word [ebp - 0x52], ax
cmp ax, 0xc
jb 0x4204f1
inc ax
pop edi
mov word [ebp - 0x52], ax
pop ebx
cmp ax, 0xc
ja 0x4205d3
lea ecx, [ecx]
mov al, byte [esi]
cmp al, 0x20
je 0x42053e
cmp al, 0x2d
je 0x42053e
cmp al, 0x2f
jne 0x420541
inc esi
jmp 0x420530
mov cl, byte [esi]
xor eax, eax
mov word [ebp - 0x54], ax
cmp cl, 0x30
jl 0x420575
mov edi, edi
cmp cl, 0x39
jg 0x420575
mov eax, dword [ebp - 0x54]
lea eax, [eax + eax*4]
movsx cx, cl
add eax, eax
add ax, cx
mov cl, byte [esi + 1]
inc esi
sub ax, 0x30
mov word [ebp - 0x54], ax
cmp cl, 0x30
jge 0x420550
mov cl, byte [esi]
cmp cl, 0x20
je 0x420577
test cl, cl
jne 0x4205d3
cmp ax, 0x32
jae 0x420594
mov edx, 0x7d0
add ax, dx
mov word [ebp - 0x54], ax
jmp 0x4205bb
cmp ax, 0x64
jae 0x4205a8
mov ecx, 0x76c
add ax, cx
mov word [ebp - 0x54], ax
jmp 0x4205bb
mov edx, dword [ebp - 0x54]
add edx, 0xfffff894
mov eax, 0xc8
cmp dx, ax
ja 0x4205d3
mov edx, dword [ebp - 0x58]
mov eax, dword [edx + 0x20]
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0x1002
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
Function at 0x420b00
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x4ff94c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x50be60]
test ecx, ecx
jne 0x420b2e
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
mov eax, ecx
push esi
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x420b34
sub eax, esi
dec eax
js 0x420b56
jmp 0x420b48
mov ecx, dword [0x50be60]
cmp byte [ecx + eax], 0x20
ja 0x420b56
dec eax
mov byte [ecx + eax + 1], 0
jns 0x420b42
test eax, eax
jle 0x420b84
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x38]
push ecx
mov dword [ebp - 0x3c], 0x32
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x420b84
push str.MAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x420b96
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
push edi
push str.MAPISendMail
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x420bc3
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x30
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
push eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x84]
lea edx, [ebp - 0x38]
push eax
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], 1
call sub.MSVCR100.dll_memset
mov ecx, dword [0x50be60]
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x84]
mov dword [ebp - 0x7c], ecx
mov ecx, dword [0x50f02c]
push eax
push ecx
lea edx, [ebp - 0x54]
push 0
mov dword [ebp - 0x80], str.PRONTO_background_job_output
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x60], edx
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, edi
neg eax
sbb eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004b7f56
mov esp, ebp
pop ebp
ret

Function at 0x420e80
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 4
push ecx
push 0x420e20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x420eb8
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x427790
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov dword [0x501854], ebx
cmp edi, ebx
jl 0x42786c
cmp edi, dword [esi + 0xe0]
jge 0x42786c
cmp dword [esi + 0xe8], ebx
je 0x42786c
mov eax, dword [esi + 0x20]
push 1
push ebx
push eax
mov dword [esi + 0x84], edi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esi + 0xe8]
cmp dword [ecx + edi*4], ebx
lea eax, [ecx + edi*4]
je 0x42783f
mov edx, dword [eax]
mov eax, dword [edx]
mov eax, dword [eax - 0xc]
lea ecx, [eax + eax + 2]
push ecx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x42786c
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x42786c
mov edx, dword [esi + 0xe8]
mov ecx, dword [edx + edi*4]
push 0
call dword [sym.imp.mfc100u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
mov edx, ebx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x427824
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x427841
mov edi, ebx
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42786c
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x427866
test edi, edi
je 0x427866
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x42ab20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fa8
call fcn.004b81c0
mov eax, dword [0x4ff94c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xb4]
mov dword [ebp - 0x1f78], ecx
test eax, eax
je 0x42acea
mov eax, dword [eax + 8]
test eax, eax
je 0x42acea
cmp dword [eax + 0x50], 0
je 0x42acea
mov eax, dword [eax + 0x64]
mov dword [ebp - 0x1f74], eax
test eax, eax
je 0x42acea
cmp word [0x4f9078], 0
jne 0x42acea
push ebx
push esi
lea ebx, [ecx + 0xf8]
push edi
mov ecx, ebx
call fcn.00426630
mov edi, eax
lea eax, [edi*4]
push eax
mov dword [ebp - 0x1f7c], edi
call dword [sym.imp.MSVCR100.dll_malloc]
mov esi, eax
add esp, 4
mov dword [ebp - 0x1f70], esi
test esi, esi
je 0x42ace7
push edi
push esi
mov ecx, ebx
call sub.mfc100u.dll_CHeaderCtrl::GetOrderArray
xor ecx, ecx
xor ebx, ebx
mov word [ebp - 0x1f6c], cx
test edi, edi
jle 0x42ac8f
jmp 0x42abe0
mov ecx, dword [ebp - 0x1f78]
lea edx, [ebp - 0x1fa8]
push edx
mov edx, dword [ecx + 0x118]
mov dword [ebp - 0x1fa8], 9
mov eax, dword [esi + ebx*4]
push eax
push 0x120b
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1f90]
test eax, eax
je 0x42ac24
mov eax, dword [eax + 0x7c]
test eax, eax
je 0x42ac24
movzx esi, word [eax + 0x18]
jmp 0x42ac27
mov esi, dword [esi + ebx*4]
mov eax, dword [ebp - 0x1fa4]
push eax
push esi
lea ecx, [ebp - 0x2c]
push 0x4d2da4
push ecx
call dword [sym.imp.MSVCR100.dll__swprintf]
lea eax, [ebp - 0x2c]
add esp, 0x10
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42ac46
lea edi, [ebp - 0x1f6c]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x42ac60
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x1f70]
cmp ebx, dword [ebp - 0x1f7c]
jl 0x42abe0
push esi
call dword [sym.imp.MSVCR100.dll_free]
mov ecx, dword [ebp - 0x1f74]
add esp, 4
push 1
call fcn.0044cd50
mov esi, eax
test esi, esi
je 0x42ace7
lea eax, [ebp - 0x1f6c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42acb5
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x1f6c]
push eax
push 1
push 0
push 0x4d2d90
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
Function at 0x4324a0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 4], 0
jne 0x4324b2
push esi
call fcn.00432bf0
add esp, 4
mov eax, dword [esi + 4]
cmp eax, 1
jne 0x4324ca
push edi
push ebx
add esi, 8
push esi
call fcn.004547d0
add esp, 0xc
pop esi
ret
cmp eax, 2
jne 0x4324df
mov eax, dword [esi]
push eax
push edi
push 1
push ebx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
pop esi
ret
Function at 0x43c1a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
jbe 0x43c21d
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
lea ebx, [esi + 8]
push edi
jmp 0x43c1c0
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push eax
mov ecx, esi
call fcn.0043bde0
test eax, eax
je 0x43c1e9
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
mov ecx, eax
call fcn.0043bb20
mov edi, eax
jmp 0x43c1ee
mov edi, 0x80004002
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
mov ecx, esi
call edx
cmp edi, 1
jne 0x43c212
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x14]
jbe 0x43c1c0
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x80070057
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x43c230
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4ff94c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x14]
lea edx, [ebp - 0x410]
push edx
push 0x20019
xor esi, esi
push esi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43c395
push ebx
mov ebx, dword [ebp + 0x18]
lea eax, [ebp - 0x408]
push eax
push edi
lea ecx, [ebp - 0x414]
push ecx
mov ecx, dword [ebp - 0x410]
push 0
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x404]
push eax
push 0
mov esi, 1
push ecx
mov dword [ebp - 0x40c], 0x200
mov dword [ebp - 0x414], esi
mov dword [ebp - 0x408], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x43c371
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x43c312
cmp byte [eax], 0
je 0x43c312
cmp word [ebp - 0x404], 0
je 0x43c31c
lea ecx, [ebp - 0x404]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43c309
test dx, dx
je 0x43c303
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43c309
add eax, 4
add ecx, 4
test dx, dx
jne 0x43c2e1
xor eax, eax
test eax, eax
jmp 0x43c31a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jmp 0x43c31a
cmp word [ebp - 0x404], 0
je 0x43c371
lea edx, [ebp - 0x408]
push edx
push edi
lea ecx, [ebp - 0x414]
push ecx
push 0
lea edx, [ebp - 0x40c]
push edx
mov edx, dword [ebp - 0x410]
lea ecx, [ebp - 0x404]
mov eax, esi
push ecx
push eax
push edx
mov dword [ebp - 0x40c], 0x200
mov dword [ebp - 0x414], 1
mov dword [ebp - 0x408], ebx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x43c2c5
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x408]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
Function at 0x440880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x4f8dd8]
mov dword [ecx + 4], eax
mov edx, dword [0x4f8ddc]
mov dword [ecx + 8], edx
mov eax, dword [0x4f8de0]
mov dword [ecx + 0xc], eax
mov edx, dword [0x4f8de4]
mov dword [ecx + 0x10], edx
mov eax, dword [0x50af5c]
mov dword [ecx + 0x14], eax
mov edx, dword [0x4f8de8]
mov dword [ecx + 0x18], edx
mov eax, dword [0x4f8dec]
mov dword [ecx + 0x1c], eax
mov edx, dword [0x50af60]
mov dword [ecx + 0x20], edx
mov eax, dword [0x4f8df0]
mov dword [ecx + 0x24], eax
mov edx, dword [0x50af64]
mov dword [ecx + 0x28], edx
mov eax, dword [0x4f8df4]
mov dword [ecx + 0x2c], eax
mov edx, dword [0x4f8df8]
mov dword [ecx + 0x30], edx
mov eax, dword [0x4f8dfc]
mov dword [ecx + 0x34], eax
mov edx, dword [0x4f8e00]
mov dword [ecx + 0x38], edx
mov eax, dword [0x4f8e04]
mov dword [ecx + 0x3c], eax
mov edx, dword [0x50af68]
mov dword [ecx + 0x40], edx
mov eax, dword [0x4f8e08]
mov dword [ecx + 0x44], eax
mov edx, dword [0x50af6c]
mov dword [ecx + 0x48], edx
mov eax, dword [0x4f8e0c]
mov dword [ecx + 0x4c], eax
mov edx, dword [0x4f8e10]
mov dword [ecx + 0x50], edx
mov eax, dword [0x4f8e14]
mov dword [ecx + 0x54], eax
movzx edx, byte [0x4f8e28]
mov byte [ecx + 0x70], dl
mov eax, dword [0x50af70]
mov dword [ecx + 0x58], eax
mov edx, dword [0x4f8e18]
mov dword [ecx + 0x5c], edx
mov eax, dword [0x4f8e1c]
mov dword [ecx + 0x60], eax
mov edx, dword [0x4f8e20]
mov dword [ecx + 0x64], edx
movzx eax, byte [0x50af78]
mov byte [ecx + 0x71], al
movzx edx, byte [0x50af79]
mov byte [ecx + 0x72], dl
mov eax, dword [0x50af74]
mov dword [ecx + 0x68], eax
mov edx, dword [0x4f8e24]
mov dword [ecx + 0x6c], edx
movzx eax, byte [0x4f8e29]
mov byte [ecx + 0x73], al
mov edx, dword [0x4f8e2c]
mov dword [ecx + 0x74], edx
mov eax, dword [0x50af7c]
push 0x104
mov dword [ecx + 0x78], eax
add ecx, 0x7c
push 0x50af80
push ecx
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
ret
Function at 0x440cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ecx + 4]
mov dword [0x4f8dd8], eax
mov edx, dword [ecx + 8]
mov dword [0x4f8ddc], edx
mov eax, dword [ecx + 0xc]
mov dword [0x4f8de0], eax
mov edx, dword [ecx + 0x10]
mov dword [0x4f8de4], edx
mov eax, dword [ecx + 0x14]
mov dword [0x50af5c], eax
mov edx, dword [ecx + 0x18]
mov dword [0x4f8de8], edx
mov eax, dword [ecx + 0x1c]
mov dword [0x4f8dec], eax
mov edx, dword [ecx + 0x20]
mov dword [0x50af60], edx
mov eax, dword [ecx + 0x24]
mov dword [0x4f8df0], eax
mov edx, dword [ecx + 0x28]
mov dword [0x50af64], edx
mov eax, dword [ecx + 0x2c]
mov dword [0x4f8df4], eax
mov edx, dword [ecx + 0x30]
mov dword [0x4f8df8], edx
mov eax, dword [ecx + 0x34]
mov dword [0x4f8dfc], eax
mov edx, dword [ecx + 0x38]
mov dword [0x4f8e00], edx
mov eax, dword [ecx + 0x3c]
mov dword [0x4f8e04], eax
mov edx, dword [ecx + 0x40]
mov dword [0x50af68], edx
mov eax, dword [ecx + 0x44]
mov dword [0x4f8e08], eax
mov edx, dword [ecx + 0x48]
mov dword [0x50af6c], edx
mov eax, dword [ecx + 0x4c]
mov dword [0x4f8e0c], eax
mov edx, dword [ecx + 0x50]
mov dword [0x4f8e10], edx
mov eax, dword [ecx + 0x54]
mov dword [0x4f8e14], eax
movzx edx, byte [ecx + 0x70]
mov byte [0x4f8e28], dl
mov eax, dword [ecx + 0x58]
mov dword [0x50af70], eax
mov edx, dword [ecx + 0x5c]
mov dword [0x4f8e18], edx
mov eax, dword [ecx + 0x60]
mov dword [0x4f8e1c], eax
mov edx, dword [ecx + 0x64]
mov dword [0x4f8e20], edx
movzx eax, byte [ecx + 0x71]
mov byte [0x50af78], al
movzx edx, byte [ecx + 0x72]
mov byte [0x50af79], dl
mov eax, dword [ecx + 0x68]
mov dword [0x50af74], eax
mov edx, dword [ecx + 0x6c]
mov dword [0x4f8e24], edx
movzx eax, byte [ecx + 0x73]
mov byte [0x4f8e29], al
mov edx, dword [ecx + 0x74]
mov dword [0x4f8e2c], edx
mov eax, dword [ecx + 0x78]
push 0x103
add ecx, 0x7c
push ecx
push 0x50af80
mov dword [0x50af7c], eax
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
call fcn.004409c0
jmp fcn.0044ae70
Function at 0x440ed0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4ff94c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00440be0
lea edx, [ebp - 0x2c]
add esp, 4
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x440ef4
cmp esi, 0xffffffff
je 0x440f44
push esi
call fcn.00440be0
lea edx, [ebp - 0x54]
add esp, 4
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x440f16
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x11c]
push 0x4d67e0
push eax
call dword [sym.imp.MSVCR100.dll__swprintf]
add esp, 0x10
jmp 0x440f65
xor eax, eax
jmp 0x440f50
movzx ecx, word [ebp + eax - 0x2c]
mov word [ebp + eax - 0x11c], cx
add eax, 2
test cx, cx
jne 0x440f50
lea eax, [ebp - 0x11c]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x440f70
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x11c]
push edx
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret

Function at 0x440fb0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x4ff94c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x441024
cmp word [esi], 0
je 0x441024
lea eax, [ebp - 0xd0]
push eax
push 0x2001f
push 0
push str.SoftwarePRONTOColor
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x441024
lea ecx, [ebp - 0xcc]
push ecx
push esi
call fcn.00440ad0
mov eax, dword [ebp - 0xd0]
add esp, 8
lea edx, [ebp - 0xcc]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [ebp - 0xd0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b7f56
mov esp, ebp
pop ebp
ret