joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f73c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47f99c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x47f79f
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0047f204
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d2cc
cmp al, 1
jne 0x47f79f
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0047f51c
test al, al
je 0x47f92b
cmp dword [ebp - 8], 0
jge 0x47f7bd
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0047f204
mov eax, dword [ebp - 0x210]
call fcn.00404ea4
cmp ebx, eax
jge 0x47f807
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0047f204
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x491e58]
and eax, 0xff
bt dword [edx], eax
jae 0x47f807
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x47f81b
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0047f718
cmp ebx, dword [ebp - 8]
je 0x47f91d
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, 0x100
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x47f847
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403fdc
and eax, 0x7f
movzx eax, word [eax*2 + 0x490c34]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x47f90a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403fdc
and eax, 0x7f
movzx eax, word [eax*2 + 0x490c34]
push eax
push 0x100
mov eax, dword [ebp - 4]
call fcn.00449fbc
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403fdc
and eax, 0x7f
movzx eax, word [eax*2 + 0x490c34]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00449fbc
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f911
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x47f97e
cmp dword [ebp - 8], 0
jge 0x47f936
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0047f204
mov eax, dword [ebp - 0x218]
call fcn.00404ea4
cmp eax, dword [ebp - 8]
jg 0x47f970
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0047f204
mov eax, dword [ebp - 0x21c]
call fcn.00404ea4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0047f718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f9a3
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404c08
ret
Function at 0x402ea9
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, esi
lea eax, [ebp - 4]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or al, 9
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004063aa
xor ebx, ebx
cmp eax, ebx
jne 0x402f8c
test byte [ebp + 0x10], 2
je 0x402f0a
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 8], ebx
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x402f71
lea eax, [ebp - 0x214]
push 0x105
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x402f46
test edi, edi
jne 0x402f71
push dword [ebp + 0x10]
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 4]
call fcn.00402ea9
test eax, eax
jne 0x402f4f
lea eax, [ebp - 0x214]
push 0x105
push eax
push edi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x402f1f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.0040690a
test eax, eax
jne 0x402f81
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x402f8c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x402f8c
push 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x405c49
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fdiv st(0), st(0)
invalid
dec eax
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.004047ac
je 0x405c45
bound edx, qword [edi - 0x72b7a73]
invalid
Function at 0x402062
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4020a1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4020a1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4020a1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4020a1
cmp dword [ecx + 0x74], 0xe
jbe 0x4020a1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40bb9d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40bc3a
push ebx
push esi
call fcn.0040bb66
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040bafc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40bbe7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bc39
push edi
push eax
call fcn.004089c0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40bc07
call fcn.00407fe0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bc38
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040bafc
add esp, 0x20
test eax, eax
jne 0x40bc26
push edi
call fcn.00407fe0
jmp 0x40bc2e
push ebx
call fcn.00407fe0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x41021b
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
mov eax, dword [eax + 0xc]
nop
shr eax, 3
test al, 1
je 0x410235
mov al, 1
leave
ret
mov eax, dword [ebp + 8]
push ebx
push esi
mov eax, dword [eax + 0xc]
nop
test al, 0xc0
mov eax, dword [ebp + 8]
je 0x41024c
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x4102a4
mov eax, dword [eax + 0x10]
nop
push eax
call fcn.0040c2d6
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x4102a4
xor ebx, ebx
lea eax, [ebp - 0x10]
inc ebx
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 8], xmm0
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4102a4
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4102a4
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x41029e
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x4102a0
xor bl, bl
mov al, bl
jmp 0x4102a6
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x414010
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41403d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41403d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402e5c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40d00c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402ef4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402ed4
xor eax, eax
push ebp
push 0x402ecd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402f10
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402ed4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x40d00c]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40d00c], ax
mov esp, ebp
pop ebp
ret

Function at 0x4035f4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40f034], 0
je 0x403655
cmp word [0x40f208], 0xd7b2
jne 0x40361d
cmp dword [0x40f210], 0
jbe 0x40361d
mov eax, 0x40f204
call dword [0x40f220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40367c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40d018], 0
jne 0x403671
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10572058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x105721a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1057207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1057206a
add dl, dl
jne 0x10572089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105720dc
xor eax, eax
add dl, dl
jne 0x10572096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1057217d
add dl, dl
jne 0x105720a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105720b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105720bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105720c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105720d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10572075
mov eax, 1
add dl, dl
jne 0x105720ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105720f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105720e1
sub eax, ebx
mov ebx, 1
jne 0x10572128
mov ecx, 1
add dl, dl
jne 0x1057210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10572119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10572105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10572075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1057213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1057214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10572136
cmp eax, 0x7d00
jae 0x1057216d
cmp eax, 0x500
jb 0x10572168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10572075
cmp eax, 0x7f
ja 0x10572170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10572075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1057219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10572075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401210
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x110
mov eax, dword [0x48268c]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x114]
push ebx
push edi
xor edi, edi
xor ebx, ebx
cmp eax, edi
mov dword [esp + 0x10], ecx
mov dword [esp + 8], edi
jne 0x401244
xor eax, eax
jmp 0x40141e
cmp byte [eax], bl
je 0x40123d
push esi
push 0x465918
push eax
call fcn.004489c6
mov esi, eax
add esp, 8
cmp esi, edi
jne 0x401264
xor eax, eax
jmp 0x40141d
push esi
push 0x100
lea eax, [esp + 0x20]
push 1
push eax
call fcn.004488e7
add esp, 0x10
cmp eax, edi
je 0x40127f
add ebx, eax
cmp eax, 0x100
je 0x401264
push ebp
lea ebp, [ebx + 1]
push ebp
call fcn.0044813a
add esp, 4
test eax, eax
mov dword [esp + 0x14], eax
jne 0x4012ab
push esi
call fcn.0044860e
add esp, 4
xor eax, eax
jmp 0x40141c
push ebp
push 0
push eax
call fcn.004489f0
push 0
push 0
push esi
call fcn.00448516
push esi
push ebp
mov ebp, dword [esp + 0x34]
push 1
push ebp
call fcn.004488e7
add esp, 0x28
cmp eax, ebx
je 0x4012e9
push ebp
call fcn.004481fd
push esi
call fcn.0044860e
add esp, 8
xor eax, eax
jmp 0x40141c
push esi
call fcn.0044860e
add esp, 4
mov ebx, ebp
cmp byte [ebx], 0
je 0x40140f
push 0xc
call fcn.0044813a
add esp, 4
cmp dword [esp + 0x10], 0
jne 0x401314
mov dword [esp + 0x10], eax
jmp 0x401317
mov dword [edi + 8], eax
mov edi, eax
test edi, edi
je 0x401437
xor eax, eax
mov dword [edi], eax
push 0xa
mov dword [edi + 4], eax
push ebx
mov dword [edi + 8], eax
mov esi, ebx
call fcn.00447f60
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40136a
mov eax, esi
mov byte [ebx], 0
add ebx, 1
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401350
sub eax, edx
test eax, eax
jle 0x40136a
cmp byte [eax + esi - 1], 0xd
jne 0x40136a
mov byte [eax + esi - 1], cl
mov al, byte [esi]
cmp al, 0x3b
jne 0x401375
mov byte [edi], 3
jmp 0x4013b0
cmp al, 0x5b
jne 0x401399
push 0x465914
push esi
call fcn.00448020
add esp, 8
test eax, eax
je 0x401399
mov byte [edi], 1
mov byte [esi], 0
mov byte [eax], 0
add esi, 1
jmp 0x4013b0
push str._r__
push esi
call fcn.00448020
add esp, 8
neg eax
sbb al, al
add eax, 3
mov byte [edi], al
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4013b5
sub eax, edx
add eax, 1
push eax
call fcn.0044813a
add esp, 4
test eax, eax
mov dword [edi + 4], eax
je 0x40143e
mov ecx, esi
lea ebp, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x4013d8
sub ecx, ebp
add ecx, 1
push ecx
push 0
push eax
call fcn.004489f0
mov ecx, dword [edi + 4]
add esp, 0xc
mov al, byte [esi]
mov byte [ecx], al
add esi, 1
add ecx, 1
test al, al
jne 0x4013f5
test ebx, ebx
mov ebp, dword [esp + 0x14]
jne 0x4012f4
push ebp
call fcn.004481fd
mov eax, dword [esp + 0x14]
add esp, 4
pop ebp
pop esi
mov ecx, dword [esp + 0x114]
pop edi
pop ebx
xor ecx, esp
call fcn.004489d9
add esp, 0x110
ret 4
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x401443
mov edx, dword [esp + 0x10]
push edx
mov ecx, dword [esp + 0x1c]
call fcn.004011d0
push ebp
call fcn.004481fd
add esp, 4
xor eax, eax
jmp 0x40141c
Function at 0x4072d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4072e9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x407324
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x407320
lea ebx, [ebx]
cmp esi, eax
jae 0x407324
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x407310
cmp esi, eax
jb 0x40732a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x409630
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4604a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x48268c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0041fa16
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x409672
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
lea ecx, [esi + 0xec]
push ecx
lea edx, [esi + 0x5fc]
push edx
lea eax, [esp + 0x20]
push str.Software_sDevice_MonitorPurchaseInformation_s
push eax
mov dword [esp + 0x38], 0
call fcn.004093c0
mov edi, dword [esp + 0x28]
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
push edi
push reloc.dcpi.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4096f1
lea eax, [edi - 0x10]
mov dword [esi + 0x6fc], 0
mov dword [esp + 0x28], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x409772
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esi + 0x700]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push str.PurchaseURLLINK
push ecx
mov dword [esi + 0x6fc], 1
mov dword [esp + 0x28], 4
call ebx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
add esi, 0x704
push esi
lea eax, [esp + 0x24]
push eax
push 0
push str.Purchase
push ecx
mov dword [esp + 0x28], 0x200
call ebx
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [edi - 0x10]
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40977e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x4097a0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4604d8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48268c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0041fa16
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4097e3
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov esi, dword [esp + 0x2c]
test esi, esi
mov dword [esp + 0x24], 0
jne 0x40982e
add eax, 0xfffffff0
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409827
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x40991c
lea ecx, [edi + 0xec]
push ecx
lea edx, [edi + 0x5fc]
push edx
lea eax, [esp + 0x20]
push str.Software_sDevice_MonitorPurchaseInformation_s
push eax
call fcn.004093c0
mov ebp, dword [esp + 0x28]
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
push 0x20006
push 0
push ebp
push reloc.dcpi.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x409888
lea eax, [ebp - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x40981b
mov edx, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [esi + 4]
push ecx
push 4
push 0
push str.PurchaseURLLINK
add edi, 0x6fc
push edx
mov dword [edi], 1
call ebx
test eax, eax
je 0x4098c7
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
jmp 0x409806
mov edx, dword [esp + 0x14]
push 0x200
lea ecx, [esi + 8]
push ecx
push 1
push 0
push str.Purchase
push edx
call ebx
test eax, eax
je 0x4098fc
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
call fcn.00401e10
xor eax, eax
jmp 0x40991c
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x18]
call fcn.00401e10
mov eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x409ea0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30c
mov eax, dword [0x48268c]
xor eax, esp
mov dword [esp + 0x308], eax
push ebx
push ebp
push esi
push edi
push 0x104
lea eax, [esp + 0x14]
push 0
push eax
mov ebp, ecx
call fcn.004489f0
add esp, 0xc
call fcn.0041db3d
mov eax, dword [eax + 8]
push 0x104
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x409ef0
sub eax, edx
je 0x409f1c
lea ecx, [esp + 0x10]
sub ecx, 1
sub eax, 1
cmp byte [ecx + eax], 0x5c
je 0x409f17
test eax, eax
mov byte [ecx + eax], 0
jne 0x409f04
jmp 0x409f1c
mov byte [esp + eax + 0xf], 0
push str.DevMon.ini
lea edx, [esp + 0x14]
push edx
lea esi, [ebp + 0xcc]
push str._s_s
push esi
call fcn.004093c0
push 0x104
lea eax, [esp + 0x128]
push 0
push eax
call fcn.004489f0
push 0x100
lea ebx, [ebp + 0x5fc]
push 0
push ebx
call fcn.004489f0
mov ecx, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0x28
push ecx
push 0x104
lea edx, [esp + 0x11c]
push edx
push 0x465904
push str.Language
push str.Main
call edi
mov eax, dword [esi]
push eax
push 0x100
push ebx
push 0x465904
push str.Company
push str.Main
call edi
mov ecx, dword [esi]
push ecx
push 0x100
lea edx, [esp + 0x220]
push edx
push 0x465904
push str.RegKeyJSU
push str.Main
call edi
lea eax, [esp + 0x218]
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x409fd0
sub eax, esi
push eax
lea eax, [esp + 0x21c]
push eax
lea ecx, [ebp + 0x90c]
call fcn.00402120
cmp byte [esp + 0x114], 0
je 0x40a09c
test ebx, ebx
je 0x40a09c
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [ebp + 0xd0]
push str._s_s
push eax
call fcn.004093c0
push str.DevMon.exe
lea ecx, [esp + 0x24]
push ecx
lea edx, [ebp + 0xd4]
push str._s_s
push edx
call fcn.004093c0
push str.DMList.exe
lea eax, [esp + 0x34]
push eax
lea ecx, [ebp + 0xd8]
push str._s_s
push ecx
call fcn.004093c0
push str.DevMon.hlp
lea edx, [esp + 0x44]
push edx
lea eax, [ebp + 0xe0]
push str._s_s
push eax
call fcn.004093c0
add esp, 0x40
push str.DevMon.chm
lea ecx, [esp + 0x14]
push ecx
push str._s_s
add ebp, 0xe4
push ebp
call fcn.004093c0
add esp, 0x10
mov eax, 1
jmp 0x40a09e
xor eax, eax
mov ecx, dword [esp + 0x318]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004489d9
add esp, 0x30c
ret
Function at 0x40ee40
Capabilities:
Resolve dns

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x1c], ecx
je 0x40eee4
cmp word [ecx + 8], 2
push ebx
push ebp
push edi
jne 0x40eeb5
cmp word [ecx + 0xa], 4
jne 0x40eeb5
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x40eeb5
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebx
push ebp
call fcn.0040edd0
test eax, eax
mov dword [esi], eax
je 0x40eed8
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x40ee90
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x24]
push 0x400
push ecx
push 0x401
push edx
call fcn.0044b1de
add esp, 0x10
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x18
pop edi
pop ebp
pop ebx
mov eax, 8
pop esi
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x40eef4.11001
jmp dword [eax*4 + 0x40ef18]
mov eax, 0x2af9
pop esi
ret 0x18
mov eax, 0x2afa
pop esi
ret 0x18
mov eax, 0x2afb
pop esi
ret 0x18