joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401694
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
lea eax, [ebp - 8]
push eax
push 0x40c140
push 1
push 0
push 0x40c130
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x40174b
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
call dword [eax + 0x50]
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
call dword [ecx + 0x1c]
lea eax, [ebp - 0xc]
push eax
push 0x40c120
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
call dword [edx]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x40173f
push 0x104
lea ecx, [ebp - 0x214]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 1
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
call dword [edx + 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
call dword [edx + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4017cd
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x108], 0
jmp 0x401803
mov ecx, dword [ebp - 0x108]
add ecx, 1
mov dword [ebp - 0x108], ecx
cmp dword [ebp - 0x108], 4
jge 0x401845
mov edx, dword [ebp - 0x108]
mov eax, dword [edx*4 + 0x40d39c]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 0x40d3f0
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4017f4
mov esp, ebp
pop ebp
ret
Function at 0x401d70
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [str.SerialComm]
push eax
mov ecx, dword [str.DeviceMap]
push ecx
mov edx, dword [str.Hardware]
push edx
push 0x40e3c4
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x104]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x401dc3
xor eax, eax
jmp 0x401e3d
mov dword [ebp - 0x108], 0
jmp 0x401dde
mov eax, dword [ebp - 0x108]
add eax, 1
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x108]
cmp edx, dword [ecx + 0x2b0]
jge 0x401e2b
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax*4 + 0x230]
push edx
push 0x40e3d0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x401dcf
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x401e41
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [str.SerialComm]
push eax
mov ecx, dword [str.DeviceMap]
push ecx
mov edx, dword [str.Hardware]
push edx
push 0x40e3d8
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x104]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x401e97
xor eax, eax
jmp 0x401f3c
mov dword [ebp - 0x108], 0
jmp 0x401eb2
mov eax, dword [ebp - 0x108]
add eax, 1
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x108]
cmp edx, dword [ecx + 0x2b0]
jge 0x401f2a
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax*4 + 0x230]
push edx
push 0x40e3e4
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x110], eax
mov edx, dword [ebp - 0x110]
push edx
lea eax, [ebp - 0x104]
push eax
push 1
push 0
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x401ea3
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401f40
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, dword [ebp + 8]
push eax
call fcn.00401d70
add esp, 4
push 0x419608
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x401f6f
xor eax, eax
jmp 0x40208b
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2b0]
push ecx
push 0
call fcn.00402643
add esp, 0xc
mov edx, dword [str.LogConfig]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [str.Enum_]
push ecx
push 0x40e3ec
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [str.Enum_]
push edx
push 0x40e3f4
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x134]
push ecx
lea edx, [ebp - 0x108]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x402004
xor eax, eax
jmp 0x40208b
mov dword [ebp - 4], 0x28
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x130]
push ecx
push 0
push 0
mov edx, dword [str.Driver]
push edx
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402067
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [str.SystemCurrentControlSetServicesClass_]
push edx
push 0x40e3fc
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x184]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x108]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40208f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0
push 0x40e404
push 0x7c00
push 0x411a08
push 0x40e410
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
jmp 0x4020d8
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jae 0x402129
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 0x411a08]
test ecx, ecx
jne 0x402127
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x411a08
push ecx
call fcn.00407d20
add esp, 0xc
test eax, eax
je 0x40211e
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x402127
mov dword [ebp - 0x14], 1
jmp 0x402129
jmp 0x4020cf
cmp dword [ebp - 0x14], 0
jne 0x402162
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jbe 0x402162
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x411a08
push eax
call fcn.00407d20
add esp, 0xc
test eax, eax
jne 0x402162
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0
jne 0x40216a
jmp 0x4021d8
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x40217e
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jae 0x4021a1
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov al, byte [eax + 0x411a08]
mov byte [edx + ecx + 0x411a07], al
jmp 0x402175
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov byte [edx + ecx + 0x411a07], 0
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov byte [ecx + eax + 0x411a08], 0
push str.system.ini
push 0x411a08
push str.386Enh
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
mov esp, ebp
pop ebp
ret
Function at 0x4021dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 0x10c], 0
jmp 0x402200
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10c]
cmp edx, dword [ecx + 0x2b0]
jge 0x402342
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
mov edx, dword [str.EnumMF_]
push edx
push 0x40e42c
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x104]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x402260
xor eax, eax
jmp 0x402347
mov dword [ebp - 0x108], 0x104
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 0
push 0
mov edx, dword [str.PORTNAME]
push edx
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40231a
movsx ecx, byte [ebp - 0x104]
cmp ecx, 0x43
je 0x4022b6
movsx edx, byte [ebp - 0x104]
cmp edx, 0x63
jne 0x40231a
movsx eax, byte [ebp - 0x103]
cmp eax, 0x4f
je 0x4022ce
movsx ecx, byte [ebp - 0x103]
cmp ecx, 0x6f
jne 0x40231a
movsx edx, byte [ebp - 0x102]
cmp edx, 0x4d
je 0x4022e6
movsx eax, byte [ebp - 0x102]
cmp eax, 0x6d
jne 0x40231a
lea ecx, [ebp - 0x101]
push ecx
call fcn.00401a91
add esp, 4
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jl 0x402310
cmp dword [ebp - 0x114], 0x80
jle 0x40231a
mov dword [ebp - 0x114], 0
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x114]
mov dword [ecx + eax*4 + 0x230], edx
jmp 0x4021f1
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x404011
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x218], 0
mov ecx, dword [ebp + 0xc]
mov word [ecx + 0x214], 0
mov dword [ebp - 0x184], 0x180
lea edx, [ebp - 0x184]
push edx
lea eax, [ebp - 0x180]
push eax
push 0
push 0
mov ecx, dword [0x40dea4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404088
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x184]
push ecx
lea edx, [ebp - 0x180]
push edx
call fcn.0040454a
add esp, 0xc
test eax, eax
jne 0x404086
xor eax, eax
jmp 0x404091
jmp 0x40408c
xor eax, eax
jmp 0x404091
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4043d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [ebp + 8]
add eax, 0x3fe
push eax
mov ecx, dword [str.Enum_]
push ecx
push 0x40e544
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [ebp + 0xc]
shl edx, 4
mov eax, dword [edx + 0x40ecd0]
mov dword [ebp - 0x108], eax
mov ecx, dword [str.MoxaAsync]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [str.MoxaAsync]
push edx
push 1
push 0
mov eax, dword [str.Class]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
push 0x40dec4
push 3
push 0
mov edx, dword [str.ConfigFlags]
push edx
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [ebp - 0x108]
push edx
push 1
push 0
mov eax, dword [str.DeviceDesc]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov eax, dword [ebp + 0x14]
push eax
push 1
push 0
mov ecx, dword [str.Driver]
push ecx
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp + 8]
add eax, 0x3fe
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x3fe
push ecx
push 1
push 0
mov edx, dword [str.HardwareID]
push edx
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [str.Moxa_Technologies]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [str.Moxa_Technologies]
push edx
push 1
push 0
mov eax, dword [0x40de08]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x404888
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [ebp + 8]
mov ecx, dword [0x4118f0]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [str.EnumRootMoxaAsync]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4048ca
xor eax, eax
jmp 0x4049f5
mov dword [ebp - 0x214], 0
mov dword [ebp - 4], 0
push 0x104
lea edx, [ebp - 0x318]
push edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x31c], eax
mov ecx, dword [ebp - 0x31c]
push ecx
mov edx, dword [ebp - 0x210]
push edx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4049e4
lea ecx, [ebp - 0x318]
push ecx
mov edx, dword [str.EnumRootMoxaAsync]
push edx
push 0x40e5c4
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ecx, dword [ebp - 0x214]
imul ecx, ecx, 0x504
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 8]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.004049f9
add esp, 0xc
cmp eax, 1
jne 0x4049df
lea eax, [ebp - 0x318]
push eax
mov ecx, dword [str.RootMoxaAsync]
push ecx
push 0x40e5cc
mov edx, dword [ebp - 0x214]
imul edx, edx, 0x104
add edx, 0x419a1c
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [ebp - 0x214]
imul eax, eax, 0x104
add eax, 0x419a1c
push eax
mov ecx, dword [ebp - 0x214]
imul ecx, ecx, 0x504
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0x214]
add ecx, 1
mov dword [ebp - 0x214], ecx
cmp dword [ebp - 0x214], 4
jl 0x4049df
jmp 0x4049e4
jmp 0x4048db
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x214]
mov dword [edx + 4], eax
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4049f9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [ebp + 0x10]
mov word [eax], 0
lea ecx, [ebp - 0x120]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x404a2b
xor eax, eax
jmp 0x404bee
mov dword [ebp - 0x118], 0xa
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
mov edx, dword [str.HardwareID]
push edx
mov eax, dword [ebp - 0x120]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x404a70
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x404bee
cmp dword [ebp - 0x118], 7
jne 0x404a90
push 4
push 0x40e5d4
lea edx, [ebp - 0xc]
push edx
call fcn.00407d20
add esp, 0xc
test eax, eax
je 0x404aa4
mov eax, dword [ebp - 0x120]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x404bee
lea ecx, [ebp - 8]
push ecx
call fcn.00401a91
add esp, 4
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x114], 0
jmp 0x404ad1
mov edx, dword [ebp - 0x114]
add edx, 1
mov dword [ebp - 0x114], edx
cmp dword [ebp - 0x114], 7
jge 0x404b2d
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x18
mov ecx, dword [eax + 0x40ee38]
cmp ecx, dword [ebp - 0x11c]
jne 0x404b2b
mov edx, dword [ebp + 0x10]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x18
mov ecx, dword [ebp + 0x10]
mov dx, word [eax + 0x40ee3c]
mov word [ecx], dx
mov eax, dword [ebp - 0x114]
imul eax, eax, 0x18
mov ecx, dword [ebp + 0x10]
mov edx, dword [eax + 0x40ee44]
mov dword [ecx + 0x2b0], edx
jmp 0x404b2d
jmp 0x404ac2
cmp dword [ebp - 0x114], 7
jne 0x404b4a
mov eax, dword [ebp - 0x120]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x404bee
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401cdb
add esp, 8
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x120]
push ecx
call fcn.00405308
add esp, 8
push 0x40e5dc
mov edx, dword [ebp + 0x10]
add edx, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40e5e4
push 0x4118f8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [0x40dd98]
push ecx
mov edx, dword [str.Root]
push edx
push 0x40e5ec
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x110]
push edx
call fcn.004021dc
add esp, 8
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.0040632a
add esp, 8
mov edx, dword [ebp - 0x120]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x405308
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov dword [ebp - 0x184], 0x180
lea eax, [ebp - 0x184]
push eax
lea ecx, [ebp - 0x180]
push ecx
push 0
push 0
mov edx, dword [str.ForcedConfig]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x405346
xor eax, eax
jmp 0x405390
cmp dword [ebp - 0x184], 8
ja 0x405353
xor eax, eax
jmp 0x405390
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 0xc]
mov word [edx + 0x22c], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x184]
push ecx
lea edx, [ebp - 0x180]
push edx
call fcn.00405394
add esp, 0xc
test eax, eax
jne 0x40538b
xor eax, eax
jmp 0x405390
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40704f
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push 0x104
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0x20c], 0
jmp 0x407097
mov edx, dword [ebp - 0x20c]
add edx, 1
mov dword [ebp - 0x20c], edx
cmp dword [ebp - 0x20c], 3
jge 0x4070d9
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax*4 + 0x40e694]
push ecx
lea edx, [ebp - 0x310]
push edx
push 0x40e848
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x407088
push str.mxbpci.inf
lea edx, [ebp - 0x104]
push edx
push 0x40e85c
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.mxppci.inf
lea edx, [ebp - 0x104]
push edx
push str._sinf_s
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.Moxa_TechnologiesMXBPCI.inf
lea edx, [ebp - 0x104]
push edx
push str._sinfother_s
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esp, ebp
pop ebp
ret
Function at 0x407570
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [ebp + 8]
mov ecx, dword [0x4118f0]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [str.EnumRootMultiFunction]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4075b2
xor eax, eax
jmp 0x4076ae
mov dword [ebp - 0x214], 0
mov dword [ebp - 4], 0
push 0x104
lea edx, [ebp - 0x318]
push edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x31c], eax
mov ecx, dword [ebp - 0x31c]
push ecx
mov edx, dword [ebp - 0x210]
push edx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x40769d
lea ecx, [ebp - 0x318]
push ecx
mov edx, dword [str.EnumRootMultiFunction]
push edx
push 0x40f2e0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ecx, dword [ebp - 0x214]
imul ecx, ecx, 0x504
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 8]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.004076b2
add esp, 0xc
cmp eax, 1
jne 0x407698
lea eax, [ebp - 0x318]
push eax
mov ecx, dword [str.RootMultiFunction]
push ecx
push str._s_s
mov edx, dword [ebp - 0x214]
imul edx, edx, 0x410
add edx, 0x419e30
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [ebp - 0x214]
add eax, 1
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 4
jl 0x407698
jmp 0x40769d
jmp 0x4075c3
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x214]
mov dword [ecx + 4], edx
mov eax, 1
mov esp, ebp
pop ebp
ret