joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403360
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403378
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4033aa
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4033a6
cmp esi, eax
jae 0x4033aa
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403398
cmp esi, eax
jb 0x4033b0
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x4041e0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 0x14]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x40426c
cmp word [ebx + 8], 2
push edi
jne 0x40423e
cmp word [ebx + 0xa], 4
jne 0x40423e
mov edi, dword [ebx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x40423e
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call fcn.00404170
mov dword [esi], eax
test eax, eax
je 0x404260
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x404218
mov eax, dword [ebx]
mov ecx, dword [ebp + 0x14]
push 0x400
push eax
push 0x401
push ecx
call fcn.0042ebf1
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x10
pop edi
pop esi
mov eax, 8
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x40427c.11001
jmp dword [eax*4 + 0x4042a4]
pop esi
mov eax, 0x2af9
pop ebx
pop ebp
ret 0x10
pop esi
mov eax, 0x2afa
pop ebx
pop ebp
ret 0x10
pop esi
mov eax, 0x2afb
pop ebx
pop ebp
ret 0x10
Function at 0x404a70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x45c070]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x460264], 0
push ebx
push esi
push edi
mov dword [ebp - 0x238], str.getaddrinfo
mov dword [ebp - 0x234], 0x404540
mov dword [ebp - 0x230], str.getnameinfo
mov dword [ebp - 0x22c], 0x4047f0
mov dword [ebp - 0x228], str.freeaddrinfo
mov dword [ebp - 0x224], fcn.004044f0
je 0x404ae9
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x45d5ac]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d4af
mov esp, ebp
pop ebp
ret 4
push 0x104
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x404bff
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x118]
push 0x10c
push eax
call fcn.0042eb92
push str.ws2_32
lea ecx, [ebp - 0x118]
push 0x10c
push ecx
call fcn.0042f01e
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [ebp - 0x118]
push edx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x404b62
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x404bb7
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x118]
push 0x10c
push ecx
call fcn.0042eb92
push str.wship6
lea edx, [ebp - 0x118]
push 0x10c
push edx
call fcn.0042f01e
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call edi
mov esi, eax
test esi, esi
je 0x404bff
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x404bb7
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x404bff
xor edi, edi
lea esp, [esp]
mov ecx, dword [ebp + edi*8 - 0x238]
push ecx
push esi
call ebx
mov dword [ebp + edi*8 - 0x234], eax
test eax, eax
je 0x404bae
inc edi
cmp edi, 3
jl 0x404bc0
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x224]
mov dword [0x45d5ac], edx
mov dword [0x45d5b4], eax
mov dword [fcn.004044f0], ecx
movzx edx, word [ebp + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [edx*8 + 0x45d5ac]
pop edi
pop esi
xor ecx, ebp
mov dword [0x460264], 1
pop ebx
call fcn.0042d4af
mov esp, ebp
pop ebp
ret 4
Function at 0x404e70
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x45c070]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x405063
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404e96
sub eax, edx
je 0x405063
mov ecx, str.127.0.0.1
mov eax, esi
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404ed0
test dl, dl
je 0x404ecc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404ed0
add eax, 2
add ecx, 2
test dl, dl
jne 0x404eb0
xor eax, eax
jmp 0x404ed5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405063
push 0x451af0
push esi
call fcn.0042f22b
add esp, 8
test eax, eax
je 0x405063
push str.localhost
push esi
call fcn.0042f22b
add esp, 8
test eax, eax
je 0x405063
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x48]
push ecx
mov dword [esp + 0x18], 0x10
xor ebx, ebx
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 2
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x404f8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x404f6d
and eax, 0xffff
or eax, 0x80070000
push eax
lea edx, [esp + 0x38]
push edx
mov ecx, str.GetComputerNameA__szLocalHost__dwSize_
call fcn.00404c70
push 0x456818
lea eax, [esp + 0x38]
push eax
call fcn.00433e48
lea ecx, [esp + 0x44]
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404fb2
test dl, dl
je 0x404fae
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404fb2
add eax, 2
add ecx, 2
test dl, dl
jne 0x404f92
xor eax, eax
jmp 0x404fb7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405063
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.00404c30
test eax, eax
je 0x40500a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x404feb
and eax, 0xffff
or eax, 0x80070000
push eax
lea ecx, [esp + 0x38]
push ecx
mov ecx, str.0__WspiapiGetAddrInfo_szLocalHost__0__hints__res_
call fcn.00404c70
push 0x456818
lea edx, [esp + 0x38]
push edx
call fcn.00433e48
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov edi, dword [ecx + 4]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
push esi
call fcn.00404c30
mov esi, dword [esp + 0xc]
test eax, eax
jne 0x405032
mov ecx, dword [esi + 0x18]
mov ebx, dword [ecx + 4]
mov eax, dword [0x46026c]
test eax, eax
jne 0x405047
push 2
call fcn.00404a70
mov dword [0x46026c], eax
push esi
call eax
xor eax, eax
cmp ebx, edi
sete al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0042d4af
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.0042d4af
mov esp, ebp
pop ebp
ret
Function at 0x405080
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
xor eax, eax
push ebx
push esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 8]
push eax
mov eax, dword [edx]
lea ecx, [esp + 0x14]
xor ebx, ebx
push ecx
push ebx
push eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 6
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
mov eax, dword [esp + 8]
mov esi, eax
cmp eax, ebx
je 0x4050f2
cmp dword [esi + 4], 2
je 0x4050ff
mov esi, dword [esi + 0x1c]
cmp esi, ebx
jne 0x4050e5
push eax
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov ebx, 0x30
mov dword [esp + 0xc], ebx
mov edx, dword [eax - 8]
mov ecx, 1
sub ecx, dword [eax - 4]
sub edx, ebx
or ecx, edx
jge 0x405124
mov ecx, ebx
mov eax, edi
call fcn.00403660
mov eax, dword [edi]
cmp dword [eax - 8], ebx
jl 0x405187
mov dword [eax - 0xc], ebx
mov ecx, dword [edi]
xor edx, edx
mov word [ecx + 0x60], dx
lea ecx, [esp + 0xc]
push ecx
push eax
mov eax, dword [esi + 0x18]
push edx
mov edx, dword [esi + 0x10]
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSAAddressToStringW]
mov edx, dword [edi]
test edx, edx
jne 0x405155
xor eax, eax
jmp 0x405171
mov eax, edx
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405160
sub eax, esi
sar eax, 1
js 0x405187
cmp eax, dword [edx - 8]
jg 0x405187
mov dword [edx - 0xc], eax
mov ecx, dword [edi]
xor edx, edx
pop esi
mov word [ecx + eax*2], dx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.004036b0
int3
Function at 0x405650
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x447f98
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x45c070]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x10], edi
push 8
mov dword [esp + 0x2c], edi
call fcn.0042de17
add esp, 4
cmp eax, edi
je 0x40569f
mov dword [eax], reloc.OLEAUT32.dll_SysReAllocString
mov dword [eax + 4], edi
jmp 0x4056a1
xor eax, eax
push edi
lea ecx, [eax + 4]
push ecx
push edi
push 3
push edi
push edi
push edi
mov dword [esp + 0x2c], eax
mov edx, dword [eax]
push str.SOFTWARETCtrlTime_control_value
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x40572c
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x45f3ec]
cmp dword [eax - 0xc], edi
je 0x4056f2
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1d
push str.AGENT_PROPERTIES::LoadFromRegistry
mov edx, str...Commonprotocol.cpp
mov ecx, esi
call fcn.00403b50
add esp, 0xc
mov eax, dword [esp + 0x10]
mov ebx, eax
cmp eax, edi
je 0x405717
lea esi, [eax + 4]
mov eax, dword [esi]
cmp eax, edi
je 0x40570e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], edi
push ebx
call fcn.0042d5dd
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x10]
mov eax, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [edx + 4]
push 0x45f414
lea ecx, [esp + 0x20]
push ecx
push edi
push 0x451384
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
je 0x4057a1
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x10]
mov ebx, eax
cmp eax, edi
je 0x405717
lea esi, [eax + 4]
mov eax, dword [esi]
cmp eax, edi
je 0x405783
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], edi
push ebx
call fcn.0042d5dd
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x45f3ec
lea eax, [esp + 0x10]
push ecx
mov esi, eax
mov ebx, eax
push eax
mov eax, 0x4601e4
mov edi, ecx
call fcn.00407830
push edi
push esi
mov eax, 0x4601f4
call fcn.00407990
mov eax, edi
push eax
push ebx
mov eax, 0x460204
call fcn.00407b00
mov eax, edi
push eax
mov eax, ebx
push eax
mov eax, 0x460214
call fcn.00407c70
mov esi, 0x45fd48
call fcn.00405840
mov esi, 0x45fd50
call fcn.00405840
mov eax, dword [esp + 0x10]
mov edi, eax
test eax, eax
je 0x405823
lea esi, [eax + 4]
mov eax, dword [esi]
test eax, eax
je 0x40581a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], 0
push edi
call fcn.0042d5dd
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445ef8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x45c070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x45d48c]
mov edx, dword [eax + 0xc]
mov ecx, 0x45d48c
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
push 0
push 0
mov dword [ebp - 4], 0
mov eax, dword [ebx]
mov ecx, dword [eax - 0xc]
push 0
push 0
push ecx
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x4066d3
mov ecx, edi
lea eax, [ebp - 0x10]
call fcn.004075c0
mov esi, dword [ebp - 0x10]
test edi, edi
js 0x4067a2
cmp edi, dword [esi - 8]
jg 0x4067a2
push 0
push 0
mov dword [esi - 0xc], edi
mov byte [edi + esi], 0
mov eax, dword [ebx]
mov ecx, dword [eax - 0xc]
mov ebx, dword [ebp + 8]
push edi
push esi
push ecx
push eax
mov eax, dword [ebx]
mov ecx, dword [eax]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406710
sub eax, edx
js 0x4067a2
cmp eax, dword [esi - 8]
jg 0x4067a2
push 2
lea edx, [ebp - 0x10]
mov dword [esi - 0xc], eax
push edx
mov byte [eax + esi], cl
call fcn.00407200
mov esi, dword [ebp - 0x10]
cmp dword [esi - 4], 1
mov edi, dword [esi - 0xc]
jle 0x40674e
push edi
lea ecx, [ebp - 0x10]
push ecx
call fcn.00407290
mov esi, dword [ebp - 0x10]
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push 0
lea edx, [ebp + 8]
push edx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40676b
call fcn.00409020
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40678e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004036b0
int3
Function at 0x407830
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [eax]
mov dword [ebp - 0x10], eax
cmp edi, eax
je 0x40797b
lea esp, [esp]
mov ecx, dword [0x460228]
mov dword [ebp - 0xc], ecx
lea ecx, [edi + 0xc]
mov eax, 0x460224
call fcn.004074f0
mov ebx, dword [0x460228]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x4078b7
mov eax, dword [eax + 0xc]
test eax, eax
je 0x407984
mov ecx, eax
mov eax, dword [edi + 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4078a9
test dx, dx
je 0x4078a5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4078a9
add eax, 4
add ecx, 4
test dx, dx
jne 0x407883
xor eax, eax
jmp 0x4078ae
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
js 0x4078b7
lea eax, [ebp - 4]
jmp 0x4078bd
mov dword [ebp - 8], ebx
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
cmp dword [eax], edx
je 0x4078d1
push 0x460224
lea ecx, [edi + 0xc]
call fcn.00406f60
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0xc]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov esi, 4
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
lea esi, [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 4]
push eax
push 0
push ecx
mov ecx, dword [edx + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x407930
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [ebp + 0xc]
mov esi, dword [edx]
cmp dword [esi - 0xc], 0
je 0x407930
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x26
push str._anonymous_namespace::_lambda0_::operator___
mov edx, str...Commonprotocol.cpp
mov ecx, esi
call fcn.00403b50
add esp, 0xc
cmp byte [edi + 0x15], 0
jne 0x407972
mov ecx, dword [edi + 8]
cmp byte [ecx + 0x15], 0
jne 0x407955
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
jne 0x407951
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
je 0x407947
mov edi, ecx
jmp 0x407972
mov eax, dword [edi + 4]
cmp byte [eax + 0x15], 0
jne 0x407970
mov edi, edi
cmp edi, dword [eax + 8]
jne 0x407970
mov edi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x407960
mov edi, eax
cmp edi, dword [ebp - 0x10]
jne 0x407850
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004036b0
int3
Function at 0x407990
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [eax]
mov dword [ebp - 0x10], eax
cmp edi, eax
je 0x407ae2
lea esp, [esp]
mov ecx, dword [0x460228]
mov dword [ebp - 0xc], ecx
lea ecx, [edi + 0xc]
mov eax, 0x460224
call fcn.004074f0
mov ebx, dword [0x460228]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x407a17
mov eax, dword [eax + 0xc]
test eax, eax
je 0x407aeb
mov ecx, eax
mov eax, dword [edi + 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407a09
test dx, dx
je 0x407a05
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407a09
add eax, 4
add ecx, 4
test dx, dx
jne 0x4079e3
xor eax, eax
jmp 0x407a0e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
js 0x407a17
lea eax, [ebp - 4]
jmp 0x407a1d
mov dword [ebp - 8], ebx
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
cmp dword [eax], edx
je 0x407a31
push 0x460224
lea ecx, [edi + 0xc]
call fcn.00406f60
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0xc]
mov edx, dword [ebp + 8]
mov edx, dword [edx]
lea esi, [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 4]
push eax
push 0
push ecx
mov ecx, dword [edx + 4]
push ecx
mov dword [ebp - 4], 3
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x407a93
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [ebp + 0xc]
mov esi, dword [edx]
cmp dword [esi - 0xc], 0
je 0x407a93
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2b
push str._anonymous_namespace::_lambda1_::operator___
mov edx, str...Commonprotocol.cpp
mov ecx, esi
call fcn.00403b50
add esp, 0xc
cmp byte [edi + 0x15], 0
jne 0x407ad9
mov ecx, dword [edi + 8]
cmp byte [ecx + 0x15], 0
jne 0x407abe
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
jne 0x407aba
lea ebx, [ebx]
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
je 0x407ab0
mov edi, ecx
jmp 0x407ad9
mov eax, dword [edi + 4]
cmp byte [eax + 0x15], 0
jne 0x407ad7
cmp edi, dword [eax + 8]
jne 0x407ad7
mov edi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x407ac7
mov edi, eax
cmp edi, dword [ebp - 0x10]
jne 0x4079b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004036b0
int3
Function at 0x407b00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [eax]
mov dword [ebp - 0x10], eax
cmp edi, eax
je 0x407c52
lea esp, [esp]
mov ecx, dword [0x460228]
mov dword [ebp - 0xc], ecx
lea ecx, [edi + 0xc]
mov eax, 0x460224
call fcn.004074f0
mov ebx, dword [0x460228]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x407b87
mov eax, dword [eax + 0xc]
test eax, eax
je 0x407c5b
mov ecx, eax
mov eax, dword [edi + 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407b79
test dx, dx
je 0x407b75
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407b79
add eax, 4
add ecx, 4
test dx, dx
jne 0x407b53
xor eax, eax
jmp 0x407b7e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
js 0x407b87
lea eax, [ebp - 4]
jmp 0x407b8d
mov dword [ebp - 8], ebx
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
cmp dword [eax], edx
je 0x407ba5
push 0x460224
lea ecx, [edi + 0xc]
call fcn.00406f60
mov eax, dword [eax]
jmp 0x407ba7
xor eax, eax
mov ecx, dword [edi + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x10]
mov edx, dword [edx]
lea esi, [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 4]
push eax
push 0
push ecx
mov ecx, dword [edx + 4]
push ecx
mov dword [ebp - 4], 3
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x407c05
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [ebp + 0xc]
mov esi, dword [edx]
cmp dword [esi - 0xc], 0
je 0x407c05
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x30
push str._anonymous_namespace::_lambda2_::operator___
mov edx, str...Commonprotocol.cpp
mov ecx, esi
call fcn.00403b50
add esp, 0xc
cmp byte [edi + 0x15], 0
jne 0x407c49
mov ecx, dword [edi + 8]
cmp byte [ecx + 0x15], 0
jne 0x407c2e
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
jne 0x407c2a
lea esp, [esp]
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
je 0x407c20
mov edi, ecx
jmp 0x407c49
mov eax, dword [edi + 4]
cmp byte [eax + 0x15], 0
jne 0x407c47
cmp edi, dword [eax + 8]
jne 0x407c47
mov edi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x407c37
mov edi, eax
cmp edi, dword [ebp - 0x10]
jne 0x407b20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004036b0
int3
Function at 0x407c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [eax + 4]
push ebx
push esi
mov esi, dword [eax]
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], esi
cmp esi, eax
jne 0x407c94
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp - 4]
mov ebx, dword [0x460228]
lea ecx, [esi + 0xc]
mov eax, 0x460224
call fcn.004074f0
mov edi, dword [0x460228]
mov dword [ebp - 8], eax
cmp eax, edi
je 0x407cf8
mov eax, dword [eax + 0xc]
test eax, eax
je 0x407dfc
mov ecx, eax
mov eax, dword [esi + 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407cea
test dx, dx
je 0x407ce6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407cea
add eax, 4
add ecx, 4
test dx, dx
jne 0x407cc4
xor eax, eax
jmp 0x407cef
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
js 0x407cf8
lea eax, [ebp - 8]
jmp 0x407cfe
mov dword [ebp - 0xc], edi
lea eax, [ebp - 0xc]
cmp dword [eax], ebx
je 0x407d13
push 0x460224
lea ecx, [esi + 0xc]
call fcn.00406f60
mov eax, dword [eax]
jmp 0x407d15
xor eax, eax
mov ecx, dword [ebp + 8]
mov edx, dword [esi + 0x10]
mov esi, dword [esi + 0xc]
mov edi, dword [ecx]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 1
test eax, eax
jne 0x407d47
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407d33
sub eax, ebx
sar eax, 1
add eax, eax
mov dword [ebp - 8], eax
mov eax, dword [edi + 4]
lea ecx, [ebp - 8]
push ecx
push edx
lea edx, [ebp - 0x10]
push edx
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x407d90
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ecx]
cmp dword [esi - 0xc], 0
je 0x407d90
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x35
push str._anonymous_namespace::_lambda3_::operator___
mov edx, str...Commonprotocol.cpp
mov ecx, esi
call fcn.00403b50
add esp, 0xc
mov edx, dword [ebp - 4]
cmp byte [edx + 0x15], 0
jne 0x407dea
mov ecx, dword [edx + 8]
cmp byte [ecx + 0x15], 0
jne 0x407dbf
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
jne 0x407dba
lea ebx, [ebx]
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x15], 0
je 0x407db0
mov dword [ebp - 4], ecx
jmp 0x407de7
mov eax, dword [edx + 4]
cmp byte [eax + 0x15], 0
jne 0x407de4
jmp 0x407dd3
mov edx, dword [ebp - 4]
cmp edx, dword [eax + 8]
jne 0x407de4
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x407dd0
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x14]
jne 0x407c91
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004036b0
int3