joyce8/EMBER2024-capa huggingface dataset:
Function at 0x535f84
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x535f9c
mov edi, dword [esi + 0xc]
jmp 0x535fdc
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x535fb5
call fcn.004559f7
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x535fca
call fcn.004559f7
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x535fdc
call fcn.004559f7
call fcn.004516bb
cmp dword [eax + 0x3c], 0
je 0x535ff1
push edi
mov ecx, ebx
call fcn.00534dde
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00535eaa
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x53600f
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x53601b
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x5441e1
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push 4
mov eax, 0x57c211
call fcn.00555ec1
mov edi, ecx
mov esi, dword [ebp + 8]
cmp dword [esi + 4], 0x100
jne 0x5442b7
mov ebx, dword [esi + 8]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
je 0x5442b7
cmp ebx, 0x43
je 0x544223
cmp ebx, 0x2d
jne 0x5442b7
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x5442b7
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [ebp - 0x10]
call fcn.00402490
movzx ecx, byte [edi + 0xae]
and dword [ebp - 4], 0
push ecx
lea eax, [edi + 0xac]
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
push ecx
push eax
lea eax, [ebp - 0x10]
push str.RGB__d___d___d_
push eax
call fcn.00403110
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 0xc]
add esp, 0x14
inc eax
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00401200
mov esi, dword [ebp + 8]
push esi
mov ecx, edi
call fcn.004e4398
call fcn.00555f99
ret 4

Function at 0x54c4d8
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x150]
mov edi, eax
movzx eax, word [ebp + 8]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp byte [ebp + 0xc], 0
jne 0x54c518
test edi, edi
jl 0x54c518
cmp al, 0x20
je 0x54c50d
cmp word [ebp + 8], 0x71
jne 0x54c518
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x168]
pop edi
pop esi
pop ebp
ret 8
Function at 0x5509f8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5e4a44]
jne 0x550a02
repz ret
jmp fcn.0055ab04

Function at 0x5527b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x5527e1
call fcn.00554d72
mov dword [eax], esi
call fcn.00554d5f
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005519c7
add esp, 0x14
push 0x16
pop eax
jmp 0x552836
test dword [ebp + 0xc], 0xfffffff9
jne 0x5527bd
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x55280e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00554d85
pop ecx
call fcn.00554d5f
mov eax, dword [eax]
jmp 0x552836
test al, 0x10
jne 0x552834
test al, 1
je 0x552834
test byte [ebp + 0xc], 2
je 0x552834
call fcn.00554d72
mov dword [eax], 5
call fcn.00554d5f
mov dword [eax], 0xd
jmp 0x552805
xor eax, eax
pop esi
pop ebp
ret

Function at 0x56bf14
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0055c3d0
and dword [ebp - 4], 0
cmp dword [0x5ed124], 0
mov ebx, eax
jne 0x56bfc5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x56c076
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5ad6d0
push edi
call esi
test eax, eax
je 0x56c076
push eax
call fcn.0055c35e
mov dword [esp], 0x5ad6c0
push edi
mov dword [0x5ed124], eax
call esi
push eax
call fcn.0055c35e
mov dword [esp], 0x5ad6ac
push edi
mov dword [0x5ed128], eax
call esi
push eax
call fcn.0055c35e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5ed12c], eax
call esi
push eax
call fcn.0055c35e
pop ecx
mov dword [0x5ed134], eax
test eax, eax
je 0x56bfc5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0055c35e
pop ecx
mov dword [0x5ed130], eax
mov eax, dword [0x5ed130]
cmp eax, ebx
je 0x56c01d
cmp dword [0x5ed134], ebx
je 0x56c01d
push eax
call fcn.0055c3d9
push dword [0x5ed134]
mov esi, eax
call fcn.0055c3d9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x56c01d
test edi, edi
je 0x56c01d
call esi
test eax, eax
je 0x56c014
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x56c014
test byte [ebp - 0xc], 1
jne 0x56c01d
or dword [ebp + 0x10], 0x200000
jmp 0x56c056
mov eax, dword [0x5ed128]
cmp eax, ebx
je 0x56c056
push eax
call fcn.0055c3d9
pop ecx
test eax, eax
je 0x56c056
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x56c056
mov eax, dword [0x5ed12c]
cmp eax, ebx
je 0x56c056
push eax
call fcn.0055c3d9
pop ecx
test eax, eax
je 0x56c056
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5ed124]
call fcn.0055c3d9
pop ecx
test eax, eax
je 0x56c076
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x56c078
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40aa5b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x41a004]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
mov esi, dword [ebp + 8]
push 0x4074dc
push 0x4074f8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40aa95
push 0x800
call eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0xc]
call fcn.00409cb0
push esi
lea ecx, [esp + 0x24]
call fcn.0040921b
lea ecx, [esp + 0x20]
call fcn.004095c7
mov esi, eax
test esi, esi
jns 0x40aae9
lea ecx, [esp + 8]
call fcn.0040a9d0
test al, al
je 0x40ab33
cmp esi, 0x80040b00
jne 0x40ab33
lea ecx, [esp + 0x20]
call fcn.00409683
mov esi, eax
test esi, esi
js 0x40ab33
mov esi, 0x80040b02
jmp 0x40ab33
cmp dword [esp + 0x1c], 8
lea esi, [esp + 8]
jb 0x40aaf8
mov esi, dword [esp + 8]
push 0x406f80
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40ab2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x40ab24
jle 0x40ab33
movzx esi, si
or esi, 0x80070000
jmp 0x40ab33
mov esi, 0x80004005
jmp 0x40ab33
push dword [ebp + 0x14]
push esi
call eax
mov esi, eax
lea ecx, [esp + 0x20]
call fcn.004092b7
lea ecx, [esp + 8]
call fcn.00409da9
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040b187
mov esp, ebp
pop ebp
ret 0x10

Function at 0x413ffd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00413d11
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x41403a
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00413d4c
pop ds
push ecx
invalid
Function at 0x4140aa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00413d4c
pushal
cdq
adc al, 0x31
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00413d5c
push eax
push esi
push dword [ebp + 8]
call fcn.00413d11
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00413d5c
push eax
push esi
push dword [ebp + 8]
call fcn.00413d11
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00413d5c
push eax
push esi
push dword [ebp + 8]
call fcn.00413d11
add esp, 0x30
mov dword [ebp - 0xb8], eax
invalid
invalid
or al, ch
push ebp
sti
invalid
Function at 0x405240
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x42e048
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
lea ebx, [ecx + 0xd0]
lea eax, [esp + 8]
push edi
xor esi, esi
push eax
mov ecx, ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], ebx
call fcn.00403c70
mov edi, eax
cmp edi, esi
jbe 0x405366
lea ecx, [esp + 0x18]
call fcn.0040ad1b
cmp edi, esi
mov dword [esp + 0x3c], esi
jbe 0x405349
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x10]
push 0
lea edx, [esi + ecx]
lea ecx, [esp + 0x20]
push edx
call fcn.0040adde
lea ecx, [esp + 0x1c]
mov edi, eax
call fcn.0040ad94
test edi, edi
je 0x40532f
mov eax, dword [esp + 0x10]
push 0
lea ecx, [esi + eax + 0x104]
push ecx
lea ecx, [esp + 0x24]
call fcn.0040adde
test eax, eax
je 0x405306
mov edx, dword [esp + 0x10]
push 0x20
lea eax, [esi + edx + 0x104]
push eax
call ebx
mov ecx, dword [esp + 0x10]
lea edx, [esi + ecx + 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x1c]
call fcn.0040ad94
mov eax, dword [esp + 0x10]
add eax, esi
lea ecx, [eax + 0x104]
push ecx
push eax
call ebp
mov edx, dword [esp + 0x10]
push 0x20
lea eax, [esi + edx + 0x104]
push eax
call ebx
mov eax, dword [esp + 0x14]
add esi, 0x208
dec eax
mov dword [esp + 0x14], eax
jne 0x4052a7
mov ebx, dword [esp + 0x18]
pop ebp
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, ebx
call fcn.00404ba0
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0040ad58
lea edx, [esp + 0x10]
mov ecx, ebx
push edx
call fcn.00403b50
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x10]
call fcn.00422a0b
mov ecx, dword [esp + 0x34]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x4059b5
Capabilities:
Create thread

Disassembly:
sub esp, 0x28
xor eax, eax
push esi
mov esi, ecx
mov ecx, dword [esp + 0x30]
cmp ecx, 1
jne 0x405a0a
mov dword [esp + 8], eax
lea eax, [esp + 0x30]
push eax
push 0
mov dword [esp + 0x14], ecx
push esi
push 0x4088c0
lea ecx, [esp + 0x14]
push 0
push ecx
mov dword [esp + 0x1c], 0xc
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0xc0], eax
jne 0x405a01
mov eax, 0x643
pop esi
add esp, 0x28
ret 4
xor eax, eax
pop esi
add esp, 0x28
ret 4
cmp ecx, 2
jne 0x405a9c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push edi
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0
push 0
lea edx, [esp + 0x24]
push 0
push edx
call edi
test eax, eax
je 0x405a67
lea eax, [esi + 0x7198]
test eax, eax
je 0x405a41
mov eax, dword [eax + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x405a67
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov edx, dword [esi + 0xc0]
lea ecx, [esp + 0x38]
push ecx
push edx
call ebx
cmp dword [esp + 0x38], 0x103
je 0x405a21
mov eax, dword [esi + 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x38]
pop edi
mov dword [esi + 0xc0], 0
pop ebx
pop esi
add esp, 0x28
ret 4
Function at 0x406150
Capabilities:
Access peb ldr_data
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x42e0d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, ecx
push edi
mov edi, dword [esp + 0x3c]
mov ecx, dword [eax + 8]
mov eax, dword [esp + 0x30]
xor ebx, ebx
sub edi, edx
cmp eax, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ecx
jbe 0x406300
push esi
mov esi, dword [esp + 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x14]
cmp eax, 3
jne 0x4061d1
cmp dword [esi + 0x104], 2
jne 0x4061d1
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov ecx, dword [ebp + 4]
push edx
push eax
push esi
push ecx
mov ecx, ebp
call fcn.004078b0
push 1
mov eax, ebx
jmp 0x40629e
cmp eax, 4
jne 0x40625a
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x40625a
mov edx, dword [0x43c990]
mov dword [esp + 0x38], edx
xor edi, edi
mov dword [esp + 0x2c], 0
test eax, eax
jbe 0x406245
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x20]
push edi
push eax
call fcn.00406320
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 1
call fcn.00422b44
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c], 0
call fcn.00422a0b
mov ecx, dword [esp + 0x38]
push esi
push ecx
call fcn.0041359a
add esp, 8
test eax, eax
je 0x4062e9
mov eax, dword [esp + 0x10]
inc edi
cmp edi, eax
jb 0x4061fa
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00422a0b
mov edi, dword [esp + 0x14]
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x406296
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x40627e
cmp eax, 5
jne 0x406296
cmp dword [ebp + 0x14], 4
je 0x406296
push 0
push esi
mov ecx, ebp
call fcn.00406c60
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x44]
lea eax, [ebx + edi]
push edx
xor edx, edx
mov ecx, ebp
div dword [esp + 0x38]
add eax, dword [esp + 0x40]
push eax
call fcn.00406120
mov eax, dword [esp + 0x18]
add ebx, edi
add esi, 0x108
dec eax
mov dword [esp + 0x18], eax
jne 0x4061a1
mov eax, dword [esp + 0x1c]
pop esi
test eax, eax
je 0x406300
pop edi
pop ebp
mov eax, 0xbc2
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0x20
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00422a0b
mov edi, dword [esp + 0x14]
jmp 0x4062b0
mov ecx, dword [esp + 0x20]
pop edi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0x20
Function at 0x406810
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x110
mov al, byte [0x440950]
push edi
mov byte [esp + 0x10], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x118]
test eax, eax
jbe 0x40694f
mov ecx, dword [esp + 0x11c]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
lea esi, [ecx + 0x208]
mov dword [esp + 0x14], eax
lea edx, [esp + 0x10]
lea edi, [esi - 0x208]
push edx
push 0x2001f
push 0
push edi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40692b
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4068ad
mov eax, dword [esp + 0x10]
push eax
call ebx
jmp 0x40692b
lea ecx, [esi - 0x104]
lea edx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4068cc
mov eax, dword [esp + 0x10]
push eax
call ebx
jmp 0x40692b
cmp byte [esi], 0
jne 0x4068f6
mov ecx, dword [esp + 0x10]
push 0x440950
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
push edx
call ebx
push edi
push SysReAllocStringLen
call dword [fcn.00440934]
jmp 0x40691b
push esi
call ebp
inc eax
push eax
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
push 1
push 0
push 0x440950
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x1c]
push edx
push SysReAllocStringLen
call dword [fcn.00440930]
mov eax, dword [esp + 0x14]
add esi, 0x30c
dec eax
mov dword [esp + 0x14], eax
jne 0x40685f
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 0x110
ret 8
xor eax, eax
pop edi
add esp, 0x110
ret 8
Function at 0x406c60
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
sub esp, 0x30c
push ebx
push esi
mov esi, dword [esp + 0x318]
push 4
push 0
mov ebx, ecx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x406d67
mov al, byte [0x440950]
push edi
mov byte [esp + 0xc], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
push esi
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0xc]
push 0x104
lea eax, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dl, byte [0x440950]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x215]
mov byte [esp + 0x214], dl
mov byte [esp + 0x110], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x114]
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x110]
lea eax, [esp + 0x214]
push edx
push 0x43c54c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x32c]
add esp, 0xc
test eax, eax
pop edi
je 0x406d4e
push esi
mov ecx, ebx
call fcn.00406ea0
pop esi
mov eax, 1
pop ebx
add esp, 0x30c
ret 8
lea ecx, [esp + 0x210]
lea edx, [esp + 8]
push ecx
push 0x43c548
push edx
mov ecx, ebx
call fcn.00406d80
pop esi
mov eax, 1
pop ebx
add esp, 0x30c
ret 8

Function at 0x406d80
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x8004
call fcn.00413140
mov al, byte [0x440950]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x14], al
mov ecx, 0x1fff
xor eax, eax
lea edi, [esp + 0x15]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x8020]
push ecx
push 0x7fff
push edx
push 0x43c564
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov al, byte [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
xor esi, esi
lea edi, [esp + 0x14]
test al, al
je 0x406df2
push edi
call ebx
mov esi, eax
inc esi
cmp esi, 0x7fff
ja 0x406e85
mov al, byte [edi + esi]
add edi, esi
test al, al
jne 0x406dd7
mov ebp, dword [esp + 0x801c]
test ebp, ebp
je 0x406e85
cmp byte [ebp], 0
je 0x406e85
mov eax, dword [esp + 0x8018]
push eax
call ebx
mov edx, eax
push ebp
mov dword [esp + 0x14], edx
call ebx
mov ecx, dword [esp + 0x10]
add esi, ecx
lea edx, [eax + esi + 2]
cmp edx, 0x7fff
ja 0x406e85
mov eax, dword [esp + 0x8018]
mov ecx, ebp
push eax
push ecx
push 0x43c55c
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push edi
call ebx
mov esi, dword [esp + 0x8020]
lea edx, [esp + 0x14]
push esi
push edx
push 0x43c564
mov byte [eax + edi + 1], 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
push esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x8004
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x8004
ret 0xc
Function at 0x406ea0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10c
mov al, byte [0x440950]
push esi
mov esi, ecx
push edi
mov byte [esp + 0x10], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x118]
lea edx, [esp + 0x10]
stosw word es:[edi], ax
push ecx
push 0x43c578
push edx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 8]
lea ecx, [esi + 0xd0]
push eax
call fcn.00403bb0
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 8]
mov esi, eax
call fcn.00422a0b
cmp esi, 0xffffffff
jne 0x406f26
pop edi
xor eax, eax
pop esi
add esp, 0x10c
ret 4
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push 2
push 0
push 0
push esi
call edi
mov eax, dword [0x43c458]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x406f82
push 0x43c56c
lea ecx, [esp + 0x10]
call fcn.00422a79
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edx, dword [eax - 8]
push edx
push eax
push esi
call ebx
push 2
push 0
push 0
push esi
call edi
lea ecx, [esp + 0xc]
mov dword [0x43c458], 0
call fcn.00422a0b
lea eax, [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x1c]
push eax
push edx
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x10c
ret 4