joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407014
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call dword [0x46441c]
test eax, eax
jne 0x40702f
push 0x471984
call fcn.00406e4c
jmp 0x407051
push 0x43
call dword [0x464578]
cmp eax, 1
je 0x407041
cmp eax, 2
jne 0x407081
push 0x471984
push 0x471978
call fcn.00406f30
pop ecx
mov edi, dword [esp + 0x1c]
mov esi, dword [0x464580]
pop ecx
xor ebx, ebx
push ebx
push ebx
push 0xf0
push edi
call esi
test eax, eax
push ebx
jne 0x407071
push 1
jmp 0x407072
push ebx
push 0xf1
push edi
call esi
xor eax, eax
jmp 0x40711d
push ebp
mov ebp, dword [0x4645c0]
push 0x44b
push dword [esi + 4]
call ebp
mov edi, dword [0x464580]
xor ebx, ebx
push ebx
push ebx
push 0xf0
push eax
call edi
cmp eax, 1
jne 0x407106
call fcn.00405c1a
test eax, eax
jne 0x4070c7
push dword [esi + 4]
call fcn.00407e22
pop ecx
push 1
push 2
push 0x1411
push eax
call edi
call fcn.00405c1a
test eax, eax
jne 0x407106
lea eax, [esp + 0x1c]
push 4
push eax
push 4
push 0x471680
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [esp + 0x34], ebx
call dword [0x464444]
push 0x44b
push dword [esi + 4]
call ebp
push ebx
push ebx
push 0xf1
push eax
call edi
mov ecx, esi
call fcn.004066f9
mov ecx, esi
call fcn.004069ba
mov eax, dword [esp + 0x20]
pop ebp
mov dword [eax], ebx
xor eax, eax
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x4071d3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
call dword [0x46441c]
test eax, eax
jne 0x4071f1
push 0x471984
call fcn.00406e4c
jmp 0x407213
push 0x43
call dword [0x464578]
cmp eax, 1
je 0x407203
cmp eax, 2
jne 0x407241
push 0x471984
push 0x471978
call fcn.00406f30
pop ecx
mov esi, dword [0x464580]
pop ecx
xor edi, edi
push edi
push edi
push 0xf0
push dword [ebp + 0x10]
call esi
test eax, eax
push edi
jne 0x407231
push 1
jmp 0x407232
push edi
push 0xf1
push dword [ebp + 0x10]
call esi
jmp 0x4072d8
push 0x453
push dword [ebx + 4]
call dword [0x4645c0]
mov esi, dword [0x464580]
xor edi, edi
push edi
push edi
push 0xf0
push eax
call esi
cmp eax, 1
jne 0x4072c5
call fcn.00406130
test eax, eax
jne 0x407284
push dword [ebx + 4]
call fcn.00407e22
pop ecx
push 1
push 1
push 0x1411
push eax
call esi
call fcn.00406130
test eax, eax
jne 0x4072c5
lea eax, [ebp + 0x10]
push 4
push eax
push 4
push str.DefaultBrowserLock
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp + 0x10], edi
call dword [0x464444]
push 0x453
push dword [ebx + 4]
call dword [0x4645c0]
push edi
push edi
push 0xf1
push eax
call esi
mov ecx, ebx
call fcn.004066f9
mov ecx, ebx
call fcn.00406b0d
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x10
Function at 0x4072e1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x140]
mov ecx, esi
call fcn.00407945
mov dword [ebp - 0xc], eax
call fcn.00405ce1
xor ebx, ebx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 8], ebx
je 0x40738a
push dword [edi + 4]
call fcn.00407e22
pop ecx
push 1
push 1
push 0x1411
push eax
call dword [0x464580]
call fcn.00406130
test eax, eax
je 0x407356
lea eax, [ebp + 0xc]
push 4
push eax
push 4
push str.DefaultBrowserLock
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp + 0xc], 1
call dword [0x464444]
jmp 0x4073d2
lea eax, [ebp + 0xc]
push 4
push eax
push 4
push str.DefaultBrowserLock
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp + 0xc], ebx
call dword [0x464444]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [esi]
push dword [esi + 0x18]
call dword [0x464484]
jmp 0x4073d2
lea eax, [ebp + 0xc]
push 4
push eax
push 4
push str.DefaultBrowserLock
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp + 0xc], ebx
call dword [0x464444]
cmp dword [ebp - 4], ebx
je 0x4073d2
lea eax, [ebp - 8]
push eax
push 0x7d0
push 1
push 0x168
push 0xa2
push 0x41c
push dword [ebp - 4]
call dword [0x4645b8]
mov ecx, edi
call fcn.004066f9
mov ecx, edi
call fcn.00406b0d
push ebx
push 0x64
call fcn.0040718d
mov eax, dword [ebp - 0xc]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4090a1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.00406130
test eax, eax
je 0x409139
push ebx
push esi
push edi
push 4
pop esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov edi, dword [0x464438]
push eax
lea eax, [ebp - 0xc]
mov ebx, 0x80000002
push eax
push str.IMEPRO
push str.SOFTWARE360Safe_safemon
push ebx
mov dword [ebp - 4], 1
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call edi
xor eax, eax
mov dword [ebp - 0xc], esi
cmp dword [ebp - 4], eax
mov dword [ebp - 4], 1
mov dword [ebp - 8], esi
setne al
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x471a58
push str.SOFTWARE360Safe_safemon
push ebx
call edi
xor eax, eax
pop edi
cmp dword [ebp - 4], eax
pop esi
pop ebx
setne al
cmp dword [ebp - 0x10], 0
je 0x409135
test eax, eax
je 0x40913d
push 1
jmp 0x40913f
test eax, eax
jne 0x40913d
push 3
jmp 0x40913f
push 2
pop eax
leave
ret
Function at 0x4098fd
Capabilities:
Set registry value

Disassembly:
push ecx
push ecx
push ebp
mov dword [esp + 4], ecx
call dword [0x46441c]
test eax, eax
jne 0x40991a
push 0x471b4c
call fcn.00406e4c
jmp 0x40993e
push 0x43
call dword [0x464578]
push 1
pop ebp
cmp eax, ebp
je 0x40992e
cmp eax, 2
jne 0x409946
push 0x471b4c
push 0x471978
call fcn.00406f30
pop ecx
pop ecx
xor eax, eax
jmp 0x4099fc
mov ecx, dword [esp + 4]
push ebx
push esi
push edi
call fcn.004090a1
cmp eax, ebp
jne 0x409996
mov ebx, dword [0x464444]
and dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push 4
push eax
push 4
mov edi, str.SOFTWARE360Safe_safemon
push str.IMEPRO
mov esi, 0x80000002
push edi
push esi
call ebx
and dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push 4
push eax
push 4
push 0x471a58
push edi
push esi
call ebx
jmp 0x4099ed
mov ebx, dword [0x464444]
lea eax, [esp + 0x14]
push 4
push eax
push 4
mov edi, str.SOFTWARE360Safe_safemon
push str.IMEPRO
mov esi, 0x80000002
push edi
push esi
mov dword [esp + 0x2c], ebp
call ebx
lea eax, [esp + 0x14]
push 4
push eax
push 4
push 0x471a58
push edi
push esi
mov dword [esp + 0x2c], ebp
call ebx
mov eax, dword [esp + 0x10]
push dword [eax + 4]
call fcn.00407e22
pop ecx
push ebp
push ebp
push 0x1411
push eax
call dword [0x464580]
mov ecx, dword [esp + 0x10]
push ebp
call fcn.00409168
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
pop ecx
pop ecx
ret 0x10

Function at 0x40ae5e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0040aeb1
test eax, eax
jne 0x40ae72
push 3
pop eax
leave
ret
push 4
mov dword [ebp - 4], 1
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x471b60
push str.SOFTWARE360Safe_safemon
push 0x80000002
call dword [0x464438]
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
and al, 0xfe
add eax, 3
leave
ret

Function at 0x40aeb1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0x43
call dword [0x464578]
push 1
pop edi
cmp eax, edi
je 0x40aee8
cmp eax, 2
je 0x40aee8
push 6
call fcn.00405e3a
cmp eax, 3
pop ecx
jne 0x40aee1
mov eax, edi
jmp 0x40af72
push 4
pop esi
cmp eax, esi
jne 0x40aeef
xor eax, eax
jmp 0x40af72
call dword [0x46441c]
test eax, eax
jne 0x40af2d
lea eax, [ebp - 0xc]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push str.FileMonAccess
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
call dword [0x464438]
xor eax, eax
cmp dword [ebp - 8], eax
setne al
jmp 0x40af72
and dword [ebp - 4], 0
call fcn.00405ce1
test eax, eax
je 0x40af6f
lea ecx, [ebp - 4]
push ecx
push 0xbb8
push edi
push 0x168
push 0x97
push 0x417
push eax
call dword [0x4645b8]
test eax, eax
jne 0x40af6f
call dword [0x464288]
cmp eax, 0x5b4
jne 0x40af6f
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x40b365
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
call dword [0x46441c]
test eax, eax
jne 0x40b383
push 0x471be4
call fcn.00406e4c
jmp 0x40b3a7
push 0x43
call dword [0x464578]
push 1
pop esi
cmp eax, esi
je 0x40b397
cmp eax, 2
jne 0x40b3aa
push 0x471be4
push 0x471978
call fcn.00406f30
pop ecx
pop ecx
jmp 0x40b418
mov ecx, edi
call fcn.0040ae5e
cmp eax, esi
jne 0x40b3d8
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 4
push eax
push 4
push 0x471b60
push str.SOFTWARE360Safe_safemon
push 0x80000002
call dword [0x464444]
jmp 0x40b410
lea eax, [ebp - 4]
push 4
push eax
push 4
push 0x471b60
push str.SOFTWARE360Safe_safemon
push 0x80000002
mov dword [ebp - 4], esi
call dword [0x464444]
push dword [edi + 4]
call fcn.00407e22
pop ecx
push esi
push 3
push 0x1411
push eax
call dword [0x464580]
push esi
mov ecx, edi
call fcn.0040af9c
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x40bef7
Capabilities:
Create process on windows
Initialize iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464f28
push 0x452f00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x834
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor esi, esi
mov word [ebp - 0x818], si
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x816]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push dword [ebp + 8]
push str.__s_
push 0x400
lea eax, [ebp - 0x818]
push eax
call fcn.0040de40
add esp, 0x10
push 5
push esi
lea eax, [ebp - 0x818]
push eax
push str.Explorer
push 0x47be6c
push esi
call dword [0x464414]
cmp eax, 0x20
jg 0x40c06c
mov dword [ebp - 4], esi
mov dword [ebp - 0x81c], esi
lea eax, [ebp - 0x81c]
push eax
push 0x467554
push 5
push esi
push 0x467544
call dword [0x464660]
test eax, eax
jl 0x40c078
mov eax, dword [ebp - 0x81c]
cmp eax, esi
je 0x40c068
mov dword [ebp - 0x830], esi
mov ecx, dword [eax]
lea edx, [ebp - 0x830]
push edx
push eax
call dword [ecx + 0x94]
cmp dword [ebp - 0x830], esi
je 0x40bfeb
push dword [ebp - 0x830]
call dword [0x464584]
push 3
push dword [ebp - 0x830]
call dword [0x464588]
push dword [ebp + 8]
call dword [0x4643b8]
pop ecx
test eax, eax
jbe 0x40c05c
mov word [ebp - 0x82c], si
mov word [ebp - 0x840], 8
push dword [ebp + 8]
call dword [0x4643fc]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x81c]
mov ecx, dword [eax]
lea edx, [ebp - 0x82c]
push edx
lea edx, [ebp - 0x82c]
push edx
lea edx, [ebp - 0x82c]
push edx
lea edx, [ebp - 0x82c]
push edx
lea edx, [ebp - 0x840]
push edx
push eax
call dword [ecx + 0xd0]
mov dword [ebp - 0x844], eax
push dword [ebp - 0x838]
call dword [0x4643f8]
mov eax, dword [ebp - 0x81c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
push 1
pop eax
jmp 0x40c07e
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c08d
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.00452e80
mov al, byte [0x47c4d0]
push edi
mov byte [ebp - 0x2008], al
mov ecx, 0x7ff
xor eax, eax
lea edi, [ebp - 0x2007]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00452e2c
test eax, eax
pop edi
je 0x40c148
cmp eax, 0x1fff
ja 0x40c148
lea ecx, [ebp - 0x2008]
push ecx
push eax
push 0
push dword [ebp + 8]
call fcn.00452e26
test eax, eax
je 0x40c148
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2008]
push 0x471c64
push eax
call fcn.00452e20
test eax, eax
je 0x40c148
push esi
mov esi, dword [ebp + 0x10]
push esi
push 0
push dword [ebp + 0xc]
call fcn.00452e6c
mov eax, dword [ebp + 8]
add esp, 0xc
movzx ecx, word [eax + 0xc]
push ecx
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
push ecx
movzx ecx, word [eax + 8]
mov eax, dword [eax + 8]
push ecx
shr eax, 0x10
push eax
dec esi
push str._d._d._d._d
push esi
push dword [ebp + 0xc]
call fcn.0040de19
add esp, 0x1c
push 1
pop eax
pop esi
leave
ret
xor eax, eax
leave
ret

Function at 0x40c14c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.00452e80
mov al, byte [0x47c4d0]
push edi
mov byte [ebp - 0x2008], al
mov ecx, 0x7ff
xor eax, eax
lea edi, [ebp - 0x2007]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00452e2c
test eax, eax
pop edi
je 0x40c1da
cmp eax, 0x1fff
ja 0x40c1da
lea ecx, [ebp - 0x2008]
push ecx
push eax
push 0
push dword [ebp + 8]
call fcn.00452e26
test eax, eax
je 0x40c1da
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2008]
push 0x471c64
push eax
call fcn.00452e20
test eax, eax
je 0x40c1da
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push 1
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
pop eax
leave
ret
xor eax, eax
leave
ret

Function at 0x40c2e7
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov al, byte [0x47c4d0]
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0x1f
mov byte [ebp - 0x80], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x7f]
push dword [ebx + 8]
rep stosd dword es:[edi], eax
push dword [ebx + 4]
mov ecx, ebx
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040dfd9
lea eax, [ebp - 0x80]
push 0x100
push eax
call fcn.00453170
lea eax, [ebp - 0x80]
push eax
call fcn.0045316a
mov esi, eax
test esi, esi
jne 0x40c339
xor al, al
jmp 0x40c35b
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x40c359
xor edi, edi
push eax
mov ecx, ebx
call fcn.0043e2b6
mov eax, dword [esi + 0xc]
add edi, 4
mov eax, dword [edi + eax]
test eax, eax
jne 0x40c344
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c3f3
Capabilities:
Get networking parameters

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, 0x248
push edi
mov edi, dword [0x4641f4]
push esi
push 0x40
call edi
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
mov dword [ebp - 4], esi
call fcn.00453146
cmp eax, 0x6f
jne 0x40c432
push ebx
call dword [0x4641fc]
push dword [ebp - 4]
push 0x40
call edi
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00453146
test eax, eax
jne 0x40c46a
lea esi, [ebx + 0x10c]
test esi, esi
je 0x40c46a
lea eax, [esi + 4]
push eax
call fcn.0040c360
test al, al
pop ecx
jne 0x40c45c
mov esi, dword [esi]
jmp 0x40c446
mov ecx, dword [ebp + 8]
add esi, 4
push esi
call fcn.0040dd31
jmp 0x40c477
mov ecx, dword [ebp + 8]
push 0x47be6c
call fcn.004026c2
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40c47f
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
lea eax, [ebp - 0x130]
push esi
push eax
mov dword [ebp - 0x130], 0x114
call dword [0x464214]
xor esi, esi
cmp dword [ebp - 0x120], 2
jne 0x40c4f9
call dword [0x464220]
lea ecx, [ebp - 4]
push ecx
push 0x20
push eax
call dword [0x464044]
lea eax, [ebp - 0xc]
push eax
push str.SeShutdownPrivilege
push esi
call dword [0x46403c]
mov eax, dword [ebp - 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 0x1c]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [0x464040]
push esi
push dword [ebp + 8]
call dword [0x4644c8]
pop esi
leave
ret
Function at 0x40d94c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
push ebx
push esi
mov esi, 0x114
lea eax, [ebp - 0x11c]
push esi
push 0
mov ebx, ecx
push eax
call fcn.00452e6c
add esp, 0xc
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], esi
push eax
call dword [0x464214]
cmp dword [ebp - 0x118], 8
jb 0x40d993
push 1
jmp 0x40da54
mov ax, word [0x47be6c]
push edi
mov word [ebp - 0x324], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x322]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 4]
push eax
push str.Test
push str.SYSTEMCurrentControlSetServicesPacketParameters
push 0x80000002
mov dword [ebp - 4], 1
call dword [0x464438]
test eax, eax
pop edi
jne 0x40da0e
push str.Hello
call fcn.00452f0c
shl eax, 1
push eax
lea eax, [ebp - 0x324]
push 0x472290
push eax
call fcn.00452f06
add esp, 0x10
test eax, eax
je 0x40da21
call fcn.0043c591
mov ecx, ebx
call fcn.0040db97
mov ecx, ebx
call fcn.0040da59
call fcn.0043c508
test eax, eax
jne 0x40da52
mov ecx, ebx
call fcn.0040da59
call fcn.0043c508
xor esi, esi
call fcn.0043c508
test eax, eax
jne 0x40da52
push 0xc8
call dword [0x4641b8]
inc esi
cmp esi, 5
jl 0x40da38
push 3
pop eax
pop esi
pop ebx
leave
ret

Function at 0x41013f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
add ecx, 0xffffffe4
push edi
mov edi, dword [0x4645c0]
mov dword [ebp - 4], 1
neg esi
sbb esi, esi
and esi, ecx
cmp dword [ebp + 0x14], 0
je 0x4101c9
push ebx
push dword [ebp + 8]
push dword [esi + 4]
call edi
push eax
mov dword [ebp - 8], eax
call dword [0x464508]
mov ecx, dword [ebp + 0xc]
or dword [ebp + 0x14], 0xffffffff
mov ebx, eax
push ebx
call fcn.00402d86
test eax, eax
mov eax, dword [ebp + 0xc]
je 0x4101bd
mov ecx, dword [eax]
mov dword [ecx - 8], ebx
mov ecx, dword [eax]
and word [ecx + ebx*2], 0
mov ecx, dword [eax]
test ecx, ecx
je 0x4101bd
lea eax, [ebx + 1]
push eax
push ecx
push dword [ebp - 8]
call dword [0x4644f4]
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
mov dword [ebp + 0x14], eax
call fcn.00402df8
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x14], ebx
pop ebx
jge 0x410208
and dword [ebp - 4], 0
jmp 0x4101e1
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
push dword [esi + 4]
call dword [0x4644dc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x410241
push 0xffffffffffffffff
add esi, 0x1c
call dword [0x4644f0]
push dword [ebp + 8]
mov eax, esi
add esi, 0xffffffe4
neg eax
sbb eax, eax
and eax, esi
push dword [eax + 4]
call edi
push eax
call dword [0x4644ec]
jmp 0x410241
cmp dword [ebp + 0x18], 0
je 0x410241
mov eax, dword [eax]
mov eax, dword [eax - 8]
cmp eax, dword [ebp + 0x1c]
jle 0x410241
push 0xffffffffffffffff
add esi, 0x1c
call dword [0x4644f0]
push dword [ebp + 8]
mov eax, esi
add esi, 0xffffffe4
neg eax
sbb eax, eax
and eax, esi
push dword [eax + 4]
call edi
push eax
call dword [0x4644ec]
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 0x18
Function at 0x410fed
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
mov eax, dword [esi]
test eax, eax
je 0x411008
push eax
call dword [0x4643f8]
and dword [esi], 0
push dword [ebx]
call dword [0x464508]
test eax, eax
jne 0x41101b
push 0x47be6c
jmp 0x411041
lea edi, [eax + 1]
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.00452e80
mov dword [ebp + 8], esp
push edi
push dword [ebp + 8]
push dword [ebx]
call dword [0x4644f4]
test eax, eax
je 0x411052
push dword [ebp + 8]
call dword [0x4643fc]
xor ecx, ecx
mov dword [esi], eax
test eax, eax
setne cl
mov eax, ecx
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x417724
Capabilities:
Hide graphical window
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 0x18], 0
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x1c], 0xc
lea ecx, [ebx + 0x2d4]
call fcn.0041795b
test eax, eax
jne 0x41782d
push 0x471898
push dword [ebx + 0x278]
call dword [0x464570]
push 0x400
mov dword [ebp - 0x14], 0x8000
push dword [ebx + 4]
call dword [0x4645c0]
sub esp, 0x10
lea esi, [ebp - 0x1c]
mov edi, esp
lea ecx, [ebx + 0x27c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0043eed9
mov esi, dword [0x4645c0]
push 0x400
push dword [ebx + 4]
call esi
push 0x472e1c
push eax
call dword [0x464570]
push 0x402
mov dword [ebp - 0x18], 1
push dword [ebx + 4]
mov dword [ebp - 0x1c], 0xe
mov dword [ebp - 0x14], 0x8000
call esi
sub esp, 0x10
lea esi, [ebp - 0x1c]
mov edi, esp
lea ecx, [ebx + 0x27c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0043eed9
mov esi, dword [0x4645c0]
push 0x402
push dword [ebx + 4]
call esi
push 0x471848
push eax
call dword [0x464570]
push 0x424
push dword [ebx + 4]
call esi
mov edi, dword [0x464588]
push 5
push eax
call edi
push 0x425
push dword [ebx + 4]
call esi
push 0
push eax
call edi
mov dword [ebx + 0x274], 1
jmp 0x417905
push 0x47183c
push dword [ebx + 0x278]
call dword [0x464570]
push 0x400
mov dword [ebp - 0x14], 0x35da
push dword [ebx + 4]
call dword [0x4645c0]
sub esp, 0x10
lea esi, [ebp - 0x1c]
mov edi, esp
lea ecx, [ebx + 0x27c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0043eed9
mov esi, dword [0x4645c0]
push 0x400
push dword [ebx + 4]
call esi
push 0x472dd8
push eax
call dword [0x464570]
push 0x402
mov dword [ebp - 0x18], 1
push dword [ebx + 4]
mov dword [ebp - 0x1c], 0xe
mov dword [ebp - 0x14], 0x35da
call esi
sub esp, 0x10
lea esi, [ebp - 0x1c]
mov edi, esp
lea ecx, [ebx + 0x27c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0043eed9
mov esi, dword [0x4645c0]
push 0x402
push dword [ebx + 4]
call esi
push 0x4717f8
push eax
call dword [0x464570]
push 0x424
push dword [ebx + 4]
call esi
mov edi, dword [0x464588]
push 0
push eax
call edi
push 0x425
push dword [ebx + 4]
call esi
push 5
push eax
call edi
and dword [ebx + 0x274], 0
push 4
mov dword [ebp - 4], 1
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x472db0
push str.SOFTWARE360Safe_safemon
push 0x80000002
call dword [0x464438]
xor ecx, ecx
lea eax, [ebx + 0x2d0]
cmp dword [ebp - 4], ecx
push 0
push eax
push 0x45f
setne cl
mov dword [eax], ecx
lea ecx, [ebx + 0x68]
call fcn.00416d44
pop edi
pop esi
pop ebx
leave
ret