joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4326c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4327a6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4fabd4], 0
jne 0x43277d
mov dword [0x4fabd4], 0x94
push 0x4fabd4
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [0x4fabd8], 6
jb 0x43277d
cmp dword [0x4fabdc], 3
jb 0x43277d
push 0x4327bc
lea eax, [ebp - 8]
call fcn.00432644
push dword [ebp - 8]
push 0x4327bc
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404dd4
push 0
push 0
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x43f5a4]
call fcn.0043fb60
mov dword [0x4fabd8], eax
push 0
push 0
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [0x43f5a4]
call fcn.0043fb60
mov dword [0x4fabdc], eax
push 0
push 0
mov ecx, 2
mov edx, dword [ebp - 4]
mov eax, dword [0x43f5a4]
call fcn.0043fb60
mov dword [0x4fabe0], eax
mov edi, ebx
mov esi, 0x4fabd4
mov ecx, 0x25
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4327ad
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a78
ret

Function at 0x433824
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x433898
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404cc4
mov eax, dword [ebp - 0x10c]
mov ecx, esi
mov edx, ebx
call fcn.004336b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43389f
lea eax, [ebp - 0x10c]
call fcn.00404a54
ret

Function at 0x4338a8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43391c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404cc4
mov eax, dword [ebp - 0x10c]
mov ecx, esi
mov edx, ebx
call fcn.004336b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433923
lea eax, [ebp - 0x10c]
call fcn.00404a54
ret

Function at 0x43392c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4339a0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.KERNEL32.DLL_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404cc4
mov eax, dword [ebp - 0x10c]
mov ecx, esi
mov edx, ebx
call fcn.004336b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4339a7
lea eax, [ebp - 0x10c]
call fcn.00404a54
ret

Function at 0x43512c
Capabilities:
Shutdown system

Disassembly:
call fcn.004350a4
test al, al
je 0x43513e
push 0
push 2
call sub.user32.dll_ExitWindowsEx
ret
Function at 0x4359f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f04
mov eax, dword [ebp - 8]
call fcn.00404f04
mov eax, dword [ebp - 0xc]
call fcn.00404f04
xor eax, eax
push ebp
push 0x435ad4
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00435714
mov ebx, 0x2001f
cmp byte [ebp + 0xc], 0
je 0x435a45
or ebx, 0x100
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
push 0
push 0x435ae4
push 0
mov eax, dword [ebp - 4]
call fcn.00404f14
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x435ab2
mov eax, dword [ebp - 0xc]
call fcn.00404f14
mov ebx, eax
mov eax, dword [ebp - 0xc]
call fcn.00404d14
inc eax
test eax, eax
jns 0x435a8d
call fcn.00403b80
push eax
push ebx
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404f14
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
test ebx, ebx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435adb
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a78
ret

Function at 0x435ae8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f04
mov eax, dword [ebp - 8]
call fcn.00404f04
xor eax, eax
push ebp
push 0x435bac
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00435714
mov ebx, 0x2001f
cmp byte [ebp + 0xc], 0
je 0x435b35
or ebx, 0x100
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
push 0
push 0x435bbc
push 0
mov eax, dword [ebp - 4]
call fcn.00404f14
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x435b8a
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404f14
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
test ebx, ebx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435bb3
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a78
ret
Function at 0x435c50
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x418], ebx
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f04
xor eax, eax
push ebp
push 0x435daa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404a54
lea ecx, [ebp - 4]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00435714
mov esi, 0x20019
test bl, bl
je 0x435cab
or esi, 0x100
lea eax, [ebp - 8]
push eax
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.00404f14
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x435d84
xor eax, eax
push ebp
push 0x435d7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x435dc0
call fcn.00404aa8
xor esi, esi
mov dword [ebp - 0x10], 0x401
jmp 0x435d23
push dword [edi]
lea edx, [ebp - 0x418]
lea eax, [ebp - 0x411]
call fcn.0040aa60
push dword [ebp - 0x418]
push 0x435dc0
mov eax, edi
mov edx, 3
call fcn.00404dd4
mov dword [ebp - 0x10], 0x401
inc esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x411]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
je 0x435cf1
lea eax, [ebp - 0x41c]
push eax
mov edx, dword [edi]
xor ecx, ecx
mov eax, dword [0x43f5a4]
call fcn.00440a2c
mov edx, dword [ebp - 0x41c]
mov eax, edi
call fcn.00404aa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435d84
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435db1
lea eax, [ebp - 0x41c]
mov edx, 2
call fcn.00404a78
lea eax, [ebp - 4]
call fcn.00404a54
ret

Function at 0x435dc4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f04
mov eax, dword [ebp - 8]
call fcn.00404f04
xor eax, eax
push ebp
push 0x435e78
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea ecx, [ebp - 4]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00435714
mov esi, 0x20019
cmp byte [ebp - 9], 0
je 0x435e14
or esi, 0x100
lea eax, [ebp - 0x10]
push eax
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.00404f14
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x435e5d
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404f14
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435e7f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a78
ret
Function at 0x435e88
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f04
mov eax, dword [ebp - 8]
call fcn.00404f04
xor eax, eax
push ebp
push 0x435f63
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 0xc]
lea ecx, [ebp - 4]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00435714
mov ebx, 0x20019
cmp byte [ebp + 8], 0
je 0x435eda
or ebx, 0x100
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00404f14
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x435f48
xor edx, edx
push ebp
push 0x435f3b
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404f14
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x435f31
mov esi, dword [ebp - 0x18]
test esi, esi
jns 0x435f31
call fcn.00403b80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x435f48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435f6a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a78
ret
Function at 0x435f78
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x435f81
mov eax, dword [ebp - 4]
add esp, 0xfffff7dc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x2828], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404f04
mov eax, dword [ebp - 8]
call fcn.00404f04
mov eax, dword [ebp - 0xc]
call fcn.00404f04
xor eax, eax
push ebp
push 0x436148
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.00404aa8
lea ecx, [ebp - 4]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00435714
mov ebx, 0x20019
cmp byte [ebp + 0xc], 0
je 0x435ff9
or ebx, 0x100
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00404f14
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x436122
xor edx, edx
push ebp
push 0x43611b
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x20], 0x2801
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2821]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404f14
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x436104
cmp dword [ebp - 0x1c], 4
jne 0x436089
cmp dword [ebp - 0x20], 4
jne 0x436089
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x2821]
mov ecx, 4
call fcn.00402950
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, esi
call fcn.0040990c
jmp 0x436104
cmp dword [ebp - 0x1c], 7
jne 0x4360f7
cmp dword [ebp - 0x20], 2
jle 0x4360f7
jmp 0x43609a
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0
jle 0x4360ba
mov eax, dword [ebp - 0x20]
dec eax
cmp eax, 0x2800
jbe 0x4360b0
call fcn.00403b80
cmp byte [ebp + eax - 0x2821], 0
je 0x436097
lea edx, [ebp - 0x2821]
mov eax, esi
mov ecx, dword [ebp - 0x20]
call fcn.00404b44
push 0
push 0
push 0
lea eax, [ebp - 0x2828]
push eax
mov eax, dword [esi]
mov ecx, 0x436160
mov edx, 0x43616c
call fcn.00431d28
mov edx, dword [ebp - 0x2828]
mov eax, esi
call fcn.00404aa8
jmp 0x436104
mov edx, esi
lea eax, [ebp - 0x2821]
call fcn.0040aa60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436122
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43614f
lea eax, [ebp - 0x2828]
call fcn.00404a54
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a78
ret
Function at 0x4361fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 5
add esp, 0xfffff004
push eax
dec eax
jne 0x436205
mov eax, dword [ebp - 4]
add esp, 0xffffffd4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x502c], ebx
mov dword [ebp - 0x5030], ebx
mov dword [ebp - 0x5028], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.004054f8
lea eax, [ebp - 8]
call fcn.004054f8
lea eax, [ebp - 0xc]
call fcn.004054f8
xor eax, eax
push ebp
push 0x436405
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.004051c4
lea ecx, [ebp - 4]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00435810
mov ebx, 0x20019
cmp byte [ebp + 0xc], 0
je 0x436286
or ebx, 0x100
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00405318
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x4363da
xor edx, edx
push ebp
push 0x4363d3
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x20], 0x5002
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x5022]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00405318
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4363bc
cmp dword [ebp - 0x1c], 4
jne 0x43632a
cmp dword [ebp - 0x20], 4
jne 0x43632a
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x5022]
mov ecx, 4
call fcn.00402950
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5028]
call fcn.0040990c
mov edx, dword [ebp - 0x5028]
mov eax, esi
call fcn.00405308
jmp 0x4363bc
cmp dword [ebp - 0x1c], 7
jne 0x4363aa
cmp dword [ebp - 0x20], 2
jle 0x4363aa
jmp 0x43633b
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0
jle 0x43635c
mov eax, dword [ebp - 0x20]
dec eax
cmp eax, 0x2800
jbe 0x436351
call fcn.00403b80
cmp word [ebp + eax*2 - 0x5022], 0
je 0x436338
lea edx, [ebp - 0x5022]
mov eax, esi
mov ecx, dword [ebp - 0x20]
call fcn.0040527c
push 0
push 0
push 0
lea eax, [ebp - 0x502c]
push eax
lea eax, [ebp - 0x5030]
mov edx, dword [esi]
call fcn.00404cdc
mov eax, dword [ebp - 0x5030]
mov ecx, 0x43641c
mov edx, 0x436428
call fcn.00431d28
mov edx, dword [ebp - 0x502c]
mov eax, esi
call fcn.00405308
jmp 0x4363bc
mov eax, esi
lea edx, [ebp - 0x5022]
mov ecx, 0x2801
call fcn.004052ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4363da
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43640c
lea eax, [ebp - 0x5030]
mov edx, 3
call fcn.00404a78
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004051a0
ret
Function at 0x43642c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f04
mov eax, dword [ebp - 8]
call fcn.00404f04
xor eax, eax
push ebp
push 0x4364fc
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00435714
mov esi, 0xf003f
test bl, bl
je 0x436477
or esi, 0x100
lea eax, [ebp - 0x10]
push eax
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.00404f14
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4364da
xor eax, eax
push ebp
push 0x4364d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00404f14
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4364da
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
ret
cmp dword [ebp - 0xc], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436503
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a78
ret

Function at 0x43650c
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f04
mov eax, dword [ebp - 8]
call fcn.00404f04
xor eax, eax
push ebp
push 0x436628
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00435714
mov esi, 0xf003f
test bl, bl
je 0x436557
or esi, 0x100
lea eax, [ebp - 0x10]
push eax
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.00404f14
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x436606
xor eax, eax
push ebp
push 0x4365ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 1
test bl, bl
je 0x4365cd
mov edx, 0x436640
mov eax, 0x436658
call fcn.0042f848
mov ebx, eax
test ebx, ebx
je 0x4365c6
push 0
push pe_nt_image_headers32
mov eax, dword [ebp - 8]
call fcn.00404f14
push eax
mov eax, dword [ebp - 0x10]
push eax
call ebx
mov dword [ebp - 0xc], eax
jmp 0x4365cd
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
je 0x4365e8
mov eax, dword [ebp - 8]
call fcn.00404f14
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegDeleteKeyA
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436606
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
ret
cmp dword [ebp - 0xc], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43662f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404a78
ret
Function at 0x436824
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x43682d
mov eax, dword [ebp - 4]
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x800c], ebx
mov dword [ebp - 0x8010], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x43697e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4fea20
call sub.KERNEL32.DLL_EnterCriticalSection
mov eax, dword [ebp + 8]
mov edx, edi
call fcn.00404aa8
test ebx, ebx
je 0x436956
test esi, esi
je 0x436956
xor eax, eax
push ebp
push 0x436916
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404f14
push eax
push 0x8001
lea eax, [ebp - 0x8005]
push eax
mov eax, edi
call fcn.00404f14
push eax
mov eax, esi
call fcn.00404f14
push eax
mov eax, ebx
call fcn.00404f14
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringA
test eax, eax
jns 0x4368d3
call fcn.00403b80
mov ebx, eax
test ebx, ebx
jle 0x4368e9
lea edx, [ebp - 0x8005]
mov eax, dword [ebp + 8]
mov ecx, ebx
call fcn.00404b44
cmp ebx, 0x2800
jle 0x43690c
mov eax, dword [0x4fdb88]
mov edx, 0x436998
call fcn.00405130
mov edx, ebx
call fcn.004033e8
call fcn.00403450
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x436956
push 0x4fea20
call sub.KERNEL32.DLL_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436985
lea eax, [ebp - 0x8010]
mov edx, 2
call fcn.00404a78
ret

Function at 0x436acc
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x436b47
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404a54
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x436b2e
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.0040aa60
mov eax, dword [ebp - 0x108]
mov edx, ebx
call fcn.00409500
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436b4e
lea eax, [ebp - 0x108]
call fcn.00404a54
ret

Function at 0x436b54
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x436bcf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404a54
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
test eax, eax
je 0x436bb6
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.0040aa60
mov eax, dword [ebp - 0x108]
mov edx, ebx
call fcn.00409500
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436bd6
lea eax, [ebp - 0x108]
call fcn.00404a54
ret
Function at 0x436dd8
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x436ed4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.00404f14
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404f14
mov edi, eax
push edi
push 0
call sub.advapi32.dll_LookupAccountNameA
mov edx, dword [ebp - 8]
inc edx
mov eax, ebx
call fcn.004050a0
mov eax, dword [ebp - 4]
call fcn.0040922c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x436eb7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.00404f14
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
push edi
push 0
call sub.advapi32.dll_LookupAccountNameA
test eax, eax
je 0x436e9a
mov eax, dword [ebx]
call fcn.00404f14
lea edx, [ebp - 0x14]
call fcn.0040aa60
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00404aa8
jmp 0x436ea1
mov eax, ebx
call fcn.00404a54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436ebe
mov eax, dword [ebp - 0xc]
call fcn.00402774
ret

Function at 0x436f74
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push eax
mov eax, 0x19
add esp, 0xfffff004
push eax
dec eax
jne 0x436f7c
mov eax, dword [esp + 0x19000]
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00404a54
test ebx, ebx
je 0x436fbe
push 0x19001
lea eax, [esp + 4]
push eax
test ebx, ebx
jns 0x436faf
call fcn.00403b80
push ebx
call sub.user32.dll_GetWindowTextA
mov edx, esi
mov eax, esp
call fcn.0040aa60
add esp, 0x19004
pop esi
pop ebx
ret

Function at 0x4371f0
Capabilities:
Get memory capacity

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov dword [esp + 8], 0x20
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GlobalMemoryStatus
call fcn.0043712c
mov dword [esp], eax
mov dword [esp + 4], edx
cmp dword [esp + 4], 0
jne 0x43722e
cmp dword [esp], 0
jne 0x43722e
mov eax, dword [esp + 0x10]
xor edx, edx
mov dword [esp], eax
mov dword [esp + 4], edx
cmp bl, 1
jne 0x43724e
push 0
push 0x400
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00405b00
mov dword [esp], eax
mov dword [esp + 4], edx
cmp bl, 2
jne 0x43726e
push 0
push 0x100000
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00405b00
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0x28
pop ebx
ret