joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4729a0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e60
call fcn.0048dcd0
mov eax, dword [esp + 0x8e68]
push ebx
push ebp
mov ebp, dword [esp + 0x8e6c]
push esi
mov esi, ecx
mov cl, byte [edx]
xor ebx, ebx
cmp cl, 0x41
je 0x4729cb
cmp cl, 0x61
jne 0x472a1c
cmp byte [edx + 1], bl
jne 0x472a1c
cmp byte [edi], bl
jne 0x472a1c
cmp byte [eax], bl
jne 0x472a1c
cmp byte [esi], bl
jne 0x472a1c
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x4729fd
cmp byte [ebp + 0xc6], bl
jne 0x4729fd
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4729fd
xor esi, esi
cmp byte [esp + 0x8e7c], bl
je 0x472a10
cmp esi, ebx
je 0x472a10
mov dword [ebp + 0xa0], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
cmp cl, bl
jne 0x472a3d
cmp byte [edi], bl
jne 0x472a3d
cmp byte [eax], bl
jne 0x472a3d
cmp byte [esi], bl
jne 0x472a3d
mov eax, ebp
call fcn.00472b90
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
push esi
push edi
push edx
push ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x828], 0x4957f9
mov byte [esp + 0xc45], bl
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc50], ebx
mov dword [esp + 0xc54], ebx
mov dword [esp + 0xc58], ebx
mov dword [esp + 0xc5c], ebx
mov dword [esp + 0xc68], ebx
mov dword [esp + 0xc6c], ebx
call fcn.00473630
test eax, eax
je 0x472b4e
test byte [esp + 0xc], 2
mov al, byte [esp + 0x8e78]
mov ecx, dword [esp + 0x8e80]
mov edx, dword [esp + 0x8e84]
mov byte [esp + 0xc35], al
mov dword [esp + 0xc44], ecx
mov dword [esp + 0xc48], edx
je 0x472b5a
mov eax, dword [esp + 0x828]
cmp eax, 0xffff
je 0x472b26
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x472b4e
cmp byte [ebp + 0xc6], bl
jne 0x472b1f
mov eax, dword [esp + 0x828]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x472b1f
mov ecx, dword [esp + 0x828]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
je 0x472b4e
mov eax, dword [esp + 0x828]
cmp dword [esp + 0xc5c], eax
je 0x472b3f
lea esi, [esp + 0xc]
mov dword [esp + 0xc5c], eax
call fcn.00473a70
push ebx
lea edx, [esp + 0x10]
push edx
call fcn.00473b30
test eax, eax
jne 0x472b6a
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
lea eax, [esp + 0xc]
push eax
push 0x472c00
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0xc3c]
cmp byte [esp + 0x8e7c], bl
je 0x472b84
cmp eax, ebx
je 0x472b84
mov dword [ebp + 0xa0], eax
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
Function at 0x472d70
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x8018
call fcn.0048dcd0
push ebx
push ebp
mov ebp, dword [esp + 0x8028]
push esi
push edi
mov edi, dword [esp + 0x802c]
mov esi, ecx
test edi, edi
je 0x472d99
mov ecx, edi
call fcn.00412600
cmp dword [esp + 0x8038], 0
jne 0x472dae
mov dword [esp + 0x8038], 0x1f4
cmp dword [esp + 0x803c], 1
jge 0x472dc3
mov dword [esp + 0x803c], 0x32
cmp ebp, 1
jge 0x472dcd
mov ebp, 1
test esi, esi
je 0x472f9a
mov ebx, dword [sym.imp.USER32.dll_SendMessageTimeoutA]
lea eax, [esp + 0x20]
push eax
push 0x7d0
push 2
push 0
push 0
push 0x406
push esi
call ebx
test eax, eax
je 0x472f9a
cmp ebp, dword [esp + 0x20]
jg 0x472f9a
push 0x8000
xor eax, eax
mov ecx, esi
lea edi, [esp + 0x1c]
call fcn.0046ffe0
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
test edi, edi
je 0x472f93
dec ebp
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x24], eax
jmp 0x472e40
lea ecx, [esp + 0x14]
push ecx
push 0x7d0
push 2
push 0
push ebp
push 0x403
push esi
call ebx
test eax, eax
je 0x472eb7
mov edx, 0x7fff
cmp word [esp + 0x14], dx
ja 0x472f0e
lea eax, [esp + 0x14]
push eax
push 0x7d0
push 2
push edi
push ebp
push 0x402
push esi
call ebx
test eax, eax
je 0x472eb7
movzx ecx, word [esp + 0x14]
mov eax, dword [esp + 0x18]
push 0
inc ecx
push ecx
lea edx, [esp + 0x30]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x472f09
mov edx, dword [esp + 0x8034]
lea eax, [esp + 0x28]
call fcn.00472300
test al, al
jne 0x472f34
cmp dword [esp + 0x802c], 0
jne 0x472f18
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x472f67
mov edi, dword [esp + 0x8038]
test edi, edi
js 0x472eee
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x24]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x472f4c
mov edx, dword [esp + 0x803c]
push 1
push edx
call fcn.00401280
mov edi, dword [esp + 0x24]
add esp, 8
jmp 0x472e40
mov byte [esp + 0x28], 0
cmp dword [esp + 0x802c], 0
je 0x472f67
mov eax, dword [esp + 0x802c]
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x34]
push edx
push eax
call fcn.004715e0
mov esi, eax
jmp 0x472f6c
mov eax, dword [0x4a7474]
push 1
push 0
push 0xffffffffffffffff
push 0x495870
push eax
call fcn.004715e0
jmp 0x472f0e
mov ecx, dword [0x4a7474]
push 1
push 0
push 0xffffffffffffffff
push 0x496ed0
push ecx
call fcn.004715e0
mov edi, dword [esp + 0x1c]
mov esi, 1
push 0x8000
push 0
push edi
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
mov edi, dword [esp + 0x802c]
mov eax, 0x496ed0
test edi, edi
jne 0x472fa8
mov eax, 0x497018
mov ecx, dword [0x4a3440]
cmp byte [ecx + 0xe4], 0
jne 0x472fd5
mov edx, dword [0x4a7474]
push 1
push 0
push 0xffffffffffffffff
push eax
push edx
call fcn.004715e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
mov ecx, dword [0x4a9048]
push 0x4957f9
push 0
push eax
call fcn.0042cd10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
Function at 0x473a70
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0xc50]
test ecx, ecx
je 0x473b27
mov eax, dword [esi]
test eax, eax
je 0x473b27
push edi
test al, 1
jne 0x473a99
mov eax, dword [esi + 0x80c]
cmp byte [eax], 0
je 0x473ab2
push 0x7fff
lea edi, [esi + 0xc58]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jne 0x473ab2
mov byte [edi], al
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x473acd
mov edx, dword [esi + 0xc50]
lea ecx, [esi + 0xc54]
push ecx
push edx
call edi
test byte [esi], 0x20
je 0x473b08
mov ecx, dword [esi + 0xc50]
lea eax, [esp + 4]
push eax
push ecx
call edi
test eax, eax
je 0x473b08
movzx edx, byte [esi + 0xc28]
mov ecx, dword [esp + 4]
push edx
lea eax, [esi + 0x8d58]
call fcn.0044ca80
add esp, 4
test eax, eax
jne 0x473b08
mov byte [esi + 0x8d58], al
test byte [esi], 8
pop edi
je 0x473b27
mov ecx, dword [esi + 0xc50]
push 0x101
lea eax, [esi + 0x8c57]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
pop ecx
ret

Function at 0x4741b0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e5c
call fcn.0048dcd0
mov eax, dword [esp + 0x8e60]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x47425d
mov dword [esp + 0xc44], eax
lea eax, [esp + 4]
push eax
push 0x4748e0
mov dword [esp + 0xc], ebx
mov dword [esp + 0x818], 0x4957f9
mov byte [esp + 0xc35], bl
mov dword [esp + 0xc38], ebx
mov dword [esp + 0xc3c], ebx
mov dword [esp + 0xc40], ebx
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc58], ebx
mov dword [esp + 0xc5c], ebx
mov byte [esp + 0xc50], cl
mov dword [esp + 0xc54], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0xc34], ebx
je 0x47425d
mov ecx, dword [0x4a3440]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x47425d
push 1
push eax
call fcn.00401280
add esp, 8
mov eax, 1
pop ebx
add esp, 0x8e5c
ret 4
Function at 0x474270
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x47428c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4a3440]
push eax
push esi
mov ecx, edi
call fcn.00474720
cmp byte [edi], 0
mov dword [esp + 0x10], eax
je 0x4742c3
test eax, eax
jne 0x4742c7
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push edi
call fcn.00474380
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x474346
test esi, esi
je 0x474346
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.00401280
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x474325
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x474325
push 1
push 0x8000012f
call fcn.00401280
add esp, 8
push esi
call edi
test eax, eax
jne 0x474300
mov edx, dword [0x4a3440]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x47433e
push 1
push eax
call fcn.00401280
add esp, 8
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x474360
mov ecx, dword [esp + 0x1c]
push 0
push ecx
push edi
call fcn.00474380
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x1c]
push edx
mov ecx, edi
call fcn.004744f0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x4744f0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e68
call fcn.0048dcd0
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x474670
xor cl, cl
mov eax, edi
call fcn.00474690
test eax, eax
jne 0x474525
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4a3440]
push eax
push ebp
mov ecx, edi
call fcn.00474720
test eax, eax
je 0x474548
xor eax, eax
mov dword [0x4a8c78], eax
jmp 0x47454d
mov eax, dword [0x4a8c78]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x824], 0x4957f9
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc64], ebx
mov dword [esp + 0xc68], ebx
cmp byte [esp + 0x8e7c], bl
je 0x474593
mov byte [esp + 0xc41], bl
cmp eax, ebx
je 0x47459b
mov byte [esp + 0xc41], 1
mov ecx, dword [0x4a8c74]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0xc54], eax
lea eax, [esp + 0x18]
push eax
push 0x4747f0
mov dword [esp + 0xc58], ecx
mov dword [esp + 0xc60], edx
call esi
mov eax, dword [esp + 0xc48]
cmp eax, ebx
je 0x474648
lea ecx, [esp + 0x10]
push ecx
push 0x473440
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x474605
mov edx, dword [esp + 0xc48]
call fcn.00473ec0
mov dword [esp + 0xc48], esi
mov eax, dword [esp + 0xc48]
call fcn.00472490
mov edx, dword [esp + 0xc48]
call fcn.00473ec0
mov edx, dword [0x4a3440]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x474670
push 1
push eax
call fcn.00401280
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
mov eax, dword [0x4a8c78]
cmp eax, ebx
je 0x474670
cmp eax, 1
setg al
mov dword [0x4a8c78], ebx
cmp al, bl
je 0x474670
mov edx, ebp
call fcn.00473ec0
push ebx
mov ecx, edi
call fcn.004744f0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x8e68
ret 4
Function at 0x4885e4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a2d90]
jne 0x4885ee
repz ret
jmp fcn.0048cf17

Function at 0x48af64
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a2d90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00485602
and dword [ebp - 0x14], 0
cmp dword [0x4a54b4], 0
mov dword [ebp - 0x18], eax
jne 0x48b017
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x48b0bf
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x48b0bf
mov esi, dword [fcn.004812d0]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4a54b4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4a54b8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4a54bc], eax
call edi
push eax
call esi
mov dword [0x4a54c4], eax
test eax, eax
je 0x48b017
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4a54c0], eax
mov eax, dword [0x4a54c0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.004812d4]
cmp eax, ecx
je 0x48b070
cmp dword [0x4a54c4], ecx
je 0x48b070
push eax
call esi
push dword [0x4a54c4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x48b070
test ebx, ebx
je 0x48b070
call edi
test eax, eax
je 0x48b067
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x48b067
test byte [ebp - 8], 1
jne 0x48b070
or dword [ebp + 0x10], 0x200000
jmp 0x48b0a3
mov eax, dword [0x4a54b8]
cmp eax, dword [ebp - 0x18]
je 0x48b0a3
push eax
call esi
test eax, eax
je 0x48b0a3
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x48b0a3
mov eax, dword [0x4a54bc]
cmp eax, dword [ebp - 0x18]
je 0x48b0a3
push eax
call esi
test eax, eax
je 0x48b0a3
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4a54b4]
call esi
test eax, eax
je 0x48b0bf
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x48b0c1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004885e4
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x403e59
pop dword [ebp - 0x34]
mov eax, 0x29ba2d27
sub eax, 0x2979eece
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xb94300b5
sub dword [ebp - 0x44], 0x6af0bb6a
mov dword [ebp - 0x40], 0xbdd06503
sub dword [ebp - 0x40], 0x8b9d18be
mov dword [ebp - 0x3c], 0xb4cb949f
sub dword [ebp - 0x3c], 0x687f5071
mov dword [ebp - 0x38], 0x423343f0
sub dword [ebp - 0x38], 0x423343f0
lea eax, [ebp - 0x44]
push eax
mov eax, 0x2a96c6e0
sub eax, 0x2a564654
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x639f1c45
sub dword [ebp - 0x44], 0xef2cb2ef
mov dword [ebp - 0x40], 0x20939b19
add dword [ebp - 0x40], 0x20d8c65c
mov dword [ebp - 0x3c], 0x18b08af1
sub dword [ebp - 0x3c], 0xb5411e85
mov dword [ebp - 0x38], 0x15ca5a29
sub dword [ebp - 0x38], 0x15ca5a29
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x320f1
push 0
call eax
mov ecx, 0xda9104b9
sub ecx, 0xda90cf7a
mov esi, eax
mov edx, 0xc5f9ae94
sub edx, 0xc5b89e94
add edx, dword [ebp - 0x34]
mov ebx, 0x4d2269a9
add ebx, 0x59574309
add dword [ebp - 0x20], eax
mov edi, dword [edx]
xor dword [ebp - 0x30], esi
add edi, ebx
add dword [ebp - 4], ecx
mov dword [esi], edi
xor dword [ebp - 8], ebx
add esi, 0xe9ead7f4
add esi, 0x16152810
add edx, 0x3a2d15b
add edx, 0xfc5d2ea9
loop 0x403f76
add eax, 0x437be920
sub eax, 0x437b2151
xor ebx, ebx
add ebx, eax
add eax, 0x94b0d449
sub eax, 0x94b0d444
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x640153b3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and esi, eax
test dword [ebx + 0x6fffffc], ebx
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.6401446a
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6401441f
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.6401445a
push cs
inc esi
mov ebp, ecx
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.6401445a
movsb byte es:[edi], byte [esi]
hlt
Function at 0x401050
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x40c1f0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x41207c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
xor ecx, ecx
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], ecx
jb 0x40108c
mov eax, dword [edi]
jmp 0x40108e
mov eax, edi
xor edx, edx
mov word [eax], dx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov eax, 0x200
lea ecx, [esp + 0x1c]
call fcn.004031e0
mov byte [esp + 0x38], 1
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
sub eax, esi
cmp dword [ebx + 0x14], 8
mov dword [esp + 0x14], eax
jb 0x4010d2
mov eax, dword [ebx]
jmp 0x4010d4
mov eax, ebx
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
je 0x401122
test esi, esi
je 0x4010ff
push esi
call fcn.00406964
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40110e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x40112d
mov eax, dword [eax]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
push esi
lea ecx, [esp + 0x20]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
je 0x40117c
test esi, esi
je 0x401159
push esi
call fcn.00406964
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40110e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
add eax, 0xfffffffe
lea ecx, [esp + 0x1c]
call fcn.004031e0
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
sub eax, esi
shr eax, 1
push eax
mov eax, esi
mov ecx, edi
call fcn.00402f70
test esi, esi
je 0x4011af
push esi
call fcn.00406964
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4011be
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4011e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c56e
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x41207c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
xor edi, edi
xor ecx, ecx
push edi
mov word [ebp - 0x58], cx
push eax
mov ebx, 7
or eax, 0xffffffff
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], edi
call fcn.004033e0
mov dword [ebp - 4], edi
cmp esi, edi
je 0x401367
push 0x10
push 8
lea edx, [ebp - 0x20]
push edx
push esi
call fcn.0040693a
xor eax, eax
add esp, 0x10
mov word [ebp - 0x74], ax
push 0xa
mov eax, 0x40f0e4
lea esi, [ebp - 0x74]
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x64], edi
call fcn.00403aa0
mov byte [ebp - 4], 1
xor ecx, ecx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
mov word [ebp - 0x3c], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x401280
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20]
lea esi, [ebp - 0x3c]
call fcn.00403aa0
push 0xffffffffffffffff
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x64]
push edi
mov edx, esi
lea ecx, [eax - 1]
sub eax, dword [ebp - 0x2c]
push edx
push ecx
lea esi, [ebp - 0x74]
call fcn.004034e0
lea edx, [ebp - 0xac]
push 0x40f100
push edx
mov ebx, esi
call fcn.00403eb0
push eax
mov eax, 0x40f0fc
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 3
call fcn.00403f90
add esp, 0xc
push edi
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.004032f0
mov esi, 8
cmp dword [ebp - 0x7c], esi
jb 0x40130c
mov eax, dword [ebp - 0x90]
push eax
call fcn.00406964
add esp, 4
xor ecx, ecx
mov ebx, 7
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x80], edi
mov word [ebp - 0x90], cx
cmp dword [ebp - 0x98], esi
jb 0x401337
mov edx, dword [ebp - 0xac]
push edx
call fcn.00406964
add esp, 4
cmp dword [ebp - 0x28], esi
jb 0x401348
mov eax, dword [ebp - 0x3c]
push eax
call fcn.00406964
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
mov word [ebp - 0x3c], cx
cmp dword [ebp - 0x60], esi
jb 0x40136c
mov edx, dword [ebp - 0x74]
push edx
call fcn.00406964
add esp, 4
jmp 0x40136c
mov esi, 8
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x44], esi
jae 0x401377
lea eax, [ebp - 0x58]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push eax
call edi
push 0x40f0d8
call edi
cmp dword [ebp - 0x44], esi
jb 0x401398
mov eax, dword [ebp - 0x58]
push eax
call fcn.00406964
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406271
mov esp, ebp
pop ebp
ret 4
Function at 0x4013c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c1c0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x41207c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x10]
xor ebx, ebx
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], ebx
jb 0x4013fa
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov eax, 0x200
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call fcn.004031e0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub edx, esi
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x18], edx
jb 0x401434
mov eax, dword [edi]
jmp 0x401436
mov eax, edi
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x14]
push ecx
push 0x20019
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, ebx
jne 0x4014df
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
jb 0x401460
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push esi
lea edx, [ebp - 0x1c]
push edx
push ebx
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, ebx
jne 0x4014df
cmp dword [ebp - 0x1c], 1
jne 0x4014df
mov eax, dword [ebp - 0x18]
cmp eax, 2
jae 0x40148e
mov eax, 2
add eax, 0xfffffffe
lea ecx, [ebp - 0x2c]
call fcn.004031e0
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
sub ecx, esi
shr ecx, 1
push ecx
mov ecx, dword [ebp + 0x10]
mov eax, esi
call fcn.00402f70
cmp esi, ebx
je 0x4014bb
push esi
call fcn.00406964
add esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x4014c9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, ebx
je 0x4014ec
push esi
call fcn.00406964
add esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x4014fa
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc