joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40be90
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469d40
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x48794c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00417b99
call fcn.0040fce6
mov eax, dword [eax + 8]
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov eax, dword [esi + 0x20]
push edi
push 1
push 0x80
push eax
call ebx
mov ecx, dword [esi + 0x20]
push edi
push 0
push 0x80
push ecx
call ebx
call fcn.0040e5e6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40bf11
push 0x80004005
call fcn.004014a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x499f08
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call fcn.0040ba30
mov byte [ebp - 4], 1
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x10]
push str.SM3350_SN_Update___v_s
push edx
call fcn.00403600
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bf6f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0x10]
push edi
mov ecx, esi
call fcn.0041684f
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bf9d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c210
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a570
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x48794c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0040ebba
call fcn.0040fce6
mov eax, dword [eax + 8]
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov eax, dword [esi + 0x20]
push edi
push 1
push 0x80
push eax
call ebx
mov ecx, dword [esi + 0x20]
push edi
push 0
push 0x80
push ecx
call ebx
lea edx, [ebp - 0x10]
push edx
call fcn.0040aec0
add esp, 4
lea edi, [esi + 0xe0]
push eax
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00404c20
or ebx, 0xffffffff
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c2bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0040af50
add esp, 4
push eax
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.00404c20
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
lock xadd dword [edx], ebx
dec ebx
test ebx, ebx
jg 0x40c2f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0x20]
push 0
push 0x32
push 0
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c660
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a120
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x48794c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
test esi, esi
je 0x40c836
mov ecx, dword [edi + 0xa8]
push esi
push 4
push 0x110a
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp + 8], 1
test eax, eax
jne 0x40c7e0
lea ecx, [edi + 0x88]
push esi
call fcn.0042b176
call fcn.0040e5e6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x40c84a
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x10], ebx
push esi
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.0040ca90
mov byte [ebp - 4], 1
mov ecx, dword [eax]
lea edx, [ebx - 0x10]
lea eax, [ecx - 0x10]
mov dword [ebp - 0x18], edx
cmp eax, edx
je 0x40c768
cmp dword [edx + 0xc], 0
lea ebx, [edx + 0xc]
mov dword [ebp - 0x14], ebx
jl 0x40c758
mov ebx, dword [eax]
cmp ebx, dword [edx]
jne 0x40c758
push eax
call fcn.00402500
mov edx, dword [ebp - 0x14]
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40c750
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebx, 0x10
mov dword [ebp - 0x10], ebx
jmp 0x40c768
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.004019d0
mov ebx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c78b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi + 0xe0]
push eax
push 0
push ebx
push str.PortMap
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jbe 0x40c7b4
push 1
push esi
lea ecx, [edi + 0x88]
call fcn.0042b2d9
jmp 0x40c7bb
mov dword [ebp + 8], 0
add ebx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c7ec
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
jmp 0x40c7ec
lea ecx, [ebp + 8]
push ecx
push eax
mov ecx, edi
call fcn.0040c660
mov edx, dword [ebp + 8]
push edx
push esi
lea ecx, [edi + 0x88]
call fcn.0042b2d9
mov eax, dword [edi + 0xa8]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push 2
push 0x1102
push eax
call ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
and dword [eax], ecx
mov edx, dword [edi + 0xa8]
push esi
push 1
push 0x110a
push edx
call ebx
mov esi, eax
test esi, esi
jne 0x40c69e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004014a0
int3
Function at 0x40dcb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469d10
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x48794c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp + 8]
call fcn.0040ba30
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx - 0xc]
or edi, 0xffffffff
test eax, eax
jne 0x40dd01
mov dword [ebp - 4], edi
lea eax, [ecx - 0x10]
jmp 0x40de1b
jle 0x40dd1f
push 0x2e
push ecx
call fcn.0043f74d
mov ecx, dword [ebp + 8]
add esp, 8
test eax, eax
je 0x40dd1f
sub eax, ecx
sar eax, 1
mov esi, eax
cmp esi, edi
jne 0x40dd2a
mov dword [ebp - 4], edi
lea eax, [ecx - 0x10]
jmp 0x40de1b
mov eax, dword [ecx - 0xc]
sub eax, esi
dec eax
push eax
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp + 8]
call fcn.004089d0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
mov eax, dword [edx - 0xc]
lea ecx, [ebp + 8]
push ecx
inc eax
mov ecx, esi
call fcn.004088e0
lea ebx, [ebp + 8]
call fcn.00408b60
mov ebx, eax
call fcn.00408be0
lea ebx, [ebp - 0x10]
call fcn.00408b60
mov ebx, eax
call fcn.00408be0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
je 0x40ddf4
cmp dword [ecx - 0xc], ebx
je 0x40ddf4
mov edx, dword [0x49a248]
push edx
mov edx, dword [ebp + 0x10]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40ddbc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x40dddb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ecx - 0x10]
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40de12
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x40de31
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40f0b7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.0040fce6
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40f0f0
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0040ed03
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x40f14e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x40f172
cmp dword [edi + 0x54], 0
jne 0x40f172
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0040fce6
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0040f10f
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x415fa7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x415fee
call fcn.0040fce6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x415fee
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41600a
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00415b1f
mov esi, eax
test edi, edi
je 0x416008
test ebx, ebx
je 0x416008
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x416edd
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x46731c
call fcn.00440827
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x416f02
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x416f48
lea ecx, [ebp - 0x10]
call fcn.00401540
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041d48a
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004014c0
mov eax, esi
call fcn.004408ff
ret 8
Function at 0x4184d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4184ec
mov edi, dword [esi + 0xc]
jmp 0x41852c
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x418505
call fcn.0041a4ad
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x41851a
call fcn.0041a4ad
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x41852c
call fcn.0041a4ad
call fcn.0040fce6
cmp dword [eax + 0x3c], 0
je 0x418541
push edi
mov ecx, ebx
call fcn.0041738e
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004183fa
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x41855f
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x41856b
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x423d30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.0040fce6
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x423d5d
xor eax, eax
jmp 0x423e03
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x423d56
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x423d56
movzx eax, word [esi + 6]
push ebx
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040e234
pop ecx
mov edi, eax
xor ecx, ecx
xor eax, eax
cmp cx, word [esi + 6]
jae 0x423db4
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
inc ecx
inc ecx
cmp eax, edx
jl 0x423da3
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.004229e5
push edi
mov ebx, eax
call fcn.0040e26e
pop ecx
test ebx, ebx
je 0x423df6
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.004230b8
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.0042316c
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4
Function at 0x427f79
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x427fc1
call fcn.0040fce6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x427fc1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x428004
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x427fed
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x427fed
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x428001
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x42a225
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 1
mov ecx, esi
test al, 1
je 0x42a249
mov eax, dword [esi]
push 0
call dword [eax + 0x98]
test eax, eax
jne 0x42a257
pop esi
ret
mov eax, dword [esi + 0x24]
mov edx, dword [esi]
push eax
call dword [edx + 0x98]
jmp 0x42a243
xor eax, eax
inc eax
pop esi
ret

Function at 0x42cb43
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x46850e
call fcn.00440827
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00401b10
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x42cba5
call fcn.0040f597
cmp eax, 1
jne 0x42cba5
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x46fcc8
push eax
call fcn.00408a60
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00404c20
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004014c0
mov dword [ebp + 8], SysReAllocString
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004014c0
mov eax, esi
call fcn.004408ff
ret 0x10
Function at 0x42cbce
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x46850e
call fcn.00440827
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00401b10
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x42cc30
call fcn.0040f597
cmp eax, 1
jne 0x42cc30
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x46fcc8
push eax
call fcn.00408a60
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00404c20
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004014c0
mov dword [ebp + 8], SysReAllocString
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004014c0
mov eax, esi
call fcn.004408ff
ret 0x14

Function at 0x43ea11
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48794c]
jne 0x43ea1b
repz ret
jmp fcn.00445ede

Function at 0x45391d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00445842
and dword [ebp - 4], 0
cmp dword [0x499e4c], 0
mov ebx, eax
jne 0x4539ce
push 0x472b8c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x453a7f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x472b80
push edi
call esi
test eax, eax
je 0x453a7f
push eax
call fcn.004457d0
mov dword [esp], 0x472b70
push edi
mov dword [0x499e4c], eax
call esi
push eax
call fcn.004457d0
mov dword [esp], 0x472b5c
push edi
mov dword [0x499e50], eax
call esi
push eax
call fcn.004457d0
mov dword [esp], 0x472b40
push edi
mov dword [0x499e54], eax
call esi
push eax
call fcn.004457d0
pop ecx
mov dword [0x499e5c], eax
test eax, eax
je 0x4539ce
push 0x472b28
push edi
call esi
push eax
call fcn.004457d0
pop ecx
mov dword [0x499e58], eax
mov eax, dword [0x499e58]
cmp eax, ebx
je 0x453a26
cmp dword [0x499e5c], ebx
je 0x453a26
push eax
call fcn.0044584b
push dword [0x499e5c]
mov esi, eax
call fcn.0044584b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x453a26
test edi, edi
je 0x453a26
call esi
test eax, eax
je 0x453a1d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x453a1d
test byte [ebp - 0xc], 1
jne 0x453a26
or dword [ebp + 0x10], 0x200000
jmp 0x453a5f
mov eax, dword [0x499e50]
cmp eax, ebx
je 0x453a5f
push eax
call fcn.0044584b
pop ecx
test eax, eax
je 0x453a5f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x453a5f
mov eax, dword [0x499e54]
cmp eax, ebx
je 0x453a5f
push eax
call fcn.0044584b
pop ecx
test eax, eax
je 0x453a5f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x499e4c]
call fcn.0044584b
pop ecx
test eax, eax
je 0x453a7f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x453a81
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45b4b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x48794c]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
je 0x45b4cc
cmp dword [ebp + 8], 0xffffffff
jne 0x45b4d3
xor eax, eax
jmp 0x45b5f4
cmp dword [ebp + 0xc], 0
jne 0x45b4e0
xor eax, eax
jmp 0x45b5f4
cmp dword [ebp + 0x14], 0
jne 0x45b4f3
cmp dword [ebp + 0x18], 0
je 0x45b4f3
xor eax, eax
jmp 0x45b5f4
cmp dword [ebp + 0x20], 0
jne 0x45b500
mov dword [ebp + 0x20], 1
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x45b519
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0x20]
jge 0x45b5f2
push 0x50
push 0
lea edx, [ebp - 0x60]
push edx
call fcn.00440cf0
add esp, 0xc
mov eax, 0x2c
mov word [ebp - 0x60], ax
mov byte [ebp - 0x5d], 0
mov byte [ebp - 0x5c], 0
mov byte [ebp - 0x5b], 0
mov byte [ebp - 0x59], 0x18
mov byte [ebp - 0x58], 0
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x54], ecx
movzx edx, byte [ebp + 0x1c]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov cl, byte [ebp + 0x10]
mov byte [ebp - 0x5a], cl
movzx edx, byte [ebp - 0x5a]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.00445ff0
add esp, 0xc
mov dword [ebp - 0x48], 0x30
push 0
lea edx, [ebp - 4]
push edx
push 0x50
lea eax, [ebp - 0x60]
push eax
push 0x50
lea ecx, [ebp - 0x60]
push ecx
push 0x4d014
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x45b5c1
lea eax, [ebp - 0x30]
push eax
call fcn.0045b0c0
add esp, 4
test eax, eax
je 0x45b5e6
cmp dword [ebp - 0x64], 0
je 0x45b5d0
mov dword [ebp - 0x68], str.w1_retry_0_n
jmp 0x45b5d7
mov dword [ebp - 0x68], str.w1_retry_1_n
mov ecx, dword [ebp - 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x45b510
mov eax, 1
jmp 0x45b5f4
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0043ea11
mov esp, ebp
pop ebp
ret
Function at 0x45b610
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x48794c]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
je 0x45b62c
cmp dword [ebp + 8], 0xffffffff
jne 0x45b633
xor eax, eax
jmp 0x45b754
cmp dword [ebp + 0xc], 0
jne 0x45b640
xor eax, eax
jmp 0x45b754
cmp dword [ebp + 0x14], 0
jne 0x45b653
cmp dword [ebp + 0x18], 0
je 0x45b653
xor eax, eax
jmp 0x45b754
cmp dword [ebp + 0x20], 0
jne 0x45b660
mov dword [ebp + 0x20], 1
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x45b679
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0x20]
jge 0x45b752
push 0x50
push 0
lea edx, [ebp - 0x60]
push edx
call fcn.00440cf0
add esp, 0xc
mov eax, 0x2c
mov word [ebp - 0x60], ax
mov byte [ebp - 0x5d], 0
mov byte [ebp - 0x5c], 0
mov byte [ebp - 0x5b], 0
mov byte [ebp - 0x59], 0x18
mov byte [ebp - 0x58], 1
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x54], ecx
movzx edx, byte [ebp + 0x1c]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov cl, byte [ebp + 0x10]
mov byte [ebp - 0x5a], cl
movzx edx, byte [ebp - 0x5a]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.00445ff0
add esp, 0xc
mov dword [ebp - 0x48], 0x30
push 0
lea edx, [ebp - 4]
push edx
push 0x50
lea eax, [ebp - 0x60]
push eax
push 0x50
lea ecx, [ebp - 0x60]
push ecx
push 0x4d014
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x45b721
lea eax, [ebp - 0x30]
push eax
call fcn.0045b0c0
add esp, 4
test eax, eax
je 0x45b746
cmp dword [ebp - 0x64], 0
je 0x45b730
mov dword [ebp - 0x68], str.r1_retry_0_n
jmp 0x45b737
mov dword [ebp - 0x68], str.r1_retry_1_n
mov ecx, dword [ebp - 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x45b670
mov eax, 1
jmp 0x45b754
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0043ea11
mov esp, ebp
pop ebp
ret