joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e8c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409f5f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409f78
push ebx
push 0x409f84
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409f0c
mov al, 0x6a
call fcn.00409ae8
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409e60
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409f15
call fcn.00409e60
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409f66
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x40a018
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40a0cc
jmp 0x40a0c1
cmp dword [esi + 0x10], 0x1000
jne 0x40a0ad
test byte [esi + 0x15], 1
jne 0x40a0ad
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x40a06c
cmp eax, 2
je 0x40a06c
cmp eax, 0x10
je 0x40a06c
cmp eax, 0x20
jne 0x40a081
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40a081
mov bl, 1
xor ebp, ebp
jmp 0x40a092
mov eax, dword [esi]
add eax, ebp
call fcn.0040a010
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40a085
test bl, bl
je 0x40a0ad
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40a0cc
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40a044
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
pop eax
mov dh, 0x2d
add eax, 0x71d5355e
imul esi, esp, 0xffffffae
cwde
sbb dl, al
and ebx, esi
int1
mov bh, 0x59
arpl word [edx + 0x6042c5e], bx
pop ebp
sbb al, 0x98
invalid
sbb byte [esi + 0x67], bl
out 0x49, al
invalid
dec esp
aas
enter 0x1cb6, 0x56
dec esp
xor dword [ecx], ebx
mov bh, 0x45
mov al, byte [0x1a2df50b]
out dx, eax
pop esi
ja 0x4153c0
out 0x49, eax
jge 0x415390
popfd
or edx, ebx
invalid
Function at 0x401b4b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x401b5a
pop dword [ebp - 0x20]
mov eax, 0x401b5a
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xb46727eb
add dword [ebp - 0x30], 0x99eb1d60
mov dword [ebp - 0x2c], 0x4e8c0124
add dword [ebp - 0x2c], 0xe3a74b21
mov dword [ebp - 0x28], 0x375cdfc3
add dword [ebp - 0x28], 0x14ef646b
mov dword [ebp - 0x24], 0x471c801c
add dword [ebp - 0x24], 0xb8e37fe4
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x621e3320
add dword [ebp - 0x30], 0x12543636
mov dword [ebp - 0x2c], 0x2b591d97
sub dword [ebp - 0x2c], 0xe9ecbc22
mov dword [ebp - 0x28], 0xa3ec54a2
sub dword [ebp - 0x28], 0x407ce836
mov dword [ebp - 0x24], 0xad8df141
sub dword [ebp - 0x24], 0xad8df141
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3a571
push 0
call eax
mov ecx, 0xc30fd487
sub ecx, 0xc30f89f9
mov edi, eax
mov ebx, 0x853414d5
add ebx, 0x7b0d9b2b
add ebx, dword [ebp - 0x20]
mov esi, 0x399cb45f
add esi, 0x2d7d2e2b
xor dword [ebp - 0x18], 0x27e1da98
mov edx, dword [ebx]
mov dword [ebp - 8], 0x8a8a2c24
xor edx, esi
mov dword [edi], edx
mov dword [ebp - 0x18], 0xc14fb4b7
add edi, 0x4686dddf
sub edi, 0x4686dddb
add ebx, 0xe94507c0
add ebx, 0x16baf844
loop 0x401c6d
add eax, 0x11d0b
xor ebx, ebx
add ebx, eax
add eax, 0x7acb3aca
sub eax, 0x7acb3ac5
mov ecx, 0xe6f306fb
add ecx, 0x194cf905
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000983f
pop dword [ebp - 0xc]
mov eax, 0x1000983f
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x36ecb
push 0
mov eax, 0x3f6ea63d
add eax, 0xd0929a27
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x76a9673a
sub ecx, 0x76a92789
xor esi, esi
add esi, eax
mov edx, 0xee2a130f
sub edx, 0xde288d0f
add edx, dword [ebp - 0xc]
mov ebx, 0x93817aac
xor dword [ebp - 4], esi
mov edi, dword [edx]
xor edi, ebx
sub dword [ebp - 8], 0x9abe5e62
mov dword [esi], edi
xor dword [ebp - 8], 0x4baf2d42
add esi, 4
add edx, 4
loop 0x10009895
add eax, 0xf197
mov ebx, eax
add eax, 0xcff8de0a
add eax, 0x300721fb
mov ecx, 0xf764f402
add ecx, 0x189b0bfe
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40579a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x40579a
lcall 0x5de5, 0x8b10c483
jmp loc.0078207c
Function at 0x405670
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4244f0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x439010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0xd]
mov byte [ebp - 0xd], 1
push eax
push str.CHBAAPIInt::DeInitHBAAPIMod
lea ecx, [ebp - 0x2c]
call fcn.00408740
push 0x60
lea eax, [edi + 8]
mov dword [ebp - 4], 0
push 0
push eax
mov byte [edi + 0xe0], 0
call fcn.00413c30
add esp, 0xc
push str.GlobalCHBAAPINTMUT
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x4056f9
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40570b
push str.CHBAAPIInt::DeInitHBAAPIMod_Failed_to_acquire_Mutex
push 0x43bf64
call sym.Prounstl.exe_public:_void___cdecl_CNcsDebug::Print_wchar_t_const__
add esp, 8
mov eax, dword [edi]
test eax, eax
je 0x40571e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [edi], 0
mov edi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test esi, esi
je 0x40572b
push esi
call edi
mov bl, byte [ebp - 0xd]
test esi, esi
je 0x405735
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00408830
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408dd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x439010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x408f4f
cmp eax, 2
je 0x408f4f
cmp byte [esi + 0x28], 0
je 0x408f4f
cmp dword [esi + 8], 0
je 0x408f4f
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x34], 0
je 0x408e49
push dword [esi + 8]
call fcn.00414a89
push eax
call fcn.00414aad
add esp, 8
cmp dword [esi + 0x34], eax
ja 0x408e49
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413026
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp - 0x18]
movzx eax, word [ebp - 6]
push dword [ebp - 0x1c]
push eax
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [esi + 4]
push str._s_tPID:_x_tTID:_x_t_02.2d:_02.2d:_02.2d._03.3d_t__I64X__t
push 0x47f
push 0x480
push 0x43ad30
call fcn.00414408
mov edi, eax
add esp, 0x34
test edi, edi
js 0x408f45
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [edi*2 + 0x43ad30]
push 0x3ff
push 0x400
push eax
call fcn.00414443
add esp, 0x14
mov ecx, 0x3ff
test eax, eax
cmovs eax, ecx
add edi, eax
mov eax, 0x47e
cmp edi, 0x47f
cmovae edi, eax
mov eax, 0xa
mov word [edi*2 + 0x43ad30], ax
lea edi, [edi*2 + 2]
cmp edi, 0x900
jae 0x408f5e
xor eax, eax
mov word [edi + 0x43ad30], ax
mov eax, dword [esi + 8]
test eax, eax
je 0x408f29
push 0x43ad30
push 0x428a6c
push eax
call fcn.00414374
add esp, 0xc
push dword [esi + 8]
call fcn.0041494c
add esp, 4
cmp dword [esi + 0x2c], 4
jne 0x408f45
push 0x43ad30
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00413026
mov esp, ebp
pop ebp
ret
call fcn.00413ffc
int3
Function at 0x409900
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424cf6
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x439010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x25c], ebx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x254]
call sym.Prounstl.exe_public:_void___thiscall_CNcsRegKey::constructor_void_
cmp byte [ebx + 8], 0
mov dword [ebp - 4], 0
je 0x409a87
test edi, edi
je 0x409a87
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409962
sub ecx, edx
sar ecx, 1
je 0x409a87
push edi
lea ecx, [ebp - 0x228]
call sym.Prounstl.exe_public:_void___thiscall_CNcsString::constructor_wchar_t_const__
push 0
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 1
push eax
push dword [ebx + 4]
lea ecx, [ebp - 0x254]
call sym.Prounstl.exe_public:_bool___thiscall_CNcsRegKey::Open_struct_HKEY_____class_CNcsString_const___bool_
cmp dword [ebp - 0x214], 8
mov bl, al
mov byte [ebp - 4], 0
jb 0x4099bb
push dword [ebp - 0x228]
call fcn.004125c9
add esp, 4
xor eax, eax
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
test bl, bl
je 0x409a87
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x258]
mov dword [ebp - 0x258], 0x100
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push dword [ebp - 0x250]
call esi
test eax, eax
jne 0x409a69
lea esp, [esp]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x254]
call sym.Prounstl.exe_public:_bool___thiscall_CNcsRegKey::DeleteSubKey_wchar_t_const__
test al, al
je 0x409a87
lea eax, [ebp - 0x264]
mov dword [ebp - 0x258], 0x100
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push dword [ebp - 0x250]
call esi
test eax, eax
je 0x409a20
lea ecx, [ebp - 0x254]
call sym.Prounstl.exe_public:_void___thiscall_CNcsRegKey::Close_void_
mov ecx, dword [ebp - 0x25c]
push edi
call sym.Prounstl.exe_private:_unsigned_long_int___thiscall_CNcsRegKey::RemoveSubKey_wchar_t_const__
test eax, eax
sete bl
jmp 0x409a89
xor bl, bl
lea ecx, [ebp - 0x254]
mov dword [ebp - 4], 0xffffffff
call sym.Prounstl.exe_public_virtual:_void___thiscall_CNcsRegKey::destructor_void_
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413026
mov esp, ebp
pop ebp
ret 4

Function at 0x409ac0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 8], 0
mov dword [esi + 0xc], 0
je 0x409aeb
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x409ade
mov eax, dword [eax]
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [esi + 0xc], eax
xor eax, eax
cmp dword [esi + 0xc], eax
pop esi
sete al
pop ebp
ret 4
Function at 0x409b00
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424d2b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x439010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
xor al, al
mov dword [ebp - 0x234], 0x100
cmp byte [esi + 8], al
je 0x409bf7
mov ecx, dword [esi + 0x10]
lea eax, [ecx + 1]
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x23c]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x218]
push eax
push ecx
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [esi + 0xc], eax
cmp eax, 0x103
jne 0x409b8b
mov dword [esi + 0x10], 0
xor al, al
jmp 0x409bf7
test eax, eax
sete bl
test bl, bl
je 0x409bf5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call sym.Prounstl.exe_public:_void___thiscall_CNcsString::constructor_wchar_t_const__
mov edx, eax
cmp dword [edx + 0x14], 8
mov dword [ebp - 4], 0
jb 0x409bb7
mov edx, dword [edx]
cmp word [edx], 0
jne 0x409bc1
xor ecx, ecx
jmp 0x409bd5
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409bc6
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, edi
call sym.Prounstl.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const___unsigned_int_
cmp dword [ebp - 0x21c], 8
jb 0x409bf5
push dword [ebp - 0x230]
call fcn.004125c9
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413026
mov esp, ebp
pop ebp
ret 4

Function at 0x409c20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x439010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x408], 0x200
xor al, al
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 8], al
je 0x409cc7
mov ecx, dword [esi + 0x10]
push 0
push 0
push 0
lea eax, [ecx + 1]
push 0
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x404]
push eax
push ecx
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [esi + 0xc], eax
cmp eax, 0x103
jne 0x409c85
mov dword [esi + 0x10], 0
test eax, eax
push ebx
sete bl
test bl, bl
je 0x409cc4
cmp word [ebp - 0x404], 0
jne 0x409c9d
xor ecx, ecx
jmp 0x409cb5
lea ecx, [ebp - 0x404]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409ca6
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x404]
mov ecx, edi
push eax
call sym.Prounstl.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const___unsigned_int_
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00413026
mov esp, ebp
pop ebp
ret 4
Function at 0x409d90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
cmp byte [esi + 8], 0
mov dword [esi + 0xc], 0
je 0x409dd7
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x409db6
mov eax, dword [eax]
push 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x409de0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424d68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x439010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0xd]
mov byte [ebp - 0xd], 0
push eax
push str.CNcsRegKey::GetValue
lea ecx, [ebp - 0x30]
call fcn.00408740
cmp byte [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 4
je 0x409ea8
push str.CNcsRegKey::GetValue_m_bIsOpened__true
push 0x43bf64
call sym.Prounstl.exe_public:_void___cdecl_CNcsDebug::Print_wchar_t_const__
mov eax, dword [ebp + 8]
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x409e56
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
test eax, eax
mov dword [esi + 0xc], eax
push str.CNcsRegKey::GetValue_:_d
push 0x43bf64
sete byte [ebp - 0xd]
call sym.Prounstl.exe_public:_void___cdecl_CNcsDebug::Print_wchar_t_const__
add esp, 0xc
cmp dword [ebp - 0x14], 4
je 0x409ea8
push str.CNcsRegKey::GetValue_dwRegType___REG_DWORD
push 0x43bf64
call sym.Prounstl.exe_public:_void___cdecl_CNcsDebug::Print_wchar_t_const__
add esp, 8
xor bl, bl
mov byte [ebp - 0xd], bl
jmp 0x409eab
mov bl, byte [ebp - 0xd]
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.00408830
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x409ed0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424d9b
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x439010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x411]
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x434]
push eax
push str.CNcsRegKey::GetValue
mov byte [ebp - 0x411], 0
call fcn.00408740
push 0x400
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x418], 1
mov dword [ebp - 0x41c], 0x200
call fcn.00413c30
add esp, 0xc
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x409f66
mov eax, dword [esi]
jmp 0x409f68
mov eax, esi
xor ecx, ecx
mov word [eax], cx
cmp byte [ebx + 8], cl
je 0x409fe2
cmp dword [edi + 0x14], 8
jb 0x409f7a
mov edi, dword [edi]
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push edi
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [ebx + 0xc], eax
sete bl
mov byte [ebp - 0x411], bl
test bl, bl
je 0x409fe8
cmp word [ebp - 0x410], 0
jne 0x409fbb
xor ecx, ecx
jmp 0x409fd3
lea ecx, [ebp - 0x410]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409fc4
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x410]
mov ecx, esi
push eax
call sym.Prounstl.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const___unsigned_int_
mov bl, byte [ebp - 0x411]
lea ecx, [ebp - 0x434]
mov dword [ebp - 4], 0xffffffff
call fcn.00408830
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413026
mov esp, ebp
pop ebp
ret 8