joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411180
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
push edi
jne 0x411197
push 0x80004005
call fcn.004032b0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
nop
push esi
call ebx
add eax, 1
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x4111a0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push edi
push eax
mov eax, dword [edx]
push 7
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4112f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x447034]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
lea edx, [ebp - 0x218]
push edx
push 0x2001f
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi]
push 0
push ecx
push eax
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x210]
mov esi, eax
test esi, esi
jne 0x41136b
test ecx, ecx
je 0x411359
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [ebp - 0x218]
mov esi, eax
mov dword [ebp - 0x210], ecx
je 0x411379
test ecx, ecx
je 0x411440
push ecx
jmp 0x41143a
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x20c]
push eax
push 0
push ecx
mov dword [ebp - 0x214], 0x100
call esi
test eax, eax
jne 0x411402
lea ecx, [ecx]
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x210]
call fcn.004112f0
mov edi, eax
test edi, edi
jne 0x411454
lea edx, [ebp - 0x228]
push edx
mov edx, dword [ebp - 0x210]
push eax
push eax
push eax
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push edi
push edx
mov dword [ebp - 0x214], 0x100
call esi
test eax, eax
je 0x4113b0
mov edi, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x41141d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x411440
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004282a0
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x411465
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004282a0
mov esp, ebp
pop ebp
ret 4
Function at 0x412270
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c278
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x447034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [eax + 0x20c], 0
jne 0x4122e8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4122d1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4122fb
test al, 0x10
je 0x412307
mov dword [ebp - 4], 0xffffffff
lea eax, [esi - 0x10]
jmp 0x4122b8
mov edx, dword [0x44951c]
mov eax, dword [edx + 0xc]
mov ecx, 0x44951c
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov bl, 1
lea edi, [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.00412a20
cmp eax, 0xffffffff
je 0x41236c
lea ecx, [eax + 1]
lea esi, [ebp - 0x14]
mov edx, edi
call fcn.00412a60
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00412ce0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412377
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x412377
lea eax, [ebp + 0xc]
lea edi, [ebp - 0x10]
call fcn.00412ce0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x20c]
test eax, eax
mov esi, dword [ebp - 0x10]
jne 0x412394
mov edi, 0x10000
mov dword [0x4496e8], edi
jmp 0x4123bb
cmp dword [eax], 2
je 0x4123a6
mov edi, 0x80000
mov dword [0x4496e8], edi
jmp 0x4123bb
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 0xc]
push esi
mov ebx, eax
call fcn.00416c20
mov dword [0x4496e8], eax
mov edi, eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4123db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412401
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x415170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x6af90], ebx
push edi
mov dword [ebp - 4], 0
mov dword [esi + 0x6af80], 2
je 0x415391
lea ebx, [ebx]
cmp dword [esi + 0x6af90], 3
jb 0x4151f7
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
mov dword [esi + ecx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af84]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af70], ecx
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x415237
mov edx, dword [esi + 0x6af84]
sub edx, ecx
cmp edx, 0x7efa
ja 0x415237
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x415222
mov dword [esi + 0x6afa0], eax
mov eax, ecx
call fcn.00414e60
mov ebx, eax
mov eax, dword [esi + 0x6af90]
cmp ebx, eax
jbe 0x415237
mov ebx, eax
cmp ebx, 3
mov eax, dword [esi + 0x6af84]
mov ecx, esi
jb 0x41531c
sub eax, dword [esi + 0x6af88]
lea edx, [ebx - 3]
call fcn.00414660
sub dword [esi + 0x6af90], ebx
cmp ebx, dword [esi + 0x6af98]
mov ecx, dword [esi + 0x6af90]
mov dword [ebp - 8], eax
ja 0x4152e4
cmp ecx, 3
jb 0x4152e4
mov edi, 1
sub ebx, edi
lea esp, [esp]
add dword [esi + 0x6af84], edi
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ecx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
sub ebx, edi
mov dword [esi + edx*4 + 0x2af70], ecx
mov edx, dword [esi + 0x6af84]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x6af7c]
mov dword [esi + ecx*4 + 0x4af70], edx
jne 0x415280
add dword [esi + 0x6af84], edi
mov eax, dword [ebp - 8]
jmp 0x415339
add dword [esi + 0x6af84], ebx
mov ecx, dword [esi + 0x6af84]
lea edx, [ecx + esi]
movzx ecx, byte [edx + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx edx, byte [edx + 0x1af71]
shl ecx, 5
xor edx, ecx
xor ebx, ebx
and edx, 0x7fff
mov dword [esi + 0x6af7c], edx
jmp 0x415339
movzx edx, byte [eax + esi + 0x1af70]
xor eax, eax
call fcn.00414660
add dword [esi + 0x6af90], 0xffffffff
add dword [esi + 0x6af84], 1
test eax, eax
je 0x415373
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
jl 0x415350
lea edx, [ecx + esi + 0x1af70]
jmp 0x415352
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
push edx
xor edi, edi
mov ecx, esi
call fcn.004144c0
mov ecx, dword [esi + 0x6af84]
add esp, 4
mov dword [esi + 0x6af74], ecx
cmp dword [esi + 0x6af90], 0x106
jae 0x415384
call fcn.00415020
cmp dword [esi + 0x6af90], 0
jne 0x4151a0
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
jl 0x4153a4
lea edx, [ecx + esi + 0x1af70]
jmp 0x4153a6
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
push edx
mov edi, 1
mov ecx, esi
call fcn.004144c0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416060
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
push edi
mov edi, eax
mov esi, edx
jne 0x41606f
pop edi
xor eax, eax
pop esi
ret
cmp edi, 8
not esi
jb 0x416157
mov edx, edi
shr edx, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [ebx*4 + 0x43f820]
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x43f820]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [ebx*4 + 0x43f820]
movzx ebx, byte [ecx + 1]
xor ebx, eax
add ecx, 1
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x43f820]
movzx ebx, byte [ecx + 1]
xor ebx, eax
add ecx, 1
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x43f820]
movzx ebx, byte [ecx + 1]
xor ebx, eax
add ecx, 1
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x43f820]
movzx ebx, byte [ecx + 1]
add ecx, 1
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x43f820]
movzx ebx, byte [ecx + 1]
add ecx, 1
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x43f820]
add ecx, 1
sub edi, 8
sub edx, 1
mov esi, eax
jne 0x416080
pop ebx
test edi, edi
je 0x41617c
jmp 0x416160
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x43f820]
add ecx, 1
sub edi, 1
jne 0x416160
mov eax, esi
pop edi
not eax
pop esi
ret

Function at 0x416190
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [edx]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x43f820]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
add eax, 1
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x43f820]
mov dword [edx + 8], ecx
ret
Function at 0x416320
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, eax
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x416346
mov eax, 0x200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x4c]
mov edx, eax
xor edi, edi
and edx, 1
je 0x41635c
mov dword [ebp - 8], 1
mov edi, dword [ebp - 8]
test al, 2
je 0x416363
or edi, 2
test al, 4
je 0x41636a
or edi, 4
mov ecx, eax
and ecx, 0x10
je 0x416374
or edi, 0x10
test al, 0x20
je 0x41637b
or edi, 0x20
test ecx, ecx
je 0x416387
or edi, 0x40000000
jmp 0x41638d
or edi, 0x80000000
or edi, 0x1000000
test edx, edx
mov dword [ebp - 8], edi
jne 0x4163a3
or edi, 0x800000
mov dword [ebp - 8], edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x28
mov dword [ebp - 0x10], eax
jbe 0x416447
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [ebp - 0xc]
push ecx
push 2
lea edx, [ebp - 4]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea ecx, [ebp - 0x14]
push ecx
push esi
call ebx
cmp word [ebp - 4], 0x54ad
jne 0x416444
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x34]
cmp dword [ebp - 0x10], edx
jbe 0x416444
push 0
push 0
push eax
push esi
call edi
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea ecx, [ebp - 0x18]
push ecx
push esi
call ebx
mov eax, dword [ebp - 0x18]
cmp eax, 0x5a4d
je 0x41643d
cmp eax, 0x454e
je 0x41643d
cmp eax, 0x454c
je 0x41643d
cmp eax, 0x4550
jne 0x416444
or dword [ebp - 8], 0x400000
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 8]
test eax, eax
je 0x416450
mov dword [eax], edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41645c
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
mov esi, dword [ebp + 0x10]
test esi, esi
mov edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x38]
je 0x4164d6
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
push 0
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
call fcn.00437220
mov dword [esi + 4], edx
mov dword [esi], eax
push 0
mov edx, ebx
sub edx, 0xd53e8000
mov eax, edi
push 0x989680
sbb eax, 0x19db1de
push eax
push edx
call fcn.00437220
mov ecx, dword [ebp - 0x48]
mov dword [esi + 0xc], edx
mov edx, dword [ebp - 0x44]
push 0
sub ecx, 0xd53e8000
push 0x989680
sbb edx, 0x19db1de
push edx
push ecx
mov dword [esi + 8], eax
call fcn.00437220
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x4164fe
push edi
push ebx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.004162c0
movzx edx, word [ebp - 4]
movzx eax, word [ebp - 8]
shl edx, 0x10
add esp, 0x10
or edx, eax
mov dword [esi], edx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4165b0
Capabilities:
Encode data using xor
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
je 0x4166a6
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4165e7
cmp dword [esi + 0x40], edi
jae 0x4165e7
push eax
call fcn.004282af
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x4165ff
lea eax, [edi + edi]
push eax
call fcn.004284f6
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.0042a950
add esp, 0xc
xor ebx, ebx
test edi, edi
jbe 0x4166a3
jmp 0x416620
mov edx, dword [esi + 0x3c]
movzx ecx, byte [ebx + edx]
mov edi, dword [esi + 0x30]
mov byte [ebp + 8], cl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x43f820]
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0x38]
shr edi, 8
xor dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
add ecx, 1
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x43f820]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, byte [ebp + 8]
add ebx, 1
cmp ebx, dword [ebp + 0xc]
mov byte [ebx + ecx - 1], al
jb 0x416620
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x20]
test edx, edx
je 0x4166e5
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x4166ca
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.0042a950
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x416707
push 0
lea edx, [ebp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4169b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [esi + 0x84]
test ecx, ecx
push edi
je 0x416a03
mov eax, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
cmp eax, edi
jae 0x416a40
sub edi, eax
cmp edi, edx
jbe 0x4169d7
mov edi, edx
push edi
add eax, ecx
push eax
push ebx
call fcn.0042a950
mov edx, dword [esi + 0x78]
add dword [esi + 0x8c], edi
add dword [esi + 0x74], edi
add esp, 0xc
mov eax, edi
mov ecx, ebx
call fcn.00416060
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x416a39
push 0
lea ecx, [ebp - 4]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x416a40
mov edi, dword [ebp - 4]
mov edx, dword [esi + 0x78]
add dword [esi + 0x74], edi
mov eax, edi
mov ecx, ebx
call fcn.00416060
mov dword [esi + 0x78], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x417630
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
je 0x4176ec
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 4]
push edx
push ecx
lea edx, [ebp - 8]
push edx
push ecx
push str.installpath
push eax
call ebx
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x417674
cmp eax, 2
jne 0x4176eb
call fcn.00402fa0
mov eax, dword [esi]
mov ecx, dword [ebp - 4]
sub eax, 0x10
shr ecx, 1
mov edx, 1
sub edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
add ecx, 1
sub eax, ecx
or edx, eax
jge 0x41769e
mov eax, esi
call fcn.004030e0
mov eax, dword [ebp + 8]
push edi
mov edi, dword [esi]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [eax]
push edi
lea edx, [ebp - 8]
push edx
push 0
push str.installpath
push ecx
call ebx
test eax, eax
jne 0x4176cd
mov edx, dword [ebp - 4]
shr edx, 1
mov word [edi + edx*2], ax
mov dword [ebp - 0xc], 1
mov edi, dword [esi]
mov ecx, edi
call fcn.004031f0
test eax, eax
jl 0x4176f6
cmp eax, dword [edi - 8]
jg 0x4176f6
mov dword [edi - 0xc], eax
mov ecx, dword [esi]
mov word [ecx + eax*2], 0
pop edi
pop ebx
mov eax, dword [ebp - 0xc]
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004032b0
int3
Function at 0x417710
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43aae3
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x447034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push 0x206
mov dword [ebp - 4], esi
lea eax, [ebp - 0x216]
mov ebx, ecx
push esi
mov dword [ebp - 0x224], esi
push eax
mov dword [ebp - 0x228], ebx
mov word [ebp - 0x218], si
call fcn.0042a8d0
mov edx, dword [0x44951c]
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x44951c
call eax
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], esi
mov edx, dword [0x44951c]
mov eax, dword [edx + 0xc]
mov edi, 1
mov ecx, 0x44951c
mov dword [ebp - 0x224], edi
call eax
add eax, 0x10
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x21c]
push ecx
xor ecx, ecx
mov dword [ebp - 4], edi
call fcn.00402100
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x21c]
cmp dword [edx - 0xc], esi
jne 0x4177d4
lea esi, [ebp - 0x21c]
call fcn.004178e0
lea eax, [ebp - 0x22c]
push 0x440e44
push eax
lea ecx, [ebp - 0x21c]
call fcn.00412a80
add esp, 8
lea edi, [ebp - 0x220]
mov byte [ebp - 4], 3
call fcn.00412ce0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417823
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x220]
push esi
push 0x208
lea ecx, [ebp - 0x218]
push ecx
push 0x43fe18
push str.TryNo
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x41786f
lea ecx, [ebp - 0x218]
call fcn.004031f0
lea edx, [ebp - 0x218]
push edx
push ebx
mov ebx, eax
call fcn.004027d0
mov ebx, dword [ebp - 0x228]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417895
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4178b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004282a0
mov esp, ebp
pop ebp
ret
Function at 0x417db0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push 0x440ed8
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi], eax
je 0x417e97
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WinHttpOpen
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi]
push str.WinHttpConnect
push eax
call edi
mov ecx, dword [esi]
push str.WinHttpOpenRequest
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi]
push str.WinHttpSendRequest
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi]
push str.WinHttpWriteData
push eax
call edi
mov ecx, dword [esi]
push str.WinHttpReceiveResponse
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi]
push str.WinHttpCloseHandle
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
push str.WinHttpReadData
push eax
call edi
mov ecx, dword [esi]
push str.WinHttpQueryDataAvailable
push ecx
mov dword [esi + 0x20], eax
call edi
mov edx, dword [esi]
push str.WinHttpSetTimeouts
push edx
mov dword [esi + 0x24], eax
call edi
cmp dword [esi + 4], ebx
mov dword [esi + 0x28], eax
pop edi
je 0x417e88
cmp dword [esi + 8], ebx
je 0x417e88
cmp dword [esi + 0xc], ebx
je 0x417e88
cmp dword [esi + 0x10], ebx
je 0x417e88
cmp dword [esi + 0x14], ebx
je 0x417e88
cmp dword [esi + 0x18], ebx
je 0x417e88
cmp dword [esi + 0x1c], ebx
je 0x417e88
cmp dword [esi + 0x20], ebx
je 0x417e88
cmp dword [esi + 0x24], ebx
je 0x417e88
cmp eax, ebx
je 0x417e88
mov eax, 1
pop ebx
ret
mov eax, dword [esi]
cmp eax, ebx
je 0x417e97
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
xor eax, eax
pop ebx
ret