joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428720
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x74
mov edi, dword [0x457338]
mov dword [esp + 0x14], 0x23de2105
mov dword [esp + 0x18], 0x27c525bb
mov dword [esp + 0x1c], 0xdb46d939
mov dword [esp + 0x20], 0xdf4edd1d
mov dword [esp + 0x24], 0xd316d140
mov dword [esp + 0x28], 0xd742d535
mov dword [esp + 0x2c], 0xcbefc929
mov word [esp + 0x30], 0xcdcc
mov dword [esp + 0x32], 0
mov byte [esp + 0x36], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x22
ja 0x4287bb
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042ad80
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x23
jb 0x428790
lea esi, [esp + 0x68]
lea eax, [esp + 0x14]
push esi
push 0
push 0
push 0xe
push eax
push 0
call edi
mov edi, dword [esp + 0x68]
test edi, edi
jns 0x4287de
mov eax, 0xffffffff
jmp 0x4287e1
lea eax, [edi + edi]
push eax
call fcn.0040c500
add esp, 4
mov ebp, eax
mov ebx, dword [0x457338]
mov dword [esp + 0x14], 0x59865b7f
mov dword [esp + 0x18], 0x5dbb5fa9
mov dword [esp + 0x1c], 0x51ae53bb
mov dword [esp + 0x20], 0x55a65797
mov dword [esp + 0x24], 0x69ae6ba4
mov dword [esp + 0x28], 0x6d9a6f8f
mov dword [esp + 0x2c], 0x6159638b
mov word [esp + 0x30], 0x6760
mov dword [esp + 0x32], 0
mov byte [esp + 0x36], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x22
ja 0x42887b
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042ae00
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x23
jb 0x428850
push esi
push edi
push ebp
push 0xe
lea eax, [esp + 0x24]
push eax
push 0
call ebx
mov eax, dword [esp + 0x68]
mov ecx, eax
add ecx, 9
jns 0x42889b
mov eax, 0xffffffff
jmp 0x4288a2
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040c500
add esp, 4
mov edi, eax
mov dword [esp + 0x14], 0x194a1bb8
mov dword [esp + 0x18], 0x65cb67b7
mov dword [esp + 0x1c], 0x61cd63d1
mov dword [esp + 0x20], 0x6dc56fc9
mov dword [esp + 0x24], 0x696a6bd1
mov dword [esp + 0x28], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x17
ja 0x42891b
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x14]
push dword [esp + 4]
push eax
call fcn.0042ae80
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x18
jb 0x4288f0
movzx ecx, word [ebp]
mov eax, edi
test cx, cx
je 0x428941
lea edx, [ebp + 2]
mov eax, edi
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428930
mov word [eax], 0
movzx ecx, word [esp + 0x14]
test cx, cx
je 0x428971
lea edx, [esp + 0x16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428960
mov esi, dword [esp + 0x88]
mov word [eax], 0
lea eax, [esp + 0x70]
push eax
push edi
call fcn.0044ac20
add esp, 8
not eax
shr eax, 0x1f
mov dword [esp + 0x64], ebp
jmp dword [eax*4 + 0x452ba0]
Function at 0x42c720
Capabilities:
Copy file
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
call fcn.0042c740
add esp, 4
test al, al
je 0x42d040
mov al, 1
ret
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
lea edi, [esp + 0x6a]
xor ebp, ebp
mov esi, 0x20219
mov eax, 1
jmp dword [eax*4 + 0x453400]
Function at 0x42f830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x84
mov edi, dword [0x457338]
mov dword [esp + 0x1c], 0xf935fbd7
mov dword [esp + 0x20], 0xe576e768
mov dword [esp + 0x24], 0xe10de328
mov dword [esp + 0x28], 0xed01ef7c
mov dword [esp + 0x2c], 0xe90eebc7
mov dword [esp + 0x30], 0x9507971a
mov dword [esp + 0x34], 0x91799308
mov dword [esp + 0x38], 0x9d719f00
mov dword [esp + 0x3c], 0x994f9b70
mov dword [esp + 0x40], 0x8562874d
mov dword [esp + 0x44], 0x81698319
mov dword [esp + 0x48], 0x8d138f1d
mov dword [esp + 0x4c], 0x891b8b1b
mov dword [esp + 0x50], 0xb564b71a
mov dword [esp + 0x54], 0xb121b32c
mov dword [esp + 0x58], 0xbdbebf24
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x3f
ja 0x42f8f6
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x1c]
push dword [esp]
push eax
call fcn.00432070
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x1c], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x40
jb 0x42f8d0
lea esi, [esp + 0x80]
lea eax, [esp + 0x1c]
push esi
push 0
push 0
push 0x1f
push eax
push 0
call edi
mov edi, dword [esp + 0x80]
test edi, edi
jns 0x42f91f
mov eax, 0xffffffff
jmp 0x42f922
lea eax, [edi + edi]
push eax
call fcn.0040c500
add esp, 4
mov ebp, eax
mov ebx, dword [0x457338]
mov dword [esp + 0x1c], 0x17d719c5
mov dword [esp + 0x20], 0x13821584
mov dword [esp + 0x24], 0xfef11ec
mov dword [esp + 0x28], 0xbeb0d80
mov dword [esp + 0x2c], 0x7e209d5
mov dword [esp + 0x30], 0x39105f6
mov dword [esp + 0x34], 0x3fa3018c
mov dword [esp + 0x38], 0x3bdb3dac
mov dword [esp + 0x3c], 0x37e139a4
mov dword [esp + 0x40], 0x33d635e3
mov dword [esp + 0x44], 0x2fb331bf
mov dword [esp + 0x48], 0x2ba52da3
mov dword [esp + 0x4c], 0x27b529b1
mov dword [esp + 0x50], 0x23f025b6
mov dword [esp + 0x54], 0xdf4b21a8
mov dword [esp + 0x58], 0xdbdadd48
mov word [esp + 0x5c], 0
mov byte [esp + 0x5e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x42
ja 0x42f9f6
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x1c]
push dword [esp]
push eax
call fcn.00432100
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x1c], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x43
jb 0x42f9d0
push esi
push edi
push ebp
push 0x1f
lea edi, [esp + 0x2c]
push edi
push 0
call ebx
lea eax, [esp + 0x64]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.0044aa70
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x453728]
Function at 0x4305e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x20
mov esi, esp
mov eax, ecx
mov edi, dword [ebp + 8]
test edi, edi
je 0x43072a
movzx ebx, byte [edi]
test bl, bl
je 0x43072a
mov dword [esi + 4], eax
xor ecx, ecx
xor edx, edx
nop
nop
nop
mov eax, ebx
cmp bl, 0x2f
je 0x43062e
movzx ebx, byte [edi + edx + 1]
inc edx
add ecx, 2
test bl, bl
jne 0x430610
xor ebx, ebx
mov edx, dword [esi + 4]
jmp 0x4306c5
mov byte [esi + 3], al
and ecx, 2
mov eax, edx
xor eax, 1
add eax, ecx
add eax, 3
and eax, 0xfffffffc
call fcn.0040c460
mov eax, esp
and eax, 0xfffffff0
mov esp, eax
mov ecx, edx
shr ecx, 2
mov ebx, edi
mov edi, eax
xchg esi, ebx
rep movsd dword es:[edi], dword [esi]
xchg esi, ebx
mov ebx, edx
and ebx, 0xfffffffc
mov dword [esi + 0xc], eax
mov edi, eax
add edi, ebx
add ebx, dword [ebp + 8]
mov ecx, edx
shr ecx, 1
and ecx, 1
mov eax, ebx
mov dword [esi + 8], edi
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
test dl, 1
je 0x430690
mov eax, edx
and eax, 2
movzx ecx, byte [ebx + eax]
mov edi, dword [esi + 8]
mov byte [edi + eax], cl
mov eax, dword [ebp + 8]
lea ebx, [eax + edx]
mov edi, dword [esi + 0xc]
mov byte [edi + edx], 0
mov ecx, 0xffffffff
mov edx, dword [esi + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + ecx + 1], 0
lea ecx, [ecx + 1]
jne 0x4306b0
cmp ecx, 2
jae 0x4306c1
mov edi, eax
movzx eax, byte [esi + 3]
mov edx, dword [edx + 8]
test edx, edx
je 0x430728
mov dword [esi + 8], ebx
mov byte [esi + 3], al
mov dword [esi + 0xc], edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esi + 4], edx
mov eax, dword [edx]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx edi, byte [eax + edx]
lea ebx, [edi - 0x41]
cmp ebx, 0x1a
jae 0x4306ff
or edi, 0x20
mov ecx, dword [esi + 0xc]
movsx ebx, byte [ecx + edx]
lea ecx, [ebx - 0x41]
cmp ecx, 0x1a
jae 0x430711
or ebx, 0x20
test edi, edi
je 0x43071a
inc edx
cmp edi, ebx
je 0x4306f0
cmp edi, ebx
je 0x430734
mov edx, dword [esi + 4]
mov edx, dword [edx + 4]
test edx, edx
jne 0x4306e0
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
cmp byte [esi + 3], 0x2f
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
jne 0x43072a
inc edx
mov ecx, eax
push edx
call fcn.004305e0
jmp 0x43072a
Function at 0x4313a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
cmp edi, 0x24
ja 0x4313fa
cmp edi, 1
je 0x4313fa
mov ebp, dword [esp + 0x34]
mov ebx, ebp
jmp 0x4313d1
inc ebx
movzx eax, byte [ebx]
movzx ecx, al
lea edx, [ecx - 9]
cmp edx, 5
jb 0x4313d0
cmp ecx, 0x20
je 0x4313d0
cmp ecx, 0x2b
mov edx, edi
je 0x4313f0
cmp ecx, 0x2d
jne 0x43140f
inc ebx
cmp al, 0x2b
sete byte [esp + 3]
jmp 0x431414
xor edi, edi
test eax, eax
je 0x4315cd
mov dword [eax], 0x16
jmp 0x4315cd
mov byte [esp + 3], 1
test edx, edx
mov dword [esp + 4], ebp
jle 0x43143d
cmp edx, 0x10
jne 0x431455
cmp byte [ebx], 0x30
jne 0x431436
movzx eax, byte [ebx + 1]
and al, 0xdf
xor ecx, ecx
cmp al, 0x58
sete cl
lea ebx, [ebx + ecx*2]
mov edi, 0x10
jmp 0x431457
xor eax, eax
xor ecx, ecx
cmp byte [ebx], 0x30
setne al
sete cl
add ebx, ecx
lea edi, [eax*2 + 8]
jmp 0x431457
mov edi, edx
movzx ecx, byte [esp + 3]
mov eax, SysReAllocString
mov dword [esp + 0x14], ecx
sub eax, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
xor edx, edx
div edi
mov dword [esp + 0x18], eax
xor ebp, ebp
xor esi, esi
mov edx, edi
mov dword [esp + 0x1c], edi
inc ebx
jmp 0x4314b0
mov ebp, ecx
mov edi, 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x431568
mov esi, edi
mov dword [eax], 0x22
mov dword [esp + 4], ebx
inc ebx
mov edi, ebp
movsx eax, byte [ebx - 1]
lea ebp, [eax - 0x30]
cmp ebp, 0xa
jb 0x4314d7
mov ecx, eax
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x431598
or al, 0x20
movsx ebp, al
add ebp, 0xffffffa9
cmp ebp, edx
jge 0x431598
mov eax, edi
mov ecx, dword [esp + 8]
xor eax, ecx
or eax, esi
je 0x431490
mov dword [esp + 0x10], ebx
mov eax, edi
mov ecx, edx
mul edx
mov dword [esp + 4], eax
xor eax, eax
cmp dword [esp + 0x18], edi
mov edi, 0
sbb edi, esi
setae bl
jae 0x431520
xor edx, edx
mov esi, dword [esp + 8]
jmp 0x431529
imul esi, ecx
add edx, esi
mov esi, dword [esp + 4]
mov ecx, ebp
sar ecx, 0x1f
mov edi, dword [esp + 8]
sub edi, ebp
sbb eax, ecx
add ebp, esi
adc ecx, edx
cmp edi, esi
mov edi, ecx
mov ecx, dword [esp + 8]
sbb eax, edx
setae al
jae 0x43154d
xor edi, edi
mov ebp, ecx
and bl, al
mov eax, dword [esp + 0x40]
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x43157d
test bl, bl
jne 0x43157d
mov ebx, dword [esp + 0x10]
jmp 0x4314a3
mov dword [esp + 0xc], 0x22
mov dword [esp + 4], ebx
mov ebp, ecx
xor esi, esi
jmp 0x431485
mov esi, edi
test bl, bl
jne 0x43158b
mov dword [esp + 0xc], 0x22
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ebx
jmp 0x431485
mov eax, dword [esp + 0x38]
test eax, eax
je 0x4315a6
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 0x40]
test ecx, ecx
mov eax, dword [esp + 0xc]
je 0x4315b4
mov eax, dword [ecx]
cmp eax, 0x22
jne 0x4315c4
mov edi, SysReAllocString
sub edi, dword [esp + 0x14]
jmp 0x4315cd
cmp byte [esp + 3], 0
jne 0x4315cd
neg edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439260
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x43928f
jmp 0x4393cc
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x4392cc
jmp 0x4393c4
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x4392da
sub esp, 4
mov dword [ebp - 0x2c], eax
mov dword [esp], eax
call fcn.0040c660
add esp, 4
mov edx, eax
jmp 0x4392ef
cmp edx, 0
setne al
jmp 0x4392f7
jmp 0x4392f9
xor ebx, ebx
test al, 1
jne 0x439304
jmp 0x4393b8
mov al, byte [esi]
mov byte [ebp - 0x14], al
mov byte [ebp - 0x28], 0x53
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x26], 0x6b
mov byte [ebp - 0x25], 0x63
mov byte [ebp - 0x24], 0x4e
mov byte [ebp - 0x23], 0x5a
mov byte [ebp - 0x22], 0x4f
mov byte [ebp - 0x21], 0x5d
mov byte [ebp - 0x20], 0x54
mov byte [ebp - 0x1f], 0x9f
mov byte [ebp - 0x1e], 0x26
mov byte [ebp - 0x1d], 0x23
mov byte [ebp - 0x1c], 0x28
mov byte [ebp - 0x1b], 0xa5
mov eax, 0xe
mov byte [ebp + eax - 0x28], 0
add eax, 1
cmp eax, 0x14
jne 0x439346
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x14
jae 0x439393
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0x28]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov esi, edx
call fcn.0043ce50
mov edx, esi
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [ebp + ecx - 0x28], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x43935a
lea eax, [ebp - 0x28]
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040d290
mov bl, al
and bl, 1
jmp 0x4393b6
jmp 0x4393b8
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4393cc
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4405f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4406ec
mov ebp, dword [esp + 0x18]
xor esi, esi
mov edi, 2
jmp 0x440629
lea ecx, [edi + 4]
add edi, 2
mov eax, dword [esp]
mov esi, eax
cmp edi, edx
mov edi, ecx
mov ebp, dword [esp + 0x18]
jae 0x4406ee
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.004219b0
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.004219b0
mov edx, dword [esp + 0x20]
add esp, 4
mov bl, al
lea eax, [esi + 1]
mov dword [esp], eax
shl bh, 2
mov eax, ebx
shr al, 4
and al, 3
or al, bh
mov ecx, dword [esp + 0x20]
mov byte [ecx + esi], al
cmp edi, edx
jae 0x440610
movzx eax, byte [ebp + edi]
push eax
call fcn.004219b0
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x440610
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea ebx, [esi + 2]
mov dword [esp], ebx
mov ebx, dword [esp + 0x20]
mov byte [ebx + esi + 1], cl
lea ecx, [edi + 1]
cmp ecx, edx
jae 0x440610
mov ecx, dword [esp + 0x18]
movzx ecx, byte [ecx + edi + 1]
push ecx
mov ebx, eax
call fcn.004219b0
mov edx, dword [esp + 0x20]
add esp, 4
cmp al, 0x40
je 0x440610
mov ecx, ebx
shl cl, 6
mov edx, eax
and dl, cl
add dl, dl
xor cl, al
add cl, dl
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov byte [eax + esi + 2], cl
add esi, 3
mov dword [esp], esi
jmp 0x440610
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4019cf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4a9a08]
xor eax, ebp
mov dword [ebp + 0x190], eax
mov eax, dword [ebp + 0x19c]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push edi
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x74]
push eax
mov edi, str.SoftwareAdobeAdobe_Acrobat8.0LanguageNext
push edi
mov ebx, reloc.WS2_32.dll_accept
push ebx
call esi
test eax, eax
je 0x401a57
lea eax, [ebp - 0x74]
push eax
push edi
mov edi, reloc.WS2_32.dll_bind
push edi
call esi
test eax, eax
je 0x401a57
lea eax, [ebp - 0x74]
push eax
push str.SoftwareAdobeAcrobat_Reader8.0LanguageNext
push ebx
call esi
test eax, eax
je 0x401a57
lea eax, [ebp - 0x74]
push eax
push str.SoftwareAdobeAcrobat_Reader8.0LanguageNext
push edi
call esi
test eax, eax
je 0x401a57
lea eax, [ebp - 0x74]
push eax
push str.SoftwareAdobeAcrobat_Reader8.0LanguageCurrent
push edi
call esi
test eax, eax
jne 0x401ae2
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x74]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x401ae2
cmp dword [ebp - 0x7c], 1
jne 0x401ae2
mov eax, dword [ebp - 0x78]
cmp eax, 4
jb 0x401ae2
mov esi, dword [sym.imp.MSVCR80.dll__wcsicmp]
shr eax, 1
lea eax, [ebp + eax*2 - 0x78]
push 0x498d78
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x401ade
mov eax, dword [ebp - 0x78]
shr eax, 1
lea eax, [ebp + eax*2 - 0x78]
push 0x498d80
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x401ade
mov edx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x80]
shr edx, 1
push 4
lea edx, [ebp + edx*2 - 0x78]
pop eax
call fcn.00401014
xor eax, eax
inc eax
jmp 0x401ae5
xor eax, eax
jmp 0x401ae5
or eax, 0xffffffff
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004801ca
add ebp, 0x194
leave
ret

Function at 0x4030d8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x489a03
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4a9a08]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x20]
call fcn.00402011
and dword [esp + 0x30], 0
lea eax, [ebp + 8]
push eax
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0040388f
push esi
push dword [esi + 4]
lea ecx, [esp + 0x18]
call fcn.00403f8a
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
call fcn.00403d2a
test al, al
jne 0x403159
push dword [esp + 0xc]
lea eax, [esp + 0x14]
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004034ca
lea eax, [ebp + 8]
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.004037c3
lea ecx, [esp + 0x1c]
call fcn.00402044
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x403185
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x489a03
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4a9a08]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x20]
call fcn.00402011
and dword [esp + 0x30], 0
lea eax, [ebp + 8]
push eax
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0040388f
push esi
push dword [esi + 4]
lea ecx, [esp + 0x1c]
call fcn.00403f8a
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.00403d2a
test al, al
jne 0x403206
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push dword [esp + 0x10]
mov ecx, esi
push eax
call fcn.004034ca
lea ecx, [esp + 0x1c]
call fcn.00402044
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x403222
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4899e0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4a9a08]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x28]
call fcn.00402011
and dword [esp + 0x38], 0
lea edi, [ebp + 8]
lea ebx, [esp + 0x10]
call fcn.00403749
push esi
push dword [esi + 4]
lea ecx, [esp + 0x20]
call fcn.00403f8a
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
call fcn.00403d2a
test al, al
jne 0x40329f
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push dword [esp + 0x14]
mov ecx, esi
push eax
call fcn.004034ca
lea eax, [ebp + 8]
push eax
lea edi, [esp + 0x1c]
mov ebx, esi
call fcn.00403412
lea ecx, [esp + 0x24]
call fcn.00402044
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4032cc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4899bd
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4a9a08]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x1c]
call fcn.00402011
and dword [esp + 0x38], 0
push esi
lea ecx, [esp + 0x24]
call fcn.004033bc
mov byte [esp + 0x38], 1
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
lea ecx, [esp + 0x20]
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.00403f8a
jmp 0x40334d
lea ecx, [esp + 8]
call fcn.00403db5
mov edx, dword [ebp + 8]
mov ecx, dword [eax]
push dword [edx]
mov eax, dword [ecx]
call dword [eax]
lea ecx, [esp + 8]
call fcn.0040406c
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x28]
lea ecx, [esp + 0x18]
call fcn.00403f8a
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
call fcn.00403d2a
test al, al
je 0x403330
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.00403b17
lea ecx, [esp + 0x18]
call fcn.00402044
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x404240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x482e83
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4a9a08]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], 0
call fcn.00404200
mov esi, dword [esp + 0x3c]
push str.Commands
push eax
push esi
mov dword [esp + 0x40], 1
call dword [sym.imp.MSVCP80.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_char__struct_std::char_traits_char___class_std::allocator_char___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
add esp, 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x30], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret

Function at 0x4042c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x482e83
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4a9a08]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], 0
call fcn.00404200
mov esi, dword [esp + 0x3c]
push str.Notification
push eax
push esi
mov dword [esp + 0x40], 1
call dword [sym.imp.MSVCP80.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_char__struct_std::char_traits_char___class_std::allocator_char___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
add esp, 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x30], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret

Function at 0x404340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x482eb1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4a9a08]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea eax, [esp + 0xc]
push eax
call fcn.0043f220
add esp, 4
push eax
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.00436150
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov dword [esi], vtable.CSynchronizerDatabaseWatcher.0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret