joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf7d749
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0xf7c003
call fcn.00f7c008
movzx ebx, word [eax + 0x3c]
jmp 0xf7d98c
lea esp, [esp + 0x14]
cmc
pop word [esp + 7]
sub esp, 0x15
sub esp, 2
jmp 0xf7d765
push bx
pop dword [esp + 9]
cld
push dword [esp + 0xb]
stc
push edi
jmp 0xf7d7a1
sub esp, 0x10
lea esp, [esp + 2]
lea esp, [esp + 0x40]
popfd
jmp 0xf7d855
push dword [esp + 0x26]
mov dword [esp], esi
lea esp, [esp + 4]
push di
push dword [esp + 0xc]
mov dword [esp + 0xf], edi
jmp 0xf7d78b
push eax
push si
call fcn.00f7d7f0
mov byte [esp + 0x17], bl
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], esp
pushal
push eax
mov dword [esp + 0x3c], ebp
jmp 0xf7d8cb
lea esp, [esp + 4]
pushfd
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0xf7d828
pushal
lea esp, [esp + 3]
pop word [esp + 0xb]
lea esp, [esp + 3]
mov dword [esp + 0x50], esi
call fcn.00f7d89c
pop eax
jmp 0xf7d8fe
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0xf7d942
je 0xf7c0cd
sub eax, 0x10000
jmp 0xf7d901
add ebx, eax
cmp word [ebx], 0x4550
je 0xf7bc5c
jne 0xf7d948
fstp dword [edi - 0x31]
stosb byte es:[edi], al
pop ecx
mov dword [ecx], esi
mov al, 0x26
inc ecx
mov al, 0x59
sub dword [ebp + reloc.MSVCRT.dll___dllonexit], ebp
cmp dword [esi + reloc.MSVCRT.dll___dllonexit], edi
or dword [ebx + reloc.MSVCRT.dll___dllonexit], edx
xchg ecx, eax
adc al, 0x8a
in eax, dx
sbb al, 0x9b
or dword [ecx + reloc.MSVCRT.dll___dllonexit], eax
rol byte [edx - 0x30], 0xb7
inc edx
movsb byte es:[edi], byte [esi]
add byte [edi], 0x97
add esp, esp
cmp byte [eax + 0x56b8492e], bh
push ss
xchg ebp, eax
add eax, 0x80749f6c
push es
xchg esp, eax
push cs
mov edi, 0x4e2bbb32
mov ebp, 0x329c180b
push ebp
movsb byte es:[edi], byte [esi]
adc eax, 0x1879e96e
jmp 0xf7da63
invalid

Function at 0xf7d784
Capabilities:
Parse pe header

Disassembly:
push bp
pop word [esp + 0x1c]
cld
call fcn.00f7d726
push word [esp + 7]
jmp 0xf7d73c

Function at 0xf7d80b
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 4], edx
pushal
pop word [esp + 0x15]
push word [esp]
jmp 0xf7d830
mov byte [esp + 2], cl
mov dword [esp], ebx
jmp 0xf7d7f5

Function at 0xf7d89c
Capabilities:
Get number of processors
Parse pe header

Disassembly:
call fcn.00f7c049
mov ebx, eax
jmp 0xf7d8a2
lea esp, [esp + 0x50]
mov eax, dword fs:[0x30]
push ebx
jmp 0xf7d864
mov dword [esp + 0x50], edi
jmp 0xf7d87a
lea ebx, [ebx + 0xc]
mov eax, dword [ebx]
pop ebx
mov eax, dword [eax + 0x1c]
jmp 0xf7d8b1
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0xf7d8f8
push eax
jmp 0xf7c044
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x67f66a9a
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x6f275590
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401ff0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x408e0b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x40e4b8]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov eax, dword [0x40e4b8]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov eax, ecx
mov ecx, dword [ebp + 8]
xor edi, edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x248], edi
mov esi, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0x20]
push edx
or esi, 0x2001f
push esi
push edi
push ecx
push eax
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, edi
jne 0x4020a3
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, edi
je 0x402087
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x20]
and esi, 0x300
mov dword [esp + 0x18], edi
mov ebx, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], esi
cmp eax, edi
je 0x4020c8
mov dword [esp + 0x248], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x4020c1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], edi
mov eax, ebx
jmp 0x402171
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x2c]
push eax
push edi
push edi
push edi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x48]
push eax
push edi
push ecx
mov dword [esp + 0x3c], pe_nt_image_headers32
call esi
test eax, eax
jne 0x40212a
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x18]
call fcn.00401ff0
mov ebx, eax
cmp ebx, edi
jne 0x4020a3
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x18]
push edi
push edi
push edi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
push ecx
push edi
push edx
mov dword [esp + 0x3c], pe_nt_image_headers32
call esi
test eax, eax
je 0x4020f0
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x40213d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
mov dword [esp + 0x1c], edi
call fcn.004015a0
mov esi, eax
mov dword [esp + 0x248], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x40216f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], edi
mov eax, esi
mov dword [esp + 0x18], edi
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.0040840e
mov esp, ebp
pop ebp
ret 4

Function at 0x402770
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0
push 0
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
test eax, eax
jne 0x40278c
pop esi
pop ecx
ret
push edi
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x401f70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x4027b4
mov ecx, dword [esi + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x403430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4090e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x40e4b8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.004026b0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0x1388
mov dword [esi + 0x38], 0x3e8
mov byte [esi + 0x3c], 1
mov byte [esi + 0x3e], 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x4034b7
cmp eax, 0x80010106
jne 0x4034ae
push str.Mscoree.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4034bb
mov byte [0x40e4d0], 1
jmp 0x4034e8
mov byte [esi + 0x3e], 1
mov edi, dword [0x40e580]
cmp edi, dword [0x40e584]
jae 0x4034e8
lea esp, [esp]
mov eax, dword [edi]
test eax, eax
je 0x4034dd
mov eax, dword [eax + 0x20]
push 1
call eax
add edi, 4
cmp edi, dword [0x40e584]
jb 0x4034d0
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x404620
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x409260
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x40e4b8]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x410]
mov edi, dword [ebp + 0x414]
mov ebx, dword [ebp + 0x418]
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp], edx
mov byte [ebp - 4], 1
push 2
push edx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x4046a2
call fcn.00401330
mov edi, eax
jmp 0x40478f
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4046bb
call fcn.00401330
jmp 0x404786
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x4046d6
call fcn.00401330
jmp 0x404786
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x18], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x404717
mov byte [ebp - 4], 0
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x4046fe
lea ecx, [ebp]
call fcn.00401f20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401eb0
mov eax, 0x8007000e
jmp 0x4047ac
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp]
call fcn.00403350
mov dword [ebp - 4], 1
jmp 0x404743
mov eax, dword [ebp]
test eax, eax
jne 0x404751
mov edi, 0x8007000e
jmp 0x404788
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x40476a
call fcn.00401330
jmp 0x404786
xor ecx, ecx
mov edx, dword [ebp]
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x41c]
push eax
mov ecx, dword [ebp]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004044d0
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea edx, [ebp + 4]
cmp dword [ebp], edx
je 0x4047a3
lea ecx, [ebp]
call fcn.00401f20
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0040840e
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405080
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x40e4b8]
xor eax, esp
mov dword [esp + 0x10c], eax
mov edx, dword [esp + 0x118]
push edi
mov edi, dword [esp + 0x120]
mov dword [edi], 0
test edx, edx
jne 0x4050c8
lea eax, [edx + 1]
pop edi
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0040840e
add esp, 0x110
ret 0xc
mov eax, edx
push esi
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4050d0
sub eax, esi
sar eax, 1
je 0x405179
mov eax, edx
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4050f0
sub eax, esi
sar eax, 1
cmp eax, 0x40
ja 0x405179
push edx
push str.SoftwareDownloadManagerIDMBI_s
lea eax, [esp + 0x1c]
push 0x80
push eax
call dword [sym.imp.MSVCR90.dll_swprintf_s]
add esp, 0x10
lea ecx, [esp + 0xc]
push ecx
push 1
push 0
lea edx, [esp + 0x20]
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405179
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0x40ab68
push edx
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40516a
mov eax, dword [esp + 8]
mov dword [edi], eax
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40517e
mov eax, 1
mov ecx, dword [esp + 0x114]
pop esi
pop edi
xor ecx, esp
call fcn.0040840e
add esp, 0x110
ret 0xc

Function at 0x4051a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [0x40e560]
test eax, eax
jne 0x4051d9
push 0x40e560
push 1
push eax
push 0x40ab34
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [0x40e560]
test eax, eax
setne cl
test cl, cl
jne 0x4051d9
mov eax, 1
pop ecx
ret 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
push str.Extensions
push eax
mov dword [esp + 0x20], 0
call esi
test eax, eax
jne 0x40524a
mov eax, dword [esp + 8]
test eax, eax
jbe 0x40524a
inc eax
push eax
push 0
mov dword [esp + 0x10], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov edi, dword [esp + 0x14]
mov dword [edi], eax
test eax, eax
je 0x40524a
lea edx, [esp + 8]
push edx
push eax
mov eax, dword [0x40e560]
push 0
push 0
push str.Extensions
push eax
call esi
test eax, eax
jne 0x405241
pop edi
pop esi
pop ecx
ret 8
mov ecx, dword [edi]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop edi
mov eax, 1
pop esi
pop ecx
ret 8
Function at 0x405260
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [0x40e560]
test eax, eax
jne 0x405299
push 0x40e560
push 1
push eax
push 0x40ab34
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [0x40e560]
test eax, eax
setne cl
test cl, cl
jne 0x405299
mov eax, 1
pop ecx
ret 0xc
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
jne 0x405308
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x405308
inc eax
push eax
push 0
mov dword [esp + 0x14], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ebx, dword [esp + 0x1c]
mov dword [ebx], eax
test eax, eax
je 0x405308
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [0x40e560]
push 0
push 0
push esi
push eax
call edi
test eax, eax
jne 0x4052ff
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
mov ecx, dword [ebx]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc

Function at 0x405320
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esi], 1
mov eax, dword [0x40e568]
test eax, eax
jne 0x40536b
push 0x40e568
push 1
push eax
push str.SoftwareDownloadManagerDwnlPanel
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x405362
mov dword [0x40e568], 0
xor eax, eax
pop esi
pop ecx
ret 8
mov eax, dword [0x40e568]
test eax, eax
je 0x405397
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 8]
push edx
push 0
push 0
push str.PanelView
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405397
mov eax, dword [esp + 4]
mov dword [esi], eax
xor eax, eax
pop esi
pop ecx
ret 8
Function at 0x4054e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x58
mov eax, dword [0x40e4b8]
xor eax, esp
mov dword [esp + 0x54], eax
cmp dword [0x40e568], 0
push ebx
mov ebx, dword [esp + 0x68]
push esi
mov esi, dword [esp + 0x68]
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jne 0x405535
push 0x40e568
push 1
push 0
push str.SoftwareDownloadManagerDwnlPanel
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x405535
mov dword [0x40e568], 0
mov dword [edi], 0
mov dword [ebx], 0
test esi, esi
je 0x405664
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405550
sub eax, edx
sar eax, 1
je 0x405664
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405570
sub eax, edx
sar eax, 1
cmp eax, 0x1f
ja 0x405664
cmp dword [0x40e568], 0
push esi
jne 0x4055ad
call fcn.004053a0
add esp, 4
test eax, eax
je 0x405664
mov dword [ebx], 1
jmp 0x405664
lea eax, [esp + 0x24]
push 0x40
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
lea ecx, [esp + 0x2c]
push 0x40
push ecx
call dword [sym.imp.MSVCR90.dll__wcsupr_s]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0x14
lea edx, [esp + 0xc]
push edx
mov edx, dword [0x40e568]
lea eax, [esp + 0x14]
push eax
push 0
push 0
lea ecx, [esp + 0x30]
push ecx
push edx
mov dword [esp + 0x24], 4
xor bl, bl
call edi
test eax, eax
je 0x405615
push esi
call fcn.004053a0
add esp, 4
test eax, eax
je 0x405613
mov eax, dword [esp + 0x14]
mov dword [eax], 1
jmp 0x405664
mov bl, 1
cmp dword [esp + 0x10], 2
je 0x40562c
test bl, bl
jne 0x40562c
mov ecx, dword [esp + 0x14]
mov dword [ecx], 1
jmp 0x405664
mov ecx, dword [0x40e568]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0
push str.DonlCaptWP
push ecx
mov dword [esp + 0x24], 4
call edi
test eax, eax
jne 0x405664
mov eax, dword [esp + 0x18]
xor edx, edx
cmp dword [esp + 0x10], 1
sete dl
mov dword [eax], edx
mov ecx, dword [esp + 0x60]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040840e
add esp, 0x58
ret 0x10

Function at 0x405680
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esi], 1
mov eax, dword [0x40e568]
test eax, eax
jne 0x4056cb
push 0x40e568
push 1
push eax
push str.SoftwareDownloadManagerDwnlPanel
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4056c2
mov dword [0x40e568], 0
xor eax, eax
pop esi
pop ecx
ret 8
mov eax, dword [0x40e568]
test eax, eax
je 0x4056f7
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 8]
push edx
push 0
push 0
push str.DonlCaptWP
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4056f7
mov eax, dword [esp + 4]
mov dword [esi], eax
xor eax, eax
pop esi
pop ecx
ret 8
Function at 0x405700
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebp
push edi
mov edi, dword [esp + 0x18]
xor ebp, ebp
mov dword [edi], ebp
mov eax, dword [0x40e564]
cmp eax, ebp
jne 0x40574f
push 0x40e564
push 1
push ebp
push str.SoftwareDownloadManagerSpecialKeys
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x405742
pop edi
mov dword [0x40e564], ebp
xor eax, eax
pop ebp
add esp, 8
ret 8
mov eax, dword [0x40e564]
cmp eax, ebp
je 0x40582e
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x10]
push edx
push ebp
push ebp
push str.UseKeyToPrevent
push eax
mov dword [esp + 0x34], 4
call esi
test eax, eax
jne 0x40582d
cmp dword [esp + 0xc], ebp
je 0x40582d
push ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
xor ebx, ebx
push ebx
push ebx
mov dword [edi], 1
mov edx, dword [0x40e564]
push str.AltP
push edx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], 4
call esi
test eax, eax
jne 0x4057bb
mov ebx, dword [esp + 0x10]
mov edx, dword [0x40e564]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push str.ShiftP
push edx
mov dword [esp + 0x38], 4
call esi
test eax, eax
jne 0x4057e7
mov ebp, dword [esp + 0x10]
mov edx, dword [0x40e564]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push str.CtrlP
push edx
mov dword [esp + 0x38], 4
call esi
test eax, eax
mov eax, dword [esp + 0x10]
je 0x405817
mov eax, dword [esp + 0x14]
test ebx, ebx
pop ebx
je 0x40581f
or dword [edi], 2
test ebp, ebp
je 0x405826
or dword [edi], 4
test eax, eax
je 0x40582d
or dword [edi], 8
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 8
Function at 0x405840
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, dword [esp + 0x24]
xor ebp, ebp
mov dword [edi], ebp
mov eax, dword [0x40e564]
cmp eax, ebp
jne 0x40588b
push 0x40e564
push 1
push ebp
push str.SoftwareDownloadManagerSpecialKeys
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x405882
mov dword [0x40e564], ebp
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret 8
mov eax, dword [0x40e564]
cmp eax, ebp
je 0x405878
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x14]
push edx
push ebp
push ebp
push str.UseKeyToForce
mov ebx, 4
push eax
mov dword [esp + 0x44], ebx
call esi
test eax, eax
jne 0x4059d6
cmp dword [esp + 0x10], ebp
je 0x4059d8
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
push eax
mov dword [edi], 1
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov eax, dword [0x40e564]
push str.AltF
push eax
mov dword [esp + 0x44], ebx
call esi
test eax, eax
jne 0x4058fd
mov ebp, dword [esp + 0x10]
mov eax, dword [0x40e564]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0
push str.CtrlF
push eax
mov dword [esp + 0x44], ebx
call esi
test eax, eax
jne 0x405928
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
mov ecx, dword [0x40e564]
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0
push str.ShiftF
push ecx
mov dword [esp + 0x44], ebx
call esi
test eax, eax
jne 0x405954
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], edx
mov edx, dword [0x40e564]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push str.InsF
push edx
mov dword [esp + 0x44], ebx
call esi
test eax, eax
jne 0x405980
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [0x40e564]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0
push str.CheckMouse
push eax
mov dword [esp + 0x44], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x10]
je 0x4059ab
mov eax, dword [esp + 0x20]
test ebp, ebp
je 0x4059b2
or dword [edi], 2
cmp dword [esp + 0x14], 0
je 0x4059bb
or dword [edi], ebx
cmp dword [esp + 0x18], 0
je 0x4059c5
or dword [edi], 8
cmp dword [esp + 0x1c], 0
je 0x4059cf
or dword [edi], 0x10
test eax, eax
je 0x4059d6
or dword [edi], 0x20
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x14
ret 8
Function at 0x4059f0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x1024
call fcn.00408420
mov eax, dword [0x40e4b8]
xor eax, esp
mov dword [esp + 0x1020], eax
mov eax, dword [esp + 0x102c]
push esi
mov esi, dword [esp + 0x1038]
push edi
mov edi, dword [esp + 0x1038]
lea ecx, [esp + 8]
push ecx
push 9
push 0
push str.SoftwareDownloadManagerDwnlSelPanel
mov dword [edi], 1
push SysReAllocStringLen
mov dword [esp + 0x2c], eax
mov dword [esi], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405b64
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebp
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push str.PanelView
mov ebp, 4
push ecx
mov dword [esp + 0x2c], ebp
call ebx
test eax, eax
jne 0x405a85
mov edx, dword [esp + 0x18]
mov dword [esi], edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
xor esi, esi
push esi
push esi
push str.PanelMode
push edx
mov dword [esp + 0x2c], ebp
call ebx
test eax, eax
jne 0x405aad
mov eax, dword [esp + 0x18]
mov dword [edi], eax
cmp dword [edi], 3
jne 0x405b57
mov eax, dword [esp + 0x20]
cmp eax, esi
je 0x405b57
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea edx, [esp + 0x38]
push edx
push esi
xor ecx, ecx
push esi
mov word [eax], cx
mov eax, dword [esp + 0x38]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x405b57
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x405b57
lea ecx, [esp + 0x28]
push ecx
push 1
push 8
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov ebx, eax
cmp ebx, esi
je 0x405b57
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp esi, dword [esp + 0x1c]
je 0x405b48
mov eax, dword [esp + 0x10]
push 0x800
lea edx, [esp + 0x34]
push edx
push esi
push eax
call ebp
mov edi, eax
test edi, edi
jne 0x405b43
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
mov dword [esp + 0x30], esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
inc esi
test edi, edi
je 0x405b10
mov eax, dword [esp + 0x20]
mov ecx, 0x2008
mov word [eax], cx
mov dword [eax + 8], ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop ebx
mov ecx, dword [esp + 0x1028]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040840e
add esp, 0x1024
ret 0x10