joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405a10
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0x423580
push eax
xor esi, esi
call fcn.00413570
add esp, 8
test eax, eax
je 0x405a52
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
je 0x405a4b
cmp cl, 0x22
je 0x405a4b
add eax, 1
mov byte [esi + 0x449da0], cl
mov cl, byte [eax]
add esi, 1
test cl, cl
jne 0x405a34
mov byte [esi + 0x449da0], 0
mov eax, 0x449da0
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x405a60
sub eax, edx
push eax
push 0x449da0
mov ecx, 0x42a294
call fcn.00405770
mov esi, dword [esp + 0x10]
push str.PCFAXRX.INI
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push 0x10
push 0x42bc5c
push 0x423e26
push str.IpAddress
push 0x449da0
call edi
push esi
push 0x20
push 0x42bc70
push 0x423e26
push str.NodeName
push 0x449da0
call edi
push esi
push 2
push str.ForceIP
push 0x449da0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
movzx eax, ax
test eax, eax
mov dword [0x433ef8], eax
jne 0x405aec
mov dword [0x433ef8], 2
push esi
push 0xff
push 0x449ea0
push 0x423e26
push str.ModelName
push 0x449da0
call edi
pop edi
mov dword [0x449d94], 1
pop esi
ret
Function at 0x408910
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x18
mov eax, dword [0x42a930]
xor eax, esp
mov dword [esp + 0x14], eax
push str.Brfaxrx.ini
push 0x14
lea eax, [esp + 8]
push eax
push str.0000000
push str.ModelCode
push 0x42a390
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp byte [esp + 1], 0x58
sete al
xor ecx, esp
call fcn.0041355c
add esp, 0x18
ret
Function at 0x409a70
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsPRESTOPM.EXE
push 0x80000002
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409ad9
push edi
lea ecx, [esp + 0x14]
push ecx
push esi
lea edx, [esp + 0x10]
push edx
push eax
push eax
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0x1f4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
je 0x409ad9
mov byte [esi], 0
xor eax, eax
pop esi
pop ecx
ret
cmp byte [esi], 0
jne 0x409ae3
xor eax, eax
pop esi
pop ecx
ret
mov eax, 1
pop esi
pop ecx
ret

Function at 0x409af0
Capabilities:
Get common file path
Get startup folder

Disassembly:
sub esp, 0x9c
mov eax, dword [0x42a930]
xor eax, esp
mov dword [esp + 0x98], eax
push esi
mov esi, dword [esp + 0xa4]
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x18], 2
jne 0x409b2d
lea ecx, [esp + 4]
push ecx
jmp 0x409b32
lea edx, [esp + 4]
push edx
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x409b5b
mov byte [esi], 0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.0041355c
add esp, 0x9c
ret
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x409b40
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x409b70
mov ecx, dword [esp + 0x9c]
pop esi
xor ecx, esp
sub eax, edx
call fcn.0041355c
add esp, 0x9c
ret

Function at 0x409ba0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SOFTWAREVisioneerPaperPortDirectories
push 0x80000002
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409c0d
push edi
lea ecx, [esp + 0x14]
push ecx
push esi
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [esp + 0x20]
push str.MaxData
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0x1f4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
je 0x409c0d
mov byte [esi], 0
xor eax, eax
pop esi
pop ecx
ret
cmp byte [esi], 0
jne 0x409c17
xor eax, eax
pop esi
pop ecx
ret
mov eax, 1
pop esi
pop ecx
ret
Function at 0x409c20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x42a930]
xor eax, esp
mov dword [esp + 0x20c], eax
lea eax, [esp]
push eax
push 1
push 0
push str.SOFTWAREVisioneerPaperPort8.0
push 0x80000002
mov byte [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409c96
push esi
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x1f4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x409c9d
cmp byte [esp + 0xc], 0
jne 0x409cb4
xor eax, eax
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0041355c
add esp, 0x210
ret
mov ecx, dword [esp + 0x20c]
xor ecx, esp
mov eax, 1
call fcn.0041355c
add esp, 0x210
ret

Function at 0x409db0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x20c
mov eax, dword [0x42a930]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
mov ebx, dword [esp + 0x21c]
push ebp
mov ebp, dword [esp + 0x224]
push esi
mov esi, dword [esp + 0x21c]
push edi
mov edi, dword [esp + 0x224]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x44ae80
push 0x4251c8
push 1
push 0
push 0x4251e8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x409e10
xor eax, eax
jmp 0x409eb0
mov eax, dword [0x44ae80]
mov ecx, dword [eax]
mov edx, dword [ecx]
push 0x44ae7c
push 0x4251d8
push eax
call edx
test eax, eax
mov eax, dword [0x44ae80]
je 0x409e36
push 0
push 0
push eax
jmp 0x409ea8
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
mov eax, dword [0x44ae80]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push edi
push eax
call edx
mov eax, dword [0x44ae80]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push ebp
push eax
call edx
push 0x104
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [0x44ae7c]
mov ecx, dword [eax]
push 1
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [0x44ae7c]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov ecx, dword [0x44ae7c]
mov edx, dword [0x44ae80]
push 1
push ecx
push edx
call fcn.00409cd0
add esp, 0xc
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041355c
add esp, 0x20c
ret
Function at 0x40a430
Capabilities:
Delete file

Disassembly:
sub esp, 0x250
mov eax, dword [0x42a930]
xor eax, esp
mov dword [esp + 0x24c], eax
mov edx, dword [esp + 0x254]
push ebx
push esi
xor ebx, ebx
lea eax, [esp + 0x4c]
push edi
mov ecx, eax
xor edi, edi
mov dword [esp + 0xc], ebx
mov byte [esp + 0x50], bl
mov esi, 0x208
sub edx, ecx
jmp 0x40a470
lea ecx, [esi + 0x7ffffdf6]
test ecx, ecx
je 0x40a48d
mov cl, byte [edx + eax]
cmp cl, bl
je 0x40a48d
mov byte [eax], cl
add eax, 1
sub esi, 1
jne 0x40a470
jmp 0x40a491
cmp esi, ebx
jne 0x40a499
sub eax, 1
mov edi, 0x8007007a
cmp edi, ebx
mov byte [eax], bl
je 0x40a4a6
xor al, al
jmp 0x40a59d
push str.Fax_YYYY_MM_DD_hh_mm_ss.dmy
push 0x208
lea edx, [esp + 0x58]
push edx
call fcn.0040a370
test eax, eax
jne 0x40a49f
push 0x4241e4
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00415481
mov ecx, dword [esp + 0x18]
add esp, 0xc
cmp ecx, ebx
je 0x40a59b
mov eax, dword [0x4241dc]
mov edx, dword [str.DummyData]
push ecx
mov dword [esp + 0x18], eax
xor eax, eax
push 1
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov word [esp + 0x36], ax
mov dword [esp + 0x18], edx
mov dx, word [0x4241e0]
lea eax, [esp + 0x18]
push 0x20
push eax
mov word [esp + 0x28], dx
call fcn.0041533b
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00415160
push 0x4241d4
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00415481
mov eax, dword [esp + 0x2c]
add esp, 0x20
cmp eax, ebx
je 0x40a590
push eax
push 1
lea ecx, [esp + 0x38]
push 0x20
push ecx
mov byte [esp + 0x40], bl
call fcn.004150d3
add esp, 0x10
test eax, eax
jbe 0x40a583
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40a583
mov bl, 1
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00415160
add esp, 4
lea edx, [esp + 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, bl
mov ecx, dword [esp + 0x258]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041355c
add esp, 0x250
ret 4

Function at 0x40cb40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.SoftwareBrotherBrother_MFL_Pro
push 0x80000002
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40cba4
mov eax, dword [esp + 4]
cmp eax, esi
je 0x40cba4
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push esi
push esi
push str.LangID
push eax
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40cb99
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x40cbb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.SoftwareBrotherBrother_MFL_Pro
push 0x80000002
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40cc14
mov eax, dword [esp + 4]
cmp eax, esi
je 0x40cc14
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push esi
push esi
push str.LangIDEx
push eax
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40cc09
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x40f260
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 0x10]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40f288
call dword [sym.imp.KERNEL32.dll_GetLastError]
ret 8
xor eax, eax
ret 8

Function at 0x40f350
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
cmp ebx, 1
push ebp
push esi
push edi
jle 0x40f384
xor esi, esi
test ebx, ebx
jle 0x40f384
mov edi, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add edi, 0x10
push edi
call ebp
test eax, eax
je 0x40f38d
add esi, 1
add edi, 0x218
cmp esi, ebx
jl 0x40f370
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x4103f0
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push esi
lea eax, [esp + 0xc]
push eax
push 0x117
push ebx
mov esi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call fcn.00410020
test eax, eax
jne 0x41042c
pop esi
mov eax, 0x57
pop ebx
add esp, 8
ret 0xc
lea ecx, [esp + 8]
push ecx
push 0x111
push ebx
mov ecx, esi
call fcn.00410020
test eax, eax
je 0x41041f
push edi
mov edi, dword [esi + 4]
test edi, edi
jne 0x41044e
xor eax, eax
jmp 0x410463
mov ecx, dword [esi + 8]
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, 0xffffffff
cmp ebx, eax
jae 0x410489
add ebx, 1
push ebx
mov ecx, esi
call fcn.0040fcf0
mov edx, dword [eax + 8]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
sub edx, eax
sub edx, ecx
add edx, 1
jmp 0x4104ce
test edi, edi
jne 0x410491
xor eax, eax
jmp 0x4104a6
mov ecx, dword [esi + 8]
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, 0xffffffff
cmp ebx, eax
jne 0x4104e9
mov edx, dword [esi + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov eax, dword [esp + 0xc]
mov esi, 1
sub esi, eax
sub esi, ecx
add edx, esi
mov esi, dword [esp + 0x20]
lea eax, [eax + ecx - 1]
mov ecx, dword [esp + 0x1c]
pop edi
mov dword [esi], edx
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
add esp, 8
ret 0xc
pop edi
pop esi
mov eax, 0x57
pop ebx
add esp, 8
ret 0xc
Function at 0x4113b0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x414
mov eax, dword [0x42a930]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, dword [esp + 0x41c]
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
test esi, esi
movzx ecx, word [esp + 0x12]
movzx edx, word [esp + 0x10]
movzx eax, word [esp + 0xe]
je 0x410cb9
push esi
push ecx
movzx ecx, word [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0x28]
push str.BRDS:_02d:_02d:_02d._03d___s_r_n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
jmp 0x410cd5
push ecx
movzx ecx, word [esp + 0x10]
push edx
push eax
push ecx
lea edx, [esp + 0x24]
push str.BRDS:_02d:_02d:_02d._03d___NULL__r_n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x414]
pop esi
xor ecx, esp
call fcn.0041355c
add esp, 0x414
ret 4
sub esp, 0x60c
mov eax, dword [0x42a930]
xor eax, esp
mov dword [esp + 0x608], eax
push esi
mov esi, dword [esp + 0x614]
lea eax, [esp + 0x18]
push eax
call fcn.00401270
push str.BrFaxRx.log
lea ecx, [esp + 0x20]
push 0x1f4
push ecx
call fcn.00413b38
add esp, 0x10
cmp dword [0x42a8c4], 0xffffffff
jne 0x4112fb
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x42a8c4], eax
je 0x411382
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x42a8c4], 0xffffffff
je 0x411382
test esi, esi
je 0x411342
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x12]
movzx edx, word [esp + 0x10]
movzx eax, word [esp + 0xe]
push esi
push ecx
movzx ecx, word [esp + 0x14]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea edx, [esp + 0x224]
push str.__08X__02d:_02d:_02d._03d___s_r_n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
jmp 0x41135a
push 0x424fbc
lea eax, [esp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 2
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [0x42a8c4]
lea edx, [esp + 0x218]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x411394
push eax
push str.Write_Error
jmp 0x411389
push 0
push str.Open_Error
push esi
push 0
call fcn.00410ad0
add esp, 0x10
mov ecx, dword [esp + 0x60c]
pop esi
xor ecx, esp
call fcn.0041355c
add esp, 0x60c
ret 4
cmp dword [0x449d64], 2
jne 0x4113be
jmp 0x410c60
jmp 0x411270
Function at 0x4113d0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x3ec
mov eax, dword [0x42a930]
xor eax, esp
mov dword [esp + 0x3e8], eax
push 0x3e7
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call int.00413370
add esp, 0xc
cmp dword [0x449d64], 0
je 0x411434
mov edx, dword [esp + 0x3f0]
lea ecx, [esp + 0x3f4]
push ecx
push edx
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
lea ecx, [esp]
push ecx
call fcn.004113b0
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x3e8]
xor ecx, esp
call fcn.0041355c
add esp, 0x3ec
ret

Function at 0x411450
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x421d78
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x42a930]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42a930]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x58]
mov ebp, dword [esp + 0x5c]
xor ebx, ebx
push 0x2a
push str.SoftwareBrotherBrother_MFL_ProBrMfInfo_
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
call fcn.00405770
mov eax, esi
mov dword [esp + 0x4c], ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4114c0
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x2c]
call fcn.00405680
cmp dword [esp + 0x3c], 0x10
mov eax, dword [esp + 0x28]
jae 0x4114e5
lea eax, [esp + 0x28]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x411542
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x411542
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push ebx
push edi
mov esi, 4
push eax
mov dword [esp + 0x38], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411537
cmp dword [esp + 0x18], esi
jne 0x411537
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x3c], 0x10
jb 0x411556
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0041356b
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0041355c
add esp, 0x3c
ret
Function at 0x411580
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x421dab
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x42a930]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
mov eax, dword [0x42a930]
xor eax, esp
push eax
lea eax, [esp + 0x144]
mov dword fs:[0], eax
mov eax, dword [esp + 0x15c]
mov esi, dword [esp + 0x154]
mov edi, dword [esp + 0x158]
xor ebx, ebx
push 0x2a
push str.SoftwareBrotherBrother_MFL_ProBrMfInfo_
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
call fcn.00405770
mov eax, esi
mov dword [esp + 0x14c], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x411605
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x28]
call fcn.00405680
mov eax, dword [esp + 0x24]
mov esi, 0x10
cmp dword [esp + 0x38], esi
jae 0x41162e
lea eax, [esp + 0x24]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x411699
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x411699
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x20]
push edx
push ebx
push edi
push eax
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41168e
cmp dword [esp + 0x18], 1
jne 0x41168e
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x3c]
push eax
call fcn.00405960
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x38], esi
jb 0x4116ac
mov edx, dword [esp + 0x24]
push edx
call fcn.0041356b
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.0041355c
add esp, 0x140
ret
Function at 0x412ed0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421ed0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x42a930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 4], ebx
mov dword [ebp - 4], ebx
je 0x412f18
push 0x4276f0
lea eax, [ebp - 0x11]
push eax
mov byte [ebp - 0x11], bl
call fcn.00413aee
cmp dword [esi + 0x20], 0x10
jb 0x412f23
mov eax, dword [esi + 0xc]
jmp 0x412f26
lea eax, [esi + 0xc]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x412f47
push 0x4276f0
lea ecx, [ebp - 0x12]
push ecx
mov byte [ebp - 0x12], bl
call fcn.00413aee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x412f8d
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
push 0x4276f0
lea ecx, [ebp - 0x13]
push ecx
mov byte [ebp - 0x13], bl
call fcn.00413aee
mov byte [ebp - 0x14], 0
mov eax, 0x412f78
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41533b
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
push ds
mov esp, 0x6b8a9a26
scasb al, byte es:[edi]
inc esi
adc ebp, dword [ecx]
cmp al, 0xd0
xchg ebp, eax
pop ecx
cwde
sub eax, 0x259efa18
add byte [edi], dl
dec edx
mov ebx, 0x49e9cc8
push fs
pushal
xchg dword [ebx - 0x72], edx
xchg dword [ecx], esi
or al, 0x85
push esp
sal dword [esp + eax*2], cl
xor al, 0x44
je 0x415334
dec ecx
dec ebp
xor byte [ebx + 0x6a761544], cl
jnp 0x41535f
cmp al, 0xba
sub al, 0x1b
test eax, 0x91d2bdf0
jle 0x4153a1
ffree st(5)
or ch, byte [ebx]
or cl, byte es:[ebp - 0x4683e45b]
scasb al, byte es:[edi]
adc eax, 0x79d3f5f8
jl 0x4153ee
mov ebx, 0x49be93e3
outsd dx, dword [esi]
pop ss
out 0xe, al
pushal
push cs
push ecx
invalid
fnstsw word [edx + 0x21c12732]
shl dword [eax], cl
insd dword es:[edi], dx
sub esp, dword [ecx + ebp*8 + 0x58ef3cce]
call 0x573cdf32
lahf
movsd dword es:[edi], dword [esi]
int1
out 0xbc, al
jg 0x415412
bound ebp, qword [edi - 0x521a209e]
add dword [ecx + 0x512009c1], 0xdfb5b80
bound ebx, qword [ebp - 0x22]
dec esp
sbb ah, byte [0xee4ce4d2]
retf
in eax, 0xe8
sub edx, ebp
clc
ret 0x9667
adc eax, 0xfb9968d3

Function at 0x4154d1
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
ret 0xa5fc
invalid
out dx, eax
lea edx, [esi + 0x71c32a70]
add al, 0xb2
jge 0x415417
xchg esp, eax
sahf
inc ebp
pop esi
bound edx, qword [eax + edx*8 + 0x487f473]
sbb byte [eax - 0x6c6f0824], bl
and ah, dl
in eax, 0xdc
ficom dword [eax - 0x4d281ed8]
push es
xor byte [ebx - 0x3f], dl
imul byte [edi]
push ds
test eax, 0xcce51e59
push ebp
sbb bh, ch
out dx, al
lds ebp, [ecx + 0x7b]
cmp al, 0xff
add ah, ah
loope 0x415463
iretd
adc bl, ch
sub edi, dword [esi]
cmp eax, 0x9baf0adb
clc
or esp, dword [ecx]
inc edx
and dword [edi + 0x66], ecx
call 0x5a1c614f
popal
stc
rol byte [eax], 0xa7
test eax, 0x5a24433e
insd dword es:[edi], dx
jmp 0x415483