joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45aea8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4a2be4]
cmp dword [eax + 0x30], 0
je 0x45af52
cmp dword [ebx + 0x94], 0
jne 0x45af4c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45ae38
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45af4c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45af12
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45af4c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004186c8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45af21
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45bab4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45bae9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004041d4
jmp 0x45baf6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404138
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45cb70
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45cbb1
mov eax, esi
call fcn.00443268
test al, al
je 0x45cbb1
mov eax, dword [ebx + 0x84]
call fcn.00442f64
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45cbb1
push 0
mov eax, dword [ebx + 0x84]
call fcn.00442f64
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4710c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4710c8
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4712ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4712d0
mov eax, esi
call fcn.0046ef4c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404138
lea ecx, [ebp - 0x10]
mov edx, 0x4712e4
mov eax, esi
call fcn.0046ef4c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404138
lea ecx, [ebp - 0x14]
mov edx, 0x4712fc
mov eax, esi
call fcn.0046ef4c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404138
lea ecx, [ebp - 0x18]
mov edx, 0x471318
mov eax, esi
call fcn.0046ef4c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404138
lea ecx, [ebp - 0x1c]
mov edx, 0x471334
mov eax, esi
call fcn.0046ef4c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404138
lea ecx, [ebp - 0x24]
mov edx, 0x47134c
mov eax, esi
call fcn.0046ef4c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408424
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0040896c
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x471364
mov eax, esi
call fcn.0046ef4c
mov eax, dword [ebp - 0x28]
call fcn.00468a24
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x471374
mov eax, esi
call fcn.0046ef4c
mov eax, dword [ebp - 0x2c]
call fcn.00468a24
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x47138c
mov eax, esi
call fcn.0046ef4c
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0040896c
inc eax
je 0x47125d
lea ecx, [ebp - 0x34]
mov edx, 0x47138c
mov eax, esi
call fcn.0046ef4c
mov eax, dword [ebp - 0x34]
call fcn.00408930
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.00409ef8
fstp qword [ebp - 0x3c]
wait
call fcn.0040a25c
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x471278
lea ecx, [ebp - 0x40]
mov edx, 0x47138c
mov eax, esi
call fcn.0046ef4c
mov eax, dword [ebp - 0x40]
call fcn.00468a24
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x47139c
mov eax, esi
call fcn.0046ef4c
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404138
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4712c1
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404108
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404108
ret
Function at 0x47804c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4780a6
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0047803c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00467690
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00467290
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4780ad
lea eax, [ebp - 4]
call fcn.004040e4
ret

Function at 0x4862f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x48631e
mov eax, ebx
call fcn.00486da4
cmp dword [ebx + 0x40], 0
je 0x486317
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x48638f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x486381
cmp dword [ebx + 8], 0
je 0x486340
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x486352
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x486381
cmp dword [ebx + 8], 0
je 0x486333
cmp eax, 3
je 0x486365
dec eax
jne 0x486333
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x486333
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x486333
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4863ad
cmp dword [ebx + 0x14], 0xcc
je 0x4863ad
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004863b8
pop ebx
ret

Function at 0x4991e4
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404594
mov eax, dword [ebp - 8]
call fcn.00404594
xor eax, eax
push ebp
push 0x49927c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x499255
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004045a4
mov ebx, eax
push ebx
call sub.wininet.dll_DeleteUrlCacheEntry
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004045a4
push eax
push ebx
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x499261
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499283
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404108
ret
Function at 0x49928c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404594
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x499406
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.0045d6a4
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.0045d6c4
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4993d2
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404354
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00408e1c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004081d4
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004081d4
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004044f0
je 0x4993ac
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404354
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004081d4
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004081d4
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004044f0
jne 0x4993c3
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.0045d6e4
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x49930d
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49940d
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404108
lea eax, [ebp - 4]
call fcn.004040e4
ret
Function at 0x499418
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404594
mov eax, dword [ebp - 8]
call fcn.00404594
xor eax, eax
push ebp
push 0x49957b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x4a1518]
call fcn.0045daec
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov ecx, 0x499588
call fcn.00405b78
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov ecx, 0x499598
call fcn.00405b78
mov eax, dword [ebp - 4]
call fcn.004045a4
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
mov eax, dword [ebp - 8]
call fcn.004045a4
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
lea eax, [ebp - 0x18]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x125]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
call fcn.004043a4
mov ecx, eax
sub ecx, 4
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00404604
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x125]
mov ecx, 0x105
call fcn.00404354
lea eax, [ebp - 0x12c]
mov edx, 0x4995b0
call fcn.004043ac
mov edx, dword [ebp - 0x12c]
lea eax, [ebp - 0x1c]
call fcn.0040493c
push 0
mov eax, dword [ebp - 0x1c]
call fcn.0040494c
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499582
lea eax, [ebp - 0x12c]
call fcn.004040e4
lea eax, [ebp - 0x20]
call fcn.004040e4
lea eax, [ebp - 0x1c]
call fcn.004047f0
lea eax, [ebp - 0x14]
call fcn.00405b34
lea eax, [ebp - 0x10]
call fcn.00405b34
lea eax, [ebp - 0xc]
call fcn.00405b34
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404108
ret
Function at 0x101d816d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
jmp 0x1020525b
pushfd
lea esp, [esp + 0x2c]
je 0x101edd90
pushfd
pushfd
jmp 0x101dffbd

Function at 0x101d8173
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x28]
je 0x101edd90
not dl
movzx dx, al
seto dh

Function at 0x101d86bf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
jne 0x101edd90
test dh, bh
shl cl, cl
mov ecx, dword [ebx]
cmc
push 0x4718c165
or ecx, ecx
pushfd
lea esp, [esp + 8]
jns 0x101df689
je 0x101edd90
movsx esi, dl
mov dx, 0xab8a
lea edx, [ebx + 4]
lea edi, [ecx*2 + 0x7160b4b5]
push 0xf029d4ba
bswap di
movzx esi, word [edx + 0x1a]
lea edi, [edx*4 + 0x2619b1ea]
not edi
pushfd
bswap edi
lea esi, [esi + edx + 0x1c]
push esp
movzx di, cl
jmp 0x101e083b
jmp 0x101e3379

Function at 0x101de8c1
Capabilities:
Encode data using xor

Disassembly:
or edx, edi
xchg esp, eax
invalid
push ss
pop ss
sti
xor eax, 0x7578efbf
out dx, eax
js 0x101de8f5
popal
dec edi
cmp al, 0x31
jge 0x101de878
sbb al, 0xd4
jno 0x101de908
dec ebp
dec esi
jl 0x101de823
cmp eax, 0x66d05ef3
bt ecx, ecx
mov byte [esp + 8], 0xb4
push 0xfb1ff48c
rol al, 3
call fcn.101e6a00
pop edx
das
add dword [edx + 0x36], edi
jp 0x101de90e
in al, dx
add al, 0x2a
pop edx
push ss
push edx
sub dword [edx - 0x5cf5ad9d], ebp
cmc
jns 0x101de8dc
cmp byte [0xe225c909], ah
dec ebp
or byte [edi + 0x24], ah
pop eax
cwde
mov dh, 0x76
jp 0x101de87d
test eax, 0x4dda5a1e
xchg ebx, eax
mov esi, 0xeb2dc070
inc ebx
in eax, dx
inc edx
mov esp, 0x1d2e8074
inc ebx
sub al, byte [eax]
sbb eax, 0x402a43
out dx, eax
dec edi
sbb dword [edi - 0x58b66099], edx
mov dword [edi - 0x44436f4e], esp
js 0x101de8d6
mov esp, 0x96b878bb
xchg esi, eax
mov ecx, 0xe7f6b43b
mov esi, 0x766c99e8
cmp esp, dword [eax]
xchg edx, eax
lahf
fst qword [ebx]
and ah, ah
adc ch, al
push 0x50
and al, 0xcc
loop 0x101de91a
outsb dx, byte [esi]
sub byte [edx + ecx + 0x1c06ff2], 0x2a
call dword [eax]
pushfd
test al, 0x87
cmp al, 0xbc
pop ds
mov dl, 0x58
out dx, al
invalid

Function at 0x101df851
Capabilities:
Resolve function by parsing pe exports

Disassembly:
fcom st(6)
lcall 0x857c, 0x4ebb959a
lodsd eax, dword [esi]
arpl word [ebx + 0x2b3604c], sp
push 0xb2bfb4a8
jmp 0x102044b1
mov dword [esp + 4], ebx
lea esp, [esp + 0xc]
jne 0x101edd90
bsf ecx, edi
clc
ror ch, 1
mov ecx, dword [ebx]
stc
pushal
or ecx, ecx
push dword [esp + 0xc]
call fcn.101d8173
pop ebx
push ebx
sbb eax, 0xb53ad895
wait
jle 0x101df8af
inc esi
jb int.101df851
inc esp
jne 0x101df819
sbb dword [esi], edi
out dx, eax
lodsd eax, dword [esi]
cmp edx, 0xffffee74
scasb al, byte es:[edi]
iretd
sub ebp, esp
add esi, dword [eax]
ret
call fcn.101d86a9
pushfd
inc al
inc ecx
mov al, 0xb1
pushfd
pushfd
setl al
mov al, 0x10
jmp 0x102035ba
Function at 0x101e339c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
call fcn.1020526d
call fcn.101df1c7
stc
cmp eax, dword [ebp - 0x10]
pushal
call fcn.1020488a
jmp 0x10204b72
or ecx, ecx
pushfd
lea esp, [esp + 4]
je 0x101edd90
pushfd
lea edx, [ebx + 4]
lea edi, [edx + 0x3e1b126]
movzx si, al
movzx esi, word [edx + 0x1a]
push dword [esp]
lea edi, [ebp - 0x4015ee6b]
lea esi, [esi + edx + 0x1c]
pop edi
mov word [esp], 0xf400
not di
mov edi, dword [ebp + 8]
jmp 0x101df6b5
pushal
clc
or eax, eax
pushfd
lea esp, [esp + 0x24]
jne 0x101edd90
not cx
bt sp, bx
mov ecx, dword [ebx]
jmp 0x101ecd9c

Function at 0x101ed88d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
aaa
push ebp
neg bp
mov ebp, esp
aad 0x1e
bsr ax, sp
shrd ax, ax, 0xf
sub esp, 0x18
sal ah, cl
btr ax, 3
bsf eax, ebp
push esi
not ax
and eax, 0x670ac5d3
push edi
aad 0xcc
ror ah, cl
push ebx
sub ah, al
and ax, 0x7edd
push edx
movzx ax, dl
adc eax, esi
btr ax, cx
mov eax, dword [ebp + 8]
pushfd
pushal
test eax, eax
mov byte [esp], cl
push eax
jmp 0x101edf49

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x217a2c09
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push esi
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cmp eax, 9
mov dword [ebp - 4], eax
jl 0x217a72c3
lea eax, [ebp - 0xcc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.217a2c75
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xcc]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x217a2c70
push dword [ebp + 0x10]
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov eax, esi
pop esi
leave
ret
xor eax, eax
jmp 0x217a2c72

Function at 0x217a2c75
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
cmp byte [ecx], bl
push edi
mov dword [ebp - 4], ebx
mov edx, ecx
je 0x217a2c8f
inc edx
cmp byte [edx], bl
jne 0x217a2c8a
mov esi, dword [ebp + 0x10]
dec edx
mov edi, esi
cmp edx, ecx
jb 0x217a2ca1
mov al, byte [edx]
dec edx
mov byte [edi], al
inc edi
jmp 0x217a2c95
mov byte [edi], bl
cmp byte [esi], bl
mov edx, esi
je 0x217a2cae
inc edx
cmp byte [edx], bl
jne 0x217a2ca9
dec edx
cmp byte [ecx], bl
mov dword [ebp + 8], edx
mov edi, ecx
je 0x217a2cbd
inc edi
cmp byte [edi], bl
jne 0x217a2cb8
dec edi
cmp ecx, edi
jae 0x217a2cdc
mov edx, esi
sub edx, ecx
mov al, byte [ecx]
xor byte [ecx + edx], al
movsx eax, byte [ecx + edx]
add dword [ebp - 4], eax
inc ecx
cmp ecx, edi
jb 0x217a2cc6
mov edx, dword [ebp + 8]
xor ebx, ebx
cmp esi, edx
mov ecx, esi
jae 0x217a2ce8
inc ecx
dec edx
cmp ecx, edx
jb 0x217a2ce2
mov eax, dword [ebp - 4]
push 0xa
lea edi, [ecx - 1]
xor edx, edx
pop ecx
div ecx
mov eax, dword [ebp + 0xc]
add dl, 0x61
cmp esi, edi
ja 0x217a2d16
mov cl, byte [esi]
and cl, 0xf
add cl, dl
mov byte [eax], cl
mov cl, byte [esi]
sar cl, 4
inc eax
add cl, dl
mov byte [eax], cl
inc eax
inc esi
jmp 0x217a2cfb
pop edi
mov byte [eax], bl
pop esi
pop ebx
leave
ret
Function at 0x217ac666
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push esi
push edi
xor esi, esi
push dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.217ad5f3
test eax, eax
pop ecx
jne 0x217ac692
push esi
push dword [ebp + 0x10]
call fcn.217ad051
pop ecx
pop ecx
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x10]
call fcn.217ac61b
pop ecx
test eax, eax
pop ecx
je 0x217ac7ac
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x138]
push 0x217b380c
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x2001f
push esi
push 0x217b3aa4
lea eax, [ebp - 0x138]
push esi
push eax
push SysReAllocStringLen
call ebx
cmp eax, esi
jne 0x217ac7ac
cmp dword [ebp + 0xc], esi
jne 0x217ac7cd
push dword [ebp + 8]
lea eax, [ebp - 0x138]
push 0x217b3818
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
lea eax, [ebp - 0x138]
push eax
push 1
push esi
push esi
push dword [ebp - 8]
call edi
cmp eax, esi
jne 0x217ac7ac
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x2001f
push esi
push 0x217b3aa8
push esi
push 0x217b3824
push dword [ebp - 8]
call ebx
cmp eax, esi
jne 0x217ac7ac
lea eax, [ebp - 0x138]
push 0x104
push eax
push dword [0x217b3010]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, esi
je 0x217ac7ac
inc eax
push eax
lea eax, [ebp - 0x138]
push eax
push 1
push esi
push esi
push dword [ebp - 4]
call edi
cmp eax, esi
jne 0x217ac7ac
cmp dword [ebp + 0x14], esi
je 0x217ac7e2
push 0xa
push str.Apartment
push 1
push esi
push 0x217b3840
push dword [ebp - 4]
call edi
cmp eax, esi
je 0x217ac7f0
cmp dword [ebp - 8], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x217ac7bc
push dword [ebp - 8]
call edi
cmp dword [ebp - 4], esi
je 0x217ac7c6
push dword [ebp - 4]
call edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp + 0xc]
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x217ac711
push str.ThreadingModel
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push 1
pop eax
jmp 0x217ac7c8
Function at 0x217ad0ef
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
push dword [ebp + 0x14]
call fcn.217ad051
pop ecx
test eax, eax
pop ecx
je 0x217ad1a4
cmp dword [ebp - 0xc], 0
je 0x217ad25b
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x114]
push ebx
push dword [ebp + 8]
push 0x217b3954
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x114]
mov edi, SysReAllocStringLen
push eax
push edi
call fcn.217ad263
pop ecx
test eax, eax
pop ecx
je 0x217ad1a4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.217ad2e7
add esp, 0x14
test eax, eax
jne 0x217ad1ab
cmp dword [ebp - 8], eax
jne 0x217ad25b
push ebx
lea eax, [ebp - 0x114]
push dword [ebp + 8]
push 0x217b3960
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x114]
push eax
push edi
call fcn.217ad263
pop ecx
test eax, eax
pop ecx
jne 0x217ad25b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call fcn.217ad3a9
add esp, 0xc
lea eax, [ebp - 0x114]
push ebx
push dword [ebp + 8]
push str._s._sCurVer
push eax
call esi
add esp, 0x10
lea eax, [ebp + 0x14]
push eax
push 0xf003f
lea eax, [ebp - 0x114]
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor ecx, ecx
cmp eax, ecx
je 0x217ad252
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0x14]
push eax
push ecx
push 0x2001f
push ecx
push 0x217b3ae4
lea eax, [ebp - 0x114]
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x217ad25b
push dword [ebp - 4]
lea eax, [ebp - 0x114]
push ebx
push dword [ebp + 8]
push 0x217b3978
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x114]
push eax
push 1
push 0
push 0
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
jmp 0x217ad1a6

Function at 0x217ad263
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
lea eax, [ebp - 4]
push esi
push eax
xor esi, esi
push 0xf003f
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
je 0x217ad28e
xor eax, eax
pop esi
leave
ret
push esi
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 8], 0x104
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, esi
jne 0x217ad2c7
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.217ad263
pop ecx
cmp eax, esi
pop ecx
jne 0x217ad28e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor ecx, ecx
cmp eax, esi
sete cl
mov eax, ecx
jmp 0x217ad28b