joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c7a3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push edi
xor eax, eax
cmp dword [ebp + 0x10], eax
push 0x34
pop ebx
je 0x40c7b8
push 0x30
pop ebx
mov edi, dword [ebp + 0xc]
cmp dword [edi], ebx
jae 0x40c7c6
xor eax, eax
jmp 0x40c97b
cmp dword [ebp + 0x10], eax
push esi
push eax
lea eax, [ebp + 0x10]
push eax
push ebx
je 0x40c84d
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp + 0x14]
push dword [ebp - 0x1c]
mov dword [esi + 8], eax
call fcn.0040c74f
push dword [ebp - 0x1c]
mov byte [esi + 0x16], al
call fcn.0040af62
mov byte [esi + 0x17], al
mov eax, dword [ebp - 0x30]
mov dword [esi], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0xc], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [esi + 0x18]
push eax
call fcn.00427a30
mov ax, word [ebp - 6]
and dword [esi + 0x10], 0
mov word [esi + 0x2a], ax
mov ax, word [ebp - 0x20]
mov word [esi + 0x14], ax
mov ax, word [ebp - 4]
mov word [esi + 0x2c], ax
mov ax, word [ebp - 8]
mov word [esi + 0x28], ax
mov ax, word [ebp - 0x2c]
add esp, 0x14
and dword [esi + 0x30], 0
mov word [esi + 4], ax
jmp 0x40c85a
mov esi, dword [ebp + 0x14]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub dword [edi], ebx
movzx ecx, word [esi + 0x28]
mov ebx, dword [edi]
mov eax, 0xff
cmp ecx, eax
jbe 0x40c86d
mov eax, ecx
movzx edx, word [esi + 0x2a]
cmp edx, eax
jbe 0x40c877
mov eax, edx
movzx edx, word [esi + 0x2c]
cmp edx, eax
jbe 0x40c881
mov eax, edx
cmp ebx, ecx
jae 0x40c88c
xor eax, eax
jmp 0x40c97a
inc eax
push eax
call fcn.0043be5a
pop ecx
mov ebx, eax
push 0
lea eax, [ebp + 0x10]
push eax
movzx eax, word [esi + 0x28]
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, word [esi + 0x28]
push ebx
push dword [ebp + 0x20]
mov byte [eax + ebx], 0
mov byte [ebx + 0xff], 0
call fcn.00428660
movzx eax, word [esi + 0x28]
sub dword [edi], eax
movzx eax, word [esi + 0x2a]
pop ecx
pop ecx
mov ecx, dword [edi]
cmp ecx, eax
jb 0x40c910
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, word [esi + 0x2a]
push ebx
push dword [ebp + 0x18]
mov byte [eax + ebx], 0
mov byte [ebx + 0xff], 0
call fcn.00428660
movzx eax, word [esi + 0x2a]
sub dword [edi], eax
movzx eax, word [esi + 0x2c]
pop ecx
pop ecx
mov ecx, dword [edi]
cmp ecx, eax
jae 0x40c91c
push ebx
call fcn.0043be55
pop ecx
jmp 0x40c885
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, word [esi + 0x2c]
push ebx
push dword [ebp + 0x1c]
mov byte [eax + ebx], 0
mov byte [ebx + 0xff], 0
call fcn.00428660
movzx eax, word [esi + 0x2c]
sub dword [edi], eax
push ebx
call fcn.0043be55
mov eax, 0xff
add esp, 0xc
cmp word [esi + 0x28], ax
jbe 0x40c963
mov word [esi + 0x28], ax
cmp word [esi + 0x2a], ax
jbe 0x40c96d
mov word [esi + 0x2a], ax
cmp word [esi + 0x2c], ax
jbe 0x40c977
mov word [esi + 0x2c], ax
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
leave
ret
Function at 0x40c97f
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x384
push ebx
push esi
mov ebx, ecx
push edi
lea ecx, [ebx + 0x134]
call fcn.0040a615
xor esi, esi
push esi
push 0x8000000
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 0x70]
mov dword [ebp + 0x54], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp + 0x64], edi
jne 0x40c9dc
cmp dword [ebp + 0x7c], esi
jne 0x40cb77
push 0x30
push str.Proxy_Checker_Pro_v7
push str.File_not_found
jmp 0x40ca79
lea eax, [ebp + 0x58]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x38
mov dword [ebp + 0x70], eax
jb 0x40ca5d
push esi
lea eax, [ebp + 0x58]
push eax
push 4
lea eax, [ebp + 0x5c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 4
lea eax, [ebp + 0x5c]
push 0x4564dc
push eax
mov dword [ebp + 0x60], esi
call fcn.004285a0
add esp, 0xc
test eax, eax
jne 0x40ca46
mov dword [ebp + 0x60], 1
sub dword [ebp + 0x70], 4
cmp dword [ebp + 0x78], esi
jne 0x40ca3c
lea ecx, [ebx + 0x134]
call fcn.0040a6bf
mov dword [ebx + 0x184], esi
mov edi, 0x33c
jmp 0x40cb23
push 4
lea eax, [ebp + 0x5c]
push 0x4562c0
push eax
call fcn.004285a0
add esp, 0xc
test eax, eax
je 0x40ca22
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x7c], esi
jne 0x40cb77
push 0x30
push str.Proxy_Checker_Pro_v7
push str.Bad_or_corrupted_database_file
push dword [ebp + 0x74]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40cb77
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x31c], eax
mov al, byte [ebp + 0x36]
or dword [ebp + 0x1c], 0xffffffff
mov byte [ebp - 5], al
mov al, byte [ebp + 0x37]
mov cl, al
and al, 0xc0
mov byte [ebp - 4], al
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x30c], eax
push 0x10
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp - 2]
and cl, 0xf
push eax
mov byte [ebp - 6], cl
call fcn.00427a30
mov ax, word [ebp + 0x34]
mov word [ebp - 0x308], ax
mov ax, word [ebp + 0x24]
mov word [ebp - 0x314], ax
mov eax, dword [ebp + 0x50]
add esp, 0xc
cmp dword [ebp + 0x54], esi
mov dword [ebp + 0x10], eax
je 0x40cb11
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebx + 0x134]
call fcn.0040a619
test eax, eax
jne 0x40cb23
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebx + 0x134]
call fcn.0040a9e0
push edi
lea eax, [ebp - 0x31c]
push esi
push eax
call fcn.00428760
lea eax, [ebp - 0x306]
push eax
lea eax, [ebp - 0x106]
push eax
lea eax, [ebp - 0x206]
push eax
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x60]
lea eax, [ebp + 0x70]
push eax
push dword [ebp + 0x64]
call fcn.0040c7a3
add esp, 0x28
test eax, eax
jne 0x40ca87
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x180], 1
pop edi
pop esi
pop ebx
add ebp, 0x68
leave
ret 0x10
Function at 0x40d168
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x17c], 0
jne 0x40d2a5
and dword [esi + 0x178], 0
cmp byte [esi + 0x1f6], 0
je 0x40d19a
call fcn.00419cf2
test eax, eax
je 0x40d2a5
push ebx
push edi
mov edi, 0x1f04
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
xor edi, edi
mov ebx, eax
push edi
push ebx
call fcn.00428760
mov eax, dword [esi + 0x128]
mov dword [ebx + 0x218], eax
mov eax, dword [esi + 0x230]
add esp, 0xc
sub eax, edi
je 0x40d1fa
dec eax
je 0x40d1f2
dec eax
je 0x40d1ea
dec eax
jne 0x40d20f
lea eax, [esi + 0x634]
jmp 0x40d200
lea eax, [esi + 0x534]
jmp 0x40d200
lea eax, [esi + 0x434]
jmp 0x40d200
lea eax, [esi + 0x334]
push eax
lea eax, [esi + 0x234]
push eax
call fcn.00428660
pop ecx
pop ecx
push 0x1ce0
lea eax, [esi + 0x188]
push eax
lea eax, [ebx + 0x220]
push eax
call fcn.00427a30
add esp, 0xc
cmp dword [ebp + 8], edi
je 0x40d23e
cmp dword [esi + 0x1e74], edi
je 0x40d23e
mov byte [ebx + 0x1f00], 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 4]
push 0x40cb81
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, 0xffffffff
mov dword [esi + 0x1e68], eax
jne 0x40d284
push str.WARNING:_Failed_to_start_pretest___thread_creation_failed
push dword [esi + 0x128]
call fcn.0040c057
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40d2a3
push str.Pretest_started
push dword [esi + 0x128]
call fcn.0040c057
pop ecx
pop ecx
mov dword [esi + 0x18], edi
mov dword [esi + 0x17c], 1
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x40d8a3
Capabilities:
Terminate thread

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0x1f98]
push edi
xor edi, edi
test ebx, ebx
jbe 0x40d8d7
push ebp
lea ebp, [esi + 0x1f80]
lea eax, [esp + 0x10]
push eax
push edi
mov ecx, ebp
call fcn.0040d2e0
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
inc edi
cmp edi, ebx
jb 0x40d8ba
pop ebp
mov esi, dword [esi + 0x1e68]
cmp esi, 0xffffffff
je 0x40d8eb
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x40d9b8
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
mov edi, ecx
mov ebx, dword [edi + 0x1f98]
test ebx, ebx
jbe 0x40da01
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
lea ecx, [edi + 0x1f80]
call fcn.0040d2e0
push 0
push dword [ebp - 0x14]
call esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jb 0x40d9d7
mov edi, dword [edi + 0x1e68]
cmp edi, 0xffffffff
je 0x40da11
push 0
push edi
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4120f3
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x754
push edi
lea edi, [ecx + 0x2338]
mov dword [ebp - 0xc], ecx
mov ecx, edi
call fcn.00410b40
test eax, eax
mov dword [ebp - 0x14], eax
je 0x4122ee
push ebx
push esi
mov ecx, edi
call fcn.00410b11
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
inc ebx
test eax, eax
mov esi, 0x400
jbe 0x4121c6
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00410b25
lea ecx, [ebp - 0x754]
push ecx
mov dword [ebp - 4], eax
push eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x1e68]
add ecx, 0x134
call fcn.0040aae6
cmp dword [ebp - 0x750], 0
je 0x412189
push esi
lea eax, [ebp - 0x418]
push eax
push 0
push dword [ebp - 4]
mov ecx, edi
call fcn.004358f3
lea eax, [ebp - 0x418]
jmp 0x41218f
lea eax, [ebp - 0x73e]
push eax
call fcn.004279a0
pop ecx
push esi
add ebx, eax
lea eax, [ebp - 0x418]
push eax
push 1
push dword [ebp - 4]
mov ecx, edi
call fcn.004358f3
lea eax, [ebp - 0x418]
push eax
call fcn.004279a0
dec dword [ebp - 8]
pop ecx
lea ebx, [ebx + eax + 3]
jne 0x41213a
push ebx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, edi
mov dword [ebp - 4], eax
call fcn.00410b11
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jbe 0x4122bb
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00410b25
mov ebx, eax
push esi
lea eax, [ebp - 0x418]
push eax
push 0
push ebx
mov ecx, edi
call fcn.004358f3
lea eax, [ebp - 0x418]
push str.0.0.0.0
push eax
call fcn.004287c0
test eax, eax
pop ecx
pop ecx
jne 0x41225b
lea eax, [ebp - 0x754]
push eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x1e68]
push ebx
add ecx, 0x134
call fcn.0040aae6
lea eax, [ebp - 0x73e]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.00428660
pop ecx
pop ecx
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 4]
call fcn.00428670
push 0x457884
push dword [ebp - 4]
call fcn.00428670
add esp, 0x10
push esi
lea eax, [ebp - 0x418]
push eax
push 1
push ebx
mov ecx, edi
call fcn.004358f3
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 4]
call fcn.00428670
cmp dword [ebp - 0x14], 1
pop ecx
pop ecx
je 0x4122b2
push 0x453e70
push dword [ebp - 4]
call fcn.00428670
pop ecx
pop ecx
dec dword [ebp - 8]
jne 0x4121f4
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0xc]
test eax, eax
pop esi
pop ebx
je 0x4122d0
mov eax, dword [eax + 0x1c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp - 0x18]
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
leave
ret
Function at 0x4136b2
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0xa
pop eax
mov esi, ecx
push 0xea60
push esi
lea ecx, [esp + 0x18]
push ecx
lea edi, [esi + 0x2338]
xor ebx, ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov eax, dword [edi]
push 0x50010049
mov ecx, edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [eax + 0x130]
push 1
lea eax, [esi + 0x2330]
push eax
mov ecx, edi
call fcn.00402da3
push ebx
push 0x200
push ebx
mov ecx, edi
call fcn.0043b256
cmp edi, ebx
jne 0x413716
xor eax, eax
jmp 0x413719
mov eax, dword [edi + 0x1c]
push 0x27
push ebx
push 0x1036
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
or ebp, 0xffffffff
push ebp
push dword [esi + 0x1ac]
mov ecx, edi
push ebx
push 0x45798c
push ebx
call fcn.0043595c
push ebp
push dword [esi + 0x1b0]
mov ecx, edi
push 1
push 0x457984
push 1
call fcn.0043595c
push ebp
push dword [esi + 0x1b4]
mov ecx, edi
push ebx
push 0x457978
push 2
call fcn.0043595c
push ebp
push dword [esi + 0x1b8]
mov ecx, edi
push ebx
push 0x457970
push 3
call fcn.0043595c
push ebp
push dword [esi + 0x1bc]
mov ecx, edi
push 1
push 0x457968
push 4
call fcn.0043595c
push ebp
push dword [esi + 0x1c0]
mov ecx, edi
push 1
push 0x457960
push 5
call fcn.0043595c
push ebp
push dword [esi + 0x1c4]
mov ecx, edi
push 1
push 0x457954
push 6
call fcn.0043595c
push ebp
push dword [esi + 0x1c8]
mov ecx, edi
push ebx
push 0x45794c
push 7
call fcn.0043595c
push ebp
push dword [esi + 0x1cc]
mov ecx, edi
push ebx
push 0x457944
push 8
call fcn.0043595c
push ebp
push dword [esi + 0x1d0]
mov ecx, edi
push ebx
push 0x457938
push 9
call fcn.0043595c
push ebp
push dword [esi + 0x1d4]
push ebx
push 0x45792c
push 0xa
mov ecx, edi
call fcn.0043595c
push 1
add esi, 0x1e70
push esi
mov ecx, edi
call fcn.00412f73
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x413d29
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ecx
push esi
mov esi, ecx
test esi, esi
push edi
jne 0x413d36
xor eax, eax
jmp 0x413d39
mov eax, dword [esi + 0x1c]
push ebx
push ebp
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [esp + 0x10], eax
lea eax, [edi + 1]
push eax
call fcn.0043be5a
push edi
push dword [esp + 0x18]
mov ebp, eax
push ebp
call fcn.00427a30
add esp, 0x10
push ebx
mov byte [edi + ebp], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esi + 0x1e68]
call fcn.0040af50
mov ecx, dword [esi + 0x1e68]
mov edi, eax
xor eax, eax
mov ax, word [esi + 0x1f4]
push eax
push ebp
call fcn.0040d5a8
push ebp
call fcn.0043be55
pop ecx
mov ecx, dword [esi + 0x1e68]
call fcn.0040af50
cmp eax, edi
pop ebp
pop ebx
je 0x413de1
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
push 1
call dword [eax + 0x5c]
push 0
push 0
mov ecx, esi
call fcn.00413958
lea edi, [esi + 0x1e64]
mov ecx, esi
mov dword [edi], 1
call fcn.0041310c
and dword [edi], 0
pop edi
pop esi
pop ecx
ret

Function at 0x41749d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push dword [ebp + 8]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4174c9
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push ebx
push esi
push edi
push 0x3fff
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00403fbd
add esp, 0xc
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov esi, str.saved_data
push esi
mov dword [ebp + 0x10], eax
call fcn.004279a0
push eax
push esi
push dword [ebp + 0x10]
push ebx
call fcn.00417829
add esp, 0x14
push dword [ebp + 0x10]
push ebx
push 3
push 0
push 0x458164
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41753f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 8]
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp + 8]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x417572
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x417648
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push esi
mov edi, 0x458164
push edi
push dword [ebp - 8]
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], 3
call esi
test eax, eax
je 0x4175ac
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x417647
push ebx
push dword [ebp - 4]
call fcn.0043be5a
pop ecx
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 0
push edi
push dword [ebp - 8]
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, str.saved_data
push esi
call fcn.004279a0
push eax
push esi
push dword [ebp - 4]
push ebx
call fcn.00417829
push dword [ebp - 4]
push ebx
call fcn.004045f5
push ebx
mov esi, eax
call fcn.0043be55
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov edi, dword [ebp + 0x10]
push edi
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call fcn.00428760
add esp, 0xc
cmp edi, dword [ebp - 4]
jbe 0x417628
mov edi, dword [ebp - 4]
push edi
push ebx
push dword [ebp + 0xc]
call fcn.00427a30
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret

Function at 0x4179ee
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, 0x4dc
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push dword [ebp + 8]
push eax
call fcn.00427a30
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push edi
push 0x4178f5
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
leave
ret

Function at 0x418b6f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, 0x734
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push dword [ebp + 8]
push eax
call fcn.00427a30
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push edi
push 0x418556
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
leave
ret
Function at 0x418db3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, 0x5d8
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push dword [ebp + 8]
push eax
call fcn.00427a30
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push edi
push 0x418bbc
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
leave
ret

Function at 0x419271
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, 0x4d8
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push dword [ebp + 8]
push eax
call fcn.00427a30
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push edi
push 0x418e00
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
leave
ret

Function at 0x41966d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, 0x5e0
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push dword [ebp + 8]
push eax
call fcn.00427a30
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push edi
push 0x4192be
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
leave
ret

Function at 0x4198b4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, 0x4ec
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push dword [ebp + 8]
push eax
call fcn.00427a30
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push edi
push 0x4196ba
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
leave
ret

Function at 0x419af9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, 0x4e0
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push dword [ebp + 8]
push eax
call fcn.00427a30
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push edi
push 0x419901
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
leave
ret
Function at 0x419c1e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, 0x558
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push dword [ebp + 8]
push eax
call fcn.00427a30
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push edi
push 0x419b46
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
leave
ret

Function at 0x41a988
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, 0x5dc
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push dword [ebp + 8]
push eax
call fcn.00427a30
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push edi
push 0x41a2e9
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
leave
ret