joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432520
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
push 0x70
mov esi, ecx
lea eax, [esi + 0x44]
push eax
push 3
xor ebp, ebp
push ebp
push str.DisplayLimits
push edi
call ebx
test eax, eax
je 0x432565
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DisplayLimits
push str.CAutoDisplayProfile::FlushToRegistry.__s_failed._err_d_n
call fcn.0040aac0
add esp, 0xc
jmp 0x43256a
mov ebp, 1
push 0xe4
lea ecx, [esi + 0x254]
push ecx
push 3
push 0
push str.Device1
push edi
call ebx
test eax, eax
je 0x4325a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Device1
push str.CAutoDisplayProfile::FlushToRegistry.__s_failed._err_d_n
call fcn.0040aac0
add esp, 0xc
jmp 0x4325a6
mov ebp, 1
push 0xe4
lea edx, [esi + 0x338]
push edx
push 3
push 0
push str.Device2
push edi
call ebx
test eax, eax
je 0x4325dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Device2
push str.CAutoDisplayProfile::FlushToRegistry.__s_failed._err_d_n
call fcn.0040aac0
add esp, 0xc
jmp 0x4325e2
mov ebp, 1
push 4
lea eax, [esi + 0x41c]
push eax
push 4
push 0
push str.ProfileFlags
push edi
call ebx
test eax, eax
je 0x432616
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ProfileFlags
push str.CAutoDisplayProfile::FlushToRegistry.__s_failed._err_d_n
call fcn.0040aac0
add esp, 0xc
jmp 0x43261b
mov ebp, 1
push 0x1a0
lea ecx, [esi + 0xb4]
push ecx
push 3
push 0
push str.DeviceProfile
push edi
call ebx
test eax, eax
je 0x4326b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeviceProfile
push str.CAutoDisplayProfile::FlushToRegistry.__s_failed._err_d_n
call fcn.0040aac0
add esp, 0xc
test ebp, ebp
je 0x4326a5
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
lea eax, [esp + 0x10]
mov dword [esp + 0x18], edx
push eax
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x10
lea ecx, [esp + 0x14]
push ecx
push 3
push 0
push str.Timestamp
push edi
call ebx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add esi, 0x420
mov dword [esi], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10
ret 4
mov ebp, 1
jmp 0x432654
Function at 0x43b6c0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x68
cmp dword [esp + 0x6c], 3
mov dword [esp], 0
jb 0x43b6e6
push str.bPostMessageToCCC:_ulAceCommand_out_of_range
call fcn.0040aac0
add esp, 4
xor eax, eax
add esp, 0x68
ret 0xc
mov eax, dword [0x4955b0]
test eax, eax
je 0x43b6ff
push str.04874F40_A61B_405c_8206_7116B598FD8A
push eax
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
jne 0x43b716
push 0
push 0x439bd0
mov dword [0x4955b0], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x4955b0]
test eax, eax
jne 0x43b734
push str.bPostMessageToCCC:_failed_to_get_CCC_window_handle
call fcn.0040aac0
add esp, 4
xor eax, eax
add esp, 0x68
ret 0xc
mov eax, dword [esp + 0x74]
test eax, eax
push edi
je 0x43b749
mov eax, dword [esp + 0x74]
push eax
call fcn.004398b0
jmp 0x43b753
mov ecx, dword [esp + 0x74]
push ecx
call fcn.00439860
mov edi, eax
add esp, 4
lea eax, [edi - 0x20]
cmp eax, 0xa
push esi
ja case.0x43b76c.35
movzx edx, byte [eax + 0x43b85c]
jmp dword [edx*4 + 0x43b854]
push str.bPostMessageToCCC:_PowerXpress_related_msg
call fcn.0040aac0
push 0xc
call fcn.0045f7e9
mov esi, eax
add esp, 8
test esi, esi
je case.0x43b76c.35
mov eax, dword [0x4955b0]
push edi
push 0x8486
push eax
lea ecx, [esp + 0x18]
push str.SendMessage_to__.8X_with_message_id:_.8X__lparam:__.8x
push ecx
call fcn.0045e4c9
lea edx, [esp + 0x20]
push edx
call fcn.00411060
mov eax, dword [0x4955b0]
push 0
lea ecx, [esp + 0x24]
push ecx
push 0
push esi
push 0x439c00
mov dword [esi], eax
mov dword [esi + 4], 0x8486
mov dword [esi + 8], edi
call fcn.00423c00
add esp, 0x2c
test eax, eax
je 0x43b7f2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, 1
pop edi
add esp, 0x68
ret 0xc
push esi
call fcn.0045f738
add esp, 4
mov edx, dword [0x4955b0]
push edi
push 0
push 0x8486
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
je 0x43b834
mov eax, dword [0x4955b0]
push eax
push str.bPostMessageToCCC:_PostMessage_success_ccc0x_x
call fcn.0040aac0
add esp, 8
pop esi
mov eax, 1
pop edi
add esp, 0x68
ret 0xc
mov ecx, dword [0x4955b0]
push ecx
push str.bPostMessageToCCC:_PostMessage_failed_ccc0x_x
call fcn.0040aac0
add esp, 8
pop esi
xor eax, eax
pop edi
add esp, 0x68
ret 0xc
Function at 0x43f780
Capabilities:
Read file via mapping

Disassembly:
mov al, byte [esp + 0xc]
test al, al
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
mov bl, 1
push edi
jne 0x43f808
push ebp
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x43f7f1
cmp eax, 0xffffffff
je 0x43f7f1
push edi
push str.CSharedDataBase::Init:_success_to_CreateFileMapping_for__s
call fcn.0040aac0
mov eax, dword [esi + 4]
add esp, 8
push ebp
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 8], eax
push edi
jne 0x43f83d
push str.CSharedDataBase::Init:_failed_to_MapViewOfFile_for__s
call fcn.0040aac0
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
push edi
push str.CSharedDataBase::Init:_failed_to_CreateFileMapping_for__s
call fcn.0040aac0
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x43f826
cmp eax, 0xffffffff
je 0x43f826
push edi
push str.CSharedDataBase::Init:_success_to_OpenFileMapping_for__s
jmp 0x43f7ba
push edi
push str.CSharedDataBase::Init:_failed_to_OpenFileMapping_for__s
call fcn.0040aac0
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
push str.CSharedDataBase::Init:_success_to_MapViewOfFile_for__s
call fcn.0040aac0
add esp, 8
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 0xc
Function at 0x441bc0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2120
call fcn.0045ed20
push ebx
push ebp
xor ebx, ebx
push esi
xor ebp, ebp
mov eax, str.dwm.exe
push edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x441be8
sub eax, edx
mov dword [esp + 0x20], eax
xor eax, eax
mov ecx, 0x400
lea edi, [esp + 0x1130]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
push 0x1000
lea ecx, [esp + 0x1138]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x441d1e
mov edi, dword [esp + 0x1c]
shr edi, 2
cmp edi, ebx
mov dword [esp + 0x24], edi
jbe 0x441d1e
jmp 0x441c40
mov edx, dword [esp + ebx*4 + 0x1130]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
xor edx, edx
cmp esi, edx
je 0x441d15
xor eax, eax
mov dword [esp + 0x130], edx
mov ecx, 0x3ff
lea edi, [esp + 0x134]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x1000
lea ecx, [esp + 0x138]
push ecx
push esi
mov dword [esp + 0x28], edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x441d06
mov eax, dword [esp + 0x18]
xor ebp, ebp
test eax, 0xfffffffc
jbe 0x441d06
jmp 0x441cb0
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x2c]
lea edx, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + ebp*4 + 0x134]
push edx
push eax
push esi
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x441cf4
mov ecx, dword [esp + 0x20]
push ecx
lea edx, [esp + 0x2c]
push str.dwm.exe
push edx
call fcn.0045f501
add esp, 0xc
test eax, eax
je 0x441d02
mov eax, dword [esp + 0x18]
inc ebp
shr eax, 2
cmp ebp, eax
jb 0x441cb0
jmp 0x441d06
inc dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x14]
inc ebx
cmp ebx, edi
jb 0x441c40
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4465d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x490918]
sub esp, 0x114
cmp eax, 0xffffffff
jne 0x446677
lea eax, [esp + 0xc]
push eax
call fcn.0040ba30
add esp, 4
test eax, eax
je 0x446672
lea ecx, [esp + 4]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x18]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x446672
mov edx, dword [esp + 4]
lea eax, [esp]
push eax
push 0x490918
lea ecx, [esp + 0x10]
push ecx
push 0
push str.ExtEvent_VideoPlaybackCpuThrottle
push edx
mov dword [esp + 0x20], 4
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x446672
cmp dword [esp], 4
jne 0x446672
mov eax, dword [0x490918]
cmp eax, 0x64
jbe 0x446677
mov eax, 0x64
mov dword [0x490918], eax
add esp, 0x114
ret
mov eax, SysReAllocString
add esp, 0x114
ret
Function at 0x446f90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x31c
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
push 2
push eax
push eax
push 0x4953f4
mov dword [ecx + 8], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x447181
lea edx, [esp + 0x140]
push edx
push ebx
mov dword [esp + 0x148], 0x11f
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInfoListDetailA]
test eax, eax
je 0x44717a
lea eax, [esp + 0x24]
push eax
push 0
push ebx
mov dword [esp + 0x30], 0x1c
mov dword [esp + 0x18], 0
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x44717a
mov edi, edi
mov edx, dword [esp + 0x38]
push 0
push 0
push 0xc8
lea ecx, [esp + 0x26c]
push ecx
push edx
call dword [sym.imp.SETUPAPI.dll_CM_Get_Device_ID_ExA]
test eax, eax
jne 0x4470c2
push 0x20019
push 1
push eax
push 1
lea eax, [esp + 0x34]
push eax
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov esi, eax
cmp esi, 0xffffffff
je 0x4470b5
xor eax, eax
mov byte [esp + 0x40], 0
mov ecx, 0x3f
lea edi, [esp + 0x41]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x44]
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x28]
push eax
push 0
push 0x47e124
push esi
mov dword [esp + 0x38], 1
mov dword [esp + 0x34], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4470ac
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x40]
push ecx
push edx
call fcn.0045eef0
add esp, 8
test eax, eax
jne 0x4470ee
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4470c2
push str.GetBDFNumberFromDeviceKey:_SetupDiOpenDevRegKey_function_fails_n
call fcn.0040aac0
add esp, 4
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x24]
inc eax
push ecx
push eax
push ebx
mov dword [esp + 0x18], eax
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x447010
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x10]
push edx
push 4
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x15
lea edx, [esp + 0x38]
push edx
push ebx
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 4
mov dword [esp + 0x28], 0
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
mov eax, dword [esp + 0x14]
mov edi, dword [ebp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push 4
mov dword [edi], eax
xor eax, eax
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 0x1c
lea ecx, [esp + 0x38]
push ecx
push ebx
mov dword [esp + 0x2c], 4
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
mov eax, dword [esp + 0x18]
mov edx, eax
shr edx, 0x10
and eax, 0xffff
push esi
mov dword [edi + 4], edx
mov dword [edi + 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x449350
Capabilities:
Delete registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x2001f
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4493a2
mov edx, dword [esp]
push str.DALCurrentObjectData
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x449398
push str.RemoveLassoLastSelectedSettings:_Success_deleted__DALCurrentObjectData
call fcn.0040aac0
add esp, 4
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret
Function at 0x44a580
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x491164]
sub esp, 0xc
push edi
push 0
push eax
call fcn.00424f40
mov edi, eax
add esp, 8
test edi, edi
je 0x44a669
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x44a665
lea ecx, [esp + 0xc]
push ecx
push 0x2001f
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x44a65f
lea edx, [esp + 8]
push edx
push 0x2001f
push eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
push str.SoftwareATI_Technologies_Inc._
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x44a62a
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xc]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareATI_Technologies_Inc._
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44a658
mov edx, dword [esp + 8]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push 0
push str.VistaMobileInternalActionInprocess
push edx
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc]
push ecx
call ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push edi
call ebx
pop ebx
pop edi
add esp, 0xc
ret

Function at 0x44a670
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x491164]
sub esp, 0xc
push esi
push 0
push eax
call fcn.00424f40
mov esi, eax
add esp, 8
test esi, esi
je 0x44a719
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x44a715
lea ecx, [esp + 0xc]
push ecx
push 0x2001f
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x44a70f
lea edx, [esp + 8]
push edx
push 0x2001f
push eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
push str.SoftwareATI_Technologies_Inc._
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44a708
mov edx, dword [esp + 8]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push eax
push str.VistaMobileInternalActionInprocess
push edx
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc]
push ecx
call ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push esi
call ebx
pop ebx
pop esi
add esp, 0xc
ret

Function at 0x44b210
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
push eax
call fcn.0044ae20
push 0
call fcn.0044bb40
add esp, 8
jmp fcn.0044a670

Function at 0x44bb40
Capabilities:
Enumerate gui resources

Disassembly:
push esi
movzx esi, byte [esp + 8]
push esi
call fcn.0044ba70
add esp, 4
push esi
push 0x44ba10
call dword [sym.imp.USER32.dll_EnumWindows]
pop esi
ret
Function at 0x45d620
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x45d637
cmp dword [ebp + 0x14], 0
jne 0x45d63b
xor eax, eax
jmp 0x45d69d
push 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x45d662
xor eax, eax
jmp 0x45d69d
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x45d68e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x45d69d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x45d6b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0
jne 0x45d6ce
xor eax, eax
jmp 0x45d72a
lea eax, [ebp - 8]
push eax
push 1
push 0
mov ecx, dword [ebp + 8]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x45d6ed
xor eax, eax
jmp 0x45d72a
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x45d71b
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x45d72a
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x45d730
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x45d747
cmp dword [ebp + 0x14], 0
jne 0x45d74b
xor eax, eax
jmp 0x45d7ad
push 0
lea eax, [ebp - 4]
push eax
push 0
push 2
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x45d772
xor eax, eax
jmp 0x45d7ad
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 3
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x45d79e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x45d7ad
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x49e008], 0x8088405
inc edx
mov dword [ebx + 0x49e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cd64
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cd95
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd7d
add dl, dl
jne 0x41cda0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cdf1
xor eax, eax
add dl, dl
jne 0x41cdad
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ce8e
add dl, dl
jne 0x41cdbc
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdc7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdd2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cddd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cde7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cd8c
mov eax, 1
add dl, dl
jne 0x41cdff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41ce0a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdf6
sub eax, ebx
mov ebx, 1
jne 0x41ce3d
mov ecx, 1
add dl, dl
jne 0x41ce23
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce2e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce1a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41ce54
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce5f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41ce4b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd8c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41ceaf
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cd8c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e5a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x485a63
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e655
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e63e
test esi, esi
jbe 0x41e655
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088e4
test eax, eax
jne 0x41e630
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e655
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e60d
jmp 0x41e655
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e655
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485a6a
ret