joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407f7b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
lea edi, [esi + 0xc]
push edi
call fcn.00495810
push dword [ebp + 0xc]
lea ebx, [esi + 0x20c]
push ebx
call fcn.00495810
push dword [ebp + 0x10]
lea eax, [esi + 0x60c]
mov dword [ebp + 0xc], eax
push eax
call fcn.00495810
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4c9660
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408080
add esi, 0x40c
lea eax, [ebp - 0x10c]
push esi
push 0x4c9648
push 0x4cae98
push eax
call fcn.004956af
add esp, 0x10
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp + 8]
push eax
push esi
push 0x20006
push esi
push 0x4d9e68
lea eax, [ebp - 0x10c]
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x408080
push ebx
call fcn.00495790
pop ecx
inc eax
push eax
push ebx
push 1
pop ebx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push str.Lmgrd
push dword [ebp + 8]
call esi
push dword [ebp + 0xc]
call fcn.00495790
pop ecx
inc eax
push eax
push dword [ebp + 0xc]
push ebx
push 0
push str.LMGRD_LOG_FILE
push dword [ebp + 8]
call esi
push edi
call fcn.00495790
pop ecx
inc eax
push eax
push edi
push ebx
push 0
push str.License
push dword [ebp + 8]
call esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x408082
xor ebx, ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 0xc

Function at 0x408094
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
lea eax, [ebp - 4]
push esi
push eax
push 1
push 0
push 0x4c9660
mov esi, ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408104
add esi, 0x40c
lea eax, [ebp - 0x108]
push esi
push 0x4c9648
push 0x4cae98
push eax
call fcn.004956af
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 4]
test eax, eax
jne 0x4080fe
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
jmp 0x408106
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
leave
ret
Function at 0x408109
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push edi
mov esi, 0x20006
push eax
xor edi, edi
push esi
push edi
push 0x4c9660
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408192
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push esi
push edi
push 0x4d9e68
push edi
push 0x4c9648
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x408189
push dword [ebp + 8]
call fcn.00495790
pop ecx
inc eax
push eax
push dword [ebp + 8]
push 1
push edi
push str.Service
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
push 1
pop eax
jmp 0x408194
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x4081e0
Capabilities:
Create process on windows
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f4
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
mov esi, ecx
lea eax, [ebp - 8]
xor ebx, ebx
mov edi, dword [esi + 4]
push eax
mov dword [ebp - 4], ebx
call fcn.00407b8e
cmp dword [esi + 4], 1
jne 0x408211
cmp dword [ebp - 8], ebx
jne 0x408211
push 2
pop edi
dec edi
je 0x40821e
dec edi
je 0x408282
xor eax, eax
jmp 0x4082f9
push 1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x408282
lea ecx, [esi + 0x40c]
push 0xf01ff
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
cmp edi, ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x408278
lea eax, [esi + 0xa24]
push eax
push dword [esi + 0xa20]
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x40826f
mov dword [ebp - 4], 1
jmp 0x408275
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call ebx
push dword [ebp - 0xc]
call ebx
mov eax, dword [ebp - 4]
jmp 0x4082f9
push 0x44
lea eax, [ebp - 0x64]
pop edi
push edi
push ebx
push eax
call fcn.004959e0
lea eax, [esi + 0x60c]
add esp, 0xc
mov dword [ebp - 0x64], edi
cmp byte [eax], bl
jne 0x4082a7
push 0x4cae14
jmp 0x4082a8
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.00495810
pop ecx
lea eax, [ebp - 0x12c]
pop ecx
push eax
lea eax, [esi + 0xc]
add esi, 0x20c
push eax
push esi
lea eax, [ebp - 0x1f4]
push str.__s___app__win__c___s___l___s_
push eax
call fcn.004956af
add esp, 0x14
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push 0x28
push ebx
push ebx
lea eax, [ebp - 0x1f4]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4082fe
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
mov esi, ecx
lea eax, [ebp - 8]
xor ebx, ebx
mov edi, dword [esi + 4]
push eax
mov dword [ebp - 4], ebx
call fcn.00407b8e
cmp dword [esi + 4], 1
jne 0x40832c
cmp dword [ebp - 8], ebx
jne 0x40832c
push 2
pop edi
dec edi
je 0x408365
dec edi
je 0x408336
xor eax, eax
jmp 0x4083b5
lea edi, [esi + 0xa0c]
mov ecx, edi
call fcn.004032e7
sub esp, 0x10
add esi, 0xc
mov ecx, esp
mov dword [ebp - 4], esp
push esi
call fcn.00411a6a
mov ecx, edi
call fcn.00403387
push esi
mov ecx, edi
call fcn.004034b4
jmp 0x4083b5
push 1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
test ebx, ebx
je 0x4083af
add esi, 0x40c
push 0xf01ff
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4083ac
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4083ac
mov dword [ebp - 4], 1
push esi
call edi
push ebx
call edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4083e1
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x4bfa0b
call fcn.00495654
sub esp, 0xad4
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x1c], ecx
push esi
push str.Flexlm_Service_1
lea ecx, [ebp - 0xae0]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], 0x63
call fcn.00407756
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x28]
mov ebx, 0x20019
push eax
push ebx
push esi
push 0x4c9660
push 0x80000002
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], esi
call edi
test eax, eax
jne 0x408507
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push 0x4c9648
push dword [ebp - 0x28]
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4084fd
lea eax, [ebp - 0x38]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 0x18]
push esi
push eax
lea eax, [ebp - 0x9c]
push eax
push esi
push dword [ebp - 0x14]
call edi
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
je 0x4084d0
lea eax, [ebp - 0x9c]
lea ecx, [ebp - 0xae0]
push eax
call fcn.004078ba
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xae0]
push eax
push dword [ecx + 8]
call fcn.0040863b
lea eax, [ebp - 0x38]
inc dword [ebp - 0x10]
push eax
push esi
push esi
lea eax, [ebp - 0x18]
push esi
push eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x18], 0x63
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
jmp 0x40847c
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x24], esi
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push str.Service
mov dword [ebp - 0x2c], 0xc7
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x14]
call ebx
push dword [ebp - 0x28]
call ebx
cmp dword [ebp - 0x10], esi
jne 0x40853e
mov edi, str.Flexlm_Service_1
lea ecx, [ebp - 0xae0]
push edi
call fcn.004078ba
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xae0]
push eax
push dword [ecx + 8]
call fcn.0040863b
lea eax, [ebp - 0x9c]
push edi
push eax
call fcn.00495810
pop ecx
mov dword [ebp - 0x20], esi
pop ecx
jmp 0x40856c
jle 0x40856c
mov ecx, dword [ebp - 0x1c]
push esi
call fcn.004075f8
mov ecx, eax
call fcn.0040790f
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.00495950
pop ecx
test eax, eax
pop ecx
jne 0x408566
mov dword [ebp - 0x20], esi
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x408540
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xae0]
call fcn.004076b3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x408a55
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
push ebx
push esi
mov esi, 0xff
push edi
xor ebx, ebx
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x813]
mov byte [ebp - 0x814], bl
mov byte [ebp - 0x414], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x413]
mov dword [ebp - 0xc], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], 0x400
mov dword [ebp - 4], ebx
push dword [eax + 0x50]
lea eax, [ebp - 0x814]
push 0x4cb218
push eax
call fcn.004956af
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x20007
push ebx
push 0x4cb1f0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x408b21
push str.Error:_unable_to_delete_local_borrow_info._n
push dword [0x4e4aac]
call fcn.00406306
mov ecx, dword [0x4e4ab0]
push 0xffffffffffffff86
pop eax
push ebx
push esi
push ebx
push ebx
push 0x24f
push eax
mov dword [ecx + 0x80], eax
push dword [0x4e4ab0]
call fcn.004247a0
mov eax, dword [0x4e4ab0]
add esp, 0x24
mov eax, dword [eax + 0x80]
jmp 0x408c38
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push ebx
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 1
call esi
test eax, eax
jne 0x408c2d
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x414], bl
lea eax, [ebp - 0x814]
push eax
call fcn.00495790
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00497090
add esp, 0x10
test eax, eax
jne 0x408bb6
mov eax, dword [ebp + 0xc]
lea edi, [eax + 4]
push edi
call fcn.00495790
pop ecx
push eax
push edi
push edi
call fcn.00495790
lea edi, [ebp - 0x414]
sub edi, eax
lea eax, [ebp - 0x414]
push eax
call fcn.00495790
pop ecx
add edi, eax
pop ecx
push edi
call fcn.00497090
add esp, 0xc
test eax, eax
je 0x408bdb
mov eax, dword [ebp - 0x10]
push ebx
push ebx
inc dword [ebp - 0x10]
push ebx
lea ecx, [ebp - 8]
push ebx
push ecx
lea ecx, [ebp - 0x414]
mov dword [ebp - 8], 0x400
push ecx
push eax
push dword [ebp - 0xc]
jmp 0x408b41
lea eax, [ebp - 4]
push 1
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.0041abc0
add esp, 0x14
cmp dword [ebp - 4], ebx
je 0x408c2d
jbe 0x408c13
mov eax, dword [ebp - 0x14]
add eax, ebx
inc ebx
inc ebx
mov cl, byte [eax]
not cl
mov byte [eax], cl
cmp ebx, dword [ebp - 4]
jb 0x408c01
push 1
lea eax, [ebp - 0x414]
push dword [ebp - 4]
push dword [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.0041aec8
add esp, 0x14
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408c3d
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
push esi
mov esi, 0xff
push edi
xor ebx, ebx
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x80b]
mov byte [ebp - 0x80c], bl
mov byte [ebp - 0x40c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x40b]
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], 0x400
push dword [eax + 0x50]
lea eax, [ebp - 0x80c]
push 0x4cb218
push eax
call fcn.004956af
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20007
push ebx
push 0x4cb1f0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x408d03
push str.Error:_unable_to_delete_local_borrow_info._n
push dword [0x4e4aac]
call fcn.00406306
mov ecx, dword [0x4e4ab0]
push 0xffffffffffffff86
pop eax
push ebx
push esi
push ebx
push ebx
push 0x24f
push eax
mov dword [ecx + 0x80], eax
push dword [0x4e4ab0]
call fcn.004247a0
mov eax, dword [0x4e4ab0]
add esp, 0x24
mov eax, dword [eax + 0x80]
jmp 0x408ded
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push ebx
push eax
lea eax, [ebp - 0x40c]
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp - 0xc], 1
call esi
test eax, eax
jne 0x408de2
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x40c], bl
lea eax, [ebp - 0x80c]
push eax
call fcn.00495790
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.00497090
add esp, 0x10
test eax, eax
jne 0x408dbd
mov eax, dword [ebp + 0xc]
lea edi, [eax + 4]
push edi
call fcn.00495790
pop ecx
push eax
push edi
push edi
call fcn.00495790
lea edi, [ebp - 0x40c]
sub edi, eax
lea eax, [ebp - 0x40c]
push eax
call fcn.00495790
pop ecx
add edi, eax
pop ecx
push edi
call fcn.00497090
add esp, 0xc
test eax, eax
jne 0x408dbd
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 4]
call edi
push 0x4cb224
push dword [ebp - 4]
call edi
push dword [ebp + 0xc]
call fcn.00408df2
pop ecx
mov eax, dword [ebp - 0xc]
push ebx
push ebx
inc dword [ebp - 0xc]
push ebx
lea ecx, [ebp - 8]
push ebx
push ecx
lea ecx, [ebp - 0x40c]
mov dword [ebp - 8], 0x400
push ecx
push eax
push dword [ebp - 4]
jmp 0x408d23
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a846
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0xc], ebx
cmp dword [esi + 4], 2
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
jne 0x40a868
mov edi, dword [esi + 8]
jmp 0x40a8dd
lea eax, [ebp - 0x34]
mov dword [ebp - 0x10], 1
push eax
push dword [esi + 8]
call fcn.0049a7e4
pop ecx
push eax
call fcn.0049a551
pop ecx
test eax, eax
pop ecx
jne 0x40a95f
mov ebx, dword [ebp - 0x20]
mov dword [ebp + 8], ebx
inc ebx
push ebx
call fcn.00495701
mov edi, eax
pop ecx
test edi, edi
mov dword [ebp - 8], edi
je 0x40a95f
push ebx
push 0
push edi
call fcn.004959e0
add esp, 0xc
push dword [ebp + 8]
push edi
push dword [esi + 8]
call fcn.0049a7e4
pop ecx
push eax
call fcn.004966f7
add esp, 0xc
test eax, eax
jle 0x40a8db
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
push dword [ebp + 8]
push dword [ebp - 8]
jmp 0x40a8b7
xor ebx, ebx
cmp edi, ebx
je 0x40a90e
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4e4ab0]
mov ecx, dword [eax + 0xe4]
mov edx, dword [eax + 0xe0]
push dword [edx + ecx*4]
lea ecx, [ebp - 0xc]
push 0x14
push 0x4cc068
push ecx
push edi
push eax
call fcn.00434360
add esp, 0x1c
cmp dword [ebp - 0x10], ebx
je 0x40a921
push edi
push dword [0x4e4ab0]
call fcn.004151dd
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
je 0x40a94a
push dword [ebp - 4]
push str.ERRORS:__s_n
push dword [0x4e4aac]
call fcn.00406306
push dword [ebp - 4]
push dword [0x4e4ab0]
call fcn.004151dd
add esp, 0x14
cmp dword [ebp - 0xc], ebx
je 0x40a95f
push dword [ebp - 0xc]
push dword [0x4e4ab0]
call fcn.004151dd
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40fcd6
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x4bfa8c
call fcn.00495654
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
push esi
lea ecx, [ebp - 0x1c]
call fcn.00411a6a
cmp dword [ebp + 0x10], esi
mov dword [ebp - 4], esi
jne 0x40fd47
mov ecx, ebx
call fcn.0040fc74
mov ecx, eax
call fcn.0040fa73
mov edi, eax
cmp edi, esi
je 0x40fd47
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
lea ecx, [ebp - 0x1c]
lea eax, [esi + 0xa]
push eax
call fcn.00411c81
add esi, 2
push esi
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1c]
call fcn.00411cad
push 0
lea ecx, [ebp - 0x1c]
call fcn.00411c81
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
or eax, 0x10000
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebx + 0x80]
call dword [sym.imp.USER32.dll_MessageBoxA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00411af7
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x411155
Capabilities:
Get graphical window text

Disassembly:
push edi
call fcn.004110c8
mov edi, eax
test edi, edi
je 0x411190
push esi
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ecx, dword [esp + 0xc]
mov esi, eax
lea eax, [esi + 0xa]
push eax
call fcn.00411c81
add esi, 5
push esi
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 0xc]
push 0xffffffffffffffff
call fcn.00411cad
pop esi
pop edi
ret 4

Function at 0x413e57
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x413e98
cmp dword [ebp + 0x10], 0
je 0x413e98
cmp dword [ebp + 0x14], 0
je 0x413e98
cmp dword [ebp + 0x18], 0
jne 0x413e9d
jmp 0x413f7c
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00413223
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x413f7c
cmp dword [ebp - 0xc], 0
je 0x413f7c
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x413f7c
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00414fc0
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x413f7c
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x413f7c
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 1
je 0x413f4e
mov edx, dword [ebp + 0x14]
cmp dword [edx], 2
jne 0x413f67
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004136e7
add esp, 0xc
mov dword [ebp - 8], eax
jmp 0x413f7c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
cmp dword [ebp - 0x10], 0
je 0x413f95
mov eax, dword [ebp - 0x10]
push eax
call fcn.004151ee
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x14], 0
je 0x413fae
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004151ee
add esp, 4
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x413fb5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x413ff6
cmp dword [ebp + 0x10], 0
je 0x413ff6
cmp dword [ebp + 0x14], 0
je 0x413ff6
cmp dword [ebp + 0x18], 0
jne 0x413ffb
jmp 0x4140da
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004134ea
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4140da
cmp dword [ebp - 0xc], 0
je 0x4140da
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4140da
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00414fc0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4140da
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4140da
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 1
je 0x4140ac
mov edx, dword [ebp + 0x14]
cmp dword [edx], 2
jne 0x4140c5
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00413593
add esp, 0xc
mov dword [ebp - 8], eax
jmp 0x4140da
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
cmp dword [ebp - 0x14], 0
je 0x4140f3
mov eax, dword [ebp - 0x14]
push eax
call fcn.004151ee
add esp, 4
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x10], 0
je 0x41410c
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004151ee
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x414177
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x4141b1
cmp dword [ebp + 0x10], 0
je 0x4141b1
cmp dword [ebp + 0x18], 0
je 0x4141b1
cmp dword [ebp + 0x1c], 0
jne 0x4141b6
jmp 0x414240
cmp dword [ebp + 0x14], 1
je 0x4141c2
cmp dword [ebp + 0x14], 2
jne 0x414221
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00413223
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4141e1
jmp 0x414240
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00413223
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x414200
jmp 0x414240
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
jmp 0x414240
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x10], 0
je 0x414259
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004151ee
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [ebp - 8], 0
je 0x414272
mov edx, dword [ebp - 8]
push edx
call fcn.004151ee
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret