joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a000
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp + 0x38], 0
je 0x40a0d6
mov edx, dword [esp + 0x24]
mov ebx, edx
mov ecx, dword [esp + 0x20]
mov edi, ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
test edx, edx
jl 0x40a0c6
jg 0x40a040
test ecx, ecx
je 0x40a0c6
nop dword [eax]
mov ecx, ebp
call fcn.004026d0
mov esi, eax
mov eax, edx
mov dword [esp + 0x10], eax
test eax, eax
jl 0x40a08e
jg 0x40a059
test esi, esi
je 0x40a08e
cmp ebx, eax
jg 0x40a069
jl 0x40a063
cmp edi, esi
jae 0x40a069
mov esi, edi
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x1c]
push esi
push eax
mov eax, dword [ebp + 0x20]
push dword [eax]
call fcn.004156d0
mov eax, dword [ebp + 0x30]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x10]
sub dword [eax], esi
mov eax, dword [ebp + 0x20]
add dword [eax], esi
jmp 0x40a0b0
mov eax, dword [ebp]
mov ecx, ebp
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x40a0be
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x1c], esi
test ebx, ebx
jg 0x40a040
jl 0x40a0be
test edi, edi
jne 0x40a040
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub ecx, edi
pop edi
pop esi
pop ebp
sbb edx, ebx
mov eax, ecx
pop ebx
add esp, 8
ret 0xc
mov eax, dword [ebp + 0x20]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov dword [esp + 0x10], esi
mov ecx, dword [eax]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x40a0f6
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
jmp 0x40a0f8
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x40a172
jg 0x40a10b
test esi, esi
je 0x40a172
test eax, eax
jl 0x40a155
jg 0x40a115
test ebx, ebx
je 0x40a155
cmp edi, eax
jg 0x40a125
jl 0x40a11f
cmp esi, ebx
jae 0x40a125
mov ebx, esi
mov dword [esp + 0x20], edi
push ebx
push dword [esp + 0x20]
push ecx
call fcn.004156d0
mov eax, dword [ebp + 0x30]
add esp, 0xc
mov ecx, dword [esp + 0x1c]
sub esi, ebx
sbb edi, dword [esp + 0x20]
add ecx, ebx
sub dword [eax], ebx
mov eax, dword [ebp + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x40a172
jg 0x40a159
test esi, esi
je 0x40a172
jmp 0x40a159
mov ecx, dword [esp + 0x1c]
mov eax, dword [ebp + 0x4c]
test eax, eax
je 0x40a172
push eax
push esi
push 1
push ecx
call fcn.0041a1e6
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x425724
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042559a

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x54f562e5
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x192d4bb0
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4019f0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
mov esi, ecx
push edx
push dword [ecx + 4]
push 1
push dword [ecx]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp eax, dword [esi + 4]
jne 0x401a14
mov dword [esi + 4], 0
xor eax, eax
jmp 0x401a38
mov edi, eax
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push dword [esi + 4]
push edi
push str.ERROR:_write__zu_of__zu_bytes_n
push eax
call fcn.004019d0
add esp, 0x10
mov eax, 0xffffffff
pop esi
pop edi
ret

Function at 0x401a40
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
mov ebp, dword [esp + 0x14]
mov ecx, dword [ecx + 4]
lea ebx, [ecx + ebp]
cmp ebx, dword [esi + 8]
jbe 0x401a73
sub ebx, 0xffffff80
push ebx
push dword [esi]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
test eax, eax
je 0x401ad7
mov dword [esi], eax
mov dword [esi + 8], ebx
mov ecx, dword [esi + 4]
jmp 0x401a75
mov eax, dword [esi]
add ecx, eax
push edi
push ebp
push 1
push ecx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, ebp
jne 0x401a8f
add dword [esi + 4], ebp
xor eax, eax
jmp 0x401ad2
mov ebx, eax
cmp dword [esp + 0x18], 0
je 0x401ab2
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_feof
add esp, 4
test eax, eax
je 0x401ab2
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ferror
add esp, 4
test eax, eax
je 0x401a88
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push ebp
push ebx
push str.ERROR:_read__zu_of__zu_bytes_n
push eax
call fcn.004019d0
add esp, 0x10
mov eax, 0xffffffff
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push ebx
push str.ERROR:_realloc_failed_on_size_d_n
push eax
call fcn.004019d0
add esp, 0xc
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop dword [eax + eax]
Function at 0x4023e0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
mov dword [esp + 0xc], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00403a80
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
lea esi, [esi]

Function at 0x402440
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x40c460]
test eax, eax
jle 0x402550
mov edx, dword [0x40c464]
xor ebx, ebx
mov ecx, dword [edx + 0xc]
cmp ecx, esi
ja 0x402471
mov edi, dword [edx + 0x10]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x4024ea
add ebx, 1
add edx, 0x14
cmp ebx, eax
jne 0x402460
mov dword [esp], esi
call fcn.00403be0
test eax, eax
mov edi, eax
je 0x402577
lea esi, [ebx + ebx*4]
mov ebx, dword [0x40c464]
shl esi, 2
add ebx, esi
mov dword [ebx + 0x10], eax
mov dword [ebx], 0
call fcn.00403cd0
add eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x40c464]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402557
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x4024f2
add dword [0x40c460], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x4024e3
cmp eax, 0x80
je 0x4024e3
cmp eax, 8
je 0x4024e3
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
add esi, dword [0x40c464]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4024e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004023e0
nop
lea esi, [esi]
xor ebx, ebx
jmp 0x40247b
mov eax, dword [0x40c464]
mov eax, dword [eax + esi + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004023e0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004023e0
mov esi, esi
lea edi, [edi]

Function at 0x4033b0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
jmp fcn.00402db0
Function at 0x403b00
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x403b38
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x403b2e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x403b3a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x403b20
xor eax, eax
pop ebx
pop esi
ret
Function at 0x640025b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x640025c9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x64002604
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x64002600
lea ebx, [ebx]
cmp esi, eax
jae 0x64002604
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x640025f0
cmp esi, eax
jb 0x6400260a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x64004df0
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x641424bb
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x6419e6d0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push esi
push edi
mov eax, dword [0x6419e6d0]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.ceiinfolog.dll
call ebx
mov dword [0x641a62d4], eax
test eax, eax
jne 0x64004f21
lea edi, [esp + 0x14]
call fcn.64005100
test eax, eax
jne 0x64004fac
call fcn.6401d6ed
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x64004e6f
push 0x80004005
call fcn.64002cd0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
push str.ceiinfolog.dll
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push str._s_s
push edx
mov dword [esp + 0x238], 0
call fcn.64002da0
mov esi, dword [esp + 0x20]
add esp, 0x10
push esi
call ebx
mov dword [0x641a62d4], eax
test eax, eax
jne 0x64004efa
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x64004eca
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
lea eax, [esi - 0x10]
mov dword [esp + 0x228], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x64004ef3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
jmp 0x64004fac
lea eax, [esi - 0x10]
mov dword [esp + 0x228], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x64004f21
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x641a62d4]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CeiInfoCreateInfoHandle
push ecx
call esi
mov edx, dword [0x641a62d4]
push str.CeiInfoReleaseInfoHandle
push edx
mov dword [0x641a62dc], eax
call esi
mov dword [0x641a62e0], eax
mov eax, dword [0x641a62d4]
push str.CeiInfoSetThreadNameW
push eax
call esi
mov ecx, dword [0x641a62d4]
push str.CeiInfoWriteLogW
push ecx
mov dword [0x641a62e4], eax
call esi
mov edx, dword [0x641a62d4]
push str.CeiInfoShowDialog
push edx
mov dword [0x641a62e8], eax
call esi
mov dword [0x641a62ec], eax
mov eax, dword [0x641a62d4]
push str.CeiInfoRegisterModuleW
push eax
call esi
mov ecx, dword [0x641a62d4]
push str.CeiInfoSetCurrentLogPathW
push ecx
mov dword [0x641a62f0], eax
call esi
mov dword [0x641a62f4], eax
xor eax, eax
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.64119c23
add esp, 0x21c
ret
Function at 0x64005070
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0x20019
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x640050fc
cmp dword [esp + 4], 2
push esi
jne 0x640050e9
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
mov edx, dword [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push str.ProgramFilesDir
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x640050ee
cmp dword [esp + 0xc], 1
je 0x640050ee
mov eax, dword [esp + 4]
push eax
or esi, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret
mov esi, 3
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x64009c50
Capabilities:
Identify system language via api

Disassembly:
push 0xffffffffffffffff
push 0x6414356b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x6419e6d0]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov eax, dword [0x6419e6d0]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x16]
push ecx
mov word [esp + 0x18], ax
call fcn.6411bc30
add esp, 0xc
call fcn.64005570
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, dword [0x641a6288]
movzx eax, ax
test ecx, ecx
je 0x64009cbd
push eax
call ecx
push 0x208
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
call fcn.640029f0
lea esi, [esp + 8]
mov dword [esp + 0x220], 0
call fcn.6400a720
mov eax, dword [0x641a627c]
test eax, eax
je 0x64009d0c
mov edx, dword [esp + 8]
push edx
call eax
mov dword [esp + 0x220], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x64009d37
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.64119c23
add esp, 0x21c
ret
Function at 0x6400b8d0
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0x3ff
or eax, 0x400
add eax, 0xfffffbf9
cmp eax, 0x18
ja case.0x6400b8f1.1032
movzx eax, byte [eax + 0x6400b994]
jmp dword [eax*4 + 0x6400b970]
push str.0411
mov ecx, esi
call fcn.640029b0
ret
push str.040C
mov ecx, esi
call fcn.640029b0
ret
push str.0410
mov ecx, esi
call fcn.640029b0
ret
push str.0407
mov ecx, esi
call fcn.640029b0
ret
push str.040A
mov ecx, esi
call fcn.640029b0
ret
push str.0413
mov ecx, esi
call fcn.640029b0
ret
push str.0412
mov ecx, esi
call fcn.640029b0
ret
push str.041f
mov ecx, esi
call fcn.640029b0
ret
push 4
push str.0409
mov ecx, esi
call fcn.640028a0
ret

Function at 0x6400e800
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0x20019
push 0
push 0
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x6400e888
cmp dword [esp + 4], 2
push esi
jne 0x6400e875
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x6400e87a
cmp dword [esp + 0xc], 1
je 0x6400e87a
mov edx, dword [esp + 4]
push edx
or esi, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret
mov esi, 3
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x640112d0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x64141d1b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x6419e6d0]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov eax, dword [0x6419e6d0]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 8]
xor edi, edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], edi
lea edx, [esp + 0x18]
push edx
push 0x2001f
push edi
mov dword [esp + 0x24c], edi
mov eax, dword [ebx]
push ecx
push eax
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x10]
mov esi, eax
cmp esi, edi
jne 0x64011368
xor eax, eax
cmp ecx, edi
je 0x6401135a
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
mov esi, eax
mov dword [esp + 0x10], ecx
cmp eax, edi
je 0x64011376
cmp ecx, edi
je 0x64011414
push ecx
jmp 0x6401140e
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x24]
push eax
push edi
push edi
push edi
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x40]
push eax
push edi
push ecx
mov dword [esp + 0x34], 0x100
call esi
test eax, eax
jne 0x640113e2
mov edi, edi
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call fcn.640112d0
mov ebx, eax
cmp ebx, edi
jne 0x6401143c
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x14]
push edi
push edi
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x40]
push ecx
push edi
push edx
mov dword [esp + 0x34], 0x100
call esi
test eax, eax
je 0x640113a0
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x640113f5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x20]
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x64011414
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.64119c23
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x6401144b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x64011416
Function at 0x64014680
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x641427f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6419e6d0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
xor ebp, ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x2c], ebp
call fcn.6401d6ed
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x640146cd
push 0x80004005
call fcn.64002cd0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
mov byte [esp + 0x30], 1
call fcn.640148c0
mov byte [esp + 0x2c], 2
mov eax, dword [eax]
push eax
lea edx, [esp + 0x18]
push str.SoftwareCanon_Electronics_Inc.NetworkMonitor_s
push edx
call fcn.64002da0
mov byte [esp + 0x38], 1
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x6401472d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push ebx
push SysReAllocStringLen
mov dword [esp + 0x3c], ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x640147e8
mov edi, dword [esp + 0x18]
mov ecx, dword [esi + 0xb4]
push 4
lea edx, [esp + 0x1c]
push edx
push 4
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.AutoConnect
push edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ecx
call ebp
mov eax, dword [esi + 0xb0]
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push 0
push str.AutoDisConnect
push edi
mov dword [esp + 0x30], eax
call ebp
lea eax, [ebx - 0x10]
mov byte [esp + 0x2c], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x640147c4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test edi, edi
je 0x640147cf
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push eax
push str.CSxUsbDevice::SaveSettingsToRegistry_reg.Create_HKEY_CURRENT_USER___LPCTSTR_strNewRegPath____ERROR_SUCCESS_:__d
push 3
mov esi, 0x641a62d4
call fcn.64004fe0
add ebx, 0xfffffff0
add esp, 0xc
mov byte [esp + 0x2c], 0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x6401481e
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x64016e10
Capabilities:
Get hostname
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x64141f6b
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x6419e6d0]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6419e6d0]
xor eax, esp
push eax
lea eax, [esp + 0x124]
mov dword fs:[0], eax
push 0x100
lea eax, [esp + 0x24]
push eax
mov esi, ecx
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x64016e83
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CUtility::GetOwnLocalBroadcastAddresses_gethostname_failed_:__d
push 3
mov esi, 0x641a62d4
call fcn.64004fe0
add esp, 0xc
xor eax, eax
jmp 0x64016fd7
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x64016ea4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CUtility::GetOwnLocalBroadcastAddresses_gethostbyname_failed_:__d
jmp 0x64016e6d
call fcn.6401d6ed
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x64016ebe
push 0x80004005
call fcn.64002cd0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push 0xff
push 0xff
push 0xff
push 0xff
push str._d__d__d__d
lea edi, [esp + 0x28]
mov dword [esp + 0x140], 0
call fcn.64017000
mov ecx, dword [esp + 0x28]
add esp, 0x14
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ebx, dword [esi + 8]
mov ebp, eax
test ebx, ebx
jge 0x64016f17
call fcn.6401d5d9
lea edi, [ebx + 1]
call fcn.64013b20
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x1c]
mov dword [edx + ebx*4], ebp
mov eax, dword [eax + 0xc]
xor ecx, ecx
mov dword [esp + 0x18], ecx
cmp dword [eax], ecx
je 0x64016fa7
mov ecx, dword [eax + ecx]
mov eax, dword [ecx]
mov edx, eax
shr edx, 0x10
and edx, 0xff
push edx
mov ecx, eax
shr ecx, 8
and ecx, 0xff
movzx edx, al
push ecx
push edx
push str._d._d._d.255
lea edi, [esp + 0x24]
call fcn.64017000
mov eax, dword [esp + 0x24]
add esp, 0x10
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ebx, dword [esi + 8]
mov ebp, eax
test ebx, ebx
jl 0x64016f12
lea edi, [ebx + 1]
call fcn.64013b20
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0x1c]
inc eax
mov dword [ecx + ebx*4], ebp
lea ecx, [eax*4]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0xc]
cmp dword [eax + ecx], 0
jne 0x64016f36
mov dword [esp + 0x12c], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x64016fd2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.64119c23
add esp, 0x11c
ret