joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fe60
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43fe93
push esi
call fcn.00442f70
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43fe8c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43ff19
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43ff02
mov eax, dword [esi + 8]
test eax, eax
je 0x43feb7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43fefe
cmp eax, 2
je 0x43ff02
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43feaa
cmp eax, 3
je 0x43fedd
cmp eax, 1
jne 0x43feaa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43feaa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43feaa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043ff40
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43ff28
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043ff40
add esp, 4
pop esi
ret

Function at 0x44bec0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x44bf63
test eax, eax
jbe 0x44bf63
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x44bf63
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x44bf0e
xor esi, esi
jmp 0x44bf14
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x44bf3f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00402de0
add esi, eax
push esi
mov ebx, esi
call fcn.00402de0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x44bf20
pop ebp
test edi, edi
pop edi
jne 0x44bf63
test ebx, ebx
je 0x44bf63
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00450430
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x44c0a5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44c1bd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44c1bd
mov eax, dword [esi + 0x3c]
push eax
call fcn.00460ffe
mov esi, eax
test esi, esi
je 0x44c1bd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44c1bd
mov ecx, esi
call fcn.0044c010
cmp edi, eax
jge 0x44c1bd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x44c143
mov dword [esp + 0x34], 1
jmp 0x44c19e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44c1bd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0044b5b0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x4619a1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4619d9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045fa58
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045fa30
jmp 0x4619e5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x463096
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4630d8
call fcn.00468b50
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4630d8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4630cf
xor eax, eax
jmp 0x4630e0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004630e6
pop edi
pop esi
pop ebx
ret 4
Function at 0x469080
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4690ae
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4690cc
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00468fe6
jmp 0x4690cc
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4690cc
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00468fe6
test edi, edi
mov eax, edi
jne 0x4690b6
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40a60b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40a61a
pop dword [ebp - 0xc]
mov eax, 0x615d354d
add eax, 0x9ee370cd
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xc61eed12
add dword [ebp - 0x1c], 0x88335839
mov dword [ebp - 0x18], 0x47d780a9
sub dword [ebp - 0x18], 0x15a43464
mov dword [ebp - 0x14], 0xf629e6a4
add dword [ebp - 0x14], 0x56225d8a
mov dword [ebp - 0x10], 0x73ff5a2e
add dword [ebp - 0x10], 0x8c00a5d2
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x96722a07
sub dword [ebp - 0x1c], 0x21ffc0b1
mov dword [ebp - 0x18], 0xbebe5a26
sub dword [ebp - 0x18], 0x7d51f8b1
mov dword [ebp - 0x14], 0xffe6eac2
sub dword [ebp - 0x14], 0x9c777e56
mov dword [ebp - 0x10], 0xa9bcf9be
sub dword [ebp - 0x10], 0xa9bcf9be
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xb76ff083
sub eax, 0xb72f2037
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3b620
push 0
call eax
mov ecx, 0x4e0d
xor ebx, ebx
add ebx, eax
mov esi, 0xce4ade49
sub esi, 0xce092e49
add esi, dword [ebp - 0xc]
mov edi, 0x3da596cc
add dword [ebp - 8], ebx
mov edx, dword [esi]
mov dword [ebp - 4], 0xce54aae
xor edx, edi
sub dword [ebp - 4], 0xd355069d
mov dword [ebx], edx
mov dword [ebp - 8], 0x9cb79449
add ebx, 0x109e6d60
add ebx, 0xef6192a4
add esi, 0x26edcffa
add esi, 0xd912300a
loop 0x40a72d
add eax, 0xe03022dc
add eax, 0x1fd1082b
mov ebx, eax
add eax, 0x8d28b8e5
add eax, 0x72d74720
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401070
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x21c
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov eax, ebx
test ebx, ebx
jne 0x4010b7
push 0
push 9
push 0x110a
push edi
call dword [sym.imp.user32.dll_SendMessageW]
lea ecx, [ebp - 0x10]
push ecx
push eax
push edi
call sym._GetItemPath
add esp, 0xc
push eax
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
mov eax, dword [ebp - 0x10]
mov edi, esi
test esi, esi
jne 0x4010de
xor esi, esi
test eax, eax
je 0x401135
test eax, eax
mov esi, edi
je 0x40110c
lea edx, [eax - 0x80000000]
mov ecx, 0x40d140
cmp edx, 6
ja 0x401109
mov esi, 0x6f
bt esi, eax
mov esi, edi
jae 0x401109
mov eax, dword [edx*4 + 0x40d238]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
test esi, esi
je 0x40112b
mov dword [ebp - 0x20], 0x104
lea eax, [ebp - 0x20]
lea esi, [ebp - 0x228]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetComputerNameW]
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x18]
call dbg.CombinePaths
mov esi, eax
mov dword [ebp - 0x228], esi
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp + 8]
call sym._GetItemPath
add esp, 0xc
mov edi, eax
mov dword [ebp - 0x224], eax
lea ecx, [ebp - 0x228]
call dbg.CombinePaths
mov ebx, eax
push esi
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
push edi
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
mov eax, ebx
add esp, 0x21c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402340
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, edx
mov dword [ebp - 0x14], ecx
lea ebx, [edx + 8]
lea edi, [edx + 0x10]
push edi
push 0
push ebx
push 0
push dword [edx + 4]
push dword [edx]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x402399
xor edi, edi
cmp eax, 2
jne 0x4023c3
cmp dword [esi + 4], 0
jne 0x4023c3
mov dword [esi + 8], 1
mov dword [esi + 0x10], 2
push 2
call dword [sym.imp.ucrtbase.dll_malloc]
add esp, 4
mov dword [esi + 0xc], eax
mov word [eax], 0
jmp 0x4023fd
mov eax, dword [esi + 0x10]
add eax, 2
push eax
call dword [sym.imp.ucrtbase.dll_malloc]
add esp, 4
push edi
mov dword [ebp - 0x10], eax
push eax
push ebx
push 0
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x4023eb
mov edi, dword [ebp - 0x10]
push dword [esi + 4]
push 0x8045
push dword [ebp - 0x14]
call dbg.error_code_messagebox
add esp, 0xc
push edi
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
mov dword [esi + 0xc], 0
xor eax, eax
jmp 0x402402
mov eax, dword [edi]
test al, 1
mov ecx, dword [ebp - 0x10]
jne 0x4023fa
mov word [ecx + eax], 0
mov dword [esi + 0xc], ecx
mov eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402870
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x2001b
push 0
push ebx
push edi
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
je 0x4028a9
push 0x7df
push esi
call dbg.error_code_messagebox
add esp, 8
xor esi, esi
jmp 0x4028f2
push 0x8150
push 0x814f
push 0x34
push esi
call dbg.messagebox
add esp, 0x10
xor esi, esi
cmp eax, 6
jne 0x4028e9
push ebx
push edi
call dword [sym.imp.shcore.dll_SHDeleteKeyW]
test eax, eax
je 0x4028e4
push ebx
push 0x805e
push dword [ebp + 8]
call dbg.error_code_messagebox
add esp, 0xc
jmp 0x4028e9
mov esi, 1
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402900
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
lea eax, [ebp - 0x10]
push eax
push 0x2001b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x40295c
mov edi, dword [ebp + 0x14]
push edi
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
mov esi, eax
test edi, edi
je 0x40294c
test esi, esi
je 0x40294c
push edi
push 0x8045
push dword [ebp + 8]
call dbg.error_code_messagebox
add esp, 0xc
xor ebx, ebx
test esi, esi
sete bl
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402970
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x250
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea edx, [esp + 4]
push edx
push 0x2001b
push 0
push ecx
push eax
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
je 0x4029c4
push 0x7dc
push dword [ebp + 8]
call dbg.error_code_messagebox
add esp, 8
xor esi, esi
jmp 0x402a80
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
lea ecx, [esp + 0x4c]
push 0x100
push ecx
push 0x805d
push eax
call dword [sym.imp.user32.dll_LoadStringW]
xor esi, esi
test eax, eax
je 0x402a76
mov ebx, dword [ebp + 0x18]
mov esi, 1
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExW]
nop word [eax + eax]
push esi
lea eax, [esp + 0x50]
push eax
push ebx
call dword [sym.imp.user32.dll_wsprintfW]
add esp, 0xc
mov eax, dword [esp + 4]
sub esp, 0x18
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
cmp eax, 2
je 0x402a35
inc esi
cmp esi, 0x64
jne 0x402a00
jmp 0x402a64
mov ecx, dword [ebp + 0x14]
lea eax, [ecx - 3]
mov esi, 2
cmp eax, 8
ja 0x402a4c
mov esi, dword [ecx*4 + 0x40d31c]
lea edi, [esp + 8]
push esi
push edi
push ecx
push 0
push ebx
push dword [esp + 0x18]
call dword [sym.imp.advapi32.dll_RegSetValueExW]
test eax, eax
je 0x402a8a
push 0x7dc
push dword [ebp + 8]
call dbg.error_code_messagebox
add esp, 8
xor esi, esi
push dword [esp + 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x40d34c]
mov eax, dword [eax]
push 0xffffffffffffffff
push esi
push edi
push dword [ebp + 0x14]
push ebx
push dword [eax + 8]
call dbg.AddEntryToList
add esp, 0x18
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], 3
mov ecx, dword [0x40d34c]
mov ecx, dword [ecx]
lea edx, [esp + 0x10]
push edx
push eax
push 0x102b
push dword [ecx + 8]
call dword [sym.imp.user32.dll_SendMessageW]
mov esi, 1
jmp 0x402a76
Function at 0x402ae0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [ebp + 0x14]
xor esi, esi
test edi, edi
je 0x402bcf
mov ebx, dword [ebp + 0x18]
test ebx, ebx
je 0x402bcf
lea eax, [params.hkey]
push eax
push 0x2001b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
je 0x402b31
push 0x7e1
push dword [ebp + 8]
call dbg.error_code_messagebox
add esp, 8
jmp 0x402bcf
mov eax, dword [params.hkey]
sub esp, 0x18
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x402ba7
mov dword [params.value_name], edi
lea edx, [params.hkey]
mov ecx, dword [ebp + 8]
call dbg.read_value
xor esi, esi
test eax, eax
je 0x402bba
push dword [params.size]
push dword [params.data]
push dword [params.type]
push 0
push ebx
push dword [params.hkey]
call dword [sym.imp.advapi32.dll_RegSetValueExW]
test eax, eax
jne 0x402b95
push edi
push dword [params.hkey]
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
test eax, eax
je 0x402bd9
push ebx
push dword [params.hkey]
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
push 0x7e1
push dword [ebp + 8]
call dbg.error_code_messagebox
add esp, 8
jmp 0x402bba
push edi
push 0x7de
push dword [ebp + 8]
call dbg.error_code_messagebox
add esp, 0xc
xor esi, esi
push dword [params.data]
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
push dword [params.hkey]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, 1
jmp 0x402bba
Function at 0x402be0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
xor edi, edi
test esi, esi
je 0x402d52
cmp dword [ebp + 0x14], 0
je 0x402d52
mov edi, dword [ebp + 0xc]
push 0x5c
push esi
call dword [sym.imp.ucrtbase.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x402c73
push esi
call dword [sym.imp.ucrtbase.dll__wcsdup]
add esp, 4
mov edi, eax
push 0x5c
push eax
call dword [sym.imp.ucrtbase.dll_wcsrchr]
add esp, 8
mov ebx, eax
mov word [eax], 0
lea eax, [ebp - 0x10]
push eax
push 0x2001d
push 0
mov dword [ebp - 0x18], edi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
je 0x402c81
push 0x7e0
push dword [ebp + 8]
call dbg.error_code_messagebox
add esp, 8
xor edi, edi
jmp 0x402d36
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], 0
mov ebx, esi
jmp 0x402c84
add ebx, 2
mov eax, dword [ebp + 0x14]
push eax
push ebx
call dword [sym.imp.kernel32.dll_lstrcmpW]
xor edi, edi
test eax, eax
je 0x402d36
mov eax, dword [ebp - 0x10]
sub esp, 0x24
lea ecx, [ebp - 0x1c]
mov dword [esp + 0x20], ecx
lea ecx, [ebp - 0x14]
mov dword [esp + 0x1c], ecx
movaps xmm0, xmmword [0x40d2c0]
movups xmmword [esp + 8], xmm0
mov ecx, dword [ebp + 0x14]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0x18], 0
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
cmp dword [ebp - 0x1c], 2
je 0x402d05
test eax, eax
jne 0x402d05
push 0
push dword [ebp - 0x14]
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.shcore.dll_SHCopyKeyW]
test eax, eax
je 0x402d18
push dword [ebp - 0x14]
call dword [sym.imp.advapi32.dll_RegCloseKey]
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegDeleteKeyW]
jmp 0x402d26
push ebx
push 0x7dd
push dword [ebp + 8]
call dbg.error_code_messagebox
add esp, 0xc
jmp 0x402d36
push esi
push dword [ebp + 0xc]
call dword [sym.imp.shcore.dll_SHDeleteKeyW]
test eax, eax
je 0x402d5c
push 0x7e0
push dword [ebp + 8]
call dbg.error_code_messagebox
add esp, 8
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x18]
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 1
jmp 0x402d36
Function at 0x402d70
Capabilities:
Get graphical window text
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, edx
push 0x7d2
mov dword [ebp - 0x1c], ecx
push ecx
call dword [sym.imp.user32.dll_GetDlgItem]
mov ebx, eax
push eax
call dword [sym.imp.user32.dll_GetWindowTextLengthW]
mov esi, eax
lea eax, [eax*2 + 2]
inc esi
push eax
call dword [sym.imp.ucrtbase.dll_malloc]
add esp, 4
push esi
mov dword [ebp - 0x10], eax
push eax
mov dword [ebp - 0x18], ebx
push ebx
call dword [sym.imp.user32.dll_GetWindowTextW]
mov esi, eax
push dword [edi + 0xc]
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
mov dword [ebp - 0x14], edi
mov eax, dword [edi + 8]
dec eax
cmp eax, 0xa
ja case.0x402dd0.3
jmp dword [eax*4 + 0x40d2d0]
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [edi + 0xc], eax
lea eax, [esi*2 + 2]
mov dword [edi + 0x10], eax
jmp 0x402f3a
push dword [ebp - 0x10]
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
push 0
push 0
push 0x401
mov ebx, dword [ebp - 0x18]
push ebx
call dword [sym.imp.user32.dll_SendMessageW]
mov esi, eax
mov edi, dword [ebp - 0x14]
mov dword [edi + 0x10], eax
push eax
call dword [sym.imp.ucrtbase.dll_malloc]
add esp, 4
mov dword [edi + 0xc], eax
push eax
push esi
push 0x401
push ebx
call dword [sym.imp.user32.dll_SendMessageW]
jmp 0x402f3a
mov edi, dword [ebp - 0x14]
mov dword [edi + 0x10], 4
push 4
call dword [sym.imp.ucrtbase.dll_malloc]
add esp, 4
mov dword [edi + 0xc], eax
cmp dword [0x411490], 0
mov ecx, 0x40d304
mov edx, 0x40d2fc
jmp 0x402ef5
lea eax, [esi*2 + 4]
push eax
call dword [sym.imp.ucrtbase.dll_malloc]
add esp, 4
xor edi, edi
test esi, esi
je 0x402f12
xor edx, edx
mov ebx, dword [ebp - 0x10]
nop word cs:[eax + eax]
movzx ecx, word [ebx + edx*2]
cmp cx, 0xd
jne 0x402ec0
cmp word [ebx + edx*2 + 2], 0xa
jne 0x402ec0
inc edx
cmp word [eax + edi*2 - 2], 0
je 0x402ec5
mov word [eax + edi*2], 0
jmp 0x402ec4
mov word [eax + edi*2], cx
inc edi
inc edx
cmp edx, esi
jb 0x402e90
jmp 0x402f15
mov edi, dword [ebp - 0x14]
mov dword [edi + 0x10], 8
push 8
call dword [sym.imp.ucrtbase.dll_malloc]
add esp, 4
mov dword [edi + 0xc], eax
cmp dword [0x411490], 0
mov ecx, str._I64x
mov edx, str._I64u
cmove edx, ecx
push eax
push edx
mov esi, dword [ebp - 0x10]
push esi
call dbg.swscanf
add esp, 0xc
push esi
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
jmp 0x402f3a
mov ebx, dword [ebp - 0x10]
mov dword [eax + edi*2], 0
push ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xc], esi
lea eax, [edi*2 + 4]
mov edi, ecx
mov dword [ecx + 0x10], eax
push dword [edi + 0x10]
push dword [edi + 0xc]
push dword [edi + 8]
push 0
push dword [edi + 4]
push dword [edi]
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov esi, eax
test eax, eax
je 0x402f66
push 0x7da
push dword [ebp - 0x1c]
call dbg.error_code_messagebox
add esp, 8
xor eax, eax
test esi, esi
sete al
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret