joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ce60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a526
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x45e580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
mov dword [ebp - 0x24c], esi
call fcn.00429270
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x218]
push 0x7e
push eax
call fcn.004294fb
lea ecx, [ebp - 0x218]
add esp, 8
mov edx, eax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cee5
sub ecx, edi
mov dword [ebp - 0x220], 0
sar ecx, 1
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x230]
movups xmmword [ebp - 0x230], xmm0
push eax
test edx, edx
je 0x41cfde
call fcn.00401d50
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00422010
push eax
push esi
mov byte [ebp - 4], 1
call fcn.0041d470
mov ecx, dword [ebp - 0x234]
add esp, 0x10
cmp ecx, 0xf
jbe 0x41cf8f
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41cf85
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d023
push ecx
push edx
call fcn.0042754c
add esp, 8
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
mov ecx, dword [ebp - 0x21c]
cmp ecx, 7
jbe 0x41d006
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41cffc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d023
jmp 0x41cffc
call fcn.00401d50
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 2
push eax
push esi
call fcn.00422010
add esp, 8
jmp 0x41cfaa
push ecx
push edx
call fcn.0042754c
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004277b9
mov esp, ebp
pop ebp
ret
call fcn.0042c4df
int3
Function at 0x424a39
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x424a60
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x424a63
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00424a15
pop esi
leave
ret 8

Function at 0x427feb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42802a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42802a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42802a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42802a
cmp dword [ecx + 0x74], 0xe
jbe 0x42802a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x435132
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004279a0
mov eax, dword [0x45e580]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0043b727
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x435174
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4352d0
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004277d0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x460650]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0043d9cb
mov ecx, dword [esi*4 + 0x460650]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4352c9
cmp eax, dword [edi + ecx + 0x24]
jne 0x4352c9
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4352c9
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0043d9cb
add esp, 0x14
test edx, edx
jl 0x4352c9
jg 0x43523f
test eax, eax
jb 0x4352c9
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4352c9
jl 0x435259
cmp dword [ebp - 0x1008], eax
ja 0x4352c9
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x435277
test ebx, ebx
je 0x4352b0
cmp ecx, edi
jae 0x4352b0
mov al, byte [ecx]
cmp al, 0xd
jne 0x435291
lea eax, [edi - 1]
cmp ecx, eax
jae 0x43529d
cmp byte [ecx + 1], 0xa
jne 0x43529d
inc ecx
jmp 0x43529d
movzx eax, al
movsx eax, byte [eax + 0x45e840]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x435277
cmp edx, ebx
jne 0x435277
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4352ce
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004277b9
leave
ret

Function at 0x43a8cf
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4517f0
push 0x4517e8
push str.FlsAlloc
push 0x1e
call fcn.0043a719
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43a903
push dword [ebp + 8]
mov ecx, esi
call dword [0x44c224]
call esi
jmp 0x43a909
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x43a94d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x451800
push 0x4517f8
push str.FlsGetValue
push 0x20
call fcn.0043a719
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43a984
push dword [ebp + 8]
mov ecx, esi
call dword [0x44c224]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x43ca22
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043c6c4

Function at 0x43ca2d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043c853

Function at 0x43ce69
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x460650]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43cea9
cmp byte [ebx], 0xa
jne 0x43cea9
or byte [eax + edi + 0x28], 4
jmp 0x43ceae
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x43cfac
mov al, byte [edx]
cmp al, 0x1a
je 0x43cf8e
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x43cedd
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x43cf02
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x43cf0c
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x43cebf
jmp 0x43cfac
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43cf89
cmp dword [ebp - 0xc], 0
je 0x43cf89
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x460650]
test byte [eax + edi + 0x28], 0x48
je 0x43cf63
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x43cf4e
mov byte [esi], dl
jmp 0x43cf5f
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x460650]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x43cfac
cmp byte [ebp - 1], 0xa
jne 0x43cf72
cmp esi, ebx
jne 0x43cf72
mov byte [esi], 0xa
jmp 0x43cfab
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0043d9e9
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x43cfac
mov byte [esi], 0xd
jmp 0x43cfab
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x460650]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x43cfa8
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x43cfac
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x43cfb5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x460650]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43cff8
cmp word [esi], dx
jne 0x43cff8
or byte [edi + eax + 0x28], 4
jmp 0x43cffd
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x43d150
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x43d130
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x43d03f
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x43d075
cmp eax, edx
jae 0x43d081
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x43d017
jmp 0x43d150
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43d12c
cmp dword [ebp - 0x14], 0
je 0x43d12c
mov eax, dword [ebx*4 + 0x460650]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x43d104
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x43d0cd
mov word [esi], cx
jmp 0x43d100
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x460650]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x460650]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x460650]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x43d150
pop ebx
cmp word [ebp - 4], bx
jne 0x43d115
cmp esi, dword [ebp + 0xc]
jne 0x43d115
mov word [esi], bx
jmp 0x43d14d
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0043d9e9
add esp, 0x10
cmp word [ebp - 4], bx
je 0x43d150
push 0xd
jmp 0x43d149
mov ecx, dword [ebx*4 + 0x460650]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x43d147
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x43d150
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x43f9d7
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043f959
Function at 0x4411a7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x441244
push ebx
push esi
call fcn.00441170
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0043ef7e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4411f1
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x441243
push edi
push eax
call fcn.0043db6c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x441211
call fcn.0043a339
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x441242
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0043ef7e
add esp, 0x20
test eax, eax
jne 0x441230
push edi
call fcn.0043a339
jmp 0x441238
push ebx
call fcn.0043a339
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x447605
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00447581
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x44777d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x44777d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x44772c
jg 0x44765e
test eax, eax
je 0x447722
push 1
push 0x1000
call fcn.0043a2dc
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x447684
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x447719
push 0x8000
push ebx
call fcn.00437297
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4476b0
jg 0x4476ab
cmp ecx, 0x1000
jb 0x4476b0
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0043c4c4
add esp, 0x10
cmp eax, 0xffffffff
je 0x4476f5
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4476ab
jl 0x4476dc
test ecx, ecx
jne 0x44769d
push dword [ebp - 0xc]
push ebx
call fcn.00437297
push esi
call fcn.0043a339
add esp, 0xc
xor edi, edi
jmp 0x44778e
cmp byte [edi + 0x24], 0
je 0x44770c
cmp dword [edi + 0x20], 5
jne 0x44770c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x447717
mov edi, dword [edi + 0x18]
jmp 0x447719
xor edi, edi
push esi
call fcn.0043a339
pop ecx
jmp 0x44778e
test ecx, ecx
jg 0x4476ee
jl 0x44772c
test eax, eax
jae 0x4476ee
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0043d9e9
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x44774f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4476ee
jmp 0x447786
push ebx
call fcn.00441611
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4476ee
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x44778e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x44778b
mov edi, dword [edi + 0x18]
jmp 0x44778e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0043d9e9
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x448c30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x448c5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x448c5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x79d916b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
cmp ebx, 0x110
je 0x79d91720
mov dword [esp + 4], 0xffffffeb
mov dword [esp], edi
call sym._GetWindowLongW_8
xor edx, edx
sub esp, 8
mov esi, eax
cmp ebx, 0x111
je 0x79d916f5
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
cmp dword [ebp + 0x10], 1
je 0x79d91800
cmp dword [ebp + 0x10], 2
jne 0x79d916e9
mov dword [esp + 4], 0x4c7
mov dword [esp], edi
call sym._EndDialog_8
mov edx, 1
sub esp, 8
jmp 0x79d916e9
test byte [0x79d9e030], 8
jne 0x79d917c0
mov dword [esp + 8], esi
mov dword [esp + 4], 0xffffffeb
mov dword [esp], edi
call sym._SetWindowLongW_12
mov edx, dword [esi + 0x28]
sub esp, 0xc
test edx, edx
je 0x79d91770
mov dword [esp + 4], 0x406
mov dword [esp], edi
call sym._GetDlgItem_8
mov edx, dword [esi + 0x28]
sub esp, 8
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._SetWindowTextA_8
sub esp, 8
mov eax, dword [esi + 8]
mov edx, 1
test eax, eax
je 0x79d916e9
mov dword [esp], edi
mov dword [esp + 4], 0x402
mov dword [ebp - 0x14], edx
call sym._GetDlgItem_8
mov ecx, dword [esi + 8]
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym._SetWindowTextA_8
mov edx, dword [ebp - 0x14]
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], str.WM_INITDIALOG___08lx__n
mov dword [esp + 0x10], 0x2f
mov dword [esp + 0xc], str.NPS_ProxyPasswordDialog
mov dword [esp + 8], 0x79d9f2d1
mov dword [esp + 4], 0x79d9e030
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x79d9172d
mov dword [esp + 4], 0x403
mov dword [esp], edi
call sym._GetDlgItem_8
sub esp, 8
test eax, eax
je 0x79d91830
mov edx, dword [esi + 0x10]
mov dword [esp + 8], edx
mov edx, dword [esi + 0xc]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._GetWindowTextA_12
sub esp, 0xc
mov dword [esp + 4], 0x404
mov dword [esp], edi
call sym._GetDlgItem_8
sub esp, 8
test eax, eax
je 0x79d91860
mov edx, dword [esi + 0x18]
mov dword [esp + 8], edx
mov edx, dword [esi + 0x14]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._GetWindowTextA_12
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], edi
call sym._EndDialog_8
mov edx, 1
sub esp, 8
jmp 0x79d916e9
Function at 0x79d92230
Capabilities:
Check if process is running under wine
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
test byte [0x79d9e040], 4
jne 0x79d92310
lea eax, [ebp - 0x14]
mov dword [esp + 4], str.SoftwareWineWineMpr_
mov esi, 5
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
call sym._RegCreateKeyA_12
sub esp, 0xc
test eax, eax
jne 0x79d92301
movzx ecx, byte [ebp - 0x1c]
mov eax, dword [ebp + 8]
movzx edx, bx
mov esi, 8
call sym._MPR_GetValueName
mov ebx, eax
test eax, eax
je 0x79d922f3
mov eax, dword [ebp + 0x10]
movzx edi, di
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
cmp eax, 1
sbb esi, esi
call sym._GetProcessHeap_0
mov dword [esp + 8], ebx
not esi
mov dword [esp + 4], 0
and esi, 0x4c7
mov dword [esp], eax
call sym._HeapFree_12
sub esp, 0xc
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], 0xffffffff
mov dword [ebp - 0x20], edx
mov dword [esp], eax
call sym._wine_dbgstr_an
mov dword [esp + 4], 0xffffffff
mov esi, eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._wine_dbgstr_an
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
movzx edx, dx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x34], edx
movzx edx, byte [ebp - 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x30], edx
movzx edx, di
mov dword [esp + 0x2c], edx
movzx edx, bx
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], str.__p__s____d___p__s____d___d__0x_08x_:_totally_insecure_n
mov dword [esp + 0x10], 0x62
mov dword [esp + 0xc], str.WNetCachePassword
mov dword [esp + 8], 0x79d9f571
mov dword [esp + 4], 0x79d9e040
mov dword [esp], 2
call sym._ros_dbg_log
jmp 0x79d92255
Function at 0x79d923b0
Capabilities:
Check if process is running under wine
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
test byte [0x79d9e040], 4
jne 0x79d92452
lea eax, [ebp - 0x14]
mov dword [esp + 4], str.SoftwareWineWineMpr_
mov edi, 5
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
call sym._RegCreateKeyA_12
sub esp, 0xc
test eax, eax
jne 0x79d92446
mov eax, esi
movzx edx, bx
mov edi, 8
movzx ecx, al
mov eax, dword [ebp + 8]
call sym._MPR_GetValueName
mov ebx, eax
test eax, eax
je 0x79d92446
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._RegDeleteValueA_8
sub esp, 8
cmp eax, 1
sbb edi, edi
call sym._GetProcessHeap_0
mov dword [esp + 8], ebx
not edi
mov dword [esp + 4], 0
and edi, 5
mov dword [esp], eax
call sym._HeapFree_12
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._wine_dbgstr_an
mov ecx, esi
mov dword [esp + 0x14], str.__p__s____d___d_:_totally_insecure_n
movzx edx, cl
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x24], edx
movzx edx, bx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0x8b
mov dword [esp + 0xc], str.WNetRemoveCachedPassword
mov dword [esp + 8], 0x79d9f571
mov dword [esp + 4], 0x79d9e040
mov dword [esp], 2
call sym._ros_dbg_log
jmp 0x79d923cc
Function at 0x79d924c0
Capabilities:
Check if process is running under wine
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x18], 0
mov esi, dword [ebp + 0x18]
test byte [0x79d9e040], 4
jne 0x79d925c0
movzx eax, word [edi]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0x1c]
mov dword [esp + 4], str.SoftwareWineWineMpr_
mov dword [esp + 8], eax
mov dword [esp], 0x80000001
call sym._RegCreateKeyA_12
mov edx, 5
sub esp, 0xc
test eax, eax
jne 0x79d925b0
mov eax, esi
movzx edx, bx
movzx ecx, al
mov eax, dword [ebp + 8]
call sym._MPR_GetValueName
mov edx, 8
mov ebx, eax
test eax, eax
je 0x79d925b0
movzx eax, word [edi]
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._RegQueryValueExA_24
mov edx, dword [ebp - 0x14]
sub esp, 0x18
cmp eax, 1
mov word [edi], dx
sbb edx, edx
not edx
and edx, 0x4c7
mov dword [ebp - 0x24], edx
call sym._GetProcessHeap_0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._HeapFree_12
mov edx, dword [ebp - 0x24]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._wine_dbgstr_an
mov ecx, esi
mov dword [esp + 0x28], edi
movzx edx, cl
mov dword [esp + 0x1c], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esp + 0x2c], edx
movzx edx, bx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.__p__s____d___p___p___d_:_totally_insecure_n
mov dword [esp + 0x10], 0xbf
mov dword [esp + 0xc], str.WNetGetCachedPassword
mov dword [esp + 8], 0x79d9f571
mov dword [esp + 4], 0x79d9e040
mov dword [esp], 2
call sym._ros_dbg_log
jmp 0x79d924e6