joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412794
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1e0]
sub esp, 0x260
mov eax, dword [0x449748]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push edi
push CreateStatusWindowA
mov dword [ebp + 0x1dc], eax
call esi
push connect
call esi
cmp word [0x44c958], 0
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x4405a8
jne 0x41286b
push 0x104
lea eax, [ebp + 0xd8]
push eax
call ebx
push str.SMGR.DLL
lea eax, [ebp + 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41286b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp word [ebp - 0x78], 0x7d1
jb 0x412856
jne 0x41286b
cmp word [ebp - 0x76], 2
jb 0x412856
jne 0x41286b
cmp word [ebp - 0x72], 0x17
jae 0x41286b
push 0x34
push edi
push 0x440430
push dword [ebp + 0x1e8]
call esi
cmp eax, 6
jne 0x4128d3
push 0x24
push edi
push 0x4402c8
push dword [ebp + 0x1e8]
call esi
cmp eax, 6
jne 0x4128d7
push 0x104
lea eax, [ebp + 0xd8]
push eax
call ebx
push str.RESTORERSTRUI.EXE
lea eax, [ebp + 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
push 0
push 0
lea eax, [ebp + 0xd8]
push eax
push str.open
push dword [ebp + 0x1e8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x4128d7
push 0x10
push edi
push 0x440288
push dword [ebp + 0x1e8]
call esi
xor al, al
jmp 0x4128d9
mov al, 1
mov ecx, dword [ebp + 0x1dc]
pop edi
pop esi
pop ebx
call fcn.00428306
add ebp, 0x1e0
leave
ret

Function at 0x4128ef
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push edi
push CreateStatusWindowA
call esi
push connect
call esi
cmp word [0x44c958], 0
jne 0x41292e
mov ax, word [0x44c960]
cmp ax, 0x19a
jne 0x412933
push 0x40
push 0x440274
push 0x440148
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov al, 1
pop edi
pop esi
ret
cmp ax, 0x1ea
jne 0x41292e
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x24
mov edi, 0x440274
push edi
push 0x4400b0
push ebx
call esi
cmp eax, 6
jne 0x41292e
push 1
push 0
push 0
push str.scanregw__fix
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x41292e
push 0x10
push edi
push str.Scanregw
push ebx
call esi
xor al, al
jmp 0x412930
Function at 0x41b0a0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x449748]
push ebx
push esi
xor esi, esi
inc esi
xor ebx, ebx
cmp byte [0x44da5c], bl
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x310], esi
jne 0x41b1d5
cmp byte [eax], 0x22
push edi
mov byte [0x44da5c], 1
jne 0x41b100
inc eax
push eax
call fcn.0042f33d
mov edi, eax
cmp edi, ebx
pop ecx
je 0x41b1ce
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax + edi - 1]
cmp byte [eax], 0x22
jne 0x41b109
mov byte [eax], bl
jmp 0x41b109
push eax
call fcn.0042f33d
pop ecx
mov edi, eax
cmp edi, ebx
je 0x41b1ce
push str.CDRSC
xor eax, eax
call fcn.00406731
cmp eax, esi
pop ecx
jne 0x41b1ac
push 0x5c
push edi
call fcn.00426970
test eax, eax
pop ecx
pop ecx
je 0x41b1ac
push ebx
push ebx
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x314]
push eax
push edi
call fcn.00427a39
push ebx
push ebx
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00427b81
add esp, 0x28
lea eax, [ebp - 0x30c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x208]
push eax
call esi
push ebx
push ebx
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call fcn.00418edd
add esp, 0x14
mov dword [ebp - 0x310], eax
lea eax, [ebp - 0x30c]
push eax
call esi
jmp 0x41b1c7
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call fcn.00418edd
add esp, 0x14
mov dword [ebp - 0x310], eax
push edi
call fcn.004262e0
pop ecx
mov byte [0x44da5c], bl
pop edi
mov ecx, dword [ebp - 4]
mov ax, word [ebp - 0x310]
pop esi
pop ebx
call fcn.00428306
leave
ret
Function at 0x41b24c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, eax
sub ebx, dword [ebp + 0xc]
je 0x41b3b7
push esi
push edi
mov edi, dword [ebp + 8]
push ebx
push 0x41b1e8
push edi
mov dword [0x44c94c], edi
call dword [sym.imp.USER32.dll_EnumChildWindows]
push str.NoQuickScrool
xor eax, eax
call fcn.00406731
xor esi, esi
cmp eax, esi
pop ecx
je 0x41b2a7
jle 0x41b3b5
cmp eax, 2
jg 0x41b3b5
push 1
push esi
push edi
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x41b3b5
push 0x27a
push edi
call dword [sym.imp.USER32.dll_KillTimer]
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
push edi
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp ebx, esi
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov edi, 0xcc0020
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], eax
push edi
jle 0x41b341
push ebx
push esi
push dword [ebp + 0xc]
sub ecx, ebx
push ecx
push eax
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp - 0xc]
push edi
push esi
push esi
push dword [ebp - 4]
sub eax, ebx
push eax
push dword [ebp - 0x10]
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp - 0xc]
mov ecx, eax
sub ecx, ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], eax
jmp 0x41b374
push esi
push esi
push dword [ebp + 0xc]
add ecx, ebx
push ecx
push eax
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
push esi
push esi
push dword [ebp - 4]
neg ebx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
push esi
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], ebx
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ReleaseDC]
push 1
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_InvalidateRect]
push esi
push 0xc8
push 0x27a
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41bc37
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push ebp
push esi
push edi
push str.QReboot
xor eax, eax
call fcn.00406731
mov dx, word [0x44c960]
mov esi, eax
mov ax, word [0x44c958]
xor ebp, ebp
cmp ax, bp
pop ecx
jne 0x41bc64
cmp dx, 0x1ea
jb 0x41bc6d
cmp esi, ebp
mov ecx, 0x444780
jne 0x41bc72
mov ecx, 0x444778
cmp ax, bp
jne 0x41bc7e
cmp dx, 0x1ea
jb 0x41bc87
cmp esi, ebp
mov eax, 0x44473c
jne 0x41bc8c
mov eax, 0x444704
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x24
push ecx
push eax
push dword [esp + 0x1c]
call edi
cmp eax, 6
jne 0x41bd8f
cmp word [0x44c958], bp
je 0x41bcfd
call fcn.00424d6c
cmp esi, ebp
mov esi, 0x8002
je 0x41bd48
push 0x4446ec
push ebp
push esi
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push ebp
push ebp
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x41bd63
push 0x4446d0
push ebp
push esi
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x10
push 0x444780
push 0x4446b8
jmp 0x41bd89
cmp esi, ebp
je 0x41bd43
cmp word [0x44c960], 0x1ea
jb 0x41bd13
mov esi, 0x8002
jmp 0x41bcc0
push 0x4445f0
push ebp
push 0x8002
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
push ebp
push str.user.exe_exitwindowsexec
push str.rundll.exe
push str.open
push dword [esp + 0x24]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x41bd8f
mov esi, 0x8002
push 0x444694
push ebp
push esi
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push ebp
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x41bd6f
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
inc eax
jmp 0x41bd91
push 0x44466c
push ebp
push esi
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x10
push 0x444778
push 0x444618
push dword [esp + 0x1c]
call edi
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x4202bc
Capabilities:
Check for time delay via gettickcount
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
push edi
call esi
mov ebx, eax
rdtsc
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp - 4], eax
call edi
sub eax, dword [ebp - 4]
cmp eax, 0x12c
jb 0x4202e2
call esi
mov esi, eax
rdtsc
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
push 0
sub esi, ebx
sub ecx, edi
push esi
sbb eax, edx
push eax
push ecx
call fcn.00428320
push 0
push 0xa
push edx
push eax
call fcn.00428320
pop edi
pop esi
pop ebx
leave
ret

Function at 0x420326
Capabilities:
Check for time delay via gettickcount
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ebx, eax
rdtsc
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x12c
jb 0x420345
call esi
mov esi, eax
rdtsc
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
push 0
sub esi, ebx
sub ecx, edi
push esi
sbb eax, edx
push eax
push ecx
call fcn.00428320
push 0
push 0xa
push edx
push eax
call fcn.00428320
pop edi
pop esi
pop ebx
leave
ret

Function at 0x420388
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
rdtsc
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov esi, 0x12c
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
rdtsc
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
push 0
sub ecx, edi
push esi
sbb eax, edx
push eax
push ecx
call fcn.00428320
push 0
push 0xa
push edx
push eax
call fcn.00428320
pop edi
pop esi
leave
ret

Function at 0x420595
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4205f7
cmp dword [ebp - 4], 1
je 0x4205cc
cmp dword [ebp - 4], 2
je 0x4205cc
cmp dword [ebp - 4], 7
jne 0x4205f7
push dword [ebp - 8]
call fcn.004280a9
pop ecx
mov ebx, eax
lea eax, [ebp - 8]
push eax
push ebx
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x4205f0
mov eax, ebx
jmp 0x4205f9
push ebx
call fcn.0042765d
pop ecx
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x420ec0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push edi
call fcn.00420e9b
test eax, eax
je 0x420f9a
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
je 0x420f9a
cmp dword [ebp - 0x18], 0
je 0x420f9a
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x30]
push eax
call esi
lea eax, [ebp - 0x20]
push eax
call esi
rdtsc
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [ebp - 4], eax
call ebx
sub eax, dword [ebp - 4]
cmp eax, 0x12c
jb 0x420f19
lea eax, [ebp - 0x28]
push eax
call esi
rdtsc
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
call edi
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
push 0
push 2
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.004283d0
mov ecx, dword [ebp - 0x28]
push dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x18]
sbb eax, edx
add ecx, dword [ebp - 0x30]
adc eax, dword [ebp - 0x2c]
sub edi, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
sbb esi, ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
call fcn.004283d0
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0xc]
push ecx
push edx
push eax
call fcn.00428320
push 0
push 0x2710
push edx
push eax
call fcn.00428320
pop esi
pop ebx
jmp 0x420f9c
xor eax, eax
pop edi
leave
ret
Function at 0x4238c1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], eax
mov dword [ebp + 0x10], ebx
mov dword [ebp - 8], ebx
jne 0x42390c
cmp byte [0x448541], bl
je 0x4239e1
cmp byte [0x448540], bl
mov eax, 0x437620
jne 0x4238f8
mov eax, str.An_error_has_occurred_in_ReadInteger.
push 0x30
push str.Registory_Class
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4239e1
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0x10]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x4239e0
inc dword [ebp + 0x10]
push esi
push 1
push dword [ebp + 0x10]
call fcn.004268a0
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x4239df
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x4239d8
mov eax, dword [ebp - 8]
cmp eax, ebx
jbe 0x4239d8
cmp eax, 2
jbe 0x4239a6
cmp eax, 4
jbe 0x423995
cmp eax, 5
je 0x42397f
cmp eax, 7
je 0x4239a6
cmp eax, 0xb
je 0x423995
jmp 0x4239d8
mov al, byte [esi + 3]
mov cl, byte [esi]
mov byte [esi + 3], cl
mov cl, byte [esi + 1]
mov byte [esi], al
mov al, byte [esi + 2]
mov byte [esi + 2], cl
mov byte [esi + 1], al
push 4
lea eax, [ebp - 4]
push esi
push eax
call fcn.00427320
add esp, 0xc
jmp 0x4239d8
mov al, byte [esi]
cmp al, 0x2d
je 0x4239b8
cmp al, 0x2b
je 0x4239b8
cmp al, 0x30
jl 0x4239d8
cmp al, 0x39
jg 0x4239d8
lea eax, [esi + 1]
jmp 0x4239c8
cmp cl, 0x30
jl 0x4239d8
cmp cl, 0x39
jg 0x4239d8
inc eax
mov cl, byte [eax]
cmp cl, bl
jne 0x4239bd
push esi
call fcn.00426600
pop ecx
mov dword [ebp - 4], eax
push esi
call fcn.004262e0
pop ecx
pop esi
pop edi
mov eax, dword [ebp - 4]
pop ebx
leave
ret
Function at 0x4239e7
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0xa0
mov eax, dword [0x449748]
push edi
xor edi, edi
cmp dword [ebp + 0x70], edi
mov dword [ebp + 0x64], eax
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x38], edi
jne 0x423a3e
cmp byte [0x448541], 0
je 0x423a37
cmp byte [0x448540], 0
mov eax, 0x437718
jne 0x423a28
mov eax, str.An_error_has_occurred_in_WriteString.
push 0x30
push str.Registory_Class
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x423b0f
cmp byte [ebp + 0x7c], 1
push ebx
push esi
mov esi, dword [ebp + 0x78]
push 2
pop ebx
je 0x423a8f
cmp byte [ebp + 0x7c], bl
jne 0x423a6d
mov al, byte [esi]
xor edx, edx
test al, al
je 0x423a92
mov ecx, esi
cmp al, 0x25
jne 0x423a60
inc edx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x423a5b
cmp edx, ebx
jl 0x423a92
jmp 0x423a8f
cmp byte [ebp + 0x7c], 3
je 0x423a92
push edi
push edi
lea eax, [ebp - 0x38]
push eax
push edi
push dword [ebp + 0x74]
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x423a92
cmp dword [ebp - 0x38], ebx
jne 0x423a92
mov dword [ebp - 0x34], ebx
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x20], ebx
je 0x423ad6
mov eax, dword [ebp - 0x24]
shr eax, 0x10
cmp ax, di
je 0x423ac8
movzx eax, ax
mov ecx, eax
shr ecx, 8
and eax, 0xff
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
jmp 0x423ad6
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x28], 1
mov ebx, dword [ebp + 0x74]
cmp byte [ebx], 0
jne 0x423af0
cmp dword [ebp - 0x2c], 4
jne 0x423af0
cmp dword [ebp - 0x28], edi
jne 0x423af0
mov dword [ebp - 0x34], 1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push dword [ebp - 0x34]
push edi
push ebx
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
pop esi
inc eax
pop ebx
mov ecx, dword [ebp + 0x64]
pop edi
call fcn.00428306
add ebp, 0x68
leave
ret
Function at 0x423f8a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push edi
mov dword [ebp - 4], ebx
jne 0x423fcb
cmp byte [0x448541], bl
je 0x423fc4
cmp byte [0x448540], bl
mov eax, 0x437ff8
jne 0x423fb5
mov eax, str.An_error_has_occurred_in__new_ReadMultiString.
push 0x30
push str.Registry_Class
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x424088
cmp dword [ebp + 0xc], ebx
push esi
je 0x424085
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x424085
cmp dword [ebp - 4], 1
je 0x424071
cmp dword [ebp - 4], 2
je 0x424071
cmp dword [ebp - 4], 7
jne 0x424085
push dword [ebp - 8]
call fcn.0042629a
mov edi, eax
cmp edi, ebx
pop ecx
je 0x424085
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
xor ecx, ecx
xor eax, eax
cmp dword [ebp - 8], ebx
jbe 0x42403d
cmp byte [eax + edi], bl
jne 0x424037
inc ecx
inc eax
cmp eax, dword [ebp - 8]
jb 0x424031
push edi
lea esi, [ecx + eax]
call fcn.004262e0
push esi
call fcn.0042629a
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x424085
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00423dbf
mov eax, dword [ebp + 0x10]
add esp, 0x10
cmp eax, ebx
je 0x42406d
mov dword [eax], esi
mov eax, edi
jmp 0x424087
mov edi, dword [ebp + 0x10]
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00423ca0
add esp, 0xc
jmp 0x424087
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret

Function at 0x42409f
Capabilities:
Read .ini file

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esp + 8], ebx
push esi
mov esi, 0x400
jne 0x4240b2
xor eax, eax
jmp 0x42411c
push edi
push 1
push esi
call fcn.004268a0
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x424119
push ebp
push dword [esp + 0x14]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov ebp, eax
lea eax, [esi - 2]
cmp ebp, eax
jne 0x4240f8
push edi
call fcn.004262e0
add esi, esi
cmp esi, ebp
pop ecx
jb 0x424118
push 1
push esi
call fcn.004268a0
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x4240c4
jmp 0x424118
xor ebx, ebx
lea eax, [edi + 1]
cmp byte [eax - 1], 0
jne 0x424108
cmp byte [eax], 0
je 0x424111
cmp byte [eax], 0
jne 0x42410e
inc ebx
inc eax
jmp 0x4240fd
push edi
call fcn.004262e0
pop ecx
pop ebp
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x42411f
Capabilities:
Read .ini file

Disassembly:
push ecx
push ebx
xor ebx, ebx
cmp dword [esp + 0xc], ebx
push esi
mov esi, 0x400
mov dword [esp + 8], ebx
je 0x4241b7
cmp dword [esp + 0x14], ebx
je 0x4241b7
push edi
push 1
push esi
call fcn.004268a0
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x4241b0
push ebp
push dword [esp + 0x18]
push esi
push edi
push 0x43c616
push ebx
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebp, eax
lea eax, [esi - 2]
cmp ebp, eax
jne 0x42418d
push edi
call fcn.004262e0
add esi, esi
cmp esi, ebp
pop ecx
jb 0x4241af
push 1
push esi
call fcn.004268a0
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
jne 0x42414f
jmp 0x4241af
mov dword [esp + 0x10], ebx
lea eax, [edi + 1]
cmp byte [eax - 1], bl
jne 0x42419d
cmp byte [eax], bl
je 0x4241a8
cmp byte [eax], bl
jne 0x4241a5
inc dword [esp + 0x10]
inc eax
jmp 0x424194
push edi
call fcn.004262e0
pop ecx
pop ebp
mov eax, dword [esp + 0xc]
pop edi
jmp 0x4241b9
xor eax, eax
pop esi
pop ebx
pop ecx
ret

Function at 0x4241bd
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
mov esi, 0x400
je 0x42424d
cmp dword [ebp + 0x10], ebx
je 0x42424d
cmp dword [ebp + 0x14], ebx
je 0x42424d
push edi
push 1
push esi
call fcn.004268a0
mov edi, eax
cmp edi, ebx
jmp 0x42421d
push dword [ebp + 8]
push esi
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, eax
lea eax, [esi - 1]
cmp ebx, eax
push edi
jne 0x424223
call fcn.004262e0
add esi, esi
cmp esi, ebx
pop ecx
jb 0x42423d
push 1
push esi
call fcn.004268a0
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x4241e7
jmp 0x42423d
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
call fcn.004266f3
test eax, eax
pop ecx
pop ecx
je 0x424239
mov edi, eax
test edi, edi
jne 0x424248
push dword [ebp + 0x14]
call fcn.0042f33d
pop ecx
mov edi, eax
mov eax, edi
pop edi
jmp 0x42424f
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x424253
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov edi, 0x400
push 1
push edi
xor ebx, ebx
call fcn.004268a0
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x4242df
push ebp
push dword [esp + 0x14]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov ebp, eax
lea eax, [edi - 2]
cmp ebp, eax
jne 0x4242a2
push esi
call fcn.004262e0
add edi, edi
cmp edi, ebp
pop ecx
jb 0x4242de
push 1
push edi
call fcn.004268a0
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
jne 0x42426e
jmp 0x4242de
cmp dword [esp + 0x18], ebx
jne 0x4242ab
push esi
jmp 0x4242cf
xor ecx, ecx
xor eax, eax
cmp byte [eax + esi], bl
jne 0x4242ba
cmp byte [eax + esi + 1], bl
je 0x4242d7
cmp byte [eax + esi + 1], bl
jne 0x4242c7
inc ecx
cmp ecx, dword [esp + 0x18]
je 0x4242ca
inc eax
jmp 0x4242af
lea eax, [eax + esi + 2]
push eax
call fcn.0042f33d
pop ecx
mov ebx, eax
push esi
call fcn.004262e0
pop ecx
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
ret