joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fcf0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2888
call fcn.00438220
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x41fdcd
lea eax, [ebp - 0x2888]
mov dword [ebp - 0x2888], 0x2880
push eax
lea eax, [ebp - 0x2884]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x41fdcd
lea eax, [ebp - 0x2884]
nop
cmp byte [eax + 0x194], 0
jne 0x41fd8d
cmp byte [eax + 0x195], 0
jne 0x41fd8d
cmp byte [eax + 0x196], 0
jne 0x41fd8d
cmp byte [eax + 0x197], 0
jne 0x41fd8d
cmp byte [eax + 0x198], 0
jne 0x41fd8d
cmp byte [eax + 0x199], 0
jne 0x41fd8d
mov eax, dword [eax]
test eax, eax
jne 0x41fd40
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 4
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
push str._02X__02X__02X__02X__02X__02X
push 0x32
push esi
call fcn.0042c614
add esp, 0x24
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 4

Function at 0x41ff90
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
jne 0x41ff9b
xor eax, eax
pop ebx
ret
push esi
push edi
mov edi, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x41ffa2
sub edi, ecx
inc edi
push edi
call fcn.0042a219
push edi
mov esi, eax
push 0
push esi
call fcn.0042e710
push ebx
push edi
push esi
call fcn.0042c854
xor eax, eax
add esp, 0x1c
cmp byte [esi], al
je 0x41ffda
mov edi, edi
xor byte [esi], 0x20
inc eax
inc esi
cmp byte [esi], 0
jne 0x41ffd0
sub esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4208a0
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0042e710
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x443cc8
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0042a175
push str.4177GameBox_Data
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0042a175
push 0x443cc8
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0042a175
push str.setconfig.ini
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0042a175
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x20c]
add esp, 0x30
push eax
push 0
push str.CloseProgramAndExit
push str.config
call esi
mov dword [0x476068], eax
lea eax, [ebp - 0x20c]
push eax
push 1
push str.AutoRun
push str.config
call esi
mov dword [0x476084], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push str.HotShowHideA
push str.config
call esi
mov dword [0x47606c], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push str.HotShowHideB
push str.config
call esi
mov dword [0x476070], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push str.HotShowHideC
push str.config
call esi
mov dword [0x476074], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push str.HotCloseProgramA
push str.config
call esi
mov dword [0x476078], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push str.HotCloseProgramB
push str.config
call esi
mov dword [0x47607c], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push str.HotCloseProgramC
push str.config
call esi
mov dword [0x476080], eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push 0x47608c
push 0x476294
push str.CachePath
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp dword [0x47606c], 0
pop esi
jne 0x420a64
mov dword [0x47606c], 0x11
mov dword [0x476070], 0
mov dword [0x476074], 0x33
cmp dword [0x476078], 0
jne 0x420a8b
mov dword [0x476078], 0x11
mov dword [0x47607c], 0
mov dword [0x476080], 0x34
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
Function at 0x420aa0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x214]
xor esi, esi
push eax
push 0x20019
push esi
push str.SOFTWARE4177SBox
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x420aec
push dword [ebp - 0x214]
mov esi, 1
call edi
xor ebx, ebx
mov eax, str.Smalbox
test esi, esi
mov esi, str.4177SBox
setne bl
test ebx, ebx
cmove esi, eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 8], 0
je 0x420bcd
test eax, eax
jne 0x420b50
push esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x214]
call edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0042e710
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x475d84]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
test ebx, ebx
je 0x420b97
push str.__autorun
jmp 0x420b9c
push str.__tlaclt
push 0x104
push eax
call fcn.0042a175
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push esi
sub esp, 8
call fcn.004225d0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 4
test eax, eax
jne 0x420be6
push esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x214]
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 4
Function at 0x421a50
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
push str.GAMEBOX_SETTING_WND_CLASS
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x421a9f
push 0
push str.GAMEBOX_SETTING_WND_CLASS
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
je 0x421a9f
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi]
test eax, eax
je 0x421ab0
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x421ac6
mov ecx, esi
call fcn.00421550
test al, al
je 0x421a9a
push esi
push 0xffffffffffffffeb
push dword [esi]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push dword [esi]
call fcn.00422cd0
pop edi
mov al, 1
pop esi
ret

Function at 0x421c80
Capabilities:
Hide graphical window

Disassembly:
push esi
push 0
push dword [0x475d84]
mov esi, ecx
push 0
push dword [esi + 0x190]
lea eax, [esi + 0xc8]
push 0
push SysReAllocString
push 0
push SysReAllocString
push SysReAllocString
push eax
push esi
push 0x20
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 0x194], eax
test eax, eax
jne 0x421cc2
pop esi
ret
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push str.shadow_window
push dword [esi + 0x194]
call dword [sym.imp.gbui.dll_GetPluginByName]
mov edx, eax
mov eax, dword [esi + 0x198]
test eax, eax
jne 0x421cf9
mov ecx, dword [edx]
push str.shadow_top_style
push edx
call dword [ecx + 0xa8]
jmp 0x421d24
cmp eax, 1
jne 0x421d05
push str.shadow_left_style
jmp 0x421d1b
cmp eax, 2
jne 0x421d11
push str.shadow_right_style
jmp 0x421d1b
cmp eax, 3
jne 0x421d24
push str.shadow_bottom_style
mov eax, dword [edx]
push edx
call dword [eax + 0xa8]
push 0
push dword [esi + 0x194]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x194]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
pop esi
ret
Function at 0x422010
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0x206
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
mov dword [ebp - 0x670], ecx
call fcn.0042e710
add esp, 0xc
lea eax, [ebp - 0x41c]
push esi
push 0x44a3a8
push eax
call fcn.00418760
add esp, 0xc
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4221ef
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.0042e710
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0xc
jmp 0x4220b0
mov ecx, 0x44988c
lea eax, [ebp - 0x640]
jmp 0x4220c0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4220e6
test dx, dx
je 0x4220e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4220e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4220c0
xor eax, eax
jmp 0x4220eb
sbb eax, eax
or eax, 1
test eax, eax
je 0x4221b9
mov eax, 0x44a3a0
lea ecx, [ebp - 0x640]
mov edi, edi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x422126
test dx, dx
je 0x422122
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x422126
add ecx, 4
add eax, 4
test dx, dx
jne 0x422100
xor eax, eax
jmp 0x42212b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4221b9
push esi
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.00429ebe
add esp, 0xc
lea eax, [ebp - 0x214]
push 0x443cc8
push 0x104
push eax
call fcn.0042a175
add esp, 0xc
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.0042a175
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [ebp - 0x66c], 0x10
lea eax, [ebp - 0x214]
push eax
je 0x4221b7
mov ecx, dword [ebp - 0x670]
call fcn.00422010
jmp 0x4221b9
call ebx
lea eax, [ebp - 0x66c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4220b0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 4
Function at 0x422210
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push 0x206
push eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
call fcn.0042e710
add esp, 0xc
lea eax, [ebp - 0x418]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4223fe
push str.MacromediaFlash_PlayerSharedObjects
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.0042a175
add esp, 0xc
xor eax, eax
mov word [ebp - 0x620], ax
push 0x206
push eax
lea eax, [ebp - 0x61e]
push eax
call fcn.0042e710
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x620]
push 0x44a3a8
push eax
call fcn.00418760
add esp, 0xc
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4223fe
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0042e710
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
add esp, 0xc
jmp 0x422300
mov ecx, 0x44988c
lea eax, [ebp - 0x844]
jmp 0x422310
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x422336
test dx, dx
je 0x422332
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x422336
add eax, 4
add ecx, 4
test dx, dx
jne 0x422310
xor eax, eax
jmp 0x42233b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4223e5
mov eax, 0x44a3a0
lea ecx, [ebp - 0x844]
mov edi, edi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x422376
test dx, dx
je 0x422372
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x422376
add ecx, 4
add eax, 4
test dx, dx
jne 0x422350
xor eax, eax
jmp 0x42237b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4223e5
test byte [ebp - 0x870], 0x10
je 0x4223e5
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00429ebe
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x443cc8
push 0x104
push eax
call fcn.0042a175
add esp, 0xc
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0042a175
add esp, 0xc
lea eax, [ebp - 0x210]
mov ecx, ebx
push eax
call fcn.00422010
lea eax, [ebp - 0x870]
push eax
push esi
call edi
test eax, eax
jne 0x422300
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
Function at 0x422410
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov word [ebp - 0x28], 0x100
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 1
lea eax, [ebp - 0x2c]
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x44], ebx
push eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4224ea
mov eax, dword [ebp - 0x30]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x14], xmm0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x34]
push eax
push esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], esi
movdqu xmmword [ebp - 0x24], xmm0
push eax
push 1
mov dword [ebp - 0x24], 0x1f01ff
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0xc], 5
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x4224ea
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x4224ea
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x4224ea
push edi
push dword [ebp - 0x34]
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x4224ea
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0xc
push eax
push ebx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, eax
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4224f8
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
je 0x422508
push eax
call ebx
test esi, esi
je 0x42250f
push esi
call ebx
test edi, edi
jne 0x42252e
push edi
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret

Function at 0x422550
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
xor bl, bl
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARE4177SBox
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4225ba
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push 0
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4225d0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 8]
push edi
mov edi, dword [ebp + 0x10]
xor bl, bl
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x422643
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0x10

Function at 0x422660
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SOFTWARE4177SBox
push reloc.OLEAUT32.dll_SysReAllocString
xor bl, bl
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4226cc
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push str.InstallName
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4228e0
Capabilities:
Get common file path
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1210
call fcn.00438220
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
push 0x4795f8
call fcn.0042e710
push 0x208
push 0
push 0x479800
call fcn.0042e710
push 0x1000
mov dword [0x479a14], 0
call fcn.0042a219
add esp, 0x1c
mov dword [0x479a08], eax
test eax, eax
je 0x4229ea
push 0x1000
push 0
push eax
call fcn.0042e710
push 0xfff
lea eax, [ebp - 0x120b]
mov byte [ebp - 0x120c], 0
push 0
push eax
call fcn.0042e710
add esp, 0x18
mov dword [ebp - 0x1210], 0x1000
lea eax, [ebp - 0x1210]
push eax
lea eax, [ebp - 0x120c]
push eax
push 0
call dword [sym.imp.urlmon.dll_ObtainUserAgentString]
lea eax, [ebp - 0x120c]
push 0x44a450
push eax
call fcn.0042cc30
add esp, 8
test eax, eax
jne 0x4229ea
lea eax, [ebp - 0x120c]
push 0x29
push eax
call fcn.0042d4e0
add esp, 8
test eax, eax
je 0x4229d0
push str.__xbp_1.0_
mov byte [eax], 0
lea eax, [ebp - 0x120c]
push 0x1000
push eax
call fcn.0042d617
add esp, 0xc
lea eax, [ebp - 0x120c]
push eax
push 0x1000
push dword [0x479a08]
call fcn.0042c854
add esp, 0xc
push 0xc8
call fcn.0042a219
add esp, 4
mov dword [0x479a0c], eax
test eax, eax
je 0x422a1b
push 0xc8
push 0
push eax
call fcn.0042e710
add esp, 0xc
push dword [0x479a0c]
call fcn.0041fcf0
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0042e710
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x23
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x20c]
push 0x443cc8
push eax
call esi
push str.4177GameBox_Data_
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x104
push 0
push 0x475b40
call fcn.0042e710
lea eax, [ebp - 0x20c]
push eax
push 0x104
push 0x475b40
call fcn.00429ebe
add esp, 0x18
push str.filecache.ini
push 0x475b40
call esi
call fcn.00422e60
mov ecx, dword [ebp - 4]
mov dword [0x479a10], eax
xor ecx, ebp
mov eax, 0x4795f8
pop esi
call fcn.00429eaf
mov esp, ebp
pop ebp
ret

Function at 0x422ad0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x422b32
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
Function at 0x422cd0
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
push ebx
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
mov dword [ebp - 8], eax
call ebx
mov edi, dword [ebp + 8]
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call ebx
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4