joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xa8
push ebx
xor eax, eax
push ebp
xor ebp, ebp
cmp edx, dword [esp + 0xb4]
push esi
push edi
mov ecx, 8
lea esi, [esp + 0x18]
lea edi, [esp + 0x98]
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x74], eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ebp
mov ebx, edx
jg 0x406477
xor eax, eax
cmp ebx, ebp
mov dword [esp + 0x54], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], 1
mov dword [esp + 0x14], ebp
jle 0x40645a
lea ecx, [ecx]
xor eax, eax
mov ecx, 8
lea esi, [esp + 0x38]
lea edi, [esp + 0x78]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x78]
mov edx, ecx
mov dword [esp + 0x34], eax
push ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xc4]
push edx
lea edx, [esp + 0x20]
mov dword [esp + 0x3c], eax
call fcn.00412d10
mov ecx, 8
lea esi, [esp + 0x80]
lea edi, [esp + 0x40]
add esp, 8
rep movsd dword es:[edi], dword [esi]
xor eax, eax
jmp 0x406430
mov ecx, dword [esp + eax + 0x38]
mov edx, dword [esp + eax + 0x98]
cmp ecx, edx
ja 0x406499
jb 0x406449
add eax, 4
cmp eax, 0x20
jl 0x406430
mov eax, dword [esp + 0x14]
inc eax
cmp eax, ebx
mov dword [esp + 0x14], eax
jl 0x4063c0
lea eax, [esp + 0x58]
lea edx, [esp + 0x38]
mov edi, eax
call fcn.00412870
inc ebx
cmp ebx, dword [esp + 0xbc]
jle 0x406387
mov edi, dword [esp + 0xc4]
mov ecx, 8
lea esi, [esp + 0x58]
rep movsd dword es:[edi], dword [esi]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa8
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa8
ret

Function at 0x406500
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0
push 0x147
push 0xd6
push esi
call dword [sym.imp.user32.dll_SendDlgItemMessageW]
test eax, eax
jl 0x406582
push ebx
push edi
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
jne 0x406553
push 0
push 0xd7
push esi
call edi
mov ebx, dword [sym.imp.user32.dll_ShowWindow]
push eax
call ebx
push 0
push 0xd8
push esi
call edi
push eax
call ebx
push 0
push 0xd9
push esi
call edi
push eax
call ebx
pop edi
pop ebx
ret
push 5
push 0xd7
push esi
call edi
mov ebx, dword [sym.imp.user32.dll_ShowWindow]
push eax
call ebx
push 5
push 0xd8
push esi
call edi
push eax
call ebx
push 5
push 0xd9
push esi
call edi
push eax
call ebx
pop edi
pop ebx
ret
Function at 0x407710
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x418
mov eax, dword [0x4890a0]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push 0x482bdc
mov ebx, ecx
xor eax, eax
push 0x400
push ebx
mov word [ebx], ax
call fcn.00432730
push ebx
push 1
mov ecx, esi
call fcn.004066a0
add esp, 0x14
test eax, eax
jne 0x407763
pop ebx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.00431784
add esp, 0x418
ret
push ebp
mov ebp, dword [sym.imp.user32.dll_GetDlgItemInt]
push edi
push 0
lea ecx, [esp + 0x10]
push ecx
push 0xdd
push esi
call ebp
push 0
lea edx, [esp + 0x14]
push edx
push 0xdf
push esi
mov edi, eax
call ebp
cmp dword [esp + 0xc], 0
je 0x4078d2
cmp dword [esp + 0x10], 0
je 0x4078d2
cmp edi, eax
jg 0x4078d2
lea ecx, [edi - 1]
cmp ecx, 0x7e
ja 0x4078d2
lea edx, [eax - 1]
cmp edx, 0x7e
ja 0x4078d2
push eax
push edi
lea eax, [esp + 0x228]
push 0x482be8
push eax
mov edx, 0x100
call fcn.00406210
lea ecx, [esp + 0x230]
push ecx
push 0x400
push ebx
call fcn.00432730
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
add esp, 0x1c
push 0x100
lea edx, [esp + 0x24]
push edx
push 0xe1
push esi
call edi
mov ebp, dword [sym.imp.user32.dll_GetWindowTextW]
push eax
call ebp
lea eax, [esp + 0x20]
lea edx, [eax + 2]
jmp 0x407820
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407820
sub eax, edx
sar eax, 1
je 0x4078b5
push 4
lea eax, [esp + 0x1c]
push eax
push 0xe3
push esi
call edi
push eax
call ebp
lea eax, [esp + 0x18]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407850
sub eax, edx
sar eax, 1
cmp eax, 1
jb 0x4078d2
push 0x482c0c
push 0x400
push ebx
call fcn.00432730
lea ecx, [esp + 0x2c]
push ecx
push 0x400
call fcn.00406590
push 0x482c14
push 0x400
push ebx
call fcn.00432730
lea edx, [esp + 0x38]
push edx
push 0x400
call fcn.00406590
push 0x482bc4
push 0x400
push ebx
call fcn.00432730
add esp, 0x34
pop edi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.00431784
add esp, 0x418
ret
mov ecx, dword [esp + 0x420]
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00431784
add esp, 0x418
ret
Function at 0x40dbb0
Capabilities:
Create thread

Disassembly:
push esi
push 0x18
call fcn.00431c1f
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0xc]
push 0
push 0
push esi
push 0x40d590
push 0
push 0
mov dword [esi], eax
mov dword [esi + 8], 0x403d90
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 0x4037a0
mov dword [esi + 0x14], edx
call fcn.00432c3e
add esp, 0x1c
mov dword [esi + 4], eax
pop esi
ret

Function at 0x40dcc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push 0xa
mov esi, eax
push 0xfa1
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
push ebx
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
push ebx
push esi
mov edi, eax
call dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, eax
push ebx
call dword [sym.imp.kernel32.dll_LockResource_1]
mov ebp, eax
lea eax, [edi + 0x10]
push eax
call fcn.00431c1f
mov esi, eax
add esp, 4
test esi, esi
jne 0x40dd1c
push ebx
call dword [sym.imp.kernel32.dll_FreeResource]
pop edi
lea eax, [esi + 0x10]
pop esi
pop ebp
pop ebx
ret
push edi
push ebp
push esi
call fcn.00433c20
mov ecx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x28]
mov edx, esi
mov byte [esi + edi], 0
mov byte [esi + edi + 1], 0
call fcn.0040dd60
push esi
mov edi, eax
call fcn.00431ac8
add esp, 0x14
push ebx
call dword [sym.imp.kernel32.dll_FreeResource]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40e640
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x20
mov eax, dword [0x4890a0]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
push edi
mov edi, ecx
cmp edi, 0xa
mov dword [esp + 4], eax
jg 0x40e71b
push ebx
push ebp
push esi
push 4
lea ecx, [esp + 0x28]
push ecx
push 0xf
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
mov eax, edi
cdq
push edx
push eax
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x3c]
push edx
push eax
xor esi, esi
xor ebp, ebp
call fcn.00445b10
mov dword [esp + 0x20], ebx
mov edi, eax
mov ebx, edx
add cl, 0x30
movsx dx, cl
mov ecx, dword [esp + 0x10]
mov word [ecx + esi*2], dx
mov eax, edi
inc esi
inc ebp
or eax, ebx
je 0x40e72b
mov eax, 0x55555556
imul ebp
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*2]
mov eax, ebp
sub eax, edx
jne 0x40e6e1
cmp esi, 0x200
jge 0x40e706
mov dx, word [esp + 0x24]
mov word [ecx + esi*2], dx
inc esi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push ebx
push edi
call fcn.00445b10
cmp esi, 0x200
mov dword [esp + 0x20], ebx
mov edi, eax
mov ebx, edx
jl 0x40e6a1
mov ecx, dword [esp + 0x10]
xor eax, eax
mov word [ecx + 0x3fe], ax
push ecx
call fcn.00432d4f
add esp, 4
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
pop edi
xor ecx, esp
call fcn.00431784
add esp, 0x20
ret
cmp esi, 0x200
jge 0x40e706
xor edx, edx
mov word [ecx + esi*2], dx
jmp 0x40e70f
Function at 0x40edb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov esi, eax
movzx eax, word [esp + 0x14]
push 0xa
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebp, eax
push ebp
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
lea ecx, [edi + 2]
push ecx
call fcn.00431c1f
add esp, 4
push ebp
push esi
mov ebx, eax
call dword [sym.imp.kernel32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_LockResource_1]
push edi
push eax
push ebx
call fcn.00433c20
mov eax, edi
cdq
sub eax, edx
add esp, 0xc
sar eax, 1
xor edx, edx
push esi
mov word [ebx + eax*2], dx
call dword [sym.imp.kernel32.dll_FreeResource]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x4111b0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
sub esp, 8
push edi
push 0x4000
call fcn.00431c1f
mov edi, eax
add esp, 4
test edi, edi
jne 0x4111cc
pop edi
add esp, 8
ret
push ebx
push esi
push 0
push 0
push 0
push 0
push 0x482f14
xor bl, bl
call dword [sym.imp.wininet.dll_InternetOpenW]
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
je 0x411281
mov eax, dword [esp + 0x18]
push ebp
push 0
push 0
push 0
push 0
push eax
push esi
call dword [sym.imp.wininet.dll_InternetOpenUrlW]
mov ebp, eax
test ebp, ebp
je 0x411275
mov ebx, dword [sym.imp.wininet.dll_InternetReadFile]
xor esi, esi
jmp 0x411220
lea ecx, [esi + 0x400]
mov eax, 0x400
mov dword [esp + 0x10], eax
cmp ecx, 0x4000
jb 0x411242
mov eax, 0x4000
sub eax, esi
mov dword [esp + 0x10], eax
lea edx, [esp + 0x10]
push edx
push eax
lea eax, [esi + edi]
push eax
push ebp
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41125b
add esi, eax
jmp 0x411220
test esi, esi
seta bl
cmp esi, 0x4000
jb 0x41126d
mov esi, 0x3fff
mov byte [esi + edi], 0
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.wininet.dll_InternetCloseHandle]
pop ebp
test bl, bl
jne 0x41128c
push edi
call fcn.00431ac8
add esp, 4
xor edi, edi
pop esi
pop ebx
mov eax, edi
pop edi
add esp, 8
ret
Function at 0x4147f0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esi + 0xc]
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
xor ebx, ebx
push edi
cmp eax, dword [esi + 8]
jb 0x4148c7
cmp byte [esi + 0x24], bl
je 0x414819
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 4
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
mov edi, 0x10000
add ecx, edi
adc eax, ebx
cmp eax, dword [ebp + 0x214]
jl 0x414843
jg 0x41483a
cmp ecx, dword [ebp + 0x210]
jbe 0x414843
mov edi, dword [ebp + 0x210]
sub edi, dword [esi + 0x10]
mov eax, dword [esi]
push 1
lea ecx, [esp + 0x18]
push ecx
push ebx
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x41487c
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
je 0x414878
or eax, 0xffffffff
mov dword [esp + 0x14], eax
jmp 0x41487c
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 4]
push ebx
mov dword [esi + 0x18], eax
lea eax, [esp + 0x20]
push eax
push edi
mov dword [esi + 0x1c], edx
mov edx, dword [esi]
push ecx
push edx
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x41480d
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x41480d
add dword [esi + 0x10], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 8], eax
adc dword [esi + 0x14], ebx
cmp byte [ebp + 1], bl
je 0x4148e5
test al, 1
je 0x4148c7
dec eax
mov dword [esi + 8], eax
cmp byte [ebp + 1], bl
je 0x4148e5
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 4]
movzx eax, word [eax + ecx]
add ecx, 2
mov dword [esi + 0xc], ecx
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 4
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
movzx eax, byte [edx + ecx]
pop edi
inc ecx
pop ebp
mov dword [esi + 0xc], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x419a10
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x4890a0]
xor eax, esp
mov dword [esp + 0x2c], eax
cmp dword [0x4d4db8], 0
mov eax, dword [esp + 0x34]
push esi
mov esi, dword [eax + 4]
jge 0x419a48
lea ecx, [esp + 4]
push 1
push ecx
call fcn.00423640
mov edx, dword [esp + 0x2c]
add esp, 8
mov dword [0x4d4db8], edx
cmp esi, 0x5a495043
je 0x419b77
cmp esi, 0x52415233
je 0x419b77
cmp esi, 0x4f463037
je 0x419b77
cmp esi, 0x4f463130
je 0x419b77
cmp esi, 0x575a4145
je 0x419b60
cmp esi, 0x57504148
je 0x419b60
cmp esi, 0x4f4f4446
jne 0x419b4e
lea eax, [esp + 4]
push 0
push eax
call fcn.00423640
mov ecx, dword [esp + 0xc]
add esp, 8
mov eax, 0x1b58
cmp ecx, 2
je 0x419abe
cmp ecx, 3
jne 0x419ac3
mov eax, 0x2328
mov ecx, dword [0x4d4db8]
imul ecx, eax
mov eax, 0x10624dd3
imul ecx
mov eax, dword [edi]
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, 0xb40
cmp eax, 2
jne 0x419aee
mov esi, 0xab4
cmp eax, 4
jne 0x419afe
cmp dword [edi + 4], 8
jne 0x419afe
mov esi, 0x834
mov eax, dword [edi + 0x90]
imul eax, dword [edi + 0x8c]
imul eax, eax, 0x3e8
cdq
idiv esi
lea eax, [eax + ecx - 1]
cdq
idiv ecx
mov esi, eax
cmp esi, 1
jge 0x419b27
mov esi, 1
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esp + 0x18]
cmp esi, eax
jle 0x419b3c
mov esi, eax
mov eax, esi
pop esi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00431784
add esp, 0x30
ret
xor eax, eax
pop esi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00431784
add esp, 0x30
ret
mov eax, dword [edi]
cmp eax, 2
je 0x419b77
cmp eax, 4
jne 0x419b77
cmp dword [edi + 4], 8
mov eax, 2
je 0x419b7c
mov eax, 1
mov ecx, dword [esp + 0x30]
pop esi
xor ecx, esp
call fcn.00431784
add esp, 0x30
ret
Function at 0x419ea0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1014
call fcn.0044f150
mov eax, dword [0x4890a0]
xor eax, esp
mov dword [esp + 0x1010], eax
mov eax, dword [esp + 0x101c]
push edi
mov edi, ecx
test eax, eax
je 0x419ee5
push eax
push 0x48351c
lea eax, [esp + 0x1c]
push 0x481724
push eax
mov edx, 0x400
call fcn.00419e80
add esp, 0x10
jmp 0x419efc
push 0x48351c
lea ecx, [esp + 0x18]
push 0x400
push ecx
call fcn.004329ff
add esp, 0xc
push edi
lea edx, [esp + 0x818]
push 0x400
push edx
call fcn.004329ff
add esp, 0xc
test esi, esi
je 0x419f1c
mov dword [esi], 1
lea eax, [esp + 4]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419fc7
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExW]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
push 0
lea ecx, [esp + 0x824]
push ecx
push edx
call edi
test eax, eax
jne 0x419fbc
cmp dword [esp + 8], 4
jne 0x419fbc
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x824]
push eax
push ecx
call edi
test eax, eax
jne 0x419fbc
test esi, esi
je 0x419f97
mov dword [esi], eax
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
mov ecx, dword [esp + 0x1010]
xor ecx, esp
call fcn.00431784
add esp, 0x1014
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1014]
mov eax, dword [esp + 0x101c]
pop edi
xor ecx, esp
call fcn.00431784
add esp, 0x1014
ret
Function at 0x419ff0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1810
call fcn.0044f150
mov eax, dword [0x4890a0]
xor eax, esp
mov dword [esp + 0x180c], eax
mov eax, dword [esp + 0x181c]
push ebx
mov ebx, ecx
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x181c]
mov word [esi], cx
test eax, eax
je 0x41a042
push eax
push 0x48351c
lea edx, [esp + 0x1c]
push 0x481724
push edx
mov edx, 0x400
call fcn.00419e80
add esp, 0x10
jmp 0x41a059
push 0x48351c
lea eax, [esp + 0x18]
push 0x400
push eax
call fcn.004329ff
add esp, 0xc
push ebx
lea ecx, [esp + 0x818]
push 0x400
push ecx
call fcn.004329ff
add esp, 0xc
test edi, edi
je 0x41a079
mov dword [edi], 1
lea edx, [esp + 8]
push edx
push 0x20019
push 0
lea eax, [esp + 0x20]
push eax
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a12e
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
push eax
lea edx, [esp + 0x14]
push edx
push eax
lea eax, [esp + 0x824]
push eax
push ecx
call ebx
test eax, eax
jne 0x41a123
cmp dword [esp + 0xc], 1
jne 0x41a123
mov edx, dword [esp + 0x1820]
lea eax, [edx + edx]
cmp dword [esp + 0x10], eax
jae 0x41a123
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1018]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 0
lea ecx, [esp + 0x824]
push ecx
push edx
call ebx
test eax, eax
jne 0x41a123
test edi, edi
je 0x41a106
mov dword [edi], eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov edx, dword [esp + 0x1820]
lea ecx, [esp + 0x1014]
push ecx
push edx
jmp 0x41a137
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1820]
push ebp
push ecx
push esi
call fcn.004329ff
mov ecx, dword [esp + 0x1820]
add esp, 0xc
pop ebp
pop ebx
xor ecx, esp
mov eax, esi
call fcn.00431784
add esp, 0x1810
ret

Function at 0x41a160
Capabilities:
Set registry value

Disassembly:
mov eax, 0x1008
call fcn.0044f150
mov eax, dword [0x4890a0]
xor eax, esp
mov dword [esp + 0x1004], eax
mov eax, dword [esp + 0x1010]
test eax, eax
je 0x41a1a2
push eax
push 0x48351c
lea eax, [esp + 0xc]
push 0x481724
push eax
mov edx, 0x400
call fcn.00419e80
add esp, 0x10
jmp 0x41a1b9
push 0x48351c
lea ecx, [esp + 8]
push 0x400
push ecx
call fcn.004329ff
add esp, 0xc
push esi
lea edx, [esp + 0x808]
push 0x400
push edx
call fcn.004329ff
add esp, 0xc
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
push 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
mov eax, dword [esp]
test eax, eax
je 0x41a211
push 4
lea edx, [esp + 0x1010]
push edx
push 4
push 0
lea ecx, [esp + 0x814]
push ecx
push eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov edx, dword [esp]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.00431784
add esp, 0x1008
ret
Function at 0x41a230
Capabilities:
Set registry value

Disassembly:
mov eax, 0x1808
call fcn.0044f150
mov eax, dword [0x4890a0]
xor eax, esp
mov dword [esp + 0x1804], eax
push esi
push 0x4816bc
push 0x48351c
lea eax, [esp + 0x810]
push 0x481724
push eax
mov edx, 0x400
mov esi, ecx
call fcn.00419e80
push esi
lea ecx, [esp + 0x101c]
push 0x400
push ecx
call fcn.004329ff
push edi
lea edx, [esp + 0x28]
push 0x400
push edx
call fcn.004329ff
add esp, 0x28
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x80c]
push ecx
push 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
mov edx, dword [esp + 4]
test edx, edx
je 0x41a2f7
lea eax, [esp + 8]
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41a2c0
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [esp + 0xc]
push ecx
push 1
push 0
lea eax, [esp + 0x1018]
push eax
push edx
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1808]
pop esi
xor ecx, esp
call fcn.00431784
add esp, 0x1808
ret

Function at 0x41a310
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1010
call fcn.0044f150
mov eax, dword [0x4890a0]
xor eax, esp
mov dword [esp + 0x100c], eax
push esi
push edi
push 0x4ad300
push 0x48351c
lea eax, [esp + 0x81c]
push 0x481724
push eax
mov edx, 0x400
mov esi, ecx
call fcn.00419e80
push esi
lea ecx, [esp + 0x28]
push 0x400
push ecx
call fcn.004329ff
add esp, 0x1c
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x818]
push eax
push 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
mov eax, dword [esp + 8]
test eax, eax
je 0x41a419
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExW]
lea ecx, [esp + 0xc]
push ecx
push 0
lea edx, [esp + 0x18]
push edx
push 0
lea ecx, [esp + 0x24]
push ecx
push eax
call edi
test eax, eax
jne 0x41a40e
cmp dword [esp + 0x10], 3
jne 0x41a40e
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41a419
push eax
call fcn.00431c1f
add esp, 4
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
mov esi, eax
push esi
lea eax, [esp + 0x18]
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
push edx
call edi
test eax, eax
jne 0x41a405
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
mov dword [ebx], ecx
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00431784
add esp, 0x1010
ret
push esi
call fcn.00431ac8
add esp, 4
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00431784
add esp, 0x1010
ret
Function at 0x41a440
Capabilities:
Set registry value

Disassembly:
mov eax, 0x1008
call fcn.0044f150
mov eax, dword [0x4890a0]
xor eax, esp
mov dword [esp + 0x1004], eax
push 0x4ad300
push 0x48351c
lea eax, [esp + 0xc]
push 0x481724
push eax
mov edx, 0x400
call fcn.00419e80
push esi
lea ecx, [esp + 0x818]
push 0x400
push ecx
call fcn.004329ff
add esp, 0x1c
lea edx, [esp]
push edx
lea eax, [esp + 8]
push eax
push 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
mov eax, dword [esp]
test eax, eax
je 0x41a4c7
push 0x20
push edi
push 3
push 0
lea ecx, [esp + 0x814]
push ecx
push eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov edx, dword [esp]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.00431784
add esp, 0x1008
ret

Function at 0x41bbe0
Capabilities:
Write clipboard data

Disassembly:
call dword [sym.imp.user32.dll_EmptyClipboard]
mov eax, ebx
lea edx, [eax + 1]
jmp 0x41bbf0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41bbf0
push esi
push edi
sub eax, edx
lea edi, [eax + 1]
push edi
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x41bc3a
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
push edi
push ebx
push eax
call fcn.00433c20
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.user32.dll_SetClipboardData]
pop edi
pop esi
jmp dword [sym.imp.user32.dll_CloseClipboard]
pop edi
pop esi
ret