joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404608
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.0040eef0
push dword [ebp + 0x14]
lea eax, [ebp - 0x104]
push dword [ebp + 0x10]
push esi
push eax
call fcn.0040431e
add esp, 0x1c
test eax, eax
je 0x4046d6
cmp byte [ebp - 0x104], 0
je 0x4046d6
lea eax, [ebp - 0x104]
push eax
push esi
lea eax, [ebp - 0x30c]
push eax
push 0x41a32c
push str.BmpDll
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4046d6
cmp eax, 0x102
je 0x4046d6
push dword [ebp + 0x14]
lea eax, [ebp - 0x208]
push dword [ebp + 0x10]
push esi
push eax
call fcn.004040fb
add esp, 0x10
test eax, eax
jne 0x4046ae
push 0x41a474
push esi
lea eax, [ebp - 0x208]
push eax
call fcn.004010dd
test eax, eax
jne 0x4046d6
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x208]
push eax
push 0x41a414
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00403f12
add esp, 0x14
neg eax
sbb eax, eax
inc eax
jmp 0x4046d8
xor eax, eax
pop esi
leave
ret

Function at 0x40518e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
lea eax, [ebp - 0x104]
push eax
mov esi, 0x104
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4051cc
push 0x41a318
push esi
lea eax, [edi + 0x310]
push eax
call fcn.004010dd
test eax, eax
je 0x4051d5
xor eax, eax
jmp 0x40522f
lea eax, [ebp - 0x104]
push eax
jmp 0x4051b7
lea eax, [ebp - 0x208]
push eax
push 0
push 0x41a314
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405208
push 0x41a32c
push esi
add edi, 0xd54
push edi
call fcn.004010dd
jmp 0x4051c8
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x208]
push eax
push esi
add edi, 0xd54
push edi
call fcn.004010dd
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x405450
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
push esi
mov esi, ecx
lea eax, [esi + 0xc50]
cmp byte [eax], 0
jne 0x40546e
xor eax, eax
jmp 0x4055c5
push ebx
push edi
push 0x41a684
push eax
call fcn.0040f7e4
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 8], eax
mov edi, 0x104
jne 0x4054ec
lea eax, [ebp - 0x160]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
lea ebx, [esi + 0x310]
jne 0x405511
push 0x41a318
push edi
push ebx
call fcn.004010dd
test eax, eax
jne 0x40550a
lea eax, [esi + 0xc50]
push eax
push ebx
push 0x41a414
lea eax, [ebp - 0x160]
push edi
push eax
call fcn.00403f12
add esp, 0x14
test eax, eax
jne 0x40550a
lea eax, [ebp - 0x160]
push 0x41a684
push eax
call fcn.0040f7e4
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 8], eax
je 0x40550a
mov ebx, 0x514
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x40551a
push dword [ebp - 8]
call fcn.0040f6d9
pop ecx
xor eax, eax
jmp 0x4055c3
lea eax, [ebp - 0x160]
push eax
jmp 0x4054a6
and dword [ebp - 0xc], 0
push dword [ebp - 8]
push ebx
push dword [ebp - 4]
call fcn.0040fe8e
add esp, 0xc
test eax, eax
jne 0x405541
mov eax, dword [ebp - 8]
test byte [eax + 0xc], 0x10
je 0x4055ac
mov dword [ebp - 0xc], 1
push 0x50
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.0040eef0
add esp, 0xc
push ebx
push dword [ebp - 4]
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 4]
mov ecx, esi
call fcn.00404eb9
push dword [ebp - 4]
lea eax, [ebp - 0x5c]
push eax
mov ecx, esi
call fcn.00405233
lea eax, [ebp - 0x5c]
push eax
push 0x41a680
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4055a2
push dword [ebp - 4]
lea eax, [esi + 0xd54]
push edi
push eax
mov dword [esi + 0x1684], 1
call fcn.004010dd
test eax, eax
jne 0x4055c8
cmp dword [ebp - 0xc], 0
je 0x40551e
xor esi, esi
inc esi
push dword [ebp - 8]
call fcn.0040f6d9
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop edi
pop ebx
pop esi
leave
ret
xor esi, esi
jmp 0x4055af
Function at 0x4055cc
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x1b0
push esi
mov esi, ecx
lea eax, [esi + 0xc50]
cmp byte [eax], 0
jne 0x4055ec
xor eax, eax
jmp 0x405748
push ebx
push edi
push 0x41a68c
push eax
call fcn.0040f7e4
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x70], eax
mov edi, 0x104
jne 0x40566a
lea eax, [ebp - 0x138]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
lea ebx, [esi + 0x310]
jne 0x40568e
push 0x41a318
push edi
push ebx
call fcn.004010dd
test eax, eax
jne 0x405687
lea eax, [esi + 0xc50]
push eax
push ebx
push 0x41a414
lea eax, [ebp - 0x138]
push edi
push eax
call fcn.00403f12
add esp, 0x14
test eax, eax
jne 0x405687
lea eax, [ebp - 0x138]
push 0x41a68c
push eax
call fcn.0040f7e4
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x70], eax
je 0x405687
push 0xa28
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp + 0x74], eax
jne 0x405697
push dword [ebp + 0x70]
call fcn.0040f6d9
pop ecx
xor eax, eax
jmp 0x405746
lea eax, [ebp - 0x138]
push eax
jmp 0x405624
and dword [ebp + 0x6c], 0
mov ebx, 0x514
push dword [ebp + 0x70]
push ebx
push dword [ebp + 0x74]
call fcn.0040ff14
add esp, 0xc
test eax, eax
jne 0x4056c3
mov eax, dword [ebp + 0x70]
test byte [eax + 0xc], 0x10
je 0x405731
mov dword [ebp + 0x6c], 1
push 0xa0
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.0040eef0
add esp, 0xc
push ebx
push dword [ebp + 0x74]
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x74]
mov ecx, esi
call fcn.00404f76
push dword [ebp + 0x74]
lea eax, [ebp - 0x34]
push eax
mov ecx, esi
call fcn.00404a5f
lea eax, [ebp - 0x34]
push eax
push 0x41a688
call fcn.0040f855
test eax, eax
pop ecx
pop ecx
jne 0x405727
push edi
push dword [ebp + 0x74]
lea eax, [esi + 0xd54]
push eax
mov dword [esi + 0x1684], 1
call fcn.00407685
add esp, 0xc
cmp dword [ebp + 0x6c], 0
je 0x4056a0
push dword [ebp + 0x70]
call fcn.0040f6d9
pop ecx
push dword [ebp + 0x74]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
inc eax
pop edi
pop ebx
pop esi
add ebp, 0x78
leave
ret
Function at 0x405d02
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
push ebx
push esi
push edi
mov ebx, ecx
lea edi, [ebx + 0x310]
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x405d5f
lea eax, [ebp - 0x398]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x405d49
push 0x41a318
push esi
push edi
call fcn.004010dd
jmp 0x405d57
lea eax, [ebp - 0x398]
push eax
push esi
push edi
call fcn.0040235b
test eax, eax
jne 0x405dfb
lea eax, [ebx + 0xc50]
push eax
push edi
mov edi, 0x41a414
push edi
mov esi, 0x208
lea eax, [ebp - 0x294]
push esi
push eax
call fcn.00403f12
add esp, 0x14
test eax, eax
jne 0x405db1
push 0x4000
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x405db1
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add ebx, 0xe58
push ebx
push dword [ebp - 4]
lea eax, [ebp - 0x294]
push edi
push esi
push eax
call fcn.00403f12
add esp, 0x14
test eax, eax
jne 0x405dfb
push 0x4000
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x405dfb
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406858
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 0xc], str.SoftwareEPSONSTM3STMDataEPNTarget
jne 0x406877
mov dword [ebp - 0xc], str.SoftwareEPSONSTM3STMDataEPLTarget
lea eax, [ebp + 0xc]
push eax
push 0x20019
push esi
push dword [ebp - 0xc]
mov dword [ebp + 0xc], esi
push 0x80000001
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4068a1
push 4
pop eax
jmp 0x406982
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push edi
lea eax, [ebp - 0x20]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x124]
push eax
mov dword [ebp - 0x10], esi
mov edi, 0x104
push esi
jmp 0x406952
cmp dword [ebp - 8], 0x103
je 0x406972
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x124]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40693a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push 0x41a77c
push dword [ebp - 4]
mov dword [ebp - 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], esi
mov dword [ebp - 4], esi
jne 0x40693a
push dword [ebp + 8]
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x406985
inc dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x10]
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
call ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x4068c9
xor esi, esi
inc esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
leave
ret
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0xc]
push str._s_s
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00403f12
add esp, 0x14
mov esi, eax
neg esi
sbb esi, esi
neg esi
jmp 0x406975
Function at 0x4069ac
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 0xc], str.SoftwareEPSONSTM3STMDataEPNTarget
jne 0x4069cb
mov dword [ebp - 0xc], str.SoftwareEPSONSTM3STMDataEPLTarget
lea eax, [ebp + 0xc]
push eax
push 0x20019
push esi
push dword [ebp - 0xc]
mov dword [ebp + 0xc], esi
push 0x80000001
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4069f5
push 4
pop eax
jmp 0x406ae8
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [ebp - 0x20]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x124]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], 0x104
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x406ac4
cmp dword [ebp - 8], 0x103
je 0x406ad8
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x124]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406aa0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x32c]
push eax
push esi
push esi
push str.Name
push dword [ebp - 4]
mov dword [ebp - 0x18], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], esi
mov dword [ebp - 4], esi
jne 0x406aa0
push dword [ebp + 8]
lea eax, [ebp - 0x32c]
push eax
call fcn.0040f855
test eax, eax
pop ecx
pop ecx
je 0x406aeb
inc dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x104
push dword [ebp + 0xc]
call edi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x124]
push eax
call ebx
test eax, eax
jne 0x406a2a
xor esi, esi
inc esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
leave
ret
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0xc]
push str._s_s
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00403f12
add esp, 0x14
mov esi, eax
neg esi
sbb esi, esi
neg esi
jmp 0x406adb
Function at 0x406b12
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov dword [ebp - 0x10], str.SoftwareEPSONSTM3STMDataEPNTarget
jne 0x406b33
mov dword [ebp - 0x10], str.SoftwareEPSONSTM3STMDataEPLTarget
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push 0xf003f
push ebx
lea eax, [ebp + 0xf]
push eax
push ebx
push dword [ebp - 0x10]
mov esi, 0x80000001
push esi
mov byte [ebp + 0xf], bl
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
call edi
test eax, eax
je 0x406b77
push 4
pop eax
jmp 0x406cd5
mov dword [ebp - 4], ebx
push dword [ebp - 4]
lea eax, [ebp - 0x11c]
push dword [ebp - 0x10]
push str._sP_016d
push 0x104
push eax
call fcn.00403f12
add esp, 0x14
test eax, eax
jne 0x406be3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xf003f
push ebx
lea eax, [ebp + 0xf]
push eax
push ebx
lea eax, [ebp - 0x11c]
push eax
push esi
call edi
test eax, eax
jne 0x406cc2
cmp dword [ebp - 0x14], 1
je 0x406bef
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x7fffffff
jl 0x406b7a
jmp 0x406cc9
mov dword [ebp - 0xc], 6
jmp 0x406cc9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
push dword [ebp + 8]
push 1
push ebx
push 0x41a77c
push dword [ebp - 8]
call esi
test eax, eax
je 0x406c29
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], 2
jmp 0x406cc9
cmp dword [ebp + 0x14], 0x7fffffff
ja 0x406c48
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004010dd
cmp eax, ebx
je 0x406c5a
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], 5
jmp 0x406cc9
push 4
pop eax
push eax
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
mov edi, str.Setting
push edi
push dword [ebp - 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], eax
call esi
push dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push 4
push ebx
push str.Timer
push dword [ebp - 8]
mov dword [ebp - 4], 0xa
call esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push edi
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406cb0
cmp dword [ebp - 4], ebx
je 0x406cb7
mov dword [ebp - 0xc], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406cc9
mov dword [ebp - 0xc], 3
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406cda
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov dword [ebp - 0x10], str.SoftwareEPSONSTM3STMDataEPNTarget
jne 0x406cfb
mov dword [ebp - 0x10], str.SoftwareEPSONSTM3STMDataEPLTarget
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push 0xf003f
push ebx
lea eax, [ebp + 0xf]
push eax
push ebx
push dword [ebp - 0x10]
mov esi, 0x80000001
push esi
mov byte [ebp + 0xf], bl
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
call edi
test eax, eax
je 0x406d3f
push 4
pop eax
jmp 0x406ea4
mov dword [ebp - 4], ebx
push dword [ebp - 4]
lea eax, [ebp - 0x11c]
push dword [ebp - 0x10]
push str._sP_016d
push 0x104
push eax
call fcn.00403f12
add esp, 0x14
test eax, eax
jne 0x406dab
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xf003f
push ebx
lea eax, [ebp + 0xf]
push eax
push ebx
lea eax, [ebp - 0x11c]
push eax
push esi
call edi
test eax, eax
jne 0x406e91
cmp dword [ebp - 0x14], 1
je 0x406db7
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x7fffffff
jl 0x406d42
jmp 0x406e98
mov dword [ebp - 0xc], 6
jmp 0x406e98
push dword [ebp + 8]
call fcn.0040ef55
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 1
push ebx
push str.Name
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x406df2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], 2
jmp 0x406e98
cmp dword [ebp + 0x14], 0x7fffffff
ja 0x406e11
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004010dd
cmp eax, ebx
je 0x406e23
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], 5
jmp 0x406e98
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
pop eax
push eax
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
mov edi, str.Setting
push edi
push dword [ebp - 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], eax
call esi
push dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push 4
push ebx
push str.Timer
push dword [ebp - 8]
mov dword [ebp - 4], 0xa
call esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push edi
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406e7f
cmp dword [ebp - 4], ebx
je 0x406e86
mov dword [ebp - 0xc], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406e98
mov dword [ebp - 0xc], 3
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406ea9
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
push esi
lea eax, [ebp - 4]
push eax
push 0xf003f
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x406edc
or eax, 0xffffffff
jmp 0x406fd0
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, 0x104
jmp 0x406f30
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x406f4f
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x324]
push str._s_s
push ebx
push eax
call fcn.00403f12
add esp, 0x14
test eax, eax
jne 0x406f67
lea eax, [ebp - 0x324]
push eax
call fcn.00406ea9
test eax, eax
pop ecx
jne 0x406f67
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
call edi
test eax, eax
je 0x406eeb
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 8], esi
push esi
jmp 0x406fa9
or esi, 0xffffffff
jmp 0x406fc3
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x406fb5
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x406f94
inc dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
call edi
test eax, eax
je 0x406f6c
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
leave
ret

Function at 0x406fd3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x406ffe
or eax, 0xffffffff
leave
ret
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.Setting
push dword [ebp - 4]
mov dword [ebp - 8], 0xff
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 8]
call fcn.00406ea9
pop ecx
xor eax, eax
leave
ret
Function at 0x407ceb
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x41932f
call fcn.0040f528
mov eax, dword [0x41f060]
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov esi, ecx
mov dword [esi], eax
je 0x407d55
mov eax, edi
shr eax, 0x10
test ax, ax
jne 0x407d55
movzx edi, di
push 0
push edi
call fcn.00407c06
test eax, eax
jne 0x407d77
mov eax, dword [0x41f060]
mov dword [ebp + 8], eax
and dword [ebp - 4], 0
push edi
lea eax, [ebp + 8]
push 0x41a82c
push eax
call fcn.00407bf3
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00407659
jmp 0x407d77
push ebx
push edi
call fcn.00407625
mov ebx, eax
test ebx, ebx
je 0x407d76
push ebx
mov ecx, esi
call fcn.004076fb
push ebx
push edi
push dword [esi]
call fcn.0040fa90
add esp, 0xc
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x408676
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x419356
call fcn.0040f528
mov eax, dword [0x41f078]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
mov esi, ecx
push edi
mov dword [esi], eax
je 0x4086e1
mov eax, ebx
shr eax, 0x10
test ax, ax
jne 0x4086e1
movzx edi, bx
push 0
push edi
call fcn.0040858e
test eax, eax
jne 0x408704
mov eax, dword [0x41f078]
mov dword [ebp + 8], eax
and dword [ebp - 4], 0
push edi
lea eax, [ebp + 8]
push str.Warning:_implicit_LoadString__u__failed_n
push eax
call fcn.0040857b
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00408017
jmp 0x408704
push ebx
call fcn.00407fe3
mov edi, eax
test edi, edi
je 0x408704
push edi
mov ecx, esi
call fcn.0040806f
lea eax, [edi + edi]
push eax
push ebx
push dword [esi]
call fcn.0040fa90
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4