joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a7b0
Capabilities:
Query service configuration

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push ebx
push esi
push edi
push 1
push eax
push ecx
mov dword [esp + 0x18], 0
call dword [0x45a034]
mov edi, dword [0x45a030]
lea edx, [esp + 0xc]
push edx
mov esi, eax
push 0
push 0
push esi
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x40a825
call dword [0x45a464]
cmp eax, 0x7a
jne 0x40a825
mov eax, dword [esp + 0xc]
push eax
call fcn.004428c1
mov edx, dword [esp + 0x10]
add esp, 4
lea ecx, [esp + 0xc]
mov ebx, eax
push ecx
push edx
push ebx
push esi
mov dword [esp + 0x20], ebx
call edi
test eax, eax
jne 0x40a836
push ebx
call fcn.004428ea
add esp, 4
push esi
call dword [0x45a02c]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 8
ret
mov edi, dword [ebx + 0xc]
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x1c], edi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 0xfffffffd
jbe 0x40a853
call fcn.0042b8d4
push ebp
mov ebp, dword [esp + 0x24]
xor edx, edx
mov ecx, dword [ebp + 4]
cmp ecx, edx
je 0x40a880
mov al, byte [ecx - 1]
test al, al
je 0x40a880
cmp al, 0xff
je 0x40a880
cmp ebx, edx
jne 0x40a8a4
dec al
mov byte [ecx - 1], al
mov dword [ebp + 4], edx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], edx
jmp 0x40a8d1
cmp ebx, edx
jne 0x40a88f
push 1
mov ecx, ebp
call fcn.00404380
jmp 0x40a8d1
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
ja 0x40a89b
cmp eax, ebx
jae 0x40a8ac
push 1
mov ecx, ebp
call fcn.00404380
push ebx
mov ecx, ebp
call fcn.00404ad0
mov esi, dword [esp + 0x20]
mov edi, dword [ebp + 4]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 4]
mov esi, dword [esp + 0x1c]
mov dword [ebp + 8], ebx
mov byte [ecx + ebx], 0
mov edx, dword [esp + 0x14]
push edx
call fcn.004428ea
add esp, 4
push esi
call dword [0x45a02c]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x40ecd0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x228
mov ecx, 0xf
xor eax, eax
push ebx
push edi
mov edi, 0x472298
rep stosd dword es:[edi], eax
call fcn.0040ee90
test eax, eax
mov dword [0x472298], eax
jne 0x40ed00
pop edi
or eax, 0xffffffff
pop ebx
add esp, 0x228
ret
call fcn.0040ef80
test eax, eax
mov dword [0x4722b0], eax
jne 0x40ed1f
call fcn.0040f070
pop edi
or eax, 0xffffffff
pop ebx
add esp, 0x228
ret
lea eax, [esp + 0x14]
push 1
push eax
call dword [0x45a010]
test eax, eax
je 0x40ed5d
push 0
push 0
lea ecx, [esp + 0x1c]
push 1
push ecx
call dword [0x45a04c]
test eax, eax
je 0x40ed5d
lea edx, [esp + 0x14]
mov dword [esp + 8], 0xc
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 1
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x12c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x12c]
push eax
push 0x104
call dword [0x45a44c]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x28]
push str.eb_errs.log
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x130]
lea edx, [esp + 0x2c]
push ecx
push 0x46c558
push edx
call fcn.0041f36f
add esp, 0x10
lea eax, [esp + 0x28]
push eax
call dword [0x45a4b0]
push 0
push 0
lea ecx, [esp + 0x10]
push 4
push ecx
push 3
lea edx, [esp + 0x3c]
push 0xc0000000
test eax, eax
push edx
setne bl
call dword [0x45a450]
cmp eax, 0xffffffff
mov dword [0x47229c], eax
jne 0x40edf4
call fcn.0040f070
pop edi
or eax, 0xffffffff
pop ebx
add esp, 0x228
ret
push 0
push 0x23000
push 0
lea ecx, [esp + 0x14]
push 4
push ecx
push eax
call dword [0x45a460]
test eax, eax
mov dword [0x4722a0], eax
jne 0x40ee25
call fcn.0040f070
pop edi
or eax, 0xffffffff
pop ebx
add esp, 0x228
ret
push 0
push 0
push 0
push 0xf001f
push eax
call dword [0x45a468]
mov edi, eax
test edi, edi
mov dword [0x4722a4], edi
jne 0x40ee54
call fcn.0040f070
pop edi
or eax, 0xffffffff
pop ebx
add esp, 0x228
ret
test bl, bl
jne 0x40ee67
mov ecx, 0x8c00
xor eax, eax
rep stosd dword es:[edi], eax
mov edi, dword [0x4722a4]
lea edx, [edi + 0x23000]
mov dword [0x4722ac], edi
pop edi
mov dword [0x4722a8], edx
xor eax, eax
pop ebx
add esp, 0x228
ret
Function at 0x4101a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x24
mov eax, edx
push ebx
push esi
sub eax, 0x80
push edi
mov ebx, 6
je 0x4101cd
sub eax, 0x40
je 0x4101c7
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret
mov dword [esp + 0x38], ebx
jmp 0x4101d5
mov dword [esp + 0x38], 4
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
mov ecx, 8
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
cmp edx, eax
mov ecx, edx
jge 0x4101f0
mov ecx, eax
sub ecx, 0x80
je 0x410211
sub ecx, 0x40
je 0x410207
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret
mov dword [esp + 0xc], 0xc
jmp 0x410219
mov dword [esp + 0xc], 0xa
sub eax, 0x80
je 0x41022f
sub eax, 0x40
je 0x410234
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret
mov ebx, 4
mov eax, dword [esp + 0x38]
xor esi, esi
test eax, eax
mov dword [esp + 0x3c], ebx
push ebp
jle 0x410289
mov eax, dword [esp + 0x10]
lea ebp, [eax + 1]
imul ebp, ebx
cmp esi, ebp
jge 0x410289
mov eax, esi
mov ecx, dword [esp + 0x38]
cdq
idiv ebx
add ecx, esi
mov edi, eax
mov eax, esi
cdq
idiv ebx
mov eax, dword [esp + 0x44]
shl edi, 5
add eax, edi
mov edi, 4
add edx, eax
mov al, byte [ecx]
add ecx, 8
mov byte [edx], al
add edx, 8
dec edi
jne 0x410273
mov eax, dword [esp + 0x3c]
inc esi
cmp esi, eax
jl 0x41024d
mov ecx, dword [esp + 0x10]
lea eax, [ecx + 1]
imul eax, ebx
cmp esi, eax
mov dword [esp + 0x10], eax
jge 0x410377
mov dword [esp + 0x38], 0x46c9fc
xor eax, eax
lea ecx, [esp + 0x14]
inc eax
mov edx, eax
and edx, 0x80000003
jns 0x4102bd
dec edx
or edx, 0xfffffffc
inc edx
mov edi, dword [esp + 0x3c]
add ecx, 8
lea edi, [edi + edx*8]
xor edx, edx
mov dl, byte [esp + edi + 0x13]
mov dl, byte [edx + 0x46c8fc]
not dl
xor byte [ecx - 8], dl
cmp eax, 4
jl 0x4102ad
mov edi, dword [esp + 0x38]
mov dl, byte [esp + 0x14]
mov al, byte [edi]
add edi, 4
sub al, 5
mov dword [esp + 0x38], edi
xor dl, al
mov eax, dword [esp + 0x3c]
mov edi, 1
mov byte [esp + 0x14], dl
cmp eax, edi
jle 0x410320
lea eax, [esp + edi + 0x14]
mov ecx, 4
mov dl, byte [eax - 1]
xor byte [eax], dl
add eax, 8
dec ecx
jne 0x41030c
mov eax, dword [esp + 0x3c]
inc edi
cmp edi, eax
jl 0x410303
mov eax, dword [esp + 0x3c]
xor ebp, ebp
test eax, eax
jle 0x41036d
cmp esi, dword [esp + 0x10]
jge 0x410377
mov eax, esi
lea ecx, [esp + ebp + 0x14]
cdq
idiv ebx
mov edi, eax
mov eax, esi
cdq
idiv dword [esp + 0x40]
mov eax, dword [esp + 0x44]
shl edi, 5
add eax, edi
mov edi, 4
add edx, eax
mov al, byte [ecx]
add ecx, 8
mov byte [edx], al
add edx, 8
dec edi
jne 0x410352
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
inc ebp
inc esi
cmp ebp, eax
jl 0x41032a
cmp esi, dword [esp + 0x10]
jl 0x4102a7
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret
Function at 0x410470
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
and edi, 0xff
mov ebp, edx
mov dword [esp + 0x1c], 4
test edi, edi
jle 0x4104a3
mov ecx, dword [esp + 0x18]
mov eax, ebp
sub ecx, edx
mov esi, edi
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec esi
jne 0x41049a
mov eax, dword [esp + 0x1c]
add ebp, 8
dec eax
mov dword [esp + 0x1c], eax
jne 0x41048c
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x410680
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
mov edi, dword [esp + 0x38]
test edi, edi
je 0x410886
mov ebx, dword [esp + 0x3c]
test ebx, ebx
je 0x410886
mov al, byte [ebx]
test al, al
je 0x410886
mov ecx, dword [edi + 0x1c]
mov edx, dword [ebx + 0x4c]
cmp ecx, edx
jne 0x410886
cmp al, 1
jne 0x41087a
mov esi, dword [ebx + 4]
cmp esi, 0x80
mov dword [esp + 0x10], esi
je 0x4106d9
cmp esi, 0xc0
jne 0x41087a
cmp ecx, 0x80
je 0x4106ed
cmp ecx, 0xc0
jne 0x410886
mov eax, dword [esp + 0x44]
push ebp
cdq
idiv ecx
xor ebp, ebp
mov dword [esp + 0x10], eax
mov eax, ecx
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
test eax, eax
jle 0x410732
mov esi, dword [esp + 0x44]
xor ecx, ecx
lea edx, [esp + ebp + 0x18]
mov bl, byte [esi + ecx]
inc ecx
mov byte [edx], bl
add edx, 8
cmp ecx, 4
jl 0x410714
inc ebp
add esi, 4
cmp ebp, eax
jl 0x41070e
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x40]
mov eax, dword [edi + 0x1c]
add ebx, 0x50
push ebx
push eax
lea eax, [esp + 0x20]
push esi
push eax
call fcn.00410390
mov eax, dword [edi + 0x1c]
add esp, 0x10
cdq
and edx, 0x1f
xor ebx, ebx
add eax, edx
sar eax, 5
test eax, eax
jle 0x410790
mov ebp, dword [esp + 0x4c]
lea esi, [edi + 1]
xor eax, eax
lea ecx, [esp + ebx + 0x18]
mov dl, byte [esi + eax]
xor dl, byte [ecx]
inc eax
add ecx, 8
cmp eax, 4
mov byte [eax + ebp - 1], dl
jl 0x410767
mov eax, dword [edi + 0x1c]
inc ebx
cdq
and edx, 0x1f
add esi, 4
add eax, edx
add ebp, 4
sar eax, 5
cmp ebx, eax
jl 0x410761
mov esi, dword [esp + 0x10]
mov dword [esp + 0x48], 1
cmp esi, 1
jle 0x41086c
mov eax, dword [edi + 0x1c]
xor ecx, ecx
cdq
and edx, 0x1f
mov dword [esp + 0x40], ecx
add eax, edx
sar eax, 5
test eax, eax
jle 0x41085b
xor esi, esi
lea ebp, [ecx*4]
lea ebx, [esp + ecx + 0x18]
jmp 0x4107e5
mov ecx, dword [esp + 0x40]
xor esi, esi
lea ebp, [ecx*4]
lea ebx, [esp + ecx + 0x18]
jmp 0x4107e5
mov edi, dword [esp + 0x3c]
mov edi, dword [edi + 0x1c]
add ebx, 8
mov eax, edi
cdq
and edx, 7
add eax, edx
mov ecx, eax
lea eax, [edi*4]
sar ecx, 3
imul ecx, dword [esp + 0x48]
cdq
and edx, 0x1f
add eax, edx
mov edx, ecx
sar eax, 5
sub edx, eax
mov eax, dword [esp + 0x44]
add edx, ebp
add ecx, ebp
add edx, esi
add ecx, esi
mov dl, byte [edx + eax]
mov al, byte [ebx - 8]
xor dl, al
mov eax, dword [esp + 0x4c]
inc esi
cmp esi, 4
mov byte [ecx + eax], dl
jl 0x4107e1
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
inc ecx
mov eax, dword [edx + 0x1c]
mov dword [esp + 0x40], ecx
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
cmp ecx, eax
jl 0x4107ce
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x48]
inc eax
cmp eax, esi
mov dword [esp + 0x48], eax
jl 0x4107a5
mov eax, dword [edi + 0x1c]
pop ebp
imul eax, esi
pop edi
pop esi
pop ebx
add esp, 0x28
ret
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x28
ret
pop edi
pop esi
mov eax, 0xfffffffb
pop ebx
add esp, 0x28
ret
Function at 0x410c70
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x4124f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x457b57
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov byte [esi], al
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov cl, byte [esp + 7]
mov dword [esp + 0x14], eax
mov byte [esi + 0x14], cl
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dl, byte [esp + 7]
mov byte [esi + 0x44], dl
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov cl, byte [esp + 7]
mov byte [esi + 0x74], cl
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov dl, byte [esp + 7]
mov byte [esi + 0xa4], dl
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
mov dword [esi + 0xd0], eax
mov dl, byte [esp + 7]
lea ecx, [esi + 0xd4]
mov byte [esp + 0x14], 4
mov byte [ecx], dl
mov dl, byte [esp + 7]
mov byte [ecx + 1], dl
mov byte [ecx + 8], al
call fcn.004161c0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x412f90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x108
push ebx
mov ebx, dword [esp + 0x114]
push esi
mov edx, dword [esp + 0x114]
push edi
mov edi, ecx
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
xor esi, esi
push eax
push ecx
push esi
push esi
push ebx
push edx
mov dword [esp + 0x24], 0x104
mov byte [esp + 0x28], 0
call dword [0x45a014]
test eax, eax
je 0x412fd3
or esi, 0xffffffff
mov al, byte [esp + 0x10]
test al, al
je 0x412fe2
lea eax, [esp + 0x10]
push eax
jmp 0x412fea
mov ecx, dword [esp + 0x120]
push ecx
push ebx
mov ecx, edi
call fcn.00414fe0
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x108
ret 0xc

Function at 0x413000
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call fcn.00415190
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x1c]
push esi
push eax
call dword [0x45a028]
neg eax
pop edi
pop esi
sbb eax, eax
ret 8
Function at 0x4135e0
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push esi
push edi
test eax, eax
mov esi, ecx
je 0x4136ee
mov edi, dword [0x45a01c]
lea eax, [esp + 0x14]
push eax
push 0x20006
push 0
push str.SOFTWAREPermeoe_BorderDriver
push 0x80000002
call edi
mov ebx, dword [0x45a018]
test eax, eax
jne 0x4136ad
mov ecx, dword [esp + 0x14]
push str.License_Key
push ecx
mov ecx, esi
call fcn.00413000
mov edx, dword [esp + 0x14]
push str.Company_Key
push edx
mov ecx, esi
call fcn.00413000
mov eax, dword [esp + 0x14]
push str.Installation_Directory
push eax
mov ecx, esi
call fcn.00413000
mov ecx, dword [esp + 0x14]
push str.Shared
push ecx
mov ecx, esi
call fcn.00413000
mov edx, dword [esp + 0x14]
push str.Allow_save_cred
push edx
mov ecx, esi
call fcn.00413000
mov eax, dword [esp + 0x14]
push str.Allow_Disable
push eax
mov ecx, esi
call fcn.00413000
mov ecx, dword [esp + 0x14]
push str.Shared_Client_Conf
push ecx
mov ecx, esi
call fcn.00413000
mov edx, dword [esp + 0x14]
push str.Server
push edx
mov ecx, esi
call fcn.00413000
mov eax, dword [esp + 0x14]
push eax
call ebx
lea ecx, [esp + 0xc]
push ecx
push 0x20006
push 0
push str.SOFTWAREPermeoe_BorderDriver
push 0x80000001
call edi
test eax, eax
jne 0x4137e5
mov edx, dword [esp + 0xc]
push str.Enable_Log_to_File
push edx
mov ecx, esi
call fcn.00413000
mov eax, dword [esp + 0xc]
push eax
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
mov edi, dword [0x45a01c]
lea ecx, [esp + 0xc]
push ecx
push 0x20006
push 0
push str.SOFTWAREPermeoe_BorderDriver
push 0x80000001
call edi
mov ebx, dword [0x45a018]
test eax, eax
jne 0x413772
mov edx, dword [esp + 0xc]
push str.Client_Configuration
push edx
mov ecx, esi
call fcn.00413000
mov eax, dword [esp + 0xc]
push str.Show_icon
push eax
mov ecx, esi
call fcn.00413000
mov ecx, dword [esp + 0xc]
push str.User_Client_Conf
push ecx
mov ecx, esi
call fcn.00413000
mov edx, dword [esp + 0xc]
push str.Credential_method
push edx
mov ecx, esi
call fcn.00413000
mov eax, dword [esp + 0xc]
push str.Enable_Log_to_File
push eax
mov ecx, esi
call fcn.00413000
mov ecx, dword [esp + 0xc]
push ecx
call ebx
lea edx, [esp + 0x14]
push edx
push 0x20006
push 0
push str.SOFTWAREPermeoe_BorderDriver
push 0x80000002
call edi
test eax, eax
jne 0x4137e5
mov eax, dword [esp + 0x14]
push str.License_Key
push eax
mov ecx, esi
call fcn.00413000
mov ecx, dword [esp + 0x14]
push str.Company_Key
push ecx
mov ecx, esi
call fcn.00413000
push str.Client_Configuration
mov ecx, esi
call fcn.00415190
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x1c]
push 1
push eax
push str.Nbproxy_enabled
push edx
call dword [0x45a028]
mov eax, dword [esp + 0x14]
push eax
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x417040
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x457efb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], ebx
lea edi, [esi + 4]
mov dword [esp + 0x2c], ebx
mov dword [edi], method.CCommandLineInfo.virtual_0
mov dword [edi + 4], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 8], ebx
push 1
lea ecx, [esi + 0x20]
push 0x2d
mov byte [esp + 0x34], 1
mov byte [esi + 0x18], bl
mov dword [esi + 0x1c], 3
call fcn.0043cda4
push 1
lea ecx, [esi + 0x24]
push 0x2d
mov byte [esp + 0x34], 2
call fcn.0043cda4
push 1
push 0x2d
lea ecx, [esi + 0x28]
mov byte [esp + 0x34], 3
call fcn.0043cda4
lea ecx, [esi + 0x2c]
mov byte [esp + 0x2c], 4
call fcn.00441241
push 8
mov byte [esp + 0x30], 5
mov dword [esi], method.CCommandLineInfo.virtual_0
call fcn.004428c1
mov ebp, eax
add esp, 4
mov dword [esp + 0x20], ebp
cmp ebp, ebx
mov byte [esp + 0x2c], 6
je 0x41715a
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x18]
push eax
call fcn.004477ca
mov dword [esp + 0x10], 1
mov ecx, dword [esp + 0x34]
mov byte [esp + 0x2c], 7
push ecx
lea ecx, [esp + 0x18]
call fcn.004477ca
mov ebx, 3
mov dword [esp + 0x10], ebx
mov edx, dword [0x46d088]
mov dword [ebp], edx
mov eax, dword [0x46d088]
mov dword [esp + 0x2c], 9
mov dword [ebp + 4], eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 0xa
push ecx
mov ecx, ebp
call fcn.00447895
lea edx, [esp + 0x18]
lea ecx, [ebp + 4]
push edx
call fcn.00447895
jmp 0x41715c
xor ebp, ebp
test bl, 2
mov dword [esp + 0x2c], 0xb
je 0x417179
and ebx, 0xfffffffd
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], ebx
call fcn.0044775c
test bl, 1
mov dword [esp + 0x2c], 5
je 0x41718f
lea ecx, [esp + 0x18]
call fcn.0044775c
mov ebx, dword [edi + 8]
push 0xffffffffffffffff
mov ecx, edi
lea eax, [ebx + 1]
push eax
call fcn.00417e80
mov ecx, dword [edi + 4]
mov eax, dword [esp + 0x40]
xor edx, edx
push eax
mov dword [ecx + ebx*4], ebp
mov ebp, dword [esp + 0x40]
cmp ebp, 5
lea ecx, [esi + 0x20]
sete dl
add edx, 2
mov dword [esi + 0x1c], edx
call fcn.004478e5
mov ecx, dword [esp + 0x44]
push ecx
lea ecx, [esi + 0x24]
call fcn.004478e5
mov edx, dword [esi + 0x34]
lea ecx, [esi + 0x2c]
push 0x46c3a0
push edx
call fcn.004414ea
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0x14
Function at 0x41abe0
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x41abee
pop esi
ret 8
mov ecx, dword [esp + 8]
lea edx, [esp + 8]
push edx
lea edx, [esp + 0x10]
mov ecx, dword [ecx]
push 0
push edx
push 0
push ecx
push eax
call dword [0x45a014]
test eax, eax
je 0x41ac18
mov dword [esi + 0xc], eax
or eax, 0xffffffff
pop esi
ret 8
mov eax, dword [esp + 8]
pop esi
ret 8

Function at 0x41acb0
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x41acc0
xor al, al
pop esi
ret 0x10
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
mov ecx, dword [ecx]
push edx
lea edx, [esp + 0x14]
push edx
push 0
push ecx
push eax
call dword [0x45a014]
test eax, eax
je 0x41acec
mov dword [esi + 0xc], eax
xor al, al
pop esi
ret 0x10
mov al, 1
pop esi
ret 0x10

Function at 0x41ad40
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x41ad50
xor al, al
pop esi
ret 0x10
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push edx
mov edx, dword [esp + 0x14]
mov ecx, dword [ecx]
push edx
mov edx, dword [esp + 0x14]
push edx
push 0
push ecx
push eax
call dword [0x45a028]
test eax, eax
je 0x41ad7c
mov dword [esi + 0xc], eax
xor al, al
pop esi
ret 0x10
mov al, 1
pop esi
ret 0x10
Function at 0x41b220
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x458786
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2ac
mov eax, dword [0x46d088]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
xor esi, esi
push 0x471d68
push ecx
mov dword [esp + 0x2cc], esi
call fcn.0043d859
mov edi, dword [esp + 0x2d4]
mov ebx, dword [0x45a410]
add esp, 8
push edi
call ebx
test eax, eax
jle 0x41b2ff
mov ebp, dword [0x45a414]
mov ecx, dword [esp + 0x10]
mov al, byte [esi + edi]
mov byte [esp + 0x18], al
mov edx, dword [ecx - 8]
test edx, edx
jle 0x41b2c0
cmp al, 0x20
je 0x41b29b
cmp al, 9
jne 0x41b2c0
lea edx, [esp + 0x17c]
push edx
push ecx
call ebp
cmp eax, 0xffffffff
je 0x41b2c0
push eax
call dword [0x45a418]
mov eax, dword [esp + 0x17c]
and eax, 0x10
cmp al, 0x10
jne 0x41b2ff
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call fcn.0043ce68
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c8], 1
call fcn.00447895
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c4], 0
call fcn.0044775c
push edi
inc esi
call ebx
cmp esi, eax
jl 0x41b281
call fcn.004544b3
mov ecx, dword [esp + 0x10]
mov eax, dword [eax + 8]
push 0
push ecx
push eax
call dword [0x45a494]
mov ebx, eax
test ebx, ebx
je 0x41b320
cmp ebx, 1
jne 0x41b32f
push 0x7f02
push 0
call dword [0x45a730]
mov ebx, eax
mov eax, dword [esp + 0x10]
mov esi, dword [0x45a498]
push 0x4000
lea edx, [esp + 0x20]
push 0x160
push edx
push 0
push eax
call esi
test eax, eax
jne 0x41b365
mov ecx, dword [esp + 0x2d0]
mov edx, dword [esp + 0x2d4]
mov dword [ecx], ebx
mov dword [edx], ebx
jmp 0x41b3bc
mov ecx, dword [esp + 0x20]
mov edi, dword [0x45a064]
push 0
push ecx
push eax
call edi
mov ebp, dword [esp + 0x2d0]
push 0x4001
lea edx, [esp + 0x20]
push 0x160
mov dword [ebp], eax
mov eax, dword [esp + 0x18]
push edx
push 0
push eax
call esi
test eax, eax
jne 0x41b3a9
mov edx, dword [esp + 0x2d4]
mov ecx, dword [ebp]
mov dword [edx], ecx
jmp 0x41b3bc
mov ecx, dword [esp + 0x20]
push 0
push ecx
push eax
call edi
mov edx, dword [esp + 0x2d4]
mov dword [edx], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c4], 0xffffffff
call fcn.0044775c
mov ecx, dword [esp + 0x2bc]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2b8
ret
Function at 0x42f750
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x45a1b0]
mov edi, dword [ebp + 8]
push edi
call dword [0x45a5dc]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0041f1e0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x42f81b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [0x45a5e0]
test eax, eax
je 0x42f81b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x42f7ce
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x42f7d9
or bh, 8
and edi, 0x8000000
je 0x42f7f4
mov eax, dword [0x477cbc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [0x45a1bc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [0x45a500]
test edi, edi
je 0x42f81b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [0x45a1bc]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret