joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404b81
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
lea eax, [ebp - 0x8c]
push eax
push 0x410b0a
call sub.fanlink2.dll_fl8803
lea edx, [ebp - 0x10c]
push edx
push 0x410b3f
call sub.fanlink2.dll_fl8803
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x8c]
push edx
push 0x80000000
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
jne 0x404bfe
mov dword [ebp - 0xc], 0x400980
push 4
lea ecx, [ebp - 0xc]
push ecx
push 3
push 0
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret

Function at 0x404c02
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
lea eax, [ebp - 0x90]
push eax
push 0x410b0a
call sub.fanlink2.dll_fl8803
lea edx, [ebp - 0x110]
push edx
push 0x410b3f
call sub.fanlink2.dll_fl8803
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x90]
push edx
push 0x80000000
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
je 0x404c5c
xor eax, eax
jmp 0x404ca6
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 4
mov bl, 1
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0xc]
push edx
push 0
push 0
lea ecx, [ebp - 0x110]
push ecx
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
je 0x404c8b
xor ebx, ebx
cmp dword [ebp - 0x10], 4
je 0x404c93
xor ebx, ebx
test bl, bl
je 0x404c9d
cmp dword [ebp - 0xc], 0
jne 0x404ca1
xor eax, eax
jmp 0x404ca6
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404ddb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4125cc
xor edx, edx
xor byte [eax], 0x55
inc edx
inc eax
cmp edx, 0x1200
jl 0x404de5
pop ebp
ret

Function at 0x4076f3
Capabilities:
Find taskbar
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov dword [ebp - 0x58], 0x58
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 0x2bc
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x48], 0x6bc
push 0x40
lea edx, [ebp - 0x40]
push edx
push 0x2bd
call fcn.00404a91
add esp, 0xc
push 0x2c7
push dword [0x411150]
call sub.USER32.dll_LoadIconA
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x58]
push ecx
push 0
call sub.SHELL32.DLL_Shell_NotifyIconA
test eax, eax
setne bl
and ebx, 1
push dword [ebp - 0x44]
call sub.USER32.dll_DestroyIcon
mov byte [0x410d44], 1
test bl, bl
jne 0x40776c
xor eax, eax
jmp 0x407793
push 0
push 0x410d45
call sub.USER32.dll_FindWindowA
mov ebx, eax
push 0
push 0x410d53
push 0
push ebx
call sub.USER32.dll_FindWindowExA
mov dword [0x410d40], eax
mov eax, dword [0x410d40]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407ae7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push dword [0x411150]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x90000000
push 0x410dbf
push 0x410dbf
push 0x88
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
test ebx, ebx
je 0x407b3c
push 1
push 0
push 0
push 0
push 0
push ebx
call sub.USER32.dll_MoveWindow
push 5
push ebx
call sub.USER32.dll_ShowWindow
push ebx
call sub.USER32.dll_UpdateWindow
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x40c048
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x40c067
mov eax, dword [0x411984]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x40c074
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x40c0a1
je 0x40c0b3
sub ecx, 0x100
je 0x40c0c1
sub ecx, 0x100
je 0x40c0c8
sub ecx, 0x100
je 0x40c0ba
jmp 0x40c0cf
sub ecx, 0x600
je 0x40c0c8
sub ecx, 0x100
je 0x40c0b3
jmp 0x40c0cf
mov edi, 1
jmp 0x40c0d4
mov edi, 2
jmp 0x40c0d4
mov edi, 4
jmp 0x40c0d4
mov edi, 5
jmp 0x40c0d4
mov edi, 3
test byte [ebp + 0xd], 1
je 0x40c0fb
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x411e74]
test al, 0x80
je 0x40c0f4
mov ebx, 0x80
jmp 0x40c10d
mov ebx, 1
jmp 0x40c10d
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x40c10d
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x40c11f
je 0x40c128
dec eax
je 0x40c131
jmp 0x40c13a
mov dword [ebp - 4], 0x80000000
jmp 0x40c149
mov dword [ebp - 4], 0x40000000
jmp 0x40c149
mov dword [ebp - 4], 0xc0000000
jmp 0x40c149
push 1
call fcn.0040be60
pop ecx
mov ebx, eax
jmp 0x40c235
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x40c165
sub eax, 0x10
je 0x40c16c
sub eax, 0x10
je 0x40c175
sub eax, 0x10
je 0x40c17e
jmp 0x40c17e
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x40c185
mov dword [ebp - 8], 1
jmp 0x40c185
mov dword [ebp - 8], 2
jmp 0x40c185
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x40c1ee
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x40c1e3
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x40c1e3
add ebx, 0xffffffb2
push ebx
call fcn.0040be60
pop ecx
mov ebx, eax
jmp 0x40c235
mov edi, esi
push edi
call fcn.0040bfb8
pop ecx
test eax, eax
je 0x40c202
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x40c20e
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0040bbbc
add esp, 8
mov ebx, eax
inc eax
jne 0x40c235
push 4
call fcn.0040be60
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40cdb4
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x40cfd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x412068], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x40d088
cmp byte [0x40e059], 0
je 0x40d042
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.00408a1c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40d02b
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.00408a1c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40d02b
lea ebx, [ebp - 0x54]
jmp 0x40d02c
inc ebx
call fcn.0040cf88
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x40d0a9
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x41206c
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004089bc
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x41206f
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x40d0a9
cmp dword [0x412068], 0xffffffff
je 0x40d0a9
mov eax, dword [0x412068]
test eax, eax
je 0x40d0a9
cmp byte [eax], 0
je 0x40d0a9
push esi
push eax
call fcn.0040d138
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401a50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea esp, [esp]
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.004227b0
mov esi, eax
mov eax, dword [section..data]
add esp, 8
cmp eax, 1
je 0x401aab
cmp eax, 2
je 0x401aab
cmp byte [0x501220], 0
je 0x401aab
cmp esi, 0xfffffff6
je 0x401b27
cmp esi, 0xfffffff7
je 0x401b33
cmp esi, 0xfffffff9
je 0x401b3f
cmp esi, 0xfffffff8
je 0x401b4b
cmp esi, 0xfffffffc
je 0x401ab9
cmp esi, 0xfffffffe
jne 0x401b57
mov edi, dword [ebx + 0x64]
cmp dword [edi + 0xbc], 0
je 0x401b57
mov eax, dword [edi + 0x78]
test eax, eax
je 0x401b57
cmp dword [eax + 0x120], 0
je 0x401b57
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x401b57
mov edx, dword [edi + 0x78]
mov ecx, dword [edx + 0x120]
mov edx, dword [ecx + 0x7c]
mov eax, edx
cmp esi, 0xfffffffc
jne 0x401b00
inc eax
jmp 0x401b01
dec eax
test eax, eax
jns 0x401b0b
mov eax, dword [ecx + 0x78]
dec eax
jmp 0x401b12
cmp eax, dword [ecx + 0x78]
jl 0x401b12
xor eax, eax
cmp eax, edx
je 0x401a60
push eax
mov ecx, edi
call fcn.0044df50
jmp 0x401a60
pop edi
pop esi
mov eax, 0xfffffff9
pop ebx
pop ebp
ret 8
pop edi
pop esi
mov eax, 0xfffffff8
pop ebx
pop ebp
ret 8
pop edi
pop esi
mov eax, 0xfffffff6
pop ebx
pop ebp
ret 8
pop edi
pop esi
mov eax, 0xfffffff7
pop ebx
pop ebp
ret 8
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x40a360
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov eax, dword [ebx + 8]
push esi
mov esi, dword [eax + 0x68]
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp esi, ecx
je 0x40a4b6
cmp dword [esi + 0x20], ecx
jne 0x40a38c
cmp byte [eax + 0x56], 2
jne 0x40a4b6
mov dword [0x501854], ecx
push edi
cmp dword [esi + 0x20], ecx
je 0x40a39f
mov edi, esi
mov dword [ebp - 4], edi
jmp 0x40a3bd
mov eax, dword [ebx + 8]
mov eax, dword [eax + 8]
cmp eax, ecx
je 0x40a4b5
mov eax, dword [eax + 0x64]
cmp eax, ecx
je 0x40a4b5
mov dword [ebp - 4], eax
mov edi, eax
cmp dword [ebp + 8], ecx
je 0x40a3e4
push 1
mov dword [0x501850], esi
mov eax, dword [edi + 0x20]
push ecx
push eax
mov dword [0x501858], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [edi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [ebx + 8]
cmp byte [edx + 0x56], 2
jne 0x40a401
cmp dword [esi + 0x20], 0
jne 0x40a401
mov eax, dword [esi + 0x80]
mov edi, dword [eax - 0xc]
mov dword [ebp - 8], esi
jmp 0x40a40a
mov ecx, esi
call sub.mfc100u.dll_CWnd::GetWindowTextLengthW
mov edi, eax
test edi, edi
jns 0x40a410
xor edi, edi
inc edi
lea ecx, [edi + edi]
push ecx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp + 8], eax
test eax, eax
je 0x40a485
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x40a485
mov eax, dword [ebp - 8]
test eax, eax
je 0x40a461
push 0
lea ecx, [eax + 0x80]
call dword [sym.imp.mfc100u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
mov edx, ebx
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x40a450
jmp 0x40a46a
push edi
push ebx
mov ecx, esi
call sub.mfc100u.dll_CWnd::GetWindowTextW_1
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x40a493
call fcn.0040c5a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x40a4aa
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x40a4af
call fcn.0040c5a0
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a500
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8230
call fcn.004b81c0
mov eax, dword [0x4ff94c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x8230], eax
mov eax, dword [ebx + 8]
cmp dword [eax + 0x58], 0
mov dword [ebp - 0x8220], ecx
mov dword [ebp - 0x8224], 0
jne 0x40a552
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret 8
mov edx, dword [eax + 8]
mov edx, dword [edx + 0x64]
push esi
push edi
mov ecx, 7
mov esi, str.SoftwarePRONTOFieldDefaults
lea edi, [ebp - 0x108]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40a575
mov ax, word [0x4cce98]
mov word [edi], ax
mov ecx, dword [edx + 0x8c]
mov eax, dword [ecx + 0x50]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40a591
lea edi, [ebp - 0x108]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40a5a3
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.00407750
push 0x104
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x108]
push 0xffffffffffffffff
push ecx
call fcn.0040d5c0
add esp, 0x14
lea eax, [ebp - 0x822c]
push eax
push 0x20019
xor edx, edx
push edx
lea ecx, [ebp - 0x310]
push ecx
push closesocket
mov word [ebp - 0x10a], dx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a6bd
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 0x58]
push 0x104
lea edx, [ebp - 0x518]
push edx
push 0xffffffffffffffff
push ecx
call fcn.0040d5c0
add esp, 0x10
lea eax, [ebp - 0x8228]
push eax
mov eax, dword [ebp - 0x822c]
xor edx, edx
lea ecx, [ebp - 0x821c]
push ecx
push edx
push edx
mov word [ebp - 0x312], dx
lea edx, [ebp - 0x518]
push edx
push eax
mov dword [ebp - 0x8228], 0x7d01
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 1
test eax, eax
je 0x40a675
mov ebx, dword [ebp - 0x8224]
mov ecx, dword [ebp - 0x822c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x40a6c3
mov edi, dword [ebp - 0x8230]
test edi, edi
je 0x40a6c3
mov eax, dword [ebp - 0x8228]
mov esi, dword [ebp - 0x8220]
cmp eax, esi
jae 0x40a6a2
mov esi, eax
dec esi
push esi
lea edx, [ebp - 0x821c]
push edx
push edi
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
xor eax, eax
mov word [edi + esi*2], ax
jmp 0x40a6c3
mov ebx, dword [ebp - 0x8224]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004b7f56
mov esp, ebp
pop ebp
ret 8
Function at 0x40a6e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8224
call fcn.004b81c0
mov eax, dword [0x4ff94c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x8220], eax
mov eax, dword [ebx + 8]
cmp dword [eax + 0x58], 0
je 0x40a872
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 0x64]
push esi
push edi
mov ecx, 7
mov esi, str.SoftwarePRONTOFieldDefaults
lea edi, [ebp - 0x108]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40a733
mov ax, word [0x4cce98]
mov word [edi], ax
mov ecx, dword [edx + 0x8c]
mov eax, dword [ecx + 0x50]
mov ecx, eax
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40a750
lea edi, [ebp - 0x108]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40a762
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.00407750
push 0x104
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x108]
push 0xffffffffffffffff
push ecx
call fcn.0040d5c0
add esp, 0x14
xor edx, edx
push edx
lea eax, [ebp - 0x8224]
push eax
push edx
push 0x2001f
push edx
push 0x4dab4c
push edx
lea ecx, [ebp - 0x310]
push ecx
push closesocket
mov word [ebp - 0x10a], dx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40a870
mov esi, dword [ebp - 0x8220]
test esi, esi
jne 0x40a80b
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 0x68]
push 0x3e80
lea edx, [ebp - 0x821c]
push edx
call sub.mfc100u.dll_CWnd::GetWindowTextW_1
xor ecx, ecx
lea edx, [ebp - 0x821c]
mov word [ebp - 0x51c], cx
mov esi, edx
mov ecx, dword [ebx + 8]
mov edx, dword [ecx + 0x58]
push 0x104
lea eax, [ebp - 0x518]
push eax
push 0xffffffffffffffff
push edx
call fcn.0040d5c0
add esp, 0x10
xor eax, eax
mov word [ebp - 0x312], ax
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a836
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x8224]
push ecx
push esi
push 1
push 0
lea edx, [ebp - 0x518]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x8224]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004b7f56
mov esp, ebp
pop ebp
ret 4
Function at 0x40a890
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x4ff94c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, dword [ebx + 8]
cmp dword [eax + 0x58], 0
je 0x40a990
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x64]
push esi
push edi
mov ecx, 7
mov esi, str.SoftwarePRONTOFieldDefaults
lea edi, [ebp - 0x108]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40a8d6
mov cx, word [0x4cce98]
mov word [edi], cx
mov edx, dword [edx + 0x8c]
mov eax, dword [edx + 0x50]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40a8f3
lea edi, [ebp - 0x108]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40a905
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x108]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00407750
push 0x104
lea ecx, [ebp - 0x310]
push ecx
lea edx, [ebp - 0x108]
push 0xffffffffffffffff
push edx
call fcn.0040d5c0
add esp, 0x14
lea ecx, [ebp - 0x314]
push ecx
push 2
xor eax, eax
push eax
lea edx, [ebp - 0x310]
push edx
push closesocket
mov word [ebp - 0x10a], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop edi
pop esi
test eax, eax
jne 0x40a990
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 0x58]
mov edx, dword [ebp - 0x314]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x314]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
Function at 0x40cb80
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
mov eax, dword [0x4ff94c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x50c], eax
mov al, byte [esi]
push edi
lea ecx, [ebp - 0x104]
mov edx, 0x100
test al, al
je 0x40cbcd
cmp al, 0x2f
je 0x40cbcd
cmp al, 0x5c
je 0x40cbcd
dec edx
test edx, edx
jle 0x40cbcd
inc esi
mov byte [ecx], al
mov al, byte [esi]
inc ecx
test al, al
jne 0x40cbb6
mov byte [ecx], 0
mov al, byte [esi]
cmp al, 0x2f
je 0x40cbda
cmp al, 0x5c
jne 0x40cbdd
inc esi
jmp 0x40cbd0
cmp byte [ebp - 0x104], 0
mov edi, dword [ebp + 0x14]
je 0x40cc4c
lea ecx, [ebp - 0x514]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x104]
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40cc43
mov eax, dword [ebp - 0x50c]
mov ecx, dword [ebp - 0x514]
push edi
push eax
push esi
push ecx
call fcn.0040cb80
mov edx, dword [ebp - 0x514]
add esp, 0x10
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
jne 0x40ccf7
lea eax, [ebp - 0x508]
push eax
lea ecx, [ebp - 0x504]
push ecx
lea edx, [ebp - 0x510]
push edx
push 0
lea eax, [ebp - 0x104]
push eax
push ebx
mov dword [ebp - 0x510], 1
mov dword [ebp - 0x508], 0x3ff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ccf7
mov eax, dword [ebp - 0x510]
cmp eax, 1
je 0x40ccc1
cmp eax, 2
jne 0x40ccf7
mov ecx, dword [ebp - 0x50c]
push edi
push ecx
lea edx, [ebp - 0x504]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov edi, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x508]
cmp eax, edi
jae 0x40cccd
mov edi, eax
mov ecx, dword [ebp - 0x50c]
push edi
lea eax, [ebp - 0x504]
push eax
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
Function at 0x40e1e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c570b
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x4ff94c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov esi, eax
mov al, byte [eax]
mov dword [ebp - 0x114], ecx
lea ecx, [ebp - 0x110]
mov edx, 0x100
test al, al
je 0x40e247
cmp al, 0x2f
je 0x40e247
cmp al, 0x5c
je 0x40e247
dec edx
test edx, edx
jle 0x40e247
inc esi
mov byte [ecx], al
mov al, byte [esi]
inc ecx
test al, al
jne 0x40e230
mov byte [ecx], 0
mov edi, esi
lea esp, [esp]
mov al, byte [edi]
cmp al, 0x2f
je 0x40e25a
cmp al, 0x5c
jne 0x40e25d
inc edi
jmp 0x40e250
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 0x120]
call fcn.0040d620
cmp byte [ebp - 0x110], 0
mov dword [ebp - 4], 0
je 0x40e311
cmp byte [esi], 0
je 0x40e311
lea ecx, [ebp - 0x120]
call fcn.0040d4d0
push 0
mov esi, eax
lea eax, [ebp - 0x118]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40e2d9
lea ecx, [ebp - 0x118]
push ecx
push 0x20019
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e36e
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x118]
push edx
push edi
push eax
call fcn.0040e1e0
mov ecx, dword [ebp - 0x118]
add esp, 0xc
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x120]
call fcn.0040c390
mov eax, esi
jmp 0x40e392
mov edx, dword [ebp - 0x114]
push edx
lea ecx, [ebp - 0x114]
call fcn.0040d5e0
lea ecx, [ebp - 0x114]
call fcn.0040d4d0
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x40e333
sub ecx, esi
sar ecx, 1
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 1
push 0
lea ecx, [ebp - 0x120]
call fcn.0040d4d0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x114]
test eax, eax
je 0x40e37d
call fcn.0040d440
lea ecx, [ebp - 0x120]
call fcn.0040c390
xor eax, eax
jmp 0x40e392
call fcn.0040d440
lea ecx, [ebp - 0x120]
call fcn.0040c390
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret