joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4218e0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x469416
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x48bb84]
xor eax, esp
mov dword [esp + 0x81c], eax
push esi
push edi
mov eax, dword [0x48bb84]
xor eax, esp
push eax
lea eax, [esp + 0x82c]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0x840]
mov dword [esp + 0x834], 0
call fcn.00402740
push eax
lea eax, [esp + 0x2c]
push 0x800
push eax
call fcn.0044b8de
lea esi, [esp + 0x34]
add esp, 0xc
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x421950
sub esi, ecx
test esi, esi
jle 0x42196b
mov al, 0x5c
nop
cmp byte [esp + esi + 0x28], al
je 0x42196b
dec esi
test esi, esi
jg 0x421960
lea ecx, [esp + 0x83c]
push ecx
lea ecx, [esp + 0x10]
inc esi
call fcn.00424f60
push 1
sub esp, 0xc
mov eax, esp
mov dword [esp + 0x28], esp
lea edx, [esi - 1]
push edx
push 1
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x850], 1
call fcn.004252e0
mov ecx, edi
call fcn.004214c0
lea ecx, [esp + 0xc]
call fcn.00424fd0
sub eax, esi
push eax
inc esi
push esi
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
call fcn.004252e0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x838], 2
call fcn.004250d0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x834], 1
call fcn.004250c0
lea ecx, [esp + 0x10]
call fcn.00402740
mov edx, dword [edi + 8]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [esp + 0xc]
mov byte [esp + 0x834], 0
call fcn.004250c0
lea ecx, [esp + 0x83c]
mov dword [esp + 0x834], 0xffffffff
call fcn.004250c0
mov ecx, dword [esp + 0x82c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x81c]
xor ecx, esp
call fcn.0044b298
add esp, 0x82c
ret 0xc

Function at 0x421a70
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46946e
mov eax, dword fs:[0]
push eax
sub esp, 0xa3c
mov eax, dword [0x48bb84]
xor eax, esp
mov dword [esp + 0xa38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48bb84]
xor eax, esp
push eax
lea eax, [esp + 0xa50]
mov dword fs:[0], eax
mov esi, dword [esp + 0xa60]
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], ebx
mov ebp, 1
mov dword [esp + 0xa58], ebp
cmp dword [edi + 8], ebx
jne 0x421add
push 0x470f93
mov ecx, esi
call fcn.00424ef0
jmp 0x421b32
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
lea ecx, [esp + 0xa78]
mov dword [esp + 0x28], 0x800
call fcn.00402740
push eax
mov eax, dword [edi + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x421b26
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
mov byte [esp + ecx + 0x24], bl
push edx
mov ecx, esi
call fcn.00424fe0
jmp 0x421b32
push 0x470f99
mov ecx, esi
call fcn.00424ef0
lea ecx, [esp + 0xa64]
mov dword [esp + 0x14], ebp
mov byte [esp + 0xa58], bl
call fcn.004250c0
mov eax, esi
mov ecx, dword [esp + 0xa50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa38]
xor ecx, esp
call fcn.0044b298
add esp, 0xa48
ret 0x10
Function at 0x421e40
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4694da
mov eax, dword fs:[0]
push eax
mov eax, 0x2010
call fcn.0044c940
mov eax, dword [0x48bb84]
xor eax, esp
mov dword [esp + 0x200c], eax
push ebx
push esi
mov eax, dword [0x48bb84]
xor eax, esp
push eax
lea eax, [esp + 0x201c]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
mov ebx, 1
push eax
lea ecx, [esp + 0x203c]
mov dword [esp + 0x2028], ebx
call fcn.00425230
lea ecx, [esp + 0x10]
call fcn.00402740
push eax
lea ecx, [esp + 0x1c]
push 0x1000
push ecx
call fcn.0044b8de
add esp, 0xc
lea edx, [esp + 0x1018]
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.00421d00
cmp dword [esi + 8], 0
je 0x421f39
push eax
lea ecx, [esp + 0x101c]
push ecx
push 3
push 0
lea ecx, [esp + 0x2040]
call fcn.00402740
mov edx, dword [esi + 8]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x421f39
lea ecx, [esp + 0xc]
mov byte [esp + 0x2024], bl
call fcn.004250c0
lea ecx, [esp + 0x202c]
mov byte [esp + 0x2024], 0
call fcn.004250c0
lea ecx, [esp + 0x2038]
mov dword [esp + 0x2024], 0xffffffff
call fcn.004250c0
mov al, bl
jmp 0x421f76
lea ecx, [esp + 0xc]
mov byte [esp + 0x2024], bl
call fcn.004250c0
lea ecx, [esp + 0x202c]
mov byte [esp + 0x2024], 0
call fcn.004250c0
lea ecx, [esp + 0x2038]
mov dword [esp + 0x2024], 0xffffffff
call fcn.004250c0
xor al, al
mov ecx, dword [esp + 0x201c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x200c]
xor ecx, esp
call fcn.0044b298
add esp, 0x201c
ret 0x18

Function at 0x421fa0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x469518
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x48bb84]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 8], 0
mov dword [esp + 0x10], 1
je 0x422034
lea ecx, [esp + 0x24]
call fcn.00424fd0
push eax
lea ecx, [esp + 0x2c]
call fcn.00402740
push eax
push 1
push 0
lea ecx, [esp + 0x2c]
call fcn.00402740
push eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x422034
lea ecx, [esp + 0x18]
mov byte [esp + 0x10], al
call fcn.004250c0
lea ecx, [esp + 0x24]
mov dword [esp + 0x10], 0xffffffff
call fcn.004250c0
mov al, 1
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 0x18
lea ecx, [esp + 0x18]
mov byte [esp + 0x10], 0
call fcn.004250c0
lea ecx, [esp + 0x24]
mov dword [esp + 0x10], 0xffffffff
call fcn.004250c0
xor al, al
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 0x18
Function at 0x422740
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x469610
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x48bb84]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 8], 0
je 0x4227b2
push 4
lea eax, [esp + 0x28]
push eax
push 4
push 0
lea ecx, [esp + 0x2c]
call fcn.00402740
mov ecx, dword [esi + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4227b2
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.004250c0
mov al, 1
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 0x10
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.004250c0
xor al, al
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 0x10
Function at 0x425ad0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x469e7f
mov eax, dword fs:[0]
push eax
mov eax, 0xa030
call fcn.0044c940
mov eax, dword [0x48bb84]
xor eax, esp
mov dword [esp + 0xa02c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48bb84]
xor eax, esp
push eax
lea eax, [esp + 0xa044]
mov dword fs:[0], eax
mov ebp, ecx
xor ebx, ebx
push 0x471c4a
lea ecx, [esp + 0x1c]
mov dword [esp + 0xa050], ebx
call fcn.00424ef0
push 0x471cb0
lea ecx, [esp + 0xa05c]
mov byte [esp + 0xa050], 1
call fcn.00402740
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0044c8e7
add esp, 0xc
test eax, eax
jne 0x425c78
mov ecx, dword [esp + 0x14]
push 2
push ebx
push ecx
call fcn.0044df37
mov edx, dword [esp + 0x20]
push edx
call fcn.0044de3f
add esp, 0x10
cmp eax, ebx
jne 0x425b87
mov eax, dword [esp + 0x14]
push eax
call fcn.0044c5ec
add esp, 4
jmp 0x425c78
cdq
mov ecx, 0xa000
idiv ecx
mov edi, edx
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call fcn.0044dbdc
add esp, 4
cmp esi, ebx
jle 0x425bfe
mov eax, dword [esp + 0x14]
push eax
push 1
lea ecx, [esp + 0x3c]
push 0xa000
push ecx
call fcn.0044dbbf
add esp, 0x10
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0xa038], bl
call fcn.00424fe0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa050], 2
call fcn.00425210
lea ecx, [esp + 0x24]
mov byte [esp + 0xa04c], 1
call fcn.004250c0
sub esi, 1
jne 0x425ba4
mov ecx, dword [esp + 0x14]
push ecx
push 1
lea edx, [esp + 0x3c]
push edi
push edx
call fcn.0044dbbf
add esp, 0x10
mov byte [esp + edi + 0x34], bl
cmp edi, ebx
je 0x425c50
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x28]
call fcn.00424fe0
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa050], 3
call fcn.00425210
lea ecx, [esp + 0x24]
mov byte [esp + 0xa04c], 1
call fcn.004250c0
mov edx, dword [esp + 0x14]
push edx
call fcn.0044c5ec
add esp, 4
push ebx
sub esp, 0xc
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call fcn.00424f60
mov ecx, ebp
call fcn.00425860
lea ecx, [esp + 0x18]
mov byte [esp + 0xa04c], bl
call fcn.004250c0
lea ecx, [esp + 0xa054]
mov dword [esp + 0xa04c], 0xffffffff
call fcn.004250c0
mov ecx, dword [esp + 0xa044]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa02c]
xor ecx, esp
call fcn.0044b298
add esp, 0xa03c
ret 0xc
Function at 0x42dd05
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x42dd29
cmp dword [edi + 0x54], 0
jne 0x42dd29
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00439fea
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0042dcc6
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x43375b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4337a2
call fcn.00439fea
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4337a2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4337be
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004332d5
mov esi, eax
test edi, edi
je 0x4337bc
test ebx, ebx
je 0x4337bc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4346b7
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x46b148
call fcn.0044e6e9
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4346dc
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x434722
lea ecx, [ebp - 0x10]
call fcn.00402620
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00433e7a
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402920
mov eax, esi
call fcn.0044e7c1
ret 8
Function at 0x438cec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x438d34
call fcn.00439fea
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x438d34
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x438d77
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x438d60
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x438d60
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x438d74
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x44b298
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48bb84]
jne 0x44b2a2
repz ret
jmp fcn.00452345
Function at 0x460597
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00453438
and dword [ebp - 4], 0
cmp dword [0x491318], 0
mov ebx, eax
jne 0x460648
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4606f9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x47a9c4
push edi
call esi
test eax, eax
je 0x4606f9
push eax
call fcn.004533c6
mov dword [esp], 0x47a9b4
push edi
mov dword [0x491318], eax
call esi
push eax
call fcn.004533c6
mov dword [esp], 0x47a9a0
push edi
mov dword [0x49131c], eax
call esi
push eax
call fcn.004533c6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x491320], eax
call esi
push eax
call fcn.004533c6
pop ecx
mov dword [0x491328], eax
test eax, eax
je 0x460648
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004533c6
pop ecx
mov dword [0x491324], eax
mov eax, dword [0x491324]
cmp eax, ebx
je 0x4606a0
cmp dword [0x491328], ebx
je 0x4606a0
push eax
call fcn.00453441
push dword [0x491328]
mov esi, eax
call fcn.00453441
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4606a0
test edi, edi
je 0x4606a0
call esi
test eax, eax
je 0x460697
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x460697
test byte [ebp - 0xc], 1
jne 0x4606a0
or dword [ebp + 0x10], 0x200000
jmp 0x4606d9
mov eax, dword [0x49131c]
cmp eax, ebx
je 0x4606d9
push eax
call fcn.00453441
pop ecx
test eax, eax
je 0x4606d9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4606d9
mov eax, dword [0x491320]
cmp eax, ebx
je 0x4606d9
push eax
call fcn.00453441
pop ecx
test eax, eax
je 0x4606d9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x491318]
call fcn.00453441
pop ecx
test eax, eax
je 0x4606f9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4606fb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f90
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x40bfb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov eax, dword [0x410200]
push ebp
mov ebp, dword [esp + 0x58]
push esi
mov esi, dword [esp + 0x58]
push edi
mov dword [esp + 0x48], eax
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [str.SOFTWAREKWMUSIC]
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push 0x80000002
mov dword [esp + 0x74], ebp
mov dword [esp + 0x70], 1
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402032
mov ecx, dword [0x410094]
lea edx, [esp + 0x60]
push edx
mov edx, dword [esp + 0x10]
push esi
lea eax, [esp + 0x64]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402027
mov byte [esi], 0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402037
sub eax, edx
mov dword [esp + 0x60], eax
jne 0x40213c
lea ecx, [esp + 0x2c]
push ecx
call fcn.00402720
add esp, 4
mov eax, dword [esp + 0x40]
test eax, eax
mov dword [esp + 0x54], 0
ja 0x402082
cmp dword [esp + 0x44], 0x10
jb 0x40207b
mov edx, dword [esp + 0x30]
push edx
call fcn.00403f98
add esp, 4
xor al, al
jmp 0x402143
mov ecx, dword [esp + 0x44]
mov edi, 0x10
cmp ecx, edi
mov ecx, dword [esp + 0x30]
jae 0x402097
lea ecx, [esp + 0x30]
cmp byte [ecx + eax - 1], 0x5c
jne 0x4020db
dec eax
push eax
push 0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
call fcn.00401860
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x60], 1
call fcn.00401530
cmp dword [esp + 0x28], edi
mov byte [esp + 0x54], 0
jb 0x4020db
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00403f98
add esp, 4
cmp dword [esp + 0x44], edi
mov eax, dword [esp + 0x30]
jae 0x4020e9
lea eax, [esp + 0x30]
mov edx, dword [0x410094]
push eax
mov eax, dword [str.SOFTWAREKWMUSIC]
push edx
push eax
push 0x80000002
call fcn.00402c70
mov eax, dword [esp + 0x54]
add esp, 0x10
cmp eax, edi
mov eax, dword [esp + 0x30]
jae 0x402114
lea eax, [esp + 0x30]
push eax
push 0x40d264
lea ecx, [ebp - 1]
push ecx
push esi
call fcn.00403f9d
mov eax, dword [esp + 0x54]
add esp, 0x10
cmp eax, edi
jb 0x40213c
mov edx, dword [esp + 0x30]
push edx
call fcn.00403f98
add esp, 4
mov byte [esi + ebp - 1], 0
mov al, 1
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x40]
pop ebp
call fcn.00403b2e
add esp, 0x4c
ret
Function at 0x402200
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x410200]
push ebx
mov ebx, dword [esp + 0x110]
push esi
mov esi, dword [esp + 0x118]
push edi
mov dword [esp + 0x110], eax
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.00402160
add esp, 8
test al, al
je 0x40226a
lea ecx, [esp + 0xc]
push ecx
push esi
push ebx
push 0
push str.Version
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x402282
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x104]
call fcn.00403b2e
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
pop edi
mov byte [ebx + esi - 1], 0
pop esi
mov al, 1
pop ebx
call fcn.00403b2e
add esp, 0x108
ret

Function at 0x402920
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov eax, ebp
cdq
mov edi, 3
idiv edi
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, ebp
sub edi, edx
test edi, edi
jle 0x4029ab
lea edx, [edi - 1]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
push ebx
nop
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0]
mov byte [ecx], al
movzx ebx, byte [esi + 1]
xor eax, eax
mov al, byte [esi]
shr ebx, 4
inc ecx
add esi, 3
and eax, 3
shl eax, 4
mov al, byte [eax + ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0]
mov byte [ecx], al
movzx ebx, byte [esi - 1]
xor eax, eax
mov al, byte [esi - 2]
shr ebx, 6
inc ecx
and eax, 0xf
mov al, byte [ebx + eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0]
mov byte [ecx], al
xor eax, eax
mov al, byte [esi - 1]
inc ecx
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0]
mov byte [ecx], al
inc ecx
dec edx
jne 0x402950
pop ebx
sub ebp, edi
cmp ebp, 1
jne 0x4029e9
movzx edx, byte [esi]
shr edx, 2
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0]
mov byte [ecx], al
xor edx, edx
mov dl, byte [esi]
inc ecx
pop edi
pop esi
pop ebp
and edx, 3
shl edx, 4
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0]
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov eax, ecx
mov byte [ecx], 0
sub eax, dword [esp + 4]
ret
cmp ebp, 2
jne 0x402a2e
movzx edx, byte [esi]
shr edx, 2
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0]
mov byte [ecx], al
movzx eax, byte [esi + 1]
xor edx, edx
mov dl, byte [esi]
shr eax, 4
inc ecx
and edx, 3
shl edx, 4
mov dl, byte [edx + eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0]
mov byte [ecx], dl
xor eax, eax
mov al, byte [esi + 1]
inc ecx
and eax, 0xf
mov dl, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
inc ecx
pop edi
mov eax, ecx
mov byte [ecx], 0
mov ecx, dword [esp + 0xc]
pop esi
sub eax, ecx
pop ebp
ret
Function at 0x402b20
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0xc], eax
cmp dword [esi + 0x18], 0x10
push edi
lea edi, [esi + 4]
jb 0x402b41
mov eax, dword [edi]
jmp 0x402b43
mov eax, edi
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
push 2
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402bbf
mov eax, dword [ebp + 0x18]
mov ecx, 0x10
cmp eax, ecx
jb 0x402b6d
mov ebp, dword [ebp + 4]
jmp 0x402b70
add ebp, 4
mov eax, dword [esp + 0x20]
cmp dword [eax + 0x18], ecx
jb 0x402b7e
mov eax, dword [eax + 4]
jmp 0x402b81
add eax, 4
mov edx, dword [esp + 0x10]
push edx
push ebp
push 1
push 0
push eax
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x402bb0
mov ecx, dword [esp + 0x24]
push ecx
call esi
test eax, eax
je 0x402c52
mov edx, dword [esp + 0x24]
push edx
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
cmp eax, 2
jne 0x402c61
push esi
push ebx
call fcn.00402ad0
add esp, 8
test al, al
je 0x402c61
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], eax
cmp dword [esi + 0x18], 0x10
jb 0x402beb
mov eax, dword [edi]
jmp 0x402bed
mov eax, edi
lea ecx, [esp + 0x1c]
push ecx
push 2
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402c61
mov eax, dword [ebp + 0x18]
mov ecx, 0x10
cmp eax, ecx
jb 0x402c13
mov ebp, dword [ebp + 4]
jmp 0x402c16
add ebp, 4
mov eax, dword [esp + 0x20]
cmp dword [eax + 0x18], ecx
jb 0x402c24
mov eax, dword [eax + 4]
jmp 0x402c27
add eax, 4
mov edx, dword [esp + 0x10]
push edx
push ebp
push 1
push 0
push eax
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x402c5a
mov ecx, dword [esp + 0x1c]
push ecx
call esi
test eax, eax
jne 0x402c5a
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x1c]
push edx
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret