joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407030
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0xc], ecx
cmp esi, edx
jne 0x40704e
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
cmp eax, edx
je 0x4070d8
cmp word [eax], dx
je 0x4070d8
lea ecx, [ebp - 0x10]
push ecx
push 0x20019
push edx
push eax
push esi
mov dword [ebp - 0x10], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407119
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 4]
push edx
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push edi
push eax
mov ebx, eax
call esi
test eax, eax
jne 0x4070c6
mov eax, 4
cmp dword [ebp - 8], eax
jne 0x4070c6
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push edi
push edx
call esi
test eax, eax
je 0x4070c6
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 4]
push ecx
push edx
lea eax, [ebp - 8]
push eax
push edx
push edi
push esi
call ebx
test eax, eax
jne 0x407119
mov eax, 4
cmp dword [ebp - 8], eax
jne 0x407119
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call ebx
test eax, eax
je 0x407119
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x407150
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
jne 0x407166
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x14
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x4071d3
cmp word [eax], di
je 0x4071d3
lea ecx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 8]
push edx
push edi
or ecx, 0xf003f
push ecx
push edi
push edi
push edi
push eax
push esi
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4071f5
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push 4
lea edx, [ebp + 0x18]
push edx
push 4
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4071b8
lea edi, [eax + 1]
mov eax, dword [ebp + 8]
push eax
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x14
mov eax, dword [ebp + 0x14]
push 4
lea edx, [ebp + 0x18]
push edx
push 4
push edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4071f5
push esi
lea edi, [eax + 1]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x407220
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
test edi, edi
je 0x407334
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x407334
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4072ee
cmp word [eax], 0
je 0x4072ee
lea ecx, [ebp + 0x18]
push ecx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 8]
push edx
push 0
or ecx, 0xf003f
push ecx
push 0
push 0
push 0
push eax
push edi
mov dword [ebp + 8], 0
mov dword [ebp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x407329
mov edx, dword [ebp + 8]
mov eax, esi
mov dword [ebp + 0xc], edx
lea edi, [eax + 2]
jmp 0x4072a0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4072a0
mov ecx, dword [ebp + 0x14]
sub eax, edi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4072cf
mov dword [ebp - 4], 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4072f3
sub eax, edx
mov edx, dword [ebp + 0x14]
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push 0
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x407329
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4076f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov esi, 1
test eax, eax
je 0x40775c
cmp word [eax], 0
je 0x40775c
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
push ecx
or edx, 0xf003f
push edx
push 0
push eax
mov eax, dword [ebp + 8]
push eax
mov dword [ebp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407777
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push ecx
push eax
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x407743
xor esi, esi
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x407777
push edi
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
pop edi
mov eax, esi
pop esi
pop ebp
ret 0x10

Function at 0x4077a0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437438
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x442308]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp ebx, eax
je 0x40783d
mov edi, dword [ebp + 8]
cmp edi, eax
je 0x40783d
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
push ecx
or edx, 0xf003f
push edx
push eax
push ebx
push edi
mov dword [ebp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407826
mov eax, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp + 8], esi
push eax
mov dword [ebp - 4], 0
call fcn.00406ec0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x407826
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4078e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp eax, esi
jne 0x4078f4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp ecx, esi
je 0x40794a
cmp word [ecx], si
je 0x40794a
lea edx, [ebp - 4]
push edx
push 0x20019
push esi
push ecx
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40796b
mov eax, dword [ebp - 4]
push edi
lea ecx, [ebp - 8]
push ecx
push esi
lea edx, [ebp - 0xc]
push edx
push esi
push ebx
push eax
mov edi, eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40793b
lea esi, [eax + 1]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xc]
push ecx
push esi
lea edx, [ebp - 8]
push edx
push esi
push ebx
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40796b
mov esi, 1
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x407980
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp esi, ecx
je 0x407a36
cmp edi, ecx
je 0x407a36
cmp eax, ecx
je 0x407a08
cmp word [eax], cx
je 0x407a08
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 4]
push edx
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push eax
push esi
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x407a2c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
push ebx
push edi
push ecx
push 0
push edx
push eax
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4079ed
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push edi
push edx
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x407a2c
push esi
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4080b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x144
mov eax, dword [0x442308]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x40828b
cmp word [esi], 0
je 0x40828b
mov ecx, dword [0x43a008]
mov edx, dword [0x43a00c]
mov eax, dword [0x43a004]
mov dword [esp + 0x3c], ecx
xor ecx, ecx
push 0xfe
mov dword [esp + 0x44], edx
mov dword [esp + 0x3c], eax
mov eax, dword [0x43a010]
push ecx
lea edx, [esp + 0x52]
push edx
mov dword [esp + 0x50], eax
mov word [esp + 0x54], cx
call fcn.00423660
lea eax, [esp + 0x54]
mov ecx, eax
add esp, 0xc
mov edx, 0x80
sub esi, ecx
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x408152
movzx ecx, word [esi + eax]
test cx, cx
je 0x408152
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x408132
jmp 0x408156
test edx, edx
jne 0x408159
sub eax, 2
xor edx, edx
mov word [eax], dx
mov ebx, 0x43cc30
lea eax, [esp + 0x48]
call fcn.00407cd0
lea eax, [esp + 0x48]
push eax
call fcn.00407d30
xor eax, eax
cmp word [esp + 0x48], ax
je 0x40828b
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x74]
push str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
push eax
call fcn.0042416e
mov cx, word [esp + 0x44]
mov dx, word [esp + 0x48]
mov eax, dword [esp + 0x40]
mov word [esp + 0x70], cx
movzx ecx, byte [esp + 0x4c]
mov word [esp + 0x72], dx
movzx edx, byte [esp + 0x50]
mov byte [esp + 0x74], cl
movzx ecx, byte [esp + 0x54]
mov byte [esp + 0x75], dl
movzx edx, byte [esp + 0x58]
mov byte [esp + 0x76], cl
movzx ecx, byte [esp + 0x5c]
mov byte [esp + 0x77], dl
movzx edx, byte [esp + 0x60]
mov byte [esp + 0x78], cl
movzx ecx, byte [esp + 0x64]
mov byte [esp + 0x79], dl
movzx edx, byte [esp + 0x68]
mov dword [edi], eax
mov eax, dword [esp + 0x70]
mov byte [esp + 0x7a], cl
mov ecx, dword [esp + 0x74]
mov dword [edi + 4], eax
mov byte [esp + 0x7b], dl
mov edx, dword [esp + 0x78]
mov dword [edi + 8], ecx
add esp, 0x34
mov dword [edi + 0xc], edx
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.0042364d
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0042364d
mov esp, ebp
pop ebp
ret 8
Function at 0x40ca20
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x442308]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
call fcn.00401600
push eax
call fcn.004010f0
test eax, eax
jne 0x40ca4a
jmp 0x40cb40
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 1
mov ecx, dword [ebp + 0xc]
call fcn.00401600
push eax
mov ecx, dword [ebp + 8]
call fcn.00401600
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40cb40
mov dword [ebp - 8], 0
jmp 0x40ca8b
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x20
jae 0x40cb1b
xor ecx, ecx
mov word [ebp - 0x810], cx
push 0x7fe
push 0
lea edx, [ebp - 0x80e]
push edx
call fcn.00423660
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00401600
push eax
push 0x4386a4
push 0x400
lea edx, [ebp - 0x810]
push edx
call fcn.00402c40
add esp, 0x18
push 1
lea eax, [ebp - 0x810]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00401600
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x40cb16
push 4
push 0
lea ecx, [ebp - 0x810]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x40cb1b
jmp 0x40ca82
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00401600
push eax
mov ecx, dword [ebp + 8]
call fcn.00401600
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042364d
mov esp, ebp
pop ebp
ret

Function at 0x40cb50
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x442308]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
call fcn.00401600
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40cc18
mov dword [ebp - 8], 0
jmp 0x40cb99
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x20
jae 0x40cc18
xor ecx, ecx
mov word [ebp - 0x810], cx
push 0x7fe
push 0
lea edx, [ebp - 0x80e]
push edx
call fcn.00423660
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401600
push eax
push 0x4386c8
push 0x400
lea ecx, [ebp - 0x810]
push ecx
call fcn.00402c40
add esp, 0x14
push 1
lea edx, [ebp - 0x810]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401600
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x40cc13
push 4
push 0
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x40cc18
jmp 0x40cb90
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0042364d
mov esp, ebp
pop ebp
ret
Function at 0x40cc30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435238
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x442308]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00412080
add esp, 0xc
mov dword [ebp - 4], 0
xor edx, edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov word [ebp - 0x30], dx
mov eax, 0x614
mov word [ebp - 0x3c], ax
mov dword [ebp - 0x48], 3
lea ecx, [ebp - 0x2c]
call fcn.00401600
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401080
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042364d
mov esp, ebp
pop ebp
ret
Function at 0x41c900
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x442308]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 2
jb 0x41c95a
cmp dword [ebp - 0x11c], 6
ja 0x41c94e
cmp dword [ebp - 0x11c], 6
jne 0x41c95a
cmp dword [ebp - 0x118], 2
jb 0x41c95a
mov dword [ebp - 0x124], 1
jmp 0x41c964
mov dword [ebp - 0x124], 0
mov al, byte [ebp - 0x124]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042364d
mov esp, ebp
pop ebp
ret

Function at 0x41d170
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436c8b
mov eax, dword fs:[0]
push eax
sub esp, 0x3e4
mov eax, dword [0x442308]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3f0], ecx
lea eax, [ebp - 0x13c]
push eax
call fcn.004151c0
add esp, 4
push 0x804
lea ecx, [ebp - 0x3ac]
push ecx
call fcn.0040ddc0
add esp, 8
push eax
lea ecx, [ebp - 0x13c]
call fcn.0040dc70
movzx edx, al
test edx, edx
je 0x41d347
lea ecx, [ebp - 0x284]
call fcn.0040dbe0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov dword [ebp - 0x284], eax
push 0x804
push SysReAllocString
lea ecx, [ebp - 0x15c]
push ecx
call fcn.0040f0b0
add esp, 0xc
mov dword [ebp - 4], 0
lea edx, [ebp - 0x284]
push edx
lea eax, [ebp - 0x3b4]
push eax
lea ecx, [ebp - 0x15c]
call fcn.00410490
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x3bc]
push eax
lea ecx, [ebp - 0x15c]
call fcn.00421e90
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x144]
push eax
call fcn.00411ed0
add esp, 0x18
lea ecx, [ebp - 0x3c4]
push ecx
lea ecx, [ebp - 0x15c]
call fcn.00410490
push eax
lea ecx, [ebp - 0x144]
call fcn.00420eb0
movzx edx, al
test edx, edx
je 0x41d2ba
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x3cc], eax
mov ecx, dword [ebp - 0x140]
mov dword [ebp - 0x3c8], ecx
mov edx, dword [ebp - 0x3c8]
push edx
mov eax, dword [ebp - 0x3cc]
push eax
lea ecx, [ebp - 0x3d4]
push ecx
lea ecx, [ebp - 0x15c]
call fcn.00410670
lea edx, [ebp - 0x3e4]
push edx
lea ecx, [ebp - 0x15c]
call fcn.00421e90
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x3dc], ecx
mov dword [ebp - 0x3d8], edx
lea eax, [ebp - 0x284]
push eax
mov ecx, dword [ebp - 0x3d8]
push ecx
mov edx, dword [ebp - 0x3dc]
push edx
lea eax, [ebp - 0x3ec]
push eax
lea ecx, [ebp - 0x15c]
call fcn.00410c40
push 1
push 0x804
lea ecx, [ebp - 0x284]
push ecx
call fcn.0041c3c0
add esp, 0xc
push 0x804
push 0x804
push 1
lea edx, [ebp - 0x15c]
push edx
call fcn.0040cf10
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15c]
call fcn.00410270
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042364d
mov esp, ebp
pop ebp
ret
Function at 0x41e360
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436e8f
mov eax, dword fs:[0]
push eax
sub esp, 0x840
mov eax, dword [0x442308]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x84c], 0
push 0x438b90
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.00404120
add esp, 0xc
mov dword [ebp - 4], 1
push 0
lea ecx, [ebp - 0x30]
call fcn.00401600
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
call fcn.004235a6
add esp, 4
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x38]
call fcn.004139a0
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x40]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x30]
call fcn.00401600
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x41e447
push str.0.0.0.0
mov ecx, dword [ebp + 8]
call fcn.00401550
mov ecx, dword [ebp - 0x84c]
or ecx, 1
mov dword [ebp - 0x84c], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.00413550
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00401080
mov eax, dword [ebp + 8]
jmp 0x41e53d
mov dword [ebp - 0x34], 0
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 0x34]
push eax
push 0x438bc4
mov ecx, dword [ebp - 0x40]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41e46e
cmp dword [ebp - 0x34], 0
jne 0x41e4aa
push 0x438bc8
mov ecx, dword [ebp + 8]
call fcn.00401550
mov edx, dword [ebp - 0x84c]
or edx, 1
mov dword [ebp - 0x84c], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.00413550
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00401080
mov eax, dword [ebp + 8]
jmp 0x41e53d
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x14]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x14]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x10]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x10]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
push str._d._d._d._d
lea eax, [ebp - 0x844]
push eax
call fcn.00422f00
add esp, 0x18
lea ecx, [ebp - 0x844]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401550
mov edx, dword [ebp - 0x84c]
or edx, 1
mov dword [ebp - 0x84c], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.00413550
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00401080
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042364d
mov esp, ebp
pop ebp
ret
Function at 0x41e970
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436fbb
mov eax, dword fs:[0]
push eax
sub esp, 0x4ac
mov eax, dword [0x442308]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4b8], ecx
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.00423660
add esp, 0xc
mov ecx, dword [ebp - 0x4b8]
add ecx, 4
call fcn.00401600
push eax
push str.__s____install
push 0x104
lea edx, [ebp - 0x21c]
push edx
call fcn.00402c40
add esp, 0x10
lea eax, [ebp - 0x21c]
push eax
push 0x438f28
push 0x200
push 0x438f48
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00407220
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x41ea64
lea ecx, [ebp - 0x4b4]
push ecx
call fcn.0041dbb0
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x47c]
call fcn.00401600
push eax
push 0x438fac
push 0x200
push 0x438fd0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00407220
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4b4]
call fcn.00409560
mov eax, dword [ebp - 0x220]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042364d
mov esp, ebp
pop ebp
ret