joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487d50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
cmp dword [0x60e6fc], 0
mov dword [0x60e6f8], 0
je 0x487d6c
xor eax, eax
add esp, 0xc
ret
mov eax, 0x60e708
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x487d74
sub eax, edx
push esi
jne 0x487de9
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 1
xor esi, esi
push esi
push str.CLSIDc6f7158b_a330_474c_b76e_ecf14355aabaInprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x487dfd
lea ecx, [esp + 0xc]
push ecx
push 0x60e708
lea edx, [esp + 0x10]
push edx
push eax
push eax
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x487dda
cmp dword [esp + 8], 1
jne 0x487dda
lea esi, [eax + 1]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x487dfd
push 0x60e708
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x60e6fc], eax
jne 0x487e19
cmp dword [0x60e6f8], 0
jle 0x487e0f
mov word [0x60e6fa], 0x8007
mov eax, 0x80004005
pop esi
add esp, 0xc
ret
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x487ef0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x5828eb
mov eax, dword fs:[0]
push eax
mov eax, 0x1108
call fcn.005401e0
mov eax, dword [0x60bd28]
xor eax, esp
mov dword [esp + 0x1104], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x60bd28]
xor eax, esp
push eax
lea eax, [esp + 0x111c]
mov dword fs:[0], eax
push 0x60e6e0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, 1
mov dword [esp + 0x14], esi
xor edi, edi
cmp dword [0x60e6fc], edi
mov dword [esp + 0x1124], edi
je 0x487f60
cmp dword [0x60e700], edi
jne 0x4880bc
mov byte [esp + 0x118], 0
call fcn.00487d50
test eax, eax
jge 0x487f95
push 0x1000
push str.This_program_requires_the_file_advrcntr3.dll__which_was_not_found_on_this_system.
lea eax, [esp + 0x120]
push 0x1000
push eax
call fcn.00545017
add esp, 0x10
jmp 0x48802d
mov ebp, dword [esp + 0x1130]
mov ebx, dword [esp + 0x112c]
push ebp
push ebx
call fcn.00487e40
add esp, 8
test eax, eax
jge 0x4880bc
test bl, bl
je 0x487fea
push ebp
push 0
call fcn.00487e40
add esp, 8
test eax, eax
jl 0x487fea
mov ebp, dword [0x60e700]
add ebp, 0x14
push ebp
mov esi, 2
call fcn.00487ea0
add esp, 4
test eax, eax
je 0x487fea
mov ecx, dword [ebp]
call ecx
mov edi, eax
mov edx, dword [esp + 0x1130]
mov eax, dword [esp + 0x1138]
mov ecx, dword [esp + 0x1134]
push edx
push eax
push ecx
push edi
push 0x12c
push 0x1fe
push esi
push str.Fatal_Error:_r_nInstallation_corrupted___please_reinstall_NERO__r_n_r_nError_Code:__i____i____i____i_r_nParameters:__i____i____i_r_nSee_Doc4536
push 0x1000
lea edx, [esp + 0x13c]
push 0x1000
push edx
call fcn.005404ee
add esp, 0x2c
push 0x60e6e0
mov dword [0x60e700], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ax, word [0x5a3d48]
mov cl, byte [0x5a3d4a]
push 0xfd
lea edx, [esp + 0x1f]
push 0
push edx
mov word [esp + 0x24], ax
mov byte [esp + 0x26], cl
call fcn.0053fd60
add esp, 0xc
push 0x100
lea eax, [esp + 0x1c]
push eax
push str.NeroSuppressProxyCheck
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x488095
lea ecx, [esp + 0x18]
push ecx
call fcn.00541939
add esp, 4
test eax, eax
jne 0x4880b5
test byte [0x60e704], 1
jne 0x4880b5
push 0x10
push str.Nero
lea edx, [esp + 0x120]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x80004005
jmp 0x4880c9
push 0x60e6e0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x111c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1104]
xor ecx, esp
call fcn.0053fab2
add esp, 0x1114
ret
Function at 0x4884a8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
push dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x48852b
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [ebp - 4]
mov edi, eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.00488408
test eax, eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
je 0x488509
push 0
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectPalette]
push edi
call dword [sym.imp.GDI32.dll_RealizePalette]
mov eax, dword [ebp + 8]
push 0
push esi
lea eax, [esi + eax*4]
add eax, dword [esi]
push eax
push 4
push esi
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push edi
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x48ac14
Capabilities:
Get file version info

Disassembly:
push ebp
sub esp, 0x414
lea ebp, [esp - 4]
mov eax, dword [0x60bd28]
xor eax, ebp
mov dword [ebp + 0x414], eax
push 0x24
mov eax, 0x5837c2
call fcn.00544ba3
mov edi, dword [ebp + 0x420]
xor ebx, ebx
mov esi, 0x410
push esi
lea eax, [ebp + 1]
push ebx
mov dword [ebp - 0x20], ebx
push eax
mov byte [ebp], bl
call fcn.0053fd60
add esp, 0xc
push esi
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
mov dword [ebp - 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jne 0x48ac9f
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jne 0x48ac9f
push 0x596192
mov ecx, edi
call fcn.00402a30
jmp 0x48ad53
lea eax, [ebp - 0xd]
push eax
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 0xd], bl
call fcn.0048abca
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
call fcn.004888e2
push eax
push esi
mov dword [ebp - 0x14], eax
push ebx
lea eax, [ebp]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x48acdc
push 0x596192
mov ecx, edi
call fcn.00402a30
jmp 0x48ad4b
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x5961cc
push dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x48acce
call fcn.00512f10
push eax
lea ecx, [ebp - 0x14]
call fcn.00401270
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax + 0x14]
push ecx
movzx ecx, word [eax + 0x16]
push ecx
movzx ecx, word [eax + 0x10]
movzx eax, word [eax + 0x12]
push ecx
push eax
lea eax, [ebp - 0x14]
push str._d._d._d._d
push eax
mov byte [ebp - 4], 1
call fcn.0041b070
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.00401c70
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401040
lea ecx, [ebp - 0x30]
call fcn.004889eb
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x414]
xor ecx, ebp
call fcn.0053fab2
add ebp, 0x418
leave
ret 4
Function at 0x48c944
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x14
mov eax, 0x583ac8
call fcn.00544ba3
and dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
and dword [ebp - 0x14], 0
mov edi, ecx
push 0x596192
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], ebx
call fcn.00402a30
movzx eax, word [0x60ec88]
xor esi, esi
inc esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], eax
call fcn.005153ed
mov eax, dword [eax + 0xc]
push str.BINHELP
push dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
call fcn.005153ed
push dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
call fcn.005153ed
push dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push dword [ebp - 0x1c]
add edi, 0x68
push eax
mov ecx, edi
call fcn.0049e023
mov ecx, ebx
call fcn.00481e0c
lea eax, [ebp + 0xc]
push eax
mov ecx, edi
mov dword [ebp - 0x14], esi
call fcn.0048c894
cmp dword [eax + 0x18], 0x10
jb 0x48c9ec
mov eax, dword [eax + 4]
jmp 0x48c9ef
add eax, 4
push eax
mov ecx, ebx
call fcn.0040c470
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401040
mov eax, ebx
call fcn.00544c7b
ret 8

Function at 0x48cb93
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x48cba9
xor eax, eax
inc eax
pop esi
ret
push 7
push str.http:__
push esi
call fcn.005456da
add esp, 0xc
test eax, eax
je 0x48cba4
push 6
push str.ftp:__
push esi
call fcn.005456da
add esp, 0xc
test eax, eax
je 0x48cba4
push 5
push str.mail:
push esi
call fcn.005456da
add esp, 0xc
neg eax
sbb eax, eax
inc eax
pop esi
ret
Function at 0x48d5af
Capabilities:
Create process on windows

Disassembly:
push 0x18
mov eax, 0x583bbe
call fcn.00544ba3
push dword [ebp + 8]
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x14]
call fcn.00402a30
and dword [ebp - 4], 0
push str.mailto:
lea ecx, [ebp - 0x18]
call fcn.00402a30
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov esi, dword [eax - 0xc]
push 0
push 0x40
lea ecx, [ebp - 0x14]
call fcn.00425000
cmp eax, 0xffffffff
je 0x48d626
push esi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.00425040
push dword [ebp - 0x18]
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x1c], ebx
call fcn.00401930
test eax, eax
mov byte [ebp - 0xd], bl
jne 0x48d62a
mov byte [ebp - 0xd], 0
test byte [ebp - 0x1c], bl
mov dword [ebp - 4], ebx
je 0x48d63d
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401040
cmp byte [ebp - 0xd], 0
je 0x48d66f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00409080
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004025f0
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401040
push 5
push 0x596192
push 0
push dword [ebp - 0x14]
push str.open
push dword [ebp - 0x24]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401040
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401040
mov eax, esi
call fcn.00544c7b
ret

Function at 0x48dd24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
cmp edi, ebx
jne 0x48ddaa
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xc], esi
mov byte [ebp - 1], bl
call fcn.004852b0
lea eax, [ebp - 0xc]
push eax
push ebx
lea ecx, [ebp - 0x1c]
call fcn.004846c0
push eax
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push ebx
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.004846c0
push esi
push eax
push esi
push dword [ebp + 0x10]
call fcn.00545017
add esp, 0x10
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], ebx
call fcn.00484990
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret
Function at 0x48ddb0
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x424]
sub esp, 0x4a4
mov eax, dword [0x60bd28]
xor eax, ebp
mov dword [ebp + 0x420], eax
push esi
mov esi, dword [ebp + 0x42c]
xor eax, eax
cmp esi, eax
mov dword [ebp + 4], esi
mov dword [ebp + 8], eax
je 0x48def6
cmp dword [ebp + 0x434], eax
je 0x48ddf9
push esi
call fcn.0048d5af
pop ecx
mov dword [ebp + 8], eax
jmp 0x48def6
push ebx
push edi
mov edi, 0x410
push edi
push eax
mov byte [ebp + 0xc], al
lea eax, [ebp + 0xd]
push eax
call fcn.0053fd60
push edi
lea eax, [ebp + 0xc]
push eax
push str..htm
mov ebx, SysReAllocString
push ebx
call fcn.0048dd24
add esp, 0x1c
test eax, eax
jne 0x48deda
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str._shellopencommand
lea eax, [ebp + 0xc]
push eax
call esi
push edi
lea eax, [ebp + 0xc]
push eax
push eax
push ebx
call fcn.0048dd24
add esp, 0x10
test eax, eax
jne 0x48def4
lea eax, [ebp + 0xc]
push str.__1_
push eax
call fcn.00540823
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x48de92
lea eax, [ebp + 0xc]
push 0x59fab0
push eax
call fcn.00540823
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x48de92
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax + 0xb]
jmp 0x48de95
mov byte [edi], 0
push 0x596424
push edi
call esi
push dword [ebp + 4]
push edi
call esi
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x80]
call fcn.0048d0c4
push dword [ebp + 0x430]
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x7c]
cmp dword [ebp - 0x80], eax
je 0x48def4
push dword [ebp - 0x80]
call fcn.0054020b
pop ecx
jmp 0x48def4
push dword [ebp + 0x430]
xor eax, eax
push eax
push eax
push esi
push str.explore
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp + 8], eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x420]
mov eax, dword [ebp + 8]
xor ecx, ebp
pop esi
call fcn.0053fab2
add ebp, 0x424
leave
ret
Function at 0x492600
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5845f3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x60bd28]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x60ec94
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.tinyxml::TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x60ec94
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x596192
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.004a2aa0
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4927b0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x584648
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x60bd28]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x18], ebx
mov ebp, dword [esp + 0x2c]
xor edi, edi
cmp ebp, edi
jne 0x4927f8
push edi
push edi
push edi
push 2
call fcn.004a3560
xor al, al
jmp 0x4929ef
mov esi, dword [ebx + 0x18]
cmp esi, edi
je 0x492811
nop
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
cmp esi, edi
jne 0x492800
push 2
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], edi
or esi, 0xffffffff
push edi
push ebp
mov dword [ebx + 8], esi
mov dword [ebx + 4], esi
call fcn.00546823
push ebp
call fcn.0054672e
push 0
push 0
push ebp
mov edi, eax
call fcn.00546823
add esp, 0x1c
test edi, edi
jg 0x492858
push 0
push 0
push 0
push 0xd
mov ecx, ebx
call fcn.004a3560
xor al, al
jmp 0x4929ef
mov dword [esp + 0x14], 0x60ec94
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
call fcn.004a2a00
lea eax, [edi + 1]
push eax
call fcn.00506f37
push ebp
push 1
mov ebx, eax
push edi
push ebx
mov byte [ebx], 0
call fcn.00542d54
add esp, 0x14
cmp eax, 1
je 0x4928cb
push ebx
call fcn.00506f62
mov ecx, dword [esp + 0x1c]
add esp, 4
push 0
push 0
push 0
push 2
call fcn.004a3560
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], esi
cmp eax, 0x60ec94
je 0x4928c4
push eax
call fcn.00506f62
add esp, 4
xor al, al
jmp 0x4929ef
add edi, ebx
mov byte [edi], 0
cmp byte [ebx], 0
mov ebp, ebx
mov esi, ebx
je 0x492993
lea ecx, [ecx]
cmp esi, edi
jb 0x4928fb
push 0x410
push 0x5a4968
push str.p____buflength_
call fcn.00545a75
add esp, 0xc
mov al, byte [esi]
cmp al, 0xa
jne 0x492923
mov ecx, esi
sub ecx, ebp
add ecx, 1
push ecx
push ebp
lea ecx, [esp + 0x1c]
call fcn.004a2b90
add esi, 1
cmp esi, edi
mov ebp, esi
jbe 0x49298a
push 0x417
jmp 0x492973
cmp al, 0xd
jne 0x492987
mov eax, esi
sub eax, ebp
test eax, eax
jle 0x49293a
push eax
push ebp
lea ecx, [esp + 0x1c]
call fcn.004a2b90
push 1
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 0xa
call fcn.004a2b90
cmp byte [esi + 1], 0xa
jne 0x492965
add esi, 2
cmp esi, edi
mov ebp, esi
jbe 0x49298a
push 0x425
jmp 0x492973
add esi, 1
cmp esi, edi
mov ebp, esi
jbe 0x49298a
push 0x42b
push 0x5a4968
push 0x5a4bf8
call fcn.00545a75
add esp, 0xc
jmp 0x49298a
add esi, 1
cmp byte [esi], 0
jne 0x4928e0
sub esi, ebp
je 0x4929a2
push esi
push ebp
lea ecx, [esp + 0x1c]
call fcn.004a2b90
push ebx
call fcn.00506f62
mov ecx, dword [esp + 0x34]
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esi]
mov eax, dword [eax + 8]
add esp, 4
push ecx
push 0
add edx, 8
push edx
mov ecx, esi
call eax
cmp byte [esi + 0x2c], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], 0xffffffff
jne 0x4928b4
cmp eax, 0x60ec94
je 0x4929ed
push eax
call fcn.00506f62
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x4994b3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call fcn.005153ed
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push dword [ebp + 8]
mov dword [ebp - 8], esi
push esi
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x4994e3
xor al, al
jmp 0x499564
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4994f6
xor al, al
jmp 0x499563
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
test eax, eax
je 0x499509
push eax
call fcn.00506f62
and dword [esi], 0
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp + 8], eax
je 0x499560
cmp dword [esi], 0
mov edi, dword [ebp + 0x14]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SizeofResource]
jne 0x499530
push dword [ebp + 0xc]
push dword [ebp - 8]
call ebx
mov dword [edi], eax
mov eax, dword [edi]
test eax, eax
je 0x49955f
push eax
call fcn.00506f67
pop ecx
push dword [ebp + 0xc]
mov dword [esi], eax
push dword [ebp - 8]
mov edi, dword [edi]
call ebx
cmp edi, eax
jl 0x49955f
push edi
push dword [ebp + 8]
push dword [esi]
call fcn.0053fde0
add esp, 0xc
mov byte [ebp - 1], 1
pop ebx
mov al, byte [ebp - 1]
pop edi
pop esi
leave
ret 0x10

Function at 0x49e795
Capabilities:
Get common file path

Disassembly:
push 8
mov eax, 0x58568c
call fcn.00544ba3
mov esi, ecx
mov dword [ebp - 0x14], esi
call fcn.0050d37d
xor edi, edi
mov dword [esi], vtable.CXHTMLStatic.0
mov dword [ebp - 4], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x6c], vtable.CFont.0
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 1
call fcn.00534d74
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 2
call fcn.005167d7
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push 0xf
mov byte [ebp - 4], 3
call ebx
push 8
mov dword [esi + 0x54], eax
call ebx
push 0xffffffffffffffff
push edi
lea ecx, [esi + 0x78]
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0x74], edi
call fcn.00534d9b
push 0xffffffffffffffff
push edi
lea ecx, [esi + 0x8c]
call fcn.005168b9
call fcn.00512f10
push eax
lea ecx, [ebp - 0x10]
call fcn.00401270
push 0x410
push 0x411
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.00401c90
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004268e0
push str.winhlp32.exe
lea ecx, [ebp - 0x10]
call fcn.00409140
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, edi
je 0x49e89e
push 0x6a
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
cmp eax, edi
je 0x49e89e
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [esi + 0xa8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401040
mov eax, esi
call fcn.00544c7b
ret
Function at 0x4a0473
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x4a11c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
jne 0x4a11d1
call fcn.004a1150
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x18], 0x10
jb 0x4a11e0
mov eax, dword [eax + 4]
jmp 0x4a11e3
add eax, 4
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push 0
push edx
push 0
push eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop esi
je 0x4a121f
push 0x50000
push eax
lea ecx, [esp + 8]
call fcn.00494a70
push 0x5dd43c
lea ecx, [esp + 4]
push ecx
call fcn.00541706
add esp, 0x14
ret 0xc

Function at 0x4a1310
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
jne 0x4a1321
call fcn.004a1150
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x18], 0x10
jb 0x4a1330
mov eax, dword [eax + 4]
jmp 0x4a1333
add eax, 4
mov edx, dword [esi + 0x1c]
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop esi
je 0x4a136c
push 0x50000
push eax
lea ecx, [esp + 8]
call fcn.00494a70
push 0x5dd43c
lea eax, [esp + 4]
push eax
call fcn.00541706
add esp, 0x14
ret 8

Function at 0x4a1380
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
jne 0x4a1391
call fcn.004a1150
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x18], 0x10
jb 0x4a13a0
mov eax, dword [eax + 4]
jmp 0x4a13a3
add eax, 4
mov edx, dword [esi + 0x1c]
push 8
lea ecx, [esp + 0x24]
push ecx
push 0xb
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop esi
je 0x4a13dc
push 0x50000
push eax
lea ecx, [esp + 8]
call fcn.00494a70
push 0x5dd43c
lea eax, [esp + 4]
push eax
call fcn.00541706
add esp, 0x14
ret 0xc

Function at 0x4a13f0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
jne 0x4a1401
call fcn.004a1150
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 0x14]
add eax, 1
cmp dword [ecx + 0x18], 0x10
jb 0x4a1416
mov ecx, dword [ecx + 4]
jmp 0x4a1419
add ecx, 4
mov edx, dword [esp + 0x1c]
cmp dword [edx + 0x18], 0x10
jb 0x4a1428
mov edx, dword [edx + 4]
jmp 0x4a142b
add edx, 4
push eax
mov eax, dword [esi + 0x1c]
push ecx
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop esi
je 0x4a145f
push 0x50000
push eax
lea ecx, [esp + 8]
call fcn.00494a70
push 0x5dd43c
lea ecx, [esp + 4]
push ecx
call fcn.00541706
add esp, 0x14
ret 8

Function at 0x4a1470
Capabilities:
Set registry value

Disassembly:
cmp byte [esp + 8], 0
je 0x4a1484
mov dword [esp + 8], 1
jmp fcn.004a1310
mov dword [esp + 8], 0
jmp fcn.004a1310