joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404300
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2028
call fcn.0047c9d0
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x404321
xor eax, eax
jmp 0x4043a0
push 0x1e
push 0
lea eax, [ebp - 0x2028]
push eax
call fcn.004a8eb0
add esp, 0xc
mov dword [ebp - 0x2008], 0x1000
mov dword [ebp - 0x2024], 3
push 0x2000
push 0
lea ecx, [ebp - 0x2004]
push ecx
call fcn.004a8eb0
add esp, 0xc
push 0x1000
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x2004]
push eax
call fcn.004c6dd2
add esp, 0xc
lea ecx, [ebp - 0x2004]
mov dword [ebp - 0x2020], ecx
mov edx, 0x614
mov word [ebp - 0x2018], dx
lea eax, [ebp - 0x2028]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
Function at 0x404930
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x404952
mov eax, 1
jmp 0x4049c1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x404967
mov eax, 1
jmp 0x4049c1
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40498f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40498f
mov eax, 1
jmp 0x4049c1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4049bf
mov edx, dword [ebp - 4]
and edx, 0x10
je 0x4049bf
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x4049bf
mov eax, 1
jmp 0x4049c1
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4049d0
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x404a08
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x52da4c
call fcn.0043c160
add esp, 0xc
mov eax, 1
jmp 0x404a6d
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x404a1d
mov eax, 1
jmp 0x404a6d
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x404a5d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x404a5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp + 8]
push edx
push str.delete__s_failed__error_d
call fcn.0043c160
add esp, 0xc
mov eax, 1
jmp 0x404a6d
push 4
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x404a80
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51dadf
mov eax, dword fs:[0]
push eax
sub esp, 0x88c
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
jne 0x404ab8
xor eax, eax
jmp 0x404c64
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x404ac9
xor eax, eax
jmp 0x404c64
mov edx, dword [ebp + 8]
push edx
call fcn.004c6518
add esp, 4
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 0x104
jl 0x404aee
xor eax, eax
jmp 0x404c64
push 0x410
push 0
lea eax, [ebp - 0x420]
push eax
call fcn.004a8eb0
add esp, 0xc
push 0x52dabc
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x888], eax
cmp dword [ebp - 0x888], 0xffffffff
je 0x404b5e
mov ecx, dword [ebp - 0x888]
and ecx, 1
je 0x404b5e
mov edx, dword [ebp - 0x888]
and edx, 0xfffffffe
mov dword [ebp - 0x888], edx
mov eax, dword [ebp - 0x888]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x884]
call fcn.00405390
mov dword [ebp - 4], 0
lea edx, [ebp - 0x420]
push edx
lea ecx, [ebp - 0x884]
call fcn.00405f00
mov dword [ebp - 0x88c], eax
cmp dword [ebp - 0x88c], 0
je 0x404c2b
lea ecx, [ebp - 0x884]
call fcn.00406720
test eax, eax
je 0x404bb7
lea ecx, [ebp - 0x884]
call fcn.00406060
mov dword [ebp - 0x88c], eax
jmp 0x404b88
lea eax, [ebp - 0x890]
push eax
lea ecx, [ebp - 0x884]
call fcn.00406380
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x884]
call fcn.00406700
test eax, eax
je 0x404bf2
lea ecx, [ebp - 0x890]
call fcn.00405660
push eax
call fcn.00404a80
add esp, 4
jmp 0x404c06
lea ecx, [ebp - 0x890]
call fcn.00405660
push eax
call fcn.004049d0
add esp, 4
lea ecx, [ebp - 0x884]
call fcn.00406060
mov dword [ebp - 0x88c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x890]
call fcn.00405480
jmp 0x404b88
lea ecx, [ebp - 0x884]
call fcn.00405da0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00404300
add esp, 4
mov dword [ebp - 0x898], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x884]
call fcn.004054b0
mov eax, dword [ebp - 0x898]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
Function at 0x4065a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1110
call fcn.0047c9d0
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
call fcn.00406530
cmp eax, 0x104
jle 0x4065cd
xor eax, eax
jmp 0x4066f1
mov dword [ebp - 0x110c], 0x400
push 0x800
push 0
lea eax, [ebp - 0x1104]
push eax
call fcn.004a8eb0
add esp, 0xc
push 0x800
push 0
lea ecx, [ebp - 0x904]
push ecx
call fcn.004a8eb0
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.00405660
push eax
lea edx, [ebp - 0x1104]
push edx
call fcn.004051a0
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x40663c
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax]
test ecx, ecx
je 0x40663c
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x1104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [ebp - 0x1110], 0xa
push 0x100
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.004a8eb0
add esp, 0xc
mov dword [ebp - 0x1108], 0
jmp 0x406677
mov edx, dword [ebp - 0x1108]
add edx, 1
mov dword [ebp - 0x1108], edx
cmp dword [ebp - 0x1108], 0xa
jge 0x4066ef
push 0x80
lea eax, [ebp - 0x104]
push eax
call fcn.00406910
add esp, 8
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x1104]
push edx
lea eax, [ebp - 0x904]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str..tmp
lea ecx, [ebp - 0x904]
push ecx
call fcn.00405180
add esp, 8
lea edx, [ebp - 0x904]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4066ea
lea eax, [ebp - 0x904]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00405600
mov eax, 1
jmp 0x4066f1
jmp 0x406668
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret

Function at 0x406fe0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x407004
xor eax, eax
jmp 0x407084
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40701b
xor eax, eax
jmp 0x407084
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x407067
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x407067
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x40703e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x407073
xor eax, eax
jmp 0x407084
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x407081
xor eax, eax
jmp 0x407084
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40abf0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40ac74
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40ac4b
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x14], 0
je 0x40ac42
push 0
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, 1
jmp 0x40ac76
mov edx, dword [ebp - 8]
add edx, 0x10
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.0040cda0
mov ecx, dword [ebp - 8]
add ecx, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40ade0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x40ae2a
jmp 0x40af03
push 0x22c
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.004a8eb0
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x40ae73
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40af03
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x244], 0
mov ecx, dword [ebp - 0x23c]
cmp ecx, dword [ebp - 0x228]
je 0x40aedf
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.004c72b0
add esp, 8
test eax, eax
jne 0x40aedf
mov ecx, dword [ebp - 0x228]
push ecx
mov ecx, dword [ebp - 0x240]
call fcn.0040af20
test eax, eax
je 0x40aedf
mov edx, dword [ebp - 0x228]
mov dword [ebp - 0x238], edx
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040cd80
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40ae89
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret 8
Function at 0x413140
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x130], ecx
cmp dword [section..data], 0
jl 0x41318c
cmp dword [section..data], 0
je 0x413177
mov dword [ebp - 0x124], 1
jmp 0x413181
mov dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x124]
jmp 0x41326a
mov dword [section..data], 0
push 0x24
push 0
lea eax, [ebp - 0x154]
push eax
call fcn.004a8eb0
add esp, 0xc
push 0x11c
push 0
lea ecx, [ebp - 0x120]
push ecx
call fcn.004a8eb0
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x413204
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x413204
xor eax, eax
jmp 0x41326a
push 0x52ddf0
push 0x52de04
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x413239
lea ecx, [ebp - 0x154]
push ecx
call dword [ebp - 0x128]
jmp 0x41323d
xor eax, eax
jmp 0x41326a
movzx edx, word [ebp - 0x154]
cmp edx, 9
je 0x413255
movzx eax, word [ebp - 0x154]
cmp eax, 6
jne 0x413268
mov dword [section..data], 1
mov eax, 1
jmp 0x41326a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
Function at 0x418700
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4014
call fcn.0047c9d0
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x52e080]
mov word [ebp - 0x4004], ax
push 0x3ffe
push 0
lea ecx, [ebp - 0x4002]
push ecx
call fcn.004a8eb0
add esp, 0xc
mov dword [ebp - 0x4008], 0
mov dword [ebp - 0x4010], 0
cmp dword [ebp + 0xc], 0
je 0x41875a
cmp dword [ebp + 0x10], 0
jne 0x418761
xor eax, eax
jmp 0x418862
lea edx, [ebp - 0x4010]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x4008], eax
cmp dword [ebp - 0x4008], 0
je 0x41878c
cmp dword [ebp - 0x4008], 0x3fff
jbe 0x418793
xor eax, eax
jmp 0x418862
lea ecx, [ebp - 0x4004]
push ecx
mov edx, dword [ebp - 0x4008]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x418860
lea ecx, [ebp - 0x4014]
push ecx
lea edx, [ebp - 0x400c]
push edx
push 0x52e084
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x418860
mov ecx, dword [ebp + 0x14]
shl ecx, 1
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
call fcn.004a8eb0
add esp, 0xc
mov eax, dword [ebp - 0x400c]
mov ecx, dword [eax + 0xc]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x400c]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x400c]
mov ecx, dword [eax + 8]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x400c]
mov ecx, dword [eax + 8]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
push 0x52e088
mov eax, dword [ebp + 0x14]
sub eax, 1
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00419b00
add esp, 0x1c
mov eax, 1
jmp 0x418862
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret 0x10

Function at 0x418880
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x4188b3
mov ecx, dword [ebp - 4]
and ecx, 2
jne 0x4188ac
mov edx, dword [ebp - 4]
and edx, 1
jne 0x4188ac
mov eax, dword [ebp - 4]
and eax, 4
je 0x4188b3
mov eax, 1
jmp 0x4188c1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [edx + 0xc]
call ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x418bc0
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ea5a
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x424], 0
cmp dword [ebp + 8], 0
je 0x418c95
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x418c95
cmp dword [ebp + 0xc], 0
je 0x418c26
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
test eax, eax
jne 0x418c74
push 0x410
push 0
lea ecx, [ebp - 0x420]
push ecx
call fcn.004a8eb0
add esp, 0xc
push 0
push 0
push 0x104
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
jl 0x418c72
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x424], 1
jmp 0x418c95
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
jl 0x418c95
mov dword [ebp - 0x424], 1
lea ecx, [ebp + 0x10]
call fcn.004193e0
movzx ecx, al
test ecx, ecx
je 0x418cb3
mov edx, dword [ebp - 0x424]
push edx
lea ecx, [ebp + 0x10]
call fcn.00419410
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x428], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00419320
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret 0x30
Function at 0x418cf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x570374]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], ecx
mov ecx, dword [ebp - 0x418]
add ecx, 8
call fcn.004067b0
movzx eax, al
test eax, eax
je 0x418d5b
push 0x104
push 0x104
mov ecx, dword [ebp - 0x418]
add ecx, 8
call fcn.00415e50
push eax
mov ecx, dword [ebp - 0x418]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x418]
push eax
mov ecx, dword [edx + 0x14]
call ecx
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x418]
add ecx, 8
call fcn.00416050
mov ecx, dword [ebp - 0x418]
add ecx, 0x18
call fcn.004067b0
movzx edx, al
test edx, edx
je 0x418da1
push 0x104
push 0x104
mov ecx, dword [ebp - 0x418]
add ecx, 0x18
call fcn.00415e50
push eax
call fcn.00419610
add esp, 8
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x418]
add ecx, 0x18
call fcn.00416050
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.004067b0
movzx eax, al
test eax, eax
je 0x418e47
push 0x208
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004a8eb0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x52de50
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x104
push 0x104
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.00415e50
push eax
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x418]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x418]
push edx
mov eax, dword [ecx + 4]
call eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x418]
add ecx, 4
call fcn.00416050
mov ecx, dword [ebp - 0x418]
add ecx, 0x10
call fcn.004067b0
movzx ecx, al
test ecx, ecx
je 0x418eb7
mov dword [ebp - 0x41c], 0x104
mov dword [ebp - 0x420], 1
lea edx, [ebp - 0x41c]
push edx
push 0x104
mov ecx, dword [ebp - 0x418]
add ecx, 0x10
call fcn.00415e50
push eax
lea eax, [ebp - 0x420]
push eax
push 0x52de70
push 0x52de78
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x418]
add ecx, 0x10
call fcn.00416050
mov ecx, dword [ebp - 0x418]
add ecx, 0x14
call fcn.004067b0
movzx ecx, al
test ecx, ecx
je 0x418f3a
push 0x208
push 0
lea edx, [ebp - 0x414]
push edx
call fcn.004a8eb0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
push 0x104
mov ecx, dword [ebp - 0x418]
add ecx, 0x14
call fcn.00415e50
push eax
lea ecx, [ebp - 0x414]
push ecx
mov edx, dword [ebp - 0x418]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x418]
push ecx
mov edx, dword [eax + 4]
call edx
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x418]
add ecx, 0x14
call fcn.00416050
mov ecx, dword [ebp - 0x418]
add ecx, 0x1c
call fcn.004067b0
movzx eax, al
test eax, eax
je 0x418f62
push 0x52de9c
mov ecx, dword [ebp - 0x418]
add ecx, 0x1c
call fcn.00405600
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047c5a8
mov esp, ebp
pop ebp
ret
Function at 0x4198a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.00419660
test eax, eax
je 0x4198b7
xor eax, eax
jmp 0x4198f5
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
jne 0x4198c4
xor eax, eax
jmp 0x4198f5
mov ecx, dword [ebp - 4]
add ecx, 8
push ecx
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
push 0
push 0
call fcn.004c9b78
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 4]
call fcn.00419660
mov esp, ebp
pop ebp
ret

Function at 0x41c840
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x41c8fd
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x41c873
xor eax, eax
jmp 0x41c92b
push 0x52e3e4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
push 0x52e3f0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
push 0x52e3fc
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
push 0x52e40c
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
push 0x52e41c
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x41c8fd
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
call ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x41c921
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
je 0x41c921
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
je 0x41c921
mov dword [ebp - 8], 1
jmp 0x41c928
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4