joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a6a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401aa9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401aa9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401aa9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401aa9
cmp dword [ecx + 0x74], 0xe
jbe 0x401aa9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40ab80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40abad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40abad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4017ed
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 8]
call fcn.00401720
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
cmp dword [ebp - 8], 0
je 0x401822
push dword [ebp - 8]
call fcn.00404c8d
pop ecx
mov al, bl
pop ebx
leave
ret

Function at 0x401843
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor esi, esi
lea eax, [ebp - 0x10]
mov edi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call fcn.00401720
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 2
push esi
push esi
push esi
push dword [ebp - 0x10]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x401890
cmp dword [ebp - 0x10], esi
je 0x40188c
push dword [ebp - 0x10]
call fcn.00404c8d
pop ecx
xor al, al
jmp 0x4018d1
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
call fcn.00401720
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push esi
push dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], esi
je 0x4018cf
push dword [ebp - 0x10]
call fcn.00404c8d
pop ecx
mov al, bl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4018d6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor esi, esi
lea eax, [ebp - 0x10]
mov edi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call fcn.00401720
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 2
push esi
push esi
push esi
push dword [ebp - 0x10]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x401923
cmp dword [ebp - 0x10], esi
je 0x40191f
push dword [ebp - 0x10]
call fcn.00404c8d
pop ecx
xor al, al
jmp 0x401986
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
call fcn.00401720
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.00401720
mov eax, dword [ebp - 0x14]
add eax, eax
push eax
push dword [ebp - 0x18]
push 1
push esi
push dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], esi
je 0x401976
push dword [ebp - 0x18]
call fcn.00404c8d
pop ecx
cmp dword [ebp - 0x10], esi
je 0x401984
push dword [ebp - 0x10]
call fcn.00404c8d
pop ecx
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401a38
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
xor esi, esi
push edi
lea eax, [ebp - 0xc]
mov edi, ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.00401720
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
call fcn.00401720
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x50]
push esi
push eax
call fcn.00408f60
mov ebx, dword [ebp - 0xc]
add esp, 0xc
mov dword [ebp - 0x50], edi
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x4c], 0x44c
mov dword [ebp - 0x44], 0x418520
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x48], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x401ac7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
cmp edi, esi
je 0x401ab7
push edi
call fcn.00404c8d
pop ecx
cmp ebx, esi
je 0x401ac2
push ebx
call fcn.00404c8d
pop ecx
mov eax, dword [ebp - 8]
jmp 0x401adf
cmp edi, esi
je 0x401ad2
push edi
call fcn.00404c8d
pop ecx
cmp ebx, esi
je 0x401add
push ebx
call fcn.00404c8d
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404944
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b2e4]
jne 0x40494e
repz ret
jmp fcn.00408ccf

Function at 0x410676
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a34a
and dword [ebp - 4], 0
cmp dword [0x41d390], 0
mov ebx, eax
jne 0x410727
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4107d8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4107d8
push eax
call fcn.0040a2d8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41d390], eax
call esi
push eax
call fcn.0040a2d8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41d394], eax
call esi
push eax
call fcn.0040a2d8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41d398], eax
call esi
push eax
call fcn.0040a2d8
pop ecx
mov dword [0x41d3a0], eax
test eax, eax
je 0x410727
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040a2d8
pop ecx
mov dword [0x41d39c], eax
mov eax, dword [0x41d39c]
cmp eax, ebx
je 0x41077f
cmp dword [0x41d3a0], ebx
je 0x41077f
push eax
call fcn.0040a353
push dword [0x41d3a0]
mov esi, eax
call fcn.0040a353
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41077f
test edi, edi
je 0x41077f
call esi
test eax, eax
je 0x410776
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x410776
test byte [ebp - 0xc], 1
jne 0x41077f
or dword [ebp + 0x10], 0x200000
jmp 0x4107b8
mov eax, dword [0x41d394]
cmp eax, ebx
je 0x4107b8
push eax
call fcn.0040a353
pop ecx
test eax, eax
je 0x4107b8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4107b8
mov eax, dword [0x41d398]
cmp eax, ebx
je 0x4107b8
push eax
call fcn.0040a353
pop ecx
test eax, eax
je 0x4107b8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41d390]
call fcn.0040a353
pop ecx
test eax, eax
je 0x4107d8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4107da
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4024ad
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x40aa8c]
xor eax, dword [ebp + 4]
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
mov dword [ebp - 4], eax
xor eax, eax
push 0x80000000
push dword [ebp + 8]
inc eax
mov esi, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], ebx
mov dword [esi + 0x9cc], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x402504
mov ecx, esi
call fcn.004039de
xor eax, eax
jmp 0x402680
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
mov dword [ebp + 8], eax
je 0x402531
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x402549
push ebx
push ebx
push 0x804
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x14], ebx
jmp 0x40262e
push ebx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40261d
cmp dword [ebp - 8], ebx
je 0x40261d
mov eax, dword [ebp - 0x18]
cmp word [eax], 0xfeff
jne 0x4025e0
add eax, 2
sub dword [ebp - 8], 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp + 8], eax
je 0x4025a0
push dword [ebp + 8]
mov ecx, esi
push dword [ebp - 0xc]
call fcn.00401aad
sub dword [ebp + 8], eax
add dword [ebp - 0xc], eax
cmp dword [ebp + 8], ebx
jne 0x402588
push 1
mov ecx, esi
call fcn.004037de
push 0x103
push ebx
push ebx
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_RedrawWindow]
mov eax, dword [esi + 0x9a4]
sub eax, ebx
mov ecx, esi
je 0x4025d8
dec eax
je 0x4025cf
call fcn.004051d9
jmp 0x40261d
push 1
call fcn.0040505c
jmp 0x40261d
push ebx
call fcn.00404eec
jmp 0x40261d
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x214
push dword [esi]
call edi
push 0x80
lea eax, [ebp - 0x158]
push eax
push 0x223
push dword [esi]
call edi
push 0x2000
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x158]
push eax
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x9cc], ebx
jne 0x40267c
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x214
push dword [esi]
call edi
push 0x80
lea eax, [ebp - 0x158]
push eax
push 0x228
push dword [esi]
call edi
push 0x2000
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x158]
push eax
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x14]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.00407e22
leave
ret 4
Function at 0x402a5f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x40aa8c]
xor eax, dword [ebp + 4]
push esi
mov esi, ecx
mov dword [ebp - 4], eax
mov eax, dword [esi + 8]
cmp dword [eax], 0x52455355
jne 0x402af8
push 4
pop edx
add eax, edx
cmp dword [eax], 0x41524850
jne 0x402af8
add eax, edx
mov ecx, dword [eax]
push ebx
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x14]
push edi
add eax, edx
mov edi, ecx
mov dword [ebp - 8], 0x20
mov dword [ebp - 0xc], 0x8c
mov ebx, dword [eax]
mov dword [edi], ebx
add eax, edx
add edi, edx
dec dword [ebp - 8]
jne 0x402aac
mov edi, dword [ebp - 0xc]
mov eax, ecx
push 0xfffffffffffffff4
pop ecx
sub ecx, esi
mov dword [ebp - 8], 0x20
lea ebx, [ecx + eax]
imul ebx, dword [eax]
mov dword [eax + 0x80], edi
add edi, ebx
add eax, edx
dec dword [ebp - 8]
jne 0x402aca
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, esi
mov edi, eax
call fcn.00402a0d
cmp edi, eax
pop edi
pop ebx
je 0x402b47
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x20
lea eax, [ebp - 0x4c]
push eax
push 0x214
push dword [0x40a050]
call esi
push 0x40
lea eax, [ebp - 0xcc]
push eax
push 0x219
push dword [0x40a050]
call esi
push 0x2000
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [0x40a060]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x402b4a
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
call fcn.00407e22
leave
ret

Function at 0x403e8f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x40aa8c]
xor eax, dword [ebp + 4]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
push 0x14
mov esi, ecx
push 0xd
push dword [esi + 0x44]
call dword [sym.imp.USER32.dll_SendMessageW]
add eax, eax
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 9
push dword [esi + 0x990]
mov ecx, 0x40aa2c
call fcn.00407b3c
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
call fcn.00407e22
leave
ret
Function at 0x4041b4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x40aa8c]
xor eax, dword [ebp + 4]
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 0x9a4]
and dword [esi + 0x9a0], 0xfffffffb
dec edi
dec edi
push edi
push dword [esi + 0x9a8]
mov dword [ebp - 4], eax
call fcn.00402e79
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
push 0x14
push 0xd
push dword [esi + 0x44]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x40aa44]
test eax, eax
je 0x40420e
push 0
lea ecx, [ebp - 0x30]
push ecx
call eax
mov dword [ebp - 8], eax
jmp 0x404212
and dword [ebp - 8], 0
cmp word [ebp - 8], 0
jne 0x404223
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x404272
cmp bx, word [ebp - 8]
je 0x404272
push dword [esi + 0x9a8]
mov ecx, esi
call fcn.00403046
mov ebx, 0x10000
push ebx
push dword [esi + 0x9a8]
mov ecx, esi
call fcn.00402ede
push dword [ebp - 8]
mov ecx, esi
push edi
push dword [esi + 0x9a8]
call fcn.00402f24
push 0x80000
push dword [esi + 0x9a8]
mov ecx, esi
call fcn.00402ec7
or dword [esi + 0x9a0], ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.00407e22
leave
ret
Function at 0x404eec
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x9a8]
mov ecx, dword [esi + 0x64]
and dword [esi + 0x9a0], 0xfffffff8
xor ebp, ebp
inc ebp
cmp eax, ecx
push edi
mov dword [esp + 0xc], ebp
jb 0x404f26
and dword [esi + 0x9a4], 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
and dword [esp + 0xc], 0
jmp 0x40502d
test byte [esp + 0x14], 4
push ebx
je 0x404fa2
xor ebx, ebx
cmp dword [esi + 0x99c], ebx
mov ecx, esi
jne 0x404f45
push 0x100000
push eax
jmp 0x405021
call fcn.0040403e
mov ebp, dword [esi + 0x9a8]
mov ecx, eax
cmp ecx, ebp
mov dword [esp + 0x18], ecx
jbe 0x404f62
mov eax, ebp
mov ebp, ecx
mov dword [esp + 0x18], eax
mov eax, ebp
sub eax, dword [esp + 0x18]
inc eax
cmp dword [esi + 0x64], ebx
mov dword [esi + 0x99c], eax
jbe 0x40502c
mov edi, 0x100000
cmp ebx, dword [esp + 0x18]
push edi
mov ecx, esi
push ebx
jae 0x404f8e
call fcn.00402ede
jmp 0x404f97
cmp ebx, ebp
ja 0x404f87
call fcn.00402ec7
inc ebx
cmp ebx, dword [esi + 0x64]
jb 0x404f7d
jmp 0x40502c
test byte [esp + 0x18], 8
je 0x404fe3
push eax
mov ecx, esi
call fcn.00402e53
mov edi, 0x100000
test edi, eax
mov ecx, esi
push edi
je 0x404fd0
push dword [esi + 0x9ac]
call fcn.00402ede
dec dword [esi + 0x99c]
jmp 0x40502c
push dword [esi + 0x9a8]
call fcn.00402ec7
inc dword [esi + 0x99c]
jmp 0x40502c
xor ebx, ebx
test ecx, ecx
mov edi, 0x100000
jbe 0x405018
cmp dword [esi + 0x99c], 0
je 0x405018
push ebx
mov ecx, esi
call fcn.00402e53
test edi, eax
je 0x405012
push edi
push ebx
mov ecx, esi
call fcn.00402ede
dec dword [esi + 0x99c]
inc ebx
cmp ebx, dword [esi + 0x64]
jb 0x404fee
push edi
push dword [esi + 0x9a8]
mov ecx, esi
mov dword [esi + 0x99c], ebp
call fcn.00402ec7
pop ebx
mov ecx, esi
call fcn.004040c6
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetFocus]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x40]
call edi
push 0
push dword [esi + 0x44]
call edi
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 4
Function at 0x406481
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov esi, ecx
push 0
push dword [esi + 0x40]
call edi
push 0
push dword [esi + 0x44]
call edi
push 0
push 0x40607b
push dword [esi + 0x10]
push 0x300
push dword [esi]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
ret

Function at 0x4064ff
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x9a0]
test al, 4
push edi
je 0x406514
call fcn.004041b4
jmp 0x40651f
test al, 3
je 0x40651f
mov ecx, esi
call fcn.00405ce1
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x40]
call edi
push 0
push dword [esi + 0x44]
call edi
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetFocus]
push 0x103
push 0
push 0
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
pop esi
ret

Function at 0x40676d
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x40aa8c]
xor eax, dword [ebp + 4]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x20019
xor edi, edi
push edi
push 0x401438
mov esi, 0x208
push 0x80000002
mov ebx, ecx
mov dword [ebp - 0xc], esi
mov word [ebp - 0x214], di
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4067d9
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push edi
push 0x401414
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x214], di
jne 0x40682a
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0x4013f4
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x406804
mov word [ebp - 0x214], di
cmp word [ebp - 0x214], di
jne 0x40682a
mov edi, 0x4013d8
push edi
push 0x4013d0
lea eax, [ebp - 0x624]
push esi
push eax
call fcn.004020cf
add esp, 0x10
jmp 0x406851
mov edi, 0x4013d8
push edi
push 0x401380
lea eax, [ebp - 0x214]
push eax
push 0x40136c
lea eax, [ebp - 0x624]
push esi
push eax
call fcn.004020cf
add esp, 0x18
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea eax, [ebp - 0x624]
push eax
call esi
test eax, eax
mov dword [ebx + 4], eax
jne 0x40686d
push edi
call esi
mov dword [ebx + 4], eax
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebx + 4], eax
pop edi
setne al
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.00407e22
leave
ret
Function at 0x4071df
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x40aa8c]
xor eax, dword [ebp + 4]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov esi, ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x407235
cmp dword [ebp - 0x114], 5
jb 0x407235
push 0x2000
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40725e
mov eax, dword [ebp + 0x10]
push 0
push 0x407175
push dword [ebp + 8]
mov dword [esi + 0x9c4], eax
mov eax, dword [ebp + 0xc]
push 0x302
push dword [esi]
mov dword [esi + 0x9c8], eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
call fcn.00407e22
leave
ret 0xc
Function at 0x407ba2
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b0
mov eax, dword [0x40aa8c]
xor eax, dword [ebp + 4]
and word [ebp - 0x2a8], 0
and word [ebp - 0x4b0], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
mov dword [ebp - 4], eax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x4b0]
push eax
mov dword [ebp - 0xc], ecx
call esi
mov edi, 0x401638
push edi
push ebx
lea eax, [ebp - 0x4b0]
push eax
call fcn.00407b54
push ebx
push ebx
lea eax, [ebp - 0x4b0]
push eax
call fcn.00402117
lea eax, [ebp + eax*2 - 0x4b0]
push eax
push dword [ebp + 8]
call sub.IMM32.dll_ImmGetIMEFileNameW
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push ebx
lea eax, [ebp - 0x2a8]
push eax
call esi
push edi
push ebx
lea eax, [ebp - 0x2a8]
push eax
call fcn.00407b54
push 0x23
pop ecx
mov esi, 0x4015a8
lea edi, [ebp - 0xa0]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 8]
push eax
movsw word es:[edi], word [esi]
push 0x20019
xor edi, edi
push edi
lea eax, [ebp - 0xa0]
push eax
push 0x80000002
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407db3
push ebx
lea eax, [ebp - 0x2a8]
push eax
call fcn.00402117
sub ebx, eax
lea ecx, [ebp - 0x10]
push ecx
lea eax, [ebp + eax*2 - 0x2a8]
push eax
push edi
push edi
push 0x401584
push dword [ebp - 8]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407c9c
inc esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x407db3
mov esi, dword [ebp + 0xc]
cmp dword [esi], edi
je 0x407cce
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x2a8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x407cce
mov dword [esi], edi
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x2a8]
push eax
mov ecx, esi
call fcn.0040175d
test eax, eax
je 0x407db3
push 0x401570
mov ecx, esi
call fcn.00401788
push 0x40155c
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00401788
push 0x401540
mov ecx, esi
mov dword [esi + 0xc], eax
call fcn.00401788
push 0x40152c
mov ecx, esi
mov dword [esi + 0x10], eax
call fcn.00401788
push 0x401514
mov ecx, esi
mov dword [esi + 0x14], eax
call fcn.00401788
push 0x4014fc
mov ecx, esi
mov dword [esi + 0x18], eax
call fcn.00401788
push 0x4014e8
mov ecx, esi
mov dword [esi + 0x1c], eax
call fcn.00401788
push 0x4014d8
mov ecx, esi
mov dword [esi + 0x20], eax
call fcn.00401788
push 0x4014c4
mov ecx, esi
mov dword [esi + 0x24], eax
call fcn.00401788
push 0x4014b0
mov ecx, esi
mov dword [esi + 0x28], eax
call fcn.00401788
cmp dword [esi + 8], edi
mov dword [esi + 0x2c], eax
je 0x407db3
cmp dword [esi + 0xc], edi
je 0x407db3
cmp dword [esi + 0x10], edi
je 0x407db3
cmp dword [esi + 0x14], edi
je 0x407db3
cmp dword [esi + 0x18], edi
je 0x407db3
cmp dword [esi + 0x1c], edi
je 0x407db3
cmp dword [esi + 0x20], edi
je 0x407db3
cmp dword [esi + 0x24], edi
je 0x407db3
cmp dword [esi + 0x28], edi
je 0x407db3
cmp eax, edi
je 0x407db3
xor eax, eax
inc eax
jmp 0x407db5
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.00407e22
leave
ret 8
Function at 0x407ef2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x401678
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407f4a
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x4016b4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407f3d
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x407f4c
xor eax, eax
pop esi
leave
ret 4