joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4272af
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.00420d9c
lea edi, [eax + 0x9c]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4272d5
or dword [edi + 8], 0x104
jmp 0x427398
lea ebx, [edi + 4]
mov dword [edi], eax
add eax, 0x40
mov dword [ebx], eax
je 0x4272f6
cmp byte [eax], 0
je 0x4272f6
push ebx
push 0x16
push 0x435f00
call fcn.00426d22
add esp, 0xc
mov eax, dword [edi]
and dword [edi + 8], 0
test eax, eax
je 0x42735b
cmp byte [eax], 0
je 0x42735b
mov eax, dword [ebx]
or eax, eax
je 0x427319
cmp byte [eax], 0
je 0x427319
mov esi, edi
call fcn.0042720c
jmp 0x427320
mov esi, edi
call fcn.00427273
cmp dword [edi + 8], 0
jne 0x4273ae
push edi
push 0x40
push 0x435cf8
call fcn.00426d22
add esp, 0xc
or eax, eax
je 0x4273a4
mov ebx, dword [ebx]
or ebx, ebx
je 0x427352
cmp byte [ebx], 0
je 0x427352
mov esi, edi
call fcn.0042720c
jmp 0x4273a4
mov esi, edi
call fcn.00427273
jmp 0x4273a4
mov ebx, dword [ebx]
or ebx, ebx
je 0x427391
cmp byte [ebx], 0
je 0x427391
push ebx
call fcn.0041f640
pop ecx
sub eax, 3
neg eax
push 1
sbb eax, eax
inc eax
push 0x426e79
mov dword [edi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
test byte [edi + 8], 4
jne 0x4273a4
and dword [edi + 8], 0
jmp 0x4273a4
mov dword [edi + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
cmp dword [edi + 8], 0
je 0x427499
mov esi, dword [ebp + 8]
mov eax, esi
sub eax, 0xffffff80
neg esi
sbb esi, esi
and esi, eax
call fcn.00426d84
mov ebx, eax
mov dword [ebp + 8], ebx
test ebx, ebx
je 0x427499
cmp ebx, 0xfde8
je 0x427499
cmp ebx, 0xfde9
je 0x427499
movzx eax, bx
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
or eax, eax
je 0x427499
push 1
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x427499
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x427425
mov cx, word [edi + 0x18]
mov word [eax], cx
mov cx, word [edi + 0x1c]
mov word [eax + 2], cx
mov word [eax + 4], bx
mov ebx, dword [ebp + 0x10]
or ebx, ebx
je 0x427494
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, 0x814
cmp word [eax], cx
jne 0x42745c
push str.Norwegian_Nynorsk
push 0x40
push ebx
call fcn.0041c2d5
add esp, 0xc
or eax, eax
je 0x42746d
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0042171e
push 0x40
push ebx
push 0x1001
push dword [edi + 0x18]
call esi
or eax, eax
je 0x427499
push 0x40
lea eax, [ebx + 0x40]
push eax
push 0x1002
push dword [edi + 0x1c]
call esi
or eax, eax
je 0x427499
push 0xa
sub ebx, 0xffffff80
push 0x10
push ebx
push dword [ebp + 8]
call fcn.0041f846
add esp, 0x10
xor eax, eax
inc eax
jmp 0x42749b
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42aaa7
Capabilities:
Link many functions at runtime

Disassembly:
mov ebx, ebx
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43dfc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push edi
push ebx
mov dword [ebp - 0x1c], eax
call fcn.00420baf
and dword [ebp - 0x14], 0
cmp dword [0x4405a8], 0
mov dword [ebp - 0x18], eax
jne 0x42ab5a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42ac02
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x436b4c
push esi
call ebx
or eax, eax
je 0x42ac02
mov edi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call edi
push str.GetActiveWindow
push esi
mov dword [0x4405a8], eax
call ebx
push eax
call edi
push str.GetLastActivePopup
push esi
mov dword [0x4405ac], eax
call ebx
push eax
call edi
push str.GetUserObjectInformationW
push esi
mov dword [0x4405b0], eax
call ebx
push eax
call edi
mov dword [0x4405b8], eax
or eax, eax
je 0x42ab5a
push str.GetProcessWindowStation
push esi
call ebx
push eax
call edi
mov dword [0x4405b4], eax
mov eax, dword [0x4405b4]
mov ecx, dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x42abb3
cmp dword [0x4405b8], ecx
je 0x42abb3
push eax
call edi
push dword [0x4405b8]
mov esi, eax
call edi
mov ebx, eax
or esi, esi
je 0x42abb3
or ebx, ebx
je 0x42abb3
call esi
or eax, eax
je 0x42abaa
lea esi, [ebp - 0x24]
lea ecx, [ebp - 0x10]
push esi
push 0xc
push ecx
push 1
push eax
call ebx
or eax, eax
je 0x42abaa
test byte [ebp - 8], 1
jne 0x42abb3
or dword [ebp + 0x10], 0x200000
jmp 0x42abe6
mov eax, dword [0x4405ac]
cmp eax, dword [ebp - 0x18]
je 0x42abe6
push eax
call edi
test eax, eax
je 0x42abe6
call eax
or eax, eax
mov dword [ebp - 0x14], eax
je 0x42abe6
mov eax, dword [0x4405b0]
cmp eax, dword [ebp - 0x18]
je 0x42abe6
push eax
call edi
test eax, eax
je 0x42abe6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4405a8]
call edi
or eax, eax
je 0x42ac02
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x42ac04
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
pop edi
pop esi
call fcn.0041b771
leave
ret
Function at 0x42ac6d
Capabilities:
Get geographical location

Disassembly:
mov ebx, ebx
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov eax, dword [0x43dfc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
push esi
push edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edi, edi
push edi
push edi
push dword [ebp + 0x10]
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
call ebx
mov ecx, eax
mov dword [ebp - 0xc], ecx
cmp ecx, edi
jne 0x42acaf
xor eax, eax
jmp 0x42ad35
jle 0x42acf6
push 0xffffffffffffffe0
pop eax
xor edx, edx
div ecx
cmp eax, 2
jb 0x42acf6
lea eax, [ecx + ecx + 8]
cmp eax, 0x400
ja 0x42acde
call fcn.004257f0
mov esi, esp
cmp esi, edi
je 0x42aca8
mov dword [esi], 0xcccc
sub esi, 0xfffffff8
jmp 0x42acf8
push eax
call fcn.0041da9a
cmp eax, edi
pop ecx
je 0x42acf2
mov dword [eax], 0xdddd
sub eax, 0xfffffff8
mov esi, eax
jmp 0x42acf8
xor esi, esi
cmp esi, edi
je 0x42aca8
push dword [ebp - 0xc]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call ebx
test eax, eax
je 0x42ad2c
push edi
push edi
cmp dword [ebp + 0x18], edi
jne 0x42ad17
push edi
push edi
jmp 0x42ad1d
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0xffffffffffffffff
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
push esi
call fcn.0041e26f
pop ebx
mov eax, edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
lea esp, [ebp - 0x18]
pop ebx
pop edi
pop esi
call fcn.0041b771
leave
ret
Function at 0x42b490
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edi, edi
cmp word [ecx], ax
je 0x42b4a6
pop ebp
xor eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x42b4a2
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
pop ebp
sete dl
mov eax, edx
ret

Function at 0x42b4d0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, esp
mov ebp, ebp
mov eax, dword [esi + 8]
mov edx, dword [eax + 0x3c]
add edx, eax
movzx eax, word [edx + 0x14]
lea eax, [eax + edx + 0x18]
xor ecx, ecx
push edi
push ebx
movzx edi, word [edx + 6]
push ebp
test edi, edi
je 0x42b50d
mov ebp, dword [esi + 0xc]
mov ebx, dword [eax + 0xc]
cmp ebp, ebx
jb 0x42b505
mov esi, dword [eax + 8]
add esi, ebx
cmp ebp, esi
jb 0x42b50f
inc ecx
sub eax, 0xffffffd8
cmp ecx, edi
jb 0x42b4f5
xor eax, eax
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x42e801
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov ebx, ebx
add esp, 0xffffffe8
push edi
push esi
push ebx
xor edi, edi
push 1
push edi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call fcn.00424754
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x42e889
push 2
push edi
push edi
push dword [ebp + 8]
call fcn.00424754
mov ecx, eax
and ecx, edx
sub esp, 0xfffffff0
cmp ecx, 0xffffffff
je 0x42e889
mov ebx, dword [ebp + 0xc]
sub ebx, eax
mov esi, dword [ebp + 0x10]
sbb esi, edx
js 0x42e91e
jg 0x42e862
cmp ebx, edi
jbe 0x42e91e
mov edi, 0x1000
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x42e895
call fcn.0041ded9
mov dword [eax], 0xc
call fcn.0041ded9
mov eax, dword [eax]
pop ebx
pop esi
pop edi
leave
ret
push 0x8000
push dword [ebp + 8]
call fcn.0042e9b7
pop ecx
pop ecx
mov dword [ebp - 8], eax
or esi, esi
jl 0x42e8b5
jg 0x42e8b1
cmp ebx, edi
jb 0x42e8b5
mov eax, edi
jmp 0x42e8b7
mov eax, ebx
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00423ac2
add esp, 0xc
cmp eax, 0xffffffff
je 0x42e901
cdq
sub ebx, eax
sbb esi, edx
js 0x42e8d8
jg 0x42e8a7
test ebx, ebx
jne 0x42e8a7
mov ebx, dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0042e9b7
pop edi
pop ecx
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
jmp 0x42e987
call fcn.0041deec
cmp dword [eax], 5
jne 0x42e916
call fcn.0041ded9
mov dword [eax], 0xd
or ebx, 0xffffffff
mov dword [ebp - 0xc], ebx
jmp 0x42e8db
cmp esi, edi
jg 0x42e993
jl 0x42e928
cmp ebx, edi
jae 0x42e993
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00424754
and eax, edx
sub esp, 0xfffffff0
cmp eax, 0xffffffff
je 0x42e889
push dword [ebp + 8]
call fcn.0042b734
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
mov dword [ebp - 0x10], eax
and eax, edx
cmp eax, 0xffffffff
mov dword [ebp - 0xc], edx
jne 0x42e993
call fcn.0041ded9
mov dword [eax], 0xd
call fcn.0041deec
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov ebx, dword [ebp - 0x10]
and ebx, dword [ebp - 0xc]
cmp ebx, 0xffffffff
je 0x42e889
push edi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.00424754
and eax, edx
sub esp, 0xfffffff0
cmp eax, 0xffffffff
je 0x42e889
xor eax, eax
jmp 0x42e890
Function at 0x41be93
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00412fa6
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x41becb
xor eax, eax
jmp 0x41bef7
cmp esi, dword [ebp - 4]
je 0x41bef4
cmp dword [ebp + 0xc], 0
je 0x41bef4
push dword [edi + 0x9c]
call fcn.0041baa1
push dword [edi + 0x9c]
mov esi, eax
call fcn.0040e444
pop ecx
pop ecx
cmp esi, eax
je 0x41bec7
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
mov eax, 1
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
xor ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
mov ecx, edi
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x401740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x511524]
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov word [ebp - 0x24], 1
mov word [ebp - 0x22], 0
mov word [ebp - 0x20], 0x16
mov word [ebp - 0x1e], 0x77
mov word [ebp - 0x1c], 0x69
mov word [ebp - 0x1a], 0x6e
mov word [ebp - 0x18], 0x6d
mov word [ebp - 0x16], 0x6d
mov word [ebp - 0x14], 0x2e
mov word [ebp - 0x12], 0x64
mov word [ebp - 0x10], 0x6c
mov word [ebp - 0xe], 0x6c
mov word [ebp - 0xc], 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [0x413178]
call dword [0x41305c]
test eax, eax
jbe 0x4017ea
lea eax, [ebp - 0x1e]
push eax
call dword [0x4130e4]
mov dword [ebp - 0x2c], eax
jmp 0x401806
mov ecx, dword [ebp - 0x28]
push ecx
push 0x14
push 0
mov edx, dword [ebp - 0x34]
push edx
call dword [0x41300c]
push 0
push 0
call dword [0x4131a4]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
call fcn.00401950
mov esp, ebp
pop ebp
ret

Function at 0x401c40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
call dword [0x4130c4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x401c66
xor eax, eax
jmp 0x401ced
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4550
je 0x401c81
xor eax, eax
jmp 0x401ced
mov edx, dword [ebp - 8]
add edx, 0x18
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x10b
je 0x401ca7
cmp dword [ebp - 0x14], 0x20b
je 0x401cc7
jmp 0x401ceb
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x5c], 0xe
ja 0x401cb4
xor eax, eax
jmp 0x401ced
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [eax + 0xd0], 0
setne cl
mov eax, ecx
jmp 0x401ced
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x6c], 0xe
ja 0x401cda
xor eax, eax
jmp 0x401ced
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp dword [ecx + 0xe0], 0
setne al
jmp 0x401ced
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4053e8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
push 1
pop ebx
push ebx
call fcn.004046ab
mov esi, 0x104
xor edi, edi
push esi
push edi
push 0x491df4
call fcn.00407360
push esi
push edi
push 0x491cf0
call fcn.00407360
push esi
push edi
push 0x491bec
call fcn.00407360
push esi
push edi
push 0x491ae8
call fcn.00407360
push esi
push edi
push 0x4919e4
call fcn.00407360
add esp, 0x40
push 0x40e0d0
push 0x1f16
push str.z_n_
call fcn.00403529
push 0x491f00
call fcn.00402642
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0x80000000
mov dword [0x491f08], edi
mov dword [0x491ef8], eax
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
jne 0x4054a8
cmp dword [ebp - 0x8c], ebx
jne 0x4054a8
mov dword [0x491f08], ebx
call fcn.004048ef
mov esi, 0x7d000
push esi
call fcn.00407bff
cmp eax, edi
pop ecx
mov dword [0x4919e0], eax
jne 0x4054c6
xor eax, eax
jmp 0x4054ea
push esi
push edi
push eax
call fcn.00407360
call fcn.004055a8
push ebx
push 0x40fde0
call fcn.00403434
push eax
push edi
call fcn.0040530f
add esp, 0x1c
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4055a8
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ebp
push esi
push edi
push 2
push 0x40fb6f
call fcn.00403434
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop ecx
pop ecx
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
mov edi, 0x40fc6f
je 0x40560d
push 1
push edi
call fcn.00403434
pop ecx
pop ecx
push eax
push ebp
call esi
push 4
push edi
mov dword [0x491f10], eax
call fcn.00403434
pop ecx
pop ecx
push eax
push ebp
call esi
push 5
push edi
mov dword [0x491f0c], eax
call fcn.00403434
pop ecx
pop ecx
push eax
push ebp
call esi
mov dword [0x491f14], eax
push 3
push 0x40fb6f
call fcn.00403434
pop ecx
pop ecx
push eax
call ebx
mov ebp, eax
test ebp, ebp
je 0x405637
push 3
push edi
call fcn.00403434
pop ecx
pop ecx
push eax
push ebp
call esi
mov dword [0x491f18], eax
mov edi, 0x40fda4
push edi
call ebx
mov ebx, eax
test ebx, ebx
je 0x405658
push 1
push edi
call fcn.00403434
pop ecx
pop ecx
push eax
push ebx
call esi
mov dword [0x491f1c], eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4028e3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
lea eax, [ebp - 4]
push ebx
push eax
xor ebx, ebx
push 1
push ebx
push 0x4012a4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4029bb
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x10c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push ebx
push 0x401514
mov dword [ebp - 8], 0x104
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4029b1
push dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4029b1
lea eax, [ebp - 0x210]
push 0x401500
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.00403a06
test eax, eax
je 0x402978
lea eax, [ebp - 0x210]
push 0x4014f8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0x10c]
push eax
push ebx
push ebx
push 0x4014f0
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4029b1
push ebx
lea eax, [ebp - 0x210]
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00403e01
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
leave
ret 8

Function at 0x4029c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
test eax, eax
mov dword [ebp - 0x1c], 0x40152c
mov dword [ebp - 0x18], 0x40149c
mov dword [ebp - 0x14], 0x4014a4
je 0x4029ec
and byte [eax], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push edi
lea eax, [ebp - 0x124]
push 0x4012a4
push eax
call ebx
and dword [ebp - 8], 0
lea edi, [ebp - 0x1c]
mov esi, dword [edi]
lea eax, [ebp - 0x124]
push esi
push eax
call fcn.00403529
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x124]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402ac0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0x401520
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402ab1
lea eax, [ebp - 0x228]
push 0x4014ac
push eax
call fcn.00403529
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.004035ba
test eax, eax
je 0x402ab1
push dword [ebp + 8]
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402ab1
cmp dword [ebp + 0xc], eax
je 0x402aaa
push esi
push dword [ebp + 0xc]
call ebx
mov dword [ebp - 4], 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 1
je 0x402adc
lea eax, [ebp - 0x124]
push eax
call fcn.00403560
inc dword [ebp - 8]
add edi, 4
cmp dword [ebp - 8], 3
jb 0x402a0a
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x402ae6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
lea eax, [ebp - 0x20c]
push 0x4012a4
push eax
call ebx
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
jne 0x402b12
mov eax, 0x40152c
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00403529
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
push edi
push 2
push edi
push edi
lea eax, [ebp - 0x20c]
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402ba8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp + 8]
call esi
inc eax
push eax
push dword [ebp + 8]
push 1
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x401520
push dword [ebp - 4]
call edi
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call ebx
lea eax, [ebp - 0x108]
push eax
call fcn.00403560
lea eax, [ebp - 0x108]
push eax
call esi
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push 0x401530
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebx
leave
ret 8

Function at 0x402bae
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
lea eax, [ebp - 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
xor ebx, ebx
push 0x2001f
push ebx
push 0x401550
push 0x80000002
call esi
test eax, eax
jne 0x402c51
lea eax, [ebp - 8]
push edi
push eax
push 1
mov edi, 0x40152c
push ebx
push edi
push dword [ebp - 4]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x402c4b
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x104
push eax
lea eax, [ebp - 0x110]
push eax
push ebx
push ebx
push 0x401540
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402c38
push 1
lea eax, [ebp - 0x110]
push 0x4014ac
push eax
call fcn.004031b8
test eax, eax
je 0x402c38
push 1
pop ebx
push dword [ebp - 8]
call esi
test ebx, ebx
je 0x402c4b
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret