joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5007abb8
Capabilities:
Check os version

Disassembly:
unpcklps xmm1, xmmword [ecx + 0x53]
push 0x64657261
push eax
jb 0x5007abbf
jo 0x5007abb7
jb 0x5007abc8
jns 0x5007ab9d
jb 0x5007abc7
jne 0x5007abca
pop esp
adc al, 0
push eax
add dword [edi], eax
pop esp
add byte [edx], ch
fisub word [ebp + 0x669e11cf]
add byte [edx + 0x64f4a300], ch
add ecx, dword [ebp + 0x74]
js 0x5007ab7a
add bh, bh
call dword [eax + sym.rtl120.bpl___xp_27ISharedPropertyGroupManager]
pop es
push eax
rol byte [ecx - 0x1133c], 0xff
mov dword [esp], 0x114
add al, 0x24
adc al, 1
add byte [eax], al
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 2
pop ebp
cmp eax, 0x7c83fff9
and al, 0x10
add dh, byte [ebp + 0xb]
inc dword [ebx + 0x210247c]
jne 0x5007abdd
cmp dword [esp + 4], 5

Function at 0x500804f8
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xfffffecc
cmp byte [0x5009e290], 0
jne 0x500805d5
mov byte [0x5009e290], 1
xor eax, eax
mov dword [0x5009e25c], eax
mov dword [esp + 0xc], 0x114
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 3
ja 0x50080540
cmp dword [esp + 0x10], 3
jne 0x500805ab
cmp dword [esp + 0x14], 0x33
jbe 0x500805ab
mov dword [esp + 4], 0x12
push esp
push 0x20019
push 0
push 0x500805dc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x500805d5
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0x5008063c
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x500805d5
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp word [esp + 0x120], 0x31
jne 0x500805d5
cmp word [esp + 0x122], 0
jne 0x500805d5
jmp 0x500805c0
push 0
push 0x5008063c
push 0x50080648
call sub.kernel32.dll_GetProfileIntW
test eax, eax
je 0x500805d5
mov eax, dword [sym.rtl120.bpl__Mapi_MAPIDLL]
call sym.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.kernel32.dll_LoadLibraryW
mov dword [0x5009e25c], eax
add esp, 0x134
ret

Function at 0x50089034
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movlps qword [ecx + 0x57], xmm1
imul esp, dword [ebp + 0x53], 0x6e697274
jae 0x50089084
popal
jo 0x500890bb
jb 0x500890aa
adc eax, dword [eax]
push eax
add dword [ebx], edi
push cs
invalid
push eax
test byte [ebx], ch
push eax
Function at 0x500890c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
enter 0x890, 0x50
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
enter 0x890, 0x50
adc byte [eax], al
add byte [eax], al
loopne 0x500890ac
add byte [eax - 0x58], dl
insb byte es:[edi], dx
add byte [eax - 0x50], dl
insb byte es:[edi], dx
add byte [eax + 0x20], dl
outsd dx, dword [esi]
add byte [eax + 0x18], dl
outsd dx, dword [esi]
add byte [eax + 0x38], dl
outsd dx, dword [esi]
add byte [eax + 0x3c], dl
outsd dx, dword [esi]
cmp byte [edi], ch
push eax
cmp al, 0x6f
add byte [eax + 0x40], dl
outsd dx, dword [esi]
add byte [eax + 0x34], dl
outsd dx, dword [esi]
add byte [eax - 0x7c], dl
imul eax, dword [eax], 0x50
mov al, byte [0xdc50006b]
push ss
push esp
push edi
imul esp, dword [ebp + 0x53], 0x6e697274
jae 0x5008911b
outsb dx, byte [esi]
jne 0x50089146
jb 0x5008913d
je 0x5008914d
jb 0x50089070
in al, 0x90
or byte [eax + 7], dl
pop es
push ds

Function at 0x500890e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
imul eax, dword [eax], 0x50
pop es
push ss
push esp
push edi
imul esp, dword [ebp + 0x53], 0x6e697274
jae 0x50089138
outsb dx, byte [esi]
jne 0x50089163
jb 0x5008915a
je 0x5008916a
jb 0x500890c5
nop
or byte [eax + 0x40], dl
adc eax, dword [eax]
push eax
add byte [eax], al
or edx, dword [edi + 0x69]
push ebx
je 0x50089180
imul ebp, dword [esi + 0x67], 0x6c000073
xchg ecx, eax
or byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, dh
xchg ecx, eax
or byte [eax + 0x1c], dl
xchg edx, eax
or byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], cl
xchg edx, eax
or byte [eax + 0x20], dl
add byte [eax], al
add byte [esi + ebx + 0x6ca85004], dh
and byte [eax], al
add byte [eax], al
mov ah, 0x1e
add al, 0x50
test al, 0x6c
add byte [eax - 0x50], dl
insb byte es:[edi], dx
add byte [eax + 0x20], dl
outsd dx, dword [esi]
add byte [eax + 0x18], dl
outsd dx, dword [esi]
add byte [eax + 0x38], dl
outsd dx, dword [esi]
add byte [eax + 0x3c], dl
outsd dx, dword [esi]
add byte [eax + 0x40], dl
outsd dx, dword [esi]
add byte [eax + 0x34], dl
outsd dx, dword [esi]
add byte [eax - 0x7c], dl
imul eax, dword [eax], 0x50
push eax
mov al, byte [0x7050006b]
xchg esp, eax
or byte [eax + 0x10], dl
cwde
or byte [eax], dl
lcall 0x5008, 0x96785008
mov esp, 0x60500049
mov esp, 0x6c500049
Function at 0x5008e4f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x5008e523
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x5008e5a2
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.5008be0c
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x5008e570
mov cx, word [esp]
sub cx, si
jmp 0x5008e572
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x5008e559
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x5008e598
mov cx, word [esp]
sub cx, si
jmp 0x5008e59a
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x5008e581
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x5008e5ff
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.5008e1c8
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x5008e5ea
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x5008e5ff
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x5008e4fe
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5009681c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x5009686e
test eax, edx
je 0x50096871
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x50096831
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x50096857
add ecx, 4
js 0x50096847
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x50096854
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x5009687d
test edx, edx
jne 0x50096824
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x5009a000
Capabilities:
Accept command line arguments

Disassembly:
sub dword [0x500a48f0], 1
jae 0x5009a0ad
call fcn.50003d54
mov byte [sym.rtl120.bpl__System_FileMode], 2
mov dword [sym.rtl120.bpl__System_RaiseExceptionProc], 0x50001b74
mov dword [sym.rtl120.bpl__System_RTLUnwindProc], 0x50001b84
mov byte [sym.rtl120.bpl__System_Test8086], 2
call fcn.5000d7f0
mov dword [sym.rtl120.bpl__System_CPUCount], eax
mov dword [sym.rtl120.bpl__System_DispCallByIDProc], 0x5000b6ac
call fcn.50006984
test al, al
je 0x5009a056
call fcn.500069b4
call fcn.50006aa0
mov word [0x500a4064], 0xd7b0
mov word [0x500a4334], 0xd7b0
mov word [0x500a4604], 0xd7b0
call sub.kernel32.dll_GetCommandLineW
mov dword [sym.rtl120.bpl__System_CmdLine], eax
call fcn.50001d34
mov dword [sym.rtl120.bpl__System_CmdShow], eax
call sub.kernel32.dll_GetACP
mov dword [sym.rtl120.bpl__System_DefaultSystemCodePage], eax
mov dword [sym.rtl120.bpl__System_DefaultUnicodeCodePage], 0x4b0
call sub.kernel32.dll_GetCurrentThreadId
mov dword [sym.rtl120.bpl__System_MainThreadID], eax
call fcn.5000d804
ret
Function at 0x402260
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54e503
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x5abe6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 8
push eax
mov dword [ebp - 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call fcn.00404d7d
push 0
call fcn.00405983
push 0xc
call fcn.004040c3
add esp, 8
mov dword [ebp - 0xf4], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4022e9
xorps xmm0, xmm0
mov ecx, eax
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.004065b1
mov esi, eax
jmp 0x4022eb
xor esi, esi
push 0x55e7cc
mov dword [ebp - 4], 0xffffffff
call fcn.0040e4e4
push 0x58dad4
mov ecx, edi
call fcn.00411bab
push 0xd8
lea eax, [ebp - 0xf0]
push 0
push eax
call fcn.00533860
add esp, 0xc
lea ecx, [ebp - 0xf0]
push 0
push 0x66
call fcn.0041740a
mov dword [ebp - 4], 1
mov dword [ebp - 0xf0], 0x58df7c
call fcn.00417bf4
call fcn.00417bf4
push 0x80
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xf0]
mov dword [ebp - 4], 2
mov ecx, eax
mov dword [edi + 0x20], eax
call fcn.0041235a
test esi, esi
je 0x40237e
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
lea ecx, [ebp - 0x30]
call fcn.0041546c
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], vtable.CBrush.0
call fcn.00402920
lea ecx, [ebp - 0xf0]
call fcn.00411e21
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00530862
mov esp, ebp
pop ebp
ret

Function at 0x402a60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0xffff
mov ebx, 0x12
nop
mov dl, byte [edi]
lea edi, [edi + 1]
movzx eax, dl
dec ebx
xor eax, esi
shr dl, 1
and eax, 1
shr si, 1
xor si, word [eax*2 + 0x58e2b8]
movzx eax, dl
movzx ecx, si
xor eax, ecx
shr dl, 1
and eax, 1
shr cx, 1
xor cx, word [eax*2 + 0x58e2b8]
movzx ecx, cx
movzx eax, dl
xor eax, ecx
shr dl, 1
and eax, 1
shr cx, 1
xor cx, word [eax*2 + 0x58e2b8]
movzx ecx, cx
movzx eax, dl
xor eax, ecx
shr dl, 1
and eax, 1
shr cx, 1
xor cx, word [eax*2 + 0x58e2b8]
movzx ecx, cx
movzx eax, dl
xor eax, ecx
shr dl, 1
and eax, 1
shr cx, 1
xor cx, word [eax*2 + 0x58e2b8]
movzx ecx, cx
movzx eax, dl
xor eax, ecx
shr dl, 1
and eax, 1
shr cx, 1
movzx edx, dl
xor cx, word [eax*2 + 0x58e2b8]
movzx ecx, cx
mov eax, ecx
shr cx, 1
xor eax, edx
shr edx, 1
and eax, 1
xor cx, word [eax*2 + 0x58e2b8]
movzx eax, cx
xor edx, eax
shr ax, 1
and edx, 1
xor ax, word [edx*2 + 0x58e2b8]
movzx esi, ax
test ebx, ebx
jg 0x402a70
pop edi
mov ax, si
pop esi
pop ebx
ret

Function at 0x403af0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00411feb
Function at 0x403c50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403c65
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403ca6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x403ca2
nop word [eax + eax]
cmp esi, edx
jae 0x403ca6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x403c90
cmp esi, edx
jb 0x403cab
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x4118a3
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ef77
mov eax, dword fs:[0]
push eax
mov eax, 0x101c
call fcn.005313a0
mov eax, dword [0x5abe6c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0x10]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x1020], edx
mov dword [ebp - 0x1028], ebx
cmp dword [ecx + 0x58], ebx
je 0x4119d7
push ebx
push eax
call fcn.00411a26
mov ebx, eax
test ebx, ebx
jne 0x41190b
push esi
jmp 0x4119ff
call fcn.00413b9d
push eax
lea ecx, [ebp - 0x1014]
call fcn.00402500
xor ecx, ecx
lea eax, [ebp - 0x1018]
push eax
push ecx
lea eax, [ebp - 0x101c]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x1020]
mov dword [ebp - 0x101c], ecx
push ebx
mov dword [ebp - 0x1018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x1024], eax
test eax, eax
jne 0x411996
push dword [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
call fcn.00402780
lea ecx, [ebp - 0x1018]
push ecx
push eax
lea eax, [ebp - 0x101c]
push eax
push 0
push dword [ebp - 0x1020]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1014]
mov dword [ebp - 0x1024], eax
call fcn.00411b4a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1024], 0
jne 0x4119c4
mov esi, dword [ebp - 0x1014]
add esi, 0xfffffff0
push esi
call fcn.00403b20
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00402620
jmp 0x411a06
push esi
mov ecx, edi
call fcn.00404010
mov ecx, dword [ebp - 0x1014]
lea ecx, [ecx - 0x10]
jmp 0x4119bd
test esi, esi
jne 0x4119e0
mov esi, 0x58e2bf
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x1010]
push 0x1000
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, edi
call fcn.00404010
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00530862
mov esp, ebp
pop ebp
ret 0x10
Function at 0x412050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00417bf4
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x412087
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.004120a8
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41235a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x28
mov eax, 0x54efca
call fcn.0053123a
mov esi, ecx
mov dword [ebp - 0x24], esi
mov eax, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], edi
call fcn.00417bf4
xor ebx, ebx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
cmp dword [esi + 0x84], ebx
je 0x4123b9
call fcn.00417bf4
push 5
push dword [esi + 0x84]
mov edi, dword [eax + 0xc]
push edi
mov dword [ebp - 0x20], edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
mov dword [ebp - 0x1c], eax
test edi, edi
je 0x4123c9
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
jmp 0x4123cc
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4123d8
or eax, 0xffffffff
jmp 0x412520
mov ecx, esi
call fcn.004128ea
mov edi, eax
mov dword [ebp - 0x30], edi
call fcn.00419e9e
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], ebx
test edi, edi
je 0x412450
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x412450
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x412450
push ebx
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.00403c30
mov dword [ebp - 0x18], eax
test eax, eax
je 0x412450
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x150]
test eax, eax
je 0x412450
mov ecx, dword [ebp - 0x18]
call fcn.004183cf
test eax, eax
je 0x412450
mov ecx, dword [ebp - 0x18]
push ebx
call fcn.00417dd8
mov dword [ebp - 0x28], 1
push esi
mov dword [ebp - 4], ebx
call fcn.00419b83
push edi
call fcn.0041b123
push dword [ebp - 0x20]
mov ecx, esi
push eax
push dword [ebp - 0x14]
call fcn.004122fb
test eax, eax
jne 0x412498
cmp dword [esi + 0x9c], ebx
jne 0x412498
call fcn.00417bf4
push edi
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.0041b123
push dword [ebp - 0x20]
mov ecx, esi
push eax
push dword [ebp - 0x14]
call fcn.004122fb
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x9c], ebx
jmp 0x4124c9
cmp dword [ebp - 0x28], 0
je 0x4124d9
mov ecx, dword [ebp - 0x18]
push 1
call fcn.00417dd8
cmp dword [ebp - 0x2c], 0
je 0x4124e8
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
test edi, edi
je 0x4124fe
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x4124fe
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.004128a1
cmp dword [esi + 0x84], ebx
je 0x41251d
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x68]
call fcn.00531198
ret
Function at 0x416f66
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x124
mov eax, 0x54f26b
call fcn.00531203
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x130], edi
call fcn.00416eef
mov dword [ebp - 0x128], eax
test eax, eax
je 0x416fba
lea eax, [ebp - 0x128]
mov ecx, esi
push eax
call fcn.00416efe
test eax, eax
je 0x416fb2
mov edx, dword [eax]
mov ecx, eax
push edi
push edi
push 0xfffffffffffffffc
push edi
call dword [edx + 0xc]
cmp dword [ebp - 0x128], edi
jne 0x416f94
cmp dword [esi + 0x58], edi
je 0x4170d5
xor eax, eax
cmp dword [esi + 0x6c], edi
setne al
test eax, eax
jne 0x416fd4
call fcn.004136db
push str.Software_
lea ecx, [ebp - 0x11c]
call fcn.00404010
push dword [esi + 0x58]
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], edi
call fcn.0040484d
push 0x55f610
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.0040eda9
push dword [esi + 0x6c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.0040eda9
add esp, 0x18
mov ecx, dword [ebp - 0x12c]
mov byte [ebp - 4], 3
lea ecx, [ecx - 0x10]
call fcn.00402620
push edi
lea eax, [ebp - 0x124]
mov esi, SysReAllocStringLen
push eax
push esi
call fcn.00416d27
lea eax, [ebp - 0x120]
push eax
push 8
push edi
push dword [ebp - 0x11c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41709e
push 0x104
lea eax, [ebp - 0x118]
push eax
push edi
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
jne 0x417092
push edi
lea eax, [ebp - 0x11c]
push eax
push esi
call fcn.00416d27
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x124]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.00402620
mov ecx, dword [ebp - 0x11c]
add ecx, 0xfffffff0
call fcn.00402620
xor eax, eax
inc eax
call fcn.005311ad
ret

Function at 0x4182b2
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5522ff
call fcn.005311cf
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x74], esi
jne 0x4182d8
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41832c
call fcn.00413b9d
push eax
lea ecx, [ebp - 0x10]
call fcn.00402500
mov ecx, dword [edi + 0x74]
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 4], esi
mov eax, dword [ecx]
call dword [eax + 0x8c]
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00539c10
push eax
call fcn.004046f1
add esp, 0x14
test edi, edi
je 0x41831f
push edi
call fcn.00538ee0
pop ecx
mov esi, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402620
mov eax, esi
call fcn.00531198
ret 8
Function at 0x41b0b9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x41b0fe
call fcn.00417bf4
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41b0fe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x41b11a
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0048ff4e
mov ebx, eax
test edi, edi
je 0x41b118
test esi, esi
je 0x41b118
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41ba3a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x41baf8
cmp dword [esi + 0x20], 0
je 0x41baf8
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41baf8
cmp dword [ebp + 8], 0
je 0x41baf8
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.00417bf4
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp + 8], eax
test eax, eax
je 0x41bac9
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp + 8]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41baf8
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.00498bb7
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x41bae9
test edi, edi
je 0x41bae9
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x41baf4
mov ecx, esi
call fcn.0041b804
mov eax, ebx
jmp 0x41bafa
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4