joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406485
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push esi
push edi
push dword [ebp + 8]
call sub.KERNEL32.dll_lstrlenW
add eax, eax
mov esi, eax
add eax, 0x216
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00403940
mov edi, dword [ebp - 0x58]
cld
mov eax, 0x22
stosw word es:[edi], ax
push 0x104
push edi
push 0
call sub.KERNEL32.dll_GetModuleFileNameW
lea edi, [edi + eax*2]
mov eax, 0x200022
stosd dword es:[edi], eax
mov eax, 0x22
stosw word es:[edi], ax
mov edx, edi
add edi, esi
stosd dword es:[edi], eax
push esi
push dword [ebp + 8]
push edx
call sub.KERNEL32.dll_RtlMoveMemory
push 0x44
lea eax, [ebp - 0x54]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
add dword [ebp - 0x54], 0x44
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x58]
push 0
call sub.KERNEL32.dll_CreateProcessW
or eax, eax
je 0x40652a
mov eax, dword [ebp - 0x10]
or eax, eax
je 0x40651d
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
or eax, eax
je 0x40652a
push eax
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 0x58]
call fcn.0040398e
pop edi
pop esi
leave
ret 4

Function at 0x406538
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
and dword [ebp - 4], 0
push str.MiniDumpWriteDump
push str.dbghelp.dll
lea eax, [ebp - 4]
push eax
call fcn.00406340
push 0x47ea44
push 0x104
call sub.KERNEL32.dll_GetTempPathW
or eax, eax
je 0x4065fb
cmp dword [ebp - 4], 0
je 0x4065fb
add eax, eax
lea edx, [0x47ea44]
add eax, edx
mov edx, eax
add edx, 0x16
mov dword [edx], 0x64002e
mov dword [edx + 4], 0x70006d
mov dword [edx + 8], 0
push 0x16
push 0x4734d0
push eax
call sub.KERNEL32.dll_RtlMoveMemory
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push 0x47ea44
call sub.KERNEL32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x4065fb
mov dword [ebp - 8], eax
mov eax, dword fs:[0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
and dword [ebp - 0xc], 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 8]
mov eax, dword fs:[0x20]
push eax
push 0xffffffffffffffff
call dword [ebp - 4]
push dword [ebp - 8]
call sub.KERNEL32.dll_CloseHandle
leave
ret 4
Function at 0x406600
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
push ebx
push 0x208
lea eax, [ebp - 0x18]
push eax
call fcn.00403940
push 0x46
push str.SystemCurrentControlSetServices_
push dword [ebp - 0x18]
call sub.KERNEL32.dll_RtlMoveMemory
lea ebx, [0x47d210]
push 0x80
push ebx
call sub.KERNEL32.dll_RtlZeroMemory
mov dword [ebx + 4], str.DeviceMup
mov dword [ebx], 0x18
add ebx, 8
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetControlNetworkProviderOrder
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExW
or eax, eax
jne 0x40677e
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push str.ProviderOrder
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegQueryValueExW
or eax, eax
jne 0x406776
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push eax
call fcn.00403940
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push str.ProviderOrder
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegQueryValueExW
mov edi, esi
jmp 0x406764
cmp word [esi], 0x2c
je 0x4066c8
cmp word [esi], 0
jne 0x40675d
mov eax, dword [ebp - 0x18]
add eax, 0x44
mov edx, esi
sub edx, edi
push edx
push edi
push eax
mov edi, eax
add edi, edx
call sub.KERNEL32.dll_RtlMoveMemory
push 0x22
push str.NetworkProvider
push edi
call sub.KERNEL32.dll_RtlMoveMemory
mov edi, esi
add edi, 2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push dword [ebp - 0x18]
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExW
or eax, eax
jne 0x40675d
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push str.DeviceName
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegQueryValueExW
or eax, eax
jne 0x406755
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
push eax
lea eax, [ebx + 4]
push eax
call fcn.00403940
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 4]
push 0
push 0
push str.DeviceName
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegQueryValueExW
add ebx, 8
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegCloseKey
add esi, 2
sub dword [ebp - 8], 2
cmp dword [ebp - 8], 0
jne 0x4066b8
push dword [ebp - 0x14]
call fcn.0040398e
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
push dword [ebp - 0x18]
call fcn.0040398e
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4067d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push esi
push edi
push ebx
xor eax, eax
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
lea edx, [ebp - 8]
mov dword [edx], 0x3a0041
mov dword [edx + 4], eax
push 0x208
lea eax, [ebp - 0x30]
push eax
call fcn.00403940
call sub.KERNEL32.dll_GetLogicalDrives
mov esi, eax
push eax
call fcn.004030d8
shl eax, 8
lea edi, [0x47d140]
push eax
lea eax, [edi + 4]
push eax
call fcn.00403940
mov bl, 0x1a
shr esi, 1
jae 0x40699d
mov dword [edi + 4], eax
mov dword [edi], 0x1000000
push 0x80
push eax
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.dll_QueryDosDeviceW
or eax, eax
je 0x406995
push dword [edi + 4]
call sub.KERNEL32.dll_lstrlenW
add eax, eax
mov word [edi], ax
cmp dword [0x47ea24], 0x3c
jae 0x4068bd
mov edx, dword [edi + 4]
add eax, edx
jmp 0x4068b4
cmp word [edx], 0x3a
jne 0x4068b1
mov ecx, edx
add ecx, 2
cmp ecx, eax
jae 0x406995
cmp word [ecx], 0x5c
jne 0x40687a
sub edx, 2
cmp edx, dword [edi + 4]
jbe 0x406995
cmp word [edx], 0x5c
jne 0x40688b
sub eax, ecx
push eax
push ecx
push edx
sub ecx, edx
sub word [edi], cx
call sub.KERNEL32.dll_RtlMoveMemory
jmp 0x406995
add edx, 2
cmp edx, eax
jb 0x406872
jmp 0x406995
mov edx, dword [edi + 4]
mov ecx, edx
sub eax, 2
add eax, edx
jmp 0x40698d
cmp dword [edx], 0x3b005c
jne 0x40698a
mov dword [ebp - 0x28], ecx
sub edx, ecx
mov word [ebp - 0x2c], dx
mov word [ebp - 0x2a], dx
lea edx, [edx + ecx + 6]
cmp word [edx], 0x3a
jne 0x406988
add edx, 2
cmp edx, eax
jae 0x406995
cmp word [edx], 0x5c
jne 0x4068f3
mov dword [ebp - 0x38], edx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
call sub.ntdll.dll_NtOpenSymbolicLinkObject
or eax, eax
jne 0x406988
lea edx, [ebp - 0x34]
mov dword [edx], 0x2080000
push 0
push edx
push dword [ebp - 0x24]
call sub.ntdll.dll_NtQuerySymbolicLinkObject
or eax, eax
jne 0x406980
cmp word [ebp - 0x34], 0x1a
jbe 0x406980
push 0x1a
push str.DeviceMup_
push dword [ebp - 0x30]
call sub.ntdll.dll_RtlCompareMemory
cmp eax, 0x1a
jne 0x406980
movzx edx, word [edi]
mov eax, dword [edi + 4]
add edx, eax
sub edx, dword [ebp - 0x38]
push edx
add edx, 0x16
mov word [edi], dx
push dword [ebp - 0x38]
add eax, 0x16
push eax
call sub.KERNEL32.dll_RtlMoveMemory
push 0x16
push str.DeviceMup_
push dword [edi + 4]
call sub.KERNEL32.dll_RtlMoveMemory
push dword [ebp - 0x24]
call sub.ntdll.dll_NtClose
jmp 0x406995
add edx, 2
cmp edx, eax
jb 0x4068cc
mov eax, dword [edi + 4]
add eax, 0x100
inc word [ebp - 8]
add edi, 8
dec bl
je 0x4069b0
or esi, esi
jne 0x40682d
push dword [ebp - 0x30]
call fcn.0040398e
pop ebx
pop edi
pop esi
leave
ret
Function at 0x411169
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push esi
mov esi, dword [ebp + 0xc]
or esi, esi
je 0x4111d5
test dword [esi + 0x81c], 2
je 0x4111d5
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x4111d5
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.00410f26
or eax, eax
je 0x4111cd
lea edx, [ebp - 8]
push 0
push edx
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
push dword [ebp - 0xc]
call fcn.0040398e
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
pop esi
leave
ret 8
Function at 0x412941
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov esi, dword [ebp + 8]
mov edi, dword [esi + 0x1c]
add edi, dword [edi + 0x3c]
movzx eax, word [edi + 0x14]
lea eax, [eax + edi + 0x18]
mov dword [esi + 0x64], eax
movzx ecx, word [edi + 6]
mov dword [esi + 0x7c], ecx
movzx eax, word [edi + 4]
mov dword [esi + 0x40], eax
mov ecx, dword [edi + 0xc]
or ecx, ecx
je 0x4129a8
add ecx, dword [esi + 0x1c]
jb 0x4129a8
cmp ecx, dword [esi + 0x20]
jae 0x4129a8
mov eax, dword [edi + 0x10]
mov dword [esi + 0x5c], eax
imul eax, eax, 0x12
jb 0x4129a8
add eax, ecx
jb 0x4129a8
cmp eax, dword [esi + 0x20]
ja 0x4129a8
mov dword [esi + 0x54], ecx
lea ecx, [eax + 4]
cmp ecx, dword [esi + 0x20]
ja 0x4129a8
mov ecx, dword [eax]
mov dword [esi + 0x60], ecx
add ecx, eax
cmp ecx, dword [esi + 0x20]
ja 0x4129a8
mov dword [esi + 0x58], eax
push esi
call fcn.00412ac1
xor ecx, ecx
mov ax, word [edi + 0x18]
add edi, 0x18
cmp ax, 0x10b
jne 0x4129e0
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x6c], eax
lea eax, [edi + 0x60]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x78], eax
mov edx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
mov edi, dword [edi + 0x38]
jmp 0x412a12
cmp ax, 0x20b
jne 0x412a10
inc ecx
mov eax, dword [edi + 0x18]
mov edx, dword [edi + 0x1c]
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], edx
mov eax, dword [edi + 0x6c]
mov dword [esi + 0x6c], eax
lea eax, [edi + 0x70]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x78], eax
mov edx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
mov edi, dword [edi + 0x38]
jmp 0x412a12
xor edi, edi
mov dword [esi + 0x44], ecx
or edi, edi
je 0x412a9d
or eax, eax
je 0x412a4f
mov ecx, eax
dec ecx
and ecx, eax
jne 0x412a4f
mov ecx, edx
dec ecx
and ecx, edx
jne 0x412a4f
test eax, 0x1ff
jne 0x412a44
test edx, 0xfff
jne 0x412a44
cmp eax, edx
ja 0x412a4f
jmp 0x412a59
cmp eax, edx
jne 0x412a4f
cmp eax, 0x1000
jb 0x412a59
mov eax, 0x200
mov edx, 0x1000
mov dword [esi + 0x70], edx
mov dword [esi + 0x74], eax
push esi
call fcn.0041257f
or edi, edi
je 0x412a79
cmp edi, 0x80000000
ja 0x412a79
cmp edi, 0x1000
jae 0x412a85
mov edi, dword [esi + 0x8c]
or edi, edi
cmove edi, dword [esi + 0x24]
mov eax, dword [esi + 0x70]
dec eax
test eax, edi
je 0x412a94
not eax
and edi, eax
add edi, dword [esi + 0x70]
mov dword [esi + 0x3c], edi
push esi
call fcn.004126e0
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x414169
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileW
mov dword [ebp - 4], eax
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0xffffffff
je 0x414336
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
cmp eax, 2
jne 0x4141fb
mov word [ebp - 0x1e], 0x4d42
add ecx, 0xe
mov dword [ebp - 0x1c], ecx
and dword [ebp - 0x18], 0
mov edx, dword [esi + 0x14]
or edx, edx
je 0x4141c8
sub ecx, edx
jmp 0x4141cd
mov ecx, 0x36
mov dword [ebp - 0x14], ecx
push 0
lea eax, [ebp - 8]
push eax
push 0xe
lea eax, [ebp - 0x1e]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
jmp 0x41432e
cmp eax, 3
jne 0x414271
cmp dword [ebp + 0x1c], 2
je 0x414271
and word [ebp - 0x34], 0
mov word [ebp - 0x32], 1
mov word [ebp - 0x30], 1
mov eax, dword [esi + 4]
mov byte [ebp - 0x2e], al
mov eax, dword [esi + 8]
mov byte [ebp - 0x2d], al
mov ax, word [esi + 0xe]
mov word [ebp - 0x28], ax
mov ax, word [esi + 0xc]
mov word [ebp - 0x2a], ax
mov ax, word [esi + 0xc]
mov word [ebp - 0x2a], ax
mov dword [ebp - 0x26], ecx
mov eax, 0x16
mov dword [ebp - 0x22], eax
push 0
lea eax, [ebp - 8]
push eax
push 0x16
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
jmp 0x41432e
cmp eax, 0xe
jne 0x41428b
push 0
lea eax, [ebp - 8]
push eax
push ecx
push esi
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
jmp 0x41432e
cmp eax, 6
jne 0x4142be
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x14]
push ecx
push esi
call fcn.00413e6b
or eax, eax
je 0x4142b4
lea edx, [ebp - 8]
push 0
push edx
push eax
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
push dword [ebp - 0x10]
call fcn.0040398e
jmp 0x41432e
cmp eax, 0x10
jne 0x4142ee
lea eax, [ebp - 0x10]
push eax
push ecx
push esi
call fcn.00413bd0
or eax, eax
je 0x4142e4
lea edx, [ebp - 8]
push 0
push edx
push eax
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
push dword [ebp - 0x10]
call fcn.0040398e
jmp 0x41432e
cmp eax, 0xb
jne 0x41431e
lea eax, [ebp - 0x10]
push eax
push ecx
push esi
call fcn.00413f84
or eax, eax
je 0x414314
lea edx, [ebp - 8]
push 0
push edx
push eax
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
push dword [ebp - 0x10]
call fcn.0040398e
jmp 0x41432e
push 0
lea eax, [ebp - 8]
push eax
push ecx
push esi
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
pop esi
leave
ret 0x18
Function at 0x41437b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push edi
mov edx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
cmp dword [edx], 0xffff0001
jne 0x4143ce
movzx edi, word [edx + 0x18]
mov cx, word [edx + 0x14]
or cx, cx
cmovs ecx, eax
add cx, di
jb 0x4144e3
mov dword [ebp - 4], edi
movzx edi, word [edx + 0x16]
mov cx, word [edx + 0x12]
or cx, cx
cmovs ecx, eax
add cx, di
jb 0x4144e3
mov dword [ebp - 8], edi
mov eax, dword [edx + 0xc]
jmp 0x41444b
movzx edi, word [edx + 0x10]
mov cx, word [edx + 0xc]
or cx, cx
cmovs ecx, eax
add cx, di
jb 0x4144e3
mov dword [ebp - 4], edi
movzx edi, word [edx + 0xe]
mov cx, word [edx + 0xa]
or cx, cx
cmovs ecx, eax
add cx, di
jb 0x4144e3
mov dword [ebp - 8], edi
cld
lea edi, [edx + 0x12]
mov ecx, dword [ebp + 0x10]
sub ecx, 0x12
shr ecx, 1
cmp word [edi], 0xffff
jne 0x41441c
add edi, 4
sub ecx, 2
jmp 0x414427
repne scasw ax, word es:[edi]
or ecx, ecx
je 0x4144e3
cmp word [edi], 0xffff
jne 0x414435
add edi, 4
sub ecx, 2
jmp 0x414440
repne scasw ax, word es:[edi]
or ecx, ecx
je 0x4144e3
repne scasw ax, word es:[edi]
jne 0x4144e3
mov eax, dword [edx]
test eax, 0x80800000
je 0x414459
test eax, 0x40000000
je 0x4144bd
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.USER32.dll_MapDialogRect
push 0
push 0xcf0000
lea eax, [ebp - 0x10]
push eax
call sub.USER32.dll_AdjustWindowRect
mov eax, dword [ebp - 0xc]
sub dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
sub dword [ebp - 8], eax
push 0
push dword [0x47d0c0]
push 0
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebp - 8]
push 0x64
push 0x64
push 0x12cf0000
push 0
push 0x8002
push 0
call sub.USER32.dll_CreateWindowExW
mov dword [ebp - 0x14], eax
push 0x41433e
push 4
push eax
call sub.USER32.dll_SetWindowLongW
jmp 0x4144c3
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push 0
push 0x41433e
push dword [ebp - 0x14]
push dword [ebp + 0xc]
push dword [0x47d0c0]
call sub.USER32.dll_CreateDialogIndirectParamW
push 0xa
push eax
call sub.USER32.dll_ShowWindow
pop edi
leave
ret 0xc
Function at 0x414b29
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push esi
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 0x80c]
call fcn.00402750
or eax, eax
je 0x414cb8
mov esi, eax
cmp byte [esi], 0
jne 0x414c00
cmp dword [0x47d3e4], 0
je 0x414c00
mov byte [esi], 1
push 0x208
lea eax, [ebp - 0x10]
push eax
call fcn.00403940
push 0x38
push str.SOFTWAREClassesInterface_
push dword [ebp - 0x10]
call sub.KERNEL32.dll_RtlMoveMemory
mov eax, dword [ebp - 0x10]
add eax, 0x36
push 0x28
push eax
push dword [ebp + 0xc]
call sub.ole32.dll_StringFromGUID2
mov dword [ebp - 0xc], 0x4e
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp - 0x10]
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExW
or eax, eax
jne 0x414bf8
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [esi + 2]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegQueryValueExW
or eax, eax
jne 0x414bf0
cmp dword [ebp - 8], 1
cmove eax, dword [ebp - 0xc]
jne 0x414bf0
lea edx, [eax + esi]
cmp word [edx], 0
jne 0x414bea
sub eax, 2
mov byte [esi + 1], al
mov byte [esi], 0x10
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
push dword [ebp - 0x10]
call fcn.0040398e
movzx eax, byte [esi]
cmp al, 0x20
jne 0x414c1e
mov eax, dword [esi + 2]
push dword [eax + 0x18]
push dword [ebp + 8]
call fcn.00412018
or eax, eax
jne 0x414c32
jmp 0x414cb8
cmp al, 0x21
jne 0x414c5a
mov ecx, dword [esi + 2]
mov eax, dword [ecx + 0x30]
or eax, eax
je 0x414cb8
add eax, ecx
mov ecx, dword [ebp + 0x14]
shr ecx, 1
push ecx
push dword [ebp + 0x10]
push 0xffffffffffffffff
push eax
push 0
push 0
call sub.KERNEL32.dll_MultiByteToWideChar
or eax, eax
jne 0x414c55
push dword [ebp + 0x10]
call sub.KERNEL32.dll_lstrlenW
jmp 0x414c56
dec eax
add eax, eax
jmp 0x414cb8
cmp al, 0x11
jne 0x414c7c
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
lea eax, [esi + 2]
movzx esi, byte [esi + 1]
cmp esi, ecx
cmova esi, ecx
push esi
push eax
push edx
call sub.KERNEL32.dll_RtlMoveMemory
mov eax, esi
jmp 0x414cb8
cmp al, 1
je 0x414ca0
or al, al
je 0x414ca0
lea eax, [esi + 2]
movzx esi, byte [esi + 1]
cmp esi, dword [ebp + 0x14]
cmova esi, dword [ebp + 0x14]
push esi
push eax
push dword [ebp + 0x10]
call sub.KERNEL32.dll_RtlMoveMemory
mov eax, esi
jmp 0x414cb8
mov ecx, dword [ebp + 0x14]
shr ecx, 1
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.ole32.dll_StringFromGUID2
or eax, eax
je 0x414cb8
dec eax
add eax, eax
pop esi
leave
ret 0x10
Function at 0x4351c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push esi
mov eax, dword [ebp + 0x10]
or eax, eax
jne 0x4352d3
push 0x208
lea eax, [ebp - 0x30]
push eax
call fcn.00403940
push dword [0x47d378]
push dword [ebp + 0xc]
push dword [0x47d340]
call fcn.00403c7c
mov dword [ebp - 0x2c], 0x2c
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x905
push dword [ebp + 0xc]
call sub.USER32.dll_GetMenuItemInfoW
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x20], 3
call fcn.00404b23
or eax, eax
je 0x435233
push dword [eax + 8]
call fcn.00404b45
pop eax
jmp 0x435238
mov eax, dword [0x47d354]
or eax, eax
jne 0x435254
push 0
push dword [ebp + 8]
call fcn.0041d790
or eax, eax
je 0x435254
cmp dword [eax + 0x18], 0
je 0x435254
and dword [ebp - 0x20], 0
cmp esi, dword [ebp - 0x20]
je 0x43526c
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x905
push dword [ebp + 0xc]
call sub.USER32.dll_SetMenuItemInfoW
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x903
push dword [ebp + 0xc]
call sub.USER32.dll_GetMenuItemInfoW
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x20], 3
push 0x104
push dword [ebp - 0x30]
push dword [ebp + 8]
call fcn.00404c3f
or eax, eax
je 0x4352ae
push dword [ebp - 0x30]
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4352ae
and dword [ebp - 0x20], 0
cmp esi, dword [ebp - 0x20]
je 0x4352c6
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x903
push dword [ebp + 0xc]
call sub.USER32.dll_SetMenuItemInfoW
push dword [ebp - 0x30]
call fcn.0040398e
jmp 0x435353
cmp eax, 1
jne 0x435353
mov dword [ebp - 0x2c], 0x2c
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x901
push dword [ebp + 0xc]
call sub.USER32.dll_GetMenuItemInfoW
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x20], 3
push dword [0x47d340]
call fcn.00403db2
and dword [ebp - 0x20], eax
cmp esi, dword [ebp - 0x20]
je 0x435329
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x901
push dword [ebp + 0xc]
call sub.USER32.dll_SetMenuItemInfoW
push dword [0x47d084]
call fcn.0041dd8c
xor edx, edx
or eax, eax
jne 0x43533d
add edx, 3
mov dword [ebp - 0x20], edx
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x909
push dword [ebp + 0xc]
call sub.USER32.dll_SetMenuItemInfoW
pop esi
leave
ret 0xc
Function at 0x43560f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
or esi, esi
je 0x435666
push dword [esi + 0x28]
call sub.USER32.dll_DestroyWindow
push 0
push 0
push 0x531
push 0x2710
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageW
mov edx, dword [esi + 0x18]
or edx, edx
je 0x435666
mov ecx, dword [0x47d380]
or ecx, ecx
cmovne ecx, eax
lock xchg dword [0x47d3ec], ecx
push edx
push dword [ebp + 8]
call fcn.0041d803
push dword [esi + 0x18]
call fcn.00402015
and dword [esi + 0x18], 0
push 0x271c
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push 0
push eax
call sub.USER32.dll_ShowWindow
push 0x2710
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push 0x87
push 0
push 0
push 0
push 0
push 0
push eax
call sub.USER32.dll_SetWindowPos
cmp dword [0x47d398], 0
je 0x435733
push 0x2712
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push 0
push eax
call sub.USER32.dll_EnableWindow
push 0x2715
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push 0
push eax
call sub.USER32.dll_EnableWindow
push 0x2718
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push 0
push eax
call sub.USER32.dll_EnableWindow
push 0x2713
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push 0
push eax
call sub.USER32.dll_EnableWindow
push 0x2716
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push 0
push eax
call sub.USER32.dll_EnableWindow
push 0x2719
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push 0
push eax
call sub.USER32.dll_EnableWindow
push dword [0x47d084]
call fcn.0041dd74
pop esi
leave
ret 8

Function at 0x4466a3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push esi
and dword [ebp - 0xc], 0
mov esi, dword [ebp + 0xc]
or esi, esi
je 0x446700
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileW
mov dword [ebp - 4], eax
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 0xc], eax
mov edx, dword [esi + 0x28]
cmp eax, 0xffffffff
je 0x446700
or edx, edx
je 0x446700
push 0
lea eax, [ebp - 8]
push eax
push edx
push dword [esi + 4]
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
pop esi
leave
ret 8