joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1023e86
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1026270
call fcn.01024374
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1028708
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1023c41
cmp eax, esi
jne 0x1023c34
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1023c44
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1023c1b
xor esi, esi
inc esi
mov eax, dword [0x1028704]
cmp eax, esi
jne 0x1023c57
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1023c86
mov eax, dword [0x1028704]
test eax, eax
jne 0x1023c80
mov dword [0x1028704], esi
push 0x10012d4
push 0x10012c8
call fcn.01023b7d
pop ecx
pop ecx
test eax, eax
je 0x1023c86
jmp 0x1023daa
mov dword [0x10283b0], esi
mov eax, dword [0x1028704]
cmp eax, esi
jne 0x1023caa
push 0x10012c4
push 0x10012bc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1028704], 2
cmp dword [ebp - 0x20], ebx
jne 0x1023cb7
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1028710], ebx
je 0x1023cd8
push 0x1028710
call fcn.010242e9
pop ecx
test eax, eax
je 0x1023cd8
push ebx
push 2
push ebx
call dword [0x1028710]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1023daa
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1023d42
cmp cx, bx
je 0x1023cfd
cmp dword [ebp - 0x1c], ebx
jne 0x1023d42
movzx ecx, word [eax]
cmp cx, bx
je 0x1023d12
cmp cx, 0x20
ja 0x1023d12
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1023cfd
test byte [ebp - 0x40], 1
je 0x1023d1e
movzx ecx, word [ebp - 0x3c]
jmp 0x1023d21
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x10283ac], eax
cmp dword [0x10283a0], ebx
jne 0x1023d87
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1023d53
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x1023ce7
cmp dword [0x10283b0], ebx
jne 0x1023d95
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10283ac]
jmp 0x1023db6
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.010243b9
ret
call fcn.010244c1
jmp 0x1023bde
Function at 0x1024759
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
and dword [edi], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x102480a
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x102480a
push eax
push ebx
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1024801
xor ebx, ebx
lea eax, [ebp + 0x10]
push eax
cmp dword [ebp + 0x14], ebx
je 0x10247d9
lea eax, [ebp - 8]
push eax
push 0x10024e0
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1024801
cmp dword [ebp + 0x10], ebx
je 0x1024801
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
jmp 0x10247ff
lea eax, [ebp - 0xc]
push eax
push 0x10027cc
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1024801
cmp dword [ebp + 0x10], ebx
je 0x1024801
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax]
mov dword [edi], ecx
movzx eax, word [eax + 2]
mov dword [esi], eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x10248b1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
lea eax, [ebp - 0x218]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1002840
push 0x80000002
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10249eb
push edi
push 4
pop edi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
mov esi, 0x1002800
push esi
push dword [ebp - 0x218]
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10249de
push esi
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp dword [ebp - 0x21c], edi
jne 0x10249de
lea eax, [ebp - 0x20c]
push eax
call fcn.01024850
xor ecx, ecx
cmp dword [ebp - 0x214], eax
sete cl
mov dword [ebp - 0x210], ecx
test ecx, ecx
je 0x10249de
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
mov esi, 0x1002818
push esi
push dword [ebp - 0x218]
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10249de
push esi
push dword [ebp - 0x224]
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp dword [ebp - 0x21c], edi
jne 0x10249de
lea eax, [ebp - 0x20c]
push eax
call fcn.01024850
xor ecx, ecx
cmp dword [ebp - 0x214], eax
sete cl
mov dword [ebp - 0x210], ecx
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop esi
xor ecx, ebp
pop ebx
call fcn.01023ead
leave
ret 4
Function at 0x1024a06
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x1028370], 0xffffffff
jne 0x1024a78
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x10028c0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1024a78
and dword [0x1028370], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x10028a4
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1024a6f
mov eax, 0x600
cmp word [ebp - 0xc], ax
sbb eax, eax
inc eax
mov dword [0x1028370], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1028370]
leave
ret

Function at 0x1024af3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push 0x1002840
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1024b8d
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0x1002888
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1024b81
test esi, esi
je 0x1024b81
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push esi
call fcn.01024a84
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp word [ebp - 0x20c], ax
pop esi
setne al
xor ecx, ebp
call fcn.01023ead
leave
ret 8

Function at 0x1024bad
Capabilities:
Check if file exists
Get file attributes
Read .ini file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x41c], eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
call fcn.01024af3
test eax, eax
je 0x1024c92
lea eax, [ebp - 0x20c]
push eax
call fcn.010248b1
test eax, eax
je 0x1024c92
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01024af3
test eax, eax
je 0x1024c92
push ebx
push 0x1002818
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01024d75
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x418], eax
push 0x80
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
push edi
lea eax, [ebp - 0x414]
push eax
push 0x1001420
push dword [ebp - 0x41c]
push 0x1002830
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
cmp dword [ebp - 0x418], 0xffffffff
je 0x1024c91
push dword [ebp - 0x418]
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01023ead
leave
ret 4
Function at 0x1024ca9
Capabilities:
Check os version
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1028374], 2
jne 0x1024d5f
and dword [0x1028374], 0
lea eax, [ebp - 0x320]
push eax
mov dword [ebp - 0x320], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x310], 2
jne 0x1024d5f
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x1002914
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01024d75
cmp dword [ebp - 0x31c], 5
pop esi
jae 0x1024d55
call fcn.01024a06
test eax, eax
jne 0x1024d55
push 0x7550005
push 0x50083
lea eax, [ebp - 0x20c]
push eax
call fcn.01024816
test eax, eax
je 0x1024d5f
lea eax, [ebp - 0x20c]
push eax
call fcn.01024bad
test eax, eax
jne 0x1024d5f
mov dword [0x1028374], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x1028374]
xor ecx, ebp
call fcn.01023ead
leave
ret

Function at 0x1024f1e
Capabilities:
Get common file path
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x234]
xor ebx, ebx
push eax
mov byte [ebp - 0x20d], bl
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x234], bx
jne 0x1024f62
cmp edi, 0x2a
jne 0x1024f62
push 0x26
pop edi
push ebx
push edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1024fc0
push 0x10029c0
lea eax, [ebp - 0x20c]
push eax
call sub.SHLWAPI.dll_PathAppendW
test eax, eax
je 0x1024fc0
cmp byte [ebp + 0x14], bl
je 0x1024fa5
push 0x10029a4
lea eax, [ebp - 0x20c]
push eax
call sub.SHLWAPI.dll_PathAppendW
test eax, eax
je 0x1024fc0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0101fdd2
test eax, eax
jl 0x1024fc0
mov byte [ebp - 0x20d], 1
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x20d]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01023ead
leave
ret 0x10
Function at 0x1025191
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x10286e8], edi
jne 0x10252ad
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x10251f8
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x10286e8], edi
pop esi
je 0x1025280
dec eax
jne 0x10252ad
cmp dword [ebp - 0x11c], 5
jne 0x102526d
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x1025261
dec eax
je 0x102524e
dec eax
je 0x1025234
mov dword [0x10286e8], 0x14
jmp 0x10252ad
cmp word [ebp - 0xc], 1
jb 0x1025245
mov dword [0x10286e8], 0x10
or dword [0x10286e8], 4
jmp 0x10252ad
cmp word [ebp - 0xc], 2
jb 0x1025245
mov dword [0x10286e8], 8
jmp 0x1025245
mov dword [0x10286e8], 4
jmp 0x10252ad
cmp dword [ebp - 0x11c], 4
ja 0x10252bf
mov dword [0x10286e8], 2
cmp dword [ebp - 0x11c], 4
jne 0x10252ad
cmp dword [ebp - 0x118], edi
je 0x10252a3
cmp dword [ebp - 0x118], 0xa
je 0x10252a3
cmp dword [ebp - 0x118], 0x5a
jne 0x10252ad
mov dword [0x10286e8], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x10286e8]
xor ecx, ebp
pop edi
call fcn.01023ead
leave
ret
mov dword [0x10286e8], 0x20
jmp 0x10252ad

Function at 0x10252d0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1025324
push 3
lea eax, [ebp - 0x44]
push 0x1002ee0
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.01023ead
leave
ret

Function at 0x1025339
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x10286ec]
jne 0x10253d4
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x1002e10
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10253d3
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x1002ec8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x10253d3
push 3
push dword [esi*8 + 0x1002c60]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x10253c5
inc esi
cmp esi, 0x1c
jb 0x10253a4
jmp 0x10253d3
mov ax, word [esi*8 + 0x1002c64]
mov word [0x10286ec], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x10286ec]
xor ecx, ebp
call fcn.01023ead
leave
ret
Function at 0x102611f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [0x10286f4], esi
jne 0x1026177
lea eax, [ebp - 4]
push eax
push 1
push esi
push 0x101f5e0
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1026177
push esi
push esi
push esi
push esi
push 0x101f59c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
mov dword [0x10286f4], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [0x10286f4], 1
pop esi
sete al
leave
ret

Function at 0x102618b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [0x10286f8], esi
jne 0x102620c
call fcn.0102611f
test eax, eax
je 0x1026202
lea eax, [ebp - 4]
push eax
push 1
push esi
push 0x101f5e0
push 0x80000002
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102620c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x101f5c0
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10261f7
cmp dword [ebp - 8], esi
sete al
inc eax
mov dword [0x10286f8], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x102620c
mov dword [0x10286f8], 2
xor eax, eax
cmp dword [0x10286f8], 1
pop esi
sete al
leave
ret
Function at 0x474470
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x210
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push edi
mov dword [esp + 0x30], 0xff
call ebx
cmp eax, 0x103
je 0x474537
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [0x4c7a54]
mov edx, dword [ecx + 0xd0]
lea eax, [esp + 0x14]
push eax
or edx, 0x20019
push edx
push 0
lea eax, [esp + 0x2c]
push eax
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x474544
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00474470
mov edx, dword [esp + 0x18]
add esp, 4
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x474544
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
test esi, esi
jne 0x474544
lea ecx, [esp + 0x18]
push ecx
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
push esi
push edi
mov dword [esp + 0x30], 0xff
call ebx
cmp eax, 0x103
jne 0x4744ba
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret

Function at 0x474560
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push esi
test ebx, ebx
je 0x474650
test edi, edi
je 0x474579
cmp word [edi], 0
jne 0x474581
test ebp, ebp
je 0x474650
mov ecx, dword [0x4c7a54]
mov edx, dword [ecx + 0xd0]
lea eax, [esp + 0x14]
push eax
or edx, 0x2001f
push edx
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x474622
mov eax, dword [esp + 0x14]
test ebp, ebp
jne 0x474639
push eax
call fcn.00474470
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x474622
mov eax, 1
test byte [0x4cdb7c], al
jne 0x474600
or dword [0x4cdb7c], eax
push str.RegDeleteKeyExW
push 0x4af5bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4cdb78], eax
jmp 0x474605
mov eax, dword [0x4cdb78]
mov edx, dword [0x4c7a54]
mov ecx, dword [edx + 0xd0]
test ecx, ecx
je 0x47462f
test eax, eax
je 0x47462f
push 0
push ecx
push edi
push ebx
call eax
mov esi, eax
cmp esi, 0xffffffff
jne 0x474655
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x474657
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x474620
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0x14]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x474622
mov esi, 0x57
mov eax, esi
mov edx, dword [0x4c7a54]
mov dword [edx + 0x30], eax
mov edx, dword [esp + 0x10]
test esi, esi
setne al
movzx ecx, al
push ecx
push edx
call fcn.00430680
pop esi
pop ebp
pop ecx
ret 8
Function at 0x401b50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401b69
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x401b7d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401b9e
cmp esi, eax
jae 0x401b77
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401b90
cmp esi, eax
jae 0x401b77
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x407240
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x443cf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov ecx, dword [0x45569c]
mov eax, 0x73b2d479
imul ecx
mov ecx, dword [0x455690]
mov esi, dword [0x4556a8]
sar edx, 0xc
imul esi, esi, 0x212c
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x27e98ca1
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub esi, ecx
mov ecx, dword [0x455694]
mov eax, 0x5d0a95d5
imul ecx
mov ecx, dword [0x45568c]
imul ecx, ecx, 0x11be
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add esi, edx
mov edx, dword [0x56bcfc]
add eax, esi
add eax, ecx
mov ecx, 0x56bcfc
mov dword [str._r_____r____], eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [0x455690]
mov esi, dword [0x4556a8]
mov eax, 0x443d7153
imul esi, esi, 0x19a8
imul ecx
mov ecx, dword [0x45569c]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x27e98ca1
imul ecx
mov edi, dword [0x4556a0]
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x455688]
imul edx, edx, 0xe0e
sub esi, ecx
mov ecx, dword [esp + 0x1c]
add esi, edx
lea eax, [esp + 0x20]
push eax
sub esi, edi
push ecx
sub esi, 0x544
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
mov dword [0x455690], esi
call fcn.00406fb0
mov ecx, dword [0x455694]
mov esi, dword [0x455690]
mov eax, 0x27e98ca1
imul esi, esi, 0x2367
imul ecx
sar edx, 0xa
mov edi, edx
add esi, edx
mov edx, dword [0x45568c]
shr edi, 0x1f
add edi, esi
mov eax, edx
imul ecx, ecx, 0x544
imul eax, eax, 0x15e3
mov esi, dword [esp + 8]
add edi, eax
mov eax, 0x48dbb693
imul edx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
add edi, ecx
push esi
mov dword [0x45569c], edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
jg 0x4073d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret