joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4079d0
Capabilities:
Send data
Send http request

Disassembly:
mov eax, 0x4004
call fcn.0040e070
mov ax, word [0x430048]
push esi
mov esi, ecx
push edi
mov word [esp + 0xc], ax
mov ecx, 0xfff
xor eax, eax
lea edi, [esp + 0xe]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push 0x2000
push ecx
mov ecx, esi
mov dword [esp + 0x10], 0x42dabc
stosw word es:[edi], ax
call fcn.00407c70
mov eax, dword [esp + 0x4010]
mov ecx, dword [esi + 0x61ac8]
push 0
lea edx, [esp + 0xc]
push 0x4400040
push edx
push 0x430048
push str.HTTP_1.0
push eax
push str.POST
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
test eax, eax
mov dword [esi + 0x61acc], eax
jne 0x407a56
pop edi
pop esi
add esp, 0x4004
ret 0x14
push 0x80000000
push str.Accept:___r_n
call fcn.0040d9e8
mov edx, dword [esi + 0x61acc]
add esp, 4
push eax
push str.Accept:___r_n
push edx
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersW]
test eax, eax
jne 0x407a93
mov ecx, esi
call fcn.00407510
pop edi
xor eax, eax
pop esi
add esp, 0x4004
ret 0x14
lea eax, [esp + 0xc]
push eax
call fcn.0040d9e8
add esp, 4
lea ecx, [esp + 0xc]
push eax
push ecx
push str.Content_Type:_application_x_www_form_urlencoded_r_n
call fcn.0040d9e8
mov edx, dword [esi + 0x61acc]
add esp, 4
push eax
push str.Content_Type:_application_x_www_form_urlencoded_r_n
push edx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x4004
ret 0x14

Function at 0x407ae0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x61acc]
test eax, eax
jne 0x407af3
xor eax, eax
pop ebx
ret 8
mov edx, dword [esp + 0xc]
push ebp
mov ecx, edx
push esi
mov esi, dword [esp + 0x10]
mov ebp, ecx
push edi
xor eax, eax
mov edi, esi
push 0x435c8c
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
push edx
and ecx, 3
push esi
rep stosb byte es:[edi], al
mov eax, dword [ebx + 0x61acc]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [0x435c8c]
pop edi
neg eax
sbb eax, eax
pop esi
pop ebp
and eax, ecx
pop ebx
ret 8

Function at 0x409f20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
test esi, esi
je 0x409f50
mov ecx, dword [esp + 8]
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x42489c]
xor eax, edx
inc ecx
dec esi
jne 0x409f31
pop ebx
not eax
pop esi
ret
Function at 0x40afa0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40aff8
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x424f88
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40afeb
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x40affa
xor eax, eax
pop esi
leave
ret 4

Function at 0x40b74f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ed40]
jne 0x40b760
test ecx, 0xffff0000
jne 0x40b760
ret
jmp fcn.0040b765
Function at 0x40caf0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x52c
mov eax, dword [0x42ed40]
mov dword [ebp - 4], eax
mov eax, dword [0x42df58]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x40cb1f
call eax
cmp eax, ebx
mov dword [ebp - 0x528], eax
jne 0x40ccac
push dword [0x42ed48]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 0x528], eax
je 0x40ccac
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x40cb57
mov byte [ebp - 0x41c], bl
push esi
lea eax, [ebp - 0x524]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x40cb6f
mov byte [ebp - 0x524], bl
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x528]
call edi
test eax, eax
jne 0x40cb90
mov byte [ebp - 0x10c], bl
push esi
lea eax, [ebp - 0x214]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
test eax, eax
pop edi
jne 0x40cbad
mov byte [ebp - 0x214], bl
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0040ca53
lea eax, [ebp - 0x52c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40cbd0
sub eax, edx
mov ecx, eax
lea eax, [ebp - 0x314]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40cbe4
sub eax, esi
add eax, ecx
mov byte [ebp + eax - 0x213], bl
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.0040ca53
lea eax, [ebp - 0x52c]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40cc19
sub eax, ecx
lea ecx, [ebp - 0x314]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x40cc2b
sub ecx, esi
add ecx, eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x524]
push eax
mov byte [ebp + ecx - 0x10b], bl
call fcn.0040c984
test eax, eax
pop esi
jne 0x40cc6c
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x524]
push eax
call fcn.0040c984
test eax, eax
jne 0x40cc9a
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.0040c984
test eax, eax
jne 0x40ccac
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.0040c984
test eax, eax
je 0x40ccac
push dword [ebp - 0x528]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x528], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x528]
pop ebx
call fcn.0040b74f
leave
ret
Function at 0x40f829
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x42f060
cmp edx, dword [eax]
je 0x40f84b
add eax, 8
inc ecx
cmp eax, 0x42f0f0
jl 0x40f83c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x42f060]
jne 0x40f979
mov eax, dword [0x4394d0]
cmp eax, 1
je 0x40f953
test eax, eax
jne 0x40f87c
cmp dword [0x42ede4], 1
je 0x40f953
cmp edx, 0xfc
je 0x40f979
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40f8b3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00412a30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00412920
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40f8f6
lea eax, [ebp - 0x1a4]
push eax
call fcn.00412920
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x426d44
push edi
call fcn.00412b20
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00412a30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00412a40
lea eax, [ebp - 0xa0]
push 0x426d24
push eax
call fcn.00412a40
push dword [esi + 0x42f064]
lea eax, [ebp - 0xa0]
push eax
call fcn.00412a40
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041299b
add esp, 0x2c
pop edi
jmp 0x40f979
lea eax, [ebp + 8]
lea esi, [esi + 0x42f064]
push 0
push eax
push dword [esi]
call fcn.00412920
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x419590
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0040e070
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x41965b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41965b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x41960e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x419619
or bh, 8
and edi, 0x8000000
je 0x419634
mov eax, dword [0x43af7c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x41965b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419a30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x419a5b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x419a7f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x419a9a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x41d41f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41d461
call fcn.00421207
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [0x42feb8]
cmp eax, edi
je 0x41d461
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41d458
xor eax, eax
jmp 0x41d469
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041d46f
pop edi
pop esi
pop ebx
ret 4
Function at 0x421c23
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x421c51
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x421c6f
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00421b89
jmp 0x421c6f
mov eax, dword [esi + 0x14]
test eax, eax
je 0x421c6f
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00421b89
test edi, edi
mov eax, edi
jne 0x421c59
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x419800
Capabilities:
Get disk information

Disassembly:
push 0
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
push 0x4d2064
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [0x4d5acc]
add ecx, eax
mov dword [0x4d5acc], ecx
mov eax, ecx
ret

Function at 0x44b092
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [esi + edx*4 + 2], 0
mov ecx, dword [esp]
mov edx, dword [ecx + 0x1454]
inc edx
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], 0x23d
mov edx, dword [esp + 0x14]
mov ecx, dword [esp]
lea ecx, [ecx + edx*4 + 0xb5c]
jge 0x44b166
mov ebx, dword [ecx]
movzx edx, word [esi + ebx*4 + 2]
movzx edx, word [esi + edx*4 + 2]
inc edx
cmp eax, edx

Function at 0x44b0d2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jge 0x44b0da
mov edx, eax
inc dword [esp + 0x20]
mov word [esi + ebx*4 + 2], dx
cmp ebx, dword [esp + 4]
jg 0x44b151
mov edi, dword [esp]
inc word [edi + edx*2 + 0xb3c]
xor edi, edi
mov dword [esp + 0x18], edi
cmp ebx, dword [esp + 0x10]
jl fcn.0044b10e
mov edi, ebx
sub edi, dword [ebx + edx*2 + 0x56]
push edi
push ebp
add esp, 0xffffffd8
mov dword [esp], eax
mov eax, dword [edx + 4]
mov esi, dword [edx]
xor cl, byte [ecx - 0x74fbdbbc]
inc edx
or byte [ebx], dh
ror byte [ebx + 0x244c8908], cl
or byte [ebx + 0x4c890448], cl
and al, 0xc
and al, 0x8b
xchg edx, eax
push esp
adc al, 0
add byte [ebx + 0xb5c9194], cl
add byte [eax], al

Function at 0x462a16
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pop ebx
lea eax, [esi + 0x32924d16]
xchg byte [esi], dl
dec ebp
xchg edx, eax
xor bl, byte [ebp - 0x71]
adc edi, edi
mov al, 0xfb
je 0x4629b4
or dh, byte [esp + ebx - 0x245099e3]
fbstp tbyte [ebp + 0x349a7d32]
jge 0x4629c2
xor al, 0x91

Function at 0x462a26
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pop ebx
lea eax, [esi + 0x32924d16]
xchg byte [esi], dl
dec ebp
xchg edx, eax
xor bl, byte [ebp - 0x71]
adc edi, edi
mov al, 0xfb
je 0x4629b4
or dh, byte [esp + ebx - 0x245099e3]
fbstp tbyte [ebp + 0x349a7d32]
jge 0x4629c2
xor al, 0x91

Function at 0x462a46
Capabilities:
Check for vm using instruction vpcext

Disassembly:
scasw ax, word es:[edi]
fcmovnu st(0), st(7)
mov ch, 0x32
and al, 0xb3
jnp 0x462a20
mov byte [0x9d7c711f], al

Function at 0x462ae6
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push edx
into
add al, 0x9f
jg 0x462a7c
sub ch, bl
bound esi, qword [edi + 0x76]
jbe 0x462ab8
xor esp, ebp
invalid
xchg ebp, eax
push ds
stosb byte es:[edi], al

Function at 0x4952e6
Capabilities:
Encode data using xor

Disassembly:
lodsb al, byte [esi]
inc eax
push ss
in al, dx
popfd
sar byte [ebp + 0x4a76e7cd], 0xd6
mov ebx, 0x9250fcc
inc eax
cmp ebp, dword [edi + 0x3b0209a4]
in al, dx
scasd eax, dword es:[edi]
movsb byte es:[edi], byte [esi]
or dword [edx], eax
cmp ebp, esp
mov es, word [ecx - 0x7d]
xor al, 0x4f
and dword [ecx], edx
loopne 0x4952f9
xchg edi, eax
dec esp
xchg byte [ebp - 0x5fcfb522], bl
stosd dword es:[edi], eax
int1
inc ecx
adc edx, edi
push ebp
pop ebp
cwde
fld qword [esi]
Function at 0x4c8c65
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d2388
cmp edx, dword [eax]
je 0x4c8c87
add eax, 8
inc ecx
cmp eax, 0x4d2418
jl 0x4c8c78
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d2388]
jne 0x4c8db5
mov eax, dword [0x4d7db0]
cmp eax, 1
je 0x4c8d8f
test eax, eax
jne 0x4c8cb8
cmp dword [0x4d22b0], 1
je 0x4c8d8f
cmp edx, 0xfc
je 0x4c8db5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c8cef
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004c9650
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c9ae0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c8d32
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c9ae0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cdd44
push edi
call fcn.004cb9b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004c9650
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c9660
lea eax, [ebp - 0xa0]
push 0x4cdd24
push eax
call fcn.004c9660
push dword [esi + 0x4d238c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c9660
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004cb924
add esp, 0x2c
pop edi
jmp 0x4c8db5
lea eax, [ebp + 8]
lea esi, [esi + 0x4d238c]
push 0
push eax
push dword [esi]
call fcn.004c9ae0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401ff0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [0x40c1c0]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov esi, dword [esp + 0x114]
lea eax, [esp + 0xc]
push 0x100
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 8], 0x100
lea eax, [esp + 4]
push eax
push 0x2001f
push 0
push str.SOFTWAREWindows_Flag
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402093
push 0
lea eax, [esp + 8]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREWindows_Flag
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x402093
push 0x408b4c
call fcn.004022f0
add esp, 4
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.00406518
add esp, 0x10c
ret
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x408af8
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4020c8
lea eax, [esp + 0xc]
push eax
push 0x408b00
call fcn.004022f0
add esp, 8
jmp 0x402112
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4020d0
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push 0x408af8
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x402105
push esi
push 0x408b14
call fcn.004022f0
add esp, 8
jmp 0x402112
push 0x408b30
call fcn.004022f0
add esp, 4
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
call fcn.00406518
add esp, 0x10c
ret
Function at 0x402140
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x6c
mov eax, dword [0x40c1c0]
xor eax, esp
mov dword [esp + 0x68], eax
push 0x27
lea eax, [esp + 0x44]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 4], 0x27
lea eax, [esp]
push eax
push 0x2001f
push 0
push str.SOFTWAREWindows_Flag
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4021b2
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREWindows_Flag
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402295
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x44]
push eax
push 0
push 0
push str.GUID
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4021ea
lea eax, [esp + 0x40]
push eax
push 0x408a88
call fcn.004022f0
add esp, 8
jmp 0x40228c
lea eax, [esp + 8]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
js 0x40228c
movzx eax, byte [esp + 0x17]
push eax
movzx eax, byte [esp + 0x1a]
push eax
movzx eax, byte [esp + 0x1d]
push eax
movzx eax, byte [esp + 0x20]
push eax
movzx eax, byte [esp + 0x23]
push eax
movzx eax, byte [esp + 0x26]
push eax
movzx eax, byte [esp + 0x29]
push eax
movzx eax, byte [esp + 0x2c]
push eax
movzx eax, word [esp + 0x2e]
push eax
movzx eax, word [esp + 0x30]
push eax
push dword [esp + 0x30]
lea eax, [esp + 0x44]
push str._08lX__04hX__04hX__02hhX_02hhX__02hhX_02hhX_02hhX_02hhX_02hhX_02hhX
push 0x27
push eax
call fcn.004022c0
lea eax, [esp + 0x50]
push eax
push 0x408ae4
call fcn.004022f0
lea ecx, [esp + 0x58]
add esp, 0x40
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402267
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push str.GUID
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00406518
add esp, 0x6c
ret

Function at 0x4022f0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x404
mov eax, dword [0x40c1c0]
xor eax, esp
mov dword [esp + 0x400], eax
lea eax, [esp + 0x40c]
push eax
push 0
push dword [esp + 0x410]
lea eax, [esp + 0xc]
push 0x400
push eax
call fcn.004022b0
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
lea eax, [esp + 0x1c]
push eax
push 0x408b64
call fcn.00402370
add esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00406518
add esp, 0x404
ret
Function at 0x403dc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xa
push dword [esp + 0x10]
mov dword [esi], eax
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x403df5
push 0x408c38
call fcn.004022f0
add esp, 4
xor al, al
pop edi
pop esi
ret 4
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403e16
push 0x408c48
call fcn.004022f0
add esp, 4
xor al, al
pop edi
pop esi
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push dword [esi]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push 0x408c58
mov dword [esi + 8], eax
call fcn.004022f0
add esp, 8
mov al, 1
pop edi
pop esi
ret 4
Function at 0x404390
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x40c1c0]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x404452
cmp byte [esi + 0x3d], 0
je 0x404452
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40443f
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x404403
sub eax, 1
je 0x404407
sub eax, 2
jne 0x40443f
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00406518
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x404427
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40443f
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00406518
add esp, 0x28
ret
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00406518
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
mov al, 1
pop esi
xor ecx, esp
call fcn.00406518
add esp, 0x28
ret