joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4abcc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
test ecx, ecx
je 0x4abd89
mov edx, 0x53ca10
lea edi, [esi + 0xc]
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4abd89
add ecx, 4
add edx, 4
sub edi, 4
jae 0x4abce0
cmp dword [ebp + 0x10], 0x28
je 0x4abd0a
mov esi, 0x80040100
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], esi
push eax
push 0x20019
push 0
push str.SoftwareLDSGameMasterDebug
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4abd6d
lea eax, [ebp - 4]
mov dword [ebp + 0x10], esi
push eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], 4
push eax
push 0
push 0
push str.ScriptError
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4abd60
cmp dword [ebp + 0x10], 1
mov eax, 0x80040100
cmove esi, eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
js 0x4abd8e
mov eax, dword [ebp + 0x1c]
mov ecx, 0xb
pop edi
mov word [eax], cx
or ecx, 0xffffffff
mov word [eax + 8], cx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov esi, 0x80040104
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4ace40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511e6b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x554418]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x230]
xor edi, edi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl_
mov dword [ebp - 0x234], edi
call fcn.00405170
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [ebp - 4], edi
jb 0x4ace95
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x230]
push eax
call fcn.00409920
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4acf2a
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004d3ba0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x4acf2a
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push eax
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov ecx, 1
cmove edi, ecx
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x4acf3b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x4acf77
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4acf6d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4acf96
push edx
push ecx
call fcn.0043ee21
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043f0c9
mov esp, ebp
pop ebp
ret 8
call fcn.004d7009
int3
Function at 0x4ad880
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511f10
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x554418]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x1c], 0
je 0x4ad9c7
cmp dword [edi + 0x14], 0
je 0x4ad9c7
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
lea eax, [ebx + ebx]
call fcn.0043f540
mov esi, esp
test esi, esi
je 0x4ad9c7
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [edi + 0x14]
mov ecx, esi
mov eax, dword [eax + 0x7c0]
lea edx, [ecx + 2]
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ad910
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00409b90
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
mov dword [ebp - 4], 0
test eax, eax
je 0x4ad956
mov esi, ecx
cmp word [esi], 0xa
je 0x4ad9ea
add esi, 2
sub eax, 1
jne 0x4ad944
mov ecx, dword [edi + 0x14]
lea edx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae edx, dword [ebp - 0x28]
mov eax, dword [ecx]
push edx
call dword [eax + 0x188]
mov esi, dword [edi + 4]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
jne 0x4ad9a2
push 0
push 0
push 0xb0
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
and eax, 0xf
lea ecx, [ebx - 1]
cmp eax, ecx
je 0x4ad9a2
push ebx
push ebx
push 0xb1
push dword [edi + 4]
call esi
mov ecx, dword [edi + 0x14]
push 0
push 0
push 0
mov eax, dword [ecx]
push str.textchanged
push dword [ebp - 0x44]
call dword [eax + 0x20]
mov ecx, eax
call fcn.00454b70
lea ecx, [ebp - 0x28]
call fcn.004055f0
xor eax, eax
lea esp, [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043f0c9
mov esp, ebp
pop ebp
ret 0x10
test esi, esi
je 0x4ad956
sub esi, ecx
sar esi, 1
cmp esi, 0xffffffff
je 0x4ad956
push esi
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0048d4d0
mov edx, eax
cmp dword [edx + 0x14], 8
mov byte [ebp - 4], 1
jb 0x4ada1c
mov edx, dword [edx]
mov ecx, dword [edi + 0x14]
push edx
mov eax, dword [ecx]
call dword [eax + 0x188]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.004055f0
push esi
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0048d4d0
cmp dword [eax + 0x14], 8
jb 0x4ada4b
mov eax, dword [eax]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x40]
call fcn.004055f0
jmp 0x4ad9a2
Function at 0x4ae400
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, dword [edi]
cmp eax, 0x17
jne 0x4ae42d
movzx eax, word [esi + 0x554]
push eax
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
pop edi
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp dword [sym.imp.USER32.dll_SetCursor]
cmp eax, 0xd
jne 0x4ae47c
mov eax, dword [esi]
call dword [eax + 0x34]
push dword [edi + 0x10]
push dword [edi + 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4ae4dd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x34]
movups xmm0, xmmword [eax]
movups xmmword [esi + 0x560], xmm0
mov eax, dword [edi + 0xc]
mov dword [esi + 0x558], eax
mov eax, dword [edi + 0x10]
pop edi
mov dword [esi + 0x55c], eax
mov byte [esi + 0x570], 1
pop esi
pop ebp
ret 4
cmp eax, 0xe
jne 0x4ae49d
mov ecx, dword [esi + 0x550]
mov byte [esi + 0x570], 0
test ecx, ecx
je 0x4ae4dd
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebp
ret 4
cmp eax, 9
jne 0x4ae4d7
cmp dword [esi + 0x550], 0
je 0x4ae4dd
cmp byte [esi + 0x570], 0
je 0x4ae4dd
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4ae4dd
mov ecx, dword [esi + 0x550]
lea eax, [edi + 0xc]
push eax
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
pop esi
pop ebp
ret 4
push edi
call fcn.004575e0
pop edi
pop esi
pop ebp
ret 4

Function at 0x4ae4f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, dword [edi]
cmp eax, 0xd
jne 0x4ae53f
mov eax, dword [esi]
push ebx
call dword [eax + 0x34]
push dword [edi + 0x10]
mov ebx, eax
push dword [edi + 0xc]
push ebx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4ae538
mov eax, dword [edi + 0xc]
sub eax, dword [ebx]
mov dword [esi + 0x554], eax
mov eax, dword [edi + 0x10]
sub eax, dword [ebx + 4]
mov dword [esi + 0x558], eax
mov byte [esi + 0x55c], 1
pop ebx
pop edi
pop esi
pop ebp
ret 4
cmp eax, 0xe
jne 0x4ae560
mov ecx, dword [esi + 0x550]
mov byte [esi + 0x55c], 0
test ecx, ecx
je 0x4ae539
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebp
ret 4
cmp eax, 9
jne 0x4ae592
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4ae592
mov ecx, dword [esi + 0x550]
test ecx, ecx
je 0x4ae539
cmp byte [esi + 0x55c], 0
je 0x4ae539
mov edx, dword [ecx]
lea eax, [edi + 0xc]
pop edi
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp dword [edx]
push edi
mov ecx, esi
call fcn.004575e0
pop edi
pop esi
pop ebp
ret 4
Function at 0x4b3cc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5121db
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x554418]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x420]
push eax
call fcn.004d3ba0
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4b3e01
cmp eax, 0x104
ja 0x4b3e01
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004d3ba0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0x52e2dc
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4b3db2
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b3d90
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x438]
call fcn.00409b90
movups xmm0, xmmword [ebp - 0x438]
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x438]
mov dword [esi + 0x14], 0
xor eax, eax
movups xmmword [esi], xmm0
mov word [ebp - 0x438], ax
movq xmm0, qword [ebp - 0x428]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
call fcn.004055f0
jmp 0x4b3e26
movups xmm0, xmmword [ebp - 0x438]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x428]
movq qword [esi + 0x10], xmm0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043f0c9
mov esp, ebp
pop ebp
ret
Function at 0x4b4210
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512218
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x554418]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
cmp byte [esi + 0x20], 0
jne 0x4b4257
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x18], 1
jbe 0x4b4293
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push 0x4b4960
push 0
push 0
call fcn.004dc959
xor ecx, ecx
mov dword [esi + 0x10], eax
add esp, 0x18
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ebx, [esi + 0x60]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [esi + 0x44]
call sub.gdiplus.dll_GdipCreateFromHDC
mov edi, dword [ebp - 0x10]
mov esi, eax
mov dword [ebp - 0x1c], edi
push 0xffffffffffffffff
push edi
mov dword [ebp - 4], 0
call sub.gdiplus.dll_GdipGraphicsClear
test eax, eax
cmovne esi, eax
mov eax, dword [ebp - 0x14]
push dword [eax + 0x2c]
push dword [eax + 0x28]
push 0
push 0
push dword [eax + 4]
push edi
call sub.gdiplus.dll_GdipDrawImageRectI
test eax, eax
push ebx
cmovne esi, eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x14]
mov ecx, dword [esi + 0x4c]
call fcn.00458100
mov ecx, esi
call fcn.004b4620
push edi
call sub.gdiplus.dll_GdipDeleteGraphics
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b9c20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5124b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x554418]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0043edf1
mov edi, eax
add esp, 4
test edi, edi
je 0x4b9cc4
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0043a61d
add esp, 4
mov dword [edi + 4], eax
jmp 0x4b9cc6
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.0041a4a0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x4b9d27
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x4b9d27
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x4b9d4a
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x4b9d6d
cmp byte [ebp + 0xc], 0
je 0x4b9d59
push esi
call fcn.0043aad8
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x4b9d79
mov esi, str.ios_base::badbit_set
jmp 0x4b9d89
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.00413910
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.0040f160
push 0x5471e8
lea eax, [ebp - 0x30]
push eax
call fcn.004d2c81
int3
Function at 0x4bc960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512ac1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x554418]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [edi], 0
call fcn.00407780
mov ecx, eax
test ecx, ecx
je 0x4bcaf4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 1
push eax
push 0xf003f
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4bcab5
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 0
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
push eax
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4bcaa7
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4bcab5
add eax, 0x10
push 0x55c716
push eax
mov dword [ebp - 0x20], eax
call fcn.0043f236
mov esi, eax
add esp, 8
test esi, esi
je 0x4bcab5
push dword [ebp - 0x20]
push 0
push esi
call fcn.004d3ba0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4bca6a
push esi
call fcn.0043f1f1
add esp, 4
jmp 0x4bcab5
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4bca70
sub ecx, edx
sar ecx, 1
je 0x4bca9e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4bca86
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.004117d0
push esi
call fcn.0043f1f1
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4bcab5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4bcad4
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043f0c9
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00406290
int3
Function at 0x4bcb00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x554418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, edi
mov dword [ebp - 0xc], eax
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4bcb24
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x4bcb86
lea eax, [esi*2 + 2]
push eax
push edi
push 1
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 8]
inc ebx
test eax, eax
je 0x4bcb86
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4bcba1
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f0c9
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4bebb5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4f47b5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f4475
Function at 0x502120
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514220
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x554418]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
test edi, edi
je 0x502269
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x502269
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x502269
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x502269
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 5
push SysReAllocString
push edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, 0xffffffff
je 0x502255
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push edi
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x50224e
cmp dword [ebp - 0x1c], ebx
jne 0x50224e
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
cmp eax, ecx
ja 0x5021ed
mov dword [esi + 0x10], eax
mov ecx, esi
cmp dword [esi + 0x14], 0x10
jb 0x5021e7
mov ecx, dword [esi]
mov byte [ecx + eax], 0
jmp 0x5021f9
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00412960
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push dword [ebp - 0x20]
mov ecx, esi
push 0
call fcn.0041fc40
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jne 0x50224e
push edi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402ef0
Capabilities:
Get file version info

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
sub esp, 8
lea edx, [esp]
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
xor edi, edi
push edx
mov dword [eax], edi
push ebx
mov dword [ecx], edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x402f8c
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push edi
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x402f74
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0x439308
push ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x402f74
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edi, 1
mov edx, dword [eax + 8]
mov dword [ecx], edx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x24]
mov dword [eax], edx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x403ee0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x403f17
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 8]
push edx
mov edx, dword [esp + 0x10]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403f17
mov eax, 1
ret
xor eax, eax
ret

Function at 0x403f20
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
test esi, esi
mov dword [esp + 0x18], edi
jne 0x403f37
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0xc]
test eax, eax
je 0x403f6a
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push esi
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403f6a
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x403f7e
cmp eax, 2
je 0x403f7e
mov eax, dword [esp + 0x1c]
mov byte [esi], 0
test eax, eax
je 0x403f7e
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop edi
pop esi
ret

Function at 0x403f90
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x403fb5
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x404000
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x404028
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 3
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
ret
xor eax, eax
ret