joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4111c9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [esi + 0x8c]
push 0x411320
push 8
call fcn.004015a0
mov ecx, dword [esi + 0x94]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
xor eax, eax
lea edx, [ebp - 4]
push edx
push eax
lea edx, [ebp - 0x1c]
push edx
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ecx + 0x20]
mov ebx, 0x40cca0
push ebx
push ecx
mov dword [ebp - 0xc], eax
call edi
cmp dword [ebp - 4], 0
je 0x411312
test eax, eax
jne 0x411312
cmp dword [ebp - 0x1c], 7
jne 0x411312
mov eax, dword [ebp - 4]
xor ecx, ecx
push 2
shr eax, 1
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00402dad
push dword [ebp - 4]
mov dword [ebp - 8], eax
push 0
push eax
call sub.msvcrt.dll_memset
xor ecx, ecx
add esp, 0x10
cmp dword [ebp - 8], ecx
je 0x421252
mov eax, dword [esi + 0x94]
mov eax, dword [eax + 0x20]
lea edx, [ebp - 4]
push edx
push dword [ebp - 8]
push ecx
push ecx
push ebx
push eax
call edi
test eax, eax
jne 0x421277
shr dword [ebp - 4], 1
je 0x421277
and dword [ebp - 0x18], 0
cmp dword [ebp - 4], 0
mov edi, dword [ebp - 8]
jbe 0x411301
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x104
push edi
call fcn.00411389
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x411317
inc dword [ebp - 0x10]
push edi
lea ecx, [ebp - 0x14]
call fcn.00407b85
push dword [ebp - 0x14]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jbe 0x4112eb
push dword [ebp - 0x14]
mov ecx, esi
call fcn.00410fbf
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x421285
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x14]
add dword [ebp - 0x18], eax
lea edi, [edi + eax*2]
call ebx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 4]
jb 0x4112a3
push dword [ebp - 8]
call fcn.00402d9c
mov eax, dword [ebp - 0xc]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
inc eax
jmp 0x41130d
mov dword [ebp - 0xc], 1
jmp 0x411301
mov eax, dword [ebp - 4]
shr eax, 1
push eax
push dword [esi + 0x8c]
push 0x421360
push 1
call fcn.004015a0
add esp, 0x10
mov eax, 0x8007000e
jmp 0x41130d
push dword [ebp - 8]
call fcn.00402d9c
pop ecx
jmp 0x411312
push dword [ebp - 0xc]
push dword [esi + 0x8c]
push 0x4212a8
push 1
call fcn.004015a0
add esp, 0x10
push dword [ebp - 0x14]
call ebx
jmp 0x411301
Function at 0x415315
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x210]
push eax
xor edi, edi
push edi
push 0x400
push 0x4153f0
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], edi
call sub.SHELL32.dll_SHGetKnownFolderPath
mov esi, eax
cmp esi, edi
jne 0x431aa0
push ebx
push edi
push 0x415420
push dword [ebp - 0x210]
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0040dcb0
push dword [ebp - 0x210]
mov ebx, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp ebx, edi
jl 0x431ab7
push edi
push 0x415414
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.004152c5
mov ebx, eax
cmp ebx, edi
jl 0x431abf
push edi
push 0x415400
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.004152c5
mov esi, eax
cmp esi, edi
jl 0x431ad6
mov ecx, dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push eax
add ecx, 0x4c
call fcn.0040585c
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00401580
leave
ret
push esi
push 0x431ca8
push 1
call fcn.004015a0
add esp, 0xc
mov eax, esi
jmp 0x4153e2
push ebx
push 0x431c18
jmp 0x431ac5
push ebx
push 0x431b80
push 1
call fcn.004015a0
add esp, 0xc
mov eax, ebx
jmp 0x4153e1
push esi
push 0x431af0
push 1
call fcn.004015a0
add esp, 0xc
mov eax, esi
jmp 0x4153e1

Function at 0x415444
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x664
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push edi
push ebx
mov esi, 0x104
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0040dcb0
test eax, eax
jl 0x430dea
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4154c1
test byte [ebp - 0x664], 0x10
je 0x430e01
lea eax, [ebp - 0x664]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41549b
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401580
leave
ret 8
push eax
push edi
push ebx
push 0x430f78
push 1
call fcn.004015a0
add esp, 0x14
jmp 0x4154c1
push 0
lea eax, [ebp - 0x638]
push eax
push ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0040dcb0
test eax, eax
jl 0x430e56
push 0x80
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
push 0x430f20
push 8
call fcn.004015a0
add esp, 0xc
jmp 0x4154a8
push eax
lea eax, [ebp - 0x638]
push eax
push ebx
push 0x430e78
push 1
call fcn.004015a0
add esp, 0x14
jmp 0x4154a8
Function at 0x4154d7
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x270], ecx
mov dword [ebp - 0x274], esi
test esi, esi
je 0x415619
push esi
push 0x415640
push 8
call fcn.004015a0
add esp, 0xc
push esi
push 0x104
lea eax, [ebp - 0x26c]
push eax
call fcn.00408e49
test eax, eax
jl 0x431014
lea eax, [ebp - 0x26c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x415537
sub eax, edx
sar eax, 1
je 0x415558
add eax, eax
cmp word [ebp + eax - 0x26e], 0x5c
jne 0x431029
push 0x3c
lea eax, [ebp - 0x40]
push 0
push eax
mov dword [ebp - 0x44], 0x2a
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x40d7c0
push 0x20
lea eax, [ebp - 0x44]
push eax
call fcn.0040f16c
test eax, eax
jl 0x415599
mov ecx, dword [ebp - 0x270]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x26c]
push eax
call fcn.00415444
push 0x41562c
push 0x114
lea eax, [ebp - 0x26c]
push eax
call fcn.0040f16c
test eax, eax
jl 0x431043
push ebx
push edi
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, eax
push 0x80
lea eax, [ebp - 0x26c]
push eax
call esi
mov ecx, dword [ebp - 0x270]
mov edi, 0x415628
push edi
lea eax, [ebp - 0x26c]
push eax
call fcn.00415444
mov ecx, dword [ebp - 0x270]
push edi
push dword [ecx + 0x4c]
call fcn.00415444
push ebx
lea eax, [ebp - 0x26c]
push eax
call esi
push 2
push dword [ebp - 0x274]
call esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401580
leave
ret 4
push eax
push 0x4310e8
push 1
call fcn.004015a0
add esp, 0xc
jmp 0x415619
push 0x5c
pop ecx
mov word [ebp + eax - 0x26c], cx
xor ecx, ecx
mov word [ebp + eax - 0x26a], cx
jmp 0x415558
push eax
push 0x431050
jmp 0x43101a
Function at 0x415f7a
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.00415f59
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x41601c
cmp dword [ebp - 0x94], 5
jb 0x415fef
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x416038
call fcn.00414c15
test eax, eax
jl 0x43a757
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00401580
leave
ret
cmp dword [ebp - 0x88], 1
je 0x43a73f
jmp 0x415fef
cmp dword [ebp - 0x90], 0
jbe 0x415fef
jmp 0x415feb
cmp dword [ebp - 0x94], 4
ja 0x415feb
je 0x41602b
jmp 0x415fef
mov byte [0x484bc0], 1
jmp 0x41600d

Function at 0x416230
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
xor edi, edi
push 0x4163ec
mov dword [ebp - 8], edi
call sub.slc.dll_SLGetWindowsInformationDWORD
test eax, eax
jl 0x43ace1
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
push 1
push edi
mov ebx, 0x416300
push ebx
push 0x80000002
mov dword [ebp - 0xc], edi
call esi
test eax, eax
je 0x43ace9
lea eax, [ebp - 4]
push eax
push 1
push edi
push ebx
push 0x80000001
mov dword [ebp - 0x10], edi
call esi
test eax, eax
je 0x43ad1d
lea eax, [ebp - 4]
push eax
xor ebx, ebx
inc ebx
push ebx
push edi
push 0x416360
push 0x80000002
mov dword [ebp - 0x14], ebx
call esi
test eax, eax
jne 0x4162e1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push 0x4163d0
push dword [ebp - 4]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43ad51
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], edi
je 0x4162fc
cmp dword [ebp - 0xc], edi
jne 0x4162fc
cmp dword [ebp - 0x10], edi
jne 0x4162fc
cmp dword [ebp - 0x14], edi
je 0x4162fc
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x4162f7
mov dword [ebp - 8], edi
jmp 0x416256
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x43ad60
push dword [ebp - 4]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x43ad0f
mov dword [ebp - 0xc], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41627b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push 0x43ad60
push dword [ebp - 4]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x43ad43
mov dword [ebp - 0x10], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x416295
mov dword [ebp - 0x14], ebx
jmp 0x4162d8
Function at 0x41678e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x40], bl
jne 0x4167b5
push 0x4167b8
mov byte [esi + 0x40], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x44], eax
cmp eax, ebx
jne 0x43ad87
pop esi
pop ebx
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43ae94
push eax
call edi
push 0x43ae84
push dword [esi + 0x44]
mov dword [esi + 0xc], eax
call edi
push 0x43ae70
push dword [esi + 0x44]
mov dword [esi + 0x10], eax
call edi
push 0x43ae5c
push dword [esi + 0x44]
mov dword [esi], eax
call edi
push 0x43ae44
push dword [esi + 0x44]
mov dword [esi + 4], eax
call edi
push 0x43ae30
push dword [esi + 0x44]
mov dword [esi + 8], eax
call edi
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x14], eax
pop edi
cmp ecx, ebx
je 0x43ae1d
cmp dword [esi + 0x10], ebx
je 0x43ae1d
cmp dword [esi], ebx
je 0x43ae1d
cmp dword [esi + 4], ebx
je 0x43ae1d
cmp dword [esi + 8], ebx
je 0x43ae1d
cmp eax, ebx
je 0x43ae1d
lea eax, [esi + 0x18]
push eax
push dword [esi + 0x38]
call ecx
mov dword [esi + 0x3c], eax
cmp eax, ebx
jne 0x4167b5
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x44], ebx
jmp 0x4167b5
Function at 0x4175e7
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x4177a0
push 8
mov esi, ecx
call fcn.004015a0
pop ecx
pop ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x104
lea eax, [ebp - 0x210]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
cmp ax, word [ebp - 0x210]
je 0x42ca26
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
cmp ebx, edi
jbe 0x42ca08
push ebx
call fcn.00402dad
pop ecx
mov dword [ebp - 0x214], eax
test eax, eax
je 0x42c9f0
push eax
push ebx
push edi
lea eax, [ebp - 0x210]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x42c9c5
and dword [ebp - 0x218], edi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x41779c
push dword [ebp - 0x214]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x42c9a7
mov ecx, dword [ebp - 0x218]
mov eax, dword [ecx + 8]
mov dword [esi + 0xb4], eax
mov ecx, dword [ecx + 0xc]
lea eax, [esi + 0xb0]
mov dword [eax], ecx
movzx eax, cx
push eax
movzx eax, word [esi + 0xb2]
push eax
movzx eax, word [esi + 0xb4]
push eax
movzx eax, word [esi + 0xb6]
push eax
push 0x417718
push 8
call fcn.004015a0
add esp, 0x18
push dword [ebp - 0x214]
call fcn.00402d9c
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401580
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42c9bb
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x42ccb8
jmp 0x42c9e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42c9d9
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x42cc20
push 1
call fcn.004015a0
add esp, 0xc
jmp 0x4176f6
push 0x42cb90
push 1
call fcn.004015a0
pop ecx
pop ecx
mov edi, 0x8007000e
jmp 0x417702
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x42ca1c
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x42caf0
jmp 0x42ca42
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x42ca3a
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x42ca58
push 1
call fcn.004015a0
add esp, 0xc
jmp 0x417702
Function at 0x43bff0
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, dword [ebp + 0x18]
push ebx
push esi
mov dword [ebp - 0x8c], eax
mov eax, dword [eax + 0x50]
xor esi, esi
push edi
mov dword [ebp - 0x90], ecx
cmp eax, esi
je 0x43c0eb
cmp eax, 0xffffffff
je 0x43c0eb
cmp dword [ebp + 0x10], esi
je 0x43c0d6
mov edi, dword [ebp + 0x14]
lea eax, [edi + 1]
movzx eax, ax
mov dword [ebp - 0x88], eax
movzx eax, ax
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00402dad
mov ebx, eax
pop ecx
cmp ebx, esi
je 0x43c0eb
movzx edi, di
shl edi, 2
push edi
push dword [ebp - 0x90]
push ebx
call sub.msvcrt.dll_memcpy
xor eax, eax
push 0x7e
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push esi
push eax
call sub.msvcrt.dll_memset
push 0x10
lea eax, [ebp - 0x84]
push eax
push esi
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll__ui64tow]
add esp, 0x28
push esi
push ebx
push esi
push dword [ebp - 0x88]
mov dword [edi + ebx], eax
mov eax, dword [ebp - 0x8c]
push esi
push dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push dword [eax + 0x50]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call fcn.00402d9c
pop ecx
jmp 0x43c0eb
push esi
push ecx
push esi
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401580
leave
ret 0x14

Function at 0x43c5f2
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ebx, ecx
test esi, esi
jne 0x43c60d
push 0x80004005
call fcn.0043c236
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x43c60f
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x43ce41
Capabilities:
Delete service
Stop service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
call fcn.0043bfab
test eax, eax
je 0x43cf69
push esi
push edi
push 0xf003f
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, edi
jne 0x43ce93
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, edi
jle 0x43ce8b
and esi, 0xffff
or esi, 0x80070000
push esi
push 0x43d0e0
jmp 0x43cecf
push 0x10020
add ebx, 0x5c
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x43cee0
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, edi
jle 0x43cec9
and esi, 0xffff
or esi, 0x80070000
push esi
push 0x43d068
push 1
call fcn.004015a0
add esp, 0xc
mov eax, esi
jmp 0x43cf67
lea ecx, [ebp - 0x24]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x80070000
test eax, eax
jne 0x43cf28
call esi
mov edi, eax
test edi, edi
jle 0x43cf0c
and edi, 0xffff
or edi, ebx
cmp edi, 0x426
je 0x43cf26
push edi
push 0x43cff0
push 1
call fcn.004015a0
add esp, 0xc
jmp 0x43cf28
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x43cf55
call esi
mov edi, eax
test edi, edi
jle 0x43cf45
and edi, 0xffff
or edi, ebx
push edi
push 0x43cf70
push 1
call fcn.004015a0
add esp, 0xc
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 8]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43d487
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, ecx
mov ecx, dword [ebp + 8]
push 0x2001f
push ecx
push dword [eax]
xor esi, esi
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
call fcn.0040314f
mov edi, eax
cmp edi, esi
je 0x43d4f9
lea ecx, [ebp - 0x214]
call fcn.004030f0
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00401580
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x43d517
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.0043d487
cmp eax, esi
jne 0x43d562
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x208], 0x100
call edi
test eax, eax
je 0x43d501
lea ecx, [ebp - 0x214]
call fcn.004030f0
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x218]
call fcn.0043c495
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.004030f0
mov eax, esi
jmp 0x43d4e9
Function at 0x440e18
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x418
mov eax, 0x47dc77
call fcn.00408d9b
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x41c], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x414], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x418], eax
cmp eax, esi
jne 0x440e71
call fcn.0043c390
mov esi, eax
jmp 0x440f50
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x440e8a
call fcn.0043c390
jmp 0x440f42
push edi
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, esi
je 0x440e80
push edi
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
jae 0x440ee6
lea eax, [ebp - 0x410]
cmp dword [ebp - 0x414], eax
je 0x440ecc
lea ecx, [ebp - 0x414]
call fcn.0043cd36
mov esi, 0x8007000e
lea ecx, [ebp - 0x41c]
call fcn.00414e44
mov eax, esi
call fcn.00408e35
ret 0x10
push eax
lea ecx, [ebp - 0x414]
call fcn.0043f378
mov dword [ebp - 4], 1
cmp dword [ebp - 0x414], esi
jne 0x440f08
mov esi, 0x8007000e
jmp 0x440f44
push edi
push dword [ebp - 0x414]
push edi
push ebx
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x440e80
mov edx, dword [ebp - 0x414]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x414]
lea ecx, [ebp - 0x424]
call fcn.00440920
mov esi, eax
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x410]
cmp dword [ebp - 0x414], eax
je 0x440ed1
lea ecx, [ebp - 0x414]
call fcn.0043cd36
jmp 0x440ed1
Function at 0x441e8b
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
mov esi, ecx
mov eax, dword [esi]
push 0x64
push esi
call dword [eax + 0x20]
mov edi, eax
test edi, edi
jge 0x441ebe
cmp edi, 0x80020009
je 0x441ebe
push edi
push 0x442058
push 1
call fcn.004015a0
add esp, 0xc
mov ebx, edi
mov ecx, esi
call fcn.0043ce41
mov edi, eax
test edi, edi
jge 0x441edd
push edi
push 0x441fd8
push 1
call fcn.004015a0
add esp, 0xc
mov ebx, edi
push 0
push 0
mov ecx, esi
call fcn.004414e5
mov esi, eax
test esi, esi
jge 0x441f00
push esi
push 0x441f48
push 1
call fcn.004015a0
add esp, 0xc
mov ebx, esi
push 0x43b1e8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x441f3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x441f2c
and ebx, 0xffff
or ebx, 0x80070000
push ebx
push 0x442058
push 1
call fcn.004015a0
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x4505da
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
lea esi, [ecx + 0x88]
push dword [esi]
push 0x450608
push 8
call fcn.004015a0
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [esi], eax
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x451aeb
Capabilities:
Get geographical location

Disassembly:
push 4
mov eax, 0x47e364
call fcn.00402847
mov esi, ecx
push dword [esi + 0x50]
push 0x451e68
push 8
call fcn.004015a0
and dword [ebp - 0x10], 0
add esp, 0xc
mov eax, dword [esi + 0x60]
and dword [ebp - 4], 0
test eax, eax
jne 0x451b36
mov eax, 0x80004002
push eax
push dword [esi + 0x50]
mov edi, eax
push 0x451dc8
push 1
call fcn.004015a0
add esp, 0x10
jmp 0x451b97
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push 0x43baac
push eax
call dword [ecx]
mov edi, eax
test edi, edi
jge 0x451b55
push edi
push dword [esi + 0x50]
push 0x451d20
jmp 0x451b2a
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x451b6c
push dword [esi + 0x88]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov edi, eax
jmp 0x451b7e
push dword [esi + 0x50]
push 0x451c58
push 1
call fcn.004015a0
add esp, 0xc
test edi, edi
jge 0x451b97
push edi
push dword [esi + 0x50]
push 0x451bb0
push 1
call fcn.004015a0
add esp, 0x10
xor edi, edi
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x451ba8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
call fcn.00402881
ret