joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4088e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
mov eax, dword [0x43b010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x408979
xor eax, eax
push 0x2fe
push eax
mov word [ebp - 0x304], ax
lea eax, [ebp - 0x302]
push eax
call fcn.0041a7b0
add esp, 0xc
lea eax, [ebp - 0x304]
push 0x180
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x408979
lea eax, [ebp - 0x304]
push str.RCLID_
push eax
call fcn.00417e59
add esp, 8
test eax, eax
je 0x408979
lea eax, [ebp - 0x2f8]
push eax
call fcn.004178f4
lea ecx, [ebp - 0x304]
mov edx, eax
push ecx
mov ecx, dword [0x43e928]
call fcn.00404d70
add esp, 8
lea eax, [ebp - 0x304]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.0041729b
mov esp, ebp
pop ebp
ret 8

Function at 0x408c20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x604
mov eax, dword [0x43b010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov edi, edx
push 0x1fe
push eax
mov word [ebp - 0x204], ax
mov esi, ecx
lea eax, [ebp - 0x202]
push eax
call fcn.0041a7b0
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x604], ax
lea eax, [ebp - 0x602]
push eax
call fcn.0041a7b0
add esp, 0x18
lea eax, [ebp - 0x204]
push pe_nt_image_headers32
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x204]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408c90
sub eax, edx
sar eax, 1
je 0x408ccb
push edi
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x604]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test eax, eax
je 0x408ccb
lea eax, [ebp - 0x604]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041729b
mov esp, ebp
pop ebp
ret
Function at 0x40b720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor bl, bl
mov esi, 0x43c5f0
cmp dword [0x43c604], 8
push edi
cmovae esi, dword [0x43c5f0]
push esi
push ecx
call fcn.00417e59
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x40b81d
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40b755
sub esi, edx
sar esi, 1
inc esi
push 0x434f6c
lea edi, [ecx + esi*2]
lea eax, [edi + 2]
mov dword [ebp - 8], edi
push eax
call fcn.00417e59
push 0x435aa8
push edi
mov esi, eax
call fcn.00417e59
add esp, 0x10
test esi, esi
je 0x40b814
test eax, eax
je 0x40b814
sub esi, edi
xor ecx, ecx
sar esi, 1
mov edx, 2
mov dword [ebp - 0xc], esi
lea eax, [esi + 1]
mov dword [ebp - 4], eax
mul edx
seto cl
neg ecx
or ecx, eax
call fcn.00414590
mov esi, eax
test esi, esi
je 0x40b814
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x40b7d4
xor eax, eax
mov edi, esi
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [ebp - 8]
push dword [ebp - 0xc]
push edi
push esi
call fcn.00417c33
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40b7ef
mov bl, 1
mov eax, dword [0x43e5bc]
mov dword [ebp - 0xc], esi
test eax, eax
jne 0x40b809
call fcn.004156f0
mov dword [0x43e5bc], eax
test eax, eax
je 0x40b814
lea ecx, [ebp - 0xc]
push 1
push ecx
call eax
add esp, 8
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c220
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42a786
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x43b010]
xor eax, esp
mov dword [esp + 0x14c], eax
push ebx
push esi
mov eax, dword [0x43b010]
xor eax, esp
push eax
lea eax, [esp + 0x160]
mov dword fs:[0], eax
mov esi, ecx
push 0x2a
xor eax, eax
mov dword [esp + 0x54], 7
push str.SoftwareHewlett_PackardHP_Print_Settings
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], 0
mov bl, 1
mov word [esp + 0x44], ax
call fcn.0040adb0
cmp dword [esp + 0x50], 8
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0
push ecx
push 0
push 0xf003f
push 0
push 0
lea eax, [esp + 0x54]
mov dword [esp + 0x2c], 2
cmovae eax, dword [esp + 0x54]
push 0
push eax
push 0x80000002
mov byte [esp + 0x40], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x40c2e5
cmp dword [esp + 0xc], 1
jne 0x40c2ed
mov byte [esp + 0x1c], bl
jmp 0x40c2ed
mov dword [esp + 0x10], 0
mov dword [esp + 0x168], 0
cmp dword [esp + 0x50], 8
jb 0x40c30b
push dword [esp + 0x3c]
call fcn.004144c0
add esp, 4
xor eax, eax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], 0
mov word [esp + 0x24], ax
lea eax, [esp + 0x24]
mov byte [esp + 0x168], 1
push eax
push 0x43c9d0
mov ecx, esi
call fcn.0040df90
test al, al
je 0x40c37c
push str.19728374
call fcn.004178fd
mov dword [esp + 0x10], eax
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40c37a
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push 0
push str.UPDADS
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov dword [esp + 0x18], eax
sete bl
jmp 0x40c37c
xor bl, bl
lea eax, [esp + 0x24]
mov ecx, esi
push eax
push 0x43ca90
call fcn.0040df90
mov esi, dword [esp + 0x10]
test al, al
je 0x40c3dd
test esi, esi
je 0x40c3dd
lea eax, [esp + 0xc]
mov dword [esp + 0xc], pe_nt_image_headers32
push eax
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x28]
push eax
push 0
push str.UPDADS
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40c3c9
cmp eax, 0xea
jne 0x40c3d5
push str.UPDADS
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x18], eax
cmp dword [esp + 0x38], 8
jb 0x40c3f4
push dword [esp + 0x24]
call fcn.004144c0
mov esi, dword [esp + 0x14]
add esp, 4
xor eax, eax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], 0
mov word [esp + 0x24], ax
test esi, esi
je 0x40c416
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [esp + 0x160]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.0041729b
mov esp, ebp
pop ebp
ret
Function at 0x40d720
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a960
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x43b010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 3
xor eax, eax
mov dword [ebp - 0x14], 7
push 0x435db4
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.0040adb0
push 0xffffffffffffffff
push 0
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a2a0
push 0x3c
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.0041a7b0
add esp, 0xc
mov dword [ebp - 0x64], 0x3c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x60], 0x40
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x58], str.runas
mov dword [ebp - 0x54], 0x435dc8
mov dword [ebp - 0x48], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 8
jb 0x40d7f6
push dword [ebp - 0x28]
call fcn.004144c0
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
cmp dword [ebp + 0x1c], 8
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
jb 0x40d81b
push dword [ebp + 8]
call fcn.004144c0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041729b
mov esp, ebp
pop ebp
ret 0x18
Function at 0x40d840
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42a998
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x43b010]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push esi
mov eax, dword [0x43b010]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor ebx, ebx
mov byte [esp + 0xf], 0
mov eax, 0x400
mov dword [esp + 0x10], 0
mov ecx, 2
mul ecx
seto bl
neg ebx
or ebx, eax
cmp dword [0x43e5c0], 0
jne 0x40d8b3
call fcn.00415650
mov dword [0x43e5c0], eax
test eax, eax
je 0x40d99a
lea eax, [esp + 0x10]
push eax
mov eax, dword [ebp + 4]
cdq
push edx
push eax
push 1
push ebx
call dword [0x43e5c0]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x40d99a
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
cmp word [esi], ax
jne 0x40d900
xor ecx, ecx
jmp 0x40d914
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d905
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [esp + 0x20]
call fcn.0040adb0
push 0xc
push str.pnputil.exe
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], 0
call fcn.0040acc0
cmp dword [esp + 0x2c], 8
lea eax, [esp + 0x18]
cmovae eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
movzx ebx, byte [esp + 0xf]
cmp eax, 0xffffffff
mov eax, dword [0x43e5bc]
mov ecx, 1
cmovne ebx, ecx
mov dword [esp + 0x14], esi
test eax, eax
jne 0x40d977
call fcn.004156f0
mov dword [0x43e5bc], eax
test eax, eax
je 0x40d983
lea ecx, [esp + 0x14]
push 1
push ecx
call eax
add esp, 8
cmp dword [esp + 0x2c], 8
jb 0x40d996
push dword [esp + 0x18]
call fcn.004144c0
add esp, 4
mov al, bl
jmp 0x40d99e
mov al, byte [esp + 0xf]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0041729b
mov esp, ebp
pop ebp
ret
Function at 0x4108d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4108e9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x410924
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x410920
lea ebx, [ebx]
cmp esi, edx
jae 0x410924
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x410910
cmp esi, edx
jb 0x41092b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x411830
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42ae30
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x43b010]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x43b010]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
xor eax, eax
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], 0
mov word [esp + 0x58], ax
lea edx, [esp + 0x58]
mov dword [esp + 0x80], eax
call fcn.00411e20
xor eax, eax
mov dword [esp + 0x54], 7
xor ebx, ebx
mov word [esp + 0x40], ax
mov dword [esp + 0x50], ebx
cmp word [esi], ax
jne 0x4118b0
xor ecx, ecx
jmp 0x4118c4
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4118b5
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [esp + 0x48]
call fcn.0040adb0
mov byte [esp + 0x80], 1
call fcn.00411760
test al, al
je 0x4119e4
xor eax, eax
mov dword [esp + 0x3c], 7
xor ecx, ecx
mov word [esp + 0x28], ax
cmp word [str.SoftwareHewlett_PackardHP_Print_SettingsUPDProperties], cx
mov eax, 0x38
mov dword [esp + 0x38], 0
cmove eax, ecx
lea ecx, [esp + 0x28]
push eax
push str.SoftwareHewlett_PackardHP_Print_SettingsUPDProperties
call fcn.0040adb0
cmp dword [esp + 0x3c], 8
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push ecx
push 0
push 0xf003f
push 1
push 0
lea eax, [esp + 0x40]
mov dword [esp + 0x34], 2
cmovae eax, dword [esp + 0x40]
push 0
push eax
push 0x80000001
mov byte [esp + 0x48], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [esp + 0x20], eax
test eax, eax
jne 0x41197b
cmp dword [esp + 0x14], 1
mov eax, dword [esp + 0x18]
jne 0x411981
mov byte [esp + 0x24], 1
jmp 0x411981
xor eax, eax
mov dword [esp + 0x18], eax
cmp dword [esp + 0x3c], 8
jb 0x411998
push dword [esp + 0x28]
call fcn.004144c0
mov eax, dword [esp + 0x1c]
add esp, 4
cmp dword [esp + 0x6c], 8
lea ecx, [esp + 0x58]
mov dword [esp + 0x14], edi
cmovae ecx, dword [esp + 0x58]
test eax, eax
je 0x4119d0
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
sete cl
jmp 0x4119d2
xor cl, cl
xor ebx, ebx
test cl, cl
setne bl
test eax, eax
je 0x4119e4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x54], 8
jb 0x4119f7
push dword [esp + 0x40]
call fcn.004144c0
add esp, 4
xor eax, eax
mov dword [esp + 0x54], 7
cmp dword [esp + 0x6c], 8
mov dword [esp + 0x50], 0
mov word [esp + 0x40], ax
jb 0x411a21
push dword [esp + 0x58]
call fcn.004144c0
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0041729b
mov esp, ebp
pop ebp
ret
Function at 0x411a50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42ae70
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x43b010]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
mov eax, dword [0x43b010]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], 0
mov word [esp + 0x58], ax
lea edx, [esp + 0x58]
mov dword [esp + 0x80], eax
call fcn.00411e20
xor eax, eax
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], 0
mov word [esp + 0x40], ax
cmp word [esi], ax
jne 0x411ace
xor ecx, ecx
jmp 0x411ae2
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411ad3
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [esp + 0x48]
call fcn.0040adb0
mov byte [esp + 0x80], 1
xor eax, eax
xor ecx, ecx
mov word [esp + 0x28], ax
cmp word [str.SoftwareHewlett_PackardHP_Print_SettingsUPDProperties], cx
mov eax, 0x38
mov dword [esp + 0xc], 0
cmove eax, ecx
mov dword [esp + 0x3c], 7
push eax
push str.SoftwareHewlett_PackardHP_Print_SettingsUPDProperties
lea ecx, [esp + 0x30]
mov dword [esp + 0x40], 0
call fcn.0040adb0
cmp dword [esp + 0x3c], 8
lea ecx, [esp + 0x10]
push ecx
push 0x20019
lea eax, [esp + 0x30]
mov dword [esp + 0x18], 0
cmovae eax, dword [esp + 0x30]
push 0
push eax
push 0x80000001
mov dword [esp + 0x28], 0
mov byte [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x10]
xor edx, edx
test eax, eax
mov dword [esp + 0x18], eax
cmovne ecx, edx
cmp dword [esp + 0x3c], 8
mov dword [esp + 0x10], ecx
jb 0x411b99
push dword [esp + 0x28]
call fcn.004144c0
mov ecx, dword [esp + 0x14]
add esp, 4
cmp dword [esp + 0x6c], 8
lea eax, [esp + 0x58]
cmovae eax, dword [esp + 0x58]
test ecx, ecx
je 0x411bdc
lea edx, [esp + 0x24]
mov dword [esp + 0x24], 4
push edx
lea edx, [esp + 0x10]
mov dword [esp + 0x24], 4
push edx
lea edx, [esp + 0x28]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov esi, dword [esp + 0xc]
test ecx, ecx
je 0x411bef
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], eax
cmp dword [esp + 0x54], 8
jb 0x411c02
push dword [esp + 0x40]
call fcn.004144c0
add esp, 4
xor eax, eax
mov dword [esp + 0x54], 7
cmp dword [esp + 0x6c], 8
mov dword [esp + 0x50], 0
mov word [esp + 0x40], ax
jb 0x411c2c
push dword [esp + 0x58]
call fcn.004144c0
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0041729b
mov esp, ebp
pop ebp
ret
Function at 0x411c50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42aea8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x43b010]
xor eax, esp
mov dword [esp + 0x50], eax
push esi
mov eax, dword [0x43b010]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], ax
lea edx, [esp + 0x28]
mov dword [esp + 0x68], eax
call fcn.00411e20
mov dword [esp + 0x20], 0
call fcn.00411760
test al, al
je 0x411dde
xor eax, eax
mov dword [esp + 0x54], 7
xor ecx, ecx
mov word [esp + 0x40], ax
cmp word [str.SoftwareHewlett_PackardHP_Print_SettingsUPDProperties], cx
mov eax, 0x38
mov dword [esp + 0x50], 0
cmove eax, ecx
lea ecx, [esp + 0x40]
push eax
push str.SoftwareHewlett_PackardHP_Print_SettingsUPDProperties
call fcn.0040adb0
cmp dword [esp + 0x54], 8
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0
push ecx
push 0
push 0xf003f
push 1
push 0
lea eax, [esp + 0x58]
mov dword [esp + 0x2c], 2
cmovae eax, dword [esp + 0x58]
push 0
push eax
push 0x80000001
mov byte [esp + 0x40], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x411d51
cmp dword [esp + 0xc], 1
jne 0x411d59
mov byte [esp + 0x1c], 1
jmp 0x411d59
mov dword [esp + 0x10], 0
cmp dword [esp + 0x54], 8
jb 0x411d6c
push dword [esp + 0x40]
call fcn.004144c0
add esp, 4
cmp dword [esp + 0x3c], 8
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x10]
cmovae eax, dword [esp + 0x28]
test ecx, ecx
je 0x411dde
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 4
push edx
lea edx, [esp + 0x24]
mov dword [esp + 0x28], 4
push edx
lea edx, [esp + 0x2c]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x411dde
cmp dword [esp + 0x3c], 8
lea eax, [esp + 0x28]
cmovae eax, dword [esp + 0x28]
push eax
call fcn.00413a40
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x411dde
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x3c], 8
mov esi, dword [esp + 0x20]
jb 0x411df5
push dword [esp + 0x28]
call fcn.004144c0
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0041729b
mov esp, ebp
pop ebp
ret
Function at 0x4139d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov ebx, ecx
cmp dword [edx + 0x14], 8
jb 0x4139e2
mov edx, dword [edx]
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x4139ed
mov esi, dword [esi]
cmp dword [ebx], 0
je 0x413a34
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp + 0xc], ecx
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413a00
sub eax, dword [ebp + 0xc]
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push esi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov dword [ebx + 8], eax
pop esi
sete al
pop ebx
pop ebp
ret 8
pop esi
xor al, al
pop ebx
pop ebp
ret 8

Function at 0x413ad0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x43b010]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp dword [eax + 0x14], 8
mov edi, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x58], 1
jb 0x413afc
mov eax, dword [eax]
lea edx, [ebp - 0x50]
push edx
push 1
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413b84
push 0x40
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x54], 0x20
push eax
call fcn.0041a7b0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x413b2f
mov esi, dword [esi]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push esi
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x413b7b
cmp word [ebp - 0x4c], ax
jne 0x413b55
xor ecx, ecx
jmp 0x413b6f
lea ecx, [ebp - 0x4c]
lea edx, [ecx + 2]
jmp 0x413b60
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413b60
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x4c]
mov ecx, edi
push eax
call fcn.0040adb0
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.0041729b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x413ba0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0x14]
push ebx
push esi
push edi
cmp dword [edx + 0x14], 8
mov esi, ecx
mov bl, 1
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jb 0x413bc6
mov edx, dword [edx]
cmp word [edx], 0
jne 0x413bd0
xor ecx, ecx
jmp 0x413be4
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413bd5
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.0040adb0
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
jb 0x413bf8
mov eax, dword [eax]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x413c28
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
lea ecx, [eax*2 + 2]
jb 0x413c3a
mov esi, dword [esi]
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x14], 8
jb 0x413c45
mov eax, dword [eax]
push ecx
push esi
push 1
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
xor ecx, ecx
movzx ebx, bl
test eax, eax
cmovne ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4150f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
test esi, esi
je 0x4151c1
push dword [esi + 0x1c]
push dword [esi + 0x18]
call fcn.004158b0
add esp, 8
mov ebx, eax
mov ecx, ebx
call fcn.00415940
test al, al
je 0x4151c1
mov ecx, dword [0x43e718]
test ecx, ecx
je 0x415153
cmp ecx, 0xffffffff
je 0x415153
push 0
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 0x1c8
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esp + 0xc]
mov edx, esi
mov ecx, ebx
call fcn.00415e00
mov esi, eax
add esp, 4
mov edx, esi
lea eax, [edx + 1]
lea ebx, [ebx]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x415170
sub edx, eax
mov eax, dword [0x43e6e8]
test eax, eax
je 0x41519f
cmp eax, 0xffffffff
je 0x41519f
push 0
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, esi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4151a4
sub edx, ecx
mov ecx, esi
call fcn.00415d90
test esi, esi
je 0x4151c1
push esi
call fcn.00417993
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret