joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10092d9a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100b4040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1008a29c
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1008a29c
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10092e11
cmp word [ecx], dx
je 0x10092e11
mov eax, dword [0x100a299c]
push edi
dec eax
push eax
push 0x100a2888
call fcn.10092d39
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10092e84
cmp word [eax], dx
je 0x10092e84
mov eax, dword [edi]
test eax, eax
je 0x10092e35
cmp word [eax], dx
je 0x10092e35
lea eax, [ebp - 0x10]
push eax
call fcn.1009271c
jmp 0x10092e3e
lea eax, [ebp - 0x10]
push eax
call fcn.100927b7
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10092eae
mov eax, dword [0x100a2884]
push dword [ebp - 0x14]
dec eax
push eax
push 0x100a2578
call fcn.10092d39
add esp, 0xc
test al, al
je 0x10092eae
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10092e79
cmp word [eax], di
je 0x10092e79
lea eax, [ebp - 0x10]
push eax
call fcn.1009271c
pop ecx
jmp 0x10092eb0
lea eax, [ebp - 0x10]
push eax
call fcn.100927b7
jmp 0x10092e76
mov eax, dword [edi]
test eax, eax
je 0x10092e9b
cmp word [eax], dx
je 0x10092e9b
lea eax, [ebp - 0x10]
push eax
call fcn.100926d1
pop ecx
jmp 0x10092eae
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10092f79
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10092bbe
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10092f79
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.DLL_IsValidCodePage]
test eax, eax
je 0x10092f79
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_IsValidLocale]
test eax, eax
je 0x10092f79
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10092f06
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1008c45e
test ebx, ebx
je 0x10092f74
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1008c45e
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x10092f79
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x10092f79
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10096b21
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10092f7b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007ef35
leave
ret
Function at 0x100987f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1009881d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1009881d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4015ae
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
xor esi, esi
push str.kernel32.dll
push esi
mov dword [ebp - 4], esi
call sub.KERNEL32.dll_GetModuleHandleExA
test eax, eax
je 0x401608
push str.VirtualAllocExNuma
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push 0x40
push 0x3000
push dword [ebp + 0xc]
mov dword [0x43230c], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x43230c]
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
push esi
call fcn.0040f650
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x40212e
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
and dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
mov cl, byte [eax]
mov dl, byte [eax + 1]
jle 0x4021ec
push ebx
push esi
push edi
movzx esi, cl
movzx ebx, dl
lea eax, [esi + 1]
cdq
mov ecx, 0x1df
idiv ecx
mov ecx, dword [0x432314]
push 0x427671
push 0x434cd0
movzx esi, dl
lea edi, [esi + ecx]
movzx eax, byte [edi]
add eax, ebx
mov byte [ebp - 2], dl
cdq
mov ebx, 0x1df
idiv ebx
mov al, byte [edi]
movzx ebx, dl
add ecx, ebx
mov byte [ebp - 3], dl
mov dl, byte [ecx]
mov byte [edi], dl
mov byte [ecx], al
mov ecx, dword [0x432314]
movzx eax, byte [ebx + ecx]
movzx ecx, byte [esi + ecx]
add eax, ecx
cdq
mov ecx, 0x1df
idiv ecx
mov byte [ebp - 1], dl
call fcn.00401f34
push eax
call fcn.00402115
mov edi, dword [ebp - 8]
movzx ecx, byte [ebp - 1]
mov edx, dword [0x432314]
mov eax, dword [ebp + 8]
mov cl, byte [ecx + edx]
add eax, edi
xor byte [eax], cl
add esp, 0xc
inc edi
cmp edi, dword [ebp + 0xc]
mov dword [ebp - 8], edi
jl 0x402152
mov cl, byte [ebp - 2]
mov eax, dword [ebp + 0x10]
mov dl, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov byte [eax], cl
mov byte [eax + 1], dl
leave
ret

Function at 0x40f321
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430d40]
jne 0x40f32b
repz ret
jmp fcn.004153ac
Function at 0x41dc0b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00414d9d
and dword [ebp - 4], 0
cmp dword [0x434c38], 0
mov ebx, eax
jne 0x41dcbc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41dd6d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42a210
push edi
call esi
test eax, eax
je 0x41dd6d
push eax
call fcn.00414d2b
mov dword [esp], 0x42a200
push edi
mov dword [0x434c38], eax
call esi
push eax
call fcn.00414d2b
mov dword [esp], 0x42a1ec
push edi
mov dword [0x434c3c], eax
call esi
push eax
call fcn.00414d2b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x434c40], eax
call esi
push eax
call fcn.00414d2b
pop ecx
mov dword [0x434c48], eax
test eax, eax
je 0x41dcbc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00414d2b
pop ecx
mov dword [0x434c44], eax
mov eax, dword [0x434c44]
cmp eax, ebx
je 0x41dd14
cmp dword [0x434c48], ebx
je 0x41dd14
push eax
call fcn.00414da6
push dword [0x434c48]
mov esi, eax
call fcn.00414da6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41dd14
test edi, edi
je 0x41dd14
call esi
test eax, eax
je 0x41dd0b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41dd0b
test byte [ebp - 0xc], 1
jne 0x41dd14
or dword [ebp + 0x10], 0x200000
jmp 0x41dd4d
mov eax, dword [0x434c3c]
cmp eax, ebx
je 0x41dd4d
push eax
call fcn.00414da6
pop ecx
test eax, eax
je 0x41dd4d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41dd4d
mov eax, dword [0x434c40]
cmp eax, ebx
je 0x41dd4d
push eax
call fcn.00414da6
pop ecx
test eax, eax
je 0x41dd4d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x434c38]
call fcn.00414da6
pop ecx
test eax, eax
je 0x41dd6d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41dd6f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4034f0
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
cmp dword [esi + 0x8c], 0
je 0x403532
call fcn.00402b90
test eax, eax
je 0x403539
lea eax, [esp + 8]
push eax
push 4
push esi
push 0x403040
push 0
push 0
call fcn.0043b355
add esp, 0x18
mov dword [esi + 0xa8], eax
test eax, eax
je 0x403532
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x403532
mov ecx, dword [eax]
push edi
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [esi + 0xb0]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov ecx, dword [esp + 8]
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
push 0
mov edx, dword [edx + 0x20]
mov edi, ecx
neg edi
push edi
mov edi, dword [esp + 0x14]
push edi
push ecx
mov ecx, dword [esi + 0x68]
push 0
push ecx
mov ecx, dword [esi + 0x64]
push ecx
mov ecx, dword [esi + 0x90]
push 0
push 0
push ecx
push eax
call edx
pop edi
test eax, eax
jne 0x403532
push eax
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x404c30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push esi
mov dword [esp + 8], ecx
call fcn.00411d42
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [eax + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x404d0e
call fcn.00411d42
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x404d0e
push edi
call fcn.00411d42
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x404ca6
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 8
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x404cf6
test ebp, ebp
je 0x404cf6
push edi
push eax
push ebp
call fcn.0043aa70
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [esp + 0x10]
push edi
push esi
call fcn.00404770
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 8
pop esi
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x404d30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
xor esi, esi
push 0x46ace0
push esi
mov dword [esp + 0x10], esi
call sub.KERNEL32.dll_GetModuleHandleExA
test eax, eax
je 0x404d8f
mov ecx, dword [esp + 4]
push edi
push str.VirtualAllocExNuma
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [esp + 0x14]
push esi
push 0x40
push 0x3000
push edi
push esi
mov dword [0x4849ec], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x4849ec]
mov edx, dword [esp + 0x10]
push edi
mov esi, eax
push edx
push esi
call fcn.0043aa70
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ecx
ret

Function at 0x404ee0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov cl, byte [eax]
mov dl, byte [eax + 1]
push ebx
xor ebx, ebx
cmp dword [esp + 0x10], ebx
jle 0x404f9c
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
movzx edi, cl
movzx ebp, dl
lea eax, [edi + 1]
cdq
mov ecx, 0x3c6
idiv ecx
movzx edi, dl
mov byte [esp + 0x12], dl
mov edx, dword [0x4849f4]
movzx eax, byte [edi + edx]
lea ecx, [edi + edx]
add eax, ebp
cdq
mov ebp, 0x3c6
idiv ebp
mov eax, dword [0x4849f4]
movzx ebp, dl
add eax, ebp
mov byte [esp + 0x13], dl
call fcn.00404d20
mov ecx, dword [0x4849f4]
movzx eax, byte [ecx + ebp]
movzx ecx, byte [edi + ecx]
add eax, ecx
cdq
mov ecx, 0x3c6
idiv ecx
mov byte [esp + 0x11], dl
call esi
call esi
call esi
call esi
call esi
call esi
movzx edx, byte [esp + 0x11]
mov eax, dword [0x4849f4]
mov cl, byte [edx + eax]
mov eax, dword [esp + 0x18]
xor byte [ebx + eax], cl
inc ebx
cmp ebx, dword [esp + 0x1c]
jl 0x404f06
mov eax, dword [esp + 0x20]
mov dl, byte [esp + 0x12]
mov cl, byte [esp + 0x13]
pop edi
pop esi
pop ebp
mov byte [eax], dl
mov byte [eax + 1], cl
pop ebx
pop ecx
ret
mov byte [eax], cl
mov byte [eax + 1], dl
pop ebx
pop ecx
ret

Function at 0x405700
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405719
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405754
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x405750
lea ebx, [ebx]
cmp esi, eax
jae 0x405754
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x405740
cmp esi, eax
jb 0x40575a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4059d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.004174e8
Function at 0x4097c7
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x466a7d
call fcn.0043beea
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4097ec
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x409832
lea ecx, [ebp - 0x10]
call fcn.004060a0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408c2a
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004057d0
mov eax, esi
call fcn.0043bfc2
ret 8

Function at 0x410abe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x410b05
call fcn.00411d42
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x410b05
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x410b21
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00410638
mov esi, eax
test edi, edi
je 0x410b1f
test ebx, ebx
je 0x410b1f
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x423531
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x4684e3
call fcn.0043beea
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00410462
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x423593
call fcn.004110a0
cmp eax, 1
jne 0x423593
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.004160fb
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00416054
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004057d0
mov dword [ebp + 8], SysReAllocStringLen
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004057d0
mov eax, esi
call fcn.0043bfc2
ret 0x10
Function at 0x4235bc
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x46850e
call fcn.0043beea
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00410462
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x42361e
call fcn.004110a0
cmp eax, 1
jne 0x42361e
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.004160fb
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00416054
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004057d0
mov dword [ebp + 8], SysReAllocStringLen
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004057d0
mov eax, esi
call fcn.0043bfc2
ret 0x14

Function at 0x42364a
Capabilities:
Delete registry key

Disassembly:
push 0
mov eax, 0x468539
call fcn.0043beea
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00410462
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x4236ac
call fcn.004110a0
cmp eax, 1
jne 0x4236ac
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.004160fb
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00416054
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004057d0
mov dword [ebp + 8], SysReAllocStringLen
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004057d0
mov eax, esi
call fcn.0043bfc2
ret 8

Function at 0x43a84f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x483638]
jne 0x43a859
repz ret
jmp fcn.00442138
Function at 0x4562c2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004422d2
and dword [ebp - 4], 0
cmp dword [0x4873c8], 0
mov ebx, eax
jne 0x456373
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x456424
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x472fa8
push edi
call esi
test eax, eax
je 0x456424
push eax
call fcn.00442260
mov dword [esp], 0x472f98
push edi
mov dword [0x4873c8], eax
call esi
push eax
call fcn.00442260
mov dword [esp], 0x472f84
push edi
mov dword [0x4873cc], eax
call esi
push eax
call fcn.00442260
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4873d0], eax
call esi
push eax
call fcn.00442260
pop ecx
mov dword [0x4873d8], eax
test eax, eax
je 0x456373
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00442260
pop ecx
mov dword [0x4873d4], eax
mov eax, dword [0x4873d4]
cmp eax, ebx
je 0x4563cb
cmp dword [0x4873d8], ebx
je 0x4563cb
push eax
call fcn.004422db
push dword [0x4873d8]
mov esi, eax
call fcn.004422db
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4563cb
test edi, edi
je 0x4563cb
call esi
test eax, eax
je 0x4563c2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4563c2
test byte [ebp - 0xc], 1
jne 0x4563cb
or dword [ebp + 0x10], 0x200000
jmp 0x456404
mov eax, dword [0x4873cc]
cmp eax, ebx
je 0x456404
push eax
call fcn.004422db
pop ecx
test eax, eax
je 0x456404
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x456404
mov eax, dword [0x4873d0]
cmp eax, ebx
je 0x456404
push eax
call fcn.004422db
pop ecx
test eax, eax
je 0x456404
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4873c8]
call fcn.004422db
pop ecx
test eax, eax
je 0x456424
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x456426
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x185a10a9
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x185a10ce
xor eax, eax
jmp 0x185a1177
push dword [ebp - 8]
call fcn.185ab940
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
push dword [eax]
push dword [ebp - 8]
push dword [ebp - 0x14]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x185a1105
mov ecx, dword [ebp - 4]
call fcn.185a1081
xor eax, eax
jmp 0x185a1177
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1885e1c4
mov eax, dword [ebp - 4]
push dword [eax]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x185a112c
mov ecx, dword [ebp - 4]
call fcn.185a1081
xor eax, eax
jmp 0x185a1177
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax]
shr eax, 0x10
and eax, 0xffff
movzx eax, ax
and eax, 0xffff
movzx eax, ax
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0xc]
mov ecx, dword [edx + ecx]
and ecx, 0xffff
movzx ecx, cx
and ecx, 0xffff
movzx ecx, cx
shl ecx, 0x10
or eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
xor eax, eax
inc eax
leave
ret 4
Function at 0x185a6876
Capabilities:
Get file attributes
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1870626c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
mov eax, dword [ebp - 0x214]
cmp dword [eax], 0
jne 0x185a68a1
xor eax, eax
jmp 0x185a6965
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x214]
cmp dword [eax + 4], 0
je 0x185a68fd
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
and eax, 0xfffffffe
mov dword [ebp - 0x210], eax
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0xa0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xffffffff
jne 0x185a6937
mov dword [ebp - 0x218], 1
jmp 0x185a693e
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x185a695f
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.18615399
leave
ret 4

Function at 0x185a6973
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x185a6992
mov dword [ebp - 4], 1
jmp 0x185a6996
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x185ae901
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1870626c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x185ae983
cmp byte [esi + 0x3d], 0
je 0x185ae983
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x185ae955
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x185ae959
sub eax, 1
je 0x185ae95d
dec eax
sub eax, 1
je 0x185ae983
xor al, al
jmp 0x185ae985
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x185ae97a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.18644026
add esp, 0x10
cmp edi, eax
jne 0x185ae955
cmp byte [esi + 0x3d], 0
sete al
jmp 0x185ae985
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.18615399
leave
ret