joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b1ae
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5e5620]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x230]
cmp word [esi], ax
jne 0x40b1da
xor al, al
jmp 0x40b24e
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
call fcn.004034b2
pop ecx
test al, al
je 0x40b215
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00552893
add esp, 0xc
jmp 0x40b230
push 0
lea eax, [ebp - 0x414]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp dword [edi + 0x438], 0
setne al
movzx eax, al
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
call fcn.00403b5f
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054d24a
leave
ret 4

Function at 0x40bd57
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5e5620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5ebc6c]
push esi
push edi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x40bda3
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40bdc0
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [0x5ebc6c], eax
jmp 0x40bdac
push eax
call dword [sym.imp.KERNEL32.dll_DecodePointer]
mov esi, eax
test esi, esi
je 0x40bdc0
push 0x800
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x40be25
mov esi, 0x105
lea eax, [ebp - 0x210]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40be23
cmp eax, esi
jae 0x40be23
cmp word [ebp + eax*2 - 0x212], 0x5c
je 0x40bdff
push 0x588d60
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00560020
add esp, 0xc
test eax, eax
jne 0x40be23
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00560020
add esp, 0xc
test eax, eax
jne 0x40be23
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x40be25
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0054d24a
leave
ret
Function at 0x40dd01
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREMICROSOFTWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40dda4
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
push ebx
push str.ReleaseId
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 4], ebx
je 0x40dd9b
push esi
push dword [ebp - 4]
call fcn.00560bfe
mov esi, eax
pop ecx
test esi, esi
je 0x40dd9a
push dword [ebp - 4]
push ebx
push esi
call fcn.0054ee80
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
push ebx
push ebx
push str.ReleaseId
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40dd93
lea eax, [ebp - 0xc]
push eax
push 0x58e054
push esi
call fcn.00412601
add esp, 0xc
push esi
call fcn.00560aa1
pop ecx
pop esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop ebx
leave
ret

Function at 0x40fcf3
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x5e5620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5ebc60]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
test eax, eax
je 0x40fdcb
push 0x58c7bc
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.005608fa
add esp, 0xc
test eax, eax
jne 0x40fdcb
cmp dword [ebp - 0x238], eax
je 0x40fdcb
push 0x208
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0054ee80
add esp, 0xc
mov dword [ebp - 0x23c], 0x104
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x2c]
push 9
push eax
call fcn.0056202c
lea eax, [ebp - 0x18]
push 9
push eax
call fcn.0056211b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x234]
push eax
push str._s__s__s:_n
push dword [ebp - 0x238]
call fcn.004125e8
push esi
push str._s_n_n
push dword [ebp - 0x238]
call fcn.004125e8
push dword [ebp - 0x238]
call fcn.00560a66
add esp, 0x34
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x5b3
je 0x40fe07
call fcn.00409c49
test al, al
je 0x40fe07
cmp byte [0x5ebc5c], 0
je 0x40fdf5
test byte [ebp + 0xc], 0xf
jne 0x40fdf5
xor eax, eax
inc eax
jmp 0x40fe11
push dword [ebp + 0xc]
push 0x58bccc
push esi
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40fe11
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0054d24a
leave
ret
Function at 0x412ebc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5e5620]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x114
lea eax, [ebp - 0x118]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.0054ee80
add esp, 0xc
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x412f15
cmp dword [ebp - 0x114], 6
ja 0x412f13
jne 0x412f15
cmp dword [ebp - 0x110], ebx
jbe 0x412f15
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0054d24a
leave
ret
Function at 0x413168
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x5e5620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 9
mov dword [ebp - 0x5c], eax
lea edi, [ebp - 0x28]
pop ecx
xor eax, eax
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x64], esi
rep stosd dword es:[edi], eax
mov dword [ebp - 0x58], ebx
call dword [sym.imp.GDI32.dll_GdiFlush]
cmp dword [ebp + 0x10], 8
ja 0x413304
lea eax, [ebp - 0x98]
push eax
push 0x18
pop edi
push edi
push dword [ebp - 0x5c]
call dword [sym.imp.GDI32.dll_GetObjectW]
cmp eax, edi
jne 0x413304
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [ebp - 0x94]
add ecx, 3
mov dword [ebp - 0x6c], eax
imul ecx, ecx, 3
push ecx
call fcn.0041917f
pop ecx
push 0xa
mov dword [ebp - 0x68], eax
lea edi, [ebp - 0x50]
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x94]
inc eax
and dword [ebp - 0x44], ebx
push 0x18
mov word [ebp - 0x48], ax
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp - 0x90]
pop eax
mov dword [ebp - 0x54], 0x28
mov dword [ebp - 0x4c], ecx
mov word [ebp - 0x46], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
mov dword [ebp - 0x60], edi
cmp dword [ebp - 0x90], ebx
jle 0x4132c6
mov esi, dword [ebp - 0x68]
lea eax, [ebp - 0x54]
push 0
push eax
push esi
push 1
push edi
push dword [ebp - 0x5c]
push dword [ebp - 0x6c]
call dword [sym.imp.GDI32.dll_GetDIBits]
and dword [ebp - 0x70], 0
cmp dword [ebp - 0x94], 0
jle 0x4132b3
mov edi, dword [ebp - 0x70]
mov al, byte [esi]
lea esi, [esi + 3]
mov byte [ebp - 0x74], al
mov al, byte [esi - 2]
mov byte [ebp - 0x78], al
mov al, byte [esi - 1]
mov byte [ebp - 0x7c], al
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x64]
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
push eax
call fcn.0041308b
add esp, 0x1c
jmp 0x41329f
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x10]
call fcn.004133b7
add esp, 0xc
mov ebx, dword [ebp - 0x58]
cmp ebx, dword [ebp + 0xc]
ja 0x41328c
inc edi
cmp edi, dword [ebp - 0x94]
jl 0x413256
mov edi, dword [ebp - 0x60]
inc edi
mov dword [ebp - 0x60], edi
cmp edi, dword [ebp - 0x90]
jl 0x41322d
mov esi, dword [ebp - 0x64]
push 1
push dword [ebp - 0x68]
call fcn.0054cfeb
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [ebp - 0x6c]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
lea eax, [ebx*4 + 4]
push eax
call fcn.00560bfe
mov edi, eax
pop ecx
test edi, edi
jne 0x413315
test esi, esi
je 0x413304
push 1
mov ecx, esi
call fcn.00413053
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054d24a
leave
ret
and dword [ebp - 0x80], 0
mov eax, 0x300
mov word [edi], ax
lea eax, [ebp - 0x80]
push eax
lea eax, [edi + 4]
mov word [edi + 2], bx
push eax
push esi
call fcn.00413347
add esp, 0xc
test esi, esi
je 0x413343
push 1
mov ecx, esi
call fcn.00413053
mov eax, edi
jmp 0x413306
Function at 0x413aad
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5e5620]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push eax
push 0xf003f
push ebx
push edi
push esi
mov dword [ebp - 0x210], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x413b1d
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call fcn.00413aad
pop ecx
pop ecx
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push dword [ebp - 0x210]
call ebx
test eax, eax
je 0x413afb
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb al, al
xor ecx, ebp
pop esi
inc al
pop ebx
call fcn.0054d24a
leave
ret

Function at 0x41435f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 1
push SysReAllocStringLen
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x414386
xor al, al
jmp 0x4143ab
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
call fcn.004143af
add esp, 0x10
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4143af
Capabilities:
Set registry value

Disassembly:
push 0x220
mov eax, 0x5787b7
call fcn.0054d2bd
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x21c], ebx
jmp 0x4144ba
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
push esi
call fcn.004144f4
add esp, 0x18
test al, al
je 0x4144d3
cmp dword [ebp - 0x220], 0x80008000
jne 0x414472
push ebx
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp + 0x14]
push ebx
push 0x20006
movzx eax, al
push eax
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4144d3
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp - 0x224]
call fcn.004143af
add esp, 0x10
mov bl, al
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x4144eb
xor ebx, ebx
jmp 0x4144a8
cmp dword [ebp - 0x220], 0x80008001
je 0x4144ef
push dword [ebp - 0x22c]
lea eax, [ebp - 0x218]
push dword [ebp - 0x21c]
push dword [ebp - 0x220]
push ebx
push eax
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4144d7
push dword [ebp - 0x21c]
call fcn.00419175
pop ecx
mov dword [ebp - 0x21c], ebx
push 1
push ebx
push ebx
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [ebp + 0x10]
jne 0x4143d7
mov bl, 1
mov al, bl
mov bl, al
push dword [ebp - 0x21c]
call fcn.00419175
pop ecx
mov al, bl
call fcn.0054d26c
ret
xor ebx, ebx
jmp 0x4144d3
xor eax, eax
inc eax
jmp 0x4144d5
Function at 0x4144f4
Capabilities:
Read file on windows

Disassembly:
push 0x1c
mov eax, 0x5787fe
call fcn.0054d2f3
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x14]
xor ebx, ebx
push ebx
push eax
push 4
lea eax, [ebp - 0x24]
mov dword [ebp - 4], ebx
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x414595
cmp dword [ebp - 0x14], 4
jne 0x414595
lea ecx, [ebp - 0x20]
call fcn.00413589
push dword [ebp - 0x24]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.004142b8
push ebx
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x24]
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x4146a5
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x14], eax
jne 0x4146a5
push eax
lea ecx, [ebp - 0x20]
call fcn.0041479e
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
push dword [esi - 0xc]
push esi
call fcn.004135d7
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 0x14]
mov byte [ebp - 4], 2
cmp ecx, dword [eax - 0xc]
ja 0x41459d
lea ecx, [eax - 0x10]
call fcn.00408abd
lea ecx, [esi - 0x10]
call fcn.00408abd
xor al, al
call fcn.0054d258
ret
push dword [eax - 0xc]
push eax
push ecx
push dword [ebp + 0x10]
call fcn.00560250
add esp, 0x10
lea eax, [ebp - 0x14]
push ebx
push eax
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
je 0x4145f5
cmp dword [ebp - 0x14], 4
jne 0x4145f5
mov edi, dword [ebp + 0x1c]
lea eax, [ebp - 0x14]
push ebx
push eax
push 4
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4145f5
cmp dword [ebp - 0x14], 4
jne 0x4145f5
push dword [edi]
call fcn.0041917f
pop ecx
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
test eax, eax
jne 0x4145fa
mov eax, dword [ebp - 0x18]
jmp 0x414585
push ebx
lea ecx, [ebp - 0x14]
push ecx
push dword [edi]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4145f5
mov ecx, dword [edi]
cmp dword [ebp - 0x14], ecx
jne 0x4145f5
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
sub eax, 1
je 0x41462a
sub eax, 1
je 0x41462a
sub eax, 5
jne 0x414689
mov eax, dword [ebp + 0x18]
push ecx
lea ecx, [ebp - 0x1c]
mov eax, dword [eax]
push eax
mov dword [ebp - 0x28], eax
call fcn.004135d7
push dword [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00419175
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax - 0xc]
add eax, eax
push eax
mov dword [edi], eax
call fcn.0041917f
pop ecx
pop ecx
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
test eax, eax
jne 0x414670
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00408abd
jmp 0x41468b
push dword [edi]
push dword [ebp - 0x1c]
push eax
call fcn.0054e900
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.00408abd
mov bl, 1
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00408abd
lea ecx, [esi - 0x10]
call fcn.00408abd
mov al, bl
jmp 0x414597
mov eax, dword [ebp - 0x20]
lea ecx, [eax - 0x10]
jmp 0x414590
Function at 0x4148b7
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
xor eax, eax
push eax
push eax
push 2
push eax
push eax
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4148dc
xor al, al
jmp 0x4148fb
push ebx
push esi
push dword [ebp + 8]
call fcn.004148fe
pop ecx
pop ecx
push esi
mov bl, al
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop esi
pop ebp
ret

Function at 0x4148fe
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5e5620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x21c], eax
push edi
mov edi, dword [ebp + 8]
mov esi, ebx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], ebx
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
je 0x41495f
test eax, eax
jne 0x4149d9
push dword [ebp - 0x210]
inc dword [ebp - 0x218]
call fcn.0041917f
pop ecx
mov ebx, eax
lea eax, [ebp - 0x210]
push eax
push ebx
lea eax, [ebp - 0x220]
push eax
push 0
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4149d7
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push ebx
push eax
push dword [ebp - 0x220]
push dword [ebp - 0x21c]
call fcn.00414acd
add esp, 0x14
test al, al
je 0x414ac9
push ebx
call fcn.00419175
inc esi
xor ebx, ebx
pop ecx
jmp 0x414924
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x104
push eax
lea eax, [ebp - 0x20c]
mov esi, ebx
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x414ab8
mov ebx, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x414ac9
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x80008000
push ebx
call fcn.00414acd
add esp, 0x14
test al, al
je 0x414ac9
push ebx
push dword [ebp - 0x218]
call fcn.004148fe
pop ecx
pop ecx
push dword [ebp - 0x218]
mov byte [ebp - 0x211], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push eax
push eax
push eax
push 0x80008001
push ebx
call fcn.00414acd
add esp, 0x14
test al, al
je 0x414ac9
cmp byte [ebp - 0x211], 0
je 0x414ac9
xor eax, eax
mov dword [ebp - 0x210], 0x104
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x210]
inc esi
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x414a0d
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054d24a
leave
ret
xor al, al
jmp 0x414aba
Function at 0x414acd
Capabilities:
Write file on windows

Disassembly:
push 0x18
mov eax, 0x578838
call fcn.0054d28a
push dword [ebp + 0x10]
lea ecx, [ebp - 0x1c]
call fcn.004134b1
mov eax, dword [ebp - 0x1c]
and dword [ebp - 4], 0
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [eax - 0xc]
inc eax
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
push 4
pop esi
push esi
lea eax, [ebp - 0x14]
push eax
push edi
call ebx
test eax, eax
je 0x414c08
cmp dword [ebp - 0x10], esi
jne 0x414c08
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push edi
call ebx
test eax, eax
je 0x414c08
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x414c08
push 0
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push edi
call ebx
test eax, eax
je 0x414c08
cmp dword [ebp - 0x10], esi
jne 0x414c08
lea ecx, [ebp - 0x18]
call fcn.004135b0
mov eax, dword [ebp + 0xc]
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
sub eax, ebx
je 0x414b88
sub eax, ebx
je 0x414b88
sub eax, 5
je 0x414b88
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
jmp 0x414bc0
mov eax, dword [ebp + 0x18]
lea ecx, [ebp - 0x20]
shr eax, 1
push eax
push dword [ebp + 0x14]
call fcn.00413508
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x18]
call fcn.004136a9
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov eax, dword [esi - 0xc]
lea ecx, [ecx - 0x10]
mov dword [ebp + 0x18], eax
call fcn.00408abd
push 0
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x414bfc
cmp dword [ebp - 0x10], 4
jne 0x414bfc
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x18]
push dword [ebp - 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x414bfc
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x18]
je 0x414bfe
xor bl, bl
lea ecx, [esi - 0x10]
call fcn.00408abd
jmp 0x414c0a
xor bl, bl
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00408abd
mov al, bl
call fcn.0054d258
ret

Function at 0x415efd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x415f42
push dword [ebp + 0xc]
push str.Error_saving_RTF_to__s
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x30
push dword [ebp + 8]
call fcn.0040fe74
add esp, 0x14
xor al, al
jmp 0x415f77
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push dword [ebp + 8]
call fcn.00415432
pop ecx
pop ecx
push ebx
mov esi, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00560aa1
pop ecx
mov al, 1
pop esi
pop edi
pop ebx
leave
ret
Function at 0x41700f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x101
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417070
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push str.EulaAccepted
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x417070
xor eax, eax
cmp dword [ebp - 8], eax
setne al
jmp 0x417072
xor eax, eax
pop esi
leave
ret