joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403210
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430551
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6015cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xffffffff
sub esp, 0xc
mov eax, esp
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x18]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x10]
call fcn.00401375
mov edx, dword [eax]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x2c]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QDialog::constructor_class_QWidget___class_QFlags_enum_Qt::WindowType__]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], vtable.DiscountPop.1.0
mov edx, dword [ebp - 0x2c]
mov dword [edx + 8], vtable.DiscountPop.0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x18
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x1c], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x2c], 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x30
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
mov byte [ebp - 4], 2
push 0x2000
lea edx, [ebp - 0x28]
push edx
push 0x800
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x2c]
call dword [sym.imp.Qt5Widgets.dll_public:_class_QFlags_enum_Qt::WindowType____thiscall_QWidget::windowFlags_void_]
mov ecx, eax
call fcn.00401c35
mov ecx, eax
call fcn.00401c35
mov edx, dword [eax]
push edx
mov ecx, dword [ebp - 0x2c]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QWidget::setWindowFlags_class_QFlags_enum_Qt::WindowType__]
push 1
push 0x78
mov ecx, dword [ebp - 0x2c]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QWidget::setAttribute_enum_Qt::WidgetAttribute__bool_]
push 1
push 0x5d
mov ecx, dword [ebp - 0x2c]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QWidget::setAttribute_enum_Qt::WidgetAttribute__bool_]
mov ecx, dword [ebp - 0x2c]
call fcn.004014d3
push 0x1b8
push 0x258
mov ecx, dword [ebp - 0x2c]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QWidget::setFixedSize_int__int_]
push str.Info_Popup
push 0x439b74
push 0x439b88
push 0x439ba8
push 0x439bb8
push 0x439bd4
call fcn.0040156e
mov ecx, eax
call fcn.00401c67
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x408200
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430d12
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x6015cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xffffffff
sub esp, 0xc
mov eax, esp
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x18]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x10]
call fcn.00401375
mov edx, dword [eax]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x24]
call dword [sym.imp.Qt5Widgets.dll_public:_void___thiscall_QFrame::constructor_class_QWidget___class_QFlags_enum_Qt::WindowType__]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
mov dword [ecx], vtable.CFrameTitleBar.1.0
mov edx, dword [ebp - 0x24]
mov dword [edx + 8], vtable.CFrameTitleBar.0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x20], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x28], edx
mov eax, dword [ebp - 0x24]
mov byte [eax + 0x2c], 0
push 0
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x30
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QPoint::constructor_int__int_]
mov ecx, dword [ebp - 0x24]
call fcn.00401262
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x408309
push 0x43a5f8
lea ecx, [ebp - 0x20]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_char_const__]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x24]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QObject::setObjectName_class_QString_const__]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x409f50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431059
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x6015cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x174], 0
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov dword [ebp - 4], 1
lea eax, [ebp - 0x30]
push eax
push 0x43aba0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
xor ecx, ecx
mov word [ebp - 0x164], cx
push 0x12a
push 0
lea edx, [ebp - 0x162]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x16c], 0x96
mov dword [ebp - 0x170], 1
lea eax, [ebp - 0x16c]
push eax
lea ecx, [ebp - 0x164]
push ecx
lea edx, [ebp - 0x170]
push edx
push 0
push 0x43ac50
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
je 0x40a013
jmp 0x40a03f
lea ecx, [ebp - 0x164]
push ecx
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
test eax, eax
je 0x40a037
lea edx, [ebp - 0x164]
push edx
lea ecx, [ebp - 0x2c]
call dword [0x60304c]
xor eax, eax
jne 0x409fa9
xor ecx, ecx
jne 0x409f95
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov eax, dword [ebp - 0x174]
or eax, 1
mov dword [ebp - 0x174], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042e70e
mov esp, ebp
pop ebp
ret
Function at 0x40aea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x6015cc]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xdc], 0x43ab10
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xdc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40aeee
jmp 0x40af71
xor eax, eax
mov word [ebp - 0xd8], ax
push 0xc6
push 0
lea ecx, [ebp - 0xd6]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0xe0], 0x64
mov dword [ebp - 0xe4], 1
lea edx, [ebp - 0xe0]
push edx
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0xe4]
push ecx
push 0
push 0x43ab40
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40af69
cmp dword [ebp - 0xe4], 1
jne 0x40af69
lea eax, [ebp - 0xd8]
push eax
mov ecx, dword [ebp + 0xc]
call dword [0x60304c]
xor ecx, ecx
jne 0x40aec1
cmp dword [ebp - 4], 0
je 0x40af81
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0042e70e
mov esp, ebp
pop ebp
ret
Function at 0x414250
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4323c4
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x6015cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], ecx
mov eax, dword [str._unknown_]
mov dword [ebp - 0x21c], eax
mov ecx, dword [0x43c208]
mov dword [ebp - 0x218], ecx
mov edx, dword [0x43c20c]
mov dword [ebp - 0x214], edx
mov eax, dword [0x43c210]
mov dword [ebp - 0x210], eax
mov ecx, dword [0x43c214]
mov dword [ebp - 0x20c], ecx
push 0x1f4
push 0
lea edx, [ebp - 0x208]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 0x10]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4143b7
lea edx, [ebp - 0x224]
push edx
push 4
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x41432e
push 0x104
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.PSAPI.DLL_GetModuleBaseNameW
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x22c]
push ecx
call dword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_]
add esp, 0xc
mov dword [ebp - 0x234], eax
mov edx, dword [ebp - 0x234]
mov dword [ebp - 0x238], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x230]
add ecx, 8
push ecx
call dword [sym.imp.Qt5Core.dll_bool___cdecl_operator_class_QString_const___class_QString_const__]
add esp, 8
mov byte [ebp - 0x225], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
movzx edx, byte [ebp - 0x225]
test edx, edx
je 0x4143b5
mov ecx, dword [ebp - 0x230]
call fcn.00401717
jmp 0x4143d6
jmp 0x4143c4
mov ecx, dword [ebp - 0x230]
call fcn.00401717
jmp 0x4143d6
mov eax, dword [ebp - 0x230]
movzx ecx, byte [eax + 0x18]
test ecx, ecx
je 0x414281
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042e70e
mov esp, ebp
pop ebp
ret
Function at 0x420210
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x6015cc]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xdc], str.SOFTWAREEASEUSPCTrans
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0xdc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42025e
jmp 0x4202e1
xor eax, eax
mov word [ebp - 0xd8], ax
push 0xc6
push 0
lea ecx, [ebp - 0xd6]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0xe0], 0x64
mov dword [ebp - 0xe4], 1
lea edx, [ebp - 0xe0]
push edx
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0xe4]
push ecx
push 0
push str.Language
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4202d9
cmp dword [ebp - 0xe4], 1
jne 0x4202d9
lea eax, [ebp - 0xd8]
push eax
mov ecx, dword [ebp + 0xc]
call dword [0x60304c]
xor ecx, ecx
jne 0x420231
cmp dword [ebp - 4], 0
je 0x4202f1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0042e70e
mov esp, ebp
pop ebp
ret
Function at 0x421490
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov byte [ebp - 9], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 0x43c8d0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4214c7
jmp 0x421511
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x10], 4
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42150d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov byte [ebp - 9], 1
xor edx, edx
jne 0x4214a8
cmp dword [ebp - 4], 0
je 0x421521
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x4219f0
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43394f
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x6015cc]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x42c], ecx
mov byte [ebp - 0xd], 1
lea eax, [ebp - 0x14]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x421b2c
mov dword [ebp - 0x1c], 0
xor ecx, ecx
mov word [ebp - 0x424], cx
push 0x3fe
push 0
lea edx, [ebp - 0x422]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x18], 0
push 0x400
push 0
lea eax, [ebp - 0x424]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x200
lea ecx, [ebp - 0x424]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x421aa9
jmp 0x421b22
push 0xffffffffffffffff
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_]
add esp, 0xc
mov dword [ebp - 4], 0
push 1
push 0x601868
lea ecx, [ebp - 0x428]
call dword [sym.imp.Qt5Core.dll_public:_bool___thiscall_QString::contains_class_QString_const___enum_Qt::CaseSensitivity_const]
movzx eax, al
test eax, eax
je 0x421afc
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
jmp 0x421b22
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
cmp dword [ebp - 0x18], 0
je 0x421a6e
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jne 0x421a25
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0042e70e
mov esp, ebp
pop ebp
ret
Function at 0x4228b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433b39
mov eax, dword fs:[0]
push eax
sub esp, 0xf4
mov eax, dword [0x6015cc]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0x43c900
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xe8]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
je 0x422924
jmp 0x422a58
xor edx, edx
mov word [ebp - 0xe4], dx
push 0xc6
push 0
lea eax, [ebp - 0xe2]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x63
lea ecx, [ebp - 0xf4]
push ecx
mov ecx, dword [ebp + 8]
call dword [sym.imp.Qt5Core.dll_public:_class_QString___thiscall_QString::left_int_]
mov dword [ebp - 4], 0
lea edx, [ebp - 0xe4]
push edx
lea ecx, [ebp - 0xf4]
call dword [sym.imp.Qt5Core.dll_public:_int___thiscall_QString::toWCharArray_wchar_t__const]
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.Qt5Core.dll_public:_int___thiscall_QString::size_void_const]
add eax, 1
mov dword [ebp - 0xf0], eax
push 0x6019d5
xor ecx, ecx
mov eax, dword [ebp - 0xf0]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042e8d0
add esp, 8
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
je 0x422a3d
mov ecx, dword [ebp - 0xf0]
shl ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0xf8]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0xf8]
push eax
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.Qt5Core.dll_public:_int___thiscall_QString::toWCharArray_wchar_t__const]
mov ecx, dword [ebp - 0xf0]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0xf8]
push edx
push 1
push 0
lea eax, [ebp - 0xe4]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xec], eax
mov edx, dword [ebp - 0xf8]
mov dword [ebp - 0x100], edx
mov eax, dword [ebp - 0x100]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
cmp dword [ebp - 0xec], 0
jne 0x422a3d
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf4]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
xor ecx, ecx
jne 0x4228e6
cmp dword [ebp - 0x10], 0
je 0x422a68
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0042e70e
mov esp, ebp
pop ebp
ret
Function at 0x4237a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433dda
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
mov eax, dword [0x6015cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x174], 0
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov dword [ebp - 4], 1
lea eax, [ebp - 0x30]
push eax
push str.SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstallEaseUS_Todo_PCTrans_is1
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
xor ecx, ecx
mov word [ebp - 0x164], cx
push 0x12a
push 0
lea edx, [ebp - 0x162]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x16c], 0x96
mov dword [ebp - 0x170], 1
lea eax, [ebp - 0x16c]
push eax
lea ecx, [ebp - 0x164]
push ecx
lea edx, [ebp - 0x170]
push edx
push 0
push str.Inno_Setup:_App_Path
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
je 0x423869
jmp 0x423895
lea ecx, [ebp - 0x164]
push ecx
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
test eax, eax
je 0x42388d
lea edx, [ebp - 0x164]
push edx
lea ecx, [ebp - 0x2c]
call dword [0x60304c]
xor eax, eax
jne 0x4237ff
xor ecx, ecx
jne 0x4237eb
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov eax, dword [ebp - 0x174]
or eax, 1
mov dword [ebp - 0x174], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042e70e
mov esp, ebp
pop ebp
ret 4
Function at 0x42e70e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6015cc]
jne 0x42e718
repz ret
jmp fcn.0042ed35
Function at 0x40292c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x40295b
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_2
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403c24
jmp 0x402979
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402854
mov edi, eax
test ebx, ebx
je 0x402979
cmp dword [esi], 0
je 0x402979
dec ebx
jmp 0x402962
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402b2c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x457040], 0x8088405
inc edx
mov dword [0x457040], edx
mul edx
mov eax, edx
ret

Function at 0x402c98
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402d30
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402d10
xor eax, eax
push ebp
push 0x402d09
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402d4c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402d10
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x403af0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004026fc
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x457045], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403ab8
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread_1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc