joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491bb0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404428
lea edi, [ebp - 0x144]
xor eax, eax
push ebp
push 0x491d4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push edi
lea eax, [ebp - 0x148]
mov ecx, 0x491d68
mov edx, dword [ebp - 4]
call fcn.00404284
mov eax, dword [ebp - 0x148]
call fcn.00404438
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
jmp 0x491d0f
lea eax, [ebp - 0x14c]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.004041e8
mov eax, dword [ebp - 0x14c]
mov edx, 0x491d78
call fcn.00404384
je 0x491d02
lea eax, [ebp - 0x150]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.004041e8
mov eax, dword [ebp - 0x150]
mov edx, 0x491d84
call fcn.00404384
je 0x491d02
cmp dword [edi], 0x10
jne 0x491cc6
push dword [ebp - 4]
push 0x491d90
lea eax, [ebp - 0x158]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.004041e8
push dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.004042f8
mov eax, dword [ebp - 0x154]
call fcn.00491bb0
jmp 0x491d02
push dword [ebp - 4]
push 0x491d90
lea eax, [ebp - 0x160]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.004041e8
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.004042f8
mov eax, dword [ebp - 0x15c]
call fcn.00408a08
push edi
push esi
call sub.KERNEL32.DLL_FindNextFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x491c35
push esi
call sub.KERNEL32.DLL_FindClose
mov eax, dword [ebp - 4]
call fcn.00408bd0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491d54
lea eax, [ebp - 0x160]
mov edx, 7
call fcn.00403f9c
lea eax, [ebp - 4]
call fcn.00403f78
ret
Function at 0x491fe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404428
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x49214e
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.00485370
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.00485390
jmp 0x49211a
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004041e8
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00408aa0
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408038
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408038
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404384
je 0x4920fa
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004041e8
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408038
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408038
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404384
jne 0x492111
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.004853b0
test eax, eax
jne 0x49205b
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492155
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00403f9c
lea eax, [ebp - 4]
call fcn.00403f78
ret
Function at 0x4010ae
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax + 4]
push esi
push edi
mov edi, dword [eax]
mov eax, dword [0x43d618]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x43d61c]
xor esi, esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], esi
call fcn.004010a7
mov eax, dword [0x43d620]
add dword [ebp - 0x14], 0x23f
mov dword [ebp - 0x28], eax
mov eax, dword [0x43d624]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x1a2e1c4], 0xc
mov dword [ebp - 4], eax
jne 0x401130
push esi
lea eax, [ebp - 0x40]
push eax
push esi
lea eax, [ebp - 0x458]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [0x1a2e1c4]
cmp eax, 0xfa9
jne 0x40114c
mov dword [0x1a2e1c0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401164
push esi
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov dword [0x1a2e114], esi
mov eax, dword [ebp - 0x14]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [0x1a2e1bc], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 8], eax
sub ebx, dword [ebp - 8]
cmp dword [0x1a2e1c4], 0xc
mov dword [ebp - 4], eax
jne 0x4011e8
xor eax, eax
mov dword [ebp - 0x58], esi
lea edi, [ebp - 0x54]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x44]
push eax
push esi
lea eax, [ebp - 0x458]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea eax, [ebp - 0x3c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, dword [ebp - 0x18]
mov eax, ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x14], 0x61c88647
sub edi, eax
dec dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
jne 0x401100
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ebx
pop ebx
leave
ret 4
Function at 0x404c67
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c33c]
jne 0x404c71
repz ret
jmp fcn.0040ab06

Function at 0x40bbec
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d6c
and dword [ebp - 4], 0
cmp dword [0x4469f4], 0
mov ebx, eax
jne 0x40bc9d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bd4e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40bd4e
push eax
call fcn.00404cfa
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4469f4], eax
call esi
push eax
call fcn.00404cfa
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4469f8], eax
call esi
push eax
call fcn.00404cfa
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4469fc], eax
call esi
push eax
call fcn.00404cfa
pop ecx
mov dword [0x446a04], eax
test eax, eax
je 0x40bc9d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404cfa
pop ecx
mov dword [0x446a00], eax
mov eax, dword [0x446a00]
cmp eax, ebx
je 0x40bcf5
cmp dword [0x446a04], ebx
je 0x40bcf5
push eax
call fcn.00404d75
push dword [0x446a04]
mov esi, eax
call fcn.00404d75
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bcf5
test edi, edi
je 0x40bcf5
call esi
test eax, eax
je 0x40bcec
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bcec
test byte [ebp - 0xc], 1
jne 0x40bcf5
or dword [ebp + 0x10], 0x200000
jmp 0x40bd2e
mov eax, dword [0x4469f8]
cmp eax, ebx
je 0x40bd2e
push eax
call fcn.00404d75
pop ecx
test eax, eax
je 0x40bd2e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bd2e
mov eax, dword [0x4469fc]
cmp eax, ebx
je 0x40bd2e
push eax
call fcn.00404d75
pop ecx
test eax, eax
je 0x40bd2e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4469f4]
call fcn.00404d75
pop ecx
test eax, eax
je 0x40bd4e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40bd50
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584108
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5f01b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov eax, dword [ebp + 0xc]
push 0
push 0
push 0
push 0
push esi
mov dword [ebp - 4], 0
push 0x4010a0
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
call fcn.0046b7d1
mov edi, eax
test edi, edi
je 0x40107c
mov dword [edi + 0x28], 0
mov ecx, dword [esi]
cmp edi, ecx
je 0x401072
test ecx, ecx
je 0x401070
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
mov dword [esi], edi
mov ecx, dword [edi + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4019f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401a0b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401a42
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x401a3e
jmp 0x401a30
cmp esi, eax
jae 0x401a42
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401a30
cmp esi, eax
jb 0x401a49
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b150
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x5f01b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.__________________LoadLibraryWtsapiDll____________________n
push 0x40000
push 0x5f2054
call fcn.00433010
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call esi
cmp dword [ebp - 0x94], 6
je 0x40b1c6
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x98], 0x94
call esi
cmp dword [ebp - 0x94], 5
jne 0x40b1c2
cmp dword [ebp - 0x90], 1
jae 0x40b1c6
xor esi, esi
jmp 0x40b1fe
mov edx, dword [edi + 0x9b0]
mov eax, dword [edx + 4]
lea ecx, [edi + 0x9b0]
call eax
cmp eax, 1
jne 0x40b1e5
mov esi, eax
push str.__Loading_WtsapiDll_is_succeeded__n
jmp 0x40b1ec
xor esi, esi
push str.__Loading_WtsapiDll_is_Failed_________n
push 0x40000
push 0x5f2054
call fcn.00433010
add esp, 0xc
push str._______________________________________________________n_n
push 0x40000
push 0x5f2054
call fcn.00433010
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0055db96
mov esp, ebp
pop ebp
ret

Function at 0x40b230
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x5f01b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.__________________WTSRegisterSessionNotification____________________n
push 0x40000
push 0x5f2054
mov esi, ecx
call fcn.00433010
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call edi
cmp dword [ebp - 0x94], 6
je 0x40b2a9
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x98], 0x94
call edi
cmp dword [ebp - 0x94], 5
jne 0x40b2a5
cmp dword [ebp - 0x90], 1
jae 0x40b2a9
xor esi, esi
jmp 0x40b2f4
cmp dword [esi + 0x9c8], 0
mov ecx, dword [esi + 0x20]
jne 0x40b2cf
mov eax, dword [esi + 0x9b8]
test eax, eax
je 0x40b2db
push 0
push ecx
call eax
mov dword [esi + 0x9c8], eax
cmp eax, 1
jne 0x40b2db
mov esi, 1
push str.__WTSRegisterSessionNotification_is_succeeded__n
jmp 0x40b2e2
xor esi, esi
push str.__WTSRegisterSessionNotification_is_Failed_________n
push 0x40000
push 0x5f2054
call fcn.00433010
add esp, 0xc
push str._______________________________________________________n_n
push 0x40000
push 0x5f2054
call fcn.00433010
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0055db96
mov esp, ebp
pop ebp
ret

Function at 0x40b320
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x5f01b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call esi
cmp dword [ebp - 0x94], 6
je 0x40b37b
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x98], 0x94
call esi
cmp dword [ebp - 0x94], 5
jne 0x40b38e
cmp dword [ebp - 0x90], 1
jb 0x40b38e
mov edx, dword [edi + 0x20]
push 0
push 0x1388
push 6
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0055db96
mov esp, ebp
pop ebp
ret
Function at 0x4107f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x588700
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x5f01b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 0xd], 0
call fcn.004347c0
mov dword [ebp - 4], 0
call fcn.0046b8a8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410845
push 0x80004005
call fcn.004020e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov bl, 1
lea esi, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.00435540
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00402070
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410890
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.BrotherOfflineChk.exe
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.00404ea0
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00402070
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4108d4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4108e5
mov bl, byte [ebp - 0xd]
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410905
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
mov dword [ebp - 0x24], vtable.CCommFun.0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410932
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410951
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c890
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x5f01b4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x88]
cmp eax, 1
jne 0x41c8f7
push 0
push str.WindowsScreenSaverClass
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x41c98c
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055db96
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x41c98c
cmp dword [ebp - 0x94], eax
jne 0x41c979
push esi
push 0x2000000
push 0
push 0
push str.screen_saver
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov esi, eax
test esi, esi
jne 0x41c953
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 5
sete cl
push esi
mov dword [ebp - 0x9c], ecx
call dword [sym.imp.USER32.dll_CloseDesktop]
mov eax, dword [ebp - 0x9c]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055db96
mov esp, ebp
pop ebp
ret
push esi
mov dword [ebp - 0x9c], 1
call dword [sym.imp.USER32.dll_CloseDesktop]
mov eax, dword [ebp - 0x9c]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055db96
mov esp, ebp
pop ebp
ret
push 0
lea edx, [ebp - 0x9c]
push edx
push 0
push 0x72
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x9c]
xor ecx, ebp
call fcn.0055db96
mov esp, ebp
pop ebp
ret
Function at 0x41e2e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584a8c
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x5f01b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.SOFTWAREBrotherInstalledInformation_
lea ecx, [ebp - 0x264]
call fcn.0042fc70
xor ebx, ebx
lea esi, [ebp - 0x26c]
mov dword [ebp - 4], ebx
call fcn.00456ae0
mov byte [ebp - 4], 1
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x274]
call fcn.0042fd30
mov byte [ebp - 4], 2
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x264]
call fcn.00430420
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x274]
add eax, 0xfffffff0
or edi, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e37e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x26c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e3a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x1b
push str.SoftwareUpdateNotification
lea ecx, [ebp - 0x264]
call fcn.00430420
mov edx, dword [ebp - 0x264]
lea ecx, [ebp - 0x268]
push ecx
push 0x20019
push ebx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41e45e
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x284], ebx
mov dword [ebp - 0x280], ebx
lea esi, [ebp - 0x288]
mov byte [ebp - 4], 3
call fcn.00430390
mov esi, dword [ebp - 0x288]
mov ecx, dword [ebp - 0x284]
lea edx, [ebp - 0x278]
push edx
sub ecx, esi
push esi
sar ecx, 1
lea eax, [ebp - 0x270]
push eax
add ecx, ecx
push ebx
mov dword [ebp - 0x278], ecx
mov ecx, dword [ebp - 0x268]
push str.Path
push ecx
mov dword [ebp - 0x270], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41e484
mov edx, dword [ebp - 0x268]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41e45e
push esi
call fcn.0046acae
add esp, 4
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x41e480
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
jmp 0x41e4db
mov ecx, dword [ebp - 0x268]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x260]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, edi
je 0x41e451
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, ebx
je 0x41e4b7
push esi
call fcn.0046acae
add esp, 4
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x41e4d9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055db96
mov esp, ebp
pop ebp
ret
Function at 0x4227c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [eax]
lea ecx, [ebp - 4]
push ecx
push 0x20006
push 0
push eax
push SysReAllocString
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42280b
push 4
lea edx, [ebp + 0xc]
push edx
mov edx, dword [ebp - 4]
push 4
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8

Function at 0x422820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [eax]
lea ecx, [ebp - 4]
push ecx
push 0x20006
push 0
push eax
push SysReAllocString
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42286f
mov eax, dword [ebp + 0xc]
mov edx, dword [eax - 0xc]
inc edx
push edx
mov edx, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42288e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esp, ebp
pop ebp
ret 8

Function at 0x4228a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov eax, 4
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push 0x20019
xor esi, esi
push esi
push eax
push SysReAllocString
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x422913
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x10]
push ecx
push esi
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x422905
lea esi, [eax + 1]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x42291d
mov eax, dword [ebp + 0x10]
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret 0xc