joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c530
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x7c], 1
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40c568
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044d06d
mov esp, ebp
pop ebp
ret
push ebx
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, eax
cmp edi, ebx
je 0x40c6a6
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 3
push 0
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x40c6a6
test ebx, ebx
jne 0x40c5bb
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov ebx, eax
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push ebx
call esi
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x80]
push eax
push edi
call esi
push 1
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x84], eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call esi
test eax, eax
jne 0x40c68f
push 0x70
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.004500f0
add esp, 0xc
mov dword [ebp - 0x20], 1
mov eax, 0x12
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x1c], ax
mov word [ebp - 0x38], ax
mov word [ebp - 0x54], ax
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x74]
push 0x1c
push eax
push 4
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x50], 3
call dword [sym.imp.USER32.dll_SendInput]
push edi
call esi
test eax, eax
jne 0x40c68f
push 0x13
push eax
push eax
push eax
push eax
push 1
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [ebp - 0x80], 0
je 0x40c682
push 6
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call esi
neg eax
sbb eax, eax
and eax, 1
mov dword [ebp - 0x7c], eax
push 0
push dword [ebp - 0x84]
push dword [ebp - 0x78]
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x40c6b5
push 9
jmp 0x40c6b7
push 5
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x7c]
xor ecx, ebp
pop esi
pop ebx
pop edi
call fcn.0044d06d
mov esp, ebp
pop ebp
ret
Function at 0x414b60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SoftwareITSAutomation
push SysReAllocString
mov esi, ecx
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x1e8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.HandleId
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x414bd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x404]
push str.svcVersion
push 0x400
push eax
call fcn.00453332
add esp, 0xc
mov dword [ebp - 0x808], 0x400
lea eax, [ebp - 0x80c]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414cf6
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x810]
push eax
push 0
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x414c66
cmp dword [ebp - 0x808], eax
jne 0x414ca9
push 0x47a924
lea eax, [ebp - 0x404]
push 0x400
push eax
call fcn.00453332
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x810]
push eax
push 0
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x804]
push 0x47886c
push eax
call fcn.00450270
add esp, 8
test eax, eax
je 0x414ce3
inc eax
push 0x47886c
push eax
call fcn.00450270
add esp, 8
test eax, eax
je 0x414ce3
mov byte [eax], 0
lea eax, [ebp - 0x804]
push eax
push dword [ebp + 0xc]
push esi
call fcn.00453332
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 8

Function at 0x414d10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], 0x64
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.CurrentBuildNumber
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414e30
Capabilities:
Persist via appinit_dlls registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREWOW6432NodeMicrosoftWindows_NTCurrentVersionWindows
mov ebx, ecx
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], 4
call edi
test eax, eax
je 0x414e88
push 0
push 0
cmp eax, 2
mov ecx, str.key_not_found
push 1
mov edx, str.Access_Denied
cmovne ecx, edx
push 0x12
push ecx
jmp 0x414ebd
lea eax, [ebp - 8]
push eax
lea esi, [ebx + 0x2b4]
push esi
lea eax, [ebp - 0x14]
push eax
push 0
push str.LoadAppInit_DLLs
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x414ee9
cmp eax, 2
jne 0x414ed9
push 0
push 0
push 1
push 0x12
push str.key_not_found
mov ecx, 0x52abf8
call fcn.0041c080
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 1
mov ecx, str.Access_Denied
push 0x12
push ecx
jmp 0x414ebd
cmp dword [esi], 1
jne 0x414ec7
push 0x47ab60
lea eax, [ebp - 0x18]
push 2
push eax
call fcn.0040ea20
add esp, 0xc
mov dword [ebp - 0xc], 0xff
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREWOW6432NodeMicrosoftWindows_NTCurrentVersionWindows
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea eax, [ebp - 0xc]
add ebx, 0x2b8
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0
push str.AppInit_DLLs
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0
push 0
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xfde9
call ebx
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
mov eax, dword [ebp - 0x10]
push edi
push 0xffffffffffffffff
add eax, 0x2b8
push eax
push 0
push 0xfde9
call ebx
push 0
push 0
push 1
push 0x12
push edi
mov ecx, 0x52abf8
call fcn.0041c080
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414fa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], 0xff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0xe4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.MachineGuid
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415000
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftSpeech_OneCoreSettingsOnlineSpeechPrivacy
push SysReAllocString
mov esi, ecx
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.HasAccepted
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push str.HasAccepted
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415090
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
mov esi, ecx
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
mov dword [ebp - 0x10], 0xa00
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push str.SecureProtocols
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push str.SecureProtocols
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415110
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftTabletTip1.7
push SysReAllocString
mov esi, ecx
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.EnableTextPrediction
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push str.EnableTextPrediction
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4151a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftEdgeUpdateClientsF3017226_FE2A_4295_8BDF_00C3A9A7E4C5
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], 0x64
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x1ec]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x47aa7c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SOFTWAREWOW6432NodeMicrosoftEdgeUpdateClientsF3017226_FE2A_4295_8BDF_00C3A9A7E4C5
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], 0x64
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x250]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x47aa7c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415260
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 8], 0x64
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x80]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.DisplayVersion
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4152c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
add esi, 4
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xa
push 4
push dword [ebp + 0xc]
push dword [esi]
call fcn.0045fc21
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x415330
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftSpeech_OneCoreSettingsOnlineSpeechPrivacy
push SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
lea eax, [esi + 8]
push eax
push 4
push 0
push str.HasAccepted
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415380
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
push esi
push 4
push 0
push str.SecureProtocols
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4153d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftTabletTip1.7
push SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
lea eax, [esi + 8]
push eax
push 4
push 0
push str.EnableTextPrediction
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415420
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareMicrosoftTabletTip1.7
push SysReAllocString
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftTabletTip1.7
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.EnableDesktopModeAutoInvoke
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x416070
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1858
call fcn.0044d300
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.OPTIONS
push 0x88
xorps xmm0, xmm0
push 0
movlpd qword [ebp - 0x1858], xmm0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x1850], esi
cmp esi, 0x800
jae 0x41614f
test esi, esi
je 0x41613b
test edi, edi
je 0x4160f6
cmp esi, 0x800
ja 0x4160f6
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.0044fb70
add esp, 0xc
jmp 0x41613b
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004500f0
add esp, 0xc
test edi, edi
jne 0x41611d
call fcn.0045861e
mov dword [eax], 0x16
jmp 0x416130
cmp esi, 0x800
jbe 0x416141
call fcn.0045861e
mov dword [eax], 0x22
call fcn.00458520
mov esi, dword [ebp - 0x1850]
cmp esi, 0x800
jae 0x41621a
mov byte [ebp + esi - 0x804], 0
lea eax, [ebp - 0x184c]
push eax
push dword [0x4a7630]
push 0x4a7634
call fcn.00404a00
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00404650
mov esi, eax
add esp, 0x14
test esi, esi
je 0x4161fe
lea eax, [ebp - 0x184c]
push eax
lea eax, [ebp - 0x1850]
push eax
push esi
call fcn.00404720
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4161f7
mov eax, dword [ebp - 0x1850]
test eax, eax
je 0x4161f0
push edi
push eax
lea eax, [ebp - 0x804]
mov ecx, 0x5647e0
push eax
call fcn.00449d80
lea ecx, [ebp - 0x804]
mov eax, 0x5354504f
cmp eax, dword [ecx]
jne 0x4161f0
mov eax, 0x3a
cmp al, byte [ecx + 4]
jne 0x4161f0
lea eax, [ebp - 0x1858]
push eax
lea eax, [ebp - 0x7ff]
push str._lld
push eax
call fcn.00403500
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1858]
xor ecx, ebp
mov edx, dword [ebp - 0x1854]
pop edi
pop esi
call fcn.0044d06d
mov esp, ebp
pop ebp
ret
call fcn.0044d487
int3
Function at 0x416790
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0x104
push eax
call fcn.0045e4b4
push str.Resources
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004532c3
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.environ.bin
push 0xaa
push str.ENVIRONMENT
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.candidat.bin
push 0xae
push str.CANDIDATE
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.errorurl.bin
push 0xa1
push str.ERRORURL
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.exitlist.bin
push 0x8d
push str.EXITLIST
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.institut.bin
push 0xad
push str.INSTITUTION
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.interval.bin
push 0x85
push str.INTERVAL
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.language.bin
push 0xaf
push str.LANGUAGE
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.logpath.bin
push 0x8b
push str.LOGPATH
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.message.bin
push 0x9e
push str.MESSAGE
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.options.bin
push 0x88
push str.OPTIONS
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.program.bin
push 0xab
push str.PROGRAM
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.safe.bin
push 0x67
push str.SAFE
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.safedom.bin
push 0x8e
push str.SAFEDOM
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.unsafe.bin
push 0x6f
push str.UNSAFE
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.unsafedo.bin
push 0x96
push str.UNSAFEDOM
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.updateur.bin
push 0x94
push str.UPDATEURL
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.url.bin
push 0x75
push 0x4793a4
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.killlist.bin
push 0xa8
push str.KILLLIST
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.alturl.bin
push 0x7c
push str.ALTURL
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.ecminver.bin
push 0xa5
push str.ECMINVERSION
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00416570
push str.killonex.bin
push 0xbc
push str.KILLONQUITLIST
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.00416570
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 4
Function at 0x416e10
Capabilities:
Create directory
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4d9770]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
push 0x104
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040ea20
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push esi
mov esi, dword [ebp + 0xc]
push esi
push ebx
call fcn.0045e4b4
push 0x479574
push esi
push ebx
call fcn.004532c3
lea eax, [ebp - 0x20c]
push eax
push esi
push ebx
call fcn.004532c3
add esp, 0x24
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x479574
push esi
push ebx
call fcn.004532c3
push str.TestSecurity.
push esi
push ebx
call fcn.004532c3
push edi
push esi
push ebx
call fcn.004532c3
push str..dll
push esi
push ebx
call fcn.004532c3
add esp, 0x30
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x47a67c
push 0x74
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push ebx
mov dword [ebp - 0x210], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x416f4f
push 0
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x210]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 0x10
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
mov ecx, 0x52abf8
call fcn.00421180
push eax
push str._dllPath_
push str.You_do_not_have_write_and_execute_permissions_to_at_least_one_of_the_following_folders._To_use_this_application__you_must_have_write_execute_access._r_n_dllPath_.
push str.NoFolderAccess
mov ecx, 0x52abf8
call fcn.00420b00
push 1
mov ecx, 0x52abf8
mov dword [0x53b6b0], 1
mov dword [0x5162c8], 1
call fcn.004211f0
mov ecx, 0x52abf8
call fcn.004186d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044d06d
mov esp, ebp
pop ebp
ret 0x10