joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404a73
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cwde
aas
std
cwde
xchg ecx, eax
dec ecx
lahf
salc
cwde
dec ecx
dec ebx
lahf
inc ebx
aaa
aaa
xchg ecx, eax
inc edx
inc ebx
xchg ebx, eax
wait
dec ebx
inc ebx
xchg ebx, eax
daa
lahf
lahf
xchg ebx, eax
dec ecx
wait
inc ebx
inc edx
dec ecx
dec eax
salc
inc edx
inc ecx
cld
dec edx
aas
clc
lahf
inc ebx
xchg ecx, eax
dec ebx
cwde
daa
cmc
dec eax
cld
inc eax
cwde
das
clc
inc eax
aaa
dec edx
dec edx
dec edx
salc
daa
inc ecx
xchg edx, eax
das
daa
inc eax
cmc
cwde
cwde
xchg edx, eax
xchg edx, eax
xchg edx, eax
dec edx
cwde
dec ebx
dec eax
daa
dec eax
std
aaa
aas
inc ecx
daa
xchg edx, eax
cdq
xchg edx, eax
clc
dec eax
cdq
inc edx
das
inc ecx
aaa
salc
inc edx
inc edx
xchg edx, eax
nop
dec ecx
inc eax
dec ebx
xchg ecx, eax
std
salc
salc
inc eax
wait
inc ecx
cwde
cld
nop
xchg edx, eax
wait
aas
daa
cmc
dec eax
daa
xchg edx, eax
stc
xchg ecx, eax
cdq
nop
cmc
cld
wait
cwde
inc eax
salc
inc ecx
dec ecx
dec edx
dec ecx
dec ebx
lahf
dec ebx
aaa
wait
cmc
stc
xchg ebx, eax
dec eax
cdq
dec ecx
salc
inc ebx
clc
inc edx
salc
cdq
daa
inc eax
dec edx
cmc
nop
inc ecx
wait
inc ebx
wait
das
dec ebx
aaa
cmc
wait
daa
aaa
xchg ecx, eax
inc ebx
lahf
xchg edx, eax
wait
cdq
stc
inc edx
dec ebx
inc edx
lahf
dec ebx
inc edx
clc
cld
inc edx
lahf
das
wait
aas
salc
salc
xchg ecx, eax
cmc
cmc
cmc
inc ebx
das
cmc
inc eax
daa
xchg ecx, eax
cwde
das
xchg ecx, eax
das
cdq
wait
jmp 0x404973
nop
jmp 0x404984
cld
nop
call 0x404d27
nop
jmp 0x40499a
nop
jmp 0x4049aa
pushal
jmp 0x4049b7
mov ebp, esp
jmp 0x4049c8
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
jmp 0x4049db
mov edx, dword [edx + 0x14]
nop
jmp 0x4049ed
xor edi, edi
jmp 0x4049ff
movzx ecx, word [edx + 0x26]
nop
jmp 0x404a13
mov esi, dword [edx + 0x28]
nop
xor eax, eax
jmp 0x404a25
lodsb al, byte [esi]
jmp 0x404a37
cmp al, 0x61
nop
jl 0x404a4d
nop
nop
sub al, 0x20
nop
jmp 0x404a4d
nop
ror edi, 0xd
nop
jmp 0x404a61
add edi, eax
jmp 0x404a70
dec ecx
jne 0x404a17
invalid
invalid
invalid
invalid
nop
jmp 0x404a89
push edx
jmp 0x404a9b
mov edx, dword [edx + 0x10]
jmp 0x404aaa
push edi
mov eax, dword [edx + 0x3c]
nop
jmp 0x404abc
add eax, edx
nop
jmp 0x404acd
mov eax, dword [eax + 0x78]
test eax, eax
nop
jmp 0x404ade
je 0x404d1b
jmp 0x404af0
nop
jmp 0x404b01
add eax, edx
nop
jmp 0x404b13
mov ebx, dword [eax + 0x20]
jmp 0x404b26
mov ecx, dword [eax + 0x18]
nop
jmp 0x404b3a
add ebx, edx
jmp 0x404b46
push eax
jmp 0x404b57
nop
test ecx, ecx
jmp 0x404b68
je 0x404cf9
nop
jmp 0x404b7b
jmp 0x404b85
xor edi, edi
nop
dec ecx
nop
jmp 0x404b98
mov esi, dword [ebx + ecx*4]
nop
jmp 0x404ba7
add esi, edx
nop
xor eax, eax
nop
jmp 0x404bc1
lodsb al, byte [esi]
nop
ror edi, 0xd
nop
jmp 0x404bd8
add edi, eax
nop
jmp 0x404be8
cmp al, ah
jmp 0x404bf7
invalid
invalid
lodsb al, byte [esi]
invalid
invalid
Function at 0x406810
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp - 0x2f]
push 0x49660b
push esi
rol byte [esi], cl
aas
call fcn.00405640
push esi
call fcn.004066e0
or dword [0xc25d5e4c], 4
add byte [eax + 0x27b82691], dl
nop
pushfd
nop
nop
nop
nop
nop
insd dword es:[edi], dx
push ebp
mov ebp, dword [esi - 0x7f]
in al, dx
adc byte [edx], al
add byte [ecx - 0x5bed13ad], ch
push esi
push edi
mov esi, dword [ebp + 4]
sbb ebx, 0xffffffc3
cmp dword [ecx + 0x194], ebp
mov ecx, dword [ebx + 0x10]
test ecx, ecx
add eax, dword [ecx + ecx*4 - 0x7438ffff]
jne 0x406875
mov ecx, dword [esi + 0x14]
lea edx, [esi + 0x28]
push ecx
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
pxor mm2, qword [ebp - 0x3affffff]
rol dword [eax], 0x83
clc
dec dword [edi]
out dx, eax
xchg ebp, eax
add dword [eax], eax
add ch, al
xor eax, sym.imp.WSOCK32.dll_WSAGetLastError
call esi
test eax, eax
je 0xf340698a
dec dword [edx + 0xafc8005]
add byte [0x650b23b3], bh
jne 0x13669f4
mov edi, dword [ebx + 0x20]
mov esi, dword [ebx + 0x34]
mov eax, edi
or eax, esi
jne 0x4068bd
pop edi
cld
mov eax, 0xb23e6
mov ebp, 0xda5de586
in al, 0
mov eax, dword [ebx + 4]
mov ecx, 0x9666
test dword [edi], ebx
mov dword [eax - 0x20c], esp
mov ecx, dword [edi - 0x34]
std
wait
dec dword [ecx - 0x4b077b]
call [ebp - 0x73]
hlt

Function at 0x40aed0
Capabilities:
Write file on windows

Disassembly:
or al, 0
call esi
push ds
pop esi
add eax, 0xe00afc80
js 0x40aef9
or al, 0x5d
test dword [eax + eax], 0x83ab438b
iretd
push ss
mov ecx, edx
xor byte [ebx + 0xc45890e], cl
test dword [edi], eax
jne 0x40af17
mov dword [esi], 0x3401
pop edi
popal
xor eax, eax
mov dh, 0x8b
in eax, 0x28
ret 0xc
mov cl, byte [ebx + 0x2c]
test cl, cl
je 0x40b03f
mov edx, dword [ebx + 0x58]
leave
push edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x74], edi
call fcn.0040a240
cmp dword [ebx + 0x61], 1
jne 0x40af66
push ebx
call 0x8040b2d0
xor ecx, ecx
mov dword [ebx + 8], edi
cmp eax, ecx
cmp eax, 0x58438b15
pop ecx
call 0x143fd740
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
mov ch, 0x32
or al, 0
mov dword [esi + 0x3c], esi
ror byte [ebx + 0x48], cl
push ds
dec ebx
inc esp
daa
inc ebp
or byte [eax], al
add byte [eax], al
add bl, ch
or cl, byte [ebx - 0x307a0783]
jbe 0x40b017
fimul dword [ebx + 0x3c]
mov edx, dword [esp + eax*2 + 0x3b]
enter 0xffffffffffffb272, 0xffffffffffffff8b
inc ebx
lodsd eax, dword [esi]
adc cl, byte [ebx + 0x38]
lea edx, [ebp - 0xc]
push edx
retf 0x5351
mov eax, dword [ebp - 4]
xor al, 0x4d
or al, 0x2b
ror dword [esi], 6
je 0x40b02a
mov dword [ebp + 0x30], 0
mov eax, dword [ebx + 0x58]
push eax
call fcn.0040a340
mov edx, 0x5e5f0845
mov edx, dword [esi]
lea esp, [ebx + 0x5052510c]
movsd dword es:[di], dword [si]
xor eax, dword [eax]
Function at 0x401460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
sub esp, 0x18
push esi
push edi
test eax, eax
jne 0x401839
call fcn.004034a0
mov ecx, 0x50d75000
push 0x25407550
add dword [eax - 0x48], eax
aad 0xd7
add byte [ebx + 0x1835c68], al
inc eax
or ah, cl
pop esi
pop esi
aad 0xd7
int3
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0xc], esi
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, eax
mov esi, dword [ebp + 0xc]
lodsb al, byte [esi]
inc ecx
test eax, eax
jne 0x401771
dec ecx
mov dword [ebp - 0x10], ecx
test ecx, ecx
jne 0x401c6b
daa
push 4
push 1
push eax
call 0x44620d
mov eax, dword [esi + 0x14]
push 3
push 1
push eax
call 0x44620d
mov ecx, dword [esi + 0x14]
push 2
push 1
push ecx
call 0x44620d
add esp, 0x24
mov eax, esi
pop esi
pop ebx
ret
mov edi, dword [0x4051bd]
push 0x10000
mov edx, dword [ebp + 8]
pop esi
mov eax, dword [0x40515a]
and edx, eax
mov eax, dword [edx]
cmp ax, di
je 0x40185a
sub edx, esi
jmp 0x40184f
mov dword [ebp - 8], edx
mov eax, edx
mov ecx, dword [eax + 0x3c]
add eax, 0x78
and ecx, 0xffff
add eax, ecx
mov eax, dword [eax]
mov esi, dword [ebp - 8]
push esi
add esi, eax
mov eax, dword [esi + 0x20]
pop edi
add edi, eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x14], eax
jmp 0x401764
push dword [ebp - 0x14]
pop ecx
mov eax, dword [edi]
mov esi, dword [ebp - 8]
add esi, eax
xor eax, eax
push ecx
mov ecx, eax
push esi
add edi, 4
lodsb al, byte [esi]
add ecx, 1
test eax, eax
jne 0x401c7f
dec ecx
pop esi
cmp ecx, dword [ebp - 0x10]
je 0x401c94
inc dword [ebp - 4]
pop ecx
loop 0x401c6f
push esi
push dword [ebp + 0xc]
call fcn.004034a0
test eax, eax
jne 0x401c8e
je 0x4031f0
add dword [ebx + ecx - 0x73], esi
lea eax, [edi + edi*8 - 1]
invalid
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov ecx, dword [esi + 0x24]
add eax, eax
add ecx, dword [ebp - 8]
add ecx, eax
movzx eax, word [ecx]
mov ecx, dword [esi + 0x1c]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax]
add eax, ecx
test eax, eax
jne 0x4016f5
pop esi
and byte [eax + 0x68b105e], cl
cmp eax, ebx
je 0x40322d
push eax
call 0x469c99
add esp, 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
pop esi
pop ebx
ret
Function at 0x40327a
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404698
push 0x403a64
push eax
mov eax, dword [0x405410]
mov dword fs:[0], esp
mov ecx, dword [sym.imp.CRTDLL.dll__fmode_dll]
sub esp, 0x6c
mov dword [ecx], eax
mov edx, dword [0x40540c]
mov eax, dword [sym.imp.CRTDLL.dll__commode_dll]
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [eax], edx
call fcn.004017b0
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
push dword [0x405408]
push edx
push eax
lea ecx, [ebp - 0x30]
push ecx
call sub.CRTDLL.dll___GetMainArgs
add esp, 0x10
push 0x4040d8
push 0x4040d4
call sub.CRTDLL.dll__initterm
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.CRTDLL.dll__acmdln_dll]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x403315
mov al, byte [ebp - 0x34]
inc esi
mov al, byte [esi]
test al, al
je 0x40330d
cmp al, 0x22
jne 0x403302
cmp byte [esi], 0x22
jne 0x40331f
inc esi
jmp 0x40331f
cmp al, 0x20
jbe 0x40331f
inc esi
cmp byte [esi], 0x20
ja 0x403319
cmp byte [esi], 0
je 0x40332f
cmp byte [esi], 0x20
ja 0x40332f
inc esi
cmp byte [esi], 0
jne 0x403324
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x50], 1
mov eax, 0xa
je 0x40334f
movzx eax, word [ebp - 0x4c]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call sub.CRTDLL.dll_exit
jmp 0x40338b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x401700
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x401724
mov eax, edi
push esi
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x401714
sub eax, esi
sar eax, 1
pop esi
mov edx, dword [ebp + 0x14]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
push edi
push edx
mov edx, dword [ecx]
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
test eax, eax
je 0x401775
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x401765
jle 0x40176a
mov ecx, dword [ebp + 8]
and eax, 0xffff
or eax, 0x80070000
mov dword [ecx], eax
mov eax, ecx
pop ebp
ret 0x10
mov eax, 0x8007054f
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
mov dword [eax], 0
pop ebp
ret 0x10

Function at 0x401790
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
push edi
lea edi, [eax + 2]
lea ecx, [ecx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4017a0
mov edx, dword [ecx]
sub eax, edi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ecx + 4]
mov ecx, dword [eax]
push esi
push 2
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
test eax, eax
je 0x4017ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4017ef
jle 0x4017f4
mov ecx, dword [ebp + 8]
and eax, 0xffff
or eax, 0x80070000
mov dword [ecx], eax
mov eax, ecx
pop ebp
ret 8
mov eax, 0x8007054f
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov dword [eax], 0
pop ebp
ret 8
Function at 0x401810
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x41c4a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
push str.com_gnutoolchains_StatusMapping__s
push 0xffffffffffffffff
mov esi, ecx
lea eax, [ebp - 0x20c]
push 0x104
push eax
mov dword [esi], vtable.UnattendedInstaller.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0xffffffff
call fcn.0040b14a
add esp, 0x14
push 1
lea ecx, [ebp - 0x230]
push ecx
mov byte [ebp - 0x210], 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea edx, [ebp - 0x230]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea ecx, [ebp - 0x20c]
push ecx
push 0x1f58
push 0
push 4
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x230]
push 0xffffffffffffffff
mov dword [ebp - 0x21c], 0xc
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], 0
mov byte [ebp - 0x210], 1
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esi + 8]
push 0
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [esi + 8]
mov dword [esi + 4], eax
cmp ecx, 0xffffffff
je 0x401901
test eax, eax
jne 0x401901
cmp ecx, 0xffffffff
je 0x401901
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 4]
test eax, eax
je 0x401918
push 0x1f58
push 0
push eax
call fcn.0040b180
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040b16b
mov esp, ebp
pop ebp
ret 4
Function at 0x402b10
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x41c4a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push edi
or ecx, 0x2001f
push ecx
xor ebx, ebx
push eax
push edx
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x208], ebx
call fcn.004023e0
mov edi, eax
cmp edi, ebx
je 0x402b8a
mov eax, dword [ebp - 0x210]
cmp eax, ebx
je 0x402b75
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b16b
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x210]
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x204]
push edx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
mov dword [ebp - 0x214], 0x100
call ebx
test eax, eax
jne 0x402c08
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x210]
call fcn.00402b10
mov edi, eax
test edi, edi
jne 0x402c41
lea edx, [ebp - 0x220]
push edx
mov edx, dword [ebp - 0x210]
push eax
push eax
push eax
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x204]
push ecx
push edi
push edx
mov dword [ebp - 0x214], 0x100
call ebx
test eax, eax
je 0x402bc0
mov eax, dword [ebp - 0x210]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
cmp eax, edi
je 0x402c23
push eax
call ebx
mov dword [ebp - 0x210], edi
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x20c], edi
push eax
cmp ecx, edi
je 0x402c6b
mov edx, dword [esi]
push edx
call fcn.004021b0
jmp 0x402c74
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x402b75
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b16b
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [ebp - 0x210]
cmp eax, edi
je 0x402c83
push eax
call ebx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b16b
mov esp, ebp
pop ebp
ret 4
Function at 0x404c30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x41c4a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
push edi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x404c54
mov eax, 0x41a184
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push eax
call ebx
test eax, eax
jne 0x404d8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x404c7f
jle 0x404c84
and eax, 0xffff
or eax, 0x80070000
jmp 0x404c84
mov eax, 0x8007054f
cmp byte [ebp + 0x10], 0
je 0x404d77
cmp eax, 0x80070003
jne 0x404d77
lea eax, [ebp - 0x30]
push esi
push eax
call fcn.00404b90
mov ecx, dword [ebp - 0x2c]
add esp, 8
test ecx, ecx
je 0x404d47
mov eax, dword [esi + 4]
cmp ecx, eax
jne 0x404cd0
mov edx, dword [esi]
push eax
push edx
push ecx
push 0
lea ecx, [ebp - 0x30]
call fcn.00401ec0
test eax, eax
sete al
test al, al
jne 0x404d47
push 1
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x34]
push ecx
call fcn.00404c30
mov eax, dword [eax]
add esp, 0xc
test eax, eax
js 0x404d09
mov esi, dword [esi]
test esi, esi
jne 0x404cf3
mov esi, 0x41a184
push 0
push esi
call ebx
test eax, eax
jne 0x404d26
push 0x8007054f
call fcn.00401550
add esp, 4
lea ecx, [ebp - 0x30]
mov dword [edi], eax
call fcn.00401000
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b16b
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x30]
mov dword [edi], 0
call fcn.00401000
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b16b
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov dword [edi], 0x80070003
test eax, eax
je 0x404d92
lea edx, [ebp - 0x24]
cmp eax, edx
je 0x404d92
push eax
call fcn.0040af1a
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b16b
mov esp, ebp
pop ebp
ret
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b16b
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b16b
mov esp, ebp
pop ebp
ret
Function at 0x404db0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x41c4a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test eax, eax
jne 0x404dd3
mov eax, 0x41a184
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404df7
test al, 0x10
je 0x404df7
mov eax, dword [ebp + 0xc]
mov dword [esi], 0
test eax, eax
je 0x404e65
lea ecx, [ebp + 0x18]
cmp eax, ecx
jmp 0x404e5a
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0x30]
push eax
call fcn.00404b90
sub esp, 0x24
lea edx, [ebp - 0x30]
mov ecx, esp
push edx
call fcn.00404640
lea eax, [ebp - 0x34]
push eax
mov ecx, edi
call fcn.00404db0
mov eax, dword [ebp - 0x34]
test eax, eax
jns 0x404e28
mov dword [esi], eax
jmp 0x404e37
push 1
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.00404c30
add esp, 0xc
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x404e4e
lea ecx, [ebp - 0x24]
cmp eax, ecx
je 0x404e4e
push eax
call fcn.0040af1a
add esp, 4
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x404e65
lea edx, [ebp + 0x18]
cmp eax, edx
je 0x404e65
push eax
call fcn.0040af1a
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040b16b
mov esp, ebp
pop ebp
ret 0x30

Function at 0x404fb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x41c4a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x40c], ecx
xor ecx, ecx
push 2
push ecx
push eax
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x408], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x404fff
call fcn.004020f0
mov esi, eax
jmp 0x4050a6
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x405018
call fcn.004020f0
jmp 0x40509d
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x40502d
call fcn.004020f0
jmp 0x40509d
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x405045
mov esi, 0x8007000e
jmp 0x40509f
push eax
lea ecx, [ebp - 0x408]
call fcn.00403420
mov eax, dword [ebp - 0x408]
test eax, eax
jne 0x405062
mov esi, 0x8007000e
jmp 0x40509f
push esi
push eax
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x40507b
call fcn.004020f0
jmp 0x40509d
mov edx, dword [ebp - 0x408]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x408]
push eax
push ecx
lea ecx, [ebp - 0x410]
call fcn.004049f0
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x404]
cmp dword [ebp - 0x408], edx
je 0x4050c0
lea ecx, [ebp - 0x408]
call fcn.00402ab0
nop
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b16b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4056e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea eax, [ebp - 4]
push eax
push 0
push 0
mov edi, ecx
mov ecx, dword [edi]
mov edx, dword [edi + 4]
push 0
mov dword [ebp - 4], 0
mov eax, dword [edx]
push ecx
push eax
call ebx
test eax, eax
je 0x405747
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x405733
jle 0x405738
mov ecx, dword [ebp + 8]
and eax, 0xffff
or eax, 0x80070000
pop edi
mov dword [ecx], eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, 0x8007054f
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
seto cl
push esi
neg ecx
or ecx, eax
push ecx
call fcn.0040ae7b
mov esi, eax
add esp, 4
test esi, esi
jne 0x40577e
mov eax, dword [ebp + 8]
pop esi
pop edi
mov dword [eax], 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [edi]
mov edx, dword [edi + 4]
lea eax, [ebp - 4]
push eax
mov eax, dword [edx]
push esi
push 0
push 0
push ecx
push eax
call ebx
test eax, eax
je 0x4057d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4057bc
jle 0x4057c1
mov ecx, dword [ebp + 8]
and eax, 0xffff
pop esi
or eax, 0x80070000
pop edi
mov dword [ecx], eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, 0x8007054f
mov ecx, dword [ebp + 8]
pop esi
pop edi
mov dword [ecx], eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4057d6
mov ecx, dword [ebp + 0xc]
sub eax, edx
sar eax, 1
push eax
push esi
call fcn.004047d0
push esi
call fcn.00408740
mov eax, dword [ebp + 8]
add esp, 4
pop esi
pop edi
mov dword [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret 8