joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fd44
Capabilities:
Encode data using base64

Disassembly:
dec byte [esp + ebp*2]
inc byte [ebx]
jae 0x1000fd8c
jb 0x1000fd92
nop
nop
nop
nop
nop
nop
nop
enter 0xffffffffffff8b51, 0xd
pushal
and eax, dword [edx]
adc byte [ebx], al
retf 0x8b51
Function at 0x401b80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov dword [ebp - 0x224], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x224]
add eax, 0x2c
push eax
push 0x104
mov ecx, dword [ebp - 0x224]
add ecx, 0x852
push ecx
push 0
push 0x449194
push 0x449150
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401c12
push 0x104
mov edx, dword [ebp - 0x224]
add edx, 0x852
push edx
push 0x6a
mov ecx, dword [ebp - 0x224]
call fcn.00401040
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [ebp - 0x224]
movzx ecx, word [eax + 0x852]
test ecx, ecx
jne 0x401c12
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x224]
add eax, 0x852
mov esp, ebp
pop ebp
ret

Function at 0x401c30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x454688]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x224]
add eax, 0x2c
push eax
push 0x209
mov ecx, dword [ebp - 0x224]
add ecx, 0x4b78
push ecx
push 0
push 0x449280
push str.PreRequisites
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401caf
push 0x4492c4
push 0x209
mov edx, dword [ebp - 0x224]
add edx, 0x4b78
push edx
call fcn.004016e0
jmp 0x401d3f
mov eax, dword [ebp - 0x224]
add eax, 0x1898
push eax
push 0x105
lea ecx, [ebp - 0x220]
push ecx
call fcn.004016e0
mov edx, dword [ebp - 0x224]
add edx, 0x4b78
push edx
push 0x105
lea eax, [ebp - 0x220]
push eax
call fcn.00401730
lea ecx, [ebp - 0x220]
push ecx
push 0x209
mov edx, dword [ebp - 0x224]
add edx, 0x4b78
push edx
call fcn.004016e0
mov eax, dword [ebp - 0x224]
add eax, 0x4b78
push eax
mov ecx, dword [ebp - 0x224]
call fcn.004031c0
test eax, eax
jne 0x401d3f
push 0x4492d0
push 0x209
mov ecx, dword [ebp - 0x224]
add ecx, 0x4b78
push ecx
call fcn.004016e0
mov eax, dword [ebp - 0x224]
add eax, 0x4b78
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004296c6
mov esp, ebp
pop ebp
ret
Function at 0x402f80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
ja case.default.0x402fad
mov ecx, dword [ebp - 0x20]
jmp dword [ecx*4 + 0x403098]
mov dword [ebp - 0x14], SysReAllocStringLen
jmp 0x402fdf
mov dword [ebp - 0x14], SysReAllocStringLen
jmp 0x402fdf
mov dword [ebp - 0x14], reloc.OLEAUT32.dll_SysReAllocString
jmp 0x402fdf
mov dword [ebp - 0x14], SysReAllocStringLen
jmp 0x402fdf
mov dword [ebp - 0x14], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x18], 0x104
push 0x44957c
push 0x104
mov edx, dword [ebp + 0x14]
push edx
call fcn.0042a069
add esp, 0xc
cmp dword [ebp + 0x18], 0
jne 0x403027
lea eax, [ebp - 0x14]
push eax
push 0x20119
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
jmp 0x403043
lea eax, [ebp - 0x14]
push eax
push 0x20219
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0xff
mov dword [ebp - 4], 1
cmp dword [ebp - 8], 0
jne 0x403083
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x403083
mov dword [ebp - 0x10], 1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x402fb4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
ja case.default.0x402fad
mov ecx, dword [ebp - 0x20]
jmp dword [ecx*4 + 0x403098]
mov dword [ebp - 0x14], SysReAllocStringLen
jmp 0x402fdf
mov dword [ebp - 0x14], SysReAllocStringLen
jmp 0x402fdf
mov dword [ebp - 0x14], reloc.OLEAUT32.dll_SysReAllocString
jmp 0x402fdf
mov dword [ebp - 0x14], SysReAllocStringLen
jmp 0x402fdf
mov dword [ebp - 0x14], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x18], 0x104
push 0x44957c
push 0x104
mov edx, dword [ebp + 0x14]
push edx
call fcn.0042a069
add esp, 0xc
cmp dword [ebp + 0x18], 0
jne 0x403027
lea eax, [ebp - 0x14]
push eax
push 0x20119
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
jmp 0x403043
lea eax, [ebp - 0x14]
push eax
push 0x20219
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0xff
mov dword [ebp - 4], 1
cmp dword [ebp - 8], 0
jne 0x403083
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x403083
mov dword [ebp - 0x10], 1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x402fbd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
ja case.default.0x402fad
mov ecx, dword [ebp - 0x20]
jmp dword [ecx*4 + 0x403098]
mov dword [ebp - 0x14], SysReAllocStringLen
jmp 0x402fdf
mov dword [ebp - 0x14], SysReAllocStringLen
jmp 0x402fdf
mov dword [ebp - 0x14], reloc.OLEAUT32.dll_SysReAllocString
jmp 0x402fdf
mov dword [ebp - 0x14], SysReAllocStringLen
jmp 0x402fdf
mov dword [ebp - 0x14], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x18], 0x104
push 0x44957c
push 0x104
mov edx, dword [ebp + 0x14]
push edx
call fcn.0042a069
add esp, 0xc
cmp dword [ebp + 0x18], 0
jne 0x403027
lea eax, [ebp - 0x14]
push eax
push 0x20119
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
jmp 0x403043
lea eax, [ebp - 0x14]
push eax
push 0x20219
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0xff
mov dword [ebp - 4], 1
cmp dword [ebp - 8], 0
jne 0x403083
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x403083
mov dword [ebp - 0x10], 1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x402fc6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
ja case.default.0x402fad
mov ecx, dword [ebp - 0x20]
jmp dword [ecx*4 + 0x403098]
mov dword [ebp - 0x14], SysReAllocStringLen
jmp 0x402fdf
mov dword [ebp - 0x14], SysReAllocStringLen
jmp 0x402fdf
mov dword [ebp - 0x14], reloc.OLEAUT32.dll_SysReAllocString
jmp 0x402fdf
mov dword [ebp - 0x14], SysReAllocStringLen
jmp 0x402fdf
mov dword [ebp - 0x14], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x18], 0x104
push 0x44957c
push 0x104
mov edx, dword [ebp + 0x14]
push edx
call fcn.0042a069
add esp, 0xc
cmp dword [ebp + 0x18], 0
jne 0x403027
lea eax, [ebp - 0x14]
push eax
push 0x20119
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
jmp 0x403043
lea eax, [ebp - 0x14]
push eax
push 0x20219
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0xff
mov dword [ebp - 4], 1
cmp dword [ebp - 8], 0
jne 0x403083
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x403083
mov dword [ebp - 0x10], 1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x402fcf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
ja case.default.0x402fad
mov ecx, dword [ebp - 0x20]
jmp dword [ecx*4 + 0x403098]
mov dword [ebp - 0x14], SysReAllocStringLen
jmp 0x402fdf
mov dword [ebp - 0x14], SysReAllocStringLen
jmp 0x402fdf
mov dword [ebp - 0x14], reloc.OLEAUT32.dll_SysReAllocString
jmp 0x402fdf
mov dword [ebp - 0x14], SysReAllocStringLen
jmp 0x402fdf
mov dword [ebp - 0x14], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x18], 0x104
push 0x44957c
push 0x104
mov edx, dword [ebp + 0x14]
push edx
call fcn.0042a069
add esp, 0xc
cmp dword [ebp + 0x18], 0
jne 0x403027
lea eax, [ebp - 0x14]
push eax
push 0x20119
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
jmp 0x403043
lea eax, [ebp - 0x14]
push eax
push 0x20219
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0xff
mov dword [ebp - 4], 1
cmp dword [ebp - 8], 0
jne 0x403083
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x403083
mov dword [ebp - 0x10], 1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x403230
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp + 8]
call fcn.004054b0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40326b
mov dword [ebp - 0x1c], 0
lea ecx, [ebp + 8]
call fcn.00401130
mov eax, dword [ebp - 0x1c]
jmp 0x40338d
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004299a6
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403297
mov dword [ebp - 0x20], 0
lea ecx, [ebp + 8]
call fcn.00401130
mov eax, dword [ebp - 0x20]
jmp 0x40338d
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
push ecx
lea ecx, [ebp + 8]
call fcn.004054b0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x4032de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0xc]
push edx
call fcn.004298c9
add esp, 4
mov dword [ebp - 0x24], 0
lea ecx, [ebp + 8]
call fcn.00401130
mov eax, dword [ebp - 0x24]
jmp 0x40338d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x449590
mov edx, dword [ebp - 0xc]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40336f
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp + 0xc]
mov word [edx], cx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
and ecx, 0xffff
mov edx, dword [ebp + 0x10]
mov word [edx], cx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp + 0x14]
mov word [edx], cx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
and ecx, 0xffff
mov edx, dword [ebp + 0x18]
mov word [edx], cx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004298c9
add esp, 4
mov dword [ebp - 0x28], 1
lea ecx, [ebp + 8]
call fcn.00401130
mov eax, dword [ebp - 0x28]
jmp 0x40338d
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004298c9
add esp, 4
mov dword [ebp - 0x2c], 0
lea ecx, [ebp + 8]
call fcn.00401130
mov eax, dword [ebp - 0x2c]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x404bb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440073
mov eax, dword fs:[0]
push eax
mov eax, 0x3e9c
call fcn.0042ee40
mov eax, dword [0x454688]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3ea8], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
call fcn.0040cdc1
xor eax, eax
mov word [ebp - 0x3e94], ax
push 0x3e7e
push 0
lea ecx, [ebp - 0x3e92]
push ecx
call fcn.0042ca00
add esp, 0xc
mov edx, dword [ebp - 0x3ea8]
add edx, 0x2c
push edx
push 0x1f40
lea eax, [ebp - 0x3e94]
push eax
lea ecx, [ebp + 8]
call fcn.004054b0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov dword [ebp - 0x3e98], eax
mov dword [ebp - 0x3e9c], 0
mov ecx, dword [ebp - 0x3e9c]
cmp ecx, dword [ebp - 0x3e98]
jae 0x404cc3
mov edx, dword [ebp - 0x3e9c]
lea eax, [ebp + edx*2 - 0x3e94]
mov dword [ebp - 0x3ea4], eax
push 0x1f40
mov ecx, dword [ebp - 0x3ea4]
push ecx
call fcn.00429a70
add esp, 8
mov edx, dword [ebp - 0x3e9c]
lea eax, [edx + eax + 1]
mov dword [ebp - 0x3e9c], eax
mov ecx, dword [ebp - 0x3ea4]
push ecx
lea ecx, [ebp - 0x3ea0]
call fcn.00405120
mov byte [ebp - 4], 1
lea edx, [ebp - 0x3ea0]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.0040ce35
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3ea0]
call fcn.00401130
jmp 0x404c48
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401130
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004296c6
mov esp, ebp
pop ebp
ret 8

Function at 0x404d40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x454688]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x434], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x21c], 0
push 0x44a2ec
push 0x105
lea eax, [ebp - 0x218]
push eax
call fcn.004016e0
mov ecx, dword [ebp - 0x434]
add ecx, 0x2c
push ecx
push 0x209
mov edx, dword [ebp - 0x434]
add edx, 0x2cf2
push edx
push 0
lea eax, [ebp - 0x218]
push eax
push 0x449150
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x434]
add eax, 0x2cf2
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004296c6
mov esp, ebp
pop ebp
ret

Function at 0x405050
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x454688]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
push str.InstallMode
push 0x105
lea eax, [ebp - 0x220]
push eax
call fcn.004016e0
mov ecx, dword [ebp - 0x43c]
add ecx, 0x2c
push ecx
push 0x104
mov edx, dword [ebp - 0x43c]
add edx, 0x53bc
push edx
push 0
lea eax, [ebp - 0x220]
push eax
push 0x449150
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x43c]
add eax, 0x53bc
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004296c6
mov esp, ebp
pop ebp
ret
Function at 0x4063d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 1
cmp dword [ebp + 8], 0
jne 0x4063f2
jmp 0x406431
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x406431
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x4065a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x4065a9
xor ecx, ecx
jne 0x4065a9
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4065f0
mov eax, dword [ebp - 0xc]
jmp 0x40664d
cmp dword [ebp - 4], 1
je 0x406603
cmp dword [ebp - 4], 2
je 0x406603
mov eax, 0xd
jmp 0x40664d
cmp dword [ebp + 0xc], 0
je 0x406641
cmp dword [ebp - 8], 0
je 0x406639
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x406630
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x406637
mov eax, 0xd
jmp 0x40664d
jmp 0x406641
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407020
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0x24], 0
push 0x44
push 0
lea eax, [ebp - 0x70]
push eax
call fcn.0042ca00
add esp, 0xc
mov dword [ebp - 0x70], 0x44
mov dword [ebp - 0x44], 1
mov ecx, 5
mov word [ebp - 0x40], cx
mov dword [ebp - 0x7c], 0xc
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0xb0]
add ecx, 0x57d0
call fcn.004051c0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x70]
push ecx
push 0
push 0
push 8
push 0
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x7c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4070f9
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x407169
mov ecx, dword [ebp + 8]
push ecx
push 0x643
push 0x10
push 0
push 0x6c
lea ecx, [ebp - 0x94]
call fcn.00401060
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0xac], edx
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xa8], eax
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0xa4], ecx
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0xa0], edx
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x9c], eax
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x98], ecx
push 0x450068
lea edx, [ebp - 0xac]
push edx
call fcn.0042b425
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x408770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0xc]
push eax
push str.SystemCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4087c3
jmp 0x408881
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0x4486ac
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4087ed
cmp dword [ebp - 8], 0
jne 0x4087f7
jmp 0x408881
mov ecx, dword [ebp - 8]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x408810
jmp 0x408881
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push str.ProductSuite
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40883c
cmp dword [ebp - 4], 7
je 0x408840
jmp 0x408881
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
movsx edx, byte [ecx]
test edx, edx
je 0x408881
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40886b
mov dword [ebp - 0x14], 1
jmp 0x408881
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x1c]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x1c], edx
jmp 0x408846
cmp dword [ebp - 0x18], 0
je 0x408891
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xc], 0
je 0x4088a1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4