joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ca890
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fd75d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x14], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x5caa1f
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.005c6330
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x5ca9dc
mov edi, edi
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp + 8], eax
cmp ebx, esi
jne 0x5ca961
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x5ca9cf
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x5ca998
mov eax, dword [eax]
cmp eax, ecx
je 0x5ca990
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x5ca9cf
cmp ebx, eax
je 0x5ca9ac
lea esp, [esp]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x5ca9fd
cmp ebx, eax
jne 0x5ca9a0
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [ebp - 0x14]
mov ecx, edx
cmp edx, esi
jne 0x5ca910
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
jmp 0x5ca9cf
push str.invalid_hash_bucket_count
call fcn.005d08d0
int3
Function at 0x5caa30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fd4cd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], ebx
cmp edx, esi
je 0x5cabdd
mov ecx, dword [ebx + 4]
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [edx + 4]
push edi
mov edi, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 4], 0
mov eax, dword [edx + 4]
mov dword [ebp - 0x24], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
xor ecx, eax
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp + 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
lea ebx, [ebx]
cmp edi, eax
mov eax, edi
mov edi, dword [edi]
push 0x10
push eax
sete bl
mov dword [ebp - 0x2c], edi
call fcn.005d1425
mov edx, dword [ebp - 0x10]
add esp, 8
dec dword [edx + 8]
test bl, bl
jne 0x5cab1e
mov eax, dword [ebp - 0x20]
cmp edi, esi
jne 0x5caae0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jne 0x5cabcd
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edi
jmp 0x5cabcd
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
cmp eax, dword [ebp + 8]
jne 0x5cab30
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
jmp 0x5cab33
mov eax, dword [ebp - 0x24]
mov dword [ecx + 4], eax
cmp edi, esi
je 0x5cabcd
mov edi, edi
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor ecx, eax
movzx eax, byte [edi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + ecx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], eax
cmp edi, eax
mov eax, edi
mov edi, dword [edi]
push 0x10
push eax
sete bl
mov dword [ebp - 0x2c], edi
call fcn.005d1425
mov eax, dword [ebp - 0x10]
add esp, 8
dec dword [eax + 8]
test bl, bl
jne 0x5cabb1
cmp edi, esi
je 0x5cabc8
mov eax, dword [ebp + 0xc]
jmp 0x5cab87
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp edi, esi
je 0x5cabcd
mov edx, dword [ebp - 0x10]
jmp 0x5cab40
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
mov dword [eax], edi
mov dword [edi + 4], eax
pop edi
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x5d03b0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
movzx ebx, byte [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
dec ebx
push edi
mov edi, dword [ebp + 0xc]
or ebx, 0xdfdfdfdf
shr edi, 2
lea edx, [eax + edi*4]
mov dword [ebp + 0x10], edx
test edi, edi
je 0x5d0444
mov ecx, edx
lea eax, [edi*4]
and ecx, 3
sub edx, eax
mov dword [ebp + 0x14], ecx
add edx, 2
jmp 0x5d03f0
test ecx, ecx
jne 0x5d03f9
mov eax, dword [edx - 2]
jmp 0x5d041a
movzx eax, byte [edx + 1]
movzx ecx, byte [edx]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx - 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx - 2]
shl eax, 8
or eax, ecx
mov ecx, dword [ebp + 0x14]
and eax, ebx
add edx, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xd
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
sub edi, 1
jne 0x5d03f0
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov eax, edi
and eax, 3
sub eax, 1
je 0x5d046d
sub eax, 1
je 0x5d0464
sub eax, 1
jne 0x5d0485
movzx ecx, byte [edx + 2]
shl ecx, 0x10
movzx eax, byte [edx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edx]
xor eax, ecx
and eax, ebx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
xor esi, edi
mov eax, esi
shr eax, 0x10
xor eax, esi
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop ebp
ret

Function at 0x5ed25b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005ed0d1
Function at 0x40111d
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x4625f8
call fcn.00436c50
sub esp, 0x1c
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], 0x56
push 0x474e90
lea eax, [ebp - 0x24]
push eax
call fcn.00436c6f
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 4]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x20], eax
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov dword [ebp - 0x10], esp
lea esi, [ecx + eax + 0x18]
mov eax, dword [edi]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esi
jge 0x40121a
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x4011e2
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x40120f
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], 0x40
push 0x474e90
lea eax, [ebp - 0x28]
jmp 0x401143
push 4
push 0x1000
push eax
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [esi + 0x10]
mov ebx, eax
mov eax, dword [esi + 0x14]
add eax, dword [ebp + 8]
push eax
push ebx
call fcn.00436cc0
add esp, 0xc
mov dword [esi + 8], ebx
inc dword [ebp - 0x14]
add esi, 0x28
jmp 0x401163
mov eax, 0x401220
ret

Function at 0x40122f
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x462602
call fcn.00436c50
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
movzx ecx, word [eax + 0x14]
and dword [ebp - 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
lea edi, [ecx + eax + 0x18]
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
movzx eax, word [ebx + 6]
cmp dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edi
jge 0x40131d
mov edx, dword [edi + 0x24]
mov eax, edx
mov ecx, edx
shr eax, 0x1d
shr ecx, 0x1e
mov esi, edx
and eax, 1
and ecx, 1
shr esi, 0x1f
test edx, 0x2000000
je 0x40129b
push 0x4000
push dword [edi + 0x10]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x401312
lea eax, [ecx + eax*2]
lea eax, [esi + eax*2]
mov eax, dword [eax*4 + 0x47e008]
mov dword [ebp - 0x14], eax
test edx, 0x4000000
je 0x4012ba
or dword [ebp - 0x14], 0x200
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x4012d4
test dl, 0x40
je 0x4012cb
mov eax, dword [ebx + 0x20]
jmp 0x4012d2
test dl, dl
jns 0x401312
mov eax, dword [ebx + 0x24]
test eax, eax
jbe 0x401312
and dword [ebp - 4], 0
push 0x474e90
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x4e
call fcn.00436c6f
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
push dword [eax + 0x10]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
or dword [ebp - 4], 0xffffffff
mov eax, 0x40130f
ret
inc dword [ebp - 0x18]
add edi, 0x28
jmp 0x401253
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4019fd
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push edi
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x30], 0x1c
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x401a3e
push str.SetupDiEnumDeviceInfo_FAILED
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x401b0f
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.SETUPAPI.dll_SetupDiSetClassInstallParamsA]
push 0x12
pop edi
push 0x14
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x401a7e
push str.SetupDiSetClassInstallParams_FAILED
jmp 0x401ae2
and dword [ebp - 4], 0
push 0x14
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], 2
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
je 0x401aff
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0x10]
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiCallClassInstaller]
test eax, eax
je 0x401aff
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x158], 0x128
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstallParamsA]
test eax, eax
jne 0x401aec
push str.SetupDiGetDeviceInstallParams_FAILED
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x401b0d
test dword [ebp - 0x154], 0x180
je 0x401b0a
push str.Need_Restart_Computer
jmp 0x401b04
push str.SetupDiSetClassInstallParams_or_SetupDiCallClassInstaller_FAILED
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
leave
ret

Function at 0x401bd4
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x46265c
call fcn.00436c50
sub esp, 0x30
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0x2b
push 0x474e90
lea eax, [ebp - 0x18]
push eax
call fcn.00436c6f
mov dword [ebp - 0x10], esp
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x3c], 0x1c
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x401c3d
push str.SetupDiEnumDeviceInfo_FAILED
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 0x401c39
ret
push 0
push dword [ebp - 0x28]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
test eax, eax
je 0x401c80
mov byte [ebp - 4], 2
mov dword [ebp - 0x1c], 0xe
push 0x474e90
lea eax, [ebp - 0x1c]
jmp 0x401bfa
test dword [ebp - 0x14], 0x400
je 0x401c98
cmp dword [ebp - 0x20], 0x16
jne 0x401c98
mov dword [ebp - 0x14], 1
jmp 0x401c9c
and dword [ebp - 0x14], 0
mov eax, 0x401ca2
ret
Function at 0x41511c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x415163
call fcn.004081f2
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x415163
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41517f
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00414c96
mov esi, eax
test edi, edi
je 0x41517d
test ebx, ebx
je 0x41517d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x415dac
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x463956
call fcn.00437610
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x415dd1
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x415e17
lea ecx, [ebp - 0x10]
call fcn.0040336f
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406116
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402977
mov eax, esi
call fcn.004376e8
ret 8

Function at 0x41c42a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x464126
call fcn.00437610
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00403986
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x41c48c
call fcn.00407601
cmp eax, 1
jne 0x41c48c
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.00405440
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00405399
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402977
mov dword [ebp + 8], SysStringLen
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402977
mov eax, esi
call fcn.004376e8
ret 0x10
Function at 0x41c4b5
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x464151
call fcn.00437610
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00403986
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x41c517
call fcn.00407601
cmp eax, 1
jne 0x41c517
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.00405440
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00405399
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402977
mov dword [ebp + 8], SysStringLen
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402977
mov eax, esi
call fcn.004376e8
ret 0x14

Function at 0x41c543
Capabilities:
Delete registry key

Disassembly:
push 0
mov eax, 0x46417c
call fcn.00437610
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00403986
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x41c5a5
call fcn.00407601
cmp eax, 1
jne 0x41c5a5
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.00405440
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00405399
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402977
mov dword [ebp + 8], SysStringLen
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402977
mov eax, esi
call fcn.004376e8
ret 8

Function at 0x425495
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4254b9
cmp dword [edi + 0x54], 0
jne 0x4254b9
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.004081f2
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00425456
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x437601
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a4e40]
jne 0x43760b
repz ret
jmp fcn.004419ca
Function at 0x4525f6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0043eefb
and dword [ebp - 4], 0
cmp dword [0x4a8a68], 0
mov ebx, eax
jne 0x4526a7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x452758
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x46e9dc
push edi
call esi
test eax, eax
je 0x452758
push eax
call fcn.0043ee89
mov dword [esp], 0x46e9cc
push edi
mov dword [0x4a8a68], eax
call esi
push eax
call fcn.0043ee89
mov dword [esp], 0x46e9b8
push edi
mov dword [0x4a8a6c], eax
call esi
push eax
call fcn.0043ee89
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4a8a70], eax
call esi
push eax
call fcn.0043ee89
pop ecx
mov dword [0x4a8a78], eax
test eax, eax
je 0x4526a7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043ee89
pop ecx
mov dword [0x4a8a74], eax
mov eax, dword [0x4a8a74]
cmp eax, ebx
je 0x4526ff
cmp dword [0x4a8a78], ebx
je 0x4526ff
push eax
call fcn.0043ef04
push dword [0x4a8a78]
mov esi, eax
call fcn.0043ef04
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4526ff
test edi, edi
je 0x4526ff
call esi
test eax, eax
je 0x4526f6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4526f6
test byte [ebp - 0xc], 1
jne 0x4526ff
or dword [ebp + 0x10], 0x200000
jmp 0x452738
mov eax, dword [0x4a8a6c]
cmp eax, ebx
je 0x452738
push eax
call fcn.0043ef04
pop ecx
test eax, eax
je 0x452738
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x452738
mov eax, dword [0x4a8a70]
cmp eax, ebx
je 0x452738
push eax
call fcn.0043ef04
pop ecx
test eax, eax
je 0x452738
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a8a68]
call fcn.0043ef04
pop ecx
test eax, eax
je 0x452758
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45275a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407a70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
mov eax, dword [0x4b7108]
xor eax, esp
mov dword [esp + 0x420], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x60
push 0
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 0
call ebx
mov edi, eax
test edi, edi
jne 0x407add
push 2
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x407add
call fcn.00406000
mov esi, eax
jmp 0x407b83
push dword [esp + 0x10]
push dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x407af9
call fcn.00406000
jmp 0x407b76
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x407b0e
call fcn.00406000
jmp 0x407b76
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x407b26
mov esi, 0x8007000e
jmp 0x407b78
push eax
lea ecx, [esp + 0x24]
call fcn.00405fb0
cmp dword [esp + 0x20], 0
jne 0x407b3e
mov esi, 0x8007000e
jmp 0x407b78
push esi
push dword [esp + 0x24]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x407b5c
call fcn.00406000
jmp 0x407b76
mov eax, dword [esp + 0x20]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [esp + 0x1c]
push dword [esp + 0x24]
call fcn.00407910
mov esi, eax
test edi, edi
je 0x407b83
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x24]
cmp dword [esp + 0x20], eax
je 0x407b96
lea ecx, [esp + 0x20]
call fcn.00405f70
mov ecx, dword [esp + 0x42c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044ee41
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4083c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4b7108]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
cmp esi, edi
je 0x4083ef
mov ecx, esi
call fcn.004082d0
add esi, 0x24
cmp esi, edi
jne 0x4083e1
mov eax, dword [ebx]
mov dword [ebx + 4], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call edi
mov esi, eax
test esi, esi
je 0x4084f8
nop
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4084e9
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4084e9
call fcn.00404a80
test eax, eax
je 0x408513
mov edx, dword [eax]
cmp edx, vtable.ATL::CAtlStringMgr.0
jne 0x408509
lock inc dword [eax + 0x14]
add eax, 8
add eax, 0x10
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
push esi
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x230], esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4084a0
sub eax, edx
lea ecx, [ebp - 0x22c]
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00408990
lea eax, [ebp - 0x228]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.004085a0
lea ecx, [ebp - 0x230]
call fcn.004082d0
push 2
push esi
call edi
mov esi, eax
test esi, esi
jne 0x408410
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044ee41
mov esp, ebp
pop ebp
ret
mov ecx, eax
call dword [edx + 0xc]
jmp 0x408450
push 0x80004005
call fcn.00408150
int3