joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407170
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x407228
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, 0x407240
call fcn.00406ea8
cmp dword [ebx], 0
je 0x4071a6
mov eax, dword [ebx]
call fcn.00406e84
test al, al
jne 0x4071ee
mov edx, ebx
mov eax, 0x40724c
call fcn.00406ea8
cmp dword [ebx], 0
je 0x4071c2
mov eax, dword [ebx]
call fcn.00406e84
test al, al
jne 0x4071ee
cmp dword [0x40c07c], 2
jne 0x4071e7
mov edx, ebx
mov eax, 0x40725c
call fcn.00406ea8
cmp dword [ebx], 0
je 0x4071e7
mov eax, dword [ebx]
call fcn.00406e84
test al, al
jne 0x4071ee
mov eax, ebx
call fcn.00407118
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.00406cd8
jmp 0x418717

Function at 0x40728c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4073c4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx

Function at 0x4072a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4073c4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx

Function at 0x4073e4
Capabilities:
Check for trap flag exception

Disassembly:
push ebp
mov ebp, esp
push esi
jmp loc.00418737

Function at 0x407d0c
Capabilities:
Hash data with crc32
Packed with generic packer

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40d560
mov eax, esi
jmp loc.004177ba

Function at 0x4081f8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov dword [esp], ebx
mov byte [esp + 4], 0
push esp
push 0
mov ecx, 0x40822c
mov dl, 1
jmp loc.00418212

Function at 0x408334
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x60]
test eax, eax
je fcn.00408355
push 0x8000
push 0
push eax
call sub.kernel32.dll_VirtualFree_1
jmp loc.00418058

Function at 0x40856c
Capabilities:
Packed with generic packer

Disassembly:
shl ecx, 8
mov dl, al
or edx, ecx
inc esi
cmp esi, 5
mov dword [ebx + 0xc], edx
jl 0x40855e
pop esi
pop ebx
ret

Function at 0x408604
Capabilities:
Packed with generic packer

Disassembly:
movzx edx, word [eax]
sub ecx, edx
sar ecx, 5
add word [eax], cx
cmp dword [ebx + 8], 0x1000000
jae 0x40862b
mov eax, ebx
jmp loc.004155a0
xor eax, eax
pop ebx
ret

Function at 0x4086f0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
jmp loc.0041869b

Function at 0x40871c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], cl
mov edi, edx
mov esi, eax
jmp loc.00415241
Function at 0x408f24
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], ecx
mov ebx, eax
cmp edx, 0x50
je 0x408f3a
mov eax, 1
jmp 0x408f6c
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408808
test eax, eax
jne 0x408f6c
mov ecx, dword [ebx]
mov edx, 0x300
add ecx, dword [ebx + 4]
shl edx, cl
mov ecx, dword [ebp + 0xc]
add edx, 0x736
add edx, edx
mov dword [ecx], edx
mov edx, dword [ebp + 8]
jmp 0x41613d
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x4093b4
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4093e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x40c208
jmp loc.00418c5a

Function at 0x409428
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [eax], 0
je fcn.00409437
mov eax, dword [eax + 4]
push eax
jmp loc.004185db

Function at 0x409438
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004093ec
test al, al
jne 0x409459
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4094a5
xor eax, eax
push ebp
push 0x409495
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40949c
lea eax, [ebp - 0xc]
call fcn.00409428
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4094b0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004093ec
test al, al
jne 0x4094d0
mov byte [ebp - 1], 0
jmp 0x409516
xor eax, eax
push ebp
push 0x409506
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406e98
mov byte [ebp - 1], al
call sub.kernel32.dll_GetLastError_1
jmp loc.00418ac8
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409520
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4095de
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4095ec
push 0x40960c
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x40dcd4], eax
push 0x40961c
push 0x40960c
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x40dcd8], eax
cmp dword [0x40dcd4], 0
je 0x40957e
cmp dword [0x40dcd8], 0
jne 0x409582
xor eax, eax
jmp 0x409584
mov al, 1
jmp 0x415ec7

Function at 0x4097d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4098bf
jmp loc.00416c78
Function at 0x4098e8
Capabilities:
Packed with generic packer
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x40c07c], 2
jne 0x40994f
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40990a
xor eax, eax
jmp 0x40995e
lea eax, [esp + 8]
push eax
push 0x409964
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
jmp 0x4178dd
push 0
push 2
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret

Function at 0x409978
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4099d2
inc esi
xor edi, edi
cmp edi, 1
jne 0x40999e
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4099ac
cmp edi, 1
jle 0x4099ac
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00409438
test eax, eax
jne 0x4099d2
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x4099d2
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x4099d2
inc edi
dec esi
jne 0x40998e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4099dc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x409a29
xor ebx, ebx
jmp 0x409a1e
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00405090
test eax, eax
jne 0x409a1d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x409ad9
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4099ff
mov al, byte [ebp - 1]
sub al, 1
jb 0x409a34
je 0x409a3d
jmp 0x409a46
call fcn.004074a0
mov edi, eax
jmp 0x409a48
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x409a48
xor edi, edi
test di, di
jmp 0x417a26
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x409b9c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x409bfb
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00405afc
mov edx, 0x404b00
call fcn.0040296c
test al, al
jne 0x409be5
push 0x10
mov eax, dword [0x40da8c]
push eax
lea eax, [ebp - 4]
call fcn.00407688
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409c02
lea eax, [ebp - 4]
jmp loc.00417be2

Function at 0x409ddc
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push esp
mov eax, 0x409db8
mov ecx, dword [0x40dce0]
mov dl, byte [0x40de0d]
call fcn.004099dc
mov eax, dword [esp]
jmp loc.004155d0
Function at 0x409e8c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409f5f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409f78
push ebx
push 0x409f84
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409f0c
mov al, 0x6a
call fcn.00409ae8
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp loc.0041833c

Function at 0x40a018
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
jmp loc.004162c0

Function at 0x40a0d4
Capabilities:
Extract resource via kernel32 functions
Packed with generic packer

Disassembly:
push ebx
push 0xa
push 0x2b67
push 0
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
jne fcn.0040a0ee
jmp loc.00418fe9

Function at 0x415b60
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
salc
add dh, dl
salc
pop edi
push ebx
dec edi
pop edi
dec edi
dec ecx
and al, 0
add al, 0
popal
popfd
mov esi, dword [esp + 8]
add esi, dword [esp + 0xc]
jmp loc.00408406

Function at 0x417b67
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
mov edi, edi
push ecx
mov eax, dword [0x410b43]
push ebx
push edi
push 0
mov ecx, eax
test eax, eax
add esp, 0x10
leave
popal
popfd
call fcn.00403154
jmp loc.00402f29

Function at 0x417c98
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push loc.0040a731
jmp loc.00417d5d
pushfd
pushal
push ebp
mov ebp, esp
dec eax
xor al, 0
pop edi
push ebx
dec edi
pop edi
dec edi
aas
popal
popfd
je 0x40a735
jmp loc.0040a731
Function at 0x4023b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40240b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40240b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4023f8
cmp esi, edx
jae 0x40240b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4023e6
cmp esi, edx
jae 0x40240b
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x402f20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461c58
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x47b040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x20], 0
push 0x404
lea eax, [ebp - 0x424]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0
call fcn.0043a680
add esp, 0xc
mov dword [ebp - 0x424], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x430], esi
test esi, esi
jne 0x402fd9
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x430], eax
test esi, esi
jne 0x402fd9
call fcn.004024a0
mov edi, eax
jmp 0x4030f3
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x402ffc
call fcn.004024a0
jmp 0x4030e6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x42c], ebx
test ebx, ebx
jne 0x40301a
call fcn.004024a0
jmp 0x4030e6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x428], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x40303b
mov edi, 0x8007000e
jmp 0x4030e8
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
jne 0x40312c
cmp eax, 0xffffffff
ja 0x40312c
cmp eax, 0x400
jbe 0x40306c
push eax
lea ecx, [ebp - 0x424]
call fcn.00406710
jmp 0x403092
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], eax
jmp 0x403092
mov dword [ebp - 4], 1
cmp dword [ebp - 0x424], 0
jne 0x4030a9
mov edi, 0x8007000e
jmp 0x4030e8
push edi
push dword [ebp - 0x424]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x4030c9
call fcn.004024a0
jmp 0x4030e6
mov eax, dword [ebp - 0x424]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x424]
call fcn.00403d10
mov edi, eax
test esi, esi
je 0x4030f3
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x40310c
lea ecx, [ebp - 0x424]
call fcn.00406450
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00438436
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.004022c0
int3
Function at 0x4091d0
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4625ad
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x47b040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
call esi
test eax, eax
je 0x4092aa
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call ebx
test eax, eax
jne 0x4092aa
push edi
call esi
test eax, eax
je 0x4092aa
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40923c
push edi
call ebx
test eax, eax
jne 0x4092aa
call fcn.00405000
mov ecx, eax
test ecx, ecx
je 0x4092c1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push edi
lea eax, [ebp - 0x10]
push 0x47095c
push eax
call fcn.00406780
mov esi, dword [ebp - 0x10]
add esp, 0x10
push esi
call ebx
push 1
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
call edi
push 4
push 0
push esi
call edi
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4092aa
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004022c0
int3
Function at 0x412390
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x47b040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x424]
mov ecx, dword [ebp + 8]
push edx
push 0xf003f
push 0
push eax
push ecx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41253a
push ebx
push esi
push edi
push eax
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
push 0
push 0
push 0
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x412471
push 0x20a
xor esi, esi
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.0043a680
add esp, 0xc
cmp dword [ebp - 0x420], esi
jbe 0x412471
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
nop word [eax + eax]
push 0x105
lea eax, [ebp - 0x41c]
push eax
push esi
push dword [ebp - 0x424]
call ebx
test eax, eax
jne 0x412468
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x424]
call edi
inc esi
cmp esi, dword [ebp - 0x420]
jb 0x412440
push dword [ebp - 0x424]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push 0x20a
lea eax, [ebp - 0x210]
mov dword [ebp - 0x424], 0
push 0
push eax
call fcn.0043a680
push dword [ebp - 0x428]
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00442d30
lea eax, [ebp - 0x210]
push 0x5c
push eax
call fcn.0043ab7b
mov esi, eax
add esp, 0x20
test esi, esi
jne 0x4124e1
lea eax, [ebp - 0x210]
push 0x2f
push eax
call fcn.0043ab7b
mov esi, eax
add esp, 8
test esi, esi
je 0x412537
mov eax, esi
lea ecx, [ebp - 0x210]
sub eax, ecx
and eax, 0xfffffffe
cmp eax, 0x20a
jae 0x41254a
xor ecx, ecx
mov word [ebp + eax - 0x210], cx
lea eax, [ebp - 0x424]
push eax
push 0xf003f
push ecx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41252f
lea eax, [esi + 2]
push eax
push dword [ebp - 0x424]
call edi
push dword [ebp - 0x424]
call ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438436
mov esp, ebp
pop ebp
ret 8
call fcn.0043862f
int3
Function at 0x413650
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463250
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x47b040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x10], 0
jne 0x4136db
push 0x10
lea eax, [ebp - 0x234]
push eax
call fcn.00413860
push eax
mov ecx, edi
call fcn.00408b70
mov ecx, dword [ebp - 0x220]
cmp ecx, 7
jbe 0x4136db
mov edx, dword [ebp - 0x234]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4136d1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41383c
push ecx
push edx
call fcn.00438aa2
add esp, 8
cmp dword [edi + 0x28], 0
jne 0x413738
push 2
lea eax, [ebp - 0x234]
push eax
call fcn.00413860
push eax
lea ecx, [edi + 0x18]
call fcn.00408b70
mov ecx, dword [ebp - 0x220]
cmp ecx, 7
jbe 0x413738
mov edx, dword [ebp - 0x234]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41372e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413841
push ecx
push edx
call fcn.00438aa2
add esp, 8
cmp dword [edi + 0x40], 0
jne 0x41380e
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0043a680
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00405000
mov ecx, eax
test ecx, ecx
je 0x413846
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
push 0x470e88
push str.k_LaunchUser_P
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push str.MicrosoftInternet_ExplorerQuic_sinnedTas_s
push eax
call fcn.00406780
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
add esp, 0x10
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4137d0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [edi + 0x30]
call fcn.00408a60
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41380e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [edi + 0x28], 0
mov eax, 0x80004005
je 0x413821
xor ecx, ecx
cmp dword [edi + 0x10], ecx
cmovne eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00438436
mov esp, ebp
pop ebp
ret
call fcn.00442b30
call fcn.00442b30
push 0x80004005
call fcn.004022c0
int3
Function at 0x413860
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x47b040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], esi
push eax
mov dword [ebp - 0x214], 0
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x413924
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0
push eax
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x41390e
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0043a680
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4138f2
lea eax, [ebp - 0x210]
push eax
jmp 0x413929
mov eax, dword [ebp - 0x214]
push dword [ebp - 0x218]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x214]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [ebp - 0x214], 0
push 0x46f490
mov ecx, esi
call fcn.00407e10
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00438436
mov esp, ebp
pop ebp
ret 8

Function at 0x413ab0
Capabilities:
Check os version
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x47b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
movups xmmword [ebp - 0x20], xmm0
xor esi, esi
mov dword [ebp - 8], 0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x118
lea eax, [ebp - 0x138]
push esi
push eax
call fcn.0043a680
add esp, 0xc
mov dword [ebp - 0x13c], 0x11c
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x138], 6
jae 0x413b7b
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push ebx
call edi
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x413b7b
mov ecx, 0x2710
cmp dword [ebp + 0x10], eax
jne 0x413b93
cmp esi, 5
ja 0x413b93
mov eax, 0xaaaaaaab
mul dword [ebp - 8]
shr edx, 1
cmp edx, 0x3e8
jae 0x413b56
mov edx, 0x3e8
jmp 0x413b5f
cmp edx, 0x2710
cmova edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
inc esi
push eax
push ebx
call edi
mov eax, dword [ebp - 0x1c]
mov ecx, 0x2710
cmp eax, 1
jne 0x413b33
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438436
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00438436
mov esp, ebp
pop ebp
ret 0x10