joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49969c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov esi, edx
mov dword [esp], eax
mov eax, dword [esp]
call fcn.00404668
mov edx, eax
mov eax, ebp
call fcn.004049f4
mov eax, dword [esp]
call fcn.00404668
mov edi, eax
test edi, edi
jle 0x499700
mov ebx, 1
mov eax, ebp
call fcn.004048c0
mov edx, dword [esp]
mov dl, byte [edx + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [ebp]
movzx eax, byte [eax + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec edi
jne 0x4996cc
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x499708
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, edi
call fcn.00404668
mov edx, eax
mov eax, dword [esp]
call fcn.004049f4
mov eax, edi
call fcn.00404668
mov ebp, eax
test ebp, ebp
jle 0x499767
mov ebx, 1
mov eax, dword [esp]
call fcn.004048c0
mov dl, byte [edi + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
xor eax, eax
mov al, byte [edi + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec ebp
jne 0x499737
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4a02ac
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4b1368
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4a02ce
shr eax, 1
xor eax, 0xedb88320
jmp 0x4a02d0
shr eax, 1
dec edx
jne 0x4a02bc
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4a02b5
mov byte [0x4b1768], 1
pop esi
pop ebx
ret

Function at 0x4a02ec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4b1768], 0
jne 0x4a0303
call fcn.004a02ac
mov eax, edi
dec eax
test eax, eax
jl 0x4a032c
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4b1368]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4a030d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4a284c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4a287d
dec al
je 0x4a28b9
dec al
je 0x4a28fd
dec al
je 0x4a2968
jmp 0x4a29f2
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4a29f2
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a288d
jmp 0x4a29f2
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a29f2
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a28c9
jmp 0x4a29f2
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a29f2
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4a292b
xor ebp, ebp
jmp 0x4a293c
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4a2945
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a290d
jmp 0x4a29f2
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a29f2
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4a29c0
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004a0334
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a297c
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a65d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a66c2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4b19d7], 0
je 0x4a668a
lea eax, [ebp - 0x14]
mov edx, 0x4b19d7
call fcn.0040460c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004a6410
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x4b4cb4]
mov eax, dword [eax + 0x2f8]
call fcn.00486974
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00492af8
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
pop ecx
call fcn.00404d58
lea eax, [ebp - 8]
call fcn.00404a88
mov eax, dword [ebp - 4]
call fcn.00404cec
cmp eax, 4
jle 0x4a668a
push 5
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0048063c
mov eax, dword [ebp - 0x20]
call fcn.00404cdc
push eax
mov eax, dword [ebp - 8]
call fcn.00404cdc
push eax
mov eax, dword [ebp - 4]
call fcn.00404cdc
push eax
push 0x4a66d0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a66c9
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404aa0
lea eax, [ebp - 0x14]
call fcn.00404398
lea eax, [ebp - 0x10]
call fcn.00404a88
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404aa0
ret

Function at 0x4a66dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a67c3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x4b4cc4], 1
jne 0x4a678d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x330]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4a6727
xor eax, eax
call fcn.004a65d0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4a6783
push 1
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.00486974
mov eax, dword [ebp - 0xc]
call fcn.00404cdc
push eax
push 0x4a67d0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.00486974
mov eax, dword [ebp - 0x10]
call fcn.00404cdc
push eax
push 0x4a67d4
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [ebp - 4]
call fcn.00475894
jmp 0x4a67a8
mov byte [0x4b4cc5], 0
mov eax, dword [ebp - 4]
call fcn.00475894
mov eax, dword [0x4ae538]
mov eax, dword [eax]
call fcn.00478e28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a67ca
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404aa0
ret
Function at 0x4a7ee4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.00402750
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a7f55
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004045a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7f5c
mov eax, dword [ebp - 0xc]
call fcn.00402770
ret
Function at 0x401160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401179
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40118d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4011ae
cmp esi, eax
jae 0x401187
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4011a0
cmp esi, eax
jae 0x401187
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x406510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x458888
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.004018e0
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00401370
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4065a2
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x414fa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x459790
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0
call fcn.0043794e
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x10]
push ecx
push ecx
add esi, 0xfffffff0
mov dword [esp + 0x40], esp
mov ebp, esp
push esi
mov byte [esp + 0x38], 1
call fcn.00401370
add eax, 0x10
add esp, 4
mov ecx, edi
mov dword [ebp], eax
call fcn.00414a90
lea ecx, [esp + 0xc]
mov edi, eax
mov byte [esp + 0x28], 0
call fcn.004379a0
mov dword [esp + 0x28], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x415030
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0x20]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x20
ret 8

Function at 0x415cd0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
sub esp, 8
push ebx
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x415d2f
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 8]
push edx
push 3
push eax
mov eax, dword [esp + 0x28]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x415d24
mov bl, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 8
ret

Function at 0x415d40
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
sub esp, 8
push ebx
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x415d9c
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 4
push ecx
push 4
push eax
mov eax, dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x415d91
mov bl, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 8
ret
Function at 0x4164c0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x18]
push ebx
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
xor bl, bl
push eax
mov byte [esp + 0x2b], bl
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41655b
push esi
mov esi, dword [esp + 0x28]
push esi
lea ecx, [esp + 0x14]
call fcn.00416310
mov ecx, dword [eax]
mov eax, dword [ecx - 0xc]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x10]
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
mov eax, dword [esp + 0x10]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop esi
jg 0x416546
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
mov bl, 1
jne 0x416550
mov bl, byte [esp + 7]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 0x10
ret
Function at 0x416570
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45992b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x640
mov eax, dword [0x4bfbe4]
push ebx
push esi
push edi
mov dword [esp + 0x644], eax
mov edi, ecx
call fcn.0043d49d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
fld qword [0x45db40]
sub esp, 8
fstp qword [esp]
lea eax, [esp + 0x18]
push str._2.2f
push eax
mov dword [esp + 0x664], 0
call fcn.004064f0
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx - 4]
mov esi, dword [ebx - 0xc]
mov ecx, 1
sub ecx, eax
mov eax, dword [ebx - 8]
sub eax, esi
add esp, 0x10
or eax, ecx
jge 0x416606
push esi
lea ecx, [esp + 0x14]
call fcn.00401650
mov ebx, dword [esp + 0x10]
push esi
lea ecx, [esp + 0x28]
push ebx
push ecx
call fcn.00428da0
mov eax, dword [ebx - 0xc]
mov byte [esp + eax + 0x30], 0
mov eax, ebx
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416622
sub eax, edx
js 0x41675a
cmp eax, dword [ebx - 8]
jg 0x41675a
mov dword [ebx - 0xc], eax
mov byte [eax + ebx], 0
mov dl, byte [edi + 0x3b9]
lea esi, [edi + 0x3ba]
mov byte [esp + 0x38], dl
mov ecx, 0x180
lea edi, [esp + 0x39]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareWanMP3Settings_
push SysReAllocString
call esi
test eax, eax
je 0x4166cf
lea eax, [ebx - 0x10]
mov dword [esp + 0x654], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4166ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x64c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x644]
call fcn.0042825d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareWanMP3Settings_
push SysReAllocString
call esi
test eax, eax
jne 0x41671e
push 0x601
lea edx, [esp + 0x3c]
push edx
push 3
push eax
mov eax, dword [esp + 0x24]
push str.Module
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x24]
push edx
push 0x45ebe8
push str.SoftwareWanMP3Settings_
push SysReAllocString
call fcn.004164c0
lea eax, [ebx - 0x10]
add esp, 0x10
mov dword [esp + 0x654], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x4166a4
push 0x80070057
call fcn.00401140
int3
Function at 0x416900
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x134
mov eax, dword [0x4bfbe4]
mov dx, word [0x45ea48]
push ebx
push ebp
push esi
mov dword [esp + 0x13c], eax
mov eax, dword [str.00Username]
mov dword [esp + 0x28], eax
mov al, byte [0x45ea4a]
mov word [esp + 0x30], dx
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x36], al
lea eax, [esp + 0x24]
push eax
push 0
push 0xf003f
mov ebp, ecx
mov ecx, dword [0x45ea44]
push 0
mov dword [esp + 0x40], ecx
push 0
xor ecx, ecx
push 0
mov dword [esp + 0x4f], ecx
push str.SoftwareWanMP3Settings_
mov dword [esp + 0x57], ecx
mov esi, 2
xor bl, bl
push SysReAllocString
mov dword [esp + 0x3c], 3
mov dword [esp + 0x40], esi
mov byte [esp + 0x5f], cl
mov byte [esp + 0x38], bl
mov byte [esp + 0x30], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x416b20
cmp dword [esp + 0x24], esi
jne 0x416ab6
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x24]
push eax
push 0
push str.Current
push ecx
call edi
test eax, eax
jne 0x416ab5
mov al, byte [esp + 0x41]
cmp al, 0x64
ja 0x416ab5
test al, al
jbe 0x416ab5
test al, al
mov cl, al
mov byte [esp + 0x10], cl
jbe 0x416a8c
movzx eax, bl
cdq
mov ecx, 0xa
idiv ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], pe_nt_image_headers32
add dl, 0x30
add al, 0x30
mov byte [esp + 0x2d], dl
mov byte [esp + 0x2c], al
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x44]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push 0
lea edx, [esp + 0x3c]
push edx
push eax
call edi
test eax, eax
jne 0x416a70
lea esi, [ebp + 0x9bb]
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x416a67
test cl, cl
je 0x416a63
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x416a67
add eax, 2
add esi, 2
test cl, cl
jne 0x416a43
xor eax, eax
jmp 0x416a6c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x416a80
mov al, byte [esp + 0x10]
inc bl
cmp bl, al
jb 0x4169f0
jmp 0x416a88
add bl, 0x80
cmp bl, 0x80
jae 0x416aae
mov cl, byte [esp + 0x10]
cmp cl, 0x64
jae 0x416a9d
inc cl
mov byte [esp + 0x10], cl
dec cl
mov bl, cl
jmp 0x416ab1
call fcn.00428b13
cdq
mov ecx, 0x64
idiv ecx
mov bl, dl
jmp 0x416ab1
add bl, 0x80
mov byte [esp + 0x18], bl
pop edi
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp + 0x1b6]
mov cl, byte [ebp + 0x9ba]
mov dl, byte [ebp + 0x1b7]
mov byte [ebp + 0x1b4], bl
or al, byte [ebp + 0x1b5]
mov byte [esp + 0x11], cl
mov byte [esp + 0x10], al
mov al, byte [ebp + 0x1b8]
mov byte [esp + 0x12], dl
lea ecx, [esp + 0x10]
push ecx
mov byte [esp + 0x17], al
lea edx, [ebp + 0x1b9]
push edx
mov edx, dword [esp + 0x14]
lea eax, [ebp + 0x9e3]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [ebp + 0x9bb]
push ecx
push edx
push eax
mov ecx, ebp
call fcn.00416770
mov ecx, dword [esp + 0x13c]
pop esi
pop ebp
pop ebx
call fcn.0042825d
add esp, 0x134
ret
Function at 0x41f407
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x41f45a
call fcn.00454014
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x41f45a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x41f450
xor eax, eax
jmp 0x41f573
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x41f48a
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x41f48a
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x41f570
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x41f4b7
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.0041e1a8
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x41f570
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x41f500
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x41f500
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x41f4fa
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.0041e1a8
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x41f560
and dword [ebp + 0xc], 0
jmp 0x41f560
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x41f560
push 0xc
call fcn.0043d390
mov esi, eax
test esi, esi
pop ecx
je 0x41f542
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x41f544
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x41f55b
push dword [ebp - 8]
call fcn.00437eca
jmp 0x41f560
call fcn.00437ea1
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x41f4c5
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc