joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61614c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00617420
test byte [ebp + 0xd], 0xc0
jne 0x616170
mov eax, dword [0x6bb418]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x61617d
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x6161aa
je 0x6161bc
sub ecx, 0x100
je 0x6161ca
sub ecx, 0x100
je 0x6161d1
sub ecx, 0x100
je 0x6161c3
jmp 0x6161d8
sub ecx, 0x600
je 0x6161d1
sub ecx, 0x100
je 0x6161bc
jmp 0x6161d8
mov edi, 1
jmp 0x6161dd
mov edi, 2
jmp 0x6161dd
mov edi, 4
jmp 0x6161dd
mov edi, 5
jmp 0x6161dd
mov edi, 3
test byte [ebp + 0xd], 1
je 0x616204
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x6bae90]
test al, 0x80
je 0x6161fd
mov ebx, 0x80
jmp 0x616216
mov ebx, 1
jmp 0x616216
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x616216
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x616228
je 0x616231
dec eax
je 0x61623a
jmp 0x616243
mov dword [ebp - 4], 0x80000000
jmp 0x616252
mov dword [ebp - 4], 0x40000000
jmp 0x616252
mov dword [ebp - 4], 0xc0000000
jmp 0x616252
push 1
call fcn.00617818
pop ecx
mov ebx, eax
jmp 0x61633e
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x61626e
sub eax, 0x10
je 0x616275
sub eax, 0x10
je 0x61627e
sub eax, 0x10
je 0x616287
jmp 0x616287
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x61628e
mov dword [ebp - 8], 1
jmp 0x61628e
mov dword [ebp - 8], 2
jmp 0x61628e
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x6162f7
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x6162ec
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x6162ec
add ebx, 0xffffffb2
push ebx
call fcn.00617818
pop ecx
mov ebx, eax
jmp 0x61633e
mov edi, esi
push edi
call fcn.006160b0
pop ecx
test eax, eax
je 0x61630b
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x616317
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00617540
add esp, 8
mov ebx, eax
inc eax
jne 0x61633e
push 4
call fcn.00617818
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.00617454
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x616500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00617420
test byte [ebp + 0xd], 0xc0
jne 0x616524
mov eax, dword [0x6bb418]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x616531
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x61655e
je 0x616570
sub ecx, 0x100
je 0x61657e
sub ecx, 0x100
je 0x616585
sub ecx, 0x100
je 0x616577
jmp 0x61658c
sub ecx, 0x600
je 0x616585
sub ecx, 0x100
je 0x616570
jmp 0x61658c
mov edi, 1
jmp 0x616591
mov edi, 2
jmp 0x616591
mov edi, 4
jmp 0x616591
mov edi, 5
jmp 0x616591
mov edi, 3
test byte [ebp + 0xd], 1
je 0x6165b8
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x6bae90]
test al, 0x80
je 0x6165b1
mov ebx, 0x80
jmp 0x6165ca
mov ebx, 1
jmp 0x6165ca
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
cmp eax, 0xffffffff
jne 0x6165ca
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x6165dc
je 0x6165e5
dec eax
je 0x6165ee
jmp 0x6165f7
mov dword [ebp - 4], 0x80000000
jmp 0x616606
mov dword [ebp - 4], 0x40000000
jmp 0x616606
mov dword [ebp - 4], 0xc0000000
jmp 0x616606
push 1
call fcn.00617818
pop ecx
mov ebx, eax
jmp 0x6166f2
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x616622
sub eax, 0x10
je 0x616629
sub eax, 0x10
je 0x616632
sub eax, 0x10
je 0x61663b
jmp 0x61663b
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x616642
mov dword [ebp - 8], 1
jmp 0x616642
mov dword [ebp - 8], 2
jmp 0x616642
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
cmp eax, 0xffffffff
jne 0x6166ab
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x6166a0
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x6166a0
add ebx, 0xffffffb2
push ebx
call fcn.00617818
pop ecx
mov ebx, eax
jmp 0x6166f2
mov edi, esi
push edi
call fcn.006160b0
pop ecx
test eax, eax
je 0x6166bf
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x6166cb
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00617540
add esp, 8
mov ebx, eax
inc eax
jne 0x6166f2
push 4
call fcn.00617818
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.00617454
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x616848
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
cmp dword [ebp + 0xc], 1
mov esi, dword [ebp + 8]
jne 0x616873
lea eax, [ebp + 0x10]
add eax, 4
mov ebx, dword [eax - 4]
push ebx
push esi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
jne 0x616887
call fcn.00617884
jmp 0x616889
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x616887
call fcn.00617884
jmp 0x616889
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x61d890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x61d8f2
call fcn.0061d840
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.006148a0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.006148a0
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x61d970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x6bc4b4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x61da4a
cmp dword [0x6bc4b0], 0
jne 0x61da4a
cmp dword [0x6bc6c4], 0
je 0x61da04
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0061d6ec
add esp, 8
mov ebx, eax
test eax, eax
jne 0x61d9ea
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0061d6ec
add esp, 8
mov ebx, eax
test eax, eax
jne 0x61d9ea
lea ebx, [ebp - 0x84]
jmp 0x61d9eb
inc ebx
call fcn.0061d92c
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x61da85
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x6bc4b8
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.006148a0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x6bc4bb
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x61da85
cmp dword [0x6bc4b0], 0
je 0x61da64
cmp dword [0x6bc4b0], 0xffffffff
je 0x61da85
push esi
call dword [0x6bc4b0]
pop ecx
mov eax, dword [0x6bc4b4]
test eax, eax
je 0x61da85
cmp dword [0x6bc4b4], 0xffffffff
je 0x61da85
cmp byte [eax], 0
je 0x61da85
push esi
push eax
call fcn.0061d890
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x61f2ac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
jge 0x61f2d2
test esi, esi
je 0x61f2d2
call fcn.0061d8f8
mov dword [eax], 0x13
or eax, 0xffffffff
jmp 0x61f344
call fcn.0061efc4
mov ebx, eax
test eax, eax
jne 0x61f2ed
call fcn.0061d8f8
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x61f344
mov edx, dword [ebp + 0x10]
mov dword [ebx + 4], edx
lea edx, [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x54], eax
push edx
mov ecx, dword [ebp + 0x18]
push ecx
push ebx
push 0x61f208
push esi
mov eax, dword [ebp + 0x14]
push eax
call sub.KERNEL32.DLL_CreateThread
test eax, eax
jne 0x61f338
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x718
jne 0x61f331
push 0x59
call fcn.00617818
pop ecx
jmp 0x61f344
call fcn.00617884
jmp 0x61f344
mov dword [ebx + 8], eax
test edi, edi
je 0x61f344
mov edx, dword [ebp - 4]
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x401996
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
sete dl
cmp dword [ebp + 8], 0
sete al
mov ecx, 0
or dl, al
jne 0x401ada
lea ecx, [edi*4 + 0xb]
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea edx, [edx*4 + 1]
cmp edx, dword [ebp + 0x14]
jle 0x401a3d
mov dword [esp], 0x6f
call sub.KERNEL32.DLL_SetLastError
sub esp, 4
mov ecx, 0
jmp 0x401ada
movzx eax, byte [ecx]
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.3d25zlut]
mov byte [ebx + 1], al
mov byte [ebx + 2], 0x3d
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
movzx eax, byte [ecx + 1]
and eax, 0xf
movzx eax, byte [eax*4 + section.3d25zlut]
mov byte [ebx + 2], al
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
mov esi, 0
mov ecx, dword [ebp + 8]
cmp esi, edi
jge 0x401ad2
movzx eax, byte [ecx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.3d25zlut]
mov byte [ebx], al
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x4019fc
movzx edx, byte [ecx]
and edx, 3
shl edx, 4
movzx eax, byte [ecx + 1]
shr al, 4
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.3d25zlut]
mov byte [ebx + 1], al
mov eax, edi
sub eax, esi
cmp eax, 2
je 0x401a1f
movzx edx, byte [ecx + 1]
and edx, 0xf
shl edx, 2
movzx eax, byte [ecx + 2]
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.3d25zlut]
mov byte [ebx + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + section.3d25zlut]
mov byte [ebx + 3], al
add esi, 3
add ecx, 3
add ebx, 4
cmp esi, edi
jl 0x401a4d
mov byte [ebx], 0
mov ecx, 1
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401b7e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, 0
mov dword [esp], 0
call sub.msvcrt.dll_malloc
mov esi, eax
mov dword [esp + 4], 0x40e000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov edi, eax
mov eax, 0
test edi, edi
je 0x401c23
jmp 0x401bc1
mov eax, 0
jmp 0x401c23
test byte [edi + 0xc], 0x10
jne 0x401c00
inc ebx
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_realloc
mov esi, eax
test eax, eax
je 0x401bba
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 1
lea eax, [eax + ebx - 1]
mov dword [esp], eax
call sub.msvcrt.dll_fread
test byte [edi + 0xc], 0x10
je 0x401bc7
lea eax, [ebx - 1]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00401b44
mov ebx, eax
mov dword [esp], esi
call sub.msvcrt.dll_free
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x407e30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407f09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407e68
mov eax, dword [ebp - 4]
call fcn.00407220
jmp 0x407e70
mov eax, dword [ebp - 4]
call fcn.00407c1c
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407ebc
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407ea6
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.00407220
jmp 0x407eb8
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407c1c
inc ebx
dec esi
jne 0x407e80
push 1
push dword [ebp - 4]
push 0x407f20
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f84
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f10
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x274bc48
Capabilities:
Encode data using xor

Disassembly:
jmp 0x274bc52
pushal
call 0x274bc58
pop ebp
sub ebp, 0x10
sub ebp, 0x234bc48
jmp 0x274bc6e
mov eax, 0x234bc48
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f7
mov edx, 0x228a64c7
xor byte [eax], dl
inc eax
dec ecx
jne 0x274bc85
jmp 0x274bc98
dec esp
or cl, byte [esi + ecx*2 - 5]
mov edi, 0x3f0646c7
mov edi, 0x7f0ac4c7
int 0xc7
mov edi, 0xc7c7ef7d
invalid
Function at 0x26cf058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x26cf1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x26cf07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x26cf06a
add dl, dl
jne 0x26cf089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x26cf0dc
xor eax, eax
add dl, dl
jne 0x26cf096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x26cf17d
add dl, dl
jne 0x26cf0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x26cf0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x26cf0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x26cf0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x26cf0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x26cf075
mov eax, 1
add dl, dl
jne 0x26cf0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x26cf0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x26cf0e1
sub eax, ebx
mov ebx, 1
jne 0x26cf128
mov ecx, 1
add dl, dl
jne 0x26cf10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x26cf119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x26cf105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x26cf075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x26cf13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x26cf14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x26cf136
cmp eax, 0x7d00
jae 0x26cf16d
cmp eax, 0x500
jb 0x26cf168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x26cf075
cmp eax, 0x7f
ja 0x26cf170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x26cf075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x26cf19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x26cf075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x410c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push ebx
push ebp
sub esp, 0xc
mov ebx, ecx
add ebx, 8
je 0x410dc9
test ecx, ecx
je 0x410dc9
mov dword [ebx], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 4], eax
push 0x44b340
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x44b358]
mov dword [ebx + 8], eax
mov dword [0x44b358], ebx
push 0x44b340
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [0x44b30c]
call fcn.00423370
push 5
push 0x81
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x410d91
push 0xf0
push 0x81
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x410d24
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
jmp 0x410d26
xor ebp, ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x410dba
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x410dab
push ebp
push esi
call fcn.00410df0
add esp, 8
mov ebp, eax
push 0
push 0x411a10
push dword [esp + 0x28]
push ebp
push ebx
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
mov ebx, eax
test ebx, ebx
je 0x410d71
cmp ebx, 0xffffffff
je 0x410d71
xor edi, edi
jmp 0x410d79
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp ebp, esi
je 0x410d8b
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test edi, edi
jne 0x410da2
jmp 0x410d96
mov ebx, 0xffffffff
mov eax, ebx
add esp, 0xc
pop ebp
pop ebx
pop edi
pop esi
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x410d96
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ebx, 0xffffffff
jmp 0x410d8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ebx, 0xffffffff
jmp 0x410d8b
xor eax, eax
push eax
push eax
push 1
push 0xc0000005
call dword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x41a790
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push esi
push edi
push ebx
push ebp
sub esp, 0x11c
mov ebp, ecx
xor ebx, ebx
lea eax, [esp + 0x10c]
mov dword [esp + 0x110], ebx
mov dword [esp + 0x114], ebx
mov edi, dword [ebp + 4]
mov dword [esp + 0x10c], ebx
or edi, 0x2001f
push eax
push edi
push ebx
push dword [esp + 0x13c]
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x110]
test esi, esi
jne 0x41a80f
test eax, eax
je 0x41a7f2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
jmp 0x41a7f4
mov esi, ebx
mov eax, dword [esp + 0x10c]
and edi, 0x300
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], edi
test esi, esi
jne 0x41a932
mov dword [esp + 0x118], pe_nt_image_headers32
lea edx, [esp + 0x100]
lea edi, [esp]
lea esi, [esp + 0x118]
push edx
push ebx
push ebx
push ebx
push esi
push edi
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x41a892
mov dword [esp + 0x108], ebp
lea ebp, [esp + 0x100]
push edi
lea ecx, [esp + 0x114]
call fcn.0041a790
test eax, eax
jne 0x41a95e
mov dword [esp + 0x118], pe_nt_image_headers32
push ebp
push ebx
push ebx
push ebx
push esi
push edi
push ebx
push dword [esp + 0x12c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x41a853
mov ebp, dword [esp + 0x108]
mov eax, dword [esp + 0x110]
test eax, eax
je 0x41a8af
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x110], 0
movzx eax, byte [0x44b2fc]
test eax, eax
mov dword [esp + 0x114], 0
je 0x41a8cc
mov eax, dword [0x44b300]
jmp 0x41a8fa
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x41a8ee
push str.RegDeleteKeyExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44b300], eax
jmp 0x41a8f3
mov eax, dword [0x44b300]
mov byte [0x44b2fc], 1
test eax, eax
je 0x41a94c
push 0
push dword [ebp + 4]
push dword [esp + 0x138]
push dword [ebp]
call eax
mov ebp, eax
mov eax, dword [esp + 0x110]
test eax, eax
je 0x41a923
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
add esp, 0x11c
pop ebp
pop ebx
pop edi
pop esi
ret 4
test eax, eax
je 0x41a93d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
add esp, 0x11c
pop ebp
pop ebx
pop edi
pop esi
ret 4
push dword [esp + 0x130]
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x41a90f
mov edx, dword [esp + 0x110]
mov ebx, eax
test edx, edx
je 0x41a972
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add esp, 0x11c
pop ebp
pop ebx
pop edi
pop esi
ret 4
Function at 0x4220e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [sym.imp.USER32.dll_DefWindowProcA]
xor esi, esi
push 8
movzx edx, byte [edi + 0xc8]
or edx, 3
and edx, 0xfffffffb
and byte [edi + 0x98], 0xc0
mov dword [edi + 0x50], esi
mov dword [edi + 4], esi
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], esi
mov dword [edi + 0x20], eax
mov dword [edi + 0x3c], esi
mov dword [edi + 0x54], esi
mov dword [edi + 0x60], esi
mov dword [edi + 0x64], esi
mov dword [edi + 0x68], esi
mov dword [edi + 0x6c], esi
mov dword [edi + 0x70], esi
mov dword [edi + 0x74], esi
mov dword [edi + 0x78], esi
mov dword [edi + 0x7c], esi
mov dword [edi + 0xd8], esi
mov dword [edi + 0xdc], esi
mov dword [edi + 0xe8], esi
mov byte [edi + 0xc8], dl
mov dword [edi + 0xcc], esi
call dword [sym.imp.USER32.dll_GetSysColor]
movzx edx, byte [edi + 0xc8]
or edx, 8
and edx, 0xffffffaf
or edx, 0x20
and byte [edi + 0x98], 0xbf
mov dword [edi + 0xd0], eax
mov eax, edi
mov dword [edi + 0xd4], 0x400
mov dword [edi + 0x94], 0xcdcdcdcd
mov dword [edi + 0xe0], 4
mov dword [edi + 0xe4], esi
mov byte [edi + 0xc8], dl
mov dword [edi + 0x58], esi
mov byte [edi + 0x5c], 1
mov dword [edi + 0xc4], esi
pop edi
pop esi
ret