joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011cf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4011e6
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40121b
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x401217
cmp edi, eax
jae 0x40121b
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x401209
cmp edi, eax
jb 0x40121f
xor eax, eax
jmp 0x401229
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x401284
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x41e068]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
lea edx, [esp + 0x10]
push edx
push 0x2001f
mov eax, ecx
mov ecx, dword [ebp + 8]
xor esi, esi
push esi
mov dword [esp + 0x28], eax
mov eax, dword [eax]
push ecx
push eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
cmp edi, esi
jne 0x401372
xor eax, eax
cmp dword [esp + 0xc], esi
je 0x4012eb
push dword [esp + 0xc]
call ebx
cmp eax, esi
mov ecx, dword [esp + 0x10]
mov edi, eax
mov dword [esp + 0xc], ecx
jne 0x401372
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push ecx
jmp 0x401342
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.00401284
cmp eax, esi
mov dword [esp + 0x10], eax
jne 0x401397
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
mov dword [esp + 0x34], 0x100
call edi
test eax, eax
je 0x401315
cmp dword [esp + 0xc], esi
je 0x401360
push dword [esp + 0xc]
call ebx
mov dword [esp + 0xc], esi
push dword [esp + 0x18]
mov eax, dword [esp + 0x20]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
cmp dword [esp + 0xc], esi
je 0x40137e
push dword [esp + 0xc]
call ebx
mov eax, edi
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00405a1a
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0xc], esi
je 0x4013a3
push dword [esp + 0xc]
call ebx
mov eax, dword [esp + 0x10]
jmp 0x401380
Function at 0x4013c1
Capabilities:
Create process on windows

Disassembly:
push 0x68
mov eax, 0x413fb0
call fcn.00407979
xor esi, esi
push 0x416d54
lea eax, [ebp - 0x1c]
inc esi
push eax
mov dword [ebp - 4], esi
call fcn.0040388d
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.00403c34
pop ecx
pop ecx
mov ebx, eax
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0x10]
mov edi, dword [eax]
cmp edi, eax
jne 0x401408
call fcn.004068ec
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.00403c34
pop ecx
pop ecx
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004013a9
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004013a9
push ecx
mov eax, esp
mov dword [ebp - 0x10], esp
mov ebx, 0x416d58
push ebx
push eax
call fcn.0040388d
call fcn.00405359
xor edi, edi
push 0x44
lea eax, [ebp - 0x74]
push edi
push eax
mov dword [ebp - 0x10], edi
call fcn.00406be0
push 0x10
lea eax, [ebp - 0x30]
push edi
push eax
mov dword [ebp - 0x74], 0x44
mov dword [ebp - 0x48], esi
mov word [ebp - 0x44], 3
call fcn.00406be0
add esp, 0x1c
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea esi, [ebp - 0x14]
call fcn.00403d45
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4014bc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x4014ad
call esi
jmp 0x4014b9
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x10], eax
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
push ebx
push eax
call fcn.0040388d
call fcn.00405359
mov eax, dword [ebp - 0x14]
pop ecx
add eax, 0xfffffff0
call fcn.004013a9
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004013a9
lea esi, [ebp + 0xc]
call fcn.0040417f
cmp dword [ebp - 0x10], edi
setne al
call fcn.00407a18
ret

Function at 0x4014f9
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x41e068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x228
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.00406be0
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push edi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00405f81
test eax, eax
pop ecx
pop ecx
je 0x401576
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x401550
jmp 0x401578
mov bl, 1
lea eax, [esi - 0x10]
call fcn.004013a9
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00405a1a
leave
ret
Function at 0x401591
Capabilities:
Enumerate processes

Disassembly:
push 0x440
mov eax, 0x413f60
call fcn.004079e2
xor edi, edi
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x448], edi
xor esi, esi
push 0x416d50
inc esi
push ebx
mov dword [ebp - 4], esi
call fcn.0040388d
push edi
push 2
mov dword [ebp - 0x448], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x228
lea eax, [ebp - 0x440]
push edi
push eax
call fcn.00406be0
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push esi
mov dword [ebp - 0x444], 0x22c
call sub.KERNEL32.dll_Process32FirstW
push dword [ebp + 8]
lea eax, [ebp - 0x420]
push eax
call fcn.00405f81
test eax, eax
pop ecx
pop ecx
je 0x401629
lea eax, [ebp - 0x444]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x401601
jmp 0x40165b
push dword [ebp - 0x43c]
push edi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push edi
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [ebp - 0x218]
push eax
push ebx
call fcn.00403958
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004013a9
mov eax, ebx
call fcn.00407a2c
ret

Function at 0x4016bd
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x41e068]
xor eax, ebp
mov dword [ebp + 0x1b0], eax
push ebx
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0x80], 0
push 0x228
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.00406be0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push ebx
mov dword [ebp - 0x7c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
lea eax, [ebp - 0x58]
push str.iexplore.exe
push eax
call fcn.00405f81
test eax, eax
pop ecx
pop ecx
jne 0x40174d
push dword [ebp - 0x74]
push eax
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x80]
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x7c]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x401713
mov ecx, dword [ebp + 0x1b0]
pop esi
xor ecx, ebp
pop ebx
call fcn.00405a1a
add ebp, 0x1b4
leave
ret
Function at 0x401b26
Capabilities:
Check if file exists
Copy file
Create directory
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x41e068]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x41441f
call fcn.00407979
mov eax, dword [ebp + 0x214]
push ecx
mov dword [ebp - 0x18], eax
mov eax, esp
mov dword [ebp - 0x1c], esp
mov edi, str.wWinMain
push edi
push eax
call fcn.0040388d
call fcn.00405359
mov dword [esp], 0x416f30
push dword [0x4201f4]
call fcn.00405f81
test eax, eax
pop ecx
pop ecx
jne 0x401bb0
push str.UnInstall
push 0x4201f8
mov dword [ebp - 0x1c], 0x66
call fcn.00403981
push str.Coupon_Print_Activator_Uninstall
push 0x41fe40
call fcn.0040607f
pop ecx
pop ecx
xor esi, esi
jmp 0x401cbb
push 0x416ef0
push 0x4201f8
mov dword [ebp - 0x1c], 0x67
call fcn.00403981
push str.Coupon_Print_Activator_Installation
push 0x41fe40
call fcn.0040607f
lea esi, [ebp - 0x14]
call fcn.00404d62
xor esi, esi
push 0x104
lea eax, [ebp]
push esi
push eax
mov dword [ebp - 4], esi
call fcn.00406be0
add esp, 0x14
push 0x416e74
lea eax, [ebp - 0x10]
push eax
call fcn.004038d2
push esi
push 0xb
lea eax, [ebp]
push eax
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, esi
je 0x401c34
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403958
mov eax, str.ProgramsE_centives
lea ecx, [ebp - 0x10]
call fcn.00403ce0
jmp 0x401c42
push str.C:Program_FilesE_centives
lea eax, [ebp - 0x10]
push eax
call fcn.00403981
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401c59
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, str.UninstallCouponActivator.exe
lea ecx, [ebp - 0x10]
call fcn.00403ce0
mov eax, dword [ebp - 0x10]
cmp dword [eax - 4], 1
jle 0x401c7e
push dword [eax - 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.00404091
mov eax, dword [ebp - 0x10]
mov ebx, eax
mov eax, dword [ebp - 0x14]
cmp dword [eax - 4], 1
jle 0x401c98
push dword [eax - 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.00404091
mov eax, dword [ebp - 0x14]
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004013a9
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004013a9
mov ebx, dword [ebp - 0x18]
push 0x64
push 0x41ff18
push 0x6d
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, ebx
call fcn.00401dc7
call fcn.00401e6d
test eax, eax
jne 0x401cf4
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push edi
push eax
call fcn.0040388d
call fcn.00405359
xor eax, eax
jmp 0x401d1f
push esi
push 0x401fd9
push dword [0x41fe38]
push dword [ebp - 0x1c]
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push edi
push eax
call fcn.0040388d
call fcn.00405359
xor eax, eax
inc eax
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00405a1a
add ebp, 0x20c
leave
ret 0x10
Function at 0x403439
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push ecx
mov eax, esp
mov dword [ebp - 8], esp
mov edi, str.ExtractResource
push edi
push eax
call fcn.0040388d
call fcn.00405359
movzx eax, word [ebp + 8]
mov dword [esp], 0x41ac60
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0x80
push 2
push esi
push esi
push 0xc0000000
push dword [ebp + 0xc]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push ebx
push esi
push 4
push esi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push esi
push esi
push esi
push 2
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebx
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.00405a30
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 8]
call esi
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push edi
push eax
call fcn.0040388d
call fcn.00405359
pop ecx
pop edi
pop esi
mov al, 1
pop ebx
leave
ret

Function at 0x403502
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push ecx
mov eax, esp
mov dword [ebp - 4], esp
mov ebx, str.ExecuteCommand
push ebx
push eax
call fcn.0040388d
call fcn.00405359
push 0x44
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x58]
push edi
push eax
call fcn.00406be0
push 0x10
lea eax, [ebp - 0x14]
push edi
push eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], di
call fcn.00406be0
mov esi, dword [ebp + 8]
add esp, 0x1c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push edi
call fcn.00403d45
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403592
push 0x1388
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
jmp 0x4035b4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x4035a4
call esi
mov edi, eax
jmp 0x4035b4
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
push ecx
mov eax, esp
mov dword [ebp - 4], esp
push ebx
push eax
call fcn.0040388d
call fcn.00405359
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404f1d
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
sub esp, 0x250
lea ebp, [esp - 4]
mov eax, dword [0x41e068]
xor eax, ebp
mov dword [ebp + 0x250], eax
push 0x1c
mov eax, 0x414044
call fcn.00407979
mov esi, 0x419ac4
push esi
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], 1
call fcn.004038d2
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 0x25c]
mov byte [ebp - 4], 2
call fcn.00403c34
lea ecx, [ebp + 0x260]
push ecx
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00403c34
add esp, 0x10
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
call fcn.004013a9
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004013a9
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x405000
xor bl, bl
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004013a9
mov eax, dword [ebp + 0x25c]
add eax, 0xfffffff0
call fcn.004013a9
mov eax, dword [ebp + 0x260]
add eax, 0xfffffff0
call fcn.004013a9
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x250]
xor ecx, ebp
call fcn.00405a1a
add ebp, 0x254
leave
ret
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040388d
mov ebx, eax
push esi
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 7
call fcn.004038d2
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp + 0x25c]
mov byte [ebp - 4], 8
call fcn.00403c34
lea ecx, [ebp - 0x10]
push ebx
push ecx
mov ecx, eax
mov byte [ebp - 4], 9
call fcn.00403c34
mov eax, dword [ebp - 0x24]
add esp, 0x10
add eax, 0xfffffff0
call fcn.004013a9
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004013a9
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.004013a9
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov eax, dword [ebp - 0x10]
setne bl
add eax, 0xfffffff0
call fcn.004013a9
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405000
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x404fb4
Function at 0x405281
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x413fe3
call fcn.00407979
push ecx
mov dword [ebp - 4], 1
mov eax, esp
mov dword [ebp - 0x14], esp
mov edi, str.CRegistryWrapper::SetRegistryValue
push edi
push eax
call fcn.0040388d
call fcn.00405359
xor esi, esi
pop ecx
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x10]
push eax
push 2
push esi
mov byte [ebp - 4], 2
push dword [ebp + 8]
and dword [ebp - 0x10], esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4052d7
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x14], esi
cmp dword [ebp + 0x10], 0
jne 0x4052e7
push 0x80004005
call fcn.00401148
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
mov dword [ebp + 0x10], eax
je 0x40531a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x14], esi
push ecx
mov eax, esp
mov dword [ebp + 0x14], esp
push edi
push eax
call fcn.0040388d
call fcn.00405359
test esi, esi
pop ecx
je 0x405338
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004013a9
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.004013a9
mov eax, dword [ebp + 0x10]
call fcn.00407a18
ret 0x10

Function at 0x405758
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x41e068]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00405697
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00406be0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4057a7
cmp dword [ebp - 0x1c], 5
jb 0x4057bf
jmp 0x4057bb
cmp dword [ebp - 0x10], 1
jne 0x4057bf
cmp dword [ebp - 0x1c], 4
ja 0x4057bb
jne 0x4057bf
cmp dword [ebp - 0x18], 0
jbe 0x4057bf
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4153a0
call fcn.0040552d
test eax, eax
jge 0x4057e0
mov byte [0x420260], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00405a1a
add ebp, 0x78
leave
ret

Function at 0x405a1a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41e068]
jne 0x405a24
repz ret
jmp fcn.00407c36
Function at 0x412509
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00408c9c
xor ebx, ebx
cmp dword [0x41fe20], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4125de
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x412549
xor eax, eax
jmp 0x4126a2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x416d20
push edi
call esi
cmp eax, ebx
je 0x412542
push eax
call fcn.00408c39
mov dword [esp], 0x416d10
push edi
mov dword [0x41fe20], eax
call esi
push eax
call fcn.00408c39
mov dword [esp], 0x416cfc
push edi
mov dword [0x41fe24], eax
call esi
push eax
call fcn.00408c39
mov dword [0x41fe28], eax
lea eax, [ebp - 8]
push eax
call fcn.0040b9f3
test eax, eax
pop ecx
pop ecx
je 0x4125ac
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004067cc
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4125de
push 0x416ce0
push edi
call esi
push eax
call fcn.00408c39
cmp eax, ebx
pop ecx
mov dword [0x41fe30], eax
je 0x4125de
push 0x416cc8
push edi
call esi
push eax
call fcn.00408c39
pop ecx
mov dword [0x41fe2c], eax
mov eax, dword [0x41fe2c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x412657
cmp dword [0x41fe30], esi
je 0x412657
push eax
call fcn.00408ca5
pop ecx
call eax
cmp eax, ebx
je 0x412624
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x41fe30]
call fcn.00408ca5
pop ecx
call eax
test eax, eax
je 0x412624
test byte [ebp - 0x18], 1
jne 0x412657
lea eax, [ebp - 0xc]
push eax
call fcn.0040ba2a
test eax, eax
pop ecx
je 0x41263f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004067cc
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x41264e
or dword [ebp + 0x10], 0x200000
jmp 0x412688
or dword [ebp + 0x10], 0x40000
jmp 0x412688
mov eax, dword [0x41fe24]
cmp eax, esi
je 0x412688
push eax
call fcn.00408ca5
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x412688
mov eax, dword [0x41fe28]
cmp eax, esi
je 0x412688
push dword [ebp - 4]
push eax
call fcn.00408ca5
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x41fe20]
call fcn.00408ca5
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001130
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10001200
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100011f5
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10001175
mov eax, dword [ebp - 4]
cmp eax, dword [0x10066004]
ja 0x10001175
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10001145
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.1002d9b0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1000119b
jmp 0x100011f5
cmp dword [ebp - 0x10], 0x10000
jne 0x100011de
cmp dword [ebp - 0x14], 0x10000
jb 0x100011de
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x100011d1
mov eax, dword [ebp - 0x24]
jmp 0x100011f7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100011f0
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.10001200
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10001145
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10001230
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10001310
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x100012fd
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1000127a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10066004]
ja 0x1000127a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1000124a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.1002d9b0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100012a0
jmp 0x100012fd
cmp dword [ebp - 0x10], 0x10000
jne 0x100012e3
cmp dword [ebp - 0x14], 0x10000
jb 0x100012e3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x100012d6
mov eax, dword [ebp - 0x24]
jmp 0x100012ff
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100012f8
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.10001310
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1000124a
xor eax, eax
mov esp, ebp
pop ebp
ret