joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4181a0
Capabilities:
Access peb ldr_data
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4549f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x46a630]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x46a630]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
lea esi, [esp + 8]
mov dword [esp + 0x30], 0
call fcn.00417e60
cmp dword [esp + 0x20], 0x10
mov ecx, dword [esp + 0xc]
jae 0x418204
lea ecx, [esp + 0xc]
call fcn.00417b80
push 0xc
push str.settings.dat
lea eax, [esp + 0x10]
call fcn.00418a00
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
jae 0x418228
lea eax, [esp + 0xc]
push 0x45ec58
push eax
call fcn.004376bc
mov esi, eax
add esp, 8
test esi, esi
je 0x41827b
push 0x46ff90
mov dword [0x46ff90], 0x46434557
mov dword [0x46ff98], 0x354
call fcn.004177b0
push esi
push 1
push 0x354
push 0x46ff90
mov word [0x46ff9c], ax
call fcn.00437ae5
push esi
call fcn.0043757c
add esp, 0x14
cmp dword [esp + 0x20], 0x10
jb 0x41828f
mov eax, dword [esp + 0xc]
push eax
call fcn.0041902a
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004362fe
add esp, 0x2c
ret

Function at 0x41ec9c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x41ecdf
call fcn.004225cf
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41ecdf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41ecfa
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0041e856
test ebx, ebx
mov esi, eax
je 0x41ecf8
test edi, edi
je 0x41ecf8
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x41fedd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x452f57
call fcn.0043978a
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.004225cf
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x41ff28
call fcn.004225cf
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x41ff39
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x41ff46
or eax, 0xffffffff
jmp 0x4200a2
mov ecx, esi
call fcn.0041fa0d
mov dword [ebp - 0x14], eax
call fcn.0041bf79
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x41ffc4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x41ffc4
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41ffc4
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.0041aa71
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x41ffc4
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x41ffc4
mov ecx, ebx
call fcn.0041ef00
test eax, eax
je 0x41ffc4
push 0
mov ecx, ebx
call fcn.0041ef1b
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.0041db19
push dword [ebp - 0x14]
call fcn.0041bed1
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.0041fce5
xor edi, edi
cmp eax, edi
je 0x420021
test byte [esi + 0x3c], 0x10
je 0x42000b
push 4
pop edi
mov ecx, esi
call fcn.0041ede7
test ax, 0x100
je 0x420001
push 5
pop edi
push edi
mov ecx, esi
call fcn.0041b9fe
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x420021
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0041f0ea
or dword [ebp - 4], 0xffffffff
jmp 0x42004c
cmp dword [ebp - 0x28], edi
je 0x42005a
push 1
mov ecx, ebx
call fcn.0041ef1b
cmp dword [ebp - 0x2c], edi
je 0x42006a
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x420083
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x420083
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.0041fa47
cmp dword [esi + 0x58], edi
je 0x42009f
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.0043982f
ret
Function at 0x4214ae
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4214c4
mov edi, dword [esi + 0xc]
jmp 0x421504
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4214dd
call fcn.004227b3
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4214f2
call fcn.004227b3
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x421504
call fcn.004227b3
call fcn.004225cf
cmp dword [eax + 0x3c], 0
je 0x421519
push edi
mov ecx, ebx
call fcn.0042040d
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004213c8
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x421537
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x421543
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x424350
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x46a630]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0xc]
jne 0x42438d
push 0x458508
push 4
push eax
call fcn.00439ef4
push eax
call fcn.00419661
add esp, 0x10
jmp 0x42439f
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x42440a
push edi
call fcn.00439b48
mov edi, dword [eax]
call fcn.00439b48
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.00439aee
add esp, 0x18
mov ebx, eax
call fcn.00439b48
cmp dword [eax], 0
je 0x4243ea
call fcn.00439b48
push dword [eax]
call fcn.00419688
pop ecx
jmp 0x4243f1
call fcn.00439b48
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x42440a
cmp ebx, esi
jae 0x42440a
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x42440c
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004362fe
leave
ret
Function at 0x4254bd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x425503
call fcn.004225cf
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x425503
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x425546
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x42552f
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x42552f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x425543
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x426928
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x426956
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x426974
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00426892
jmp 0x426974
mov eax, dword [esi + 0x14]
test eax, eax
je 0x426974
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00426892
test edi, edi
mov eax, edi
jne 0x42695e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x46eb40]
test ecx, ecx
je 0x426a37
jmp 0x426927
ret 8

Function at 0x4362fe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46a630]
jne 0x436308
repz ret
jmp fcn.0043c7e8
Function at 0x4376cf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x43770c
cmp dword [ebp + 0x14], edi
je 0x43770c
cmp ecx, edi
jne 0x437713
call fcn.00439b48
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004366b4
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x437727
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x437748
cmp ebx, 0xffffffff
je 0x437737
push ebx
push edi
push ecx
call fcn.00439300
add esp, 0xc
cmp esi, edi
je 0x4376f4
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4376f4
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x437764
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x43776b
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x43785c
test word [esi + 0xc], 0x10c
je 0x4377bf
mov eax, dword [esi + 4]
test eax, eax
je 0x4377bf
jl 0x4378bd
cmp ebx, eax
mov edi, ebx
jb 0x437790
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x437864
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00436372
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x437854
cmp ebx, dword [ebp - 0xc]
jb 0x43782c
cmp dword [ebp - 0xc], 0
je 0x4377e9
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x4377de
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4377e5
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4377f4
mov eax, SysReAllocString
cmp ebx, eax
ja 0x4377f4
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x437890
push eax
push dword [ebp - 8]
push esi
call fcn.00441da0
pop ecx
push eax
call fcn.00442d28
add esp, 0xc
test eax, eax
je 0x4378cf
cmp eax, 0xffffffff
je 0x4378bd
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x437854
push esi
call fcn.00442647
cmp eax, 0xffffffff
pop ecx
je 0x4378c1
cmp dword [ebp - 4], 0
je 0x437890
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x437773
mov eax, dword [ebp + 0x14]
jmp 0x43770e
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x43787b
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00439300
add esp, 0xc
call fcn.00439b48
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x437704
cmp dword [ebp + 0xc], 0xffffffff
je 0x4378a6
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00439300
add esp, 0xc
call fcn.00439b48
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x437704
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x43770e
or dword [esi + 0xc], 0x10
jmp 0x4378c1
Function at 0x43b507
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x46a7c0]
je 0x43b522
inc edi
cmp edi, 0x17
jb 0x43b513
cmp edi, 0x17
jae 0x43b6a2
push ebp
push 3
call fcn.00447133
cmp eax, 1
pop ecx
je 0x43b66e
push 3
call fcn.00447133
test eax, eax
pop ecx
jne 0x43b556
cmp dword [0x46a5c8], 1
je 0x43b66e
cmp ebx, 0xfc
je 0x43b6a1
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x46ec50
push ebp
call fcn.0043cc55
add esp, 0xc
test eax, eax
je 0x43b58c
push esi
push esi
push esi
push esi
push esi
call fcn.004365b8
add esp, 0x14
push 0x104
mov esi, 0x46ec69
push esi
push 0
mov byte [0x46ed6d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x43b5d0
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0043cc55
add esp, 0xc
test eax, eax
je 0x43b5d0
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004365b8
add esp, 0x14
push esi
call fcn.0043ccc0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x43b615
push esi
call fcn.0043ccc0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x46ef64
push 0x45a4b4
sub ecx, eax
push ecx
push eax
call fcn.00447080
add esp, 0x14
test eax, eax
je 0x43b615
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004365b8
add esp, 0x14
jmp 0x43b617
xor esi, esi
push 0x45a4b0
push ebx
push ebp
call fcn.0044700f
add esp, 0xc
test eax, eax
je 0x43b637
push esi
push esi
push esi
push esi
push esi
call fcn.004365b8
add esp, 0x14
push dword [edi*8 + 0x46a7c4]
push ebx
push ebp
call fcn.0044700f
add esp, 0xc
test eax, eax
je 0x43b659
push esi
push esi
push esi
push esi
push esi
call fcn.004365b8
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00446e52
add esp, 0xc
jmp 0x43b6a1
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x43b6a1
cmp ebp, 0xffffffff
je 0x43b6a1
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x46a7c4]
push dword [esi]
call fcn.0043ccc0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x446e52
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043c0b7
xor ebx, ebx
cmp dword [0x46f750], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x446f28
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x447008
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x447008
push eax
call fcn.0043c049
mov dword [esp], 0x45a814
push edi
mov dword [0x46f750], eax
call esi
push eax
call fcn.0043c049
mov dword [esp], 0x45a800
push edi
mov dword [0x46f754], eax
call esi
push eax
call fcn.0043c049
mov dword [0x46f758], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0043a009
test eax, eax
pop ecx
pop ecx
je 0x446ef6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004365b8
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x446f28
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0043c049
cmp eax, ebx
pop ecx
mov dword [0x46f760], eax
je 0x446f28
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043c049
pop ecx
mov dword [0x46f75c], eax
mov eax, dword [0x46f75c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x446fad
cmp dword [0x46f760], ecx
je 0x446fad
push eax
call fcn.0043c0c0
push dword [0x46f760]
mov esi, eax
call fcn.0043c0c0
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x446fad
cmp edi, ebx
je 0x446fad
call esi
cmp eax, ebx
je 0x446f7a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x446f7a
test byte [ebp - 0x18], 1
jne 0x446fad
lea eax, [ebp - 0x10]
push eax
call fcn.0043a040
test eax, eax
pop ecx
je 0x446f95
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004365b8
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x446fa4
or dword [ebp + 0x10], 0x200000
jmp 0x446fe8
or dword [ebp + 0x10], 0x40000
jmp 0x446fe8
mov eax, dword [0x46f754]
cmp eax, dword [ebp - 8]
je 0x446fe8
push eax
call fcn.0043c0c0
cmp eax, ebx
pop ecx
je 0x446fe8
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x446fe8
mov eax, dword [0x46f758]
cmp eax, dword [ebp - 8]
je 0x446fe8
push eax
call fcn.0043c0c0
cmp eax, ebx
pop ecx
je 0x446fe8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46f750]
call fcn.0043c0c0
cmp eax, ebx
pop ecx
je 0x447008
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44700a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4506e6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45073e
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x45ec20
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x450731
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x450740
xor eax, eax
pop esi
leave
ret 4

Function at 0x4524e4
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x46a630]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00452479
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00439300
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x452533
cmp dword [ebp - 0x1c], 5
jb 0x45254b
jmp 0x452547
cmp dword [ebp - 0x10], 1
jne 0x45254b
cmp dword [ebp - 0x1c], 4
ja 0x452547
jne 0x45254b
cmp dword [ebp - 0x18], 0
jbe 0x45254b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x45d074
call fcn.0045236a
test eax, eax
jge 0x45256c
mov byte [0x46fa88], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004362fe
add ebp, 0x78
leave
ret
Function at 0x7c632076
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x7c6320cc
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, ecx
jne 0x7c6320e2
push 0x80004005
call fcn.7c63102d
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x7c6320e5
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x7c6325fe
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x7c6451a0]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
call fcn.7c632041
mov edi, eax
cmp edi, esi
je 0x7c632666
lea ecx, [ebp - 0x70]
call fcn.7c631fdc
mov eax, edi
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.7c63c62c
add ebp, 0x198
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x7c63267e
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.7c6325fe
cmp eax, esi
jne 0x7c6326b1
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call edi
test eax, eax
je 0x7c63266e
lea ecx, [ebp - 0x70]
call fcn.7c631fdc
push dword [ebp - 0x78]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.7c631fdc
mov eax, esi
jmp 0x7c63264c
Function at 0x7c6334cb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x7c6451a0]
xor eax, ebp
mov dword [ebp + 0x39c], eax
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3a8]
push esi
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x3b0]
push edi
mov esi, ecx
mov dword [ebp - 0x74], eax
call dword [str.cN]
xor edi, edi
push 2
push edi
push ebx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x68], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 0x78], ebx
jne 0x7c633536
call fcn.7c631837
mov esi, eax
jmp 0x7c633602
push dword [ebp - 0x74]
push dword [ebp - 0x6c]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
jne 0x7c633553
call fcn.7c631837
jmp 0x7c6335f7
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
mov dword [ebp - 0x6c], eax
je 0x7c633549
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x7c6335ac
lea eax, [ebp - 0x64]
cmp dword [ebp - 0x68], eax
je 0x7c633583
lea ecx, [ebp - 0x68]
call fcn.7c63255b
mov esi, 0x8007000e
lea ecx, [ebp - 0x70]
call fcn.7c631958
mov ecx, dword [ebp + 0x39c]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.7c63c62c
add ebp, 0x3a0
leave
ret 0x10
push eax
lea ecx, [ebp - 0x68]
call fcn.7c63295c
mov ebx, dword [ebp - 0x68]
cmp ebx, edi
jne 0x7c6335c3
mov esi, 0x8007000e
jmp 0x7c6335f9
call dword [str.cN]
push esi
push ebx
push esi
push dword [ebp - 0x6c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x7c633549
mov ecx, dword [ebp - 0x68]
push dword [ebp + 0x3b4]
mov word [ecx + eax*2], di
push dword [ebp - 0x68]
lea ecx, [ebp - 0x80]
call fcn.7c633330
mov esi, eax
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x64]
cmp dword [ebp - 0x68], eax
je 0x7c633588
lea ecx, [ebp - 0x68]
call fcn.7c63255b
jmp 0x7c633588