joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53d40f
Capabilities:
Get disk size
Get system information on windows

Disassembly:
mov eax, 0x55c79f
call fcn.005493c0
sub esp, 0x40
push ebx
push esi
push edi
push dword [ebp + 0x14]
mov esi, ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x18], esi
push dword [ebp + 8]
call fcn.0053c565
mov eax, dword [ebp + 0x10]
xor ebx, ebx
and eax, 1
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x10]
cmp eax, ebx
lea edi, [esi + 0x30]
mov dword [ebp - 4], ebx
mov dword [esi], 0x5797b0
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 8], ebx
mov dword [ebp + 8], 0x20000
je 0x53d4f5
push ebx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0053ab84
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x53d4c0
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x38], eax
jmp 0x53d4ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 0x14]
cmp ecx, ebx
mov dword [esi + 8], eax
je 0x53d4e3
push dword [esi + 0x10]
mov edx, dword [ecx]
push eax
push 0xd4
push str..CPortableUnBufWinPFile.cpp
call dword [edx + 4]
mov dword [esi + 0x38], 0x200
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00407f50
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
cmp ecx, 0x20000
mov dword [esi + 0x40], ecx
jbe 0x53d510
mov dword [ebp + 8], ecx
mov eax, dword [ebp + 8]
xor edx, edx
div ecx
push dword [ebp + 0xc]
imul eax, ecx
mov ecx, esi
mov dword [esi + 0x3c], eax
call fcn.0053d024
cmp dword [esi + 0xc], 0xffffffff
je 0x53d535
push edi
mov ecx, esi
call fcn.0053c645
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x53dfa6
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
lea eax, [ebp - 0x30]
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x2c]
mov edi, 0x20000
cmp ecx, edi
mov esi, 0x5cc538
ja 0x53dfdb
xor edx, edx
lea eax, [ecx + 0x5cc537]
div ecx
mov esi, eax
imul esi, ecx
and dword [ebp - 8], 0
add ebx, 4
mov dword [ebp - 4], 5
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
mov ecx, ebx
add esi, edi
call fcn.0053df3d
dec dword [ebp - 4]
jne 0x53dfe9
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x53e8ec
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x5c58d0]
push esi
push dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
push dword [ecx + 0x30]
lea eax, [ebp - 0x80]
push 2
push 1
push eax
call fcn.0053a5c1
add esp, 0x14
test byte [ebp + 0x3ac], 0x10
jne 0x53e96a
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
cmp eax, 0xffffffff
mov esi, ecx
je 0x53e959
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x80]
call fcn.00407f50
xor eax, eax
test esi, esi
sete al
jmp 0x53e9c5
push edi
xor eax, eax
mov byte [ebp - 0x70], 0
mov ecx, 0x103
lea edi, [ebp - 0x6f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x70]
push eax
push 0x40f
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x53e9b9
push dword [ebp - 0x7c]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call esi
mov edi, eax
test edi, edi
je 0x53e9a8
lea eax, [ebp - 0x70]
push eax
call esi
lea ecx, [ebp - 0x80]
call fcn.00407f50
xor eax, eax
test edi, edi
sete al
jmp 0x53e9c4
lea ecx, [ebp - 0x80]
call fcn.00407f50
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp + 0x3a0]
pop esi
call fcn.0054939e
add ebp, 0x3a4
leave
ret 8
Function at 0x53ff70
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x68c584]
sub esp, 0xc
test eax, eax
mov dword [0x68c580], 0
je 0x53ff8c
xor eax, eax
add esp, 0xc
ret
mov eax, 0x68c590
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x53ff94
sub eax, edx
push esi
mov dword [esp + 0xc], eax
jne 0x540031
lea eax, [esp + 4]
push eax
push 1
xor esi, esi
push esi
push str.CLSID0280750F_22B0_46fd_BCCA_99B3BF28765EInprocServer32
push SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x540015
lea ecx, [esp + 0xc]
push ecx
push 0x68c590
lea edx, [esp + 0x10]
push edx
push eax
push eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x540006
cmp dword [esp + 8], 1
jne 0x540006
mov esi, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x540031
mov eax, dword [0x68c580]
test eax, eax
jle 0x540027
mov word [0x68c582], 0x8007
mov eax, 0x80004005
pop esi
add esp, 0xc
ret
push 0x68c590
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x68c584], eax
je 0x540015
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x540110
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55ca4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1114
call fcn.00549330
mov eax, dword [0x5c58d0]
push ebx
push esi
push edi
push 0x68c568
mov dword [esp + 0x1120], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, 1
mov dword [esp + 0x14], edi
mov eax, dword [0x68c584]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x112c], esi
je 0x540177
cmp dword [0x68c588], esi
jne 0x5402d2
mov byte [esp + 0x118], 0
call fcn.0053ff70
test eax, eax
jge 0x5401a8
push 0x1000
lea eax, [esp + 0x11c]
push str.This_program_requires_the_file_advrcntr2.dll__which_was_not_found_on_this_system.
push eax
call dword [sym.imp.MSVCR71.dll__mbsnbcpy]
add esp, 0xc
jmp 0x54024d
mov ebx, dword [ebp + 8]
push ebx
call fcn.00540070
add esp, 4
test eax, eax
jge 0x5402d2
test bl, bl
mov dword [esp + 0x10], esi
je 0x540214
mov eax, dword [0x68c588]
cmp eax, esi
jne 0x5401f9
mov eax, dword [0x68c584]
cmp eax, esi
je 0x540214
push 6
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x5401f0
push esi
call eax
add esp, 4
mov dword [0x68c588], eax
jmp 0x5401f5
mov eax, dword [0x68c588]
cmp eax, esi
je 0x540214
lea esi, [eax + 0x28]
push esi
mov edi, 2
call fcn.005400c0
add esp, 4
test eax, eax
je 0x540214
call dword [esi]
mov dword [esp + 0x10], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
push 0x1f40
push 0x2a94
push edi
push str.Fatal_Error:_r_nInstallation_corrupted___please_reinstall_NERO__r_n_r_nError_Code:__i____i____i____i_r_nParameters:__i____i____i_r_nSee_Doc4536
lea edx, [esp + 0x138]
push 0x1000
push edx
call dword [sym.imp.MSVCR71.dll__snprintf]
add esp, 0x28
xor esi, esi
push 0x68c568
mov dword [0x68c588], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ax, word [0x5798e8]
mov cl, byte [0x5798ea]
mov word [esp + 0x18], ax
mov byte [esp + 0x1a], cl
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x1b]
rep stosd dword es:[edi], eax
push 0x100
lea edx, [esp + 0x1c]
push edx
push str.NeroSuppressProxyCheck
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x5402ac
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.MSVCR71.dll_atoi]
add esp, 4
test eax, eax
jne 0x5402cb
test byte [0x68c58c], 1
jne 0x5402cb
push 0x10
push str.Nero
lea ecx, [esp + 0x120]
push ecx
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x80004005
jmp 0x5402df
push 0x68c568
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x1124]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x111c]
call fcn.0054939e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x541d09
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ecx], 0xffffffff
mov eax, dword [0x5c58d0]
mov dword [ebp - 4], eax
je 0x541d47
call fcn.00541b37
push 7
lea ecx, [ebp - 0xc]
push ecx
movzx eax, ax
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x541d47
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR71.dll_atoi]
pop ecx
jmp 0x541d49
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.0054939e
leave
ret

Function at 0x5428c6
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5c58d0]
push edi
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x5428f4
mov edi, dword [ebp + 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
jmp 0x54297f
push esi
push edi
call dword [sym.imp.MSVCR71.dll_malloc]
mov esi, eax
test esi, esi
pop ecx
jne 0x54290f
mov edi, dword [ebp + 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
jmp 0x54297e
push esi
push edi
push 0
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x542936
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x57e6f4
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x54294b
push esi
call dword [sym.imp.MSVCR71.dll_free]
mov edi, dword [ebp + 8]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
jmp 0x54297d
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0x14]
push ecx
movzx ecx, word [eax + 0x16]
push ecx
movzx ecx, word [eax + 0x10]
movzx eax, word [eax + 0x12]
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0043c940
push esi
call dword [sym.imp.MSVCR71.dll_free]
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x10]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
pop esi
mov ecx, dword [ebp - 4]
pop edi
call fcn.0054939e
leave
ret
Function at 0x543665
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 4
inc eax
movzx eax, ax
push 6
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x5436d9
push edi
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x5436d8
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x5436d1
mov cx, word [eax]
and esi, 0xf
inc eax
inc eax
test esi, esi
je 0x5436bd
movzx ecx, cx
lea eax, [eax + ecx*2]
xor ecx, ecx
mov cx, word [eax]
inc eax
inc eax
dec esi
jne 0x5436ad
test cx, cx
je 0x5436d1
movzx ecx, cx
push ecx
mov ecx, dword [esp + 0x18]
push eax
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
ret
Function at 0x54f920
Capabilities:
Get geographical location

Disassembly:
push ecx
push 2
lea eax, [esp + 4]
push eax
push 0x20001004
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x54f948
pop ecx
ret
mov eax, dword [esp]
pop ecx
ret
Function at 0x556360
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55d6b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov eax, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ebx
call fcn.005562e0
test eax, eax
jne 0x5563bb
mov eax, edi
call fcn.00556350
test eax, eax
je 0x5563bb
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
lea esi, [edi + 4]
push eax
mov dword [ebp - 4], ebx
call fcn.005574a0
mov ecx, dword [edi + 0xc]
add esp, 4
cmp ecx, ebx
je 0x5563a5
mov edx, dword [ecx]
call dword [edx + 0x60]
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx]
mov ebx, eax
mov eax, dword [esi]
push eax
call dword [edx + 0x80]
test eax, eax
je 0x556402
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.0042b8e0
mov dword [ebp - 0x14], 1
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x64]
mov dword [edi + 0x10], 0
jmp 0x5563a5

Function at 0x5569f0
Capabilities:
Resume thread

Disassembly:
push ecx
push esi
mov esi, eax
lea ecx, [esp + 4]
mov eax, 0x68ce4c
mov dword [esp + 4], 0
call fcn.00557820
mov eax, dword [esi + 0x20]
test eax, eax
je 0x556a1b
mov eax, dword [eax + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
call fcn.005564d0
mov ecx, 1
mov eax, 0x68ce4c
call fcn.00557840
xor eax, eax
pop esi
pop ecx
ret

Function at 0x556aa0
Capabilities:
Resume thread

Disassembly:
push esi
push 0
mov eax, ebx
or eax, 4
push eax
push 0
push 0
push ecx
push edx
call sub.MFC71.DLL_AfxBeginThread
mov esi, eax
test esi, esi
je 0x556ad0
test bl, 4
mov dword [esi + 0x28], 0
jne 0x556ad0
mov eax, dword [esi + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
pop esi
ret

Function at 0x5574d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55d60f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov eax, dword [0x5c58d0]
push esi
push edi
mov dword [esp + 0x11c], eax
mov esi, ecx
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_9]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
mov dword [esp + 0x130], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_6]
mov edx, dword [ebp + 8]
push edx
mov ecx, esi
call dword [0x5746d4]
lea eax, [esp + 0xc]
push eax
call fcn.005572d0
add esp, 4
push eax
mov ecx, esi
call dword [0x5746d4]
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, esi
call dword [0x5746d4]
mov esi, dword [esi]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x11c]
mov eax, esi
call fcn.0054939e
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5575e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x55d94f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
xor ebx, ebx
lea eax, [esp + 0x34]
push eax
push ebx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x80]
push ebx
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x48]
push edx
push ebx
push ebx
push ebx
push eax
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x5577a0
mov ecx, dword [esp + 8]
push ebp
push esi
push edi
push ecx
mov ecx, dword [esp + 0x80]
call fcn.0042a910
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x80]
push edx
call fcn.0042a910
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x13]
push ecx
inc eax
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x1b], bl
call fcn.0042ac60
mov dword [esp + 0x70], ebx
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x13]
inc eax
push edx
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0x1b], bl
call fcn.0042ac60
mov byte [esp + 0x70], 1
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x4c]
mov edi, dword [esp + 0x5c]
xor esi, esi
cmp eax, ebx
mov dword [esp + 0x30], esi
jbe 0x557783
jmp 0x5576d0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
inc eax
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x7c]
push edi
mov dword [esp + 0x2c], eax
inc ecx
lea eax, [esp + 0x28]
push eax
push ebx
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x4c]
push ecx
push ebp
push esi
push edx
mov dword [esp + 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x557772
cmp dword [esp + 0x20], 1
jne 0x557772
cmp dword [esp + 0x24], ebx
je 0x557772
push edi
lea ecx, [esp + 0x2c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_8]
mov esi, dword [esp + 0x7c]
lea ebx, [esp + 0x28]
mov byte [esp + 0x70], 2
call fcn.0042aa40
mov ecx, ebx
mov byte [esp + 0x70], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
push ebp
lea ecx, [esp + 0x30]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_8]
mov esi, dword [esp + 0x80]
lea ebx, [esp + 0x2c]
mov byte [esp + 0x70], 3
call fcn.0042aa40
mov ecx, ebx
mov byte [esp + 0x70], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
mov esi, dword [esp + 0x30]
xor ebx, ebx
mov eax, dword [esp + 0x14]
inc esi
cmp esi, eax
mov dword [esp + 0x30], esi
jb 0x5576d0
cmp edi, ebx
je 0x557790
push edi
call sub.MFC71.DLL_operator_delete_1
add esp, 4
cmp ebp, ebx
je 0x55779d
push ebp
call sub.MFC71.DLL_operator_delete_1
add esp, 4
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x5c]
pop ebx
mov dword fs:[0], ecx
add esp, 0x64
ret
Function at 0x5578a0
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [0x5c58d0]
push ebx
push edi
xor ebx, ebx
mov dword [esp + 0xa4], eax
xor eax, eax
mov dword [esp + 8], 0x94
mov ecx, 0x24
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x557978
cmp dword [esp + 0x14], 0x1508
jbe 0x557978
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x557978
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegisterApplicationRestart
push edi
call ebx
push str.RegisterApplicationRecoveryCallback
push edi
mov dword [esi], eax
call ebx
push str.ApplicationRecoveryFinished
push edi
mov dword [esi + 4], eax
call ebx
push str.ApplicationRecoveryInProgress
push edi
mov dword [esi + 8], eax
call ebx
push str.GetApplicationRecoveryCallback
push edi
mov dword [esi + 0xc], eax
call ebx
push str.GetApplicationRestartSettings
push edi
mov dword [esi + 0x10], eax
call ebx
push str.UnregisterApplicationRecoveryCallback
push edi
mov dword [esi + 0x14], eax
call ebx
push str.UnregisterApplicationRestart
push edi
mov dword [esi + 0x18], eax
call ebx
mov dword [esi + 0x1c], eax
mov ecx, dword [esp + 0xa4]
mov eax, esi
call fcn.0054939e
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x557ce8
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x55d998
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
mov edx, dword [esi + 0x60]
mov ecx, dword [esi + 0x5c]
cmp ecx, edx
push edi
mov edi, dword [esp + 0x30]
je 0x557d12
lea ebx, [ebx]
mov eax, ecx
call fcn.00556300
cmp eax, edi
je 0x557d12
add ecx, 0x14
cmp ecx, edx
jne 0x557d00
cmp edx, ecx
je 0x557d30
mov eax, ecx
call fcn.005562f0
pop edi
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 8
lea ecx, [esp + 0x30]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_9]
push edi
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x10]
push eax
lea edx, [esp + 0x10]
push edx
call fcn.00556430
lea eax, [esi + 0x58]
lea ecx, [esp + 8]
mov byte [esp + 0x24], 1
call fcn.00429c30
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
lea ecx, [esp + 0x30]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x558a00
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0xc]
push eax
push 4
push esi
push 0x5589d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 4], eax
je 0x558a38
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 8]
test eax, eax
je 0x558a38
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x10]
push eax
call dword [edx]
mov ecx, dword [esi + 4]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret 4

Function at 0x558a50
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x34
test eax, eax
jne 0x558a68
mov ecx, dword [esp + 0x38]
mov edx, ebx
call fcn.005589b0
add esp, 0x34
ret 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x40]
mov esi, eax
xor eax, eax
test ebx, ebx
setne al
xor edx, edx
mov dword [esp + 8], eax
call fcn.005589b0
mov edi, eax
cmp edi, 0x102
jne 0x558b4d
push ebp
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
lea ecx, [ecx]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x558ac4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, eax
jbe 0x558aba
not esi
lea eax, [eax + esi + 1]
xor esi, esi
sub eax, esi
cmp eax, ebx
jae 0x558b42
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x34]
push ecx
call ebp
test eax, eax
jle 0x558b29
nop
mov eax, dword [esp + 0xc]
test eax, eax
je 0x558b00
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, eax
jbe 0x558afa
not esi
lea eax, [eax + esi + 1]
xor esi, esi
sub eax, esi
cmp eax, ebx
jae 0x558b29
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x34]
push ecx
call ebp
test eax, eax
jg 0x558ae0
mov ecx, dword [esp + 0x44]
xor edx, edx
call fcn.005589b0
mov edi, eax
cmp edi, 0x102
je 0x558aa0
pop ebp
mov eax, edi
pop edi
pop esi
add esp, 0x34
ret 4
mov eax, edi
pop edi
pop esi
add esp, 0x34
ret 4