joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6401a5f5
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x6402ca78]
je 0x6401a610
inc edi
cmp edi, 0x17
jb 0x6401a601
cmp edi, 0x17
jae 0x6401a790
push ebp
push 3
call fcn.6401d6b3
cmp eax, 1
pop ecx
je 0x6401a75c
push 3
call fcn.6401d6b3
test eax, eax
pop ecx
jne 0x6401a644
cmp dword [0x6402d5a0], 1
je 0x6401a75c
cmp ebx, 0xfc
je 0x6401a78f
push str.y9ks5c1rgonml5_n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x6402dbf0
push ebp
call fcn.64013eb8
add esp, 0xc
test eax, eax
je 0x6401a67a
push esi
push esi
push esi
push esi
push esi
call fcn.64011fb8
add esp, 0x14
push 0x104
mov esi, 0x6402dc09
push esi
push 0
mov byte [0x6402dd0d], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6401a6be
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.64013eb8
add esp, 0xc
test eax, eax
je 0x6401a6be
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.64011fb8
add esp, 0x14
push esi
call fcn.64013cc0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x6401a703
push esi
call fcn.64013cc0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x6402df04
push 0x64025304
sub ecx, eax
push ecx
push eax
call fcn.6401b746
add esp, 0x14
test eax, eax
je 0x6401a703
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.64011fb8
add esp, 0x14
jmp 0x6401a705
xor esi, esi
push 0x64025300
push ebx
push ebp
call fcn.6401b68e
add esp, 0xc
test eax, eax
je 0x6401a725
push esi
push esi
push esi
push esi
push esi
call fcn.64011fb8
add esp, 0x14
push dword [edi*8 + 0x6402ca7c]
push ebx
push ebp
call fcn.6401b68e
add esp, 0xc
test eax, eax
je 0x6401a747
push esi
push esi
push esi
push esi
push esi
call fcn.64011fb8
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.6401d4f6
add esp, 0xc
jmp 0x6401a78f
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x6401a78f
cmp ebp, 0xffffffff
je 0x6401a78f
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x6402ca7c]
push dword [esi]
call fcn.64013cc0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.kernel32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x6401d4f6
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.640143e6
xor ebx, ebx
cmp dword [0x6402df7c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x6401d5cc
push 0x64026488
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x6401d6ac
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x6401d6ac
push eax
call fcn.64014378
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x6402df7c], eax
call esi
push eax
call fcn.64014378
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x6402df80], eax
call esi
push eax
call fcn.64014378
mov dword [0x6402df84], eax
lea eax, [ebp - 0xc]
push eax
call fcn.640159ef
test eax, eax
pop ecx
pop ecx
je 0x6401d59a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.64011fb8
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x6401d5cc
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.64014378
cmp eax, ebx
pop ecx
mov dword [0x6402df8c], eax
je 0x6401d5cc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.64014378
pop ecx
mov dword [0x6402df88], eax
mov eax, dword [0x6402df88]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x6401d651
cmp dword [0x6402df8c], ecx
je 0x6401d651
push eax
call fcn.640143ef
push dword [0x6402df8c]
mov esi, eax
call fcn.640143ef
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x6401d651
cmp edi, ebx
je 0x6401d651
call esi
cmp eax, ebx
je 0x6401d61e
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x6401d61e
test byte [ebp - 0x18], 1
jne 0x6401d651
lea eax, [ebp - 0x10]
push eax
call fcn.64015a26
test eax, eax
pop ecx
je 0x6401d639
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.64011fb8
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x6401d648
or dword [ebp + 0x10], 0x200000
jmp 0x6401d68c
or dword [ebp + 0x10], 0x40000
jmp 0x6401d68c
mov eax, dword [0x6402df80]
cmp eax, dword [ebp - 8]
je 0x6401d68c
push eax
call fcn.640143ef
cmp eax, ebx
pop ecx
je 0x6401d68c
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x6401d68c
mov eax, dword [0x6402df84]
cmp eax, dword [ebp - 8]
je 0x6401d68c
push eax
call fcn.640143ef
cmp eax, ebx
pop ecx
je 0x6401d68c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x6402df7c]
call fcn.640143ef
cmp eax, ebx
pop ecx
je 0x6401d6ac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x6401d6ae
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401a90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cbc0
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x43a00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
cmp dword [0x43ba14], 0xb7
je 0x401c44
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004195c0
add esp, 0xc
mov dword [ebp - 0x220], 0x104
lea ecx, [ebp - 0x238]
call fcn.004100c0
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 1
push eax
push 1
xor esi, esi
push esi
push str.SoftwareMicrosoftBingWallpaperApp
push 0x80000001
mov dword [ebp - 0x23c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401b34
mov esi, 0x80004005
jmp 0x401b61
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push str.BWCUVersion
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ecx, 0x80004005
cmovne esi, ecx
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x401b72
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x80004005
jne 0x401b7e
mov al, 1
jmp 0x401ba2
cmp dword [ebp - 0x224], 8
lea edx, [ebp - 0x238]
lea ecx, [ebp - 0x21c]
cmovae edx, dword [ebp - 0x238]
call fcn.0040fc70
test eax, eax
setne al
cmp dword [ebp - 0x228], 0
je 0x401c03
test al, al
je 0x401c03
mov edx, dword [ebp - 0x224]
lea ecx, [ebp - 0x238]
mov esi, dword [ebp - 0x238]
cmp edx, 8
cmovae ecx, esi
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401bd0
sub ecx, edi
lea eax, [ebp - 0x238]
sar ecx, 1
add ecx, ecx
cmp edx, 8
push ecx
push ecx
cmovae eax, esi
mov dword [ebp - 0x220], ecx
push eax
push str.BWCUVersion
call fcn.0040d540
add esp, 0x10
call fcn.00401c80
mov edx, dword [ebp - 0x224]
cmp edx, 8
jb 0x401c44
mov ecx, dword [ebp - 0x238]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401c3a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401c6a
push edx
push ecx
call fcn.00417807
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004177f9
mov esp, ebp
pop ebp
ret 0x10
call fcn.0041af8c
int3
Function at 0x403710
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x43a00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 1
mov dword [ebp - 8], eax
test cl, cl
jne 0x403736
xor ecx, ecx
test dl, dl
cmove eax, ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftBingWallpaperApp
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x403783
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SoftwareMicrosoftBingWallpaperApp
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40379b
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.LaunchStartApp
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4037a9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004177f9
mov esp, ebp
pop ebp
ret
Function at 0x407410
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x43a00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x64], 8
lea eax, [ebp - 0x10]
push ebx
push esi
push edi
push eax
lea edi, [ebp + 0x50]
mov dword [ebp - 8], 0
cmovae edi, dword [ebp + 0x50]
xor esi, esi
push 1
push esi
push str.SoftwareMicrosoftBingWallpaperApp
push 0x80000001
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x407463
mov esi, 0x80004005
jmp 0x407483
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ecx, 0x80004005
cmovne esi, ecx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x407491
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40749f
cmp dword [ebp - 8], 1
jne 0x40749f
mov bl, 1
jmp 0x4074a1
xor bl, bl
lea ecx, [ebp + 0x20]
call fcn.00403230
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x4074df
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4074d5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4074f2
push edx
push ecx
call fcn.00417807
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004177f9
mov esp, ebp
pop ebp
ret
call fcn.0041af8c
int3
Function at 0x408960
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d59d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x43a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov bl, 1
mov dword [ebp - 0x20], 0x43594c
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], bl
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push ecx
cmovae eax, dword [ebp + 8]
lea ecx, [ebp - 0x20]
push eax
call fcn.004133b0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x4089c2
jmp 0x408a33
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4089fa
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x18], 0x43594c
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push ecx
cmovae eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push eax
call fcn.004133b0
xor eax, eax
movzx ebx, bl
cmp dword [ebp - 0x14], eax
mov dword [ebp - 0x18], vtable.CProcessHelper.0
cmovne ebx, eax
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x20], vtable.CProcessHelper.0
cmp edx, 8
jb 0x408a70
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408a66
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408a8d
push edx
push ecx
call fcn.00417807
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004177f9
mov esp, ebp
pop ebp
ret
call fcn.0041af8c
int3
Function at 0x40a4d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, 0x43ad70
push 0
call fcn.00417792
mov edi, eax
mov dword [ebp - 8], 1
test edi, edi
je 0x40a665
mov eax, dword [ebp + 8]
shr eax, 4
mov dword [ebp - 0x10], eax
lea ecx, [eax + 1]
movzx eax, cx
mov dword [ebp - 0xc], eax
nop dword [eax + eax]
push 0
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov ebx, eax
test ebx, ebx
je 0x40a56c
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40a56c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40a56c
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, dword [ebp + 8]
mov ecx, ebx
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40a562
cmp esi, edx
jae 0x40a56c
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40a550
cmp esi, edx
jae 0x40a56c
cmp word [esi], 0
jne 0x40a58d
mov ebx, dword [ebp - 8]
mov ecx, 0x43ad70
push ebx
call fcn.00417792
mov edi, eax
inc ebx
mov dword [ebp - 8], ebx
test edi, edi
je 0x40a665
mov eax, dword [ebp - 0xc]
jmp 0x40a510
test edi, edi
je 0x40a665
mov eax, dword [ebp - 0x10]
inc eax
push 6
movzx eax, ax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x40a665
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40a665
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40a665
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and ebx, 0xf
jbe 0x40a5f6
cmp esi, ecx
jae 0x40a665
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ebx, 1
jne 0x40a5e4
cmp esi, ecx
jae 0x40a665
movzx eax, word [esi]
test ax, ax
je 0x40a665
mov edx, dword [ebp - 4]
mov edi, eax
mov ebx, eax
mov ecx, 1
mov edx, dword [edx]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x40a62c
mov ebx, dword [ebp - 4]
mov ecx, ebx
push edi
call fcn.0040a760
mov edx, dword [ebx]
movzx ebx, word [esi]
movzx ecx, bx
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.0041b238
push eax
call fcn.004016b0
mov ecx, dword [ebp - 4]
add esp, 0x14
mov eax, dword [ecx]
cmp edi, dword [eax - 8]
jg 0x40a670
mov dword [eax - 0xc], edi
mov eax, dword [ecx]
xor ecx, ecx
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00401690
int3
Function at 0x40d320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d9d7
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x43a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], esi
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x224], 0
push eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
push 0x4354f8
mov word [esi], ax
call fcn.0040c560
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x224], 1
call fcn.004195c0
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
lea eax, [ebp - 0x220]
xor edi, edi
mov dword [ebp - 0x220], edi
push eax
push 1
push edi
push str.SoftwareMicrosoftDispatcher
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d3ee
mov edi, 0x80004005
jmp 0x40d41b
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push str.MachineID
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ecx, 0x80004005
cmovne edi, ecx
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x40d42c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x40d51b
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x22c], edi
lea edx, [ecx + 2]
mov dword [ebp - 0x228], 7
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d453
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.0040c560
lea eax, [ebp - 0x23c]
cmp esi, eax
je 0x40d4df
mov ecx, dword [esi + 0x14]
cmp ecx, 8
jb 0x40d4b8
mov eax, dword [esi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x40d4ae
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d538
mov eax, edx
push ecx
push eax
call fcn.00417807
add esp, 8
movups xmm0, xmmword [ebp - 0x23c]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x22c]
movq qword [esi + 0x10], xmm0
jmp 0x40d51b
mov edx, dword [ebp - 0x228]
cmp edx, 8
jb 0x40d51b
mov ecx, dword [ebp - 0x23c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d511
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d538
push edx
push ecx
call fcn.00417807
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004177f9
mov esp, ebp
pop ebp
ret
call fcn.0041af8c
int3
Function at 0x40d540
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x43a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push eax
push 0xf003f
push esi
push str.SoftwareMicrosoftBingWallpaperApp
push 0x80000001
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d5a6
push esi
lea eax, [ebp - 8]
push eax
push esi
push 0xf003f
push 1
push esi
push esi
push str.SoftwareMicrosoftBingWallpaperApp
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40d5a6
mov esi, 0x80004005
jmp 0x40d5c2
push dword [ebp + 0x10]
push ebx
push 1
push 0
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov ecx, 0x80004005
cmovne esi, ecx
mov eax, dword [ebp - 8]
test eax, eax
je 0x40d5d0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004177f9
mov esp, ebp
pop ebp
ret
Function at 0x40d5f0
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42da37
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x43a00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x220], edi
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x228], 0
push 5
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
push str.en_us
mov word [edi], ax
call fcn.0040c560
push 0x10
mov dword [ebp - 0x228], 1
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov dword [ebp - 0x220], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp dword [ebp - 0x220], 0xffffffff
movzx esi, ax
je 0x40d82f
xor eax, eax
cmp ax, si
je 0x40d82f
push 0x208
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004195c0
add esp, 0xc
lea eax, [ebp - 0x21c]
push esi
push 0x104
push eax
push 6
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
test eax, eax
je 0x40d82f
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x230], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x22c], 7
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d704
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x240]
call fcn.0040c560
lea eax, [ebp - 0x240]
cmp edi, eax
je 0x40d790
mov ecx, dword [edi + 0x14]
cmp ecx, 8
jb 0x40d769
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x40d75f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d84d
mov eax, edx
push ecx
push eax
call fcn.00417807
add esp, 8
movups xmm0, xmmword [ebp - 0x240]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
movups xmmword [edi], xmm0
movq xmm0, qword [ebp - 0x230]
movq qword [edi + 0x10], xmm0
jmp 0x40d7d0
mov edx, dword [ebp - 0x22c]
cmp edx, 8
jb 0x40d7d0
mov ecx, dword [ebp - 0x240]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40d7c6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d84d
push edx
push ecx
call fcn.00417807
add esp, 8
cmp dword [edi + 0x14], 8
jb 0x40d7e2
mov edx, dword [edi]
mov esi, edx
mov ecx, dword [edi + 0x10]
lea eax, [edx + ecx*2]
jmp 0x40d7ec
mov eax, dword [edi + 0x10]
mov esi, edi
mov edx, edi
lea eax, [edi + eax*2]
mov dword [ebp - 0x220], eax
cmp esi, eax
je 0x40d82f
sub edx, esi
mov dword [ebp - 0x224], edx
nop
movzx eax, word [esi]
push eax
call fcn.0041b160
mov ecx, dword [ebp - 0x224]
add esp, 4
mov word [ecx + esi], ax
add esi, 2
cmp esi, dword [ebp - 0x220]
jne 0x40d800
jmp 0x40d82f
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004177f9
mov esp, ebp
pop ebp
ret
call fcn.0041af8c
int3
Function at 0x410300
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d9d7
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x43a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], esi
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x224], 0
push eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
push 0x4354f8
mov word [esi], ax
call fcn.0040c560
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x224], 1
call fcn.004195c0
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
lea eax, [ebp - 0x220]
xor edi, edi
mov dword [ebp - 0x220], edi
push eax
push 1
push edi
push str.SoftwareMicrosoftBingWallpaperApp
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4103ce
mov edi, 0x80004005
jmp 0x4103fb
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push str.PartnerCode
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ecx, 0x80004005
cmovne edi, ecx
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x41040c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x4104fb
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x22c], edi
lea edx, [ecx + 2]
mov dword [ebp - 0x228], 7
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410433
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.0040c560
lea eax, [ebp - 0x23c]
cmp esi, eax
je 0x4104bf
mov ecx, dword [esi + 0x14]
cmp ecx, 8
jb 0x410498
mov eax, dword [esi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x41048e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410518
mov eax, edx
push ecx
push eax
call fcn.00417807
add esp, 8
movups xmm0, xmmword [ebp - 0x23c]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x22c]
movq qword [esi + 0x10], xmm0
jmp 0x4104fb
mov edx, dword [ebp - 0x228]
cmp edx, 8
jb 0x4104fb
mov ecx, dword [ebp - 0x23c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4104f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410518
push edx
push ecx
call fcn.00417807
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004177f9
mov esp, ebp
pop ebp
ret
call fcn.0041af8c
int3