joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a140
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x523588
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x55bb24]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push esi
mov eax, dword [0x55bb24]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [edi + 0x3c], ebx
je 0x40a28b
cmp byte [edi + 0x41], bl
je 0x40a28b
mov eax, dword [edi]
mov edx, dword [eax + 4]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x40a27e
mov ecx, 0xf
xor eax, eax
mov byte [esp + 0x18], bl
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 8
cmp ecx, 0x10
jae 0x40a1c6
lea eax, [esp + 0x18]
mov byte [eax + 8], bl
mov dword [esp + 0x40], ebx
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x2c]
mov edx, eax
cmp ebx, 0x10
jae 0x40a1e2
lea edx, [esp + 0x18]
mov eax, edx
mov ecx, dword [edi + 0x3c]
mov esi, dword [ecx]
lea ebx, [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x2c]
add ebx, edx
push ebx
push eax
lea eax, [edi + 0x44]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x40a212
sub eax, 1
je 0x40a216
sub eax, 2
lea ecx, [esp + 0x14]
jne 0x40a279
jmp 0x40a286
mov byte [edi + 0x41], 0
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
mov ecx, eax
cmp ebx, 0x10
jae 0x40a229
lea ecx, [esp + 0x18]
mov esi, dword [esp + 0x10]
sub esi, ecx
je 0x40a256
cmp ebx, 0x10
jae 0x40a23a
lea eax, [esp + 0x18]
mov ecx, dword [edi + 0x4c]
push ecx
push esi
push 1
push eax
call fcn.004f15bf
add esp, 0x10
cmp esi, eax
jne 0x40a275
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
cmp byte [edi + 0x41], 0
je 0x40a282
test esi, esi
jne 0x40a1d5
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.00404d30
jmp 0x40a1cd
lea ecx, [esp + 0x14]
call fcn.00402b30
xor al, al
jmp 0x40a28d
lea ecx, [esp + 0x14]
call fcn.00402b30
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004f070d
mov esp, ebp
pop ebp
ret
Function at 0x40f8c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x527ad8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x55bb24]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
call fcn.004cefff
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 0x40
call eax
test al, al
je 0x40f970
push 0x534dc4
push ecx
push 0x534dc0
push ecx
push 0x534dd4
push ecx
push 0x5a
push ecx
push 0x534dd8
push ecx
push str.TConfig::GetConfigFromRes
push ecx
push 0x534dc0
push ecx
call fcn.004cf0d6
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00402b90
add esp, 4
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 0xc
push eax
call fcn.00405660
add esp, 8
push 0x40
call fcn.004cf0e5
xor esi, esi
mov dword [esp + 0x14], esi
push 0x538e20
mov dword [esp + 0x28], esi
mov ecx, dword [0x560dd8]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
mov dword [esp + 0x18], ebx
cmp ebx, esi
je 0x40fa2f
mov edx, dword [0x560dd8]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
mov dword [esp + 0x14], ebp
cmp ebp, esi
je 0x40fa24
mov edi, dword [esp + 0x2c]
mov ecx, dword [edi + 0x98]
mov edx, dword [edi + 0x94]
add edi, 0x90
cmp edx, ecx
je 0x40f9e8
mov eax, ecx
sub eax, ecx
lea esi, [eax + edx]
test eax, eax
jle 0x40f9e5
push eax
push ecx
push eax
push edx
call fcn.004f071c
add esp, 0x10
mov dword [edi + 8], esi
mov eax, dword [0x560dd8]
mov esi, dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push eax
call esi
call fcn.00417610
mov ecx, dword [0x560dd8]
push ebx
push ecx
call esi
push ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [esp + 0x2c]
push esi
push eax
mov eax, dword [edx + 0x94]
push eax
call fcn.004f7510
add esp, 0xc
test ebp, ebp
je 0x40fa2f
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x41ad70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x5254e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x55bb24]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, edx
xor ebx, ebx
push 0xffffffffffffffff
push ebx
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], ax
call fcn.00403000
mov eax, esi
mov dword [esp + 0x34], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41adc6
sub eax, edx
sar eax, 1
push eax
push esi
lea esi, [esp + 0x18]
call fcn.0040a4c0
push 0xffffffffffffffff
push ebx
xor edx, edx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push eax
mov ecx, edi
mov word [edi + 4], dx
call fcn.00403000
cmp dword [esp + 0x28], 8
jb 0x41ae0f
mov eax, dword [esp + 0x14]
push eax
call fcn.004f0cfc
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x41bc60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x523398
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x55bb24]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [0x55bb24]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x24]
mov edi, ecx
mov ecx, dword [ebp + 0x20]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
mov dword [esp + 0xc], ecx
push eax
mov ecx, esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 0
call fcn.00402210
lea ecx, [esp + 0x10]
push ecx
push ecx
push eax
mov dword [esp + 0x6c], 0
mov esi, dword [esi + 0x10]
push esi
lea edx, [ebp + 0x14]
push edx
lea eax, [ebp + 0xc]
push eax
lea ecx, [esp + 0x48]
push ecx
push edi
call fcn.0041c7d0
add esp, 0x1c
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.004e201d
mov dword [esp + 0x34], eax
mov dword [esp + 0x70], 0xffffffff
mov eax, dword [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x28], edx
test eax, eax
je 0x41bd57
push 0
lea ecx, [esp + 0x30]
mov edi, eax
call fcn.004e166f
mov eax, dword [edi + 4]
test eax, eax
jbe 0x41bd35
cmp eax, 0xffffffff
jae 0x41bd35
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x2c]
and esi, edi
call fcn.004e1697
test esi, esi
je 0x41bd57
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [ebp + 0x10], 0
mov edx, dword [ebp + 0xc]
jne 0x41bd9a
test edx, edx
je 0x41bd91
mov eax, dword [edx + 0x20]
cmp dword [eax], 0
je 0x41bd7b
mov ecx, dword [edx + 0x30]
cmp dword [ecx], 0
jle 0x41bd7b
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x41bd87
mov eax, dword [edx]
mov ecx, edx
mov edx, dword [eax + 0x10]
call edx
mov edx, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x41bd91
mov byte [ebp + 0x11], al
jmp 0x41bd96
xor edx, edx
mov dword [ebp + 0xc], edx
mov byte [ebp + 0x10], 1
cmp byte [ebp + 0x18], 0
mov ecx, dword [ebp + 0x14]
jne 0x41bdd2
test ecx, ecx
je 0x41bdd0
mov eax, dword [ecx + 0x20]
cmp dword [eax], 0
je 0x41bdbe
mov esi, dword [ecx + 0x30]
cmp dword [esi], 0
jle 0x41bdbe
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x41bdcb
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x41bdd2
xor ecx, ecx
test edx, edx
jne 0x41be02
test ecx, ecx
je 0x41be06
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x30]
cmp dword [esp + 0x14], ecx
je 0x41be0f
cmp dword [esp + 0x10], 0
jne 0x41be0f
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 4], ecx
jmp 0x41be12
test ecx, ecx
je 0x41bdda
mov eax, dword [esp + 0xc]
or dword [eax], 1
jmp 0x41bdde
or dword [eax], 2
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.004f070d
mov esp, ebp
pop ebp
ret 0x20
Function at 0x41be40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x523398
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x55bb24]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [0x55bb24]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x24]
mov edi, ecx
mov ecx, dword [ebp + 0x20]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
mov dword [esp + 0xc], ecx
push eax
mov ecx, esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 0
call fcn.00402210
lea ecx, [esp + 0x10]
push ecx
push ecx
push eax
mov dword [esp + 0x6c], 0
mov esi, dword [esi + 0x10]
push esi
lea edx, [ebp + 0x14]
push edx
lea eax, [ebp + 0xc]
push eax
lea ecx, [esp + 0x48]
push ecx
push edi
call fcn.0041c7d0
add esp, 0x1c
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.004e20e0
mov dword [esp + 0x34], eax
mov dword [esp + 0x70], 0xffffffff
mov eax, dword [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x28], edx
test eax, eax
je 0x41bf37
push 0
lea ecx, [esp + 0x30]
mov edi, eax
call fcn.004e166f
mov eax, dword [edi + 4]
test eax, eax
jbe 0x41bf15
cmp eax, 0xffffffff
jae 0x41bf15
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x2c]
and esi, edi
call fcn.004e1697
test esi, esi
je 0x41bf37
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [ebp + 0x10], 0
mov edx, dword [ebp + 0xc]
jne 0x41bf7a
test edx, edx
je 0x41bf71
mov eax, dword [edx + 0x20]
cmp dword [eax], 0
je 0x41bf5b
mov ecx, dword [edx + 0x30]
cmp dword [ecx], 0
jle 0x41bf5b
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x41bf67
mov eax, dword [edx]
mov ecx, edx
mov edx, dword [eax + 0x10]
call edx
mov edx, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x41bf71
mov byte [ebp + 0x11], al
jmp 0x41bf76
xor edx, edx
mov dword [ebp + 0xc], edx
mov byte [ebp + 0x10], 1
cmp byte [ebp + 0x18], 0
mov ecx, dword [ebp + 0x14]
jne 0x41bfb2
test ecx, ecx
je 0x41bfb0
mov eax, dword [ecx + 0x20]
cmp dword [eax], 0
je 0x41bf9e
mov esi, dword [ecx + 0x30]
cmp dword [esi], 0
jle 0x41bf9e
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x41bfab
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x41bfb2
xor ecx, ecx
test edx, edx
jne 0x41bfe2
test ecx, ecx
je 0x41bfe6
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x30]
cmp dword [esp + 0x14], ecx
je 0x41bfef
cmp dword [esp + 0x10], 0
jne 0x41bfef
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 4], ecx
jmp 0x41bff2
test ecx, ecx
je 0x41bfba
mov eax, dword [esp + 0xc]
or dword [eax], 1
jmp 0x41bfbe
or dword [eax], 2
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.004f070d
mov esp, ebp
pop ebp
ret 0x20
Function at 0x41c230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x523338
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x55bb24]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push edi
mov eax, dword [0x55bb24]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], edx
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
lea edx, [esp + 0x24]
mov esi, ecx
mov ecx, dword [ebp + 0x1c]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0
call fcn.00402210
lea ecx, [esp + 0x14]
push ecx
push ecx
push eax
lea edx, [ebp + 0x14]
push edx
lea eax, [ebp + 0xc]
push eax
lea ecx, [esp + 0x48]
push ecx
push esi
mov dword [esp + 0x9c], 0
call fcn.0041cc80
add esp, 0x18
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x40]
push eax
call fcn.004e248b
fstp qword [esp + 0x3c]
mov dword [esp + 0x90], 0xffffffff
mov edi, dword [esp + 0x34]
add esp, 0x10
test edi, edi
je 0x41c321
push 0
lea ecx, [esp + 0x2c]
call fcn.004e166f
mov eax, dword [edi + 4]
test eax, eax
jbe 0x41c2ff
cmp eax, 0xffffffff
jae 0x41c2ff
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.004e1697
test esi, esi
je 0x41c321
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [ebp + 0x10], 0
mov edx, dword [ebp + 0xc]
jne 0x41c364
test edx, edx
je 0x41c35b
mov eax, dword [edx + 0x20]
cmp dword [eax], 0
je 0x41c345
mov ecx, dword [edx + 0x30]
cmp dword [ecx], 0
jle 0x41c345
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x41c351
mov eax, dword [edx]
mov ecx, edx
mov edx, dword [eax + 0x10]
call edx
mov edx, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x41c35b
mov byte [ebp + 0x11], al
jmp 0x41c360
xor edx, edx
mov dword [ebp + 0xc], edx
mov byte [ebp + 0x10], 1
cmp byte [ebp + 0x18], 0
mov ecx, dword [ebp + 0x14]
jne 0x41c39c
test ecx, ecx
je 0x41c39a
mov eax, dword [ecx + 0x20]
cmp dword [eax], 0
je 0x41c388
mov esi, dword [ecx + 0x30]
cmp dword [esi], 0
jle 0x41c388
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x41c395
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x41c39c
xor ecx, ecx
test edx, edx
jne 0x41c3c5
test ecx, ecx
je 0x41c3c9
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x34]
cmp dword [esp + 0x18], ecx
je 0x41c3d2
cmp dword [esp + 0x14], 0
jne 0x41c3d2
fld qword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
fstp qword [eax]
jmp 0x41c3d5
test ecx, ecx
je 0x41c3a4
mov eax, dword [esp + 0x10]
or dword [eax], 1
jmp 0x41c3a8
or dword [eax], 2
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0x10]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.004f070d
mov esp, ebp
pop ebp
ret 0x20
Function at 0x41c400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x523338
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x55bb24]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push edi
mov eax, dword [0x55bb24]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], edx
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
lea edx, [esp + 0x24]
mov esi, ecx
mov ecx, dword [ebp + 0x1c]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0
call fcn.00402210
lea ecx, [esp + 0x14]
push ecx
push ecx
push eax
lea edx, [ebp + 0x14]
push edx
lea eax, [ebp + 0xc]
push eax
lea ecx, [esp + 0x48]
push ecx
push esi
mov dword [esp + 0x9c], 0
call fcn.0041cc80
add esp, 0x18
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x40]
push eax
call fcn.004e22e5
fstp qword [esp + 0x3c]
mov dword [esp + 0x90], 0xffffffff
mov edi, dword [esp + 0x34]
add esp, 0x10
test edi, edi
je 0x41c4f1
push 0
lea ecx, [esp + 0x2c]
call fcn.004e166f
mov eax, dword [edi + 4]
test eax, eax
jbe 0x41c4cf
cmp eax, 0xffffffff
jae 0x41c4cf
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.004e1697
test esi, esi
je 0x41c4f1
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [ebp + 0x10], 0
mov edx, dword [ebp + 0xc]
jne 0x41c534
test edx, edx
je 0x41c52b
mov eax, dword [edx + 0x20]
cmp dword [eax], 0
je 0x41c515
mov ecx, dword [edx + 0x30]
cmp dword [ecx], 0
jle 0x41c515
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x41c521
mov eax, dword [edx]
mov ecx, edx
mov edx, dword [eax + 0x10]
call edx
mov edx, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x41c52b
mov byte [ebp + 0x11], al
jmp 0x41c530
xor edx, edx
mov dword [ebp + 0xc], edx
mov byte [ebp + 0x10], 1
cmp byte [ebp + 0x18], 0
mov ecx, dword [ebp + 0x14]
jne 0x41c56c
test ecx, ecx
je 0x41c56a
mov eax, dword [ecx + 0x20]
cmp dword [eax], 0
je 0x41c558
mov esi, dword [ecx + 0x30]
cmp dword [esi], 0
jle 0x41c558
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x41c565
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x41c56c
xor ecx, ecx
test edx, edx
jne 0x41c595
test ecx, ecx
je 0x41c599
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x34]
cmp dword [esp + 0x18], ecx
je 0x41c5a2
cmp dword [esp + 0x14], 0
jne 0x41c5a2
fld qword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
fstp qword [eax]
jmp 0x41c5a5
test ecx, ecx
je 0x41c574
mov eax, dword [esp + 0x10]
or dword [eax], 1
jmp 0x41c578
or dword [eax], 2
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0x10]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.004f070d
mov esp, ebp
pop ebp
ret 0x20
Function at 0x41f4b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
cmp dword [eax + 0x1c], 8
mov dword [esp], 0
jb 0x41f4c5
mov ecx, dword [eax + 8]
jmp 0x41f4c8
lea ecx, [eax + 8]
mov eax, dword [eax + 0x20]
push esi
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x41f511
lea ecx, [esp + 8]
call fcn.004f0779
push 0x54cc08
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], vtable.registry::read_error.0
mov dword [esp + 0x20], esi
call fcn.004f4646
mov eax, dword [esp + 4]
pop esi
add esp, 0x18
ret

Function at 0x41f630
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push edi
mov edi, eax
call fcn.0041f4b0
test eax, eax
je 0x41f6bc
mov ecx, dword [esi + 0x14]
cmp eax, ecx
ja 0x41f652
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.00403ed0
jmp 0x41f65e
sub eax, ecx
push 0
push eax
mov ecx, esi
call fcn.00409f20
mov eax, dword [esi + 0x14]
mov dword [esp + 4], eax
mov eax, 8
cmp dword [esi + 0x18], eax
jb 0x41f674
mov ecx, dword [esi + 4]
jmp 0x41f677
lea ecx, [esi + 4]
cmp dword [edi + 0x1c], eax
jb 0x41f681
mov eax, dword [edi + 8]
jmp 0x41f684
lea eax, [edi + 8]
lea edx, [esp + 4]
push edx
push ecx
push 0
push 0
push eax
mov eax, dword [edi + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x41f6d2
mov eax, dword [esp + 4]
cmp eax, 1
jb 0x41f6d2
mov ecx, dword [esi + 0x14]
shr eax, 1
dec eax
cmp eax, ecx
ja 0x41f6c1
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.00403ed0
pop edi
add esp, 0x18
ret
sub eax, ecx
push 0
push eax
mov ecx, esi
call fcn.00409f20
pop edi
add esp, 0x18
ret
lea ecx, [esp + 8]
call fcn.004f0779
push 0x54cc08
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], vtable.registry::read_error.0
mov dword [esp + 0x20], edi
call fcn.004f4646
int3

Function at 0x420160
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x524e96
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x55bb24]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
mov al, byte [esp + 0x24]
mov byte [edi], al
mov eax, dword [esp + 0x20]
xor esi, esi
push 1
mov dword [edi + 4], esi
call fcn.0041f410
mov dword [edi + 8], eax
mov eax, 7
xor ecx, ecx
mov dword [edi + 0x24], eax
mov dword [edi + 0x20], esi
add esp, 4
mov word [edi + 0x10], cx
mov dword [esp + 0x14], esi
mov dword [edi + 0x28], vtable.registry::const_value.0
mov dword [edi + 0x44], eax
mov dword [edi + 0x40], esi
xor edx, edx
mov word [edi + 0x30], dx
mov dword [edi + 0x48], esi
mov byte [esp + 0x14], 1
mov byte [edi + 0x4c], 1
call fcn.00420240
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0xc
Function at 0x420240
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi + 0x20]
push esi
lea esi, [edi + 0xc]
cmp eax, 0x105
jb 0x42025f
push 0xffffffffffffffff
push 0x105
mov ecx, esi
call fcn.00403ed0
jmp 0x420270
mov ecx, 0x105
sub ecx, eax
push 0
push ecx
mov ecx, esi
call fcn.00409f20
mov edx, dword [edi + 0x20]
dec edx
cmp dword [esi + 0x18], 8
mov dword [esp + 4], edx
jb 0x420283
mov eax, dword [esi + 4]
jmp 0x420286
lea eax, [esi + 4]
mov edx, dword [edi + 4]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [edi + 8]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x4202ac
mov byte [edi], 1
mov ecx, dword [esi + 0x14]
mov eax, dword [esp + 4]
cmp eax, ecx
ja 0x4202c6
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.00403ed0
mov eax, esi
pop esi
pop ecx
ret
sub eax, ecx
push 0
push eax
mov ecx, esi
call fcn.00409f20
mov eax, esi
pop esi
pop ecx
ret

Function at 0x4202e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x524e60
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push edi
mov eax, dword [0x55bb24]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x10], ebx
push 0x17
mov byte [esp + 0x34], 1
mov eax, dword [0x560dd8]
push 0x5396a8
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
mov dword [esp + 0x14], ebp
cmp ebp, ebx
je 0x42035c
mov ecx, dword [0x560dd8]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0x10], eax
cmp eax, ebx
jne 0x42038b
mov dword [esp + 0x14], ebx
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x534dc0
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00403c20
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x24
ret
mov edx, dword [0x560dd8]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea edi, [esp + 0x18]
call fcn.00417610
mov eax, dword [0x560dd8]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
mov edi, dword [esp + 0x20]
push eax
push edi
call fcn.004f7510
mov eax, edi
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
add esp, 0xc
mov byte [esi + 4], bl
lea ebp, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4203e0
sub eax, ebp
push eax
push edi
mov ecx, esi
call fcn.00403c20
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp edi, ebx
je 0x420376
push edi
call fcn.004f0cfc
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x24
ret