joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001381
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 8], edx
mov esi, ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x28]
push edi
call fcn.100011f3
lea edi, [ebp - 0x18]
xor edx, edx
movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
mov al, byte [edx + esi + 0xa]
xor al, byte [edx + esi]
xor byte [ebp + ecx - 0x18], al
lea eax, [edx + 1]
push 0xa
cdq
pop edi
idiv edi
inc ecx
cmp ecx, 0x10
jl 0x100013ab
movups xmm2, xmmword [ebp - 0x28]
xor edx, edx
xorps xmm1, xmm1
xorps xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 2
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 1
xorps xmm1, xmm0
movd eax, xmm1
xor byte [ebp + edx - 0x18], al
inc edx
cmp edx, 0x10
jl 0x100013cb
mov edx, ebx
lea ecx, [ebp - 0x18]
call fcn.100012a7
xor ecx, ecx
xor eax, eax
mov dl, byte [ebx + eax]
mov byte [ebp - 1], dl
cmp dl, 0x2d
je 0x10001440
mov ebx, dword [ebp + 0xc]
xor edx, edx
cmp byte [ebp - 1], 0x41
je 0x1000143e
mov bl, byte [ebp - 1]
inc edx
cmp bl, byte [edx + str.ABCDEFGHJKLMNPRSTUVWXY0123456789]
jne 0x10001432
mov ebx, dword [ebp + 0xc]
add ecx, edx
inc eax
cmp eax, 0x1e
jl 0x10001419
mov eax, ecx
sar eax, 5
and eax, 0x1f
and ecx, 0x1f
pop edi
pop esi
mov al, byte [eax + str.ABCDEFGHJKLMNPRSTUVWXY0123456789]
mov byte [ebx + 0x1e], al
mov al, byte [ecx + str.ABCDEFGHJKLMNPRSTUVWXY0123456789]
mov byte [ebx + 0x1f], al
mov byte [ebx + 0x20], 0
pop ebx
leave
ret
Function at 0x401fe0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555db4
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5b6e64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00416122
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [esi], vtable.CIEEvents.0
mov dword [esi + 0x20], eax
call fcn.004176b0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40203f
push 0x80004005
call fcn.00403110
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x24], eax
mov byte [ebp - 4], 1
call fcn.004176b0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40206c
push 0x80004005
call fcn.00403110
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x28], eax
mov byte [ebp - 4], 2
call fcn.004176b0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x402099
push 0x80004005
call fcn.00403110
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.00418a46
push 0
push 0x5944a8
lea ecx, [esi + 0x24]
call fcn.00402e70
push 0
push 0x5944a8
lea ecx, [esi + 0x28]
call fcn.00402e70
push 0
push 0x5944a8
lea ecx, [esi + 0x2c]
call fcn.00402e70
mov dword [esi + 0x30], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4048d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4048e5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404926
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x404922
nop word [eax + eax]
cmp esi, edx
jae 0x404926
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x404910
cmp esi, edx
jb 0x40492b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x407190
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5b6e64]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
mov edi, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], eax
call esi
push 1
mov dword [ebx], eax
call esi
push 0x5944a8
push str.Shell_TrayWnd
mov dword [edi], eax
call dword [sym.imp.USER32.dll_FindWindowA]
xorps xmm0, xmm0
movups xmmword [ebp - 0x14], xmm0
test eax, eax
je 0x4071ea
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [edi]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
cmp eax, esi
jg 0x40728f
cmp ecx, dword [ebx]
jg 0x40728f
mov esi, dword [ebp - 0x1c]
mov dword [esi], 0
mov edx, dword [edi]
cmp eax, edx
jne 0x40725e
mov esi, dword [ebx]
cmp ecx, esi
jne 0x40725b
cmp dword [ebp - 0x14], 0
jne 0x407237
sub edx, eax
add edx, dword [ebp - 0x10]
mov dword [edi], edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00537a6f
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebp - 0x10], 0
jne 0x40732f
sub esi, ecx
add esi, dword [ebp - 0x14]
pop edi
mov dword [ebx], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00537a6f
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp - 0x1c]
cmp dword [ebp - 0x10], 0
jne 0x40732f
cmp dword [ebp - 0x14], 0
jne 0x40732f
mov dword [esi], 1
mov edx, dword [ebx]
cmp ecx, edx
je 0x40730f
cmp eax, dword [edi]
jne 0x40732f
jmp 0x40732b
mov edx, eax
sub edx, esi
mov esi, dword [ebp - 0x14]
sub eax, edx
mov dword [ebp - 0x18], edx
add esi, edx
sub ecx, edx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x18]
cmp eax, dword [edi]
jne 0x4072f5
cmp ecx, dword [ebx]
jne 0x4072f5
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0
mov edi, dword [ebp - 0x20]
test esi, esi
jne 0x4072d7
sub edx, dword [ebp - 0x18]
sub edx, eax
add dword [edi], edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00537a6f
mov esp, ebp
pop ebp
ret 0xc
test edx, edx
jne 0x40732f
sub esi, dword [ebp - 0x18]
sub esi, ecx
add dword [ebx], esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00537a6f
mov esp, ebp
pop ebp
ret 0xc
test edx, edx
jne 0x40732f
test esi, esi
jne 0x40732f
mov edx, dword [ebp - 0x1c]
mov dword [edx], 1
mov edx, dword [ebx]
cmp ecx, edx
jne 0x407324
add eax, dword [ebp - 0x18]
sub dword [edi], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00537a6f
mov esp, ebp
pop ebp
ret 0xc
cmp eax, dword [edi]
jne 0x40732f
sub edx, dword [ebp - 0x18]
sub edx, ecx
mov dword [ebx], edx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00537a6f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x409730
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55655b
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x5b6e64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x5944a8
lea ecx, [ebp - 0x13c]
call fcn.00404ae0
push 0x128
lea eax, [ebp - 0x138]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0053aab0
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4097ac
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x4098e6
lea eax, [ebp - 0x138]
mov dword [ebp - 0x138], 0x128
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4098da
nop dword [eax]
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4097e0
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x13c]
call fcn.00402e70
push str._System_Process_
push dword [ebp - 0x13c]
call fcn.0053d922
add esp, 8
test eax, eax
sete al
test al, al
jne 0x4098c4
push str.System
push dword [ebp - 0x13c]
call fcn.0053d922
add esp, 8
test eax, eax
sete al
test al, al
jne 0x4098c4
xor esi, esi
cmp dword [edi + 0x110], esi
jle 0x409893
test esi, esi
js 0x409933
cmp esi, dword [edi + 0x110]
jge 0x409933
mov eax, dword [edi + 0x10c]
mov ecx, dword [eax + esi*4]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x409929
push ecx
push dword [ebp - 0x13c]
call fcn.0053d922
add esp, 8
test eax, eax
sete al
test al, al
jne 0x4098c4
inc esi
cmp esi, dword [edi + 0x110]
jl 0x409846
push 0x5944a8
push dword [ebp - 0x13c]
call fcn.0053d922
add esp, 8
test eax, eax
setne al
test al, al
je 0x4098c4
lea eax, [ebp - 0x13c]
lea ecx, [edi + 0x108]
push eax
push dword [ecx + 8]
call fcn.0041f404
lea eax, [ebp - 0x138]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4097d0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov esi, dword [ebp - 0x13c]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40990b
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00537a6f
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403110
call fcn.0041825b
int3
Function at 0x409940
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get file version info
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x650
mov eax, dword [0x5b6e64]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x400
lea eax, [ebp - 0x440]
push 0
push eax
call fcn.0053aab0
add esp, 0xc
lea eax, [ebp - 0x440]
push 0
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [ebp - 0x440]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409985
lea eax, [ebp - 0x440]
mov ecx, 8
mov esi, str.Internet_Exploreriexplore.exe
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4099c0
pop edi
mov eax, 0xb
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00537a6f
mov esp, ebp
pop ebp
ret
push 0x3c
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.0053aab0
add esp, 0xc
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov dword [ebp - 0x644], eax
test eax, eax
je 0x409a9b
push eax
call fcn.0040de5d
add esp, 4
mov esi, eax
lea eax, [ebp - 0x440]
push esi
push dword [ebp - 0x644]
push dword [ebp - 0x648]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x409a92
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueA]
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x64c]
push eax
push str.VarFileInfoTranslation
push esi
call edi
test eax, eax
je 0x409a92
mov ecx, dword [ebp - 0x64c]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x640]
push str.StringFileInfo_04x_04xFileVersion
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x640]
push eax
push esi
call edi
test eax, eax
je 0x409a92
push dword [ebp - 0x650]
lea eax, [ebp - 0x40]
push 0x594bf0
push eax
call fcn.0040bfe0
add esp, 0xc
push esi
call fcn.0040de66
add esp, 4
lea eax, [ebp - 0x40]
push eax
call fcn.005417c9
add esp, 4
cmp eax, 5
jg 0x409ac1
pop edi
mov eax, 5
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00537a6f
mov esp, ebp
pop ebp
ret
cmp eax, 8
jne 0x409ad6
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00537a6f
mov esp, ebp
pop ebp
ret
cmp eax, 9
jne 0x409aeb
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00537a6f
mov esp, ebp
pop ebp
ret
cmp eax, 0xa
jne 0x409b00
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00537a6f
mov esp, ebp
pop ebp
ret
mov ecx, 0xb
cmp eax, ecx
pop edi
cmove eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00537a6f
mov esp, ebp
pop ebp
ret
Function at 0x40a7f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5566f1
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x5b6e64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0
push 0x104
lea eax, [ebp - 0x114]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0053aab0
add esp, 0xc
lea ecx, [ebp - 0x128]
push 0
push 0
push 0x2001f
push 0
push 0
push str.SOFTWARE_skwgt_tu2
push dword [0x5b7700]
call fcn.0040c310
mov edi, dword [ebp - 0x128]
xor esi, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop word [eax + eax]
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x104
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x11c]
push eax
push 0
push str.tu_adc
push edi
call ebx
test eax, eax
jne 0x40a8e1
mov eax, dword [ebp - 0x11c]
cmp eax, 1
je 0x40a8cd
cmp eax, 2
jne 0x40a8e1
mov eax, dword [ebp - 0x118]
test eax, eax
je 0x40a91d
cmp byte [ebp + eax - 0x115], 0
je 0x40a924
inc esi
cmp esi, 5
jl 0x40a890
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x40a8f6
push edi
call esi
xor edi, edi
xor ebx, ebx
test edi, edi
je 0x40a8ff
push edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00537a6f
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
call fcn.005417c9
mov esi, eax
add esp, 4
test esi, esi
jle 0x40a8e7
dec esi
call fcn.004176b0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40a956
push 0x80004005
call fcn.00403110
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x118], eax
mov eax, 0x5944a8
mov byte [ebp - 4], 1
test eax, 0xffff0000
jne 0x40a992
movzx ebx, ax
push ebx
call fcn.00419d3b
test eax, eax
je 0x40a9a4
push ebx
push eax
lea ecx, [ebp - 0x118]
call fcn.004049b0
jmp 0x40a9a4
push 0
push 0x5944a8
lea ecx, [ebp - 0x118]
call fcn.00402e70
push esi
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 2
push 0x594dac
push eax
call fcn.00404c80
mov esi, dword [ebp - 0x118]
xor eax, eax
add esp, 0xc
test esi, esi
setne al
test eax, eax
je 0x40a9f1
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a9d3
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push str.tu_adc
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40aa0d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x40aa1c
push edi
call esi
xor edi, edi
mov ebx, 1
jmp 0x40a8f8
Function at 0x40aa30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556730
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5b6e64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0
push 0
push 0x2001f
push 0
push 0
push str.SOFTWARE_skwgt_tu2
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push dword [0x5b7700]
call fcn.0040c310
push 0x5944a8
lea ecx, [ebp - 0x10]
call fcn.00404ae0
push dword [ebp + 8]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push 0x594dac
push eax
call fcn.00404c80
mov edi, dword [ebp - 0x1c]
add esp, 0xc
mov eax, dword [ebp - 0x10]
xor esi, esi
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x40aaf4
mov ecx, eax
lea ebx, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40aad1
sub ecx, ebx
inc ecx
push ecx
push eax
push 1
push 0
push str.tu_adc
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x40aafa
inc esi
cmp esi, 5
jl 0x40aac1
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x40ab0f
push edi
call esi
mov eax, dword [ebp - 0x10]
xor edi, edi
mov dword [ebp - 0x1c], edi
lea edx, [eax - 0x10]
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ab32
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x40ab39
push edi
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40ab60
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5b6e64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], ecx
push 0
push eax
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
call fcn.0053aab0
add esp, 0xc
lea ecx, [ebp - 0x120]
push 0
push 0
push 0x2001f
push 0
push 0
push str.SOFTWARE_skwgt_tu2
push dword [0x5b7700]
call fcn.0040c310
mov edi, dword [ebp - 0x120]
xor esi, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop dword [eax]
nop word [eax + eax]
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x104
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.tu_adc
push edi
call ebx
test eax, eax
jne 0x40ac41
mov eax, dword [ebp - 0x114]
cmp eax, 1
je 0x40ac2d
cmp eax, 2
jne 0x40ac41
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x40ac99
cmp byte [ebp + eax - 0x109], 0
je 0x40aca0
inc esi
cmp esi, 5
jl 0x40abf0
push 2
push 0x594b14
push 1
push 0
push str.tu_adc
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x40ac6d
push edi
call esi
xor edi, edi
mov eax, dword [ebp - 0x110]
xor ebx, ebx
mov dword [eax + 0xe8], 0
test edi, edi
je 0x40ac86
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00537a6f
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x108], 0
lea eax, [ebp - 0x108]
push eax
call fcn.005417c9
add esp, 4
test eax, eax
jle 0x40ac47
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x40acc2
push edi
call esi
xor edi, edi
mov eax, dword [ebp - 0x110]
mov ebx, 1
mov dword [eax + 0xe8], 1
jmp 0x40ac7f
Function at 0x40c180
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c1e1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x40c1bd
cmp eax, 2
jne 0x40c1cf
mov eax, dword [ebp + 0x10]
test esi, esi
je 0x40c1dd
test eax, eax
je 0x40c1da
cmp byte [eax + esi - 1], 0
je 0x40c1dd
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
mov byte [esi], 0
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x40c1f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0041c90a

Function at 0x4114eb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x411530
call fcn.0041c602
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x411530
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x41154c
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0042147f
mov ebx, eax
test edi, edi
je 0x41154a
test esi, esi
je 0x41154a
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x411e93
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x411f51
cmp dword [esi + 0x20], 0
je 0x411f51
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x411f51
cmp dword [ebp + 8], 0
je 0x411f51
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.0041c602
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp + 8], eax
test eax, eax
je 0x411f22
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp + 8]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x411f51
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.0042bcb2
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x411f42
test edi, edi
je 0x411f42
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x411f4d
mov ecx, esi
call fcn.00411c5d
mov eax, ebx
jmp 0x411f53
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x416e22
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x55adb1
call fcn.0053852c
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x74], esi
jne 0x416e48
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x416e9c
call fcn.004176b0
push eax
lea ecx, [ebp - 0x10]
call fcn.00403130
mov ecx, dword [edi + 0x74]
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 4], esi
mov eax, dword [ecx]
call dword [eax + 0x8c]
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0054213b
push eax
call fcn.00404770
add esp, 0x14
test edi, edi
je 0x416e8f
push edi
call fcn.005420b0
pop ecx
mov esi, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00403160
mov eax, esi
call fcn.005384f5
ret 8