joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401187
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4011b8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4011b4
cmp esi, eax
jae 0x4011b8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x4011a4
cmp esi, eax
jb 0x4011be
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x4012d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40133e
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x40130f
cmp eax, 2
jne 0x40132a
mov eax, dword [esp]
test esi, esi
je 0x401338
test eax, eax
je 0x401333
test al, 1
jne 0x40132a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x401338
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x4016e0
Capabilities:
Check if file exists
Delete file
Download url
Get common file path
Move file
Receive data

Disassembly:
sub esp, 0x414
mov eax, dword [0x45636c]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea eax, [esp + 8]
push eax
push 0x104
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.360ini.cab
lea ecx, [esp + 0xc]
push ecx
call edi
push 0
push 0
lea edx, [esp + 0x10]
push edx
push str._thttp:__dl.360safe.com_gf_360ini.cab
push 0
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
jge 0x401750
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.0042a9a5
add esp, 0x414
ret
lea eax, [esp + 0x210]
push eax
push 0x104
call esi
push str.360ini
lea ecx, [esp + 0x214]
push ecx
call edi
lea edx, [esp + 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4017a0
lea eax, [esp + 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
je 0x4017a0
cmp eax, 0x50
je 0x4017a0
cmp eax, 0xb7
jne 0x401733
lea ecx, [esp + 0x210]
push ecx
push 0x401650
push 0
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetW]
mov esi, eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
je 0x401733
push str.360ini.dll
lea ecx, [esp + 0x214]
push ecx
call edi
lea edx, [esp + 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401733
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.360Ini
call ebx
test eax, eax
je 0x4018a6
lea eax, [esp + 0xc]
lea esi, [esp + 0x214]
mov ecx, eax
mov edx, 0x104
sub esi, ecx
mov edi, edi
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x401840
movzx ecx, word [esi + eax]
test cx, cx
je 0x401840
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x401820
jmp 0x401844
test edx, edx
jne 0x401847
sub eax, 2
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.Internet360Ini.dll
lea ecx, [esp + 0x10]
push ecx
call edi
push str.Internet360Ini
call ebx
test eax, eax
jne 0x401885
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x40189f
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.0042a9a5
add esp, 0x414
ret
lea ecx, [esp + 0xc]
push ecx
jmp 0x4018ae
lea edx, [esp + 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [esp + 0x41c]
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.0042a9a5
add esp, 0x414
ret
Function at 0x4039a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x45636c]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call fcn.0042f230
add esp, 0xc
push 0x104
lea edx, [esp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x45a5b4
lea esi, [esp + 4]
mov edx, 0x104
sub esi, eax
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x403a11
movzx ecx, word [esi + eax]
test cx, cx
je 0x403a11
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4039f1
jmp 0x403a15
test edx, edx
jne 0x403a18
sub eax, 2
xor edx, edx
mov word [eax], dx
call fcn.0040acf0
mov dword [0x45a1a4], eax
call fcn.0040adb0
mov dword [0x45a1a8], eax
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push 0x44c514
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
mov eax, 0x45a1ac
lea esi, [esp + 4]
mov edx, 0x104
sub esi, eax
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x403a80
movzx ecx, word [esi + eax]
test cx, cx
je 0x403a80
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x403a60
jmp 0x403a84
test edx, edx
jne 0x403a87
sub eax, 2
xor edx, edx
push 0x45a1ac
mov word [eax], dx
call fcn.0040cb20
add esp, 4
cmp dword [0x45a1a4], 0
je 0x403afe
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x45a1ac
push 0x100
push 0x45a3b4
push 0x44bf28
push str.name
push 0x44c52c
call esi
push 0x45a1ac
push 0x80
push 0x45a7bc
push 0x44c534
push 0x44c53c
push 0x44c52c
call esi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0042a9a5
add esp, 0x20c
ret
mov eax, 0x45a3b4
mov esi, str.ningmengUpdateSevice
mov edx, 0x100
sub esi, eax
nop
lea ecx, [edx + 0x7ffffefe]
test ecx, ecx
je 0x403b30
movzx ecx, word [esi + eax]
test cx, cx
je 0x403b30
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x403b10
jmp 0x403b34
test edx, edx
jne 0x403b37
sub eax, 2
xor edx, edx
mov word [eax], dx
mov eax, 0x45a7bc
mov esi, str.ningmengUpdateSevice
mov edx, 0x80
sub esi, eax
lea ecx, [ecx]
lea ecx, [edx + 0x7fffff7e]
test ecx, ecx
je 0x403b70
movzx ecx, word [esi + eax]
test cx, cx
je 0x403b70
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x403b50
jmp 0x403b74
test edx, edx
jne 0x403b77
sub eax, 2
mov ecx, dword [esp + 0x20c]
xor edx, edx
pop esi
xor ecx, esp
mov word [eax], dx
call fcn.0042a9a5
add esp, 0x20c
ret
Function at 0x403ba0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x447428
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x45636c]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push esi
push edi
mov eax, dword [0x45636c]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov eax, dword [0x45a1a0]
xor ebx, ebx
cmp eax, ebx
je 0x403d19
mov eax, dword [eax + 4]
cmp eax, ebx
je 0x403d19
cmp dword [0x45a1a4], ebx
jne 0x403d19
lea edi, [eax + 4]
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403c00
sub eax, edx
je 0x403d19
push 7
push 0x44c570
push edi
call fcn.00440fbd
add esp, 0xc
test eax, eax
jne 0x403d19
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call fcn.0040c0a0
add esp, 4
mov dword [esp + 0x78], ebx
mov eax, dword [esp + 0x34]
mov esi, 8
cmp dword [esp + 0x48], esi
jae 0x403c57
lea eax, [esp + 0x34]
push ebx
push ebx
push 1
push ebx
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], esi
jae 0x403c7f
lea eax, [esp + 0x34]
push eax
push 0x20
lea ecx, [esp + 0x54]
push ecx
push 0x44bf28
push 0x44c578
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x58]
push str._04d_02d_02d
push eax
call fcn.0042afaf
mov cx, word [esp + 0x34]
add esp, 0x14
cmp cx, word [esp + 0x1c]
jne 0x403d10
movzx eax, word [esp + 0x22]
mov edx, eax
shl edx, 4
sub edx, eax
movzx eax, word [esp + 0x26]
lea ecx, [eax + edx*2]
movzx eax, word [esp + 0x18]
mov edx, eax
shl edx, 4
sub edx, eax
movzx eax, word [esp + 0x14]
lea eax, [eax + edx*2]
cmp ecx, eax
jl 0x403d10
add eax, 7
cmp ecx, eax
jge 0x403d10
push edi
call fcn.0040a980
add esp, 4
lea esi, [esp + 0x30]
call fcn.00405b80
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0042a9a5
add esp, 0x6c
ret
Function at 0x404960
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x45a1a0]
sub esp, 8
push esi
test eax, eax
je 0x4049cc
cmp dword [eax + 0x14], 0
je 0x4049cc
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x4049cc
cmp dword [esp + 8], 1
jle 0x4049cc
mov ecx, dword [esi + 4]
push 6
push ecx
push 0x44c7bc
call fcn.00441911
add esp, 0xc
test eax, eax
je 0x4049c0
mov edx, dword [esi + 4]
push 6
push edx
push str._start
call fcn.00441911
add esp, 0xc
test eax, eax
jne 0x4049c5
call fcn.004049e0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
add esp, 8
ret
Function at 0x4055b0
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc2c
mov eax, dword [0x45636c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x45a1a0]
push ebx
push esi
push edi
test eax, eax
je 0x4057f7
cmp dword [eax], 0
je 0x4057f7
push 0x410
lea eax, [ebp - 0x828]
push 0
push eax
call fcn.0042f230
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x828]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x828]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.NmSvr.cfg
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x828]
push ecx
push 0
push str.setuptime
push str.setup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
xor edi, edi
mov edx, esi
or edx, edi
je 0x405677
push edi
call fcn.0042bdb0
mov ecx, dword [0x45a1a0]
mov ecx, dword [ecx]
mov ebx, dword [ecx + 0x414]
add esp, 4
sub eax, esi
sbb edx, edi
xor ecx, ecx
cmp edx, ecx
jl 0x4057f7
jg 0x405677
cmp eax, ebx
jb 0x4057f7
xor edx, edx
push 0x3fe
push edx
lea eax, [ebp - 0xc26]
push eax
mov word [ebp - 0xc28], dx
call fcn.0042f230
mov ecx, dword [0x45a1a0]
mov edx, dword [ecx]
add esp, 0xc
cmp dword [edx], edi
je 0x4057f7
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0xc2c], ebx
test ebx, ebx
je 0x4057f7
mov eax, dword [0x45a1a0]
mov esi, dword [eax]
add esi, 0x108
jne 0x4056d7
xor eax, eax
jmp 0x405704
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
cmp edi, 0x3fffffff
jle 0x4056ed
xor eax, eax
jmp 0x405704
lea eax, [edi + edi]
call fcn.00437d80
mov ecx, esp
mov eax, esi
push 3
mov edx, edi
mov esi, ecx
call fcn.00401030
push 1
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x4057e5
cmp eax, 0x424
jne 0x4057e5
xor ecx, ecx
push 0x40e
push ecx
lea edx, [ebp - 0x416]
push edx
mov word [ebp - 0x418], cx
call fcn.0042f230
add esp, 0xc
push 0x208
lea eax, [ebp - 0x418]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.NmSvr.exe
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [0x45a1a0]
mov edi, dword [eax]
add edi, 0x108
je 0x40579a
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x40579e
xor eax, eax
jmp 0x4057b5
lea eax, [esi + esi]
call fcn.00437d80
mov ecx, esp
mov edx, esi
push 3
mov eax, edi
mov esi, ecx
call fcn.00401030
push eax
push str._c__s
lea edx, [ebp - 0xc28]
call fcn.00401000
add esp, 8
push 0
push 0
lea ecx, [ebp - 0xc28]
push ecx
lea edx, [ebp - 0x418]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
mov eax, dword [ebp - 0xc2c]
push eax
call esi
lea esp, [ebp - 0xc38]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a9a5
mov esp, ebp
pop ebp
ret
Function at 0x405810
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x414
mov eax, dword [0x45636c]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [0x45a1a0]
test eax, eax
je 0x405891
cmp dword [eax + 0x20], 0
je 0x405891
xor eax, eax
push 0x40e
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.0042f230
add esp, 0xc
push 0x208
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.CiUpdate.exe
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push 0
push 0x44bf28
lea edx, [esp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.0042a9a5
add esp, 0x414
ret

Function at 0x406750
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
xor eax, eax
push esi
push 0x44
push eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push eax
call fcn.0042f230
mov eax, dword [esp + 0x68]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
push eax
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
cmp esi, 1
jne 0x4067b5
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x54
ret
Function at 0x4067c0
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x447018
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45636c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x458f04]
mov edx, dword [eax + 0xc]
mov ecx, 0x458f04
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], 0
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
test ebx, ebx
je 0x40686e
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esi]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esi]
push eax
push str._s.bak
lea edi, [esp + 0x1c]
call fcn.004065d0
mov edi, dword [esp + 0x1c]
mov eax, dword [esi]
add esp, 8
push 1
push edi
push eax
call ebp
test eax, eax
jne 0x40686e
lea eax, [edi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x4068d1
mov eax, dword [esi]
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x406891
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40689d
test ebx, ebx
je 0x40689d
mov esi, dword [esi]
push 1
push esi
push edi
call ebp
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4068b9
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4068b9
push 4
push eax
push edi
call ebp
lea eax, [edi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4068dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x406eb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x406ec0
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x406ed0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406f00
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x228
mov eax, dword [0x45636c]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [ecx]
push ebx
mov ebx, dword [ecx + 4]
push ebp
push esi
push edi
mov edi, dword [esp + 0x23c]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x20]
push ecx
xor ebp, ebp
or ebx, 0x2001f
push ebx
push ebp
push edi
push eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x14]
mov esi, eax
cmp esi, ebp
jne 0x406f7a
xor eax, eax
cmp ecx, ebp
je 0x406f62
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
and ebx, 0x300
mov esi, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
cmp eax, ebp
je 0x406f88
cmp ecx, ebp
je 0x40701b
push ecx
jmp 0x407015
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x28]
push edx
push ebp
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
lea edx, [esp + 0x44]
push edx
push ebp
push ecx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
jne 0x406fea
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.00406f00
mov ebx, eax
cmp ebx, ebp
jne 0x407038
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push ebp
push ebp
push ebp
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x44]
push eax
push ebp
push ecx
mov dword [esp + 0x3c], 0x100
call esi
test eax, eax
je 0x406fb0
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x406ffd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebp
mov esi, dword [esp + 0x24]
mov dword [esp + 0x18], ebp
call fcn.00406df0
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x40701b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042a9a5
add esp, 0x228
ret 4
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x407047
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x40701d
Function at 0x407540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x447ea0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x45636c]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0x414]
mov esi, ecx
lea ecx, [ebp - 0x14]
mov edi, edx
call fcn.0040d120
mov ecx, dword [ebp + 0x410]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], ecx
lea ecx, [ebp]
mov dword [ebp - 0x28], eax
call fcn.0040d120
push 2
push 0
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x4075cb
call fcn.00406b30
mov edi, eax
jmp 0x4076af
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4075e4
call fcn.00406b30
jmp 0x4076a6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
je 0x4075da
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x20], edi
lea ecx, [ebp]
cmp eax, edi
jae 0x407623
call fcn.0040d2b0
lea ecx, [ebp - 0x14]
call fcn.0040cf50
mov eax, 0x8007000e
jmp 0x4076c1
push eax
mov byte [ebp - 4], 2
call fcn.0040d1d0
mov dword [ebp - 4], 1
jmp 0x40764c
lea ecx, [ebp]
call fcn.0040d1c0
test eax, eax
jne 0x40765f
mov edi, 0x8007000e
jmp 0x4076a8
push edi
lea ecx, [ebp]
call fcn.0040d1c0
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
je 0x4075da
lea ecx, [ebp]
call fcn.0040d1c0
xor edx, edx
mov word [eax + edi*2], dx
mov eax, dword [ebp + 0x418]
push eax
lea ecx, [ebp]
call fcn.0040d1c0
mov ecx, eax
lea edx, [ebp - 0x28]
call fcn.004083f0
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp]
call fcn.0040d2b0
lea ecx, [ebp - 0x14]
call fcn.0040cf50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0042a9a5
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40a790
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x3c], 0x3c
push 0x38
push 0
lea eax, [ebp - 0x38]
push eax
call fcn.0042f230
add esp, 0xc
mov dword [ebp - 0x30], str.runas
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 1
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40a7fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x4c7
jne 0x40a7ed
xor eax, eax
jmp 0x40a800
cmp dword [ebp - 0x40], 2
jne 0x40a7f7
xor eax, eax
jmp 0x40a800
xor eax, eax
jmp 0x40a800
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x40a8c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x45636c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0042f230
add esp, 0xc
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x214], 0x208
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
push str.Software_nmimInstallPath
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40a951
mov eax, dword [ebp + 0xc]
call fcn.00405e10
push eax
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040d5a0
mov ecx, dword [ebp - 0x21c]
or ecx, 1
mov dword [ebp - 0x21c], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a9a5
mov esp, ebp
pop ebp
ret

Function at 0x40acf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447258
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x45636c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x55]
mov dword [ebp - 0x54], eax
push 0
xor esi, esi
lea edi, [ebp - 0x48]
call fcn.00405dc0
mov eax, str.NmMenu.dll
call fcn.004093a0
push eax
push str.NmMenu.dll
lea ecx, [ebp - 0x48]
call fcn.0040db30
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.0040a810
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x48]
call fcn.00405b80
lea eax, [ebp - 0x2c]
call fcn.00405e10
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x4c], eax
lea esi, [ebp - 0x2c]
call fcn.00405b80
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a9a5
mov esp, ebp
pop ebp
ret