joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50b080
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x566ec8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x5df7e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
mov bl, 1
push ecx
mov esi, esp
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x20], esi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 0x10], 0
push eax
call fcn.004bbb10
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0
mov ecx, edi
call fcn.0050ae00
mov byte [ebp - 4], 3
call fcn.004bb5b0
mov ecx, eax
test ecx, ecx
je 0x50b261
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
push ecx
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
push eax
call fcn.004bbb10
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov byte [ebp - 4], 7
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 5
mov ecx, edi
call fcn.0050abe0
mov byte [ebp - 4], 8
push dword [eax]
lea eax, [ebp - 0x14]
push str.SOFTWAREAlibabaWWLights
push str._s_s_
push eax
call fcn.004c0530
add esp, 0x10
mov byte [ebp - 4], 5
or esi, 0xffffffff
mov edx, dword [ebp - 0x1c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x50b179
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp - 0x14]
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x50b1b2
push eax
push str.reg_RegCreateKeyEx_fail:__ld
call fcn.004c1030
add esp, 8
xor bl, bl
jmp 0x50b1f0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 1
push 0
push str.Path
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x50b1e7
push eax
push str.reg_RegSetValueEx_fail:__ld
call fcn.004c1030
add esp, 8
xor bl, bl
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 3
mov eax, esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x50b20e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x50b22c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x50b24b
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004b95c0
int3
Function at 0x51524b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x5471e7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00547066

Function at 0x54c4b4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0054c174
Function at 0x554850
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, ecx
push edi
push str.GetMethodProperty
push dword [ebx + 0xc]
call esi
push str.GetNumberOfMethods
mov dword [ebx + 0x10], eax
push dword [ebx + 0xc]
call esi
push str.GetNumberOfFormats
mov dword [ebx + 0x14], eax
push dword [ebx + 0xc]
call esi
push str.GetHandlerProperty
mov dword [ebx + 0x18], eax
push dword [ebx + 0xc]
call esi
push str.GetHandlerProperty2
mov dword [ebx + 0x1c], eax
push dword [ebx + 0xc]
call esi
push str.CreateObject
mov dword [ebx + 0x20], eax
push dword [ebx + 0xc]
call esi
push str.SetLargePageMode
mov dword [ebx + 0x24], eax
push dword [ebx + 0xc]
call esi
mov dword [ebx + 0x28], eax
cmp dword [ebx + 0x10], 0
je 0x5548eb
cmp dword [ebx + 0x14], 0
je 0x5548eb
cmp dword [ebx + 0x24], 0
je 0x5548eb
lea edx, [ebx + 0x2c]
lea ecx, [ebx + 0x10]
call fcn.00555e60
lea edx, [ebx + 0x40]
mov byte [ebx + 8], al
lea ecx, [ebx + 0x10]
call fcn.00556150
or byte [ebx + 8], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x554b70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.CPrivateInStream.0
jne 0x554bab
push dword [ecx + 0x10]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.00535602
mov ecx, dword [ebp + 0x14]
add esp, 0x10
test ecx, ecx
je 0x554ba1
mov dword [ecx], eax
xor eax, eax
pop ebp
ret 0x10
pop ebp
ret 0x10
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edx
jmp 0x554ba7

Function at 0x5570b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 0x10]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.00535c15
mov ecx, dword [ebp + 0x10]
add esp, 0x10
mov dword [ecx], eax
xor eax, eax
pop ebp
ret 0xc

Function at 0x557140
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 0x10]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.00535602
mov ecx, dword [ebp + 0x10]
add esp, 0x10
test ecx, ecx
je 0x55715f
mov dword [ecx], eax
xor eax, eax
pop ebp
ret 0xc
Function at 0x5578f0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
push edi
je 0x557906
add dword [esi + 0x78], 1
adc dword [esi + 0x7c], 0
cmp dword [esi + 0x70], 0
je 0x557968
cmp byte [esi + 0x6a], 0
je 0x557926
lea eax, [esi + 0x5c]
push eax
mov eax, dword [esi + 0x6c]
push 0
push 0
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov edi, dword [esi + 0x6c]
mov eax, dword [edi + 8]
cmp eax, 0xffffffff
je 0x557968
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x557945
mov dword [edi + 8], 0xffffffff
jmp 0x557968
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x55795a
pop edi
mov eax, 0x80004005
pop esi
pop ebp
ret 8
jle 0x557964
movzx eax, ax
or eax, 0x80070000
test eax, eax
jne 0x55799f
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x55797c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x70], 0
cmp byte [esi + 0x58], 0
je 0x55799d
cmp byte [esi + 0x69], 0
je 0x55799d
cmp dword [esi + 0x54], 8
lea eax, [esi + 0x40]
jb 0x557993
mov eax, dword [eax]
push dword [esi + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x559410
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
mov ecx, 0x400000
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], ecx
push eax
cmovbe ecx, dword [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x14]
test eax, eax
mov eax, dword [ebp - 4]
setne dl
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
test ecx, ecx
je 0x559457
mov dword [ecx], eax
test dl, dl
je 0x559463
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x559478
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x10
jle 0x559482
movzx eax, ax
or eax, 0x80070000
mov esp, ebp
pop ebp
ret 0x10
Function at 0x409782
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4098d9
mov edx, 0x10000000
cmp eax, 0x7c
je 0x4098d9
cmp eax, 0x29
jne 0x4097bf
cmp dword [esi + 0x10], 0
jne 0x4098d9
cmp eax, eax
jne 0x4097bf
test dword [esi + 0x50], edx
je 0x4098df
cmp eax, 0x2e
jne 0x4097da
push 5
lea ecx, [esi + 0x24]
call fcn.00409a04
mov ecx, esi
call fcn.00409759
jmp 0x4098c3
cmp eax, 0x5c
jne 0x40982f
mov ecx, esi
call fcn.00409759
test byte [esi + 0x50], 0x80
je 0x409823
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x40980b
push 4
lea ecx, [esi + 0x24]
call fcn.00409a04
mov ecx, esi
call fcn.00409759
jmp 0x4098ca
cmp eax, 0x42
jne 0x409823
push 4
lea ecx, [esi + 0x24]
call fcn.00409a04
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x4097ff
mov ecx, esi
call fcn.0040a813
jmp 0x4098c3
cmp eax, 0x5b
jne 0x40984f
mov ecx, esi
call fcn.00409759
mov ecx, esi
call fcn.0040a7c7
cmp dword [esi + 0x4c], 0x5d
je 0x4097ce
push 4
jmp 0x4098e1
cmp eax, 0x28
jne 0x40986c
mov ecx, esi
call fcn.00409759
mov ecx, esi
call fcn.0040a8c1
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4098df
jmp 0x4098b8
cmp eax, 0x5e
jne 0x409875
push 2
jmp 0x4097f7
cmp eax, 0x24
jne 0x409881
push 3
jmp 0x4097f7
cmp eax, 0x2a
je 0x4098d5
cmp eax, 0x2b
je 0x4098d5
cmp eax, 0x3f
je 0x4098d5
cmp eax, 0x7b
je 0x4098d5
cmp eax, 0x7d
jne 0x40989f
test dword [esi + 0x50], edx
je 0x4098d1
cmp eax, 0x5d
jne 0x4098a9
test dword [esi + 0x50], edx
je 0x409848
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0040aa4b
mov bl, 1
mov ecx, esi
call fcn.00409759
test bl, bl
je 0x4098ca
mov ecx, esi
call fcn.0040a971
mov cl, 1
jmp 0x409789
push 6
jmp 0x4098e1
push 0xa
jmp 0x4098e1
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.004088ab
int3
Function at 0x41a9e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x659fd4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x50], 0
push esi
lea esi, [ebx + 4]
push edi
jne 0x41aa05
xor edi, edi
jmp 0x41aa97
cmp dword [esi + 0x38], 0
je 0x41aa7c
cmp byte [esi + 0x3d], 0
je 0x41aa7c
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x41aa23
xor al, al
jmp 0x41aa7e
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x41aa4e
sub eax, 1
je 0x41aa52
sub eax, 2
je 0x41aa7c
xor al, al
jmp 0x41aa7e
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x41aa73
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.005b3ef5
add esp, 0x10
cmp edi, eax
je 0x41aa73
xor al, al
jmp 0x41aa7e
cmp byte [esi + 0x3d], 0
sete al
jmp 0x41aa7e
mov al, 1
push dword [esi + 0x4c]
xor edi, edi
test al, al
cmovne edi, esi
call fcn.005b410f
xor ecx, ecx
add esp, 4
test eax, eax
cmovne edi, ecx
mov byte [esi + 0x48], 0
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea ecx, [esi + 8]
mov byte [esi + 0x3d], 0
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x664820]
mov dword [esi + 0x40], eax
mov eax, dword [0x664824]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x44], eax
mov dword [esi + 0x38], 0
test edi, edi
jne 0x41ab38
mov eax, dword [ebx]
push edi
mov ecx, dword [eax + 4]
xor eax, eax
add ecx, ebx
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00412620
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005a7b5f
mov esp, ebp
pop ebp
ret
Function at 0x41dc80
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
xorps xmm0, xmm0
lea eax, [esp + 0x14]
push edi
push eax
movlpd qword [esp + 0x24], xmm0
movlpd qword [esp + 0x1c], xmm0
movlpd qword [esp + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x41dcba
xorps xmm0, xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
call esi
mov eax, dword [esp + 0x18]
add dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
adc dword [esp + 0x14], eax
rdtsc
mov edi, eax
mov ebx, edx
nop dword [eax]
lea eax, [esp + 0x20]
push eax
call esi
mov ecx, dword [esp + 0x24]
cmp ecx, dword [esp + 0x14]
jb 0x41dce0
ja 0x41dcfd
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x10]
jb 0x41dce0
rdtsc
mov ecx, eax
call fcn.005d1d20
cvtsd2ss xmm0, xmm0
mov edx, ebx
mov ecx, edi
movss dword [esp + 0x10], xmm0
call fcn.005d1d20
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
pop edi
pop esi
pop ebx
movss xmm0, dword [esp + 4]
subss xmm0, xmm1
divss xmm0, dword [0x62e6b0]
mov esp, ebp
pop ebp
ret
Function at 0x421500
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d6631
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x659fd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00442b90
lea eax, [edi + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 8]
call fcn.00442b90
lea eax, [edi + 0x10]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 0x10]
call fcn.00442b90
lea eax, [edi + 0x18]
mov byte [ebp - 4], 2
push eax
lea ecx, [esi + 0x18]
call fcn.00442b90
lea eax, [edi + 0x20]
mov byte [ebp - 4], 3
push eax
lea ecx, [esi + 0x20]
call fcn.0045a140
lea eax, [edi + 0x28]
mov byte [ebp - 4], 4
push eax
lea ecx, [esi + 0x28]
call fcn.0045a140
lea eax, [edi + 0x30]
mov byte [ebp - 4], 5
push eax
lea ecx, [esi + 0x30]
call fcn.00442b90
lea eax, [edi + 0x38]
mov byte [ebp - 4], 6
push eax
lea ecx, [esi + 0x38]
call fcn.0045a140
lea eax, [edi + 0x40]
mov byte [ebp - 4], 7
push eax
lea ecx, [esi + 0x40]
call fcn.0045a140
lea ecx, [esi + 0x48]
lea edx, [edi + 0x48]
mov dword [ecx], vtable.srl::Size.0
cmp ecx, edx
je 0x4215d2
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
lea ecx, [esi + 0x58]
lea edx, [edi + 0x58]
mov dword [ecx], vtable.srl::Size.0
cmp ecx, edx
je 0x4215ee
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
lea ecx, [esi + 0x68]
lea edx, [edi + 0x68]
mov dword [ecx], vtable.srl::Size.0
cmp ecx, edx
je 0x42160a
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
lea eax, [edi + 0x78]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [esi + 0x78]
call fcn.00453060
mov dword [esi + 0x94], vtable.srl::Exists.0
movzx eax, byte [edi + 0x98]
mov byte [esi + 0x98], al
mov dword [esi + 0x9c], vtable.srl::Exists.0
movzx eax, byte [edi + 0xa0]
mov byte [esi + 0xa0], al
mov dword [esi + 0xa4], vtable.srl::Exists.0
movzx eax, byte [edi + 0xa8]
mov byte [esi + 0xa8], al
mov dword [esi + 0xac], vtable.srl::Exists.0
movzx eax, byte [edi + 0xb0]
mov byte [esi + 0xb0], al
mov dword [esi + 0xb4], vtable.srl::Exists.0
movzx eax, byte [edi + 0xb8]
mov byte [esi + 0xb8], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42e480
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7988
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x659fd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 4
push eax
push 0
push str.install
push dword [edi]
call esi
test eax, eax
jne 0x42e4eb
cmp dword [ebp - 0x10], 4
jne 0x42e4f4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0xd
jne 0x42e654
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push str.install
push dword [edi]
call esi
test eax, eax
jne 0x42e654
mov eax, dword [ebp - 0x10]
cmp eax, 1
je 0x42e529
cmp eax, 2
jne 0x42e654
mov eax, dword [ebp - 0x14]
shr eax, 1
mov dword [ebp - 0x10], eax
je 0x42e654
push ecx
inc eax
lea ecx, [ebp - 0x20]
push eax
call fcn.0042f0c0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x20]
mov ecx, edi
push eax
push esi
push str.install
call fcn.0042f990
test eax, eax
jne 0x42e608
mov ecx, 0x629fd8
mov eax, esi
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42e596
test dx, dx
je 0x42e592
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42e596
add eax, 4
add ecx, 4
test dx, dx
jne 0x42e570
xor ecx, ecx
jmp 0x42e59b
sbb ecx, ecx
or ecx, 1
xor eax, eax
test ecx, ecx
sete al
mov dword [ebx], eax
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x42e5f4
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x42e5d5
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42e668
push ecx
push esi
call fcn.005a7e2d
add esp, 8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x42e654
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x42e635
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42e66d
push ecx
push esi
call fcn.005a7e2d
add esp, 8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.005af179
call fcn.005af179
int3
Function at 0x42f990
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42fa01
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x42f9cf
cmp eax, 2
jne 0x42f9eb
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x42f9fb
test ecx, ecx
je 0x42f9f6
test cl, 1
jne 0x42f9eb
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x42f9fb
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x42fa50
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7b34
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x659fd4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x84], vtable.srl::Size.0
movlpd qword [ebp - 0x7c], xmm0
mov dword [ebp - 0x94], vtable.srl::Size.0
movlpd qword [ebp - 0x8c], xmm0
mov dword [ebp - 0xa4], vtable.srl::Size.0
movlpd qword [ebp - 0x9c], xmm0
mov byte [ebp - 4], 3
push str.kernel32.dll
mov dword [ebp - 0x74], 0x40
mov dword [ebp - 0x34], 0x20
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42fbcc
sub esp, 8
lea ecx, [ebp - 0x2b8]
call fcn.00413c70
sub esp, 8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x208]
call fcn.00413c70
sub esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x158]
call fcn.00413c70
push str.GlobalMemoryStatusEx
push esi
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42fb63
lea ecx, [ebp - 0x74]
push ecx
call eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x98], eax
jmp 0x42fba0
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x158]
call fcn.004138a0
lea ecx, [ebp - 0x208]
call fcn.004138a0
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 3
call fcn.004138a0
mov eax, dword [0x66458c]
test eax, eax
jne 0x42fc01
push 0x78
call fcn.00461253
add esp, 4
mov dword [ebp - 0xa8], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x42fbf6
mov ecx, eax
call fcn.0040d790
jmp 0x42fbf8
xor eax, eax
mov byte [ebp - 4], 3
mov dword [0x66458c], eax
lea esi, [eax + 0x64]
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
push 0x11597
call fcn.00418130
lea eax, [ebp - 0x94]
mov ecx, esi
push eax
push 0x116d5
call fcn.00418130
lea eax, [ebp - 0xa4]
mov ecx, esi
push eax
push 0x116d6
call fcn.00418130
push 0x624ff8
push 0x11606
mov ecx, esi
call fcn.00418410
push 0x624ff8
push 0x11607
mov ecx, esi
call fcn.00418410
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005a7b5f
mov esp, ebp
pop ebp
ret
Function at 0x4374a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d83f3
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x659fd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], edx
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4374dd
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x437600
push ebx
call fcn.005b4418
mov edi, eax
add esp, 4
test edi, edi
je 0x437600
cmp dword [esi + 0x14], 8
jb 0x43750d
mov esi, dword [esi]
push edi
push ebx
push dword [ebp - 0x2c]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4375f7
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x62a0f8
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4375f7
sub esp, 8
lea ecx, [ebp - 0xec]
call fcn.00413c70
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
lea ecx, [ebp - 0xdc]
push eax
call fcn.0042f1c0
mov edx, 0x628254
mov ecx, eax
call fcn.00410580
mov ecx, eax
call fcn.0042f1c0
mov edx, 0x628254
mov ecx, eax
call fcn.00410580
mov ecx, eax
call fcn.0042f1c0
mov edx, 0x628254
mov ecx, eax
call fcn.00410580
mov ecx, eax
call fcn.0042f1c0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xd4]
call fcn.00414520
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 1
call fcn.0040a6f2
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.004076c4
push edi
call fcn.005b1e01
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec]
call fcn.004138a0
mov al, 1
jmp 0x437602
push edi
call fcn.005b1e01
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a7b5f
mov esp, ebp
pop ebp
ret