joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4192f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x419348
cmp dword [esi + 0x18], 0
je 0x419348
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041ac10
add esp, 8
test eax, eax
jne 0x419350
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x419330
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x419360
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x4193b8
cmp dword [esi + 0x18], 0
je 0x4193b8
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041ac10
add esp, 8
test eax, eax
jne 0x4193c0
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x4193a0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x419470
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
test edx, edx
je 0x4194b4
cmp dword [eax + 0x18], 0
je 0x4194b4
mov eax, dword [eax]
inc ecx
cmp ecx, edx
jb 0x4194a7
mov esp, ebp
pop ebp
ret

Function at 0x4194c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.00419d10
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
cmp dword [esi + 0x18], 0
je 0x41954b
mov edi, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x30]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0041a330
lea edx, [ebp - 0x10c]
push edx
push edi
call fcn.00413dc0
add esp, 0x10
test eax, eax
jne 0x419553
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x419520
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4199c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4199ce
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4199ca
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x4199ca
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret

Function at 0x419a40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x419a64
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x419a64
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x419a6c
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebp + 8]
push esi
inc edx
push edx
push eax
call fcn.00419e40
mov ecx, dword [ebx + 0x50]
mov esi, eax
push ecx
push esi
call fcn.00419cc0
mov edx, dword [ebx + 0x54]
push edx
push edi
push esi
call fcn.00419c90
xor edx, edx
xor eax, eax
add esp, 0x1c
mov dword [ebp - 4], edx
cmp ax, word [ebx + 6]
jae 0x419afe
mov dword [ebp + 0xc], edx
jmp 0x419aa9
xor edx, edx
mov ecx, dword [edi + 0x3c]
add ecx, dword [ebp + 0xc]
lea eax, [ecx + esi + 0xf8]
mov ecx, dword [eax + 0x10]
cmp ecx, edx
jne 0x419ac0
mov dword [eax + 0x14], edx
mov edx, dword [eax + 8]
cmp ecx, edx
jbe 0x419ad6
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, edi
push edx
add eax, esi
push eax
jmp 0x419ae3
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x14]
add ecx, edi
push ecx
add edx, esi
push edx
call fcn.00419c90
mov eax, dword [ebp - 4]
movzx ecx, word [ebx + 6]
add dword [ebp + 0xc], 0x28
inc eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x419aa7
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419b10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x419b30
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x419b30
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x419b34
xor eax, eax
pop ebp
ret
mov eax, dword [eax + ecx + 0x2c]
add eax, ecx
pop ebp
ret

Function at 0x419bb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x419bd0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x419bd0
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x419bd4
xor eax, eax
pop ebp
ret
mov eax, dword [eax + edx + 0x28]
test eax, eax
je 0x419bd0
add eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x41a8f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x41ab2c
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.00419d10
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x41aabc
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x41aab2
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.00409a10
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x41aadd
inc eax
cmp byte [esi + eax], 0
jne 0x41aad6
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.00419c90
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x41aafa
inc edi
cmp byte [edi + ebx], 0
jne 0x41aaf3
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x41ab0a
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x41ab02
test esi, esi
je 0x41ab1f
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.00419ce0
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401190
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4011a9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4011e4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4011e0
lea ebx, [ebx]
cmp esi, eax
jae 0x4011e4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4011d0
cmp esi, eax
jb 0x4011ea
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x404180
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x32c
mov eax, dword [0x46be4c]
xor eax, esp
mov dword [esp + 0x328], eax
push ebx
mov ebx, dword [esp + 0x338]
push esi
push edi
mov edi, dword [esp + 0x33c]
push str.PrinterDriverData
xor eax, eax
push edi
push str.SystemCurrentControlSetControlPrintPrinters
mov dword [esp + 0x2c], eax
mov byte [esp + 0x30], al
lea eax, [esp + 0x34]
push 0x45c79c
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x14
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x34]
push edx
push 0x80000002
call esi
test eax, eax
je 0x404279
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetControlPrintPrinters
push 0x80000002
call esi
test eax, eax
jne 0x404318
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push eax
push edi
push edx
call esi
test eax, eax
je 0x404246
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x404318
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
push str.PrinterDriverData
push edx
call esi
test eax, eax
je 0x404279
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
jmp 0x404316
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push str.PrinterID
push edx
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], 3
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x4042fb
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov cl, byte [esp + 0x24]
mov dword [ebx], eax
push edx
mov byte [ebx + 4], cl
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4042d3
push eax
call esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4042de
push eax
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x328]
xor ecx, esp
call fcn.0044027a
add esp, 0x32c
ret
mov eax, dword [esp + 0x14]
push eax
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40430d
push eax
call esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x404318
push eax
call esi
mov ecx, dword [esp + 0x334]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0044027a
add esp, 0x32c
ret
Function at 0x404340
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x30
mov eax, dword [0x46be4c]
xor eax, esp
mov dword [esp + 0x2c], eax
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.EnumRootPrinter
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40437e
xor eax, eax
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0044027a
add esp, 0x30
ret
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push edi
xor edi, edi
push edi
push edi
push edi
push edi
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x20]
push edi
push eax
mov dword [esp + 0x2c], 0x10
call ebp
test eax, eax
jne 0x4044b8
push ebx
mov ebx, dword [esp + 0x40]
push esi
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push 0xf003f
push 0
lea edx, [esp + 0x38]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40445e
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], eax
mov byte [esp + 0x30], al
lea eax, [esp + 0x28]
push eax
push 0
push str.PrinterID
push ecx
mov dword [esp + 0x34], 4
mov dword [esp + 0x38], 3
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404453
mov dl, byte [esp + 0x24]
cmp dl, byte [ebx]
mov esi, dword [esp + 0x1c]
jne 0x40444b
mov ecx, ebx
lea edx, [esp + 0x24]
sub ecx, edx
cmp eax, esi
jge 0x40444d
mov bl, byte [esp + eax + 0x25]
add eax, 1
lea edx, [ecx + eax]
cmp bl, byte [esp + edx + 0x24]
je 0x404437
cmp eax, esi
je 0x40449b
mov ebx, dword [esp + 0x44]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push eax
push eax
push eax
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x40]
push edx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x28]
add edi, 1
push edi
push eax
mov dword [esp + 0x34], 0x10
call ebp
test eax, eax
je 0x4043c6
jmp 0x4044b6
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop esi
pop ebx
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x34]
pop edi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.0044027a
add esp, 0x30
ret
Function at 0x404a10
Capabilities:
Get file version info

Disassembly:
sub esp, 0x94
mov eax, dword [0x46be4c]
xor eax, esp
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x9c]
push ebp
push esi
push edi
mov edi, dword [esp + 0xa4]
lea ecx, [esp + 0x14]
push ecx
xor ebp, ebp
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebp
jne 0x404a6a
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.0044027a
add esp, 0x94
ret
push ebx
lea edx, [esi + 0x64]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
cmp ebx, ebp
jne 0x404a84
xor eax, eax
jmp 0x404b66
push ebx
push esi
push ebp
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x404b5d
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueA
cmp dword [esp + 0x14], 4
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
jne 0x404ae3
mov eax, dword [esp + 0x10]
movzx edx, byte [eax + 2]
movzx ecx, byte [eax + 3]
push edx
movzx edx, byte [eax]
movzx eax, byte [eax + 1]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
push str.StringFileInfo_02x_02x_02x_02x_
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
jmp 0x404aef
push str.StringFileInfo040904e4_
lea edx, [esp + 0x24]
push edx
call esi
push str.ProductVersion
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueA
cmp dword [esp + 0x14], ebp
je 0x404b5d
cmp dword [esp + 0xb0], 1
jne 0x404b4c
mov ecx, dword [esp + 0x10]
push 0x2e
push ecx
call fcn.00442520
add esp, 8
cmp eax, ebp
je 0x404b4c
add eax, 1
push 0x2e
push eax
call fcn.00442520
add esp, 8
cmp eax, ebp
je 0x404b4c
mov byte [eax], 0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
push edx
push eax
call esi
mov ebp, 1
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebp
mov ecx, dword [esp + 0xa0]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0044027a
add esp, 0x94
ret
Function at 0x404b80
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x26c
mov eax, dword [0x46be4c]
xor eax, esp
mov dword [esp + 0x268], eax
push 0x104
lea eax, [esp + 0x168]
push 0
push eax
call fcn.004413c0
add esp, 0xc
push str.SOFTWARECanonVDCSETUP
lea ecx, [esp + 0x168]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp]
push edx
push 0x20019
push 0
lea eax, [esp + 0x170]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404c17
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push str.Path
push ecx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x404c2e
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.0044027a
add esp, 0x26c
ret
mov eax, dword [esp]
push ebx
push esi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x44
lea ecx, [esp + 0x2c]
push 0
push ecx
call fcn.004413c0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0xc
xor eax, eax
push 0x45c6ec
lea edx, [esp + 0x70]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x5c], 1
mov word [esp + 0x60], ax
call esi
push str.AuVdc.exe
lea eax, [esp + 0x70]
push eax
call esi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push str.__remove
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x18]
push ecx
mov edi, eax
call ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x404ce7
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push esi
call ebx
mov ecx, dword [esp + 0x274]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044027a
add esp, 0x26c
ret
Function at 0x404f90
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x858
mov eax, dword [0x46be4c]
xor eax, esp
mov dword [esp + 0x854], eax
push esi
push edi
mov edi, dword [esp + 0x864]
push 0x200
lea eax, [esp + 0x60]
push 0
push eax
call fcn.004413c0
push 0x200
lea ecx, [esp + 0x26c]
push 0
push ecx
call fcn.004413c0
add esp, 0x18
push 0x200
lea edx, [esp + 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push str.cmd.exe
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x264]
push 0x45ccb8
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x44
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.004413c0
push edi
push str._C_net_stop___s___Y
lea ecx, [esp + 0x480]
push 0x400
push ecx
mov dword [esp + 0x44], 0x44
mov word [esp + 0x74], 0
mov dword [esp + 0x70], 1
call fcn.004424d5
add esp, 0x2c
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x47c]
push ecx
lea edx, [esp + 0x280]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
test esi, esi
je 0x4050c9
mov eax, dword [esp + 8]
push ebx
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call ebx
push str.SPOOLER
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
pop ebx
jne 0x4050c7
call fcn.004316f5
mov eax, dword [eax + 4]
mov dword [eax + 0x4f4], 1
mov eax, esi
mov ecx, dword [esp + 0x85c]
pop edi
pop esi
xor ecx, esp
call fcn.0044027a
add esp, 0x858
ret

Function at 0x4050e0
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push esi
push 0x104
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov esi, eax
test esi, esi
jne 0x405102
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop esi
add esp, 8
ret
mov ecx, dword [esp + 0x10]
push edi
lea eax, [esp + 8]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edx, dword [esp + 8]
push esi
push edx
mov edi, eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jne 0x40512e
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
pop edi
jne 0x405172
cmp dword [esp + 4], 0
je 0x405172
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x405172
mov eax, dword [esp + 8]
test eax, eax
je 0x405172
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x405180
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x821c
call fcn.00441390
mov eax, dword [0x46be4c]
xor eax, esp
mov dword [esp + 0x8218], eax
mov eax, dword [str.wininit.ini]
mov ecx, dword [0x45cce0]
mov edx, dword [0x45cce4]
push ebx
push esi
mov esi, dword [esp + 0x8228]
push edi
mov edi, dword [esp + 0x8230]
mov dword [esp + 0xc], eax
push esi
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x45ccd8
lea ecx, [esp + 0x1c]
push ecx
call ebx
push edi
lea edx, [esp + 0x1c]
push edx
call ebx
lea eax, [esp + 0xc]
push eax
push 0x7fff
lea ecx, [esp + 0x22c]
push ecx
push str.RENAME
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov ebx, eax
test ebx, ebx
jbe 0x4052b4
xor edi, edi
cmp byte [esp + 0x224], 0
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
je 0x405258
lea esi, [esp + 0x228]
lea ecx, [ecx]
push esi
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4052ad
push esi
call ebp
lea edi, [edi + eax + 1]
cmp byte [esp + edi + 0x228], 0
lea esi, [esp + edi + 0x228]
jne 0x405230
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + ebx + 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x1c]
push edx
call ebp
add eax, ebx
mov byte [esp + eax + 0x229], 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x22c]
push ecx
push str.rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8218]
xor ecx, esp
call fcn.0044027a
add esp, 0x821c
ret
mov eax, 1
jmp 0x405294
lea edx, [esp + 0xc]
push edx
push edi
push esi
push str.RENAME
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [esp + 0x8224]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044027a
add esp, 0x821c
ret