joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407bc0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x260
mov eax, dword [0x435280]
xor eax, esp
mov dword [esp + 0x25c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x26c]
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x6e]
push ecx
mov word [esp + 0x70], ax
call fcn.004150b0
add esp, 0xc
cmp dword [0x43868c], 0
mov dword [esp + 0x10], 0
je 0x407c26
mov eax, dword [0x438688]
test eax, eax
je 0x407c26
push str.hpqUnRegisterBIOSEvent
push str._S_Started
push eax
call fcn.00425500
add esp, 0xc
lea eax, [esp + 0x64]
mov edi, str.SoftwareHewlett_Packard_
mov ecx, eax
mov edx, 0x104
sub edi, ecx
jmp 0x407c40
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x407c60
movzx ecx, word [edi + eax]
test cx, cx
je 0x407c60
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x407c40
jmp 0x407c64
test edx, edx
jne 0x407c67
sub eax, 2
xor edx, edx
push str.0018752E_7735_4B30_9DA9_4A01F024F270
mov word [eax], dx
push 0x104
lea eax, [esp + 0x6c]
push eax
call fcn.00401050
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [esp + 0x80]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x407cc6
mov ecx, dword [esp + 0x10]
push ebp
push ecx
call ebx
test eax, eax
je 0x407ccd
mov edx, dword [esp + 0x10]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
push 0
call esi
mov edx, 0x104
lea eax, [esp + 0x64]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x407d01
movzx ecx, word [edi + eax]
test cx, cx
je 0x407d01
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x407ce1
jmp 0x407d05
test edx, edx
jne 0x407d08
sub eax, 2
xor edx, edx
push str.0018752E_7735_4B30_9DA9_4A01F024F270
mov word [eax], dx
push 0x104
lea eax, [esp + 0x6c]
push eax
call fcn.00401050
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
lea edx, [esp + 0x70]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov esi, eax
test esi, esi
jne 0x407db0
push 0x3e
push eax
lea ecx, [esp + 0x2e]
push ecx
mov dword [esp + 0x20], 0x20
mov word [esp + 0x30], ax
call fcn.004150b0
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
push esi
push esi
push esi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x38]
push ecx
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, 0x103
jne 0x407db0
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SoftwareHewlett_Packard_
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, dword [esp + 0x10]
push str.0018752E_7735_4B30_9DA9_4A01F024F270
push ecx
call ebx
mov esi, eax
cmp dword [0x43868c], 0
je 0x407dd6
mov eax, dword [0x438688]
test eax, eax
je 0x407dd6
push esi
push str.hpqUnRegisterBIOSEvent
push str._S_Completed_lRet:__ld_
push eax
call fcn.00425500
add esp, 0x10
mov ecx, dword [esp + 0x26c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004149ce
add esp, 0x260
ret
Function at 0x4149ce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x435280]
jne 0x4149d8
repz ret
jmp fcn.00417a7c

Function at 0x41dd0f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041746a
and dword [ebp - 4], 0
cmp dword [0x43b390], 0
mov ebx, eax
jne 0x41ddc0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41de71
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41de71
push eax
call fcn.004173f8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43b390], eax
call esi
push eax
call fcn.004173f8
mov dword [esp], 0x42bd80
push edi
mov dword [0x43b394], eax
call esi
push eax
call fcn.004173f8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43b398], eax
call esi
push eax
call fcn.004173f8
pop ecx
mov dword [0x43b3a0], eax
test eax, eax
je 0x41ddc0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004173f8
pop ecx
mov dword [0x43b39c], eax
mov eax, dword [0x43b39c]
cmp eax, ebx
je 0x41de18
cmp dword [0x43b3a0], ebx
je 0x41de18
push eax
call fcn.00417473
push dword [0x43b3a0]
mov esi, eax
call fcn.00417473
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41de18
test edi, edi
je 0x41de18
call esi
test eax, eax
je 0x41de0f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41de0f
test byte [ebp - 0xc], 1
jne 0x41de18
or dword [ebp + 0x10], 0x200000
jmp 0x41de51
mov eax, dword [0x43b394]
cmp eax, ebx
je 0x41de51
push eax
call fcn.00417473
pop ecx
test eax, eax
je 0x41de51
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41de51
mov eax, dword [0x43b398]
cmp eax, ebx
je 0x41de51
push eax
call fcn.00417473
pop ecx
test eax, eax
je 0x41de51
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43b390]
call fcn.00417473
pop ecx
test eax, eax
je 0x41de71
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41de73
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x424f30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0x20]
or eax, 0xf003f
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x424f75
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x424f9e
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x424fb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x20]
or edx, 0x20019
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x424fe5
mov eax, dword [ebp - 8]
jmp 0x42501b
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42500f
mov eax, dword [ebp - 8]
jmp 0x42501b
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x425500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x435280]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x42563b
mov dword [ebp - 4], 0
push str.a_ccsUTF_8
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
push edx
lea eax, [ebp - 4]
push eax
call fcn.00423b06
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x42563b
xor ecx, ecx
mov word [ebp - 0x418], cx
push 0x40e
push 0
lea edx, [ebp - 0x416]
push edx
call fcn.004150b0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x838], ax
push 0x40e
push 0
lea ecx, [ebp - 0x836]
push ecx
call fcn.004150b0
add esp, 0xc
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x208
lea eax, [ebp - 0x838]
push eax
call fcn.004010b0
lea ecx, [ebp - 0x838]
push ecx
movzx edx, word [ebp - 0x41a]
push edx
movzx eax, word [ebp - 0x41c]
push eax
movzx ecx, word [ebp - 0x41e]
push ecx
movzx edx, word [ebp - 0x420]
push edx
movzx eax, word [ebp - 0x422]
push eax
movzx ecx, word [ebp - 0x426]
push ecx
movzx edx, word [ebp - 0x428]
push edx
push str.__04d__02d__02d__02d:_02d:_02d._03d___s_n
push 0x208
lea eax, [ebp - 0x418]
push eax
call fcn.00401100
add esp, 0x2c
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x418]
push edx
call fcn.00415b19
add esp, 4
push eax
push 2
lea eax, [ebp - 0x418]
push eax
call fcn.00423cbb
add esp, 0x10
mov dword [ebp - 0x83c], eax
mov edx, dword [ebp - 4]
push edx
call fcn.00420a27
add esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004149ce
mov esp, ebp
pop ebp
ret
Function at 0x401895
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push esi
jmp 0x4018a3
push 0x40189e
push 0x12c
push 0
call sub.KERNEL32.dll_FindResourceA
push eax
push 0
call sub.KERNEL32.dll_LoadResource
push eax
call sub.KERNEL32.dll_LockResource
mov esi, eax
push 0
push 0
push 0
call sub.KERNEL32.dll_HeapCreate
or eax, eax
jne 0x4018ec
push 0
push 0x404063
push 0x4040b3
push dword [ebp + 8]
call sub.USER32.dll_MessageBoxA
pop esi
leave
ret 4
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
push eax
push 8
push dword [ebp - 0xc]
call sub.KERNEL32.dll_HeapAlloc
or eax, eax
jne 0x401911
push dword [ebp - 0xc]
call sub.KERNEL32.dll_HeapDestroy
pop esi
leave
ret 4
mov dword [ebp - 8], eax
add esi, 8
push dword [ebp - 8]
push esi
call fcn.00402090
add esp, 8
push dword [ebp - 8]
push 0
push 0xc
push 0x7d1
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
push dword [ebp - 0xc]
call sub.KERNEL32.dll_HeapDestroy
pop esi
leave
ret 4

Function at 0x401944
Capabilities:
Copy file
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
call fcn.00401844
test eax, eax
jne 0x401aeb
push 0x80
push 0x404278
call sub.KERNEL32.dll_GetSystemDirectoryA
or eax, eax
je 0x401990
cmp byte [eax + 0x404277], 0x5c
je 0x401990
cmp byte [eax + 0x404278], 0
jne 0x401990
mov byte [eax + 0x404278], 0x5c
mov byte [eax + 0x404279], 0
push 0x404278
push 0x4042f8
call sub.KERNEL32.dll_lstrcpyA
push str.ImeRovasoftWBJJ_
push 0x4042f8
call sub.KERNEL32.dll_lstrcatA
cmp byte [0x404578], 1
jne 0x4019bc
call fcn.00401af0
mov cl, byte [0x404579]
mov ch, byte [0x40457a]
or cl, ch
or cl, cl
je 0x401a4a
cmp byte [0x40457b], 1
jne 0x401a41
push 0x4042f8
lea eax, [ebp - 0x80]
push eax
call sub.KERNEL32.dll_lstrcpyA
jmp 0x4019ec
jmp 0x4019f6
push 0x4019ee
lea eax, [ebp - 0x80]
push eax
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x100]
push eax
call sub.KERNEL32.dll_lstrcpyA
push 0x4019e7
lea eax, [ebp - 0x100]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x80]
push eax
call sub.KERNEL32.dll_CopyFileA
push 0x8f
call sub.KERNEL32.dll_Sleep
mov byte [0x40457b], 1
jmp 0x401a51
mov byte [0x40457b], 0
or eax, eax
je 0x401ab3
push 0x404278
lea eax, [ebp - 0x80]
push eax
call sub.KERNEL32.dll_lstrcpyA
jmp 0x401a69
push 0x401a65
lea eax, [ebp - 0x80]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0
lea eax, [ebp - 0x80]
push eax
call sub.KERNEL32.dll_CreateDirectoryA
jmp 0x401a8e
push 0x401a84
lea eax, [ebp - 0x80]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0
lea eax, [ebp - 0x80]
push eax
call sub.KERNEL32.dll_CreateDirectoryA
push 0
push 0x4042f8
call sub.KERNEL32.dll_CreateDirectoryA
mov byte [ebp - 0x80], 0
push 0x4042f8
lea eax, [ebp - 0x80]
push eax
call sub.KERNEL32.dll_lstrcpyA
push str.Wbczu.dat
lea eax, [ebp - 0x80]
push eax
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp - 0x80]
push eax
call sub.KERNEL32.dll_DeleteFileA
call fcn.00401d00
call fcn.00401ec9
mov eax, 0x40412c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401d87
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [ebp - 4], ecx
movzx eax, byte [0x40457a]
test eax, eax
je 0x401dac
mov edx, dword [esi + 0x38]
mov dword [esi + 0x34], edx
xor ecx, ecx
movzx eax, byte [0x40457b]
test eax, eax
setne cl
mov edx, dword [esi + 0x34]
lea edx, [edx + esi + 0x10]
mov word [edx], cx
xor ebx, ebx
mov eax, dword [esi + ebx*4 + 4]
lea edi, [eax + esi]
mov eax, dword [edi]
lea eax, [eax + edi]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 8]
mov dword [0x4041d3], eax
mov eax, dword [edi + 0xc]
mov dword [0x4041d7], eax
mov ax, word [edi + 0x10]
mov word [ebp - 0x12], ax
mov ax, word [edi + 0x12]
mov word [ebp - 0x9e], ax
lea eax, [edi + 0x14]
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0x10]
cmp word [ebp - 0x9e], 0
je 0x401e18
mov ecx, 0x404278
jmp 0x401e1d
mov ecx, 0x4042f8
push ecx
lea eax, [ebp - 0x92]
push eax
call sub.KERNEL32.dll_lstrcpyA
push dword [ebp - 0xc]
lea eax, [ebp - 0x92]
push eax
call sub.KERNEL32.dll_lstrcatA
cmp word [ebp - 0x12], 0
jne 0x401e47
mov edx, 1
jmp 0x401e4c
mov edx, 2
push 0
push 0x80
push edx
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x92]
push eax
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x401eb6
mov dword [ebp - 0x98], eax
push 0
lea eax, [ebp - 0x9c]
push eax
push dword [ebp - 8]
push edi
push dword [ebp - 0x98]
call sub.KERNEL32.dll_WriteFile
push dword [ebp - 0x98]
call sub.KERNEL32.dll_FlushFileBuffers
push 0x4041d3
push 0
push 0
push dword [ebp - 0x98]
call sub.KERNEL32.dll_SetFileTime
push dword [ebp - 0x98]
call sub.KERNEL32.dll_CloseHandle
inc ebx
cmp ebx, dword [ebp - 4]
jl 0x401dc6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x401ec9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push esi
push edi
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallWBJJ
push 0x80000002
call sub.ADVAPI32.dll_RegCreateKeyExA
or eax, eax
jne 0x401f66
push str.WbjjUninst.exe
push 0x4042f8
call sub.KERNEL32.dll_lstrcatA
push 0x4042f8
call sub.KERNEL32.dll_lstrlenA
mov dword [ebp - 0x8c], eax
push 0x11
push 0x4041a3
push 1
push 0
push str.DisplayName
push dword [ebp - 0x84]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [ebp - 0x8c]
push 0x4042f8
push 1
push 0
push str.UninstallString
push dword [ebp - 0x84]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [ebp - 0x84]
call sub.ADVAPI32.dll_RegCloseKey
mov esi, 0x404278
lea edi, [ebp - 0x80]
push esi
push edi
call sub.KERNEL32.dll_lstrcpyA
push str.Wbjju.ime
push edi
call sub.KERNEL32.dll_lstrcatA
push 0x40401b
lea eax, [ebp - 0x80]
push eax
call sub.IMM32.dll_ImmInstallIMEA
cmp eax, 0xffffffff
je 0x401f9a
mov eax, 0x40412c
jmp 0x401f9f
mov eax, 0x40414d
pop edi
pop esi
leave
ret
Function at 0x402090
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x4020ab
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x40209c
add dl, dl
jne 0x4020b6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x402102
xor eax, eax
add dl, dl
jne 0x4020c3
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4021a4
add dl, dl
jne 0x4020d2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4020dd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4020e8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4020f3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4020fd
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x4020a2
mov eax, 1
add dl, dl
jne 0x402110
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x40211b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x402107
sub eax, 2
jne 0x40214c
mov ecx, 1
add dl, dl
jne 0x402132
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x40213d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x402129
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4020a2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x402163
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x40216e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x40215a
cmp eax, 0x7d00
jae 0x402191
cmp eax, 0x500
jb 0x40218c
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4020a2
cmp eax, 0x7f
ja 0x402197
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4020a2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4021c0
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4020a2
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x41083b
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x41088e
push esi
push dword [ebp + 8]
call fcn.00410a21
mov edi, eax
test edi, edi
je 0x410889
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x410889
mov eax, dword [ebp - 8]
jmp 0x4108a0
mov eax, dword [ebp + 0x10]
jmp 0x4108a0
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
leave
ret 0xc

Function at 0x4126cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x412716
call fcn.00416302
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x412713
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x412766
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x412743
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5739c8]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x412743
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x412764
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call dword [0x5739c8]
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x418518
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x41855d
call fcn.00416302
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41855d
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x418579
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004b17dc
mov ebx, eax
test edi, edi
je 0x418577
test esi, esi
je 0x418577
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x418f94
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x419052
cmp dword [esi + 0x20], 0
je 0x419052
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x419052
cmp dword [ebp + 8], 0
je 0x419052
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.00416302
push 0x575b70
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x419023
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x419052
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.004b227d
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x419043
test edi, edi
je 0x419043
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x41904e
mov ecx, esi
call fcn.00418d34
mov eax, ebx
jmp 0x419054
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41d9f2
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x565676
call fcn.00547f67
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x41da18
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41da78
call fcn.0041f29e
push eax
lea ecx, [ebp - 0x10]
call fcn.00402c23
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x5739c8]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00550306
push eax
call fcn.00403361
add esp, 0x14
test esi, esi
je 0x41da6b
push esi
call fcn.0054cb10
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040b2b9
mov eax, ebx
call fcn.00547f30
ret 8

Function at 0x426c36
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push edi
test esi, esi
jne 0x426c50
call fcn.00416302
mov esi, dword [eax + 0xc]
push 0x5761e4
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x426ca6
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x426ca6
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x426c85
xor esi, esi
jmp 0x426c9b
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00426caf
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
jmp 0x426ca8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8