joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x402c00
pop dword [ebp - 0x2c]
mov eax, 0x4f0b938e
add eax, 0xb1349872
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xdd16bd7a
sub dword [ebp - 0x3c], 0x8ec4782f
mov dword [ebp - 0x38], 0xa83c8791
sub dword [ebp - 0x38], 0x76093b4c
mov dword [ebp - 0x34], 0x8e764ddc
sub dword [ebp - 0x34], 0x422a09ae
mov dword [ebp - 0x30], 0x7459ab00
sub dword [ebp - 0x30], 0x7459ab00
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x740bd256
sub eax, 0x73cb61f2
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x90ed4b1e
add dword [ebp - 0x3c], 0xe3851e38
mov dword [ebp - 0x38], 0x260678c8
add dword [ebp - 0x38], 0x1b65e8ad
mov dword [ebp - 0x34], 0xbab87af3
add dword [ebp - 0x34], 0xa8b6f179
mov dword [ebp - 0x30], 0xcefe8df4
sub dword [ebp - 0x30], 0xcefe8df4
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x747c5f71
add eax, 0x8bc41137
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x38fde
push 0
call eax
mov ecx, 0x5136
mov ebx, eax
mov esi, 0x410000
add esi, dword [ebp - 0x2c]
mov edi, 0x373d64c3
add edi, 0x2dfa1feb
xor dword [ebp - 0x18], 0x844617d5
mov edx, dword [esi]
mov dword [ebp - 4], 0xea704f6a
xor edx, edi
sub dword [ebp - 0xc], ebx
mov dword [ebx], edx
sub dword [ebp - 0x10], 0xc832e86f
add ebx, 0xbc567479
sub ebx, 0xbc567475
add esi, 0xa71bd9d1
add esi, 0x58e42633
loop 0x402d16
add eax, 0x137ab
mov ebx, eax
add eax, 5
mov ecx, 0x467ee0ed
sub ecx, 0x463ee0ed
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x1018a20d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1018a24c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1018a24c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1018a24c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1018a24c
cmp dword [ecx + 0x74], 0xe
jbe 0x1018a24c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1018cefd
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1018cf9a
push ebx
push esi
call fcn.1018cec6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1018ce5a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1018cf47
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1018cf99
push edi
push eax
call fcn.1018ae9d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1018cf67
call fcn.1018aeeb
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1018cf98
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1018ce5a
add esp, 0x20
test eax, eax
jne 0x1018cf86
push edi
call fcn.1018aeeb
jmp 0x1018cf8e
push ebx
call fcn.1018aeeb
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1018d207
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10194958
push 0x10194950
push str.FlsAlloc
push 0x1f
call fcn.1018d123
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1018d23b
push dword [ebp + 8]
mov ecx, esi
call dword [0x10193120]
call esi
jmp 0x1018d241
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1018d285
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10194968
push 0x10194960
push str.FlsGetValue
push 0x21
call fcn.1018d123
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1018d2bc
push dword [ebp + 8]
mov ecx, esi
call dword [0x10193120]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1018d2c4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10194970
push 0x10194968
push str.FlsSetValue
push 0x22
call fcn.1018d123
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1018d2fe
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10193120]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10192930
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1019295d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1019295d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401310
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x70
lea eax, [esp]
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
push eax
push 0x20019
push 0
push str.SOFTWARELXSUPMON
push 0x80000002
call ebp
test eax, eax
jne 0x401469
lea ecx, [esp + 0x14]
lea edx, [esp + 0x4c]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.UserWantsToBeReminded
push eax
mov dword [esp + 0x2c], 0x32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40145e
mov edx, dword [0x488e90]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x18]
push 0x32
push ecx
push 0x34
push edx
call edi
lea esi, [esp + 0x18]
lea eax, [esp + 0x4c]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4013b1
test cl, cl
je 0x4013ad
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4013b1
add eax, 2
add esi, 2
test cl, cl
jne 0x401389
xor eax, eax
jmp 0x4013b6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4013cf
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
mov edx, dword [0x488e90]
lea ecx, [esp + 0x18]
push 0x32
push ecx
push 0x3a
push edx
call edi
lea esi, [esp + 0x18]
lea eax, [esp + 0x4c]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x401411
test cl, cl
je 0x40140d
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x401411
add eax, 2
add esi, 2
test cl, cl
jne 0x4013e9
xor eax, eax
jmp 0x401416
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40145e
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push ecx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call ebp
test eax, eax
jne 0x40145e
mov edx, dword [esp + 0x10]
push str.LXSUPMON
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x70
ret

Function at 0x401480
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SOFTWARELXSUPMON
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4014de
lea ecx, [esp + 8]
lea edx, [esp + 4]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.TimerOverride
push eax
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4014d3
mov dword [esp + 4], 0
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 0xc
ret
Function at 0x403020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov ecx, dword [0x488e90]
push ebx
push esi
push 0x105
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, dword [0x488e90]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403199
push edi
mov ax, word [esi + 0x12]
push ebp
mov ebp, dword [esi + 0xa]
add ebp, esi
mov cx, word [esi + 0x16]
add esi, 0xe
mov edi, dword [esp + 0x3c]
mov word [esp + 0x14], ax
mov eax, dword [0x426b20]
test eax, eax
mov word [esp + 0x10], cx
jne 0x40311e
lea ecx, [esi + 0x28]
xor eax, eax
mov ebx, dword [0x426b1c]
mov dl, byte [ecx + 2]
add ecx, 4
mov byte [ebx + eax + 4], dl
mov ebx, dword [0x426b1c]
mov dl, byte [ecx - 4]
mov byte [ebx + eax + 6], dl
mov ebx, dword [0x426b1c]
mov dl, byte [ecx - 3]
mov byte [ebx + eax + 5], dl
mov edx, dword [0x426b1c]
mov ebx, 1
mov byte [edx + eax + 7], bl
add eax, 4
cmp eax, 0x400
jl 0x403093
mov ecx, dword [0x426b1c]
mov al, 0xff
mov byte [ecx + 6], al
mov edx, dword [0x426b1c]
mov byte [edx + 5], al
mov ecx, dword [0x426b1c]
mov byte [ecx + 4], al
mov edx, dword [0x426b1c]
push edx
call dword [sym.imp.GDI32.dll_CreatePalette]
push 0
push eax
push edi
mov dword [0x426b10], eax
mov dword [0x426b20], ebx
call dword [sym.imp.GDI32.dll_SelectPalette]
mov ebx, dword [esp + 0x30]
mov dword [0x426b14], eax
mov eax, dword [0x426b10]
push 0
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectPalette]
push edi
call dword [sym.imp.GDI32.dll_RealizePalette]
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x18], eax
add eax, edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x1c], ecx
add ecx, eax
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_MapDialogRect]
movsx eax, word [esp + 0x10]
push 0
push esi
push ebp
push eax
mov ecx, dword [esp + 0x2c]
push 0
mov edx, dword [esp + 0x2c]
push 0
push 0
push eax
movsx eax, word [esp + 0x34]
push eax
push ecx
push edx
push edi
call dword [sym.imp.GDI32.dll_SetDIBitsToDevice]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x403400
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x160
mov al, byte [0x426b5c]
push ebx
push esi
push edi
mov byte [esp + 0x6c], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x6d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov cx, word [0x423208]
mov dl, byte [0x42320a]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov word [esp + 0x10], cx
stosb byte es:[edi], al
lea eax, [esp + 0x18]
mov byte [esp + 0x12], dl
push eax
push str..htm
push 0x80000000
call ebx
test eax, eax
jne 0x40356a
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea edx, [esp + 0x20]
push ecx
push edx
push 0x426b5c
push eax
mov dword [esp + 0x20], 0x50
call ebp
test eax, eax
jne 0x40355e
mov edi, str._shellopencommand
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x20]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
push 0x80000000
call ebx
test eax, eax
jne 0x40355e
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push eax
push 0x426b5c
push ecx
mov dword [esp + 0x20], 0x50
call ebp
test eax, eax
jne 0x403553
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x403553
lea edx, [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
call fcn.00417a50
add esp, 8
test eax, eax
je 0x403523
lea ecx, [esp + 0x20]
lea edx, [esp + 0x20]
sub eax, ecx
dec eax
push eax
lea eax, [esp + 0x74]
push edx
push eax
call fcn.00417bd0
add esp, 0xc
mov edi, dword [esp + 0x174]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x70]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
lea edi, [esp + 0x6c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x427140
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x160
ret
Function at 0x4069f0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x427108]
sub esp, 0x100
push ebx
push ebp
push esi
xor ebx, ebx
xor esi, esi
cmp eax, ebx
push edi
jne 0x406a78
lea eax, [esp + 0x10]
push 0x100
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.LEXBCE.DLL
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ecx, ecx
cmp eax, ebx
sete cl
cmp cx, bx
mov dword [0x427108], eax
je 0x406a73
mov eax, ecx
and eax, 0xffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
mov esi, 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.BceSendBidi
push eax
call ebp
cmp word [0x427104], bx
mov edi, eax
jne 0x406ad9
mov ecx, dword [esp + 0x130]
mov edx, dword [esp + 0x118]
push ecx
push edx
call fcn.00406b80
mov esi, eax
add esp, 8
cmp si, bx
je 0x406ad4
mov eax, dword [0x427108]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov dword [0x427108], ebx
and eax, 0xffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
mov esi, 1
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x124]
and ecx, 0xffff
push ecx
mov ecx, dword [esp + 0x124]
push edx
mov edx, dword [esp + 0x124]
push eax
push ecx
movsx ecx, word [0x427104]
and edx, 0xffff
xor eax, eax
mov ax, word [0x427106]
push edx
push ebx
push eax
push ecx
call edi
cmp esi, ebx
mov edi, eax
je 0x406b60
mov edx, dword [0x427108]
push str.BceUnregisterApp
push edx
call ebp
movsx ecx, word [0x427104]
push ecx
call eax
mov edx, dword [0x427108]
mov word [0x427104], bx
push edx
mov word [0x427106], bx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x427108], ebx
mov eax, edi
pop edi
pop esi
pop ebp
and eax, 0xffff
pop ebx
add esp, 0x100
ret
Function at 0x406b80
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x427108]
sub esp, 0x2a8
test eax, eax
push ebx
push esi
push edi
je 0x406c6c
cmp word [0x427104], 0
je 0x406bac
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x2a8
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.BceRegisterApp
push eax
call esi
mov edi, eax
mov eax, dword [0x427108]
push str.BceRegisterWithRpcServer
push eax
call esi
mov ecx, dword [0x427108]
push str.BceEnumSpecificPort
push ecx
call esi
mov edx, dword [0x427108]
push str.BceEnumByUNC
push edx
mov ebx, eax
call esi
push 0xffffffffffffffff
call edi
cmp ax, 0xfff4
mov word [0x427104], ax
je 0x406c6c
mov ecx, 0xaa
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x2b8]
lea eax, [esp + 0x160]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
movsx ecx, word [0x427104]
push 0x406c80
push edi
push 0xfff
push ecx
call ebx
cmp ax, 1
je 0x406c4b
cmp word [0x427106], 0
je 0x406c4b
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x2a8
ret
mov edx, dword [0x427108]
push str.BceUnregisterApp
push edx
call esi
movsx ecx, word [0x427104]
push ecx
call eax
mov word [0x427104], 0
pop edi
pop esi
mov eax, 3
pop ebx
add esp, 0x2a8
ret

Function at 0x406cd0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
push esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 4]
push eax
push 0x421538
push 1
push 0
push 0x421448
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jne 0x406d9a
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x218]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x220]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [esp + 0x224]
test eax, eax
je 0x406d3c
mov ecx, dword [esp + 4]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x421838
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x406d90
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0xc]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push 1
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
test esi, esi
setge al
pop esi
add esp, 0x210
ret
Function at 0x4164a0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x30
lea eax, [esp + 4]
lea ecx, [esp]
push eax
push ecx
push 0
push 0x20006
push 0
push str.SOFTWARE
push 0
push str.SOFTWARELXSUPMON
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x416535
mov eax, dword [0x43799c]
push edi
test eax, eax
je 0x4164ec
cmp eax, 2
je 0x4164ec
mov dl, byte [0x426b5c]
mov byte [esp + 0xc], dl
jmp 0x416502
mov ecx, dword [0x488e90]
lea eax, [esp + 0xc]
push 0x28
push eax
push 0x35
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x14]
push str.UserWantsToBeReminded
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
add esp, 0x30
ret

Function at 0x416540
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x68
mov edx, dword [esp + 0x6c]
lea eax, [esp + 0x34]
push ebx
push ebp
push esi
push edi
push eax
push ecx
push 0x148
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, 0x34
mov ecx, dword [0x488e90]
lea eax, [esp + 0x10]
push 0x32
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 0x44]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.00417a50
add esp, 8
test eax, eax
je 0x4165fd
lea ecx, [esp + 0x7c]
lea edx, [esp + 0x80]
push ecx
push edx
push 0
push 0x20006
push 0
push str.SOFTWARE
push 0
push str.SOFTWARELXSUPMON
push 0x80000002
call ebx
test eax, eax
jne 0x4165fd
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x84]
push eax
push 1
push 0
push str.UserWantsToBeReminded
push ecx
call ebp
mov edx, dword [esp + 0x80]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp esi, 0x3a
jle 0x416572
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x68
ret
Function at 0x416870
Capabilities:
Set registry value

Disassembly:
sub esp, 0x40
lea eax, [esp + 4]
push eax
call fcn.00417e40
add esp, 4
lea ecx, [esp + 8]
lea edx, [esp]
push ecx
push edx
push 0
push 0x20006
push 0
push str.SOFTWARE
push 0
push str.SOFTWARELXSUPMON
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41691d
push edi
lea eax, [esp + 8]
push esi
push eax
call fcn.00417e20
add esp, 4
lea ecx, [esp + 0x14]
push eax
push 0x423738
push ecx
call fcn.00417d40
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [esp + 0x14]
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x18]
push str.UserWasWarned
push eax
call esi
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push 0
push str.UserWasWarnedinSec
push edx
call esi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
add esp, 0x40
ret

Function at 0x416930
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x18
lea eax, [esp + 8]
mov dword [esp + 4], 0xff
push eax
call fcn.00417e40
add esp, 4
lea ecx, [esp]
push ecx
push 0x20019
push 0
push str.SOFTWARELXSUPMON
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4169ff
mov ecx, dword [esp]
lea edx, [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0
push str.UserWasWarnedinSec
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4169a6
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push edx
push eax
call fcn.00417f70
fstp qword [esp + 0x18]
add esp, 8
jmp 0x4169ff
lea ecx, [esp + 4]
lea edx, [esp]
push ecx
push edx
push 0
push 0x20006
push 0
push str.SOFTWARE
push 0
push str.SOFTWARELXSUPMON
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4169ff
mov ecx, dword [esp]
lea eax, [esp + 8]
push 4
push eax
push 4
push 0
push str.UserWasWarnedinSec
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0x40ac2000
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
fild dword [esp + 0x20]
fcomp qword [esp + 0x10]
fnstsw ax
test ah, 0x41
mov eax, 2
je 0x416a23
mov eax, 1
add esp, 0x18
ret