joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001140
Capabilities:
Check if process is running under wine
Query or enumerate registry value

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x3d
mov ebp, esp
push edi
push ebx
lea edi, [ebp - 0x304]
sub esp, 0x338
movdqu xmm0, xmmword [str.libctapi.so]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x320]
lea edi, [ebp - 0x314]
movups xmmword [ebp - 0x314], xmm0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareWinectapi32
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x10001248
test byte [0x10003018], 8
jne 0x10001218
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov edx, dword [0x100070a4]
mov eax, dword [0x100070a0]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [0x10003050]
mov edx, eax
sub esp, 0x10
mov eax, 1
test edx, edx
je 0x1000120a
mov dword [esp], str.Wine_cannot_find_any_usable_hardware_library__ctapi32.dll_not_working._n
call sym._wine_dbg_printf
mov dword [esp], str.Please_create_the_key__HKEY_CURRENT_USERSoftwareWinectapi32__in_your_registry_n
call sym._wine_dbg_printf
mov dword [esp], str.and_set_the_value__library__to_your_library_name__e.g.__libctapi_cyberjack.so.1__or___usr_lib_readers_libctapi.so__._n
call sym._wine_dbg_printf
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.Loading_library__s_n
mov dword [esp + 8], str.load_functions
mov dword [esp + 4], 0x10003018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x100011b2
lea eax, [ebp - 0x318]
lea ebx, [ebp - 0x210]
mov dword [ebp - 0x318], 0x206
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x31c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.library
mov eax, dword [ebp - 0x320]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x1000129f
cmp dword [ebp - 0x31c], 1
je 0x100012c0
mov eax, dword [ebp - 0x320]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x100011a9
mov eax, dword [ebp - 0x318]
xor edx, edx
shr eax, 1
mov word [ebp + eax*2 - 0x210], dx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfdf2
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
sub esp, 0x20
jmp 0x1000129f

Function at 0x10001540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10001598
cmp byte [esi + ebx - 1], 0xa
je 0x1000156c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10007084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x42c980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x476e90
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x4bb050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x140], ecx
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], esi
cmp dword [ebx + 4], esi
jbe 0x42ca01
nop
mov eax, edi
lea esi, [ebp - 0x138]
and eax, 1
mov ecx, ebx
lea esi, [esi + eax*2]
call fcn.0042d170
movzx eax, word [eax + edi*2]
push eax
call fcn.00462198
xor word [esi], ax
inc edi
add esp, 4
cmp edi, dword [ebx + 4]
jb 0x42c9d0
mov esi, dword [ebp - 0x138]
mov eax, 4
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
mov word [ebp - 0x1a], ax
lea ecx, [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov byte [ebp - 0x18], 1
push 1
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x130], 0
call fcn.00435000
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
cmove eax, dword [ebp - 0x12c]
xor ecx, ecx
mov word [eax + 4], cx
push 0x49b418
lea eax, [ebp - 0x134]
mov dword [ebp - 4], ecx
push 0x49c2fc
push eax
call fcn.00434d80
push str.mutex_file_
lea eax, [ebp - 0x134]
push 0x49c2fc
push eax
call fcn.00434d80
push esi
lea eax, [ebp - 0x134]
push str.0x_p
push eax
call fcn.00434d80
mov esi, dword [ebp - 0x13c]
lea eax, [ebp - 0x128]
mov ecx, dword [ebp - 0x140]
add esp, 0x24
cmp byte [ebp - 0x18], 0
cmove eax, dword [ebp - 0x12c]
add eax, 4
push eax
push esi
call fcn.0043cf50
test al, al
jne 0x42cae2
push 0x49b440
mov ecx, esi
call fcn.0042c400
xor bl, bl
jmp 0x42cae4
mov bl, 1
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x42cb0d
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x42cb0d
push eax
call fcn.0045dc2d
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a329
mov esp, ebp
pop ebp
ret 8

Function at 0x42d330
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp byte [ecx + 0x11c], 0
lea eax, [ecx + 0xc]
jne 0x42d33f
mov eax, dword [ecx + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42d351
xor al, al
ret
shr eax, 4
not al
and al, 1
ret
Function at 0x42d360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x4bb050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov cl, byte [edi + 0x11c]
lea eax, [edi + 0xc]
test cl, cl
jne 0x42d387
mov eax, dword [edi + 8]
cmp word [eax + 6], 0x3a
jne 0x42d41f
lea eax, [edi + 0xc]
test cl, cl
jne 0x42d39c
mov eax, dword [edi + 8]
cmp word [eax + 8], 0
jne 0x42d41f
push edi
lea ecx, [ebp - 0x24c]
call fcn.00434840
push 0x49b470
lea eax, [ebp - 0x24c]
push 0x49c2fc
push eax
call fcn.00434d80
add esp, 0xc
lea eax, [ebp - 0x240]
cmp byte [ebp - 0x130], 0
cmove eax, dword [ebp - 0x244]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42d3f1
xor bl, bl
jmp 0x42d3f7
shr ebx, 4
and bl, 1
cmp byte [ebp - 0x130], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x42d540
mov eax, dword [ebp - 0x244]
lea ecx, [ebp - 0x240]
jmp 0x42d533
push edi
lea ecx, [ebp - 0x128]
call fcn.00434840
mov al, byte [edi + 0x11c]
lea ecx, [edi + 0xc]
test al, al
jne 0x42d43b
mov ecx, dword [edi + 8]
cmp word [ecx + 6], 0x3a
jne 0x42d464
lea ecx, [edi + 0xc]
test al, al
jne 0x42d44c
mov ecx, dword [edi + 8]
cmp word [ecx + 8], 0x5c
jne 0x42d464
lea ecx, [edi + 0xc]
test al, al
jne 0x42d45d
mov ecx, dword [edi + 8]
cmp word [ecx + 0xa], 0
je 0x42d4ac
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x42d4ac
test al, al
lea eax, [edi + 0xc]
jne 0x42d475
mov eax, dword [edi + 8]
cmp word [eax + ecx*2 + 2], 0x5c
jne 0x42d4ac
push esi
lea esi, [ecx - 1]
push ecx
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x124], esi
call fcn.00435000
cmp byte [ebp - 0xc], 0
lea eax, [ebp - 0x11c]
cmove eax, dword [ebp - 0x120]
xor ecx, ecx
mov word [eax + esi*2 + 4], cx
pop esi
cmp byte [ebp - 0xc], 0
lea eax, [ebp - 0x11c]
cmove eax, dword [ebp - 0x120]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42d4d2
xor bl, bl
jmp 0x42d517
mov al, byte [edi + 0x11c]
lea ecx, [edi + 0xc]
test al, al
jne 0x42d4e2
mov ecx, dword [edi + 8]
cmp word [ecx + 6], 0x3a
jne 0x42d511
lea ecx, [edi + 0xc]
test al, al
jne 0x42d4f3
mov ecx, dword [edi + 8]
cmp word [ecx + 8], 0x5c
jne 0x42d511
test al, al
je 0x42d503
add edi, 0xc
jmp 0x42d506
mov edi, dword [edi + 8]
cmp word [edi + 0xa], 0
jne 0x42d511
mov bl, 1
jmp 0x42d517
shr ebx, 4
and bl, 1
cmp byte [ebp - 0xc], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x42d540
mov eax, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
cmp eax, ecx
je 0x42d540
push eax
call fcn.0045dc2d
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.0045a329
mov esp, ebp
pop ebp
ret
Function at 0x42da60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x476f7b
mov eax, dword fs:[0]
push eax
sub esp, 0x2c0
mov eax, dword [0x4bb050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x268], ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x278], esi
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x25c], eax
call fcn.00430d30
mov ecx, dword fs:[0x2c]
mov dword [ebp - 0x264], eax
mov edx, dword [ecx]
mov ecx, dword [0x4cc840]
cmp ecx, dword [edx + 4]
jg 0x42dca5
cmp byte [0x4cc838], 0
je 0x42db8f
push 0x44
lea eax, [ebp - 0x2cc]
push 0
push eax
call fcn.0045bd20
mov eax, dword [ebp - 0x25c]
add esp, 0xc
mov ecx, dword [ebp - 0x268]
xorps xmm0, xmm0
mov word [ebp - 0x29c], ax
lea eax, [ebp - 0x288]
mov dword [ebp - 0x2cc], 0x44
push eax
lea eax, [ebp - 0x2cc]
push eax
push 0
push dword [ebp - 0x260]
movups xmmword [ebp - 0x288], xmm0
push esi
call fcn.0042dcf0
test al, al
je 0x42dc9e
push dword [ebp - 0x288]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x284]
call esi
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a329
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp - 0x25c]
push eax
push dword [ebp - 0x26c]
push dword [ebp - 0x260]
push edi
push str.open
push dword [ebp - 0x270]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
cmp edi, 0x20
jg 0x42db70
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x274]
lea ecx, [ebp - 0x134]
call fcn.0042cbb0
push 0x49b4dc
lea ecx, [ebp - 0x258]
mov dword [ebp - 4], 0
call fcn.00434910
mov esi, eax
push edi
push 0x49c174
push esi
mov byte [ebp - 4], 1
call fcn.00434d80
push 0x49b4a8
push 0x49c2fc
push esi
call fcn.00434d80
add esp, 0x18
lea eax, [esi + 0xc]
cmp byte [esi + 0x11c], 0
jne 0x42dc21
mov eax, dword [esi + 8]
mov esi, dword [ebp - 0x278]
lea ecx, [ebp - 0x134]
push ecx
add eax, 4
mov ecx, esi
push eax
call fcn.0042c8d0
cmp byte [ebp - 0x13c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x42dc65
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x24c]
cmp eax, ecx
je 0x42dc65
push eax
call fcn.0045dc2d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x42dc95
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x42dc95
push eax
call fcn.0045dc2d
add esp, 4
mov edx, edi
mov ecx, esi
call fcn.0042e310
xor al, al
jmp 0x42db72
push 0x4cc840
call fcn.0045a6d3
add esp, 4
cmp dword [0x4cc840], 0xffffffff
jne 0x42daef
mov eax, dword [ebp - 0x264]
mov al, byte [eax + 0xd2a]
test al, al
je 0x42dcd6
cmp al, 1
sete al
jmp 0x42dcd6
push 0x4cc840
mov byte [0x4cc838], al
call fcn.0045a689
add esp, 4
jmp 0x42daef
Function at 0x42e0a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x477048
mov eax, dword fs:[0]
push eax
sub esp, 0x184
mov eax, dword [0x4bb050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x11c], 0
lea ecx, [esi + 0xc]
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x190], eax
jne 0x42e0eb
mov ecx, dword [esi + 8]
add ecx, 4
call fcn.00438430
mov ecx, esi
mov bl, al
call fcn.0042d360
test al, al
jne 0x42e1d0
cmp byte [esi + 0x11c], al
lea eax, [esi + 0xc]
jne 0x42e112
mov eax, dword [esi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42e1f0
shr eax, 4
not al
test al, 1
je 0x42e1f0
test bl, bl
je 0x42e1d0
lea ecx, [ebp - 0x68]
call fcn.0043c9a0
mov dword [ebp - 4], 1
lea eax, [esi + 0xc]
cmp byte [esi + 0x11c], 0
jne 0x42e158
mov eax, dword [esi + 8]
add eax, 4
push eax
call fcn.0043cb60
mov ebx, eax
test edi, edi
je 0x42e169
mov dword [edi], ebx
test ebx, ebx
je 0x42e1c8
cmp byte [esi + 0x11c], 0
lea edi, [esi + 0xc]
jne 0x42e17c
mov edi, dword [esi + 8]
mov ecx, dword [ebp - 0x190]
push 0x49baf4
call fcn.0042c400
push ebx
mov esi, eax
push 0x49c2f4
push esi
call fcn.00434d80
push 0x49bb04
push 0x49c2fc
push esi
call fcn.00434d80
lea eax, [edi + 4]
push eax
push 0x49c2fc
push esi
call fcn.00434d80
add esp, 0x24
lea ecx, [ebp - 0x68]
call fcn.0043c8c0
xor al, al
jmp 0x42e1d2
lea ecx, [ebp - 0x68]
call fcn.0043c8c0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a329
mov esp, ebp
pop ebp
ret 8
test edi, edi
je 0x42e1fa
mov dword [edi], 1
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x42e209
mov eax, dword [esi + 8]
push 0
push 0
push 0
push 0
push 0
add eax, 4
lea ecx, [ebp - 0x18c]
push eax
call fcn.0042cbb0
mov ecx, dword [ebp - 0x190]
lea eax, [ebp - 0x18c]
push eax
push str.b_rN0R
mov dword [ebp - 4], 0
call fcn.0042c8d0
cmp byte [ebp - 0x70], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x42e269
mov eax, dword [ebp - 0x184]
lea ecx, [ebp - 0x180]
cmp eax, ecx
je 0x42e269
push eax
call fcn.0045dc2d
add esp, 4
xor al, al
jmp 0x42e1d2
Function at 0x430ff0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x4bb050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
push ebx
mov ebx, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [0x4cc844]
cmp eax, dword [ecx + 4]
jg 0x4311bb
cmp byte [0x4cc7a0], 0
jne 0x431199
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0045bd20
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x431192
push edi
push 0x208
lea eax, [ebp - 0x414]
mov dword [ebp - 0x41c], 0
push 0
push eax
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x418], 0
call fcn.0045bd20
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x431191
push esi
push edi
call fcn.0045dc48
mov esi, eax
add esp, 4
test esi, esi
je 0x431190
push esi
push edi
push dword [ebp - 0x41c]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x431187
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x420]
push eax
push str.VarFileInfoTranslation
push esi
call edi
test eax, eax
je 0x431187
cmp dword [ebp - 0x418], 4
jb 0x431187
mov ecx, dword [ebp - 0x420]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x414]
push str.StringFileInfo_04x_04xCompanyName
push eax
call fcn.00434220
add esp, 0x10
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
call edi
test eax, eax
je 0x431187
mov eax, dword [ebp - 0x418]
cmp eax, 2
jbe 0x431187
mov ecx, dword [ebp - 0x424]
cmp word [ecx + eax*2 - 2], 0
jne 0x43117b
push ecx
mov ecx, 0x4cc850
call fcn.00434a20
jmp 0x431187
push eax
push ecx
mov ecx, 0x4cc850
call fcn.00434a90
push esi
call fcn.0045dc2d
add esp, 4
pop esi
pop edi
mov byte [0x4cc7a0], 1
push 0x4cc850
mov ecx, ebx
call fcn.0042d2b0
mov ecx, dword [ebp - 4]
mov al, byte [0x4cc7a0]
xor ecx, ebp
pop ebx
call fcn.0045a329
mov esp, ebp
pop ebp
ret 4
push 0x4cc844
call fcn.0045a6d3
add esp, 4
cmp dword [0x4cc844], 0xffffffff
jne 0x431020
mov ecx, 0x4cc850
call fcn.00434790
push 0x484d00
call fcn.0045a0b9
push 0x4cc844
call fcn.0045a689
add esp, 8
jmp 0x431020
Function at 0x432800
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x477596
mov eax, dword fs:[0]
push eax
sub esp, 0x790
mov eax, dword [0x4bb050]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 5], 0
mov edi, dword [ebp + 8]
jne 0x432843
push str.Win7
jmp 0x432a4a
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.0045bd20
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x432a45
inc eax
cmp eax, 0x104
jae 0x432a45
cmp byte [esi + 0x494], 0
lea eax, [esi + 0x384]
jne 0x432894
mov eax, dword [esi + 0x380]
add eax, 4
lea ecx, [ebp - 0x674]
push eax
call fcn.00434910
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4328b3
sub ecx, edx
lea eax, [ebp - 0x668]
sar ecx, 1
cmp byte [ebp - 0x558], 0
push ecx
cmove eax, dword [ebp - 0x66c]
lea ecx, [ebp - 0x21c]
push ecx
add eax, 4
push eax
call fcn.00462c59
add esp, 0xc
test eax, eax
jne 0x4328f5
mov byte [esi + 0x2206], 1
cmp byte [esi + 0x2206], 0
jne 0x432a15
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x79c]
call fcn.0042cbb0
lea ecx, [ebp - 0x54c]
call fcn.0042cb50
lea eax, [ebp - 0x54c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x79c]
call fcn.0042d560
push 0x208
lea eax, [ebp - 0x424]
push 0
push eax
call fcn.0045bd20
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [ebp - 0x430]
lea ecx, [ebp - 0x540]
mov edi, dword [ebp - 0x544]
test dl, dl
cmove ecx, edi
add ecx, 4
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432984
sub ecx, ebx
lea eax, [ebp - 0x540]
sar ecx, 1
test dl, dl
push ecx
cmove eax, edi
add eax, 4
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.00462c59
add esp, 0xc
test eax, eax
jne 0x4329bd
mov byte [esi + 0x2206], 1
cmp byte [ebp - 0x430], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4329e9
mov eax, dword [ebp - 0x544]
lea ecx, [ebp - 0x540]
cmp eax, ecx
je 0x4329e9
push eax
call fcn.0045dc2d
add esp, 4
cmp byte [ebp - 0x680], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x432a15
mov eax, dword [ebp - 0x794]
lea ecx, [ebp - 0x790]
cmp eax, ecx
je 0x432a15
push eax
call fcn.0045dc2d
add esp, 4
cmp byte [ebp - 0x558], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x432a41
mov eax, dword [ebp - 0x66c]
lea ecx, [ebp - 0x668]
cmp eax, ecx
je 0x432a41
push eax
call fcn.0045dc2d
add esp, 4
mov al, 1
jmp 0x432a53
push 0x49c024
mov ecx, edi
call fcn.0042c400
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045a329
mov esp, ebp
pop ebp
ret 4
Function at 0x434530
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ecx
mov eax, dword [ebx]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push edi
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x434615
test edi, edi
je 0x4345cb
cmp word [edi], 0
je 0x4345cb
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x434585
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.0042c5d0
push 0x49c294
mov esi, eax
push 0x49c2fc
push esi
call fcn.00434d80
add esp, 0xc
lea ecx, [ebx + 4]
push ecx
push 0x49c2fc
push esi
call fcn.00434d80
add esp, 0xc
push 0x49b470
push 0x49c2fc
push esi
call fcn.00434d80
add esp, 0xc
push edi
jmp 0x4345fc
cmp byte [esi + 0x128], 0
lea edi, [esi + 0x18]
jne 0x4345da
mov edi, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.0042c5d0
push 0x49c294
mov esi, eax
push 0x49c2fc
push esi
call fcn.00434d80
add esp, 0xc
lea ecx, [edi + 4]
push ecx
push 0x49c2fc
push esi
call fcn.00434d80
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x18]
je 0x434685
test edi, edi
je 0x43464a
cmp word [edi], 0
je 0x43464a
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x434636
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push 0
call fcn.0042c5d0
push 0x49c2a4
jmp 0x434593
cmp byte [esi + 0x128], 0
je 0x434658
add esi, 0x18
jmp 0x43465b
mov esi, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push 0x49c2a4
call fcn.0042c400
lea ecx, [esi + 4]
push ecx
push 0x49c2fc
push eax
call fcn.00434d80
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x10]
pop edi
mov dword [ebx], eax
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4346a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ecx
push 4
push dword [ebp + 0xc]
push 4
push 0
push edi
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x434785
test edi, edi
je 0x434741
cmp word [edi], 0
je 0x434741
cmp byte [esi + 0x128], 0
push ebx
lea ebx, [esi + 0x18]
jne 0x4346df
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.0042c5d0
push 0x49c2bc
mov esi, eax
push 0x49c2fc
push esi
call fcn.00434d80
lea ecx, [ebx + 4]
push ecx
push 0x49c2fc
push esi
call fcn.00434d80
push 0x49c2d4
push 0x49c2fc
push esi
call fcn.00434d80
push edi
push 0x49c2fc
push esi
call fcn.00434d80
push 0x49c2dc
push 0x49c2fc
push esi
call fcn.00434d80
add esp, 0x3c
xor al, al
pop ebx
pop edi
pop esi
pop ebp
ret 0x14
cmp byte [esi + 0x128], 0
lea edi, [esi + 0x18]
jne 0x434750
mov edi, dword [esi + 0x14]
mov ecx, dword [ebp + 8]
push eax
call fcn.0042c5d0
push 0x49c2bc
mov esi, eax
push 0x49c2fc
push esi
call fcn.00434d80
lea ecx, [edi + 4]
push ecx
push 0x49c2fc
push esi
call fcn.00434d80
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebp
ret 0x14
pop edi
mov al, 1
pop esi
pop ebp
ret 0x14

Function at 0x4350d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 4], 0
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push eax
mov edi, edx
mov dword [ebp - 8], 0
xor bl, bl
mov dword [ebp - 0x10], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x435110
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
call fcn.0045dc48
add esp, 4
mov esi, eax
push esi
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x435191
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x49b470
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x435191
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
movzx eax, word [ecx + 0xa]
mov word [edi], ax
movzx eax, word [ecx + 8]
mov word [edi + 2], ax
movzx eax, word [ecx + 0xe]
mov word [edi + 4], ax
movzx eax, word [ecx + 0xc]
mov word [edi + 6], ax
test edx, edx
je 0x43518f
movzx eax, word [ecx + 0x12]
mov word [edx], ax
movzx eax, word [ecx + 0x10]
mov word [edx + 2], ax
movzx eax, word [ecx + 0x16]
mov word [edx + 4], ax
movzx eax, word [ecx + 0x14]
mov word [edx + 6], ax
mov bl, 1
test esi, esi
je 0x43519e
push esi
call fcn.0045dc2d
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret