joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b6a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x458736
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe8
push esi
mov esi, ecx
mov dword [esp + 8], esi
call dword [sym.imp.user32.dll_ReleaseCapture]
mov eax, dword [esp + 0xfc]
cmp eax, 0x7ed
je 0x41b86c
cmp dword [esi + 0x60], 0xfffffffe
jne 0x41b865
mov eax, dword [esi + 0xc0]
push ebx
push ebp
push edi
push esi
push 0x102
push eax
lea ecx, [esp + 0x70]
mov dword [esi + 0x138], 1
call fcn.00441adf
xor ebp, ebp
mov dword [esp + 0x100], ebp
call fcn.00448768
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [esp + 0x10], ebx
mov edi, dword [esi + 0x15c]
mov dword [esp + 0x1c], 4
mov eax, dword [edi - 0xc]
test eax, eax
mov byte [esp + 0x100], 1
je 0x41b752
call fcn.00452f9c
mov eax, dword [eax + 4]
push edi
mov ecx, eax
call fcn.004546b3
mov ebp, eax
xor edi, edi
test ebp, ebp
je 0x41b796
push edi
lea eax, [esp + 0x14]
push 0x45e2c0
push eax
call fcn.00406380
mov ebx, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
push 0
push ebx
push ebp
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x41b796
mov ecx, dword [esp + 0x18]
mov dword [esp + edi*4 + 0x24], ecx
jmp 0x41b79e
mov dword [esp + edi*4 + 0x24], 0xffffff
inc edi
cmp edi, 0x10
jl 0x41b754
lea edx, [esp + 0x24]
lea ecx, [esp + 0x64]
mov dword [esp + 0xe4], edx
call fcn.00441a6a
cmp eax, 1
jne 0x41b7cc
mov eax, dword [esp + 0xe0]
mov dword [esi + 0xc4], eax
jmp 0x41b7d7
mov dword [esp + 0x108], 0x7ed
test ebp, ebp
je 0x41b81b
xor esi, esi
lea edi, [esp + 0x24]
push esi
lea ecx, [esp + 0x14]
push 0x45e2c0
push ecx
call fcn.00406380
mov ebx, dword [esp + 0x1c]
add esp, 0xc
push 4
push edi
push 4
push 0
push ebx
push ebp
call dword [sym.imp.advapi32.dll_RegSetValueExA]
inc esi
add edi, 4
cmp esi, 0x10
jl 0x41b7e1
push ebp
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov esi, dword [esp + 0x14]
add ebx, 0xfffffff0
mov dword [esi + 0x138], 0
mov byte [esp + 0x100], 0
lea edx, [ebx + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x41b847
mov ecx, dword [ebx]
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
lea ecx, [esp + 0x64]
mov dword [esp + 0x100], 0xffffffff
call fcn.00443677
mov eax, dword [esp + 0x108]
pop edi
pop ebp
pop ebx
cmp eax, 0x7ed
jne 0x41b878
mov ecx, dword [esi + 0xc0]
mov dword [esi + 0xc4], ecx
mov edx, dword [esi + 0xc4]
push 0
push edx
push eax
mov eax, dword [esi + 0x134]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, dword [esi + 0x138]
test eax, eax
jne 0x41b8a3
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x60]
mov ecx, dword [esp + 0xec]
pop esi
mov dword fs:[0], ecx
add esp, 0xf4
ret 4
Function at 0x41c850
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x458825
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9c
mov eax, dword [0x4797a0]
xor eax, dword [esp + 0xa8]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xa0], eax
mov dword [esp + 8], esi
call fcn.00444c49
xor ebx, ebx
push 0xc
mov dword [esp + 0xb0], ebx
mov dword [esi], 0x45e018
mov dword [esi + 0x50], 0xff000000
call dword [sym.imp.user32.dll_GetSysColor]
push 0x45dd68
lea ecx, [esi + 0x58]
mov dword [esi + 0x54], eax
call fcn.00408f60
push 0x45dd58
lea ecx, [esi + 0x5c]
mov byte [esp + 0xb0], 1
call fcn.00408f60
push 0x45e2ec
lea ecx, [esi + 0x78]
mov byte [esp + 0xb0], 2
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
call fcn.00408f60
push 0x45a867
lea ecx, [esi + 0x7c]
mov byte [esp + 0xb0], 3
call fcn.00408f60
lea ecx, [esi + 0x80]
mov byte [esp + 0xac], 4
call fcn.00426500
lea ecx, [esi + 0x84]
mov byte [esp + 0xac], 5
call fcn.00426500
lea ecx, [esi + 0x88]
mov byte [esp + 0xac], 6
call fcn.00426500
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [esp + 0x1c], 2
jne 0x41c970
mov eax, dword [esp + 0x10]
cmp eax, 5
ja 0x41c96c
jne 0x41c970
cmp dword [esp + 0x14], 1
jb 0x41c970
mov cl, 1
jmp 0x41c972
xor cl, cl
cmp cl, bl
lea eax, [esi + 0x6c]
mov dword [eax], ebx
je 0x41c989
push ebx
push eax
push ebx
push 0x1022
call dword [sym.imp.user32.dll_SystemParametersInfoA]
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0xa0]
xor ecx, dword [esp + 0xb0]
mov eax, esi
pop esi
pop ebx
add esp, 0xa8
jmp fcn.004311b5
Function at 0x41cea0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x458716
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.00444c49
mov dword [esp + 0x1c], 0
mov dword [esi], method.CWnd.virtual_0
lea edi, [esi + 0x68]
call fcn.00448768
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x1c], 1
lea ebp, [esi + 0x6c]
call fcn.00448768
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp], eax
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb0], vtable.CFont.0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xb8], 0x45df64
lea ecx, [esi + 0xc8]
mov byte [esp + 0x1c], 4
call fcn.004426af
mov byte [esp + 0x1c], 5
call fcn.00448768
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x15c], eax
mov ecx, esi
mov byte [esp + 0x1c], 6
call fcn.0041a820
mov eax, dword [esp + 0x2c]
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x134], eax
mov eax, dword [esp + 0x34]
test eax, eax
mov edx, eax
jne 0x41cf89
mov edx, 0x45a867
test edx, edx
jne 0x41cf91
xor eax, eax
jmp 0x41cfab
mov eax, edx
lea ecx, [eax + 1]
mov dword [esp + 0xc], ecx
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41cfa0
sub eax, dword [esp + 0xc]
push eax
push edx
mov ecx, edi
call fcn.00402380
mov edx, dword [esp + 0x38]
test edx, edx
jne 0x41cfc9
mov edx, 0x45a867
test edx, edx
jne 0x41cfc9
xor eax, eax
jmp 0x41cfd9
mov eax, edx
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41cfd0
sub eax, edi
push eax
push edx
mov ecx, ebp
call fcn.00402380
mov edx, dword [esp + 0x3c]
test edx, edx
jne 0x41cff7
mov edx, 0x45a867
test edx, edx
jne 0x41cff7
xor eax, eax
jmp 0x41d009
mov eax, edx
lea ebp, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d000
sub eax, ebp
push eax
push edx
lea ecx, [esi + 0x15c]
call fcn.00402380
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
mov ecx, esi
call fcn.0041ca50
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret 0x1c
Function at 0x41e960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x458918
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.00444c49
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esi], method.CWnd.virtual_0
lea edi, [esi + 0x6c]
call fcn.00448768
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x1c], 1
lea ebp, [esi + 0x70]
call fcn.00448768
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp], eax
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xa4], vtable.CFont.0
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xac], 0x45df64
lea ecx, [esi + 0xbc]
mov byte [esp + 0x1c], 4
call fcn.004426af
mov ecx, esi
mov byte [esp + 0x1c], 5
call fcn.0041d460
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov dword [esi + 0x128], eax
mov eax, dword [esp + 0x34]
test eax, eax
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov edx, eax
jne 0x41ea24
mov edx, 0x45a867
test edx, edx
jne 0x41ea2c
xor eax, eax
jmp 0x41ea40
mov eax, edx
lea ecx, [eax + 1]
mov dword [esp + 0x2c], ecx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ea35
sub eax, dword [esp + 0x2c]
push eax
push edx
mov ecx, edi
call fcn.00402380
mov edi, dword [esp + 0x38]
test edi, edi
mov edx, edi
jne 0x41ea58
mov edx, 0x45a867
test edx, edx
jne 0x41ea60
xor eax, eax
jmp 0x41ea7b
mov eax, edx
lea ecx, [eax + 1]
mov dword [esp + 0x2c], ecx
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ea70
sub eax, dword [esp + 0x2c]
push eax
push edx
mov ecx, ebp
call fcn.00402380
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
push edi
push edx
mov edx, dword [esp + 0x2c]
push eax
push ebx
push ecx
push edx
mov ecx, esi
call fcn.0041e810
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x421c10
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
push 0x45e7b4
mov dword [esi + 0x14], 0
call dword [sym.imp.kernel32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x14], eax
je 0x421c76
push edi
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x45e7a4
push eax
call edi
mov dword [esi], eax
mov eax, dword [esi + 0x14]
push 0x45e794
push eax
call edi
mov ecx, dword [esi + 0x14]
push 0x45e784
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi + 0x14]
push 0x45e764
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x14]
push 0x45e750
push eax
call edi
mov dword [esi + 0x10], eax
pop edi
mov eax, esi
pop esi
ret

Function at 0x422210
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x458c08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 8]
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [eax]
mov eax, edx
sub eax, esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
fild dword [esp + 0xc]
movzx ebx, cl
push edi
movzx edi, al
sub ebx, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x30], edi
movzx edi, ah
fild dword [esp + 0x18]
movzx ebx, ch
fdiv st(1)
sub ebx, edi
mov dword [esp + 0x20], ebx
shr ecx, 0x10
shr eax, 0x10
movzx eax, al
movzx ecx, cl
sub ecx, eax
cmp esi, edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x40], eax
fstp qword [esp + 0x18]
fild dword [esp + 0x20]
fdiv st(1)
fstp qword [esp + 0x20]
fild dword [esp + 0x28]
fdiv st(1)
fstp qword [esp + 0x10]
fstp st(0)
fild dword [esp + 0x30]
fstp qword [esp + 0x30]
fild dword [esp + 0x38]
fstp qword [esp + 0x38]
fild dword [esp + 0x40]
fstp qword [esp + 0x40]
jg 0x422388
mov edi, dword [ebp + 8]
fld qword [esp + 0x40]
call fcn.004322f0
fld qword [esp + 0x38]
xor ebx, ebx
mov bh, al
call fcn.004322f0
fld qword [esp + 0x30]
mov bl, al
shl ebx, 8
call fcn.004322f0
movzx edx, al
or ebx, edx
push ebx
push 1
push 0
lea ecx, [esp + 0x34]
call fcn.0044bacb
lea eax, [esp + 0x28]
push eax
mov ecx, edi
mov dword [esp + 0x60], 0
call fcn.0044ba0f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
push edx
mov ebx, eax
push esi
lea eax, [esp + 0x50]
push eax
mov ecx, edi
call fcn.0044b3da
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
push edx
push esi
mov ecx, edi
call fcn.0044b131
push ebx
mov ecx, edi
call fcn.0044ba0f
fld qword [esp + 0x30]
fadd qword [esp + 0x18]
lea ecx, [esp + 0x28]
mov dword [esp + 0x5c], 0xffffffff
mov dword [esp + 0x28], vtable.CGdiObject.0
fstp qword [esp + 0x30]
fld qword [esp + 0x38]
fadd qword [esp + 0x20]
fstp qword [esp + 0x38]
fld qword [esp + 0x40]
fadd qword [esp + 0x10]
fstp qword [esp + 0x40]
call fcn.0044b98a
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
inc esi
cmp esi, ecx
jle 0x4222c4
mov ecx, dword [esp + 0x54]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x422670
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.user32.dll_SendMessageA]
push esi
push edi
push 0
push 0
mov esi, ecx
mov eax, dword [esi + 0x1c]
push 0x476
push eax
call ebx
mov edi, eax
push edi
call dword [sym.imp.user32.dll_IsWindow]
test eax, eax
je 0x4226e8
push edi
call dword [sym.imp.user32.dll_IsWindowVisible]
test eax, eax
je 0x4226e8
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0xc], ecx
mov ecx, esi
mov dword [esp + 0x14], 0xffffff37
call fcn.00447bc6
lea edx, [esp + 0xc]
push edx
push eax
push 0x4e
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0
call ebx
test eax, eax
je 0x4226df
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push 0
push edi
call dword [sym.imp.user32.dll_ShowWindow]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret

Function at 0x424c90
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa8
mov eax, dword [0x4797a0]
xor eax, dword [ebp + 4]
push esi
mov dword [esp + 0xa8], eax
mov eax, dword [ecx + 0x300]
cmp eax, 1
push edi
je 0x424d20
cmp eax, 2
je 0x424d06
mov esi, dword [sym.imp.kernel32.dll_GetVersionExA]
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x9c
call esi
test eax, eax
jne 0x424cf6
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x94
call esi
test eax, eax
je 0x424d20
mov eax, dword [esp + 0x18]
sub eax, 2
jne 0x424d20
cmp dword [esp + 0xc], 5
jb 0x424d20
mov eax, 1
mov ecx, dword [esp + 0xac]
xor ecx, dword [ebp + 4]
call fcn.004311b5
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xac]
xor ecx, dword [ebp + 4]
xor eax, eax
call fcn.004311b5
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x426740
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [ecx - 3]
cmp eax, 0x25
push esi
push edi
ja case.0x42675a.5
movzx eax, byte [eax + 0x4268ec]
jmp dword [eax*4 + 0x4268c8]
push 0x100
push 0x47b898
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
pop edi
mov eax, 0x47b898
pop esi
pop ecx
ret
push 0x100
push 0x47b898
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
pop edi
mov eax, 0x47b898
pop esi
pop ecx
ret
mov ecx, 0xb
mov esi, 0x45f2ec
mov edi, 0x47b898
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
mov eax, 0x47b898
pop esi
pop ecx
ret
mov ecx, 0x16
mov esi, 0x45f290
mov edi, 0x47b898
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
mov eax, 0x47b898
pop esi
pop ecx
ret
mov ecx, 0xb
mov esi, 0x45f25c
mov edi, 0x47b898
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
mov eax, 0x47b898
pop esi
pop ecx
ret
mov ecx, 0x16
mov esi, 0x45f200
mov edi, 0x47b898
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
mov eax, 0x47b898
pop esi
pop ecx
ret
lea ecx, [esp + 0x14]
push ecx
push 0x47b898
lea edx, [esp + 0x10]
push edx
push 0x45f1f0
push 0x45f1c4
push 0x80000002
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0x100
call dword [sym.imp.shlwapi.dll_SHGetValueA]
neg eax
sbb eax, eax
not eax
pop edi
and eax, 0x47b898
pop esi
pop ecx
ret
mov eax, dword [esp + 0x10]
push 0
push 6
push 0x47b898
push eax
call dword [sym.imp.shell32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4268a0
mov eax, 0x47b898
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x426864
sub eax, edx
lea eax, [eax + 0x47b898]
cmp eax, 0x47b898
jbe 0x426894
lea ebx, [ebx]
mov cl, byte [eax]
cmp cl, 0x5c
je 0x426894
cmp cl, 0x2f
je 0x426894
dec eax
cmp eax, 0x47b898
ja 0x426880
pop edi
mov byte [eax], 0
mov eax, 0x47b898
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret
push 0
push ecx
mov ecx, dword [esp + 0x18]
push 0x47b898
push ecx
call dword [sym.imp.shell32.dll_SHGetSpecialFolderPathA]
neg eax
sbb eax, eax
pop edi
and eax, 0x47b898
pop esi
pop ecx
ret
Function at 0x426e80
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
cmp eax, edi
je 0x426def
push eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
pop edi
pop esi
ret
push esi
push 0
push 0
push 0
push 0
push 0x45f418
push 0
mov esi, ecx
call dword [sym.imp.kernel32.dll_SearchPathA]
test eax, eax
je 0x426f68
push 0x45f418
call dword [sym.imp.kernel32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0xc], eax
je 0x426f68
push edi
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x45f40c
push eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
push 0x45f400
push eax
call edi
mov ecx, dword [esi + 0xc]
push 0x45f3f0
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi + 0xc]
push 0x45f3e0
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xc]
push 0x45f3d0
push eax
call edi
mov ecx, dword [esi + 0xc]
push 0x45f3c0
push ecx
mov dword [esi + 0x20], eax
call edi
mov edx, dword [esi + 0xc]
push 0x45f3b0
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0xc]
push 0x45f3a0
push eax
call edi
mov ecx, dword [esi + 0x10]
test ecx, ecx
mov dword [esi + 0x2c], eax
pop edi
je 0x426f60
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x426f60
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x426f60
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x426f60
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x426f60
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x426f60
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x426f60
test eax, eax
jne 0x426f68
mov ecx, esi
pop esi
jmp 0x426dc0
pop esi
ret

Function at 0x427d99
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x45f458
push 0x80000000
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x427df1
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x45f494
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x427de4
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
jmp 0x427df3
xor eax, eax
pop esi
leave
ret 4
Function at 0x428e84
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x428ed7
call fcn.00452f9c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
cmp eax, ebx
je 0x428ed7
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x428ecd
xor eax, eax
jmp 0x428fec
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x428f06
mov eax, dword [edi]
push ebx
push dword [ebp - 4]
mov ecx, edi
push dword [ebp + 8]
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x428f06
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x428fe9
mov edi, dword [eax + 0x40]
and dword [ebp + 0x10], 0
xor eax, eax
cmp edi, eax
mov dword [ebp + 0xc], edi
mov dword [ebp - 8], edi
je 0x428f35
mov ecx, dword [edi]
mov dword [ebp + 0xc], ecx
mov ecx, dword [edi + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0x10], ecx
cmp dword [ebx + 8], eax
mov dword [ebp - 4], eax
jbe 0x428fe9
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x428f73
mov ecx, dword [ecx + 4]
mov edx, dword [ebx + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x428f73
test edi, edi
mov dword [ebp - 8], edi
je 0x428f6d
mov eax, dword [edi]
mov dword [ebp + 0xc], eax
mov eax, dword [edi + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0x10], eax
jmp 0x428fd9
and dword [ebp + 0x10], 0
jmp 0x428fd9
mov ecx, dword [ebx + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x428fd9
push 0xc
call fcn.004486a4
mov esi, eax
test esi, esi
pop ecx
je 0x428fb8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebx + 0xc]
mov edx, dword [ebp - 0x10]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.user32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0xc]
mov dword [esi], eax
jmp 0x428fba
xor esi, esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x428fd4
push dword [ebp - 8]
call fcn.00442f56
jmp 0x428fd9
call fcn.00442f2d
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jb 0x428f41
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x432263
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x432280
call fcn.004348e5
mov dword [eax], 0x16
xor eax, eax
jmp 0x4322ea
push esi
push 0x88
push 1
call fcn.00434dc8
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4322d5
push esi
call fcn.00435c08
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x4322b3
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x4321bf
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
jne 0x4322e9
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.00432775
test ebx, ebx
pop ecx
je 0x4322e7
push ebx
call fcn.004348f7
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4331ed
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x43320d
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.004348f7
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x433230
test byte [esp + 8], 2
je 0x433230
call fcn.004348e5
mov dword [eax], 0xd
call fcn.004348ee
mov dword [eax], 5
jmp 0x433209
xor eax, eax
ret