joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4088a7
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
xor esi, esi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x408911
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x408901
inc eax
jmp 0x408925
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
imul eax, dword [ebp - 0xc]
shr eax, 0x14
jmp 0x40891f
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
shl eax, 0xc
shr ecx, 0x14
add eax, ecx
cmp eax, dword [ebp + 0xc]
sbb eax, eax
inc eax
pop esi
leave
ret

Function at 0x408928
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push esi
push edi
lea eax, [ebp - 0x40c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.00412594
lea edi, [ebp - 0xc]
add esp, 0x14
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x408962
push 0x420204
lea eax, [ebp - 0xc]
mov esi, 0x420200
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop edi
test eax, eax
pop esi
lea eax, [ebp - 0xc]
jne 0x408995
push 0x19
push eax
call fcn.004088a7
pop ecx
pop ecx
leave
ret
push 0xf
push eax
call fcn.004088a7
test eax, eax
pop ecx
pop ecx
je 0x4089ba
push 0xa
push 0x420208
call fcn.004088a7
test eax, eax
pop ecx
pop ecx
je 0x4089ba
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x408a60
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.004118d0
push esi
push edi
mov esi, 0x800
push esi
lea eax, [ebp - 0x808]
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.msi.dll
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x1008]
push eax
push esi
push edi
lea eax, [ebp - 0x808]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x408af9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x420218
lea eax, [ebp - 0x1008]
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x408af9
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 8]
xor esi, esi
mov eax, 0x20000
inc esi
cmp ecx, eax
ja 0x408ae9
jne 0x408aeb
cmp dword [edx + 0xc], 0xa280000
jb 0x408aeb
mov edi, esi
cmp ecx, 0x30000
jb 0x408af9
mov dword [0x427cb8], esi
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x408aff
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push esi
xor esi, esi
cmp dword [0x427cb4], esi
je 0x408b3a
push 0x400
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x408]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
inc esi
jmp 0x408b82
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstaller
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408b82
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push esi
push str.InstallerLocation
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408b79
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x408cb6
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00410a4c
cmp dword [0x427cc4], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop ecx
je 0x408cda
push 0
push edi
call ebx
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push str._sSun_
push edi
call esi
add esp, 0xc
cmp dword [0x427cc4], 0
je 0x408cfa
push 0
push edi
call ebx
push edi
push str._sJava_
push edi
call esi
add esp, 0xc
cmp dword [0x427cc4], 0
je 0x408d14
push 0
push edi
call ebx
push 0x4202dc
push 0x4202e4
push edi
push str._s_s_s
push edi
call esi
add esp, 0x14
cmp dword [0x427cc4], 0
je 0x408d38
push 0
push edi
call ebx
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
movzx eax, word [ebp + 0x10]
push eax
push 0x4202f0
push dword [ebp + 0xc]
push str._s_s_d.MST
push dword [ebp + 0xc]
call esi
push 0x420300
push 0x420308
push edi
push str._s_s_s.msi
push edi
call esi
add esp, 0x28
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x408e5f
Capabilities:
Delete file

Disassembly:
push esi
push edi
push dword [esp + 0x10]
call fcn.0040e3a3
push dword [esp + 0x10]
mov edi, eax
push 0xffffffffffffffff
call fcn.00408d74
add esp, 0xc
test edi, edi
mov esi, eax
je 0x408e84
test esi, esi
je 0x408ea1
push dword [esp + 0xc]
push 0
call fcn.00408d74
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x408ea1
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
mov eax, esi
pop esi
ret

Function at 0x408f4f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x94]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
pop edi
jne 0x408f95
cmp dword [ebp - 0x8c], 2
jne 0x408f95
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x40929b
Capabilities:
Check http status code
Connect to http server
Create http request
Parse url
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420630
push 0x41140c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
mov eax, 0x2058
call fcn.004118d0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x30], 4
push dword [ebp + 8]
push 0x420318
lea eax, [ebp - 0x1070]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 4], ebx
mov esi, 0x800
push esi
lea eax, [ebp - 0x870]
push eax
call fcn.00409021
pop ecx
pop ecx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x870]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x409443
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x70]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x70], 0x3c
lea eax, [ebp - 0x2070]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], esi
mov word [ebp - 0x58], bx
lea eax, [ebp - 0x1870]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], esi
lea eax, [ebp - 0x870]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x70]
push eax
push ebx
lea eax, [ebp - 0x1070]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x1070]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
push ebx
push ebx
push 3
push 0x42031b
push 0x42031c
push dword [ebp - 0x58]
push dword [ebp - 0x60]
push dword [ebp - 0x24]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x409443
push ebx
push 0x4440000
push ebx
push 0x42031d
push 0x420320
lea ecx, [ebp - 0x1870]
push ecx
push 0x42032c
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, ebx
je 0x409443
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x4093fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34], eax
sub eax, 0x2ee2
je 0x4093f5
sub eax, 5
je 0x4093f5
sub eax, 0x16
jne 0x4093fc
mov dword [ebp - 0x20], 0x80004005
mov dword [ebp - 0x1c], ebx
push ebx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x20000013
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x409443
cmp dword [ebp - 0x1c], 0x197
jne 0x40942a
mov dword [ebp - 0x20], 0x80070210
jmp 0x409443
cmp dword [ebp - 0x1c], 0x190
je 0x40943c
cmp dword [ebp - 0x1c], 0x194
jne 0x409443
mov dword [ebp - 0x20], 0x80070211
or dword [ebp - 4], 0xffffffff
call fcn.00409460
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40974c
Capabilities:
Create process on windows
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
or dword [ebp - 4], 0xffffffff
push esi
push edi
xor eax, eax
push 0x11
pop ecx
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor esi, esi
cmp dword [0x427cc0], esi
stosd dword es:[edi], eax
mov dword [ebp - 0x58], 0x44
je 0x4097af
push 0x427c8c
push 0x4204b0
push esi
call fcn.0040ec7e
push 0x427c78
push 0x4204b8
push esi
call fcn.0040ec7e
push 0x427778
push 0x4204c0
push esi
call fcn.0040ec7e
add esp, 0x24
jmp 0x4097be
push esi
push 0x4204d0
push esi
call fcn.0040ec7e
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
pop esi
je 0x4097fe
push dword [ebp - 0x14]
call fcn.004012bc
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40980c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call fcn.0040967f
mov eax, dword [ebp - 4]
leave
ret

Function at 0x409a42
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push esi
push dword [ebp + 8]
xor esi, esi
call fcn.00408805
test eax, eax
pop ecx
je 0x409abe
push dword [ebp + 0xc]
lea eax, [ebp - 0x800]
push str._C:_msiinst.exe__delayrebootq_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0xc]
call fcn.00409811
add esp, 0x14
test eax, eax
mov ecx, 0xbc2
je 0x409a96
cmp eax, ecx
je 0x409a96
cmp eax, 0x669
jne 0x409abe
xor esi, esi
inc esi
cmp eax, ecx
jne 0x409abe
push str.REBOOT
push dword [ebp + 0x14]
call fcn.00411a80
test eax, eax
pop ecx
pop ecx
jne 0x409abe
push str.REBOOTFORCE
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, esi
pop esi
leave
ret
Function at 0x40aca5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, word [ebp + 8]
push ebx
push esi
mov esi, dword [0x427df4]
push 0xf0
push eax
push esi
mov ebx, ecx
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40ad5f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40ad5f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40ad5f
push edi
call dword [0x426060]
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ax, word [esi]
test ax, ax
je 0x40ad5e
inc esi
inc esi
mov cx, word [esi]
inc esi
inc esi
mov edx, dword [esi]
add esi, 4
cmp cx, 0x403
mov dword [ebp + 8], edx
jne 0x40ad23
push esi
push 0
push 0x143
jmp 0x40ad43
cmp cx, 0x1234
jne 0x40ad55
or dword [ebp - 0x24], 0xffffffff
lea ecx, [ebp - 0x28]
push ecx
push 0
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x20], esi
push 0x401
movzx eax, ax
push eax
push dword [ebx + 4]
call edi
cmp eax, 0xffffffff
jne 0x40ad55
and dword [ebp - 4], 0
add esi, dword [ebp + 8]
cmp dword [ebp - 4], 0
jne 0x40acfb
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 4
Function at 0x40b643
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x41df1b
call fcn.00412124
sub esp, 0x418
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
call dword [0x426060]
xor ebx, ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x424], ebx
cmp dword [ebp + 8], ebx
mov byte [ebp - 4], 1
je 0x40b6ec
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
cmp edi, 0x400
jg 0x40b6b5
push edi
call fcn.00407585
test al, al
pop ecx
je 0x40b6b5
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.004118d0
mov dword [ebp - 0x10], esp
mov esi, esp
jmp 0x40b6cb
lea eax, [edi + 8]
push eax
call fcn.004121fd
cmp eax, ebx
pop ecx
je 0x40b6ec
mov dword [eax], ebx
mov dword [ebp - 0x18], eax
lea esi, [eax + 8]
cmp esi, ebx
je 0x40b6ec
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov byte [esi], bl
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x40b6ee
xor eax, eax
cmp eax, ebx
jne 0x40b715
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x40b70b
lea ecx, [ebp - 0x424]
call fcn.0040b829
mov esi, 0x8007000e
jmp 0x40b808
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x14], edi
jne 0x40b734
call fcn.00403aa5
mov esi, eax
jmp 0x40b7ef
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
je 0x40b756
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp + 0x10], eax
jne 0x40b760
call fcn.00403aa5
jmp 0x40b7e4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 8], eax
inc eax
cmp eax, 0x400
mov byte [ebp - 4], 2
jbe 0x40b78b
push eax
lea ecx, [ebp - 0x424]
call fcn.0040c84b
jmp 0x40b79b
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], eax
jmp 0x40b79b
mov edi, dword [ebp - 0x424]
cmp edi, ebx
mov dword [ebp - 4], 1
jne 0x40b7b3
mov esi, 0x8007000e
jmp 0x40b7e6
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push dword [ebp + 0x14]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp + 8]
mov byte [ecx + eax], bl
push dword [ebp - 0x424]
lea ecx, [ebp - 0x20]
call fcn.0040b832
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x40b808
lea ecx, [ebp - 0x424]
call fcn.0040b829
lea ecx, [ebp - 0x18]
call fcn.004075de
mov eax, esi
lea esp, [ebp - 0x430]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40c321
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.00408569
cmp eax, esi
jne 0x40c399
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x40c362
lea eax, [ebp - 0x110]
push eax
call fcn.0040c321
cmp eax, esi
jne 0x40c398
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 8], pe_nt_image_headers32
call edi
test eax, eax
lea ecx, [ebp - 4]
je 0x40c352
call fcn.00408552
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
lea ecx, [ebp - 4]
mov esi, eax
call fcn.00408552
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x40c757
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x40c762
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x40d39a
Capabilities:
Delete registry value
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x218
push edi
lea eax, [ebp + 0x6c]
push 1
push eax
call fcn.0040e99a
test eax, eax
pop ecx
pop ecx
je 0x40d578
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push esi
push 4
pop ebx
push 0x420a44
lea eax, [ebp + 0x64]
push eax
mov dword [ebp + 0x70], ebx
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
push 0
push 0x420a48
push dword [ebp + 0x6c]
mov dword [ebp + 0x70], 3
call esi
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp + 0x68]
push eax
push 0
push 0x420a50
push dword [ebp + 0x6c]
mov byte [ebp - 0x1a4], 0
mov dword [ebp + 0x70], pe_nt_image_headers32
call esi
push 0x420a60
lea eax, [ebp - 0x24]
push eax
call edi
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x68]
push eax
push 0
push 0x420a64
push dword [ebp + 0x6c]
mov dword [ebp + 0x70], 0x80
call esi
push 0x420a78
lea eax, [ebp - 0xa4]
push eax
call edi
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp + 0x68]
push eax
xor edi, edi
push edi
push 0x420a7c
push dword [ebp + 0x6c]
mov dword [ebp + 0x70], 0x80
call esi
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x68]
push eax
push edi
push 0x420a8c
push dword [ebp + 0x6c]
mov dword [ebp + 0x70], ebx
call esi
test eax, eax
jne 0x40d4d7
push edi
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp + 0x64]
push eax
push 0x420a9c
lea eax, [ebp - 0x1a4]
push 0x420aa0
push eax
call fcn.0040fe4a
add esp, 0x20
test eax, eax
je 0x40d4d7
push 0x420aa4
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x68]
push eax
push edi
push 0x420ab4
push dword [ebp + 0x6c]
mov dword [ebp + 0x70], ebx
mov dword [ebp + 0x60], edi
call esi
test eax, eax
jne 0x40d56b
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x68]
push eax
push edi
push 0x420ac4
push dword [ebp + 0x6c]
mov dword [ebp + 0x70], ebx
mov dword [ebp + 0x5c], edi
call esi
push dword [ebp + 0x5c]
lea eax, [ebp - 0x24]
push dword [ebp + 0x60]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp + 0x64]
push eax
push 0x420ad8
lea eax, [ebp - 0x1a4]
push 0x420adc
push eax
call fcn.0040fe4a
add esp, 0x20
test eax, eax
je 0x40d56b
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x420ae0
push dword [ebp + 0x6c]
call esi
push 0x420af4
push dword [ebp + 0x6c]
call esi
push 0x420b08
push dword [ebp + 0x6c]
call esi
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
jmp 0x40d57a
xor edi, edi
mov dword [0x427d1c], edi
xor eax, eax
pop edi
add ebp, 0x74
leave
ret 4
Function at 0x40d58a
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.0040f701
test eax, eax
jne 0x40d59b
leave
ret
push ebx
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push 1
xor ebx, ebx
push eax
mov dword [ebp - 8], ebx
call fcn.0040e99a
test eax, eax
pop ecx
pop ecx
je 0x40d647
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x420b18
push dword [ebp - 4]
call edi
mov esi, eax
neg esi
sbb esi, esi
inc esi
jne 0x40d605
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x420b28
push dword [ebp - 4]
call edi
mov esi, eax
neg esi
sbb esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
cmp esi, ebx
pop esi
je 0x40d647
cmp dword [0x427d1c], ebx
jne 0x40d647
cmp dword [ebp + 8], ebx
jne 0x40d637
push 0x427d1c
push ebx
push ebx
push fcn.0040d39a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x40d647
push ebx
mov dword [0x427d1c], 1
call fcn.0040d39a
xor eax, eax
inc eax
pop ebx
leave
ret

Function at 0x40dcdd
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x9c
and dword [ebp + 0x74], 0
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x14], 2
pop edi
jne 0x40dd6f
cmp dword [ebp - 0x20], 6
je 0x40dd6a
cmp dword [ebp - 0x20], 5
jne 0x40dd6f
cmp dword [ebp - 0x1c], 1
jae 0x40dd6a
lea eax, [ebp - 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40dd27
sub eax, edx
mov dword [ebp + 0x70], eax
je 0x40dd5e
lea eax, [ebp - 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40dd3b
sub eax, edx
mov dword [ebp + 0x70], eax
je 0x40dd5e
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp - 0x10]
push 0x421118
push eax
call fcn.00412a88
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x40dd6f
cmp dword [ebp + 0x74], 2
jb 0x40dd6f
xor eax, eax
inc eax
jmp 0x40dd71
xor eax, eax
add ebp, 0x78
leave
ret

Function at 0x40dd76
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xc], 2
pop edi
jne 0x40ddbd
cmp dword [ebp - 0x18], 6
jne 0x40ddaf
xor eax, eax
inc eax
jmp 0x40ddbf
cmp dword [ebp - 0x18], 5
jne 0x40ddbd
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
je 0x40ddbf
xor eax, eax
add ebp, 0x78
leave
ret