joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406a8f
Capabilities:
Get common file path

Disassembly:
mov eax, 0x43372b
call fcn.0042617c
sub esp, 0x12c
and byte [ebp - 0x138], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x137]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and dword [ebp - 0x14], 0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x406b05
lea eax, [ebp - 0x138]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x406b05
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x406b05
mov eax, dword [ebp - 0x10]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp byte [ebp - 0x138], 0
lea eax, [ebp - 0x138]
push ebx
push eax
je 0x406b3e
lea ecx, [ebp - 0x34]
call fcn.00406b94
push 1
mov dword [ebp - 0x34], 0x436480
pop ebx
mov dword [ebp - 0x14], ebx
and dword [ebp - 4], 0
push 0x43f3c4
lea ecx, [ebp - 0x34]
call fcn.00404baf
jmp 0x406b53
lea ecx, [ebp - 0x24]
call fcn.00406b94
push 2
mov dword [ebp - 0x24], 0x436480
pop ebx
lea eax, [ebp - 0x24]
mov edi, dword [ebp + 8]
push eax
mov ecx, edi
call fcn.004030e5
or ebx, 4
mov dword [edi], 0x436480
test bl, 2
je 0x406b77
lea ecx, [ebp - 0x24]
and ebx, 0xfffffffd
call fcn.0040311b
test bl, 1
pop ebx
je 0x406b85
lea ecx, [ebp - 0x34]
call fcn.0040311b
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
leave
ret
Function at 0x4072d7
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x433790
call fcn.0042617c
sub esp, 0x70
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.0040438f
xor esi, esi
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], esi
call fcn.004030e5
mov dword [ebp - 0x40], 0x436480
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 2
call fcn.0040311b
lea ecx, [ebp - 0x40]
call fcn.00403c8a
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40742b
push dword [ebp - 0x34]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x14], eax
mov eax, 0x436448
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x30], eax
push esi
lea eax, [ebp - 0x10]
push 1
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
mov dword [ebp - 0x10], 0x5c
call fcn.00403d2f
cmp eax, esi
jle 0x407413
push ebx
push edi
lea ebx, [eax + 1]
lea eax, [ebp - 0x50]
push ebx
push esi
push eax
lea ecx, [ebp - 0x20]
call fcn.00405cb6
mov edi, dword [eax + 0xc]
mov byte [ebp - 4], 5
push edi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
push edi
lea ecx, [ebp - 0x24]
call fcn.004051d1
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 4
call fcn.004031de
cmp dword [ebp - 0x14], esi
jne 0x4073b1
xor eax, eax
jmp 0x4073ba
push dword [ebp - 0x14]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
lea eax, [ebp - 0x60]
push ebx
push eax
lea ecx, [ebp - 0x20]
call fcn.00405cb6
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.00403cf7
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 4
call fcn.004031de
lea ecx, [ebp - 0x30]
call fcn.00403c8a
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
lea eax, [ebp - 0x10]
push 1
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], 0x5c
call fcn.00403d2f
cmp eax, esi
jg 0x407373
pop edi
pop ebx
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.004031de
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.004031de
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040311b
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x408e51
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4339e5
call fcn.0042617c
push ecx
push esi
mov esi, ecx
xor ecx, ecx
mov eax, 0x436448
mov dword [esi + 0x10], ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 4], eax
mov dword [esi + 0x20], ecx
mov dword [ebp - 4], ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x30], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x24], eax
mov ecx, esi
mov byte [ebp - 4], 2
mov dword [esi], 0x436648
call fcn.00408f17
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40967b
Capabilities:
Check os version

Disassembly:
mov eax, 0x433a82
call fcn.0042617c
sub esp, 0x98
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
call fcn.0040ac1f
mov ecx, 0x436e18
mov dword [ebx + 0x50], 0x4366b4
mov dword [ebx + 0x54], 0x4366b0
lea edi, [ebx + 0x5c]
mov esi, ecx
mov dword [ebx + 0x80], 0xfefefefe
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x6c]
mov esi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
movsd dword es:[edi], dword [esi]
mov word [ebx + 0x7c], ax
mov word [ebx + 0x7e], ax
mov dword [ebx + 0xa8], eax
mov dword [ebp - 4], eax
mov dword [ebx + 0xb4], eax
lea esi, [ebx + 0xb8]
mov ecx, 0x436448
mov dword [esi + 0xc], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi], ecx
lea edi, [ebx + 0xc8]
mov dword [edi + 0xc], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi], ecx
push 0x7f89
push eax
mov byte [ebp - 4], 3
mov dword [ebx], 0x4366a0
mov dword [ebx + 0x50], 0x43669c
mov dword [ebx + 0x54], 0x436698
mov dword [ebx + 0x58], 0x436678
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x8c], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push str.AnimateWindow
push 0x43f6e8
mov dword [ebx + 0x94], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
and dword [ebx + 0x98], 0
mov dword [ebx + 0x9c], eax
push 0x94
lea eax, [ebp - 0xa4]
push 0
push eax
call fcn.004261a0
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa0], 5
lea eax, [ebx + 0xa0]
mov byte [eax], 1
jb 0x4097b0
and byte [eax], 0
mov eax, dword [ebp + 8]
and dword [ebx + 0xa4], 0
mov dword [ebx + 0xac], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xb0], eax
lea eax, [ebx + 0xb4]
push 0
push eax
call fcn.00402f6b
push dword [ebp + 0x10]
mov ecx, esi
call fcn.00403cf7
push dword [ebp + 0x14]
mov ecx, edi
call fcn.00403cf7
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x40a83b
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
cmp eax, 0x42d
je 0x40a9c3
cmp eax, 0x403
je 0x40a9c3
cmp eax, 0x402
je 0x40a9c3
cmp eax, 0x804
je 0x40a9c3
cmp eax, 0x41a
je 0x40a9c3
cmp eax, 0x405
je 0x40a9c3
cmp eax, 0x406
je 0x40a9c3
cmp eax, 0x40b
je 0x40a9c3
cmp eax, 0x408
je 0x40a9c3
cmp eax, 0x40e
je 0x40a9c3
cmp eax, 0x421
je 0x40a9c3
mov edx, 0x411
cmp eax, edx
je 0x40a9c3
cmp eax, 0x412
je 0x40a9c3
cmp eax, 0x415
je 0x40a9c3
cmp eax, 0x816
je 0x40a9c3
cmp eax, 0x416
je 0x40a9c3
cmp eax, 0x418
je 0x40a9c3
cmp eax, 0x419
je 0x40a9c3
cmp eax, 0x424
je 0x40a9c3
cmp eax, 0x41b
je 0x40a9c3
cmp eax, 0x41e
je 0x40a9c3
cmp eax, 0x41f
je 0x40a9c3
cmp eax, 0xc0c
je 0x40a9c3
mov ecx, eax
and ecx, 0xff
cmp ecx, 0xa
jne 0x40a956
mov eax, 0x40a
ret
cmp ecx, 7
jne 0x40a961
mov eax, 0x407
ret
cmp ecx, 9
jne 0x40a96c
mov eax, 0x409
ret
cmp ecx, 0xc
jne 0x40a977
mov eax, 0x40c
ret
cmp ecx, 0x13
jne 0x40a982
mov eax, 0x413
ret
cmp ecx, 0x10
jne 0x40a98d
mov eax, 0x410
ret
cmp ecx, 0x14
jne 0x40a998
mov eax, 0x414
ret
cmp ecx, 0x1d
jne 0x40a9a3
mov eax, 0x41d
ret
cmp ecx, 4
jne 0x40a9ae
mov eax, 0x404
ret
xor ecx, ecx
cmp eax, 0xc1a
setne cl
dec ecx
and ecx, edx
add ecx, 0x409
mov eax, ecx
ret
Function at 0x40b8e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
mov dword [ebp - 4], ecx
jne 0x40b8fc
mov dword [ebp + 0xc], 0x409
cmp byte [ebp + 0x10], 0
je 0x40b94c
mov eax, dword [0x4447b4]
cmp eax, edi
mov dword [ebp + 0x10], eax
jne 0x40b912
xor esi, esi
jmp 0x40b93f
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.00426210
mov esi, esp
push edi
push edi
push ebx
and byte [esi], 0
push esi
push 0xffffffffffffffff
push dword [ebp + 0x10]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, edi
jne 0x40b959
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
call fcn.0040bb92
mov ebx, eax
push dword [0x43648c]
mov ecx, dword [ebp - 4]
push edi
call fcn.0040ba38
mov ecx, dword [ebp + 8]
push dword [ebp + 0xc]
mov eax, ecx
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceExA]
shr eax, 4
inc eax
and ecx, 0xf
movzx edi, ax
push edi
push 6
push ebx
mov dword [ebp + 8], ecx
mov dword [ebp + 0x10], 1
call esi
test eax, eax
jne 0x40b9c5
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x10], 2
and ax, 0x3ff
or ah, 4
push eax
push edi
push 6
push ebx
call esi
test eax, eax
jne 0x40b9c5
push 6
push edi
push ebx
mov dword [ebp + 0x10], 3
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40ba2c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40b9f2
xor edx, edx
mov cx, word [eax]
test cx, cx
je 0x40b9ea
inc eax
inc eax
cmp edx, dword [ebp + 8]
movzx ecx, cx
je 0x40ba1c
lea eax, [eax + ecx*2]
jmp 0x40b9ec
inc eax
inc eax
inc edx
cmp edx, 0x10
jl 0x40b9d3
cmp dword [ebp + 0x10], 1
jne 0x40ba14
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x10], 2
and ax, 0x3ff
or ah, 4
push eax
push edi
push 6
push ebx
call esi
test eax, eax
jne 0x40b9c5
cmp dword [ebp + 0x10], 2
jne 0x40ba2c
jmp 0x40b9b0
push ecx
mov ecx, dword [ebp - 4]
push eax
push 0
call fcn.0040baf4
mov al, 1
jmp 0x40ba2e
xor al, al
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40bd8a
Capabilities:
Check os version
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
jae 0x40be05
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp ax, 0x804
jne 0x40bdc6
push 0x43f980
jmp 0x40bdf0
cmp ax, 0x404
jne 0x40bdd3
push 0x43f978
jmp 0x40bdf0
and eax, 0xff
cmp ax, 0x11
jne 0x40bde5
push str.MS_UI_Gothic
jmp 0x40bdf0
cmp ax, 0x12
jne 0x40be05
push 0x43f960
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0xc]
mov word [eax], 9
mov al, 1
leave
ret
xor al, al
leave
ret
Function at 0x40e7d2
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, 0x434070
call fcn.0042617c
sub esp, 0x64
push esi
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004030e5
mov dword [ebp - 0x1c], 0x436480
xor esi, esi
mov eax, str.__del
cmp word [str.__del], si
mov dword [ebp - 4], esi
mov ecx, eax
je 0x40e80c
inc ecx
inc ecx
cmp word [ecx], si
jne 0x40e805
sub ecx, eax
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.00404b27
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.004049c0
push 0x44
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.004261a0
push 0x10
lea eax, [ebp - 0x2c]
push esi
push eax
mov dword [ebp - 0x70], 0x44
call fcn.004261a0
add esp, 0x18
lea ecx, [ebp - 0x1c]
call fcn.00403c8a
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push esi
push 0x20
push esi
push esi
push esi
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040311b
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40e883
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x434084
call fcn.0042617c
mov eax, 0x4130
call fcn.00426210
lea eax, [ebp - 0x38]
push ebx
push eax
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
push 0x20019
push ebx
push ebx
push ebx
push str.SOFTWAREInstallShieldUpdate_ServiceScheduler
mov dword [ebp - 0x20], ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40ea16
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x40ea0d
cmp dword [ebp - 0x18], ebx
je 0x40ea0d
push esi
push edi
mov ecx, 0xfff
lea edi, [ebp - 0x413b]
mov byte [ebp - 0x413c], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
xor eax, eax
lea edi, [ebp - 0x13b]
mov byte [ebp - 0x13c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor edi, edi
cmp dword [ebp - 0x18], ebx
mov byte [ebp - 0xd], bl
jbe 0x40e9fd
mov esi, 0x43fd38
cmp byte [ebp - 0xd], bl
jne 0x40e9fd
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 0x3fff
push eax
lea eax, [ebp - 0x13c]
push eax
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
lea eax, [ebp - 0x413c]
push eax
push edi
push dword [ebp - 0x14]
mov dword [ebp - 0x24], 0x104
mov byte [ebp - 0x413c], bl
mov byte [ebp - 0x13c], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea eax, [ebp - 0x13c]
lea ecx, [ebp - 0x34]
push eax
call fcn.00406b94
mov dword [ebp - 0x34], 0x436480
cmp word [0x43fd38], bx
mov dword [ebp - 4], ebx
mov eax, esi
je 0x40e99e
inc eax
inc eax
cmp word [eax], bx
jne 0x40e997
sub eax, esi
lea ecx, [ebp - 0x34]
sar eax, 1
push eax
push esi
push ebx
call fcn.00413858
cmp word [0x43fd38], bx
mov eax, esi
je 0x40e9bf
inc eax
inc eax
cmp word [eax], bx
jne 0x40e9b8
sub eax, esi
lea ecx, [ebp - 0x34]
sar eax, 1
push eax
push esi
call fcn.00404b27
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x20]
add eax, 0x10
push eax
call fcn.0041793a
pop ecx
test al, al
pop ecx
je 0x40e9e7
mov byte [ebp - 0xd], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.0040311b
inc edi
cmp edi, dword [ebp - 0x18]
jb 0x40e92e
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0xd]
pop edi
pop esi
jmp 0x40ea18
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40fc47
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x434288
call fcn.0042617c
sub esp, 0x2c
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
push 0x20019
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0040fd30
push 0x14
mov dword [ebp - 0x1c], ebx
pop eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], 0x436448
push eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00405245
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0040ab9d
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push str.Version
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.0040ab62
cmp dword [ebp - 0x1c], ebx
je 0x40fcdf
push dword [ebp - 0x1c]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x40fcfd
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.004031de
cmp dword [ebp - 0x10], ebx
je 0x40fcf8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
pop eax
jmp 0x40fd23
mov eax, dword [ebp - 0x1c]
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
movzx esi, word [eax]
sub esi, 0x30
call fcn.004031de
cmp dword [ebp - 0x10], ebx
je 0x40fd20
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41069b
Capabilities:
Set registry value

Disassembly:
mov eax, 0x4343f8
call fcn.0042617c
sub esp, 0x30
push ebx
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push edi
push 0x44027c
call esi
xor ebx, ebx
mov edi, 0x436448
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], edi
push 0x440278
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.004069c4
push str.Database
call esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00403c8a
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [ebp - 0x28]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x410766
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x14], esi
call fcn.00403c8a
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0x38]
mov ecx, edi
mov dword [ebp - 0x18], eax
call fcn.00403c8a
mov edi, dword [edi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push 1
push ebx
push dword [ebp - 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp esi, ebx
je 0x410766
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], bl
call fcn.004031de
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004031de
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x410b34
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ebx
jne 0x410b4e
xor esi, esi
jmp 0x410b7c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.00426210
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 4], edi
jne 0x410bb9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x410ba4
call esi
mov esi, eax
jmp 0x410c4e
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x410c4e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x410bea
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x410bfd
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x410c45
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
mov dword [ebp + 8], edi
jne 0x410c01
jmp 0x410bcc
call esi
jmp 0x410c43
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [ebp + 8]
cmp byte [esi + eax], bl
je 0x410c37
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.00426210
lea eax, [esi + 1]
mov edi, esp
push eax
push dword [ebp + 8]
push edi
call fcn.00426860
add esp, 0xc
mov byte [edi + esi], bl
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push edi
call fcn.00410cb5
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [ebp - 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x411671
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x434468
call fcn.0042617c
sub esp, 0x114
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebx]
call fcn.0040fd30
mov edi, eax
cmp edi, esi
je 0x4116bb
cmp dword [ebp - 0x10], esi
je 0x4116b4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x411758
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x41172c
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x10]
push eax
call fcn.00411671
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x411719
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x120]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x4116de
cmp dword [ebp - 0x10], esi
je 0x411727
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
jmp 0x411758
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x41173f
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 0x10], esi
mov ebx, eax
je 0x411756
push dword [ebp - 0x10]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x411769
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.00426210
push ebx
push esi
lea eax, [ebp - 0x2014]
push edi
mov esi, ecx
push eax
mov dword [ebp - 0x14], esi
call fcn.00410e0e
xor edi, edi
cmp eax, edi
jl 0x411921
lea eax, [ebp - 0xa]
push eax
lea eax, [ebp - 0x2014]
push eax
call fcn.0041192e
pop ecx
test eax, eax
pop ecx
jne 0x4117b4
mov eax, 0x80020009
jmp 0x411921
mov ecx, esi
call fcn.00410de6
lea eax, [ebp - 0x1014]
mov ecx, esi
push eax
call fcn.00410e0e
cmp eax, edi
jl 0x411921
movzx eax, word [ebp - 0xa]
sub eax, 8
je 0x4118e9
sub eax, 9
je 0x41184e
dec eax
dec eax
jne 0x411910
lea eax, [ebp - 0x1014]
test eax, eax
jne 0x4117f9
xor ebx, ebx
jmp 0x41182e
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.00426210
mov ebx, esp
push esi
push ebx
lea eax, [ebp - 0x1014]
push 0xffffffffffffffff
push eax
push edi
push edi
mov word [ebx], di
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push ebx
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [ebp - 0x10]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
jmp 0x411901
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test al, 1
mov dword [ebp - 8], eax
jne 0x41188a
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.00426210
mov dword [ebp - 4], esp
push ebx
push edi
push dword [ebp - 4]
call fcn.004261a0
add esp, 0xc
cmp dword [ebp - 4], edi
jne 0x411894
mov eax, 0x80004005
jmp 0x411921
cmp dword [ebp - 8], 0
jle 0x4118ce
mov ecx, dword [ebp - 4]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + ecx]
mov al, byte [ebp + edi - 0x1014]
push eax
call fcn.004119b5
pop ecx
mov ecx, edi
push 4
and ecx, 1
shl ecx, 2
mov edx, ecx
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc edi
cmp edi, dword [ebp - 8]
jl 0x41189a
mov eax, dword [ebp + 8]
push ebx
push dword [ebp - 4]
mov eax, dword [eax]
push 3
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edi, edi
jmp 0x411910
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x1014]
push eax
push 1
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.00410e0e
cmp eax, edi
jl 0x411921
xor eax, eax
lea esp, [ebp - 0x2020]
pop edi
pop esi
pop ebx
leave
ret 0xc