joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41410a
Capabilities:
Check if file exists
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, edx
mov dword [ebp - 4], eax
push edi
mov edi, ecx
test eax, eax
jne 0x414125
mov eax, 0x10da
jmp 0x4141a7
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x414147
test bl, 1
je 0x414147
mov ecx, ebx
and ecx, 0xfffffffe
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor esi, esi
push esi
push 0x2000080
push 2
push esi
push esi
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x41418f
push esi
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 8]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x414184
call fcn.00413ed5
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x414196
call fcn.00413ed5
mov esi, eax
cmp ebx, 0xffffffff
je 0x4141a3
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
pop ebx
pop edi
leave
ret

Function at 0x41427a
Capabilities:
Access pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push 0x2000000
push 3
push ebx
push 5
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x4142a9
mov esi, 0xffff
jmp 0x414327
push edi
push ebx
push ebx
push ebx
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push ebx
push ebx
push ebx
push 4
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov esi, 0xffff
test edi, edi
je 0x41431e
push edi
mov ebx, esi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
test eax, eax
je 0x4142e2
movzx ebx, word [eax + 4]
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
movzx eax, bx
sub eax, 0x14c
je 0x41431c
sub eax, 0x78
je 0x414318
sub eax, 0x3c
je 0x414314
sub eax, 0x8464
je 0x41430f
sub eax, 0x2400
jne 0x41431e
push 0xc
jmp 0x414311
push 9
pop esi
jmp 0x41431e
push 6
jmp 0x414311
push 5
jmp 0x414311
xor esi, esi
lea ecx, [ebp - 4]
call fcn.00411dea
pop edi
lea ecx, [ebp - 8]
call fcn.00411dea
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x414467
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, ecx
lea eax, [ebp - 4]
push eax
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
mov edi, edx
mov dword [ebp - 4], ecx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4144ea
mov eax, dword [ebp - 8]
test eax, eax
je 0x4144e5
cmp eax, 2
jbe 0x41449f
cmp eax, 7
jne 0x4144e5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add eax, 2
shr eax, 1
push eax
call fcn.00402070
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
xor eax, eax
push eax
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4144ea
mov eax, dword [ebp - 4]
shr eax, 1
je 0x4144d8
xor ecx, ecx
cmp word [esi + eax*2 - 2], cx
jne 0x4144d8
dec eax
mov ecx, dword [ebp + 8]
push eax
call fcn.004020f5
xor eax, eax
jmp 0x4144ea
mov eax, 0x65e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x414530
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0x20006
push 4
push esi
push esi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x414575
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x414695
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
call fcn.00402506
push eax
lea ecx, [ebp - 0x14]
call fcn.00402331
push 0x4000
lea ecx, [ebp - 0x14]
call fcn.00402070
xor ecx, ecx
mov esi, eax
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], esi
push eax
push ecx
push ecx
lea eax, [ebp - 8]
push eax
push ecx
push ecx
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
test ebx, ebx
jne 0x414786
jmp 0x41473e
push 0x4000
dec ecx
push esi
push ecx
push edi
mov dword [ebp - 8], ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
test esi, esi
jne 0x414739
and dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x3001f
push 4
push dword [ebp - 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x414726
mov ecx, dword [ebp - 4]
call fcn.00414798
mov esi, eax
cmp dword [ebp - 4], 0
je 0x414735
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x41473b
mov ebx, esi
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x4146e6
dec ecx
mov dword [ebp - 8], ecx
jmp 0x41477b
xor ecx, ecx
mov dword [ebp - 0x18], 0x4000
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x18]
dec eax
push ecx
push esi
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x414779
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x41477b
mov ebx, eax
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x41474b
dec eax
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004025d7
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x414d52
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x45b480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
pop ecx
push 0x4021
push 7
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x280]
push eax
push 0x100001
lea eax, [ebp - 0x254]
lea esi, [ebp + 8]
lea edi, [ebp - 0x280]
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov ebx, eax
test ebx, ebx
jne 0x414ee9
xor edi, edi
mov dword [ebp - 0x25c], eax
push edi
push edi
push 0xff
push 2
push 0x248
lea ecx, [ebp - 0x25c]
mov dword [ebp - 0x278], ecx
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x254]
push ecx
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x27c], eax
push ecx
push edi
push edi
push edi
push eax
jmp 0x414ecd
mov eax, dword [ebp - 0x214]
mov edx, dword [ebp - 0x218]
mov word [ebp - 0x25a], ax
mov word [ebp - 0x25c], ax
test dl, 0x10
je 0x414e64
test edx, 0x400
je 0x414e2d
test dword [ebp - 0x210], 0x20000000
jne 0x414e64
jmp 0x414e3e
mov edx, eax
lea ecx, [ebp - 0x20c]
call fcn.00414d2a
test al, al
jne 0x414ea8
sub esp, 0x18
lea esi, [ebp - 0x280]
push 6
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00414d52
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x414ea4
mov edx, dword [ebp - 0x218]
xor edi, edi
test dl, 1
je 0x414e7d
xor edx, 1
lea ecx, [ebp - 0x280]
call fcn.004150f1
mov esi, eax
test esi, esi
jne 0x414ea4
lea ecx, [ebp - 0x280]
call fcn.00414f7c
mov esi, eax
test esi, esi
je 0x414ea8
mov edx, dword [ebp - 0x218]
test dl, 1
je 0x414ea4
lea ecx, [ebp - 0x280]
call fcn.004150f1
mov ebx, esi
xor edi, edi
push edi
push edi
push 0xff
push 2
push 0x248
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x264]
push eax
push edi
push edi
push edi
push dword [ebp - 0x254]
call dword [sym.imp.ntdll.dll_ZwQueryDirectoryFile]
test eax, eax
je 0x414df8
push dword [ebp - 0x254]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004488a4
leave
ret
Function at 0x414f7c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
push 0x204000
push 5
lea eax, [ebp - 0x20]
mov esi, ecx
push eax
push esi
push 0x110000
lea eax, [ebp - 8]
mov dword [ebp - 0xc], esi
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
jne 0x4150ec
push 0xd
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 1
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
push dword [ebp - 8]
mov ebx, eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jne 0x414fdf
xor eax, eax
jmp 0x4150ec
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
movzx ecx, word [eax]
add ecx, 4
movzx eax, cx
push ecx
mov word [ebp - 0x18], ax
mov word [ebp - 0x16], ax
call edi
mov edx, dword [esi + 8]
mov dword [ebp - 0x14], eax
movzx ecx, word [edx]
push ecx
push dword [edx + 4]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0x10
movzx ecx, word [eax]
mov eax, dword [ebp - 0x14]
push 0x7e
pop edx
push 0x24
mov word [ecx + eax], dx
mov eax, dword [esi + 8]
pop edx
movzx ecx, word [eax]
mov eax, dword [ebp - 0x14]
mov word [ecx + eax + 2], dx
mov eax, dword [esi + 4]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x30], eax
xor eax, eax
push eax
push eax
push 0x5000
push 2
push eax
push 0x80
push eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x18
push eax
push 0x110000
lea eax, [ebp - 8]
mov dword [ebp - 0x2c], 0x40
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
push dword [ebp - 0x14]
mov ebx, dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
call ebx
mov eax, dword [esi + 8]
movzx esi, word [eax]
add esi, 0x10
push esi
call edi
mov edx, dword [ebp - 0xc]
mov edi, eax
mov edx, dword [edx + 8]
movzx ecx, word [edx]
push ecx
push dword [edx + 4]
lea ecx, [edi + 0xc]
push ecx
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xc]
add esp, 0x14
mov byte [edi], 1
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
push 0xa
push esi
push edi
movzx eax, word [eax]
mov dword [edi + 8], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
push edi
mov esi, eax
call ebx
pop ecx
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
neg esi
sbb esi, esi
and esi, dword [ebp - 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4150f1
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x45b480]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x204020
push 7
lea eax, [ebp - 0x3c]
mov esi, edx
push eax
push ecx
push 0x100100
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
jne 0x415151
push 8
pop ecx
push 4
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
push 0x28
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
push dword [ebp - 0x34]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004488a4
leave
ret

Function at 0x41515f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x18
push 0x456a78
call fcn.00448a10
mov ebx, edx
mov edi, ecx
and dword [ebp - 4], 0
push dword [ebp + 8]
push 1
push 0x10
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
jne 0x415198
call fcn.00413ed5
mov dword [ebp - 4], 0xfffffffe
jmp 0x415228
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x415187
and dword [ebp - 0x20], 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
call fcn.00448c60
mov dword [ebp - 0x18], esp
mov edi, esp
push esi
push dword [ebp - 0x24]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x44eb58
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x415187
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 0xc]
mov dword [ebx], eax
mov eax, dword [ecx + 8]
mov dword [ebx + 4], eax
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x415228
lea esp, [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4155ab
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00402506
push eax
lea ecx, [ebp - 4]
call fcn.00402331
lea ecx, [ebp - 4]
call fcn.00413d87
mov esi, dword [ebp - 4]
test eax, eax
jne 0x41568b
mov eax, dword [esi - 0xc]
lea ecx, [ebp - 4]
dec eax
push eax
call fcn.00411cbd
push 0x5c
pop ecx
cmp ax, cx
je 0x4155f8
push ecx
lea ecx, [ebp - 4]
call fcn.00401c04
mov esi, dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0xc], eax
lea eax, [esi - 0x10]
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.00402227
push dword [ebp - 0xc]
push edi
jmp 0x415645
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [edi - 0x10]
cmp eax, 0xb7
jne 0x415686
inc dword [ebp - 8]
call fcn.004025d7
lea ecx, [esi - 0x10]
call fcn.00402227
push dword [ebp - 0xc]
push dword [ebp - 8]
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str.patchmgr_x__x_
push eax
call fcn.00412d59
mov edi, dword [ebp - 4]
add esp, 0x10
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41561f
lea ecx, [edi - 0x10]
call fcn.00402227
add eax, 0x10
lea ecx, [edi - 0x10]
mov dword [ebx], eax
call fcn.004025d7
mov ecx, dword [ebp - 0x10]
jmp 0x41569b
call fcn.004025d7
call fcn.00402506
push eax
mov ecx, ebx
call fcn.00402331
lea ecx, [esi - 0x10]
call fcn.004025d7
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x4171dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push ecx
push 4
push str.Path
mov ebx, edx
mov edi, ecx
call fcn.00413578
mov esi, eax
test esi, esi
jne 0x417204
mov eax, 0x80004005
jmp 0x4172b8
push ecx
push 5
push str.Csidl
mov ecx, edi
call fcn.00413578
test eax, eax
jne 0x417242
mov edx, dword [esi + 4]
test edx, edx
je 0x417223
mov eax, dword [esi + 0xc]
jmp 0x417225
xor eax, eax
test edx, edx
jne 0x41722e
mov edx, 0x44c488
push eax
lea ecx, [ebp - 4]
call fcn.00414b6f
pop ecx
push eax
mov ecx, ebx
call fcn.00402280
jmp 0x4172ab
mov eax, dword [eax + 4]
test eax, eax
jne 0x41724e
mov eax, 0x44c488
push 0xa
xor edi, edi
push edi
push eax
call dword [sym.imp.msvcrt.dll_strtol]
add esp, 0xc
mov ecx, ebx
push edi
push eax
push 0x104
call fcn.00402070
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x41727f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4172b8
push ecx
mov ecx, ebx
call fcn.00411d9f
mov edx, dword [esi + 4]
test edx, edx
je 0x417293
mov edi, dword [esi + 0xc]
jmp 0x417298
mov edx, 0x44c488
push edi
lea ecx, [ebp - 4]
call fcn.00414b6f
pop ecx
mov ecx, ebx
mov edx, dword [eax]
call fcn.004135e3
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.004025d7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x417370
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
push ecx
push 0xc
push str.Architecture
mov edi, ecx
call fcn.00413578
mov esi, eax
test esi, esi
jne 0x417395
or eax, 0xffffffff
jmp 0x41742a
push ebx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esi + 4]
mov ebx, 0x44c488
test eax, eax
jne 0x4173ae
mov eax, ebx
mov esi, dword [sym.imp.msvcrt.dll_strtol]
push 0xa
push 0
push eax
call esi
movzx ecx, word [ebp - 0x24]
add esp, 0xc
cmp eax, ecx
jne 0x417427
push ecx
push 8
push str.Revision
mov ecx, edi
call fcn.00413578
test eax, eax
je 0x4173f4
mov eax, dword [eax + 4]
test eax, eax
jne 0x4173e2
mov eax, ebx
push 0xa
push 0
push eax
call esi
movzx ecx, word [ebp - 2]
add esp, 0xc
cmp eax, ecx
jne 0x417427
push ecx
push 5
push str.Level
mov ecx, edi
call fcn.00413578
test eax, eax
je 0x417422
mov eax, dword [eax + 4]
test eax, eax
jne 0x417410
mov eax, ebx
push 0xa
push 0
push eax
call esi
movzx ecx, word [ebp - 4]
add esp, 0xc
cmp eax, ecx
jne 0x417427
xor eax, eax
inc eax
jmp 0x417429
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4189ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
push edi
mov edi, edx
push eax
mov dword [ebp - 0x10], edi
call fcn.00418755
xor ebx, ebx
inc ebx
cmp eax, ebx
jne 0x418add
and dword [ebp - 8], 0
push ecx
push 5
push str.Value
mov ecx, edi
call fcn.00413578
test eax, eax
je 0x418adb
mov edx, dword [eax + 4]
test edx, edx
je 0x4189f8
mov ecx, dword [eax + 0xc]
jmp 0x4189fa
xor ecx, ecx
test ecx, ecx
je 0x418adb
test edx, edx
je 0x418a0b
mov eax, dword [eax + 0xc]
jmp 0x418a0d
xor eax, eax
test edx, edx
jne 0x418a16
mov edx, 0x44c488
push eax
lea ecx, [ebp - 0xc]
call fcn.00414b6f
pop ecx
lea ecx, [ebp - 8]
push ecx
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
push dword [eax]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0xc]
mov edi, eax
add ecx, 0xfffffff0
call fcn.004025d7
test edi, edi
je 0x418a4f
xor eax, eax
jmp 0x418add
push ecx
mov ecx, dword [ebp - 0x10]
push 4
push str.Type
call fcn.00413578
test eax, eax
je 0x418adf
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x418a6f
mov ecx, 0x44c488
mov eax, dword [ebp - 0x14]
sub eax, 1
je 0x418ad4
sub eax, 1
je 0x418acd
sub eax, 1
je 0x418ac6
sub eax, 1
je 0x418ab1
sub eax, 3
je 0x418aaa
dec eax
sub eax, 1
je 0x418aa3
dec eax
sub eax, 1
je 0x418a9c
or ebx, 0xffffffff
jmp 0x418adf
push str.REG_QWORD
jmp 0x418ab6
push str.REG_FULL_RESOURCE_DESCRIPTOR
jmp 0x418ab6
push str.REG_MULTI_SZ
jmp 0x418ab6
push str.REG_DWORD
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
jmp 0x418adf
push str.REG_BINARY
jmp 0x418ab6
push str.REG_EXPAND_SZ
jmp 0x418ab6
push str.REG_SZ
jmp 0x418ab6
mov eax, ebx
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x418aee
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop ebx
leave
ret
Function at 0x418af4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
push edi
push eax
mov ebx, edx
call fcn.00418755
mov edi, eax
cmp edi, 1
jne 0x418bec
push ecx
push 5
push str.Value
mov ecx, ebx
call fcn.00413578
test eax, eax
je 0x418bb1
and dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
mov edx, dword [eax + 4]
test edx, edx
je 0x418b44
mov eax, dword [eax + 0xc]
jmp 0x418b46
xor eax, eax
test edx, edx
jne 0x418b4f
mov edx, 0x44c488
push eax
lea ecx, [ebp - 0x10]
call fcn.00414b6f
pop ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push 0
push dword [eax]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x10]
mov edi, eax
add ecx, 0xfffffff0
call fcn.004025d7
test edi, edi
jne 0x418b89
cmp dword [ebp - 0x14], 4
jne 0x418bec
push ecx
push 0xa
push str.Comparison
mov ecx, ebx
call fcn.00413578
mov edi, eax
test edi, edi
je 0x418bb1
push ecx
push 4
push str.Data
mov ecx, ebx
call fcn.00413578
test eax, eax
jne 0x418bb6
or edi, 0xffffffff
jmp 0x418bec
mov eax, dword [eax + 4]
test eax, eax
jne 0x418bc2
mov eax, 0x44c488
mov edi, dword [edi + 4]
test edi, edi
jne 0x418bce
mov edi, 0x44c488
push 0xa
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.msvcrt.dll_strtoul]
add esp, 0xc
mov ecx, edi
push ebx
push eax
push ebx
push dword [ebp - 8]
call fcn.004188e0
mov edi, eax
cmp dword [ebp - 4], 0
je 0x418bfb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
leave
ret

Function at 0x419123
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, edx
call fcn.0041949c
xor edi, edi
inc edi
cmp eax, edi
jne 0x419140
xor eax, eax
jmp 0x419221
test eax, eax
jne 0x41921e
push ecx
push 8
push str.Language
mov ecx, esi
call fcn.00413578
test eax, eax
je 0x41921e
mov edx, dword [eax + 4]
test edx, edx
je 0x41916b
mov eax, dword [eax + 0xc]
jmp 0x41916d
xor eax, eax
test edx, edx
jne 0x419176
mov edx, 0x44c488
push ebx
push eax
lea ecx, [ebp - 8]
call fcn.00414b6f
pop ecx
call fcn.00402506
push eax
lea ecx, [ebp - 4]
call fcn.00402331
push 0x55
pop ebx
push ebx
lea ecx, [ebp - 4]
call fcn.00402070
push ebx
push eax
push 0x59
push 0x800
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ecx
lea ecx, [ebp - 4]
call fcn.00411d9f
mov esi, dword [ebp - 4]
lea ecx, [ebp - 8]
push esi
call fcn.00401831
test eax, eax
je 0x419206
push 0x2d
lea ecx, [ebp - 4]
call fcn.00401c04
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov eax, dword [esi - 0xc]
sub ebx, eax
push ebx
lea eax, [ecx + eax*2]
push eax
push 0x5a
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ecx
lea ecx, [ebp - 4]
call fcn.00411d9f
push esi
lea ecx, [ebp - 8]
call fcn.00401831
mov edi, eax
neg edi
sbb edi, edi
inc edi
lea ecx, [esi - 0x10]
call fcn.004025d7
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.004025d7
mov eax, edi
pop ebx
jmp 0x419221
or eax, 0xffffffff
pop edi
pop esi
leave
ret