joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dd30
Capabilities:
Get file version info

Disassembly:
sub esp, 0x118
mov eax, dword [0x4f2888]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
mov ebx, dword [esp + 0x124]
xor eax, eax
push ebp
mov ebp, dword [esp + 0x124]
mov dword [esp + 0xc], eax
cmp ebx, eax
jne 0x40dd6f
push 0x4bacfe
mov ecx, ebp
call fcn.004021a0
jmp 0x40de00
push esi
push edi
push eax
push ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
push edi
call fcn.00481965
push edi
mov esi, eax
push 0
push esi
call fcn.00480970
add esp, 0x10
push esi
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x18]
movzx edx, word [eax + 2]
movzx eax, word [eax]
push edx
push eax
lea ecx, [esp + 0x28]
push str.StringFileInfo_04x_04xProductVersion
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push esi
call sub.VERSION.dll_VerQueryValueA
mov edx, dword [esp + 0x10]
push edx
mov ecx, ebp
call fcn.004021a0
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.0047f7c9
add esp, 0x118
ret
Function at 0x40f650
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4b0f60
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x4f2888]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebx, ebx
push str.0.0.0.0
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebx
call fcn.004021a0
push 0x4be968
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], ebx
call fcn.004021a0
mov byte [esp + 0x24], 1
call fcn.004329d2
mov esi, dword [eax + 0xc]
cmp esi, ebx
jne 0x40f6c1
mov esi, dword [esp + 0x2c]
push str.0.0.0.0
mov ecx, esi
call fcn.004021a0
jmp 0x40f7c0
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x40f7a7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x40f7a7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, ebx
je 0x40f7a7
push str.VarFileInfoTranslation
push 0x4f3d00
mov dword [esp + 0x14], ebx
call fcn.004809ea
add esp, 8
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x4f3d00
push esi
call sub.VERSION.dll_VerQueryValueA
cmp eax, ebx
je 0x40f769
cmp dword [esp + 0x18], 4
jne 0x40f769
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push ecx
mov edx, eax
shr edx, 0x10
and edx, 0xff
push edx
mov ecx, eax
movzx edx, al
shr ecx, 0x18
push ecx
push edx
shr eax, 8
and eax, 0xff
push eax
push str.StringFileInfo_02X_02X_02X_02X_s
push 0x4f3d00
call fcn.004809ea
add esp, 0x1c
jmp 0x40f780
mov eax, dword [esp + 0x10]
push eax
push str.StringFileInfo041203b5_s
push 0x4f3d00
call fcn.004809ea
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x4f3d00
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40f7a7
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.004020d0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
push eax
call fcn.004015b0
mov esi, dword [esp + 0x30]
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x24], bl
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f7e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x24], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f808
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret 4
Function at 0x40fdc0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x418
lea eax, [esp]
push eax
push 0x4cec6c
push 1
push 0
push 0x4d0e1c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40fe8d
mov eax, dword [esp]
mov ecx, dword [eax]
push esi
lea edx, [esp + 8]
push edx
push 0x4cfecc
push eax
mov eax, dword [ecx]
call eax
mov esi, eax
test esi, esi
jl 0x40fe7e
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x420]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x42c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x428]
mov ecx, dword [eax]
push 0
push edx
push eax
mov eax, dword [ecx + 0x44]
call eax
mov edx, dword [esp + 0x424]
push 0x104
lea ecx, [esp + 0x10]
push ecx
push 0xffffffffffffffff
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push 1
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov esi, eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
pop esi
add esp, 0x418
ret 0x10
Function at 0x4102b0
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x4b10d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebp
push esi
push edi
mov eax, dword [0x4f2888]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x38], 0
call fcn.0042f8f6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4102f8
push 0x80004005
call fcn.00401040
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx - 0xc]
mov byte [esp + 0x38], 1
test eax, eax
jge 0x41031d
or eax, 0xffffffff
jmp 0x410338
push 0x4bb75c
push ecx
call fcn.0047fa95
add esp, 8
test eax, eax
jne 0x410334
or eax, 0xffffffff
jmp 0x410338
sub eax, dword [esp + 0x40]
inc eax
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x48]
call fcn.00401d40
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 2
call fcn.00401fb0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x38], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41037c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
lea eax, [esi - 0x10]
mov byte [esp + 0x38], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4103bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
mov dword [esp + 0x38], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4103e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov edx, ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x2c
ret 4
Function at 0x413ab0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x413b16
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413b16
push eax
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
Function at 0x413b70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x53c
mov eax, dword [0x4f2888]
xor eax, esp
mov dword [esp + 0x538], eax
xor eax, eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov word [esp + 0x39], ax
mov byte [esp + 0x3b], al
mov dword [esp + 0x15], eax
mov word [esp + 0x19], ax
lea eax, [esp + 0x245]
push ebx
push eax
mov edi, ecx
mov byte [esp + 0x24], bl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x24c], bl
call fcn.00480970
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x104
lea ecx, [esp + 0x244]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x103
lea eax, [esp + 0x141]
xor edx, edx
push ebx
push eax
mov byte [esp + 0x18], bl
mov word [esp + 0x19], dx
mov byte [esp + 0x148], bl
call fcn.00480970
push 0xff
lea ecx, [esp + 0x455]
push ebx
push ecx
mov byte [esp + 0x45c], bl
call fcn.00480970
push 0xff
lea edx, [esp + 0x361]
push ebx
push edx
mov byte [esp + 0x368], bl
call fcn.00480970
push 0x103
lea eax, [esp + 0x61]
push ebx
push eax
mov byte [esp + 0x68], bl
call fcn.00480970
lea ecx, [esp + 0x374]
push ecx
lea edx, [esp + 0x478]
push edx
lea eax, [esp + 0x174]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x280]
push edx
call fcn.00482478
add esp, 0x44
push str.ip.ini
lea eax, [esp + 0x140]
push eax
lea ecx, [esp + 0x14]
push ecx
push str._s_s_s
push 0x104
lea edx, [esp + 0x4c]
push edx
call fcn.00480a83
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0x18
lea eax, [esp + 0x38]
push eax
push 0x20
lea ecx, [esp + 0x20]
push ecx
push 0x4bacfe
push str.DOWN_IP
push str.TestSvr
call esi
lea edx, [esp + 0x38]
push edx
push 7
lea eax, [esp + 0x18]
push eax
push 0x4bacfe
push str.DOWN_PORT
push str.TestSvr
call esi
test eax, eax
jbe 0x413d2d
lea ecx, [esp + 0x18]
push ecx
lea edx, [edi + 0x25c8]
push 0x14
push edx
call fcn.0048058f
lea eax, [esp + 0x1c]
push eax
call fcn.0048023b
add esp, 0x10
mov dword [edi + 0x25dc], eax
jmp 0x413dda
mov esi, dword [esp + 0x54c]
movsx eax, byte [esi]
sub eax, 0x60
cdq
mov ecx, 3
idiv ecx
sub edx, ebx
je 0x413d70
sub edx, 1
je 0x413d60
sub edx, 1
jne 0x413d70
push str.115.71.29.227
push 0x14
lea eax, [edi + 0x25c8]
push eax
jmp 0x413d7e
push str.115.71.29.226
push 0x14
lea ecx, [edi + 0x25c8]
push ecx
jmp 0x413d7e
push str.115.71.29.225
push 0x14
lea edx, [edi + 0x25c8]
push edx
call fcn.0048058f
movsx eax, byte [esi]
sub eax, 0x60
cdq
mov ecx, 5
idiv ecx
add esp, 0xc
cmp edx, 4
ja case.0x413d99.9672
jmp dword [edx*4 + 0x413df4]
mov dword [edi + 0x25dc], 0x8cca
jmp 0x413dda
mov dword [edi + 0x25dc], 0x8ccb
jmp 0x413dda
mov dword [edi + 0x25dc], 0x8ccc
jmp 0x413dda
mov dword [edi + 0x25dc], 0x8ccd
jmp 0x413dda
mov dword [edi + 0x25dc], 0x8cc9
mov ecx, dword [esp + 0x544]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047f7c9
add esp, 0x53c
ret 4
Function at 0x4142a0
Capabilities:
Hide graphical window

Disassembly:
cmp byte [0x4f3ed0], 1
push esi
mov esi, ecx
je 0x414360
mov byte [0x4f3ed0], 1
mov eax, dword [esi + 0x20]
push 0x64
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0
mov ecx, esi
call fcn.004120f0
mov ecx, dword [esi + 0x20]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esp + 8], 0
je 0x4142f1
mov ecx, esi
call fcn.00414140
push 0
mov ecx, esi
call fcn.004186e0
lea ecx, [esi + 0xd0]
call fcn.00406780
mov ecx, dword [esi + 0xcb4]
test ecx, ecx
je 0x414317
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [esi + 0x25c4]
test ecx, ecx
je 0x414345
mov edx, dword [ecx]
mov eax, dword [edx + 0x60]
call eax
mov ecx, dword [esi + 0x25c4]
test ecx, ecx
je 0x41433b
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
mov dword [esi + 0x25c4], 0
push str.detect_service.exe
push str.detect.exe
call fcn.0041c6f0
add esp, 8
push 1
mov ecx, esi
call fcn.00435692
pop esi
ret 4
Function at 0x41c6f0
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
mov eax, 0x211c
call fcn.0047f7e0
mov eax, dword [0x4f2888]
xor eax, esp
mov dword [esp + 0x2118], eax
lea eax, [esp + 0xc]
push eax
push 0x2000
lea ecx, [esp + 0x1c]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x41c87e
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
xor ebx, ebx
push 0x103
lea edx, [esp + 0x2025]
push ebx
shr esi, 2
push edx
mov dword [esp + 0x1c], esi
mov byte [esp + 0x202c], bl
call fcn.00480970
add esp, 0xc
xor edi, edi
cmp esi, ebx
jbe 0x41c87b
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, dword [esp + edi*4 + 0x24]
cmp esi, ebx
je 0x41c86f
push 0x104
lea eax, [esp + 0x2028]
push ebx
push eax
call fcn.00480970
add esp, 0xc
push esi
push ebx
push 0xc11
call ebp
mov esi, eax
cmp esi, ebx
je 0x41c868
lea ecx, [esp + 0x18]
push ecx
push 4
lea edx, [esp + 0x18]
push edx
push esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x41c868
mov ecx, dword [esp + 0x10]
push 0x104
lea eax, [esp + 0x2028]
push eax
push ecx
push esi
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
jbe 0x41c868
lea eax, [esp + 0x2024]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41c7e3
sub eax, edx
je 0x41c868
mov ecx, dword [esp + 0x2130]
lea eax, [esp + 0x2024]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41c820
cmp dl, bl
je 0x41c81c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41c820
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x41c800
xor eax, eax
jmp 0x41c825
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x41c860
mov ecx, dword [esp + 0x2134]
lea eax, [esp + 0x2024]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41c857
cmp dl, bl
je 0x41c853
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41c857
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x41c837
xor eax, eax
jmp 0x41c85c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x41c868
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esp + 0x14]
jb 0x41c762
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2118]
xor ecx, esp
xor al, al
call fcn.0047f7c9
add esp, 0x211c
ret
Function at 0x41e2b0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x41e2e8
mov eax, dword [esi + 8]
push edi
push 0
push 0x1f4
push 0x60
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esi + 8]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push ecx
call edi
mov edx, dword [esi + 8]
push 9
push edx
call edi
mov byte [esi + 4], 0
pop edi
pop esi
ret

Function at 0x41e519
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
sub eax, 0x203
push esi
mov esi, ecx
je 0x41e52c
sub eax, 1
jne 0x41e561
call fcn.0041e2f0
pop esi
ret 4
cmp byte [esi + 4], 0
je 0x41e561
mov eax, dword [esi + 8]
push edi
push 0
push 0x1f4
push 0x60
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esi + 8]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push ecx
call edi
mov edx, dword [esi + 8]
push 9
push edx
call edi
mov byte [esi + 4], 0
pop edi
pop esi
ret 4

Function at 0x41e6c0
Capabilities:
Inspect load icon resource

Disassembly:
push 0xffffffffffffffff
push 0x4b2373
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4f2888]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 0
mov dword [esi], vtable.CBTray.0
lea edi, [esi + 0x10]
call fcn.0042f8f6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41e714
push 0x80004005
call fcn.00401040
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x28]
mov dword [esi + 8], ecx
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
mov dword [esi + 0xc], edx
call fcn.00401fb0
mov ecx, dword [esi + 0xc]
mov edi, dword [sym.imp.USER32.dll_LoadIconA]
push 0xb8
push ecx
mov byte [esi + 4], 0
call edi
mov edx, dword [esi + 0xc]
push 0xb9
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xc]
push 0xba
push eax
call edi
mov ecx, dword [esi + 0xc]
push 0xbb
push ecx
mov dword [esi + 0x20], eax
call edi
mov edx, dword [esi + 0xc]
push 0xbc
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0xc]
push 0xbd
push eax
call edi
mov ecx, dword [esi + 0xc]
push 0xbe
push ecx
mov dword [esi + 0x2c], eax
call edi
mov edx, dword [esi + 0xc]
push 0xbf
push edx
mov dword [esi + 0x30], eax
call edi
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0xc]
push 0xc0
push eax
call edi
mov ecx, dword [esi + 0xc]
push 0xc1
push ecx
mov dword [esi + 0x38], eax
call edi
mov dword [esi + 0x3c], eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x18], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41e7ff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0xc
Function at 0x420e10
Capabilities:
Create directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x4f2888]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x11c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, 1
lea ebp, [eax - 1]
cmp ebp, esi
jle 0x420e83
cmp byte [edi + esi], 0x5c
jne 0x420e7e
mov al, byte [edi + esi - 1]
cmp al, 0x5c
je 0x420e7e
cmp al, 0x3a
je 0x420e7e
cmp byte [edi + esi + 1], 0x5c
je 0x420e7e
push esi
lea eax, [esp + 0x14]
push edi
push eax
call fcn.00482eb0
add esp, 0xc
push 0
lea ecx, [esp + 0x14]
push ecx
mov byte [esp + esi + 0x18], 0
call ebx
inc esi
cmp esi, ebp
jl 0x420e48
cmp dword [esp + 0x120], 0
je 0x420e92
push 0
push edi
call ebx
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047f7c9
add esp, 0x108
ret

Function at 0x421a00
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x4f2888]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
push 0x9c
lea eax, [esp + 8]
push 0
push eax
call fcn.00480970
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x9c
call esi
test eax, eax
jne 0x421a6b
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x94
call esi
test eax, eax
jne 0x421a6b
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0047f7c9
add esp, 0xa0
ret
cmp dword [esp + 8], 6
mov ecx, dword [esp + 0xa0]
sbb eax, eax
pop esi
xor ecx, esp
inc eax
call fcn.0047f7c9
add esp, 0xa0
ret
Function at 0x425870
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4258a6
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax + 0xc]
push esi
push edi
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x14]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call edi
push ebx
call edi
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
add esp, 8
ret

Function at 0x4258f0
Capabilities:
Delete registry value
Query or enumerate registry key

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 4]
push eax
push 0x2001f
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42591b
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x18]
push ebp
push esi
push edi
test eax, eax
je 0x425956
mov edx, dword [esp + 0x10]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call edi
push ebx
call edi
test esi, esi
je 0x4259ff
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov dword [esp + 0x14], 0
lea ebx, [ebx]
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x30]
push edx
push 0
push 0
push 0
push eax
call ebp
test eax, eax
jne 0x425a0c
cmp dword [esp + 0x14], eax
jbe 0x4259e4
mov ecx, dword [esp + 0x18]
inc ecx
push ecx
call fcn.0042d6ea
mov edx, dword [esp + 0x1c]
add esp, 4
inc edx
push edx
mov esi, eax
mov eax, dword [esp + 0x14]
push esi
push 0
push eax
call edi
test eax, eax
jne 0x425a21
mov ecx, dword [esp + 0x10]
push ecx
push eax
push esi
call fcn.004258f0
add esp, 0xc
push esi
test eax, eax
je 0x425a3f
call fcn.0042d6f5
add esp, 4
cmp dword [esp + 0x14], 0
ja 0x425970
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x425a52
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push esi
call fcn.0042d6f5
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
call fcn.0042d6f5
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x426070
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x10]
sub esp, 0xc
lea eax, [esp]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x426098
xor eax, eax
add esp, 0xc
ret
mov edx, dword [esp]
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0xc]
push eax
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push ebx
push edx
call ebp
test eax, eax
je 0x4260d0
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push esi
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 4]
push edi
mov edi, dword [esp + 0x14]
test eax, eax
je 0x4260ed
mov ecx, dword [esi]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esi]
push edi
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
push 0
mov dword [esi + 4], eax
mov eax, dword [esp + 0x20]
push ebx
push eax
mov dword [esi + 8], edi
call ebp
test eax, eax
je 0x426150
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
mov edx, dword [esp + 0x2c]
push edx
call edi
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x426140
push eax
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 4], edi
mov dword [esi + 8], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esi + 0xc], ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [esp + 0x2c]
push eax
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret