joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406f00
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x45b4a0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x473354]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor edi, edi
push 1
mov dword [esp + 0x20], edi
call fcn.0042f396
mov esi, eax
mov byte [esi], 0
push 1
mov dword [esp + 0x30], edi
call fcn.0042f396
mov ebp, eax
mov dword [esp + 0x20], ebp
mov byte [ebp], 0
mov eax, dword [esp + 0x3c]
push eax
mov byte [esp + 0x34], 1
call fcn.0042f484
mov edi, eax
push esi
mov dword [esp + 0x24], edi
call fcn.0042f4d9
mov ecx, dword [0x4746a8]
add esp, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 0x100
jne 0x406ff3
push edi
call fcn.0042f484
mov esi, eax
push esi
call fcn.00431191
push str._PROGRAMFILES_
push esi
call fcn.00430b10
add esp, 0x10
test eax, eax
je 0x406fea
push str._PROGRAMFILES_
push esi
call fcn.00430b10
mov edx, dword [str._ProgramW6432_]
add esp, 8
sub eax, esi
mov dword [eax + edi], edx
mov ecx, dword [0x460618]
mov dword [eax + edi + 4], ecx
mov edx, dword [0x46061c]
mov dword [eax + edi + 8], edx
mov cx, word [0x460620]
mov word [eax + edi + 0xc], cx
lea eax, [eax + edi + 0xe]
mov edx, eax
nop
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x406fe0
push esi
call fcn.0042f4d9
add esp, 4
lea edx, [esp + 0x1c]
push edi
push edx
call fcn.00416cc0
mov eax, dword [eax]
push eax
call fcn.0042f484
mov esi, eax
push ebp
mov dword [esp + 0x28], esi
call fcn.0042f4d9
mov eax, dword [esp + 0x2c]
push eax
call fcn.0042f4d9
push esi
call fcn.0042f484
mov ebx, eax
push edi
mov dword [esp + 0x30], ebx
call fcn.0042f4d9
add esp, 0x1c
cmp byte [esi], 0x22
jne 0x407083
lea ebp, [esi + 1]
push 0x22
push ebp
call fcn.00430610
add esp, 8
mov edi, eax
push ebp
test edi, edi
je 0x407069
mov byte [edi], 0
call fcn.0042f484
push ebx
mov dword [esp + 0x1c], eax
call fcn.0042f4d9
mov ebx, dword [esp + 0x1c]
add esp, 8
mov byte [edi], 0x22
jmp 0x4070dc
mov edi, ebx
call fcn.0042f484
push edi
mov dword [esp + 0x1c], eax
call fcn.0042f4d9
mov ebx, dword [esp + 0x1c]
add esp, 8
jmp 0x4070dc
push esi
call fcn.00416f90
add esp, 4
cmp eax, 0xffffffff
jne 0x4070dc
push 0x20
push esi
xor ebp, ebp
call fcn.004306d0
mov edi, eax
add esp, 8
test edi, edi
je 0x4070dc
test ebp, ebp
je 0x4070ac
mov byte [ebp], 0x20
push esi
mov byte [edi], 0
call fcn.00416f90
add esp, 4
cmp eax, 0xffffffff
je 0x4070c1
test al, 0x10
je 0x40710d
push 0x20
push esi
mov ebp, edi
call fcn.004306d0
mov edi, eax
add esp, 8
test edi, edi
jne 0x4070a4
test ebp, ebp
je 0x4070dc
mov byte [ebp], 0x20
push ebx
call fcn.0042f484
mov edi, dword [esp + 0x34]
push esi
mov dword [edi], eax
call fcn.0042f4d9
push ebx
call fcn.0042f4d9
mov eax, edi
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push esi
jmp 0x4070dd
Function at 0x407e80
Capabilities:
Get file version info

Disassembly:
sub esp, 0x114
mov eax, dword [0x473354]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
push edi
push 1
call fcn.0042f396
add esp, 4
mov edi, eax
push 0x104
lea eax, [esp + 0x1c]
push eax
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
push ebx
call fcn.0042f396
add esp, 4
mov esi, eax
push esi
push ebx
push 0
lea eax, [esp + 0x24]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
push str.InternalName
lea ecx, [esp + 0x10]
push esi
push ecx
call fcn.004071e0
mov eax, dword [eax]
push eax
call fcn.0042f484
push edi
mov ebx, eax
call fcn.0042f4d9
mov edx, dword [esp + 0x20]
push edx
call fcn.0042f4d9
call fcn.004312c5
add eax, 0x40
push eax
push 0x4606bc
call fcn.004311b6
call fcn.004312c5
add eax, 0x40
push eax
push ebx
call fcn.004311b6
call fcn.004312c5
add eax, 0x40
push eax
push 0x460d4c
call fcn.004311b6
push str.FileVersion
lea eax, [esp + 0x44]
push esi
push eax
call fcn.004071e0
mov eax, dword [eax]
push eax
call fcn.0042f484
add esp, 0x40
push ebx
mov edi, eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0042f4d9
call fcn.004312c5
add eax, 0x40
push eax
push edi
call fcn.004311b6
call fcn.004312c5
add eax, 0x40
push eax
push 0x460d3c
call fcn.004311b6
push str.FileDescription
lea edx, [esp + 0x28]
push esi
push edx
call fcn.004071e0
mov eax, dword [eax]
push eax
call fcn.0042f484
push edi
mov ebx, eax
call fcn.0042f4d9
mov eax, dword [esp + 0x38]
push eax
call fcn.0042f4d9
call fcn.004312c5
add eax, 0x40
push eax
push ebx
call fcn.004311b6
call fcn.004312c5
add eax, 0x40
push eax
push 0x4606bc
call fcn.004311b6
add esp, 0x40
push str.LegalCopyright
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.004071e0
mov eax, dword [eax]
push eax
call fcn.0042f484
push ebx
mov edi, eax
call fcn.0042f4d9
mov edx, dword [esp + 0x24]
push edx
call fcn.0042f4d9
call fcn.004312c5
add eax, 0x40
push eax
push edi
call fcn.004311b6
call fcn.004312c5
add eax, 0x40
push eax
push 0x4606bc
call fcn.004311b6
push str.CompanyName
lea eax, [esp + 0x38]
push esi
push eax
call fcn.004071e0
mov eax, dword [eax]
push eax
call fcn.0042f484
push edi
mov esi, eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x48]
push ecx
call fcn.0042f4d9
add esp, 0x40
call fcn.004312c5
add eax, 0x40
push eax
push esi
call fcn.004311b6
call fcn.004312c5
add eax, 0x40
push eax
push 0x460490
call fcn.004311b6
call fcn.004312c5
add eax, 0x40
push eax
call fcn.00432a57
push esi
call fcn.0042f4d9
mov ecx, dword [esp + 0x134]
add esp, 0x18
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00430430
add esp, 0x114
ret
Function at 0x40a6a0
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push 0xf003f
push 3
push 0
push 0
push esi
push ebp
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40a702
mov eax, dword [ecx]
test eax, eax
je 0x40a6fe
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40a704
mov ecx, dword [ecx]
jmp 0x40a706
xor eax, eax
jmp 0x40a6f6
xor eax, eax
xor ecx, ecx
lea edx, [eax + eax]
mov eax, dword [esp + 0xc]
push edx
push ecx
push 6
push 0
push str.SymbolicLinkValue
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x40a72d
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40a778
lea edx, [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x40a778
test esi, esi
je 0x40a778
mov eax, dword [esi]
test eax, eax
je 0x40a75f
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x40a76f
push eax
call fcn.00430786
add esp, 4
push esi
call fcn.0042f2c2
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x40a790
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push ebx
push ebp
lea eax, [esp + 8]
push eax
xor ebp, ebp
push 0x20019
push ebp
push str.SystemCurrentControlSetControlProductOptions
xor ebx, ebx
push ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebp
call fcn.00409f10
add esp, 0x14
test eax, eax
jne 0x40a875
mov ecx, dword [esp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
push edx
push ebp
lea eax, [esp + 0x1c]
push eax
push ebp
push str.ProductSuite
push ecx
call esi
test eax, eax
jne 0x40a874
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a874
push edi
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebp
je 0x40a873
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push edi
lea eax, [esp + 0x20]
push eax
push ebp
push str.ProductSuite
push ecx
call esi
test eax, eax
jne 0x40a866
cmp dword [esp + 0x18], 7
jne 0x40a866
mov esi, edi
cmp byte [edi], bl
je 0x40a866
mov ebp, dword [esp + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push ebp
push esi
call ebx
test eax, eax
je 0x40a85e
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esi + eax + 1], 0
lea esi, [esi + eax + 1]
jne 0x40a842
jmp 0x40a866
mov dword [esp + 0x1c], 1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [esp + 0x1c]
xor ebp, ebp
pop edi
pop esi
mov eax, dword [esp + 8]
cmp eax, ebp
je 0x40a884
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x40b6f0
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x45b896
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x473354]
xor eax, esp
mov dword [esp + 0x178], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x473354]
xor eax, esp
push eax
lea eax, [esp + 0x190]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1a4]
mov ebp, dword [esp + 0x1a0]
mov ebx, dword [esp + 0x1a8]
push 1
mov dword [esp + 0x28], esi
call fcn.0042f396
mov edi, eax
add esp, 4
mov dword [esp + 0x20], edi
mov byte [edi], 0
push ebp
lea eax, [esp + 0x20]
push eax
mov ecx, 0x474ec8
mov dword [esp + 0x1a0], 0
call fcn.00409bc0
mov ebp, dword [esp + 0x1c]
mov byte [esp + 0x198], 1
test ebp, ebp
je 0x40b79d
cmp dword [ebp + 4], 0
jne 0x40b794
mov ecx, dword [ebp]
push ecx
call fcn.0042e110
mov dword [ebp + 4], eax
mov edx, dword [ebp + 4]
mov dword [esp + 0x18], edx
jmp 0x40b7a5
mov dword [esp + 0x18], 0
mov eax, dword [esi]
push 0x46043c
mov dword [esp + 0x18], eax
call fcn.0042f484
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esi], eax
call fcn.0042f4d9
mov esi, dword [ebx]
push 0x46043c
call fcn.0042f484
push esi
mov dword [ebx], eax
call fcn.0042f4d9
mov eax, dword [esp + 0x28]
add esp, 0x10
lea edx, [esp + 0x28]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x40b8b1
push esi
call fcn.0042f396
mov ecx, dword [esp + 0x1c]
add esp, 4
mov ebp, eax
push ebp
push esi
push 0
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40b8a4
push str.FileDescription
lea edx, [esp + 0x18]
push ebp
push edx
call fcn.004071e0
mov eax, dword [eax]
push eax
call fcn.0042f484
push edi
mov esi, eax
call fcn.0042f4d9
mov eax, dword [esp + 0x28]
push eax
call fcn.0042f4d9
add esp, 0x18
cmp byte [esi], 0
je 0x40b857
mov edi, dword [ebx]
push esi
call fcn.0042f484
push edi
mov dword [ebx], eax
call fcn.0042f4d9
add esp, 8
push str.CompanyName
lea ecx, [esp + 0x18]
push ebp
push ecx
call fcn.004071e0
mov eax, dword [eax]
push eax
call fcn.0042f484
mov edi, eax
push esi
mov dword [esp + 0x34], edi
call fcn.0042f4d9
mov edx, dword [esp + 0x28]
push edx
call fcn.0042f4d9
add esp, 0x18
cmp byte [edi], 0
je 0x40b8a4
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
push edi
call fcn.0042f484
push esi
mov dword [ebx], eax
call fcn.0042f4d9
add esp, 8
push ebp
call fcn.0042f4d9
mov ebp, dword [esp + 0x20]
add esp, 4
mov ecx, dword [esp + 0x18]
push 0x101
push 0x160
lea eax, [esp + 0x34]
push eax
push 0
push ecx
mov dword [esp + 0x40], 0
call fcn.00417110
mov esi, dword [esp + 0x40]
add esp, 0x14
test ebp, ebp
je 0x40b914
lea edx, [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x40b914
mov eax, dword [ebp]
test eax, eax
je 0x40b8fb
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp + 4]
test eax, eax
je 0x40b90b
push eax
call fcn.00430786
add esp, 4
push ebp
call fcn.0042f2c2
add esp, 4
push edi
call fcn.0042f4d9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x190]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x178]
xor ecx, esp
call fcn.00430430
add esp, 0x188
ret
Function at 0x40faf0
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x45bf38
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x473354]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 1
call fcn.0042f396
mov ebx, eax
add esp, 4
mov byte [ebx], 0
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x28], 0
test eax, eax
jne 0x40fb3b
mov eax, 0x46043c
push eax
call fcn.0042f484
mov edi, eax
lea eax, [esp + 0x18]
push eax
mov eax, str.SoftwareClassesCLSID_
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], edi
call fcn.00406910
push eax
mov eax, str.Instance
lea ecx, [esp + 0x24]
call fcn.004068d0
mov eax, dword [eax]
push eax
call fcn.0042f484
mov esi, eax
push ebx
mov dword [esp + 0x28], esi
call fcn.0042f4d9
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x34]
push edx
call fcn.0042f4d9
push edi
call fcn.0042f4d9
mov ebp, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
lea eax, [esp + 0x34]
push eax
push ebp
push ecx
call fcn.0040fa30
add esp, 0x2c
cmp dword [esp + 0x30], 0
je 0x40fc75
mov eax, dword [0x474eac]
test eax, eax
je 0x40fbd8
push 1
call eax
mov edx, dword [0x4746a8]
push 0x200
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x40fbe5
mov eax, 0x46043c
push eax
call fcn.0042f484
mov edi, eax
lea eax, [esp + 0x40]
push eax
mov eax, str.SoftwareWow6432NodeClassesCLSID_
lea ecx, [esp + 0x24]
mov dword [esp + 0x44], edi
call fcn.00406910
push eax
mov eax, str.Instance
lea ecx, [esp + 0x3c]
call fcn.004068d0
mov eax, dword [eax]
push eax
mov ebx, esi
call fcn.0042f484
mov esi, eax
push ebx
mov dword [esp + 0x28], esi
call fcn.0042f4d9
mov ecx, dword [esp + 0x44]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x34]
push edx
call fcn.0042f4d9
push edi
call fcn.0042f4d9
mov ecx, dword [esp + 0x54]
lea eax, [esp + 0x34]
push eax
push ebp
push ecx
call fcn.0040fa30
mov eax, dword [0x474eac]
add esp, 0x2c
test eax, eax
je 0x40fc75
push 0
call eax
mov edx, dword [0x4746a8]
push 0x100
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call fcn.0042f4d9
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x415d40
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
sub esp, 0x210
mov eax, dword [0x473354]
xor eax, esp
mov dword [esp + 0x20c], eax
push edi
mov edi, dword [esp + 0x21c]
push edi
lea eax, [esp + 0x21c]
push eax
push str.AutoRuns
call fcn.00418480
add esp, 0xc
test eax, eax
jne 0x415d91
mov eax, 1
pop edi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00430430
add esp, 0x210
ret
push esi
call fcn.00427050
mov byte [0x474ea4], al
call fcn.004046d0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0
push eax
mov dword [0x4746a8], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.004047d0
lea ecx, [esp + 8]
push str._PATH_
push ecx
call fcn.00416cc0
mov eax, dword [eax]
mov esi, dword [0x474ef4]
push eax
call fcn.0042f484
push esi
mov dword [0x474ef4], eax
call fcn.0042f4d9
mov edx, dword [esp + 0x18]
push edx
call fcn.0042f4d9
call fcn.00407e80
mov ecx, dword [esp + 0x230]
lea eax, [esp + 0x1c]
push eax
push edi
push ecx
call fcn.00410250
add esp, 0x20
test al, al
je 0x415e51
push 0x4748bc
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.00403fa0
cmp dword [0x474ea8], 0
je 0x415f76
push 0
call fcn.0040fca0
mov eax, dword [0x475078]
sub eax, dword [0x475074]
add esp, 4
sar eax, 2
test eax, eax
jne 0x415e6d
push str.No_other_accounts_detected_on_this_system._n_n
call fcn.0043263b
add esp, 4
pop esi
mov eax, 1
pop edi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00430430
add esp, 0x210
ret
xor esi, esi
test eax, eax
jbe 0x415f76
cmp esi, eax
jb 0x415e80
call fcn.004305db
mov edx, dword [0x475074]
mov eax, dword [edx + esi*4]
add eax, 0x10c
lea edx, [esp + 0x110]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x415e95
lea eax, [esp + 0x110]
push eax
call fcn.0043102a
mov eax, dword [0x474ea8]
lea edx, [esp + 0x10]
add esp, 4
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x415ec0
lea ecx, [esp + 0xc]
push ecx
call fcn.0043102a
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x118]
push eax
call fcn.00430b10
add esp, 0xc
test eax, eax
je 0x415f5f
mov ecx, dword [0x475078]
sub ecx, dword [0x475074]
sar ecx, 2
cmp esi, ecx
jb 0x415f05
call fcn.004305db
mov edx, dword [0x475074]
mov eax, dword [edx + esi*4]
add eax, 0x10c
push eax
push str.Autoruns_for__s:_n
call fcn.0043263b
mov ecx, dword [0x475078]
sub ecx, dword [0x475074]
add esp, 8
sar ecx, 2
cmp esi, ecx
jb 0x415f39
call fcn.004305db
mov edx, dword [0x475074]
mov eax, dword [edx + esi*4]
mov ecx, dword [eax + 4]
mov edx, dword [0x474ea0]
push ecx
push edx
push 0
call fcn.0040b9d0
add esp, 0xc
test al, al
je 0x415e51
mov eax, dword [0x475078]
sub eax, dword [0x475074]
inc esi
sar eax, 2
cmp esi, eax
jb 0x415e80
mov eax, dword [esp + 8]
push eax
call fcn.00413520
mov ecx, dword [esp + 0x218]
add esp, 4
pop esi
pop edi
xor ecx, esp
xor eax, eax
call fcn.00430430
add esp, 0x210
ret
Function at 0x416ab0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
push 0
push 0
push ebx
push ebp
push ecx
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x416b1d
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
mov edx, dword [edi]
add esi, 2
push esi
push edx
call fcn.0042f567
push esi
push 0
push eax
mov dword [edi], eax
call fcn.0042f790
mov edi, dword [edi]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x2c]
add esp, 0x14
lea eax, [esp + 0x10]
push eax
push edi
push ecx
push ebx
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x416b30
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
lea eax, [esp + 8]
push eax
push 0
push ebx
push ebp
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x416b8c
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x20]
mov ecx, dword [edi]
add esi, 2
push esi
push ecx
call fcn.0042f567
push esi
push 0
push eax
mov dword [edi], eax
call fcn.0042f790
mov edi, dword [edi]
add esp, 0x14
lea edx, [esp + 0x10]
push edx
push edi
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x416b90
Capabilities:
Query or enumerate registry key

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push ebx
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x416c01
mov eax, dword [esp + 4]
push esi
inc eax
push edi
mov edi, dword [esp + 0x1c]
mov ecx, dword [edi]
lea esi, [eax + 1]
push esi
push ecx
mov dword [esp + 0x14], eax
call fcn.0042f567
push esi
push 0
push eax
mov dword [edi], eax
call fcn.0042f790
mov edx, dword [esp + 0x20]
mov edi, dword [edi]
mov eax, dword [esp + 0x2c]
add esp, 0x14
push edx
push edi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x416c10
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push ebp
xor ebx, ebx
mov ebp, dword [esp + 0x14]
push ebx
push ebx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebp
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, ebx
jne 0x416cb0
mov eax, dword [esp + 8]
push esi
inc eax
push edi
mov edi, dword [esp + 0x24]
mov edx, dword [edi]
lea esi, [eax + 1]
push esi
push edx
mov dword [esp + 0x18], eax
call fcn.0042f567
push esi
push ebx
push eax
mov dword [edi], eax
call fcn.0042f790
mov esi, dword [esp + 0x28]
mov ebx, dword [esp + 0x44]
mov eax, dword [ebx]
add esi, 2
push esi
push eax
call fcn.0042f567
push esi
push 0
push eax
mov dword [ebx], eax
call fcn.0042f790
mov ebx, dword [ebx]
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
mov edi, dword [edi]
add esp, 0x28
lea ecx, [esp + 0x14]
push ecx
push ebx
push edx
mov edx, dword [esp + 0x2c]
push eax
lea ecx, [esp + 0x20]
push ecx
push edi
push edx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x416cc0
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 0
push 0
push ebp
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 1
mov edi, eax
call fcn.0042f396
lea ebx, [edi + 1]
push ebx
push eax
mov byte [eax], 0
call fcn.0042f567
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push 0
push esi
mov dword [eax], esi
call fcn.0042f790
add esp, 0x18
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x416f90
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x45cc68
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x473354]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x474ec8
call fcn.00409bc0
mov esi, dword [esp + 0xc]
mov dword [esp + 0x18], 0
test esi, esi
je 0x416fed
cmp dword [esi + 4], 0
jne 0x416fe8
mov edx, dword [esi]
push edx
call fcn.0042e110
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
jmp 0x416fef
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, eax
test esi, esi
je 0x417030
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x417030
mov eax, dword [esi]
test eax, eax
je 0x417017
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x417027
push eax
call fcn.00430786
add esp, 4
push esi
call fcn.0042f2c2
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x417110
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x45ccc8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x473354]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x474ec8
call fcn.00409bc0
mov esi, dword [esp + 0xc]
mov dword [esp + 0x18], 0
test esi, esi
je 0x41716d
cmp dword [esi + 4], 0
jne 0x417168
mov edx, dword [esi]
push edx
call fcn.0042e110
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
jmp 0x41716f
xor eax, eax
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push ecx
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov edi, eax
test esi, esi
je 0x4171c4
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4171c4
mov eax, dword [esi]
test eax, eax
je 0x4171ab
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x4171bb
push eax
call fcn.00430786
add esp, 4
push esi
call fcn.0042f2c2
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret