joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101a11d
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x101e0f8
call fcn.0101a254
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x102205c
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1019ed4
cmp eax, esi
jne 0x1019ec7
xor esi, esi
inc esi
mov ebx, esi
jmp 0x1019ed7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1019eae
xor esi, esi
inc esi
mov eax, dword [0x1022058]
cmp eax, esi
jne 0x1019eea
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1019f19
mov eax, dword [0x1022058]
test eax, eax
jne 0x1019f13
mov dword [0x1022058], esi
push 0x1001604
push 0x10015f8
call fcn.01019e13
pop ecx
pop ecx
test eax, eax
je 0x1019f19
jmp 0x101a041
mov dword [0x1021ce8], esi
mov eax, dword [0x1022058]
cmp eax, esi
jne 0x1019f3d
push 0x10015f4
push 0x10015e4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1022058], 2
test ebx, ebx
jne 0x1019f49
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1022068], 0
je 0x1019f6d
push 0x1022068
call fcn.0101a509
pop ecx
test eax, eax
je 0x1019f6d
push 0
push 2
push 0
call dword [0x1022068]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1019fc9
test al, al
je 0x1019f87
cmp dword [ebp - 0x1c], 0
jne 0x1019fc9
mov al, byte [esi]
test al, al
je 0x1019f97
cmp al, 0x20
ja 0x1019f97
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1019f87
test byte [ebp - 0x3c], 1
je 0x1019fa3
movzx eax, word [ebp - 0x38]
jmp 0x1019fa6
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1021ce4], eax
cmp dword [0x1021cd8], 0
jne 0x101a01d
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x1019fd8
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x1019feb
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1019f74
cmp dword [0x1021ce8], 0
jne 0x101a02c
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1021ce4]
jmp 0x101a04d
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0101a299
ret
call fcn.0101a656
jmp 0x1019e74
Function at 0x10001193
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov edi, eax
mov eax, dword [0x1000b70c]
xor esi, esi
cmp eax, esi
je 0x100011d7
cmp ecx, 0x90
jae 0x100011d7
push dword [ebp + 0x10]
push 1
push edi
push dword [ebp + 8]
push dword [ebp + 0xc]
push ecx
xor ecx, ecx
cmp dword [ebp + 0x14], esi
setne cl
inc ecx
inc ecx
push ecx
call eax
add esp, 0x1c
neg eax
sbb eax, eax
inc eax
jmp 0x100012af
push ebx
push dword [ebp + 0x14]
call fcn.100010f6
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
je 0x100012ac
push esi
lea eax, [ebp - 4]
push eax
push 0x18
lea eax, [ebp - 0x24]
push eax
push esi
push esi
push 0x70000
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100012a5
cmp esi, dword [ebp - 0x20]
jg 0x100012a5
jl 0x10001224
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x24]
ja 0x100012a5
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 0xc], eax
ja 0x100012a5
cmp edi, dword [ebp - 0x14]
ja 0x100012a5
push esi
push dword [ebp + 8]
push esi
push eax
call fcn.10007720
xor ecx, ecx
add eax, dword [ebp + 0xc]
push esi
push dword [ebp - 0x14]
adc edx, ecx
push edx
push eax
call fcn.10007720
push esi
push dword [ebp - 0x10]
xor ecx, ecx
dec edi
add eax, edi
adc edx, ecx
push edx
push eax
call fcn.10007720
push esi
lea ecx, [ebp - 8]
push ecx
push eax
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x100012a5
cmp dword [ebp + 0x14], esi
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
jne 0x10001287
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push ebx
call eax
test eax, eax
push ebx
je 0x100012a6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x100012ae
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x10001ccc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10001940
push eax
push esi
push dword [ebp + 8]
call fcn.100018f5
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10001940
add al, 0xfc
invalid
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.100018f5
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
inc ebp
fld dword [esi + eax*8 + 0x45]
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x10001dcb
Function at 0x1000200f
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10002007
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10002025
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov dword [ecx + eax], 0x948b0000
invalid
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10002083
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000206a
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10002073
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1000207d
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1000205f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10001fe9
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x100020d0
dec eax
je 0x100020c7
sub eax, 3
je 0x100020be
mov dword [ebp - 4], 0x40
jmp 0x100020ed
mov dword [ebp - 4], 4
jmp 0x100020d3
mov dword [ebp - 4], 0x20
jmp 0x100020d3
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1000211f
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1000209f
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10001930
add dword [ebx + 0x75fff596], 0x14
push 1
push esi
call edi
mov eax, esi
jmp 0x1000212b
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100021fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add al, 0
add byte [eax], al
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
Function at 0x10025b9
Capabilities:
Log keystrokes via application hook

Disassembly:
push 0
push dword [0x100a0b8]
push 0x1002057
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x100a0c8], eax
mov al, cl
ret

Function at 0x1003fa1
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.010057fa
test eax, eax
je 0x1004033
mov eax, dword [esi + 0x50]
dec eax
je 0x1003fc1
dec eax
je 0x1003fcf
jmp 0x100403a
push 0x7d2
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_KillTimer]
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
mov dword [esi + 0x50], 3
call ebx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea edi, [esi + 0x48]
sub eax, dword [edi]
push 0
sbb ecx, dword [edi + 4]
push 0x3e8
push ecx
push eax
call fcn.01007430
push dword [esi + 0x44]
push dword [esi + 0x40]
push edx
push eax
call fcn.01007380
cmp eax, dword [esi + 0x30]
jle 0x1004033
push 0
push 5
push 0x7d3
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
je 0x1004033
push edi
call ebx
jmp 0x100403a
mov ecx, esi
call fcn.01003cb3
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1004f50
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, ecx
push 0x5b
mov dword [esi + 0x50], 2
call edi
mov ebx, 0x8000
mov ecx, ebx
test cx, ax
jne 0x1004f8d
push 0x5c
call edi
test bx, ax
jne 0x1004f8d
cmp byte [esi + 0x75], 0
jne 0x1004f8d
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.01003cb3
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetFocus]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi + 0x10]
cmp edi, ecx
jne 0x1004f83
cmp eax, ecx
jne 0x1004f83
mov ecx, esi
call fcn.01003bce
movzx eax, byte [esi + 0x28]
xor edi, edi
mov byte [esi + 0x54], al
cmp dword [esi + 0x14], edi
je 0x1004fd1
push 2
push eax
push edi
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov ecx, esi
call fcn.01003b80
push edi
mov edi, dword [sym.imp.USER32.dll_NotifyWinEvent]
push 0xfffffffffffffffc
push dword [esi + 0x10]
push 3
call edi
mov ecx, esi
call fcn.01004580
inc eax
push eax
push 0xfffffffffffffffc
push dword [esi + 0x10]
push 0x8005
call edi
pop edi
pop esi
pop ebx
ret
Function at 0x100638d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x10019c4
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10063e4
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x100a124
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10019b4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x100a124]
leave
ret

Function at 0x1007773
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1007df8
call fcn.010079a4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x100a4b4
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x100752a
cmp eax, esi
jne 0x100751d
xor esi, esi
inc esi
mov ebx, esi
jmp 0x100752d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1007504
xor esi, esi
inc esi
mov eax, dword [0x100a4b0]
cmp eax, esi
jne 0x1007540
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100756f
mov eax, dword [0x100a4b0]
test eax, eax
jne 0x1007569
mov dword [0x100a4b0], esi
push 0x10012bc
push 0x10012b0
call fcn.01007469
pop ecx
pop ecx
test eax, eax
je 0x100756f
jmp 0x1007697
mov dword [0x100a158], esi
mov eax, dword [0x100a4b0]
cmp eax, esi
jne 0x1007593
push 0x10012ac
push 0x10012a4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100a4b0], 2
test ebx, ebx
jne 0x100759f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100a4b8], 0
je 0x10075c3
push 0x100a4b8
call fcn.01007919
pop ecx
test eax, eax
je 0x10075c3
push 0
push 2
push 0
call dword [0x100a4b8]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x100761f
test al, al
je 0x10075dd
cmp dword [ebp - 0x1c], 0
jne 0x100761f
mov al, byte [esi]
test al, al
je 0x10075ed
cmp al, 0x20
ja 0x10075ed
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10075dd
test byte [ebp - 0x3c], 1
je 0x10075f9
movzx eax, word [ebp - 0x38]
jmp 0x10075fc
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x100a154], eax
cmp dword [0x100a148], 0
jne 0x1007673
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x100762e
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x1007641
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x10075ca
cmp dword [0x100a158], 0
jne 0x1007682
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100a154]
jmp 0x10076a3
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.010079e9
ret
call fcn.01007af1
jmp 0x10074ca
Function at 0x40a9ec
Capabilities:
Check if file exists

Disassembly:
push 0x7c
mov eax, 0x472519
call fcn.00459836
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
push 0x4791e4
lea esi, [ebp - 0x6c]
mov dword [ebp - 4], ebx
call fcn.004062ba
push str.vToolbarUpdater
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 1
call fcn.004062ba
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0040d0b1
pop ecx
pop ecx
xor edi, edi
push ebx
inc edi
push edi
call fcn.0040866c
push ebx
push edi
lea esi, [ebp - 0x6c]
mov byte [ebp - 4], bl
call fcn.0040866c
cmp dword [ebp - 0x18], ebx
jne 0x40aa71
push ebx
push edi
lea esi, [ebp - 0x2c]
call fcn.0040866c
xor al, al
call fcn.004598b9
ret
lea eax, [ebp - 0x2c]
push eax
lea esi, [ebp - 0x48]
call fcn.004085e7
push str.log4cplusU.dll
mov eax, esi
push eax
mov byte [ebp - 4], 3
call fcn.0040626f
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x40aa9a
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40aab1
push ebx
push edi
lea esi, [ebp - 0x48]
call fcn.0040866c
jmp 0x40aa5f
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x40aabd
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
test eax, eax
jne 0x40ab13
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.CLogger::SetDllDirectory_____SetDllDirectory_failed
lea esi, [ebp - 0x6c]
mov dword [ebp - 0x50], eax
call fcn.004062ba
push dword [ebp - 0x50]
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040a368
pop ecx
push ebx
push edi
call fcn.0040866c
mov byte [ebp - 0x49], bl
push ebx
push edi
lea esi, [ebp - 0x48]
call fcn.0040866c
push ebx
push edi
lea esi, [ebp - 0x2c]
call fcn.0040866c
mov al, byte [ebp - 0x49]
jmp 0x40aa6b
mov byte [ebp - 0x49], 1
jmp 0x40aaf7

Function at 0x40ac91
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40aca8
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40acdd
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x40acd9
cmp edi, eax
jae 0x40acdd
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x40accb
cmp edi, eax
jb 0x40ace1
xor eax, eax
jmp 0x40acea
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x40ae8e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40aef2
cmp dword [ebp + 0xc], 1
je 0x40aeca
cmp dword [ebp + 0xc], 2
je 0x40aeca
push 0xd
pop eax
jmp 0x40aef2
mov eax, dword [ebp - 4]
test edi, edi
je 0x40aeec
test eax, eax
je 0x40aee7
test al, 1
jne 0x40aec5
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40aeec
jmp 0x40aec5
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x40ec3b
Capabilities:
Check if file exists

Disassembly:
push 0x44
mov eax, 0x4723ac
call fcn.00459836
lea eax, [ebp - 0x2c]
push eax
mov edi, ecx
call fcn.00411c1f
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
jne 0x40ec70
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.0040866c
xor al, al
call fcn.004598b9
ret
lea eax, [ebp - 0x4c]
push str.ProgramFiles
push eax
call fcn.0040e8bc
pop ecx
pop ecx
push 0xffffffffffffffff
push ebx
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0040855c
push ebx
push 1
lea esi, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.0040866c
cmp dword [edi + 0x14], ebx
je 0x40ec5d
push 0x4786ac
push edi
call fcn.0040626f
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2c]
mov ecx, edi
call fcn.0040612d
push str.configuration.xml
push edi
call fcn.0040626f
cmp dword [edi + 0x18], 8
jb 0x40eccf
mov edi, dword [edi + 4]
jmp 0x40ecd2
add edi, 4
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40ecf3
mov byte [ebp - 0x2d], bl
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.0040866c
mov al, byte [ebp - 0x2d]
jmp 0x40ec6a
mov byte [ebp - 0x2d], 1
jmp 0x40ece0
Function at 0x410245
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x470182
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x489218]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x489218]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4102a8
xor eax, eax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0045509c
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor edi, edi
cmp ecx, edi
je 0x4102d0
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
add edx, ecx
cmp ecx, edx
jae 0x4102d0
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
mov byte [eax], bl
mov eax, ebx
jmp 0x410288
mov eax, dword [esi + 0x4c]
cmp eax, edi
jne 0x4102dc
or eax, 0xffffffff
jmp 0x410288
cmp dword [esi + 0x3c], edi
jne 0x4102f0
push eax
push ebx
call fcn.0040ffde
pop ecx
pop ecx
test al, al
je 0x4102d7
jmp 0x4102cc
push edi
push 8
lea ecx, [esp + 0x4c]
mov byte [esp + 0x18], bl
call fcn.004108fa
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x74], edi
call fcn.00410920
mov ecx, eax
call fcn.00410ccd
mov edi, dword [esp + 0x58]
mov ebx, eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
call fcn.00410920
mov ecx, eax
call fcn.00410ccd
lea edx, [esp + 0x18]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x410400
cmp eax, 1
jg 0x410428
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x48]
call fcn.00410920
mov ecx, eax
call fcn.00410ccd
mov edi, dword [esp + 0x18]
sub edi, eax
je 0x410395
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x48]
call fcn.00410920
mov ecx, eax
call fcn.00410ccd
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00457c80
add esp, 0x10
cmp edi, eax
jne 0x41043f
lea eax, [esp + 0x10]
mov byte [esi + 0x41], 1
cmp dword [esp + 0x1c], eax
jne 0x410456
test edi, edi
ja 0x4103c3
cmp dword [esp + 0x58], 0x20
jae 0x41043f
push 0
push 8
lea ecx, [esp + 0x4c]
call fcn.004057d6
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
call fcn.00410920
mov ecx, eax
call fcn.00410ccd
mov edi, dword [esp + 0x58]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
call fcn.00410920
mov ecx, eax
call fcn.00410ccd
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [esp + 0x28]
push edx
lea edx, [esp + 0x21]
push edx
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x2c], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x410343
jmp 0x41043f
cmp eax, 3
jne 0x41043f
push dword [esi + 0x4c]
push dword [esp + 0x14]
call fcn.0040ffde
pop ecx
pop ecx
test al, al
jne 0x410456
or esi, 0xffffffff
push 0
push 1
lea ecx, [esp + 0x4c]
call fcn.004076fc
mov eax, esi
jmp 0x410288
mov esi, dword [ebp + 8]
jmp 0x410442