joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408e14
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408dc8
test al, al
jne 0x408e35
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408e81
xor eax, eax
push ebp
push 0x408e71
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408e78
lea eax, [ebp - 0xc]
call fcn.00408e04
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409330
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x40938a
inc esi
xor edi, edi
cmp edi, 1
jne 0x409356
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x409364
cmp edi, 1
jle 0x409364
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408e14
test eax, eax
jne 0x40938a
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x40938a
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x40938a
inc edi
dec esi
jne 0x409346
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4097bc
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40988f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4098a8
push ebx
push 0x4098b4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x40983c
mov al, 0x62
call fcn.00409394
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409790
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409845
call fcn.00409790
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409896
lea eax, [ebp - 4]
call fcn.00403198
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x401443
pop dword [ebp - 0x20]
mov eax, 0x6b7a4ecd
sub eax, 0x6b3a3a8a
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x55884839
add dword [ebp - 0x30], 0xf8c9fd12
mov dword [ebp - 0x2c], 0xec75fc54
add dword [ebp - 0x2c], 0x45bd4ff1
mov dword [ebp - 0x28], 0x279cf20b
add dword [ebp - 0x28], 0x24af5223
mov dword [ebp - 0x24], 0xd58b2c84
sub dword [ebp - 0x24], 0xd58b2c84
lea eax, [ebp - 0x30]
push eax
mov eax, 0x7700287f
add eax, 0x894057f9
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x38238fb7
sub dword [ebp - 0x30], 0xc3b12661
mov dword [ebp - 0x2c], 0xe699b1e1
sub dword [ebp - 0x2c], 0xa52d506c
mov dword [ebp - 0x28], 0x2fb476e3
sub dword [ebp - 0x28], 0xcc450a77
mov dword [ebp - 0x24], 0xdfd8621d
add dword [ebp - 0x24], 0x20279de3
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x35fe1
push 0
call eax
mov ecx, 0x6fc5b2f2
add ecx, 0x903a8b85
xor esi, esi
add esi, eax
mov edi, 0xfc22566a
sub edi, 0xfbdcc46a
add edi, dword [ebp - 0x20]
mov ebx, 0x21ad64dd
add dword [ebp - 0x14], edi
mov edx, dword [edi]
xor edx, ebx
mov dword [ebp - 0x1c], 0x72e4882e
mov dword [esi], edx
mov dword [ebp - 0x14], 0x663831b1
add esi, 0x39216bf5
add esi, 0xc6de940f
add edi, 4
loop 0x40155c
add eax, 0x581cebb4
sub eax, 0x581bff05
xor ebx, ebx
add ebx, eax
add eax, 0x1cd98f25
sub eax, 0x1cd98f20
mov ecx, 0x5a1807a4
add ecx, 0xa627f85c
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x40107e
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x44b5d8]
mov edx, dword [ebp + 8]
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, dword [edx + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [0x44b5dc]
push edi
mov edi, dword [edx]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], edi
call fcn.00401077
mov eax, dword [0x44b5e0]
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x44b5e4]
add ebx, 0x23f
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x2d4a014], 0xc
mov dword [ebp - 4], eax
jne 0x401106
xor eax, eax
push eax
lea ecx, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x430]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x2d4a014]
cmp eax, 0xfa9
jne 0x401122
mov dword [0x2d4a010], 0xedeb2e40
cmp eax, 0x3eb
jne 0x40113b
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and dword [0x2d49f68], 0
mov edx, dword [ebp + 8]
lea eax, [ebx + edi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x10], 0
mov dword [0x2d4a00c], 0xf4ea3dee
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x18]
sub esi, eax
mov dword [ebp - 8], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
lea eax, [ebx + esi]
mov dword [ebp - 0x14], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 8]
add ebx, 0x61c88647
sub edi, eax
dec dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], edi
jne 0x4010d1
mov dword [edx], edi
pop edi
mov dword [edx + 4], esi
pop esi
pop ebx
leave
ret 4
Function at 0x406525
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44a764]
jne 0x40652f
repz ret
jmp fcn.0040ae96

Function at 0x409d17
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404b1e
and dword [ebp - 4], 0
cmp dword [0x44f81c], 0
mov ebx, eax
jne 0x409dc8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409e79
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409e79
push eax
call fcn.00404aac
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44f81c], eax
call esi
push eax
call fcn.00404aac
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44f820], eax
call esi
push eax
call fcn.00404aac
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44f824], eax
call esi
push eax
call fcn.00404aac
pop ecx
mov dword [0x44f82c], eax
test eax, eax
je 0x409dc8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404aac
pop ecx
mov dword [0x44f828], eax
mov eax, dword [0x44f828]
cmp eax, ebx
je 0x409e20
cmp dword [0x44f82c], ebx
je 0x409e20
push eax
call fcn.00404b27
push dword [0x44f82c]
mov esi, eax
call fcn.00404b27
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409e20
test edi, edi
je 0x409e20
call esi
test eax, eax
je 0x409e17
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409e17
test byte [ebp - 0xc], 1
jne 0x409e20
or dword [ebp + 0x10], 0x200000
jmp 0x409e59
mov eax, dword [0x44f820]
cmp eax, ebx
je 0x409e59
push eax
call fcn.00404b27
pop ecx
test eax, eax
je 0x409e59
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409e59
mov eax, dword [0x44f824]
cmp eax, ebx
je 0x409e59
push eax
call fcn.00404b27
pop ecx
test eax, eax
je 0x409e59
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44f81c]
call fcn.00404b27
pop ecx
test eax, eax
je 0x409e79
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409e7b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100316aa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x10031716
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x1003175f
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.100392b0
add esp, 8
test eax, eax
jne 0x1003175d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x10031761
jmp 0x1003170d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100344db
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.100344b9
add esp, 4
and eax, 0xff
test eax, eax
je 0x10034564
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea eax, [ebp - 0x2cc]
push eax
call fcn.10034f10
add esp, 0xc
mov dword [ebp - 0x2cc], 0x10001
lea ecx, [ebp - 0x2cc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x10034562
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [ebp + 0xc]
jne 0x10034562
jmp 0x10034564
jmp 0x100344e4
mov esp, ebp
pop ebp
ret

Function at 0x10036c71
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x1003bbf8
cmp edx, dword [eax]
je 0x10036c93
add eax, 8
inc ecx
cmp eax, 0x1003bc88
jl 0x10036c84
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x1003bbf8]
jne 0x10036dc1
mov eax, dword [0x1003e6b8]
cmp eax, 1
je 0x10036d9b
test eax, eax
jne 0x10036cc4
cmp dword [0x1003b924], 1
je 0x10036d9b
cmp edx, 0xfc
je 0x10036dc1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10036cfb
lea eax, [ebp - 0x1a4]
push 0x1003a538
push eax
call fcn.10035080
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.10035000
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x10036d3e
lea eax, [ebp - 0x1a4]
push eax
call fcn.10035000
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1003a534
push edi
call fcn.10035230
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x1003a518
push eax
call fcn.10035080
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.10035090
lea eax, [ebp - 0xa0]
push 0x1003a514
push eax
call fcn.10035090
push dword [esi + 0x1003bbfc]
lea eax, [ebp - 0xa0]
push eax
call fcn.10035090
push 0x12010
lea eax, [ebp - 0xa0]
push 0x1003a4ec
push eax
call fcn.10038a28
add esp, 0x2c
pop edi
jmp 0x10036dc1
lea eax, [ebp + 8]
lea esi, [esi + 0x1003bbfc]
push 0
push eax
push dword [esi]
call fcn.10035000
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x407e4f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42dc50]
jne 0x407e59
repz ret
jmp fcn.0040c58d

Function at 0x40b2e0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406080
and dword [ebp - 4], 0
cmp dword [0x437620], 0
mov ebx, eax
jne 0x40b391
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b442
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b442
push eax
call fcn.0040600e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x437620], eax
call esi
push eax
call fcn.0040600e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x437624], eax
call esi
push eax
call fcn.0040600e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x437628], eax
call esi
push eax
call fcn.0040600e
pop ecx
mov dword [0x437630], eax
test eax, eax
je 0x40b391
push 0x429f10
push edi
call esi
push eax
call fcn.0040600e
pop ecx
mov dword [0x43762c], eax
mov eax, dword [0x43762c]
cmp eax, ebx
je 0x40b3e9
cmp dword [0x437630], ebx
je 0x40b3e9
push eax
call fcn.00406089
push dword [0x437630]
mov esi, eax
call fcn.00406089
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b3e9
test edi, edi
je 0x40b3e9
call esi
test eax, eax
je 0x40b3e0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b3e0
test byte [ebp - 0xc], 1
jne 0x40b3e9
or dword [ebp + 0x10], 0x200000
jmp 0x40b422
mov eax, dword [0x437624]
cmp eax, ebx
je 0x40b422
push eax
call fcn.00406089
pop ecx
test eax, eax
je 0x40b422
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b422
mov eax, dword [0x437628]
cmp eax, ebx
je 0x40b422
push eax
call fcn.00406089
pop ecx
test eax, eax
je 0x40b422
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x437620]
call fcn.00406089
pop ecx
test eax, eax
je 0x40b442
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b444
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f90
Capabilities:
Get number of processors
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x445ef8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x45f4c8]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push esi
mov eax, dword [0x45f4c8]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x34], 7
xor bh, bh
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
mov dword [esp + 0x78], eax
push 0x2e
push eax
mov dword [esp + 0x14], eax
mov word [esp + 0x40], ax
lea eax, [esp + 0x42]
push eax
call fcn.00433da0
sub esp, 0xc
mov dword [esp + 0x28], 0x30
mov ecx, esp
xor eax, eax
push 7
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push str.5.1_5.2
mov word [ecx], ax
call fcn.00404410
call fcn.00402720
test al, al
je 0x402037
push str.XP_detected__aborting_KMDF_detect.
jmp 0x402066
push str.IIF_NODRV
lea ecx, [esi + 4]
call fcn.00414740
push str.Preparing_to_check_for_Kernal_Mode_Driver_Framework_1.11_or_higher
push 0x450cfc
push 0x46064c
mov bl, al
call fcn.00417ac0
add esp, 0xc
test bl, bl
je 0x40207c
push str.No_Driver_mode_detected__skipping_check.
push 0x450cfc
push 0x46064c
call fcn.00417ac0
mov bh, 1
jmp 0x402126
push 0x2b
push str.SYSTEMCurrentControlSetControlWdfKmdf1
lea ecx, [esp + 0x28]
call fcn.00404410
cmp dword [esp + 0x34], 8
lea ecx, [esp + 0xc]
push ecx
push 0x20019
lea eax, [esp + 0x28]
cmovae eax, dword [esp + 0x28]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402112
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x30
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push str.Version
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x38]
push eax
call fcn.0042ff45
fstp qword [esp + 0x18]
movsd xmm0, qword [esp + 0x18]
add esp, 4
comisd xmm0, xmmword [0x457e10]
setae bh
test bh, bh
je 0x402112
push str.KMDF_1.11_or_higher_detected_
jmp 0x402117
push str.KMDF_1.11_or_higher_not_detected_.
push 0x450cfc
push 0x46064c
call fcn.00417ac0
add esp, 0xc
cmp dword [esp + 0x34], 8
jb 0x40213c
push dword [esp + 0x20]
call fcn.00420070
add esp, 4
mov al, bh
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0042f51f
mov esp, ebp
pop ebp
ret
Function at 0x404de0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446073
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x45f4c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CDialog.0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov dword [ebp - 0x14], ecx
mov word [ecx], ax
push eax
push 0x451a28
mov byte [ebp - 4], 1
call fcn.00404410
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, esi
mov byte [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], SysReAllocString
mov dword [esi + 0x1c], SysReAllocString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x404e90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
movzx eax, word [eax + 8]
push 5
push eax
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x404ec5
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404ebb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x404ebb
push ebx
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push ebx
call fcn.004302bb
mov esi, eax
add esp, 4
test esi, esi
je 0x404f1c
push ebx
push dword [ebp - 4]
push ebx
push esi
call fcn.0043023c
add esp, 0x10
test eax, eax
je 0x404f27
push esi
call fcn.0043034d
add esp, 4
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, 0x4621e0
call fcn.00419770
test al, al
je 0x404f3c
or dword [esi + 8], 0x402000
push 0
push 0x404dd0
push dword [ebp + 8]
push esi
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov ebx, dword [ebp - 8]
mov dword [ebx + 4], eax
lea edi, [ebx + 4]
test eax, eax
je 0x404f93
push edi
call fcn.00406680
push 0x404d80
push 4
mov dword [eax], ebx
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [edi]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
call fcn.00406680
push 0
push 0
push 0x110
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax]
push esi
call fcn.0043034d
add esp, 4
xor eax, eax
cmp dword [edi], eax
setne al
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x404fc0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push 0
mov esi, ecx
call fcn.00404e90
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x1c]
push 0
push 0
push 0
push eax
call edi
test eax, eax
je 0x405038
push ebx
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
lea esp, [esp]
cmp byte [esi + 0xc], 0
jne 0x405037
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x405027
lea eax, [ebp - 0x1c]
push eax
call ebx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call edi
test eax, eax
jne 0x405000
pop ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, 0x462a0c
call fcn.00419eb0
mov eax, dword [0x462a14]
mov ecx, 0x462a14
push dword [eax + 4]
call fcn.0041a0e0
mov eax, dword [0x462a14]
pop edi
mov dword [eax + 4], eax
mov eax, dword [0x462a14]
mov dword [eax], eax
mov eax, dword [0x462a14]
mov dword [eax + 8], eax
mov dword [0x462a18], 0
mov eax, dword [esi + 0x10]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x405090
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44609b
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x45f4c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
mov dword [ebp - 4], eax
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push dword [ecx + 4]
call edi
mov esi, eax
test esi, esi
je 0x40514e
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x405100
push 0x400
lea eax, [ebp - 0x810]
push eax
push esi
call ebx
lea eax, [ebp - 0x828]
mov ecx, 0x4621e0
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.00419c10
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 2
push esi
call edi
mov esi, eax
test esi, esi
jne 0x405100
cmp dword [ebp - 0x814], 8
jb 0x405165
push dword [ebp - 0x828]
call fcn.00420070
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042f51f
mov esp, ebp
pop ebp
ret