joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x40d069
xor ecx, ecx
jne 0x40d069
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40d0b0
mov eax, dword [ebp - 0xc]
jmp 0x40d10d
cmp dword [ebp - 4], 1
je 0x40d0c3
cmp dword [ebp - 4], 2
je 0x40d0c3
mov eax, 0xd
jmp 0x40d10d
cmp dword [ebp + 0xc], 0
je 0x40d101
cmp dword [ebp - 8], 0
je 0x40d0f9
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x40d0f0
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x40d0f7
mov eax, 0xd
jmp 0x40d10d
jmp 0x40d101
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40e100
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
lea ecx, [ebp + 8]
call fcn.004077a0
mov dword [ebp - 0x2c], eax
lea ecx, [ebp + 0xc]
call fcn.004077a0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0
movzx eax, byte [ebp + 0x10]
sub eax, 1
neg eax
sbb eax, eax
and eax, 0xfffffffb
add eax, 5
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp + 8]
call fcn.00408680
lea ecx, [ebp + 0xc]
call fcn.00408680
mov esp, ebp
pop ebp
ret

Function at 0x40e2a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b5458
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4e7950]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov byte [ebp - 0xd], 0
lea ecx, [ebp + 8]
call fcn.0041d8d0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40e2e8
mov byte [ebp - 0xd], 0
jmp 0x40e2ec
mov byte [ebp - 0xd], 1
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.00407050
mov al, byte [ebp - 0xd]
mov byte [ebp - 0xe], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00408680
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x411e20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b79c8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push edi
mov eax, dword [0x4e7950]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x201
je 0x411e73
cmp dword [ebp - 0x30], 0x202
jle 0x412031
cmp dword [ebp - 0x30], 0x204
jle 0x411e73
jmp 0x412031
push 0x3ea
mov ecx, dword [ebp - 0x2c]
call fcn.0040db20
mov ecx, dword [ebp - 0x2c]
add ecx, 0x2f0
call fcn.00421500
push 0x26
lea ecx, [ebp - 0x10]
push ecx
call fcn.0043ab60
add esp, 8
mov dword [ebp - 4], 0
push 0x4cbb10
lea ecx, [ebp - 0x10]
call fcn.00401f20
push 1
push 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x2d8
call fcn.004077a0
push eax
lea ecx, [ebp - 0x10]
call fcn.004077a0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408680
mov ecx, dword [ebp - 0x2c]
add ecx, 0x2e4
call fcn.004025b0
movzx edx, al
test edx, edx
jne 0x412023
lea ecx, [ebp - 0x14]
call fcn.00401e00
mov dword [ebp - 4], 1
push 0
lea eax, [ebp - 0x18]
push eax
lea edi, [ebp - 0x14]
call fcn.004394c0
add esp, 8
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [ebp - 0x14]
push edx
call fcn.00401e20
mov dword [ebp - 0x34], eax
call fcn.0043ac10
add esp, 4
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x412008
lea ecx, [ebp - 0x1c]
call fcn.00401e00
mov byte [ebp - 4], 3
push 0x19
lea eax, [ebp - 0x24]
push eax
call fcn.0043ab60
add esp, 8
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x2e4]
push eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx]
push edx
push str._s_s.lnk
lea eax, [ebp - 0x1c]
push eax
call fcn.00404820
add esp, 0x10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.00408680
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
lea edx, [ebp - 0x1c]
push edx
call fcn.00401e20
mov dword [ebp - 0x44], eax
call fcn.0043ac10
add esp, 4
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x411ffc
push 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x2d8
call fcn.004077a0
push eax
push 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x2e8
call fcn.004077a0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004077a0
push eax
lea ecx, [ebp - 0x14]
call fcn.004077a0
push eax
call fcn.00439780
add esp, 0x18
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.00408680
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00408680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00408680
push 0
push 0
push 0x10
mov ecx, dword [ebp - 0x2c]
call fcn.0040da60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x4143e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x4ed83c
lea ecx, [ebp - 4]
call fcn.00401e20
push 1
push 0
push 0
lea ecx, [ebp - 4]
call fcn.004077a0
push eax
push 0x4cbf60
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.00408680
mov esp, ebp
pop ebp
ret

Function at 0x414420
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b87f0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push edi
mov eax, dword [0x4e7950]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
push 0x4ed840
lea ecx, [ebp - 0x10]
call fcn.00401e20
mov dword [ebp - 4], 0
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x4cbf6c
call fcn.00401e40
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x4cbf70
call fcn.00401e40
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x4cbf74
call fcn.00401e40
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x44], edx
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x4cbf78
call fcn.00401e40
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x2c]
add ecx, 0x2bc
push ecx
mov edx, esp
mov dword [ebp - 0x24], esp
push ecx
mov ecx, edx
call fcn.00401e20
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.gg_gamepack_start_cd09
call fcn.00401e40
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 0
mov edi, 0x4ed830
call fcn.0045bc80
push 1
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.004077a0
push eax
push 0x4cbfac
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408680
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x414560
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0x3f4
push ecx
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401e20
mov dword [ebp - 0x14], eax
call fcn.0043ac10
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4145b2
push 0x10
push 0x4cbfb8
push 0x4cbfc4
mov ecx, dword [ebp - 0x10]
call fcn.0046c8f7
mov ecx, dword [ebp - 0x10]
call fcn.00416ab0
jmp 0x41467b
push ecx
mov ecx, esp
mov dword [ebp - 0xc], esp
push 0x4cbff8
mov edx, dword [ebp - 0x10]
add edx, 0x264
push edx
push ecx
call fcn.00402370
add esp, 0xc
mov dword [ebp - 0x1c], eax
call fcn.0043ac10
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4145f9
mov ecx, dword [ebp - 0x10]
add ecx, 0x3e8
call fcn.004025b0
movzx eax, al
test eax, eax
je 0x414617
push 0x10
push 0x4cc018
push 0x4cc024
mov ecx, dword [ebp - 0x10]
call fcn.0046c8f7
mov ecx, dword [ebp - 0x10]
call fcn.00416ab0
jmp 0x41467b
push 0x5c
mov ecx, dword [ebp - 0x10]
add ecx, 0x3f4
call fcn.00402090
add eax, 1
push eax
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x3f4
call fcn.00402200
push 1
lea ecx, [ebp - 4]
call fcn.004077a0
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x3f0
call fcn.004077a0
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x3f4
call fcn.004077a0
push eax
push 0x4cc044
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.00408680
mov esp, ebp
pop ebp
ret

Function at 0x414680
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x4ed84c
lea ecx, [ebp - 4]
call fcn.00401e20
push 1
push 0
push 0
lea ecx, [ebp - 4]
call fcn.004077a0
push eax
push 0x4cc050
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.00408680
mov esp, ebp
pop ebp
ret

Function at 0x4146c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b55a8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4e7950]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
push 0x4ed858
lea ecx, [ebp - 0x10]
call fcn.00401e20
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0x3ec
push eax
lea ecx, [ebp - 0x10]
call fcn.00401f00
push str..html
lea ecx, [ebp - 0x10]
call fcn.004024a0
push 1
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.004077a0
push eax
push 0x4cc068
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408680
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4157d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b77c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4e7950]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 1
push 0x4cc590
lea ecx, [ebp + 0xc]
call fcn.004077a0
push eax
push 0x4cc598
call fcn.0040d610
mov ecx, eax
call fcn.00466f33
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x3fc
call fcn.00401ec0
lea ecx, [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x264
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.004022c0
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x3f8
call fcn.00401ec0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00408680
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x2cc], 1
push 0
push 0
mov ecx, dword [ebp - 0x18]
push ecx
push 0x415990
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00408680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00408680
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x4158e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7788
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4e7950]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [0x4ed3f8], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x2cc], ecx
push 0x4cc5a4
mov ecx, dword [ebp - 0x14]
add ecx, 0x3fc
call fcn.00401ee0
lea edx, [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x3f8
call fcn.00401ec0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
push 0x415990
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00408680
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x415ca0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b4638
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4e7950]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x1c]
push eax
push 0x4c2690
push 1
push 0
push 0x4c26a0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x415d0c
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x415e36
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [eax + 0x50]
call edx
mov eax, dword [ebp - 0x2c]
add eax, 0x264
push eax
lea ecx, [ebp - 0x10]
call fcn.00401e20
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x10]
call fcn.00402590
sub eax, 1
push eax
lea ecx, [ebp - 0x10]
call fcn.0041d940
lea ecx, [ebp - 0x10]
call fcn.004077a0
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [edx + 0x24]
call ecx
cmp dword [ebp + 0x10], 0
je 0x415d7d
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ecx + 0x44]
call eax
lea ecx, [ebp - 0x14]
push ecx
push 0x4c26e0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [eax]
call edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x415dbd
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408680
mov eax, dword [ebp - 0x20]
jmp 0x415e36
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [edx + 0x18]
call ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x415dfb
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408680
mov eax, dword [ebp - 0x24]
jmp 0x415e36
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ecx + 8]
call eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408680
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x416ab0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 1
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x264
call fcn.004077a0
push eax
push 0x4cc6ec
push 0x4cc708
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x420f10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
call fcn.0041fe80
mov dword [ebp - 0xc], eax
push 0x4caa18
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x420f45
xor eax, eax
jmp 0x420ffa
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x420f74
xor eax, eax
jmp 0x420ffa
mov eax, dword [ebp - 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0048db60
add esp, 0xc
lea edx, [ebp - 0x18]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0041fef0
add esp, 8
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x420ff8
mov eax, 1
jmp 0x420ffa
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x421e70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x421e79
xor ecx, ecx
jne 0x421e79
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x421e9a
mov eax, 0xd
jmp 0x421ef5
xor eax, eax
jne 0x421e81
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x421eab
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8
Function at 0x421f00
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4e7950]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00421000
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0040cff0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x421f6b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.0040cf80
mov eax, dword [ebp - 0x224]
jmp 0x421ffc
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x421fd1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00421f00
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x421fc8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.0040cf80
mov eax, dword [ebp - 0x228]
jmp 0x421ffc
mov dword [ebp - 4], 0x100
jmp 0x421f72
lea ecx, [ebp - 0x14]
call fcn.0040cfa0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00421ca0
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.0040cf80
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00480723
mov esp, ebp
pop ebp
ret 4
Function at 0x42a4e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6008
mov eax, dword fs:[0]
push eax
sub esp, 0x1c8
mov eax, dword [0x4e7950]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 4], 1
push 0x4c91b4
lea ecx, [ebp - 0x18]
call fcn.00401e40
mov byte [ebp - 4], 2
push 0
lea ecx, [ebp + 0xc]
call fcn.004077a0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x42a590
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401e20
mov ecx, dword [ebp - 0x1d0]
or ecx, 1
mov dword [ebp - 0x1d0], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00408680
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00408680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00408680
mov eax, dword [ebp + 8]
jmp 0x42a6eb
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046164f
add esp, 4
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0
lea ecx, [ebp + 0xc]
call fcn.004077a0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x1c0]
push ecx
push 0x4c91b8
mov edx, dword [ebp - 0x14]
push edx
call sub.VERSION.dll_VerQueryValueW
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
push eax
push 0x4c91ec
lea ecx, [ebp - 0x1c8]
push ecx
call fcn.00406fa0
add esp, 0xc
mov dword [ebp - 0x1d4], eax
mov edx, dword [ebp - 0x1c0]
movzx eax, word [edx + 2]
push eax
mov ecx, dword [ebp - 0x1c0]
movzx edx, word [ecx]
push edx
mov ecx, dword [ebp - 0x1d4]
call fcn.004077a0
push eax
lea eax, [ebp - 0x1bc]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x1c8]
call fcn.00408680
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x1bc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.VERSION.dll_VerQueryValueW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x1c], 0
je 0x42a68e
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x18]
call fcn.00401ee0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1cc], eax
mov ecx, dword [ebp - 0x1cc]
push ecx
call fcn.0046165a
add esp, 4
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.00401e20
mov eax, dword [ebp - 0x1d0]
or eax, 1
mov dword [ebp - 0x1d0], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00408680
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00408680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00408680
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.00480723
mov esp, ebp
pop ebp
ret