joyce8/EMBER2024-capa huggingface dataset:
Function at 0x516348
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x5164cc
push ebx
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 8], ebx
je 0x5164cb
push esi
push edi
mov edi, dword [ebx]
add edi, 0x40
push edi
call fcn.004ea96f
mov esi, eax
test esi, esi
pop ecx
je 0x5164c9
push edi
push ebx
push esi
call fcn.004ebce0
mov edi, dword [esi]
add esp, 0xc
add edi, esi
and dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0xc]
mov ecx, dword [edi + ecx*4]
xor eax, eax
cmp ecx, dword [eax*8 + 0x56b3c0]
je 0x5163be
inc eax
cmp eax, 4
jb 0x5163ad
jmp 0x516420
cmp dword [ebp + 0x10], 0
je 0x5163da
cmp dword [eax*8 + 0x56b3c4], 0x12
je 0x516420
mov eax, dword [ebp + 0xc]
mov dword [edi + eax*4], 0xffffff
jmp 0x516420
lea ebx, [eax*8 + 0x56b3c4]
push dword [ebx]
mov dword [ebp - 4], ebx
call dword [sym.imp.user32.dll_GetSysColor]
push dword [ebx]
movzx eax, ah
mov dword [ebp + 8], eax
call dword [sym.imp.user32.dll_GetSysColor]
mov ecx, dword [ebp + 8]
mov ch, al
mov eax, ebx
push dword [eax]
shl ecx, 8
mov dword [ebp + 8], ecx
call dword [sym.imp.user32.dll_GetSysColor]
mov ecx, dword [ebp + 8]
shr eax, 0x10
movzx eax, al
or ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [edi + eax*4], ecx
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0x10
jl 0x5163a5
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
push 0
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], ebx
call dword [sym.imp.user32.dll_GetDC]
push ebx
push edi
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.gdi32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [ebp - 4], eax
je 0x5164ab
push dword [ebp + 0x10]
call dword [sym.imp.gdi32.dll_CreateCompatibleDC]
push dword [ebp - 4]
mov ebx, dword [sym.imp.gdi32.dll_SelectObject]
mov edi, eax
push edi
call ebx
mov cl, byte [esi + 0xe]
push 0xcc0020
xor edx, edx
inc edx
shl edx, cl
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push esi
lea ecx, [ecx + edx*4 + 0x28]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
push edi
call dword [sym.imp.gdi32.dll_StretchDIBits]
push dword [ebp - 0xc]
push edi
call ebx
push edi
call dword [sym.imp.gdi32.dll_DeleteDC]
push dword [ebp + 0x10]
push 0
call dword [sym.imp.user32.dll_ReleaseDC]
push esi
call fcn.004ea481
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_FreeResource]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x51b7f4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x590f68]
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
mov dword [ebp - 4], eax
je 0x51b841
push dword [ebp + 8]
call fcn.005291c4
mov esi, eax
test esi, esi
je 0x51b869
push edi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.advapi32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
jmp 0x51b869
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0x550000
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.004e9911
leave
ret 0xc

Function at 0x521aad
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x521ac3
mov edi, dword [esi + 0xc]
jmp 0x521aed
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.kernel32.dll_FindResourceA]
push eax
push dword [esi + 8]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov edi, eax
test edi, edi
jne 0x521aed
call fcn.0050fa59
call fcn.00527fd7
cmp dword [eax + 0x1038], 0
je 0x521b05
push edi
mov ecx, ebx
call fcn.00520c61
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.005219cc
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x58]
test eax, eax
je 0x521b23
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
and dword [ebx + 0x58], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x521b2f
mov edi, eax
mov dword [ebx + 0x58], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x528993
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.00527fd7
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
test eax, eax
je 0x5289d3
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
mov dword [ebp - 8], eax
je 0x5289d3
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov esi, eax
test esi, esi
jne 0x5289d7
xor eax, eax
jmp 0x528a54
movzx eax, word [esi + 6]
push ebx
shl eax, 2
push edi
push eax
call fcn.005043b5
mov edi, eax
xor eax, eax
cmp word [esi + 6], ax
pop ecx
jbe 0x528a05
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
inc ecx
inc ecx
cmp eax, edx
jl 0x5289f4
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.00528529
push edi
mov ebx, eax
call fcn.005043e0
test ebx, ebx
pop ecx
je 0x528a47
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.005287a3
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.0052888d
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4
Function at 0x529273
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov eax, 0x540aa1
call fcn.004ec0ac
mov eax, 0x1014
call fcn.004ea990
mov eax, dword [0x590f68]
push ebx
push edi
xor edi, edi
mov dword [ebp - 0x101c], edi
cmp dword [ecx + 0x50], edi
mov dword [ebp - 0x10], eax
je 0x52936e
push dword [ebp + 0xc]
call fcn.005291c4
cmp eax, edi
mov dword [ebp - 0x1014], eax
jne 0x5292bc
push dword [ebp + 0x14]
jmp 0x52939f
push esi
call fcn.00503c89
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp + 0xc], ebx
mov esi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1020]
push eax
push edi
lea eax, [ebp - 0x101c]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp - 0x1014]
call esi
cmp eax, edi
mov dword [ebp - 0x1018], eax
jne 0x529339
lea eax, [ebp - 0x1020]
push eax
push dword [ebp - 0x1020]
lea ecx, [ebp + 0xc]
call fcn.004015f0
push eax
lea eax, [ebp - 0x101c]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x1014]
call esi
push 0xffffffffffffffff
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x1018], eax
call fcn.00434640
mov ebx, dword [ebp + 0xc]
push dword [ebp - 0x1014]
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [ebp - 0x1018], edi
mov ecx, dword [ebp + 8]
pop esi
jne 0x52935c
lea eax, [ebp + 0xc]
push eax
call fcn.00402bf0
jmp 0x529364
push dword [ebp + 0x14]
call fcn.004018f0
lea ecx, [ebx - 0x10]
call fcn.00401210
jmp 0x5293a7
cmp dword [ebp + 0x14], edi
jne 0x52937a
mov dword [ebp + 0x14], 0x54e04a
push dword [ecx + 0x64]
lea eax, [ebp - 0x1010]
push 0x1000
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, dword [ebp + 8]
call fcn.004018f0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.004e9911
leave
ret 0x10

Function at 0x52958f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [ebp + 0xc], 0x800
mov eax, dword [0x590f68]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
jne 0x5295ed
push 0x56d0e8
push eax
call dword [sym.imp.kernel32.dll_lstrcpy]
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.004ec693
add esp, 0x10
cmp eax, 0xffffffff
je 0x529601
cmp eax, esi
jae 0x529601
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
jmp 0x529603
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
test eax, eax
jne 0x5295b8
jmp 0x529604
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.004e9911
leave
ret
Function at 0x529624
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x590f68]
push ebx
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_GetModuleHandleA]
xor ebx, ebx
push 0x56d15c
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push 0x56d140
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
cmp eax, ebx
je 0x5296c6
call eax
mov esi, dword [sym.imp.kernel32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push 0x56d124
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x5297c8
call dword [sym.imp.kernel32.dll_GetVersion]
test eax, eax
jns 0x529776
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push 0x56d0fc
push 0x80000001
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5297c9
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x52976b
cmp dword [ebp - 0x24], 1
jne 0x52976b
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x56d0f8
push eax
call fcn.004ec4d8
add esp, 0xc
cmp eax, 1
jne 0x52976b
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.kernel32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x5297c9
push 0x56d0ec
call edi
cmp eax, ebx
je 0x5297c9
lea ecx, [ebp - 0x18]
push ecx
push 0x52960e
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.kernel32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x5297c9
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x5297ef
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.0052958f
cmp eax, ebx
pop ecx
pop ecx
jne 0x5297f1
inc edi
cmp edi, esi
jl 0x5297d8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004e9911
leave
ret 4
Function at 0x52a149
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x540cb9
call fcn.004ec0ac
sub esp, 0x11c
mov eax, dword [0x590f68]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x52a242
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x52a216
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.004018f0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.0052a149
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401210
test bl, bl
jne 0x52a216
or dword [ebp - 4], 0xffffffff
jmp 0x52a187
cmp esi, 0x103
je 0x52a226
cmp esi, 0x3f2
jne 0x52a236
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.advapi32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.004e9911
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x52a9e1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x52aa16
cmp edi, dword [esi + 0xc]
jge 0x52aa16
push dword [esi]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x52aa16
cmp edi, dword [eax + 8]
jge 0x52aa16
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x52aa18
xor edi, edi
push ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x52ab9f
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x52abd3
jmp fcn.004fd73a
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret
Function at 0x52ac44
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x52ad3d
cmp eax, dword [edi + 0xc]
jge 0x52ad3d
push dword [edi]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x52ac95
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x52ad26
cmp dword [ebp + 0xc], ebx
je 0x52ad26
jmp 0x52acbf
push 0x10
call fcn.0052a8ad
cmp eax, ebx
je 0x52acab
mov ecx, eax
call fcn.0052ab6c
mov esi, eax
jmp 0x52acad
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x52acd6
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.kernel32.dll_LocalAlloc]
jmp 0x52ace6
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.kernel32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x52acf8
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.004fd73a
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.004ec3c0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x52ad38
cmp ecx, dword [esi + 8]
jge 0x52ad38
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x52ad3e
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x52b5b1
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x590f68]
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.004ec668
mov esi, eax
test esi, esi
pop ecx
je 0x52b659
push esi
call dword [sym.imp.kernel32.dll_lstrlen]
add eax, esi
je 0x52b64f
push edi
mov edi, 0x80000000
push ebx
push eax
push esi
mov byte [eax], 0
call fcn.004ee24d
pop ecx
pop ecx
lea eax, [ebp - 0x110]
push eax
push esi
push edi
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
jne 0x52b64d
push 0x105
lea eax, [ebp - 0x10c]
push eax
xor ebx, ebx
push ebx
push dword [ebp - 0x110]
call dword [sym.imp.advapi32.dll_RegEnumKeyA]
test eax, eax
jne 0x52b627
inc ebx
push dword [ebp - 0x110]
call dword [sym.imp.advapi32.dll_RegCloseKey]
test ebx, ebx
jne 0x52b64d
push esi
push edi
call dword [sym.imp.advapi32.dll_RegDeleteKeyA]
push 0x5c
push esi
call fcn.004ea4f2
test eax, eax
pop ecx
pop ecx
jne 0x52b5e8
pop ebx
pop edi
push esi
call fcn.004ea481
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.004e9911
leave
ret 4
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
sub ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
pop edi
cmp edi, ebx
jne 0x40b525
xor eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
or eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
test eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
test eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x411091
Capabilities:
Terminate process

Disassembly:
jmp 0x4199e0
jmp fcn.0041a4d0
cmp ecx, dword [0x42529c]
jne 0x4199ea
repz ret
jmp 0x4111fe
Function at 0x40d1f0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48f22b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0048373e
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40d272
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00480fa0
mov eax, dword [eax]
push 0x5c7234
push eax
call fcn.00461074
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004839c9
test bl, bl
je 0x40d272
push 0x5c7234
lea ecx, [esp + 0xc]
call fcn.00483d59
push 0x5cadc0
lea ecx, [esp + 0xc]
call fcn.00483d59
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40d2ae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004839c9
jmp 0x40d379
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40d332
lea edx, [esp + 0x7c]
push 0x5cadbc
push edx
call fcn.00461074
add esp, 8
test eax, eax
je 0x40d332
lea eax, [esp + 0x7c]
push 0x5cadb8
push eax
call fcn.00461074
add esp, 8
test eax, eax
je 0x40d332
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40d2c2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004839c9
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40e5d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40e632
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc