joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409310
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421bf8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x42a520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x18]
push 0x426648
xor ebx, ebx
push eax
xor esi, esi
mov dword [ebp - 4], ebx
call fcn.004097b0
add esp, 8
mov edi, dword [ebp - 0x18]
cmp dword [edi - 0xc], ebx
je 0x409416
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea ebx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.004094f0
mov ebx, dword [ebp - 0x24]
test eax, eax
jne 0x409409
test ebx, ebx
je 0x409414
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.__s_
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00406e00
mov edi, dword [ebp - 0x14]
mov eax, edi
add esp, 8
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4093c0
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
mov eax, dword [ebp + 8]
push edx
push edi
push 2
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb esi, esi
lea eax, [edi - 0x10]
inc esi
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409409
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, ebx
je 0x409414
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40945c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40beb0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4284c8
push 0x416480
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x84f0
call fcn.004207e0
mov eax, dword [0x42a520]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 4], ebx
push 6
push 0x4267d4
push esi
call fcn.0041196f
add esp, 0xc
test eax, eax
je 0x40c0ce
call fcn.00409740
xor eax, eax
mov word [ebp - reloc.winhttp.dll_WinHttpSetTimeouts], ax
push 0x206
push ebx
lea ecx, [ebp - 0x4ae]
push ecx
call fcn.00412510
add esp, 0xc
push 0x104
lea edx, [ebp - 0x4b0]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40c0ed
xor eax, eax
mov word [ebp - reloc.winhttp.dll_WinHttpSetTimeouts], ax
push 0x206
push ebx
lea ecx, [ebp - 0x2a6]
push ecx
call fcn.00412510
add esp, 0xc
lea edx, [ebp - 0x2a8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40c0ed
lea eax, [ebp - 0x2a8]
push eax
push ebx
push ebx
mov ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x40c0ed
call fcn.004079c0
test eax, eax
je 0x40c0ed
mov byte [ebp - 0xa0], bl
push 0x80
push ebx
lea edx, [ebp - 0x9f]
push edx
call fcn.00412510
add esp, 0xc
mov dword [ebp - 0x84b4], 0x81
lea edx, [ebp - 0x84b4]
lea eax, [ebp - 0xa0]
call fcn.0040a290
test eax, eax
je 0x40c0ed
lea ecx, [ebp - 0x2a8]
lea edx, [ebp - 0x4b0]
call fcn.0040ba60
test eax, eax
je 0x40c0ed
xor eax, eax
mov word [ebp - reloc.winhttp.dll_WinHttpSetTimeouts], ax
push 0x7ffe
push ebx
lea ecx, [ebp - 0x84ae]
push ecx
call fcn.00412510
lea edx, [ebp - 0xa0]
push edx
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x2a8]
push ecx
push str.__s____help_s_t_S
push 0x4000
lea edx, [ebp - 0x84b0]
push edx
call fcn.00411448
mov dword [ebp - 0x8508], ebx
push reloc.winhttp.dll_WinHttpCrackUrl
push ebx
lea eax, [ebp - 0x8504]
push eax
call fcn.00412510
add esp, 0x30
mov dword [ebp - 0x8508], 0x44
xor ecx, ecx
mov word [ebp - reloc.winhttp.dll_WinHttpSetTimeouts], cx
mov dword [ebp - 0x84dc], 1
mov dword [ebp - 0x84c4], ebx
xor eax, eax
mov dword [ebp - 0x84c0], eax
mov dword [ebp - 0x84bc], eax
mov dword [ebp - 0x84b8], eax
lea edx, [ebp - 0x84c4]
push edx
lea eax, [ebp - 0x8508]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x84b0]
push ecx
lea edx, [ebp - 0x2a8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x40c0ed
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.0040bae0
add esp, 4
jmp 0x40c0ed
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004106c7
mov esp, ebp
pop ebp
ret 0x10
Function at 0x7f4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007f41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7f407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7f406a
add dl, dl
jne 0x7f4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7f40dc
xor eax, eax
add dl, dl
jne 0x7f4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7f417d
add dl, dl
jne 0x7f40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7f40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7f40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7f40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7f40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7f4075
mov eax, 1
add dl, dl
jne 0x7f40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7f40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7f40e1
sub eax, ebx
mov ebx, 1
jne 0x7f4128
mov ecx, 1
add dl, dl
jne 0x7f410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7f4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7f4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7f4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7f413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7f414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7f4136
cmp eax, 0x7d00
jae 0x7f416d
cmp eax, 0x500
jb 0x7f4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7f4075
cmp eax, 0x7f
ja 0x7f4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7f4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7f419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7f4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x402830
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x402d90
call fcn.00402b68
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x403448
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x402665
cmp eax, esi
jne 0x402658
xor esi, esi
inc esi
mov edi, esi
jmp 0x402668
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40263c
xor esi, esi
inc esi
cmp dword [0x40344c], esi
jne 0x40267a
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x4026b4
cmp dword [0x40344c], ebx
jne 0x4026ae
mov dword [0x40344c], esi
push 0x4010dc
push 0x4010d0
call fcn.004027e4
pop ecx
pop ecx
test eax, eax
je 0x4026b4
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4027de
mov dword [0x40301c], esi
cmp dword [0x40344c], esi
jne 0x4026d7
push 0x4010cc
push 0x4010c0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x40344c], 2
test edi, edi
jne 0x4026e4
xor eax, eax
mov ecx, 0x403448
xchg dword [ecx], eax
cmp dword [0x403450], 0
je 0x402710
push 0x403450
call fcn.004029c0
pop ecx
test eax, eax
je 0x402710
push ebx
push 2
push ebx
mov esi, dword [0x403450]
mov ecx, esi
call dword [0x40414c]
call esi
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov ecx, dword [eax]
test ecx, ecx
je 0x40269d
mov dword [ebp - 0x24], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x20]
movzx eax, word [ecx]
cmp ax, si
ja 0x40277b
test ax, ax
je 0x40274a
test edx, edx
jne 0x40277b
test ax, ax
je 0x40274a
cmp ax, si
ja 0x40274a
add ecx, 2
mov dword [ebp - 0x24], ecx
movzx eax, word [ecx]
jmp 0x402735
test byte [ebp - 0x40], 1
je 0x402756
movzx eax, word [ebp - 0x3c]
jmp 0x402759
push 0xa
pop eax
push eax
push ecx
push ebx
push 0x400000
call main
mov dword [0x403018], eax
cmp dword [0x403030], 0
jne 0x4027c3
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp eax, 0x22
jne 0x40278c
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x20], edx
add ecx, 2
mov dword [ebp - 0x24], ecx
jmp 0x402724
cmp dword [0x40301c], 0
jne 0x4027d7
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x403018]
mov dword [ebp - 4], 0xfffffffe
call fcn.00402bb0
ret
call fcn.00402ab3
jmp 0x402613

Function at 0x4028b4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x402db0
call fcn.00402d2c
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x402914
cmp eax, 0xffffffff
je 0x402914
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40290d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40290d
cmp edx, 0x10000000
jae 0x40290d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40290a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.00402d71
ret 4
Function at 0x402970
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4029ae
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4029a6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4029b0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x402996
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x402a80
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x402a96
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x402ab1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x43b651
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov esi, 0x43b3c1
mov ebx, 0xfdbc01f5
call fcn.0043b694
mov ebx, 0xa4b8b059
mov ebx, eax
xor dword [ecx], esi
and ebx, eax
inc ecx
add eax, 0x52c0da28
sub esp, 4
mov dword [esp], 0x7e787463
pop eax
dec eax
cmp ecx, edi
jne fcn.0043b651
dec eax
push 0xfb001d67
pop ebx
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
jmp 0x403a1c
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405220], eax
mov dword [0x4051a8], 0x403098
mov dword [0x4051a4], 2
jmp 0x403a4c
mov dword [0x4051ac], 0
mov dword [0x4051b0], 0
mov dword [0x4051a0], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051b4], eax
mov dword [0x4051c8], 0x40426e
mov dword [0x4051c0], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051b8], eax
mov dword [0x4051cc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051bc], eax
push 0x4051a0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.justam
push 0x40426e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405218], eax
push 5
push dword [0x405218]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405218]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x403b1f
push 0
push 0
push 0
push 0x4051d0
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x403b4c
push 0x4051d0
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x4051d0
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x403b1f
mov eax, dword [0x4051d8]
jmp 0x403b59
call 0x402be1
ret

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x4030ac
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
sub esp, 0x120
lea ebp, [esp - 4]
mov eax, dword [0x41e250]
xor eax, ebp
mov dword [ebp + 0x120], eax
push 0x20
mov eax, 0x4188e5
call fcn.0040bc26
mov edi, dword [ebp + 0x12c]
mov esi, 0x104
xor ebx, ebx
push esi
lea eax, [ebp + 0x1c]
push ebx
push eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], esi
call fcn.0040b320
add esp, 0xc
push ebx
lea ecx, [ebp]
mov byte [ebp - 0xd], 1
mov dword [ebp + 0x18], 0xf
call fcn.00402920
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x1c]
push eax
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 4], ebx
jmp 0x40318a
cmp byte [ebp - 0xd], bl
je 0x403144
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.00402e58
mov byte [ebp - 0xd], bl
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
jne 0x40316f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.00402e58
inc dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x1c]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
push dword [ebp - 0x24]
call edi
test eax, eax
je 0x403124
mov eax, dword [ebp - 0x14]
cmp dword [0x41f5ec], eax
jne 0x4031b1
cmp dword [ebp + 0x18], 0x10
mov eax, dword [ebp + 4]
jae 0x4031a7
lea eax, [ebp + 4]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ebx
push 1
lea ecx, [ebp]
call fcn.004029cc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x120]
xor ecx, ebp
call fcn.0040b39a
add ebp, 0x124
leave
ret 4

Function at 0x40488b
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x40490e
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, ecx
jne 0x404924
push 0x80004005
call fcn.00404096
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x404927
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x405739
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x41e250]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0xa0]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
call fcn.00404303
mov edi, eax
cmp edi, esi
je 0x4057a1
lea ecx, [ebp - 0x70]
call fcn.0040429e
mov eax, edi
mov ecx, dword [ebp + 0x94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b39a
add ebp, 0x98
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x4057b9
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.00405739
cmp eax, esi
jne 0x4057ec
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call edi
test eax, eax
je 0x4057a9
lea ecx, [ebp - 0x70]
call fcn.0040429e
push dword [ebp - 0x78]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.0040429e
mov eax, esi
jmp 0x405787
Function at 0x40785a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
sub esp, 0x404
lea ebp, [esp - 4]
mov eax, dword [0x41e250]
xor eax, ebp
mov dword [ebp + 0x404], eax
push 0x20
mov eax, 0x418bdf
call fcn.0040bc59
mov edi, ecx
mov eax, dword [ebp + 0x414]
mov esi, dword [ebp + 0x410]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
call dword [0x41e178]
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp], ebx
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x407914
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
call fcn.00403f51
add esp, 0xc
test eax, eax
jl 0x407914
mov edi, dword [ebp - 0x24]
cmp edi, 0x400
jg 0x4078fc
push edi
call fcn.0040562a
test al, al
pop ecx
je 0x4078fc
mov eax, edi
call fcn.0040c580
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x407905
push edi
lea ecx, [ebp - 0x20]
call fcn.00405f9e
push dword [ebp - 0x1c]
push edi
push esi
push eax
call fcn.00404032
cmp eax, ebx
jne 0x407959
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x407924
lea ecx, [ebp]
call fcn.00405594
lea ecx, [ebp - 0x20]
call fcn.004054ce
mov eax, 0x8007000e
lea esp, [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0040b39a
add ebp, 0x408
leave
ret 0x10
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x1c], edi
jne 0x407978
call fcn.004041ba
mov esi, eax
jmp 0x407a3b
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x407995
call fcn.004041ba
jmp 0x407a30
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x40798b
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x18], esi
jae 0x4079dc
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x4079c8
lea ecx, [ebp]
call fcn.00405594
mov esi, 0x8007000e
lea ecx, [ebp - 0x20]
call fcn.004054ce
mov eax, esi
jmp 0x407931
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.00406b58
mov dword [ebp - 4], 1
jmp 0x4079fd
cmp dword [ebp], ebx
jne 0x407a09
mov esi, 0x8007000e
jmp 0x407a32
push esi
push dword [ebp - 0x14]
push esi
push dword [ebp]
call fcn.004040e3
mov eax, dword [ebp]
add esp, 0x10
push dword [ebp + 0x41c]
mov byte [eax + esi], bl
push dword [ebp]
lea ecx, [ebp - 0x2c]
call fcn.004076eb
mov esi, eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x4079cd
lea ecx, [ebp]
call fcn.00405594
jmp 0x4079cd
Function at 0x4083d5
Capabilities:
Check os version

Disassembly:
push 0xa0
mov eax, 0x418ce5
call fcn.0040bc8f
mov ebx, dword [ebp + 8]
and dword [ebp - 0xa8], 0
mov dword [ebp - 0xac], ebx
xor edi, edi
lea eax, [ebp + 0xc]
inc edi
push eax
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.00402deb
push 0x94
lea eax, [ebp - 0xa4]
push 0
push eax
mov dword [ebp - 0xa8], edi
call fcn.0040b320
add esp, 0xc
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 2
jne 0x408465
cmp dword [ebp - 0xa0], 5
jne 0x408465
push str.Global_
mov ecx, ebx
call fcn.00402e58
push 0xffffffffffffffff
push 0
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call fcn.00402b9f
push 0
push edi
lea ecx, [ebp + 0xc]
call fcn.004029cc
mov eax, ebx
call fcn.0040bcd9
ret

Function at 0x408684
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x41f624], ebx
mov byte [ebp - 1], 1
jne 0x4086c1
push 0x41f624
push ebx
push ebx
push 0x408478
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
jne 0x4086ba
mov dword [0x41f624], ebx
mov byte [ebp - 1], bl
jmp 0x4086c1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
pop ebx
leave
ret
Function at 0x4093c7
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x41e250]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0040935c
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0040b320
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x409416
cmp dword [ebp - 0x1c], 5
jb 0x40942e
jmp 0x40942a
cmp dword [ebp - 0x10], 1
jne 0x40942e
cmp dword [ebp - 0x1c], 4
ja 0x40942a
jne 0x40942e
cmp dword [ebp - 0x18], 0
jbe 0x40942e
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x419b80
call fcn.0040416f
test eax, eax
jge 0x40944f
mov byte [0x41f684], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040b39a
add ebp, 0x78
leave
ret

Function at 0x40b39a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41e250]
jne 0x40b3a4
repz ret
jmp fcn.0040d34b