joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4148e0
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x414a33
cmp word [esi], 0
je 0x414a33
push ebx
push edi
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 5
push 0
push 0
push esi
push str.open
push 0
mov ebx, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
cmp edi, 0x20
jg 0x414934
push 5
push 0
push 0
push esi
push str.edit
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
test ebx, ebx
je 0x41493d
cmp ebx, 1
jne 0x414943
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, 0x20
jle 0x414953
pop edi
pop ebx
mov eax, 1
pop esi
ret 4
cmp edi, 0x1a
ja case.0x414963.1
movzx eax, byte [edi + 0x414a50]
jmp dword [eax*4 + 0x414a3c]
movzx eax, word [0x43ad06]
sub eax, 7
je 0x4149ba
sub eax, 2
je 0x41499d
sub eax, 1
jne 0x41499d
mov esi, dword [str.El_sistema_no_puede_asignar_suficiente_memoria]
mov eax, 0xa8010f00
push esi
push eax
call fcn.00413190
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
ret 4
mov esi, dword [str.The_system_cannot_allocate_enough_memory]
mov eax, 0xa8010f00
push esi
push eax
call fcn.00413190
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
ret 4
mov esi, dword [str.Der_Speicher_reicht_nicht]
mov eax, 0xa8010f00
push esi
push eax
call fcn.00413190
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
ret 4
mov eax, 0xa0010007
push esi
push eax
call fcn.00413190
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
ret 4
mov eax, 0xa0010002
push esi
push eax
call fcn.00413190
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
ret 4
mov eax, 0xa001000b
push esi
push eax
call fcn.00413190
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
ret 4
mov eax, 0xe0010029
push esi
push eax
call fcn.00413190
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
ret 4
xor eax, eax
pop esi
ret 4
Function at 0x414fe0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
push 0
mov dword [ebp - 4], esi
call ebx
push 0
push 0
push 0xe
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
test esi, esi
jne 0x41501e
push 0x20010024
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc esi
lea eax, [esi + esi]
cmp eax, 1
jb 0x415071
push eax
call fcn.0041d6de
mov edi, eax
add esp, 4
test edi, edi
jne 0x41507b
movzx eax, word [0x43ad06]
sub eax, 7
je 0x41505a
sub eax, 2
je 0x415053
sub eax, 1
jne 0x415053
mov eax, dword [str.El_sistema_no_puede_asignar_suficiente_memoria]
jmp 0x41505f
mov eax, dword [str.The_system_cannot_allocate_enough_memory]
jmp 0x41505f
mov eax, dword [str.Der_Speicher_reicht_nicht]
push eax
push 0xa8010f00
call fcn.00413190
add esp, 8
push 0xe
call ebx
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push esi
push 0xd
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
test esi, esi
jg 0x4150a3
or esi, 0xffffffff
push edi
call fcn.0041d6c3
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
je 0x4150b5
push eax
call fcn.0041d6c3
add esp, 4
mov dword [ebx], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415e40
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push edi
mov edi, ecx
test edi, edi
je 0x415f55
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x415e51
sub esi, ecx
sar esi, 1
je 0x415f55
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ebx, [esi*2 + 2]
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x415ee6
movzx eax, word [0x43ad06]
sub eax, 7
je 0x415ecd
sub eax, 2
je 0x415eb4
sub eax, 1
jne 0x415eb4
mov eax, dword [str.El_sistema_no_puede_asignar_suficiente_memoria]
push eax
push 0xa8010f00
call fcn.00413190
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
ret
mov eax, dword [str.The_system_cannot_allocate_enough_memory]
push eax
push 0xa8010f00
call fcn.00413190
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
ret
mov eax, dword [str.Der_Speicher_reicht_nicht]
push eax
push 0xa8010f00
call fcn.00413190
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x415f3b
push ebx
push edi
push eax
call fcn.0041cd00
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x415f3b
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x415f35
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x415f35
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop edi
mov eax, 1
pop esi
ret
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0xe0010022
call fcn.00413190
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop edi
xor eax, eax
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x4167e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x43ad34]
mov ecx, 0x43ad00
test eax, eax
je 0x4167fb
mov ecx, eax
mov eax, dword [ecx + 0x34]
test eax, eax
jne 0x4167f2
push esi
mov esi, dword [ecx + 8]
push edi
push 0x210
call fcn.0041d6de
mov edi, eax
add esp, 4
test edi, edi
jne 0x41685a
movzx eax, word [0x43ad06]
sub eax, 7
je 0x416837
sub eax, 2
je 0x416830
sub eax, 1
jne 0x416830
mov eax, dword [str.El_sistema_no_puede_asignar_suficiente_memoria]
jmp 0x41683c
mov eax, dword [str.The_system_cannot_allocate_enough_memory]
jmp 0x41683c
mov eax, dword [str.Der_Speicher_reicht_nicht]
push eax
push 0xa8010f00
call fcn.00413190
add esp, 8
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
push ebx
push eax
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x416922
mov edx, esi
mov ecx, edi
call fcn.004117c0
test eax, eax
je 0x41692f
test esi, esi
jne 0x4168b7
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416895
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x4168b1
cmp word [edi + ecx*2 - 2], 0x5c
jne 0x4168b1
dec ecx
xor eax, eax
mov word [edi + ecx*2], ax
mov esi, edi
mov ebx, edi
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4168c0
sub esi, ecx
sar esi, 1
test esi, esi
jle 0x4168d6
lea ebx, [edi + esi*2]
mov eax, 0x104
sub eax, esi
cmp eax, 8
jle 0x41690e
test ebx, ebx
je 0x41690e
push 0x10
push str._LOG.txt
push ebx
call fcn.0041c640
xor eax, eax
add esp, 0xc
mov word [ebx + 0x10], ax
mov eax, 8
add eax, esi
je 0x416934
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x2001001f
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xe0010018
call fcn.00413190
add esp, 4
xor eax, eax
mov word [edi], ax
push edi
call fcn.0041d6c3
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x417870
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x43a004]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], 0
mov dword [0x43bdcc], eax
push edi
mov edi, edx
test esi, esi
jne 0x4178b5
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004194d8
mov esp, ebp
pop ebp
ret 4
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, dword [0x43bdc8]
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
movlpd qword [esp + 0x28], xmm0
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], 0x50
push dword [eax]
call dword [sym.imp.USER32.dll_GetLastActivePopup]
cmp word [esi], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edi
je 0x417907
mov dword [esp + 0x28], 0x4175a0
mov dword [esp + 0x2c], esi
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
cmp dword [0x43bd20], 0
mov ebx, eax
je 0x41792d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 0x43acbc
cmp dword [0x43bd20], eax
je 0x417932
mov ecx, 0x43ac6c
mov eax, dword [ecx]
mov dword [esp + 0x10], eax
or eax, 0x40000
mov dword [ecx], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
cmp dword [0x43bd20], 0
mov edi, eax
je 0x417968
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x43bd20], eax
mov eax, 0x43acbc
je 0x41796d
mov eax, 0x43ac6c
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
test edi, edi
je 0x41799e
push esi
xor eax, eax
push edi
mov word [esi], ax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x417997
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [esp + 0xc], 1
push edi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp ebx, 1
je 0x4179a7
test ebx, ebx
jne 0x4179ad
call dword [sym.imp.ole32.dll_OleUninitialize]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004194d8
mov esp, ebp
pop ebp
ret 4
Function at 0x418120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, edx
push esi
push edi
mov dword [ebp - 8], eax
mov esi, ecx
cmp dword [eax + 4], 0
mov edi, 0x20010c00
jne 0x418142
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
movzx eax, word [eax]
push ebx
push 0xa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4181e0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4181e0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x4181e0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
test ecx, ecx
je 0x4181e0
mov ebx, dword [ebp - 8]
xor eax, eax
mov edi, dword [ebx + 4]
lea edx, [eax + 1]
cmp edi, edx
jbe 0x4181cd
cmp word [ecx + eax*2], 0
je 0x4181ac
nop dword [eax]
inc eax
cmp eax, esi
jae 0x4181c2
cmp word [ecx + eax*2], 0
jne 0x4181a0
inc eax
cmp eax, esi
jae 0x4181c2
inc edx
cmp edx, edi
jb 0x418195
mov dword [ebx + 8], ecx
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp edi, 0xffffffff
jne 0x4181d9
lea eax, [edx - 1]
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, 0x20010d00
jmp 0x4181ed
push 0x60010021
call fcn.00413190
add esp, 4
movzx eax, word [0x43ad06]
sub eax, 7
je 0x418211
sub eax, 2
je 0x41820a
sub eax, 1
jne 0x41820a
mov eax, dword [str.El_programa_no_puede_cargar_recursos_del_idioma]
jmp 0x418216
mov eax, dword [str.Program_cant_load_language_resources]
jmp 0x418216
mov eax, dword [str.Programm_kann_Sprach_Ressourcen_nicht_laden]
mov ecx, edi
push eax
or ecx, 0x88000000
push ecx
call fcn.00413190
add esp, 8
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401960
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x474bf8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x499694]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00401e80
push eax
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x70], 0
call fcn.00401ee0
add esp, 0x10
push 0x494060
lea eax, [esp + 0x30]
push eax
call fcn.0041134b
int3
Function at 0x405c40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474778
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x499694]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x405c81
xor eax, eax
jmp 0x405e1a
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
xor eax, eax
cmp edx, eax
je 0x405caf
mov ecx, dword [esi + 0x34]
mov ebx, dword [ecx]
lea ebx, [edx + ebx*2]
cmp edx, ebx
jae 0x405caf
dec dword [ecx]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x405e1a
cmp dword [esi + 0x54], eax
je 0x405e15
mov edx, dword [esi + 0x10]
lea ebx, [esi + 0x48]
cmp dword [edx], ebx
jne 0x405cd8
mov ecx, dword [esi + 0x40]
mov ebx, dword [esi + 0x3c]
mov dword [edx], ebx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov edx, dword [esi + 0x30]
sub ecx, ecx
sar ecx, 1
mov dword [edx], ecx
cmp dword [esi + 0x44], eax
jne 0x405d02
mov esi, dword [esi + 0x54]
push esi
push edi
call fcn.0040f6f3
mov ecx, 0xffff
add esp, 8
cmp ax, cx
movzx eax, di
jne 0x405e1a
mov eax, ecx
jmp 0x405e1a
movzx edx, di
mov ecx, 0xf
mov dword [ebp - 0x30], edx
mov edx, eax
mov byte [ebp - 0x2c], al
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x405d2a
lea edx, [ebp - 0x2c]
mov byte [edx + 8], al
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x405d42
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x34]
push ebx
push edx
push eax
lea eax, [ebp - 0x38]
push eax
lea edx, [ebp - 0x2e]
push edx
mov edx, dword [edi + 0x14]
lea eax, [ebp - 0x30]
push eax
lea eax, [esi + 0x4c]
push eax
call edx
test eax, eax
js 0x405e0d
cmp eax, 1
jg 0x405dd5
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x405d82
lea ecx, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, ecx
je 0x405dab
cmp ebx, 0x10
jae 0x405d91
lea eax, [ebp - 0x2c]
mov ecx, dword [esi + 0x54]
push ecx
push edi
push 1
push eax
call fcn.00410b5e
add esp, 0x10
cmp edi, eax
jne 0x405e0d
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x30]
mov byte [esi + 0x4a], 1
cmp dword [ebp - 0x38], edx
jne 0x405dff
test edi, edi
jne 0x405d36
cmp dword [ebp - 0x1c], 0x20
lea ecx, [ebp - 0x2c]
jae 0x405e10
push edi
push 8
call fcn.004065e0
jmp 0x405d30
cmp eax, 3
jne 0x405e0d
mov eax, dword [esi + 0x54]
mov ecx, dword [ebp - 0x30]
call fcn.004053a0
movzx esi, word [ebp + 8]
test al, al
jne 0x405df2
mov esi, 0xffff
lea ecx, [ebp - 0x2c]
call fcn.00405420
mov ax, si
jmp 0x405e1a
lea ecx, [ebp - 0x2c]
call fcn.00405420
mov ax, word [ebp + 8]
jmp 0x405e1a
lea ecx, [ebp - 0x2c]
call fcn.00405420
mov eax, 0xffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ecc7
mov esp, ebp
pop ebp
ret 4
Function at 0x406820
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474af8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x499694]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
cmp dword [esi + 0x54], 0
jne 0x406917
mov eax, dword [ebp + 8]
push 0x40
push eax
push ecx
call fcn.0040dbfa
add esp, 0xc
test eax, eax
je 0x406917
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea edx, [esi + 0x18]
mov dword [esi + 0x20], edx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov byte [esi + 0x50], 1
mov byte [esi + 0x4a], 0
lea edx, [esi + 0x28]
mov dword [esi + 0x30], edx
lea ecx, [esi + 0xc]
mov dword [esi + 0x14], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [ecx], 0
mov ecx, dword [esi + 0x24]
mov dword [ecx], 0
mov edx, dword [esi + 0x34]
mov dword [edx], 0
mov ecx, dword [esi + 0x10]
mov dword [ecx], 0
mov edx, dword [esi + 0x20]
mov dword [edx], 0
mov ecx, dword [esi + 0x30]
mov edx, dword [0x49e260]
mov dword [ecx], 0
mov dword [esi + 0x54], eax
lea edi, [ebp + 8]
mov eax, esi
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], 0
call fcn.00407bb0
push eax
mov dword [ebp - 4], 0
call fcn.00409480
add esp, 4
mov edi, eax
call fcn.00406b10
lea ecx, [ebp + 8]
call fcn.00404740
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4069c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4748e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x499694]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x406aeb
cmp byte [edi + 0x4a], bl
je 0x406aeb
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffff
mov ecx, edi
call edx
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
je 0x406adf
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x406a3f
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x406a57
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
mov edx, dword [esi + 0x18]
push eax
lea eax, [edi + 0x4c]
push eax
call edx
sub eax, 0
je 0x406a80
dec eax
je 0x406a84
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x406ada
jmp 0x406ae6
mov byte [edi + 0x4a], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x406a94
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x406abd
cmp ebx, 0x10
jae 0x406aa3
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.00410b5e
add esp, 0x10
cmp esi, eax
jne 0x406ad7
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x4a], 0
je 0x406ae3
test esi, esi
jne 0x406a4b
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.004065e0
jmp 0x406a45
lea ecx, [ebp - 0x2c]
call fcn.00405420
xor al, al
jmp 0x406aed
lea ecx, [ebp - 0x2c]
call fcn.00405420
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ecc7
mov esp, ebp
pop ebp
ret
Function at 0x407ac0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47474b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x499694]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0040daeb
push 4
mov dword [ebp - 4], 0
call fcn.0040f44d
mov edi, eax
add esp, 4
test edi, edi
je 0x407b3c
call fcn.0040d9c3
mov dword [edi], eax
call fcn.0040d782
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0040daac
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x407b32
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0040dad4
jmp 0x407b3e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409df0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftwareEDataStore
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409e55
mov eax, 4
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.LanguageID
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x40a040
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, 0x49ee48
mov ebx, 0x35
mov eax, dword [esi + 0x44]
cmp eax, 2
jne 0x40a084
cmp dword [esi], 8
jb 0x40a074
mov eax, dword [esi - 0x14]
push eax
mov eax, dword [esi - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x40a0cf
lea eax, [esi - 0x14]
push eax
mov eax, dword [esi - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x40a0cf
cmp eax, 1
jne 0x40a0cf
cmp dword [esi], 8
mov dword [ebp - 4], 0
jb 0x40a09a
mov ecx, dword [esi - 0x14]
jmp 0x40a09d
lea ecx, [esi - 0x14]
mov eax, dword [esi - 0x18]
lea edx, [ebp - 4]
push edx
push ecx
push eax
call edi
test eax, eax
jne 0x40a0cf
cmp dword [esi + 0x1c], 8
jb 0x40a0b7
mov eax, dword [esi + 8]
jmp 0x40a0ba
lea eax, [esi + 8]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0x60
dec ebx
jne 0x40a057
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a1b0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x494450
push 0x4163d0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x499694]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x40], edi
test edi, edi
jne 0x40a20f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x3c]
jmp 0x40a245
cmp dword [esi + 0x14], 8
jb 0x40a219
mov eax, dword [esi]
jmp 0x40a21b
mov eax, esi
push 0x20
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x40a23f
lea eax, [ebp - 0x38]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40a245
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], 0xfffffffe
call fcn.0040a273
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0040ecc7
mov esp, ebp
pop ebp
ret