joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10039232
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1003927c
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10039223
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10039232
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1043eed5
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10039283
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.100200f9
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10039322
add edi, 4
add eax, 2
dec ecx
jne 0x10039268
call 0x100392cf
loope 0x100392c5
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1003931f
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10039330
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x100392e3
cmp eax, ecx
ja 0x100392e3
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1003936d
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10039363
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.100205d8
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x403c07
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0040ffa0
mov eax, dword [0x2818bc4]
mov ecx, dword [0x2818650]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x403cdc
push ebx
push edi
mov ebx, ecx
mov edi, eax
cmp dword [0x2818bc4], 0x959
jne 0x403ccb
push esi
lea eax, [ebp - 0x800]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x403760
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0x403788
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0x4037b4
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
lea eax, [ebp - 0x400]
push eax
push esi
push 0x4037d0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call fcn.00403ac7
add ebx, 8
dec edi
jne 0x403c33
pop edi
pop ebx
pop esi
leave
ret
Function at 0x403f69
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
push ebx
push esi
xor esi, esi
cmp dword [0x2818bc4], 0x400
push edi
jne 0x40403c
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0x4039bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
push esi
push esi
call fcn.00404c70
push esi
push esi
call fcn.00404679
push esi
call fcn.00404bf5
add esp, 0x14
push esi
call fcn.00404ed9
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.004042f0
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404330
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004047c0
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404460
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404940
fstp st(0)
push esi
call fcn.00404f4d
add esp, 0xc
push esi
push esi
call fcn.0040457d
push esi
call fcn.00404d1d
add esp, 0xc
mov ebx, dword [sym.imp.GDI32.dll_GetCharWidthI]
xor edi, edi
cmp edi, 0xacc
jge 0x404071
push esi
push esi
call dword [sym.imp.USER32.dll_SetCaretPos]
push esi
lea eax, [esp + 0x10]
push eax
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharABCWidthsI]
push esi
push esi
push esi
push esi
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x45be411
jg 0x404093
inc edi
cmp edi, 0x3330601
jl 0x404044
xor edi, edi
cmp edi, 0x16d2a
jge 0x4040a4
push esi
push esi
push esi
push esi
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x12e82fe
jg 0x4040c2
inc edi
cmp edi, 0x3011b
jl 0x404095
mov eax, dword [0x42ac54]
mov dword [0x2818bc4], eax
call fcn.00403cdf
mov edi, 0x2ec37
cmp dword [0x2818bc4], 0x51f
jne 0x4040ee
push esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec edi
jne 0x4040d6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40710b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4277c4]
jne 0x407115
repz ret
jmp fcn.0040ba2c
Function at 0x40f0b1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4277c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405b19
and dword [ebp - 0x14], 0
cmp dword [0x435bb4], 0
mov dword [ebp - 0x18], eax
jne 0x40f164
push 0x4036d4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40f20c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4036c8
push ebx
call edi
test eax, eax
je 0x40f20c
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4036b8
push ebx
mov dword [0x435bb4], eax
call edi
push eax
call esi
push 0x4036a4
push ebx
mov dword [0x435bb8], eax
call edi
push eax
call esi
push 0x403688
push ebx
mov dword [0x435bbc], eax
call edi
push eax
call esi
mov dword [0x435bc4], eax
test eax, eax
je 0x40f164
push 0x403670
push ebx
call edi
push eax
call esi
mov dword [0x435bc0], eax
mov eax, dword [0x435bc0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40f1bd
cmp dword [0x435bc4], ecx
je 0x40f1bd
push eax
call esi
push dword [0x435bc4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40f1bd
test ebx, ebx
je 0x40f1bd
call edi
test eax, eax
je 0x40f1b4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40f1b4
test byte [ebp - 8], 1
jne 0x40f1bd
or dword [ebp + 0x10], 0x200000
jmp 0x40f1f0
mov eax, dword [0x435bb8]
cmp eax, dword [ebp - 0x18]
je 0x40f1f0
push eax
call esi
test eax, eax
je 0x40f1f0
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40f1f0
mov eax, dword [0x435bbc]
cmp eax, dword [ebp - 0x18]
je 0x40f1f0
push eax
call esi
test eax, eax
je 0x40f1f0
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x435bb4]
call esi
test eax, eax
je 0x40f20c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40f20e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040710b
leave
ret
Function at 0x41ef30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x41ef71
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x41ef73
mov esi, edi
test esi, esi
je 0x41efe8
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
push 0
push ecx
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x41efdd
mov ecx, dword [esp + 0x20]
mov eax, 4
cmp ecx, eax
jne 0x41efdd
cmp dword [esp + 0x1c], eax
jbe 0x41efae
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x41efdd
cmp esi, edi
je 0x41efcf
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp esi, edi
je 0x41efe8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x41f300
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x485ddf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x49a204]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x41f36b
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x41f36d
mov esi, edi
test esi, esi
je 0x41f437
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41f42c
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x41f3af
cmp eax, 2
je 0x41f3af
cmp eax, 6
je 0x41f3af
cmp eax, 7
jne 0x41f42c
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.0046bb2f
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebp
jne 0x41f412
lea ecx, [esp + 0x14]
call fcn.0046bf7d
cmp esi, dword [esp + 0x14]
je 0x41f407
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.0046bb58
add esp, 4
jmp 0x41f449
call fcn.0046bb58
add esp, 4
lea ecx, [esp + 0x10]
push 0x488d48
call fcn.0046bf7d
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x41f437
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x41f449
push eax
lea ecx, [esp + 0x14]
call fcn.0046bf7d
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0046bb69
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.0046bdf4
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x41f590
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
je 0x41f5c7
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
or edx, 0x20019
push ecx
push edx
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x41f5ca
mov esi, dword [ebp + 8]
test esi, esi
je 0x41f77b
call fcn.00435830
test eax, eax
je 0x41f6b4
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x41f5eb
mov dword [ebp + 0x10], eax
jmp 0x41f61e
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.0040e590
mov ecx, dword [ebp + 0x10]
mov ebx, esp
push edi
push ebx
push 0xffffffffffffffff
push ecx
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp + 0x10], ebx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 0x14]
push 0
push eax
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f76f
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x41f658
cmp eax, 2
je 0x41f658
cmp eax, 6
je 0x41f658
cmp eax, 7
jne 0x41f76f
mov edx, dword [ebp + 0xc]
add edx, 2
push edx
call fcn.0046bb2f
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov edi, ebx
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebx
jne 0x41f75a
mov ecx, dword [ebp + 0x18]
call fcn.00442b50
cmp esi, dword [ebp + 8]
je 0x41f744
jmp 0x41f73d
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 0x14]
push 0
push eax
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41f76f
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x41f6ee
cmp eax, 2
je 0x41f6ee
cmp eax, 6
je 0x41f6ee
cmp eax, 7
jne 0x41f76f
mov edx, dword [ebp + 0xc]
add edx, 2
push edx
call fcn.0046bb2f
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov edi, ebx
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebx
jne 0x41f75a
mov ecx, dword [ebp + 0x18]
call fcn.00442c20
cmp esi, dword [ebp + 8]
je 0x41f744
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.0046bb58
add esp, 4
mov eax, 1
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.0046bb58
mov ecx, dword [ebp + 0x18]
add esp, 4
push 0x488d48
call fcn.00442c20
cmp esi, dword [ebp + 8]
je 0x41f77b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4201c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x485ea8
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x420216
lea ecx, [ebp + 0x14]
lea edx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 8]
or ecx, 0x20006
push 0
push ecx
push 0
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x420219
mov esi, dword [ebp + 8]
test esi, esi
je 0x4202ff
call fcn.00435830
test eax, eax
je 0x42029a
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x420235
xor ebx, ebx
jmp 0x420265
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.0040e590
mov eax, dword [ebp + 0x10]
mov ebx, esp
push edi
push ebx
push 0xffffffffffffffff
push eax
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, dword [ebp + 0x18]
push edi
call fcn.0040e2ae
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
push edi
push 1
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4202f3
cmp esi, dword [ebp + 8]
je 0x420293
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x420301
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0x18]
push edx
call fcn.0043c6f0
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
mov eax, dword [ebp + 0x10]
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4202e4
cmp esi, dword [ebp + 8]
je 0x4202ce
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.0043cf00
mov eax, 1
jmp 0x420301
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.0043cf00
cmp esi, dword [ebp + 8]
je 0x4202ff
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4210a0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 8
lea eax, [esp + 0xc]
lea ecx, [esp]
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x421218
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4211f7
mov eax, dword [esp + 0x1c]
cmp eax, 0x104
jae 0x4210f6
mov eax, 0x104
mov dword [esp + 0x1c], eax
inc eax
push eax
call fcn.0046bb2f
mov esi, eax
add esp, 4
test esi, esi
je 0x421218
mov edx, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
lea ecx, [edx + 1]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x42120f
mov ebp, dword [esp + 0x20]
mov eax, ebp
or eax, 0x2001f
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
push ecx
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42120f
mov edi, dword [esp + 0x20]
test edi, edi
je 0x42120f
push ebp
push edi
call fcn.004210a0
add esp, 8
test eax, eax
je 0x421204
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4a3148]
test eax, eax
je 0x4211a1
test ebp, ebp
je 0x4211a1
push 0
push ebp
push esi
push ebx
call eax
test eax, eax
jne 0x42120f
jmp 0x4211ad
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x42120f
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
je 0x4211ee
mov edx, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
lea ecx, [edx + 1]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x42120f
mov eax, dword [esp + 0x14]
jmp 0x42114a
push esi
call fcn.0046bb58
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
test edi, edi
je 0x42120f
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0046bb58
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x4228a0
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e250
push 0x4139b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x4a32cc]
xor ebx, ebx
cmp eax, ebx
jne 0x422a00
mov byte [ebp - 0x11c], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4229fb
mov byte [ebp - 0x224], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x223]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.user32.dll
lea ecx, [ebp - 0x11c]
push ecx
push 0x49f4f8
lea edx, [ebp - 0x224]
push edx
call fcn.0041218b
add esp, 0x10
mov dword [ebp - 0x22c], ebx
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x120], eax
push eax
call fcn.0046bb2f
add esp, 4
mov esi, eax
mov dword [ebp - 0x238], esi
cmp esi, ebx
je 0x4229fb
push esi
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4229f2
mov dword [ebp - 0x230], ebx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x230]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4229f2
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x234], eax
mov ecx, dword [eax]
mov dword [0x4a32cc], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x4229f2
push esi
call fcn.0046bb58
add esp, 4
mov eax, dword [0x4a32cc]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d6e0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
test ebx, ebx
jne 0x42d6fc
xor eax, eax
pop ebx
add esp, 0x208
ret
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
push 0x207
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.0040e1b0
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call fcn.00412e60
mov esi, eax
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jbe 0x42d780
cmp byte [esp + 0x10], 0x5c
jne 0x42d780
cmp byte [esp + 0x11], 0x5c
jne 0x42d780
lea edx, [esp + 0x12]
push 0x5c
push edx
call fcn.00412e60
add esp, 8
test eax, eax
je 0x42d7fe
inc eax
push 0x5c
push eax
call fcn.00412e60
add esp, 8
mov esi, eax
test esi, esi
je 0x42d7fe
lea eax, [esp + 0x10]
mov byte [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x42d7c2
test bl, 1
je 0x42d7b1
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 0xfffffffe
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x42d834
cmp ebx, 0xffffffff
je 0x42d7cb
test edi, edi
jne 0x42d7da
lea ecx, [esp + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x42d834
mov byte [esi], 0x5c
inc esi
push 0x5c
push esi
call fcn.00412e60
mov esi, eax
add esp, 8
test esi, esi
jne 0x42d784
test ebp, ebp
je 0x42d834
mov ebx, dword [esp + 0x21c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42d829
test al, 0x10
jne 0x42d834
test al, 1
je 0x42d81c
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x42d834
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x208
ret