joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428f70
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x44d558]
mov dword [ebp - 8], eax
push edi
mov dword [ebp - 0x214], 0
mov dword [ebp - 4], 0
mov ax, word [0x44eb78]
mov word [ebp - 0x210], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.DumpFailedJobCreationSQL___n
call fcn.004329b0
add esp, 4
cmp dword [ebp + 8], 0
je 0x428fcc
cmp dword [ebp + 0xc], 0
jne 0x428fd1
jmp 0x429056
mov ecx, dword [ebp + 8]
push ecx
push 0x450878
push str._sTempCreateJob_s.SQL
lea edx, [ebp - 0x210]
push edx
mov eax, dword [0x450d4c]
call dword [eax + 0x4cc]
add esp, 0x10
push 0
push 0x100080
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SQLUNIRL.dll__CreateFile_28]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x429056
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCR71.dll_wcslen]
add esp, 4
shl eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
call fcn.00434de1
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x42ca90
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x44d558]
mov dword [ebp - 8], eax
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 0
mov ax, word [0x44ecd0]
mov word [ebp - 0x208], ax
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x10
push 0
lea ecx, [ebp - 0x218]
push ecx
call sub.MSVCR71.dll_memset
add esp, 0xc
push 1
push str.SQLServerAgentJobListJobIDMemory
push pe_nt_image_headers32
lea edx, [ebp - 0x208]
push edx
call fcn.004233a0
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
push 0
push 4
mov ecx, dword [0x450d4c]
call dword [ecx + 0x354]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42cb7d
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x42cb73
push 0x10
mov eax, dword [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x218]
push ecx
call sub.MSVCR71.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x21c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0042cbb0
add esp, 8
mov ecx, dword [0x450d0c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 8]
call fcn.00434de1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4317f0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x44d558]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x114], 0
mov ax, word [0x44edcc]
mov word [ebp - 0x108], ax
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x106]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x110], 0
cmp dword [0x44de90], 0
je 0x431985
mov ecx, dword [0x44dec0]
and ecx, 0x200
jne 0x431860
jmp 0x43199a
call fcn.0041fe00
test eax, eax
jne 0x43186e
jmp 0x43199a
push 0x44ca9c
push 0x44e2f8
push 0x81
push 0
push 4
call fcn.0041d760
add esp, 0x14
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str.W95SCM_s
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [0x450d4c]
call dword [edx + 0x4cc]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 8
push 0
push 4
mov ecx, dword [0x44ef48]
push ecx
push 0xffffffffffffffff
mov edx, dword [0x450d4c]
call dword [edx + 0x9c]
mov dword [ebp - 0x110], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xb7
jne 0x4318ef
jmp 0x43199a
cmp dword [ebp - 0x110], 0
je 0x431983
push 0
push 0
push 0
push 2
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x44edc4], eax
cmp dword [0x44edc4], 0
jne 0x431921
jmp 0x43199a
push 0
push 0
push 0
push 2
call fcn.00431dd0
add esp, 0x10
push 0
push 0
push 0x431a00
call dword [sym.imp.MSVCR71.dll__beginthread]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x43194a
jmp 0x43199a
call fcn.004204a0
test eax, eax
jne 0x431955
jmp 0x43199a
call fcn.00421380
test eax, eax
jne 0x431960
jmp 0x43199a
push 0xffffffffffffffff
mov ecx, dword [0x450d00]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xf
call fcn.00411190
add esp, 4
mov dword [ebp - 0x10c], 1
jmp 0x43199a
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x450d4c]
call dword [eax + 0x47c]
mov dword [ebp - 0x10c], eax
call fcn.00432030
cmp dword [0x44edc4], 0
je 0x4319cf
push 0
push 0
push 0
push 1
call fcn.00431dd0
add esp, 0x10
mov ecx, dword [0x44edc4]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [0x44edc4], 0
cmp dword [ebp - 0x110], 0
je 0x4319e5
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 4]
call fcn.00434de1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x433e00
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x433e1b
cmp dword [ebp + 0xc], 0
jne 0x433e1f
xor eax, eax
jmp 0x433e78
mov eax, dword [ebp + 8]
mov word [eax], 0
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x433e76
lea ecx, [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x433e76
mov eax, dword [ebp + 8]
jmp 0x433e78
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x435cc0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b8b8
push 0x434e46
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffdbc
mov eax, dword [0x44d558]
mov dword [ebp - 0x34], eax
push ebx
push esi
push edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jb 0x435d17
jmp 0x435e50
mov word [ebp - 0x248], 0
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x246]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x250], 0x105
push 0x43b7d0
call sub.MSVCR71.dll_wcslen
add esp, 4
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x250]
push eax
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
je 0x435dd6
mov edx, dword [ebp - 0x24c]
cmp edx, dword [ebp - 0x250]
jae 0x435dd6
lea eax, [ebp - 0x248]
push eax
call sub.MSVCR71.dll_wcslen
add esp, 4
mov ecx, dword [ebp - 0x254]
lea edx, [eax + ecx + 2]
cmp edx, dword [ebp - 0x250]
ja 0x435dd6
push 0x43b7ec
lea eax, [ebp - 0x248]
push eax
call sub.MSVCR71.dll_wcscat
add esp, 8
push 0x43b7f0
lea ecx, [ebp - 0x248]
push ecx
call sub.MSVCR71.dll_wcscat
add esp, 8
lea edx, [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x435dde
jmp 0x435e50
push 0x43b80c
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
push 0x43b820
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x30], 0
je 0x435e0e
cmp dword [ebp - 0x20], 0
jne 0x435e10
jmp 0x435e50
cmp dword [ebp + 8], 0
jne 0x435e26
lea edx, [ebp - 0x1c]
push edx
push 0x65
push 0
call dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
jmp 0x435e36
lea eax, [ebp - 0x1c]
push eax
push 0x65
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x435e3e
jmp 0x435e50
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x10]
and eax, 0x10
je 0x435e50
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], 0xffffffff
call fcn.00435e5e
jmp 0x435e98
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x34]
call fcn.00434de1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4011d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4011eb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401222
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40121e
jmp 0x401210
cmp esi, eax
jae 0x401222
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401210
cmp esi, eax
jb 0x401229
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x401a30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x58bd90]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x401a69
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045463b
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401a72
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 - 0x212], 0x5c
je 0x401aa9
push 0x54c734
lea ecx, [ebp - 0x210]
push 0x105
push ecx
call fcn.00454e6a
add esp, 0xc
test eax, eax
jne 0x401a59
push esi
lea edx, [ebp - 0x210]
push 0x105
push edx
call fcn.00454e6a
add esp, 0xc
test eax, eax
jne 0x401a59
lea eax, [ebp - 0x210]
push eax
call fcn.00402740
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 4
call fcn.0045463b
mov esp, ebp
pop ebp
ret
Function at 0x407630
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x58bd90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
mov dword [ecx], edx
movzx edx, byte [eax + 1]
shr edx, 7
mov dword [ecx + 4], edx
movzx edx, word [eax + 1]
push esi
mov esi, edx
shr edx, 8
and esi, 0xf
shl esi, 8
or esi, edx
mov dword [ecx + 8], esi
movzx edx, byte [eax + 5]
shr edx, 1
and edx, 0x1f
mov dword [ecx + 0xc], edx
movzx edx, byte [eax + 5]
and edx, 1
mov dword [ecx + 0x10], edx
movzx edx, byte [eax + 6]
mov dword [ecx + 0x14], edx
movzx edx, byte [eax + 7]
mov dword [ecx + 0x18], edx
movzx edx, word [eax + 3]
movzx esi, dl
shr edx, 8
shl esi, 8
or esi, edx
mov dword [ecx + 0x28], esi
movzx edx, word [eax + 8]
mov esi, edx
shr edx, 8
and esi, 0x1f
shl esi, 8
or esi, edx
push edi
mov dword [ecx + 0x2c], esi
movzx edx, word [eax + 0xa]
mov edi, edx
and edi, 0xf
shr edx, 8
shl edi, 8
or edi, edx
mov edx, dword [ecx + 8]
mov dword [ecx + 0x30], edi
lea edx, [edx + eax - 1]
lea edi, [edi + eax + 0xc]
mov dword [ebp - 0x80c], ecx
mov dword [ebp - 0x814], edx
mov dword [ebp - 0x808], 0
cmp edi, edx
jae 0x4077be
push ebx
movzx eax, word [edi + 3]
movzx edx, word [ebp - 0x808]
mov esi, eax
and esi, 0xf
shr eax, 8
shl esi, 8
or esi, eax
movzx eax, byte [edi]
lea edx, [edx + edx*2]
lea ecx, [ecx + edx*4]
push eax
mov dword [ebp - 0x810], ecx
mov dword [ecx + 0x38], eax
push str.stream_type___x_n
mov ecx, 0x400
lea ebx, [ebp - 0x804]
add esi, 5
call fcn.00407b90
add esp, 8
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
movzx ecx, word [edi + 1]
mov edx, dword [ebp - 0x80c]
mov eax, ecx
and eax, 0x1f
shr ecx, 8
shl eax, 8
or eax, ecx
movzx ecx, word [ebp - 0x808]
lea ecx, [ecx + ecx*2 + 0xf]
push eax
mov dword [edx + ecx*4], eax
push str.elementary_PID___x_n
mov ecx, 0x400
lea ebx, [ebp - 0x804]
call fcn.00407b90
add esp, 8
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
movzx eax, word [edi + 3]
mov edx, dword [ebp - 0x810]
inc dword [ebp - 0x808]
mov ecx, eax
and ecx, 0xf
shl ecx, 8
shr eax, 8
or ecx, eax
add edi, esi
mov dword [edx + 0x40], ecx
mov ecx, dword [ebp - 0x80c]
cmp edi, dword [ebp - 0x814]
jb 0x4076f3
pop ebx
movzx eax, word [ebp - 0x808]
mov dword [ecx + 0x34], eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0045463b
mov esp, ebp
pop ebp
ret 4
Function at 0x4079c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x58bd90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
mov dword [esi], eax
movzx ecx, byte [edi + 1]
shr ecx, 7
mov dword [esi + 4], ecx
movzx eax, word [edi + 1]
mov edx, eax
and edx, 0xf
shr eax, 8
shl edx, 8
or edx, eax
mov dword [esi + 8], edx
movzx eax, byte [edi + 5]
shr eax, 1
and eax, 0x1f
mov dword [esi + 0xc], eax
movzx ecx, byte [edi + 5]
and ecx, 1
mov dword [esi + 0x10], ecx
movzx edx, byte [edi + 6]
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x14], edx
movzx eax, byte [edi + 7]
push ecx
push str.pat_version____d_n
mov ecx, 0x400
lea ebx, [ebp - 0x804]
mov dword [esi + 0x18], eax
call fcn.00407b90
add esp, 8
mov edx, ebx
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
movzx ecx, word [edi + 3]
movzx eax, cl
shr ecx, 8
shl eax, 8
or eax, ecx
push eax
push str.transport_stream_id___d_n
mov ecx, 0x400
lea ebx, [ebp - 0x804]
mov dword [esi + 0x28], eax
call fcn.00407b90
add esp, 8
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esi + 8]
sub eax, 9
shr eax, 2
mov dword [esi + 0x2c], eax
mov dword [ebp - 0x80c], 0
test eax, eax
jle 0x407b6b
mov ecx, dword [ebp + 8]
add ecx, 0xa
lea edi, [esi + 0x34]
mov dword [ebp - 0x808], ecx
jmp 0x407ab6
mov ecx, dword [ebp - 0x808]
movzx eax, word [ecx - 2]
movzx edx, al
shr eax, 8
shl edx, 8
or edx, eax
mov dword [edi - 4], edx
movzx eax, word [ecx]
mov edx, dword [ebp - 0x80c]
mov ecx, eax
and ecx, 0x1f
shl ecx, 8
shr eax, 8
or ecx, eax
push edx
mov dword [edi], ecx
push str.____program_index_________________d_n
mov ecx, 0x400
lea ebx, [ebp - 0x804]
call fcn.00407b90
add esp, 8
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [edi - 4]
push ecx
push str.____program_number________________d_n
mov ecx, 0x400
lea ebx, [ebp - 0x804]
call fcn.00407b90
add esp, 8
mov edx, ebx
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [edi]
push eax
push str.____network_or_program_map_PID____d_n_n
mov ecx, 0x400
lea ebx, [ebp - 0x804]
call fcn.00407b90
add esp, 8
mov ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x80c]
add dword [ebp - 0x808], 4
inc eax
add edi, 8
mov dword [ebp - 0x80c], eax
cmp eax, dword [esi + 0x2c]
jl 0x407ab0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0045463b
mov esp, ebp
pop ebp
ret 4
Function at 0x410870
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f639b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x58bd90]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov eax, dword [0x58bd90]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov edi, ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x240], esi
mov ecx, dword [edi + 4]
mov edx, dword [edi]
or ecx, 0x2001f
push ecx
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.00410c00
mov ebx, eax
cmp ebx, esi
je 0x410910
mov dword [esp + 0x240], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x410909
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], esi
mov eax, ebx
jmp 0x4109c1
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x14]
push esi
push esi
push esi
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x40]
push edx
push esi
push eax
mov dword [esp + 0x3c], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x41097e
lea ebx, [ebx]
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call fcn.00410870
mov ebx, eax
cmp ebx, esi
jne 0x4108eb
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x14]
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
push edx
mov dword [esp + 0x3c], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x410940
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x410993
push eax
call ebx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x20]
push eax
mov ecx, edi
mov dword [esp + 0x18], esi
call fcn.004107f0
mov edi, eax
mov dword [esp + 0x240], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x4109bf
push eax
call ebx
mov dword [esp + 0x10], esi
mov eax, edi
mov dword [esp + 0x14], esi
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.0045463b
mov esp, ebp
pop ebp
ret 4

Function at 0x410b10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
lea edx, [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push esi
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0xc]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410b82
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x410b51
cmp eax, 2
jne 0x410b6c
mov eax, dword [ebp + 0x10]
test esi, esi
je 0x410b7c
test eax, eax
je 0x410b77
test al, 1
jne 0x410b6c
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x410b7c
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x41ccf3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x41cd3a
call fcn.004167c9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41cd3a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41cd56
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041c7f3
mov esi, eax
test edi, edi
je 0x41cd54
test ebx, ebx
je 0x41cd54
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x421002
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.004167c9
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x42102f
xor eax, eax
jmp 0x4210d6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x421028
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x421028
movzx eax, word [esi + 6]
push ebx
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00415ec5
pop ecx
mov edi, eax
xor ecx, ecx
xor eax, eax
cmp cx, word [esi + 6]
jae 0x421087
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 2
cmp eax, edx
jl 0x421075
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.0041fccb
push edi
mov ebx, eax
call fcn.00415ef4
pop ecx
test ebx, ebx
je 0x4210c9
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.004202ea
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.0042039e
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4

Function at 0x42c499
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.004167c9
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42c4d2
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0042c0d6
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x42c530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x42c554
cmp dword [edi + 0x74], 0
jne 0x42c554
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.004167c9
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0042c4f1
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42c878
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0042c5a4
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x42c8c2
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041af22
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00405ec0
jmp 0x42c8cd
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0042630d
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x42ce1a
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x42ce58
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42ce66
push str.MoveFileTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42ce66
push dword [esi]
push 2
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x42ce68
cmp dword [esi + 4], 0
je 0x42ce66
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x42e2ca
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 1
mov ecx, esi
test al, 1
je 0x42e2ee
mov eax, dword [esi]
push 0
call dword [eax + 0xe0]
test eax, eax
jne 0x42e2fc
pop esi
ret
mov eax, dword [esi + 0x24]
mov edx, dword [esi]
push eax
call dword [edx + 0xe0]
jmp 0x42e2e8
xor eax, eax
inc eax
pop esi
ret