joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c50
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x438120
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x44b538]
xor eax, esp
mov dword [esp + 0x4c], eax
push esi
mov eax, dword [0x44b538]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0041557a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403c9b
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x68]
push ecx
lea edx, [esp + 0x18]
push str.0x_08X
push edx
mov dword [esp + 0x6c], 0
call fcn.00426f4f
add esp, 0xc
cmp dword [esi + 0x2a2c], 0
jne 0x403d22
push str.RealtekInstallShield
add esi, 0x148
lea eax, [esp + 0x14]
push esi
push eax
call fcn.00402cd0
add esp, 0xc
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x64], 1
call fcn.00402df0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x60], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403d32
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x403d32
push 0x20
push str.SoftwareRealtekAudioInstaller
lea ecx, [esp + 0x10]
call fcn.00402a70
mov esi, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push esi
push 0x80000002
call dword [0x43b00c]
test eax, eax
jne 0x403d70
push 0x40
lea edx, [esp + 0x18]
push edx
push 1
push eax
mov eax, dword [esp + 0x1c]
push str.InstallerErrorCode
push eax
call dword [0x43b010]
mov ecx, dword [esp + 0xc]
push ecx
call dword [0x43b034]
lea eax, [esi - 0x10]
mov dword [esp + 0x60], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403d94
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00425d1a
add esp, 0x5c
ret 4
Function at 0x403dc0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x438166
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x44b538]
xor eax, esp
mov dword [esp + 0x8c], eax
push esi
mov eax, dword [0x44b538]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0041557a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403e14
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 8], eax
mov eax, dword [esp + 0xa8]
add eax, 0xffffffff
cmp eax, 3
mov dword [esp + 0xa0], 0
ja case.default.0x403e3e
jmp dword [eax*4 + 0x403f94]
mov ecx, dword [esp + 0xac]
push ecx
push str.DriverPackageInstall_Error_code_0x_08X
jmp 0x403e89
mov eax, dword [esp + 0xac]
push eax
push str.DriverPackagePrenstall_Error_code_0x_08X
lea ecx, [esp + 0x1c]
push ecx
jmp 0x403e8e
mov edx, dword [esp + 0xac]
push edx
push str.DriverPackageUninstall_Error_code_0x_08X
lea eax, [esp + 0x1c]
push eax
jmp 0x403e8e
mov ecx, dword [esp + 0xac]
push ecx
push str.DriverPackageGetPath_Error_code_0x_08X
lea edx, [esp + 0x1c]
push edx
call fcn.00426f4f
add esp, 0xc
cmp dword [esi + 0x2a2c], 0
jne 0x403ef4
push str.RealtekInstallShield
add esi, 0x148
lea eax, [esp + 0x14]
push esi
push eax
call fcn.00402cd0
add esp, 0xc
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0xa4], 1
call fcn.00402df0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0xa0], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403f04
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x403f04
push 0x20
push str.SoftwareRealtekAudioInstaller
lea ecx, [esp + 0x10]
call fcn.00402a70
mov esi, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push esi
push 0x80000002
call dword [0x43b00c]
test eax, eax
jne 0x403f45
push 0x80
lea edx, [esp + 0x18]
push edx
push 1
push eax
mov eax, dword [esp + 0x1c]
push str.DIFxAPIErrorCode
push eax
call dword [0x43b010]
mov ecx, dword [esp + 0xc]
push ecx
call dword [0x43b034]
lea eax, [esi - 0x10]
mov dword [esp + 0xa0], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403f6c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.00425d1a
add esp, 0x9c
ret 8
Function at 0x4086a0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x44c9d4]
push esi
mov esi, ecx
xor ecx, ecx
cmp eax, 0x5a
setge cl
push 0
sub ecx, 1
and ecx, 0xa
add eax, ecx
push eax
mov dword [0x44c9d4], eax
mov edx, dword [esi + 0x2a50]
push 0x402
push edx
call dword [0x43b494]
push 0
mov ecx, esi
call fcn.00410c84
cmp dword [esi + 0x2a20], 0
je 0x4086f0
mov dword [0x44c9cc], 1
jmp 0x408700
mov ecx, esi
call fcn.00401fb0
test eax, eax
mov dword [0x44c9cc], eax
je 0x408778
mov eax, dword [esi + 0x2a04]
test eax, eax
push edi
je 0x408751
cmp dword [esi + 0x2a0c], 0
je 0x408733
mov ecx, esi
call fcn.00406b10
mov ecx, esi
mov edi, eax
call fcn.00405de0
test edi, edi
jne 0x408763
test eax, eax
jne 0x40876c
push 0xffffffffffffffff
call fcn.00427666
test eax, eax
je 0x408751
cmp dword [esi + 0x2a0c], 0
jne 0x40874d
mov ecx, esi
call fcn.00406b10
mov edi, eax
xor eax, eax
jmp 0x408724
test eax, eax
jne 0x40872c
cmp dword [esi + 0x2a0c], 0
je 0x40872c
mov ecx, esi
call fcn.00405de0
jmp 0x408728
cmp edi, 1
jne 0x408792
test eax, eax
jmp 0x40876f
cmp eax, 1
jne 0x408792
push 0xfffffffffffffffc
call fcn.00427666
push 0x30
push str.Warning
push str._Microsoft_Bus_driver_should_be_loaded_in_your_system_before_installing_Realtek_HD_Audio_driver__
mov ecx, esi
call fcn.00401670
push 0xfffffffffffffffe
call fcn.00427666
pop edi
pop esi
ret

Function at 0x4086a5
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x44c9d4]
push esi
mov esi, ecx
xor ecx, ecx
cmp eax, 0x5a
setge cl
push 0
sub ecx, 1
and ecx, 0xa
add eax, ecx
push eax
mov dword [0x44c9d4], eax
mov edx, dword [esi + 0x2a50]
push 0x402
push edx
call dword [0x43b494]
push 0
mov ecx, esi
call fcn.00410c84
cmp dword [esi + 0x2a20], 0
je 0x4086f0
mov dword [0x44c9cc], 1
jmp 0x408700
mov ecx, esi
call fcn.00401fb0
test eax, eax
mov dword [0x44c9cc], eax
je 0x408778
mov eax, dword [esi + 0x2a04]
test eax, eax
push edi
je 0x408751
cmp dword [esi + 0x2a0c], 0
je 0x408733
mov ecx, esi
call fcn.00406b10
mov ecx, esi
mov edi, eax
call fcn.00405de0
test edi, edi
jne 0x408763
test eax, eax
jne 0x40876c
push 0xffffffffffffffff
call fcn.00427666
test eax, eax
je 0x408751
cmp dword [esi + 0x2a0c], 0
jne 0x40874d
mov ecx, esi
call fcn.00406b10
mov edi, eax
xor eax, eax
jmp 0x408724
test eax, eax
jne 0x40872c
cmp dword [esi + 0x2a0c], 0
je 0x40872c
mov ecx, esi
call fcn.00405de0
jmp 0x408728
cmp edi, 1
jne 0x408792
test eax, eax
jmp 0x40876f
cmp eax, 1
jne 0x408792
push 0xfffffffffffffffc
call fcn.00427666
push 0x30
push str.Warning
push str._Microsoft_Bus_driver_should_be_loaded_in_your_system_before_installing_Realtek_HD_Audio_driver__
mov ecx, esi
call fcn.00401670
push 0xfffffffffffffffe
call fcn.00427666
pop edi
pop esi
ret
Function at 0x401030
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 1
jne 0x401044
mov eax, dword [0x40d0cc]
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
jmp 0x401056
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [0x40d0d0]
shr edx, 1
cmp dword [ebp - 4], edx
jae 0x4010db
mov eax, dword [ebp - 4]
mov ecx, dword [0x40d0b4]
movzx edx, word [ecx + eax*2]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 0xc
cmp eax, 3
jne 0x4010d6
mov ecx, dword [ebp - 0xc]
and ecx, 0xfff
add ecx, 0x1474
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1474
mov dword [ebp - 8], edx
cmp dword [ebp - 4], 0
jne 0x4010b7
push 0x20e
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x4010b7
xor eax, eax
jmp 0x4010db
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx]
add eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx], eax
jmp 0x40104d
mov esp, ebp
pop ebp
ret
Function at 0x4018b0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401920
xor eax, eax
jmp 0x401a01
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
jne 0x401938
xor eax, eax
jmp 0x401a01
push ebp
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
add eax, 0x1046a
call fcn.00401330
mov esp, ebp
pop ebp
ret

Function at 0x401be0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x40d0c0], 0x24e1
mov eax, dword [0x40d0c0]
sub eax, 0x24e1
mov dword [0x40d0c0], eax
mov ecx, 1
test ecx, ecx
je 0x401c8b
mov edx, dword [0x40d0c0]
cmp edx, dword [ebp + 0xc]
jb 0x401c17
jmp 0x401c8b
cmp dword [0x40d0c0], 0
jne 0x401c35
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x401c35
xor eax, eax
jmp 0x401c8b
mov eax, dword [ebp + 8]
add eax, dword [0x40d0c0]
mov ecx, dword [eax]
add ecx, dword [0x40d0c0]
mov edx, dword [ebp + 8]
add edx, dword [0x40d0c0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x64b60
mov eax, dword [0x40d0c0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x40d0c0]
push eax
call fcn.00401200
add esp, 8
mov ecx, dword [0x40d0c0]
add ecx, 4
mov dword [0x40d0c0], ecx
jmp 0x401bfd
mov esp, ebp
pop ebp
ret
Function at 0x10002a7b
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x10041ef0
call fcn.10035ae0
sub esp, 0x408
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
push ebx
mov dword [ebp - 0x10], edi
call fcn.10002979
test al, al
pop ecx
je 0x10002ab5
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.10002a06
add esp, 0xc
jmp 0x10002b3b
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], edi
call fcn.100024a0
mov esi, eax
mov eax, dword [ebx + 4]
cmp eax, edi
mov dword [ebp + 0xc], esi
mov dword [ebp - 0x10], 0x3e8
jne 0x10002ad8
mov eax, 0x10047534
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], edi
push ecx
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10002b40
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x10002b09
push esi
call ebx
xor esi, esi
mov dword [ebp + 0xc], esi
mov ecx, dword [ebp + 8]
mov al, byte [ebp + 0xb]
push edi
mov byte [ecx], al
call fcn.100149cc
lea eax, [ebp - 0x414]
push eax
call fcn.10035bc0
pop ecx
mov ecx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.10015611
cmp esi, edi
je 0x10002b3b
push esi
call ebx
mov eax, dword [ebp + 8]
jmp 0x10002b80
cmp esi, edi
je 0x10002b50
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp + 0xc], esi
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
push edi
mov ecx, ebx
mov al, byte [eax]
mov byte [ebx], al
call fcn.100149cc
push dword [0x10047530]
mov ecx, ebx
push edi
push dword [ebp + 0x10]
call fcn.10014664
cmp esi, edi
je 0x10002b7e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10002c30
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x10041f18
call fcn.10035ae0
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], ebx
mov ecx, dword [0x10059e2c]
mov dword [ebp - 4], esi
cmp ecx, esi
je 0x10002c5b
call fcn.10002120
jmp 0x10002c5d
xor eax, eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], esi
push ecx
lea ecx, [ebp - 0x10]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
jne 0x10002c84
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp eax, esi
jne 0x10002c93
mov eax, 0x10047534
lea ecx, [ebp + 8]
mov dword [ebp - 0x10], esi
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push esi
push eax
push ebx
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, dword [ebp - 0x14]
test eax, eax
je 0x10002cbc
mov edi, dword [ebp + 0xc]
cmp ebx, esi
je 0x10002cc7
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10002dae
Capabilities:
Set registry value

Disassembly:
mov eax, 0x10041f50
call fcn.10035ae0
sub esp, 0xc
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
call fcn.100024a0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.tb_items
push ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
jne 0x10002dfa
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
je 0x10002e09
push ebx
call edi
xor ebx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp eax, esi
jne 0x10002e18
mov eax, 0x10047534
mov ecx, dword [ebp + 0xc]
push 4
mov dword [ebp + 8], ecx
lea ecx, [ebp + 8]
push ecx
push 4
push esi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp - 0x10], esi
je 0x10002e3b
push dword [ebp - 0x10]
call edi
cmp ebx, esi
je 0x10002e42
push ebx
call edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10002e51
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x10041f6c
call fcn.10035ae0
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push edi
xor edi, edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 1
call fcn.100024a0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
push ecx
lea ecx, [ebp - 0x14]
push ecx
push edi
push 0xf003f
push edi
push edi
push edi
push str.tb_items
push eax
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, edi
jne 0x10002ea1
mov ebx, dword [ebp - 0x14]
cmp dword [ebp - 0x10], edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x10002eb4
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp eax, edi
jne 0x10002ec3
mov eax, 0x10047534
lea ecx, [ebp + 8]
mov dword [ebp - 0x14], edi
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push edi
push eax
push ebx
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10002f0b
cmp ebx, edi
je 0x10002eef
push ebx
call esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x10], edi
mov dword [ebp + 8], eax
je 0x10002eff
push dword [ebp - 0x10]
call esi
cmp ebx, edi
je 0x10002f06
push ebx
call esi
mov eax, dword [ebp + 8]
jmp 0x10002f30
cmp ebx, edi
je 0x10002f14
push ebx
call esi
xor ebx, ebx
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x10], edi
mov eax, dword [eax]
mov dword [ebp + 8], eax
je 0x10002f26
push dword [ebp - 0x10]
call esi
cmp ebx, edi
je 0x10002f2d
push ebx
call esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1000342e
Capabilities:
Initialize iwebbrowser2

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi], 0
jne 0x1000346d
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
push 0x10048d10
push 4
push 0
push 0x10048ce0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1000346d
mov eax, dword [esi]
push dword [esp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xa4]
push 1
pop eax
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1000569f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x1005a894], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
push edi
jne 0x100056e7
call ebx
test eax, 0x80000000
je 0x100056dd
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x1005a898], eax
mov dword [0x1005a894], 1
mov eax, dword [0x1005a898]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10005703
push dword [ebp + 0x10]
push eax
call esi
test eax, eax
mov dword [ebp - 4], eax
jne 0x10005734
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x1000572b
call ebx
test eax, 0x80000000
mov eax, dword [ebp + 8]
je 0x1000571f
push dword [eax + 8]
call dword [eax]
jmp 0x10005725
push dword [eax + 0xc]
call dword [eax + 4]
test eax, eax
je 0x10005734
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10005f92
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, 0x1004245c
call fcn.10035ae0
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
call fcn.100137e7
xor ebx, ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xb0], 0x10047550
mov ecx, dword [sym.imp.USER32.dll_DefWindowProcA]
lea eax, [esi + 0xc0]
push ebx
mov byte [ebp - 4], 1
mov dword [eax + 0x18], ecx
mov dword [eax], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x1c], esi
mov dword [eax + 0x20], 1
mov dword [eax + 0x24], ebx
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x100]
mov byte [ecx], al
call fcn.100149cc
mov al, byte [ebp - 0xd]
lea edi, [esi + 0x12c]
push ebx
mov ecx, edi
mov byte [ebp - 4], 2
mov byte [edi], al
call fcn.100149cc
mov byte [edi + 0x30], bl
mov cl, byte [ebp - 0xd]
lea eax, [esi + 0x160]
mov byte [eax], cl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x178]
mov byte [ecx], al
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov dword [esi + 0x18c], ebx
mov dword [esi + 0x198], ebx
mov byte [ebp - 4], 6
mov dword [esi], 0x1004753c
mov dword [esi + 0xb0], 0x10047538
mov dword [esi + 0x194], ebx
mov dword [esi + 0x190], 0x64
mov dword [esi + 0xf0], ebx
mov byte [esi + 0x188], bl
mov byte [esi + 0x170], bl
call fcn.10013fb4
mov edi, 0x10059ef8
mov byte [0x10059e08], bl
push edi
mov ecx, 0x10059e0c
mov byte [esi + 0x111], 1
call fcn.10006106
push edi
mov ecx, 0x10059e30
call fcn.10006106
mov dword [esi + 0x124], ebx
mov dword [esi + 0x128], ebx
mov byte [esi + 0x110], bl
mov dword [esi + 0x1a0], ebx
mov dword [esi + 0x1a4], ebx
mov dword [esi + 0x1a8], ebx
mov dword [esi + 0x1ac], ebx
mov dword [esi + 0x1b0], ebx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x1b4], ebx
mov dword [esi + 0x1b8], ebx
mov byte [esi + 0x1bc], bl
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x100066ee
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 4]
xor esi, esi
mov ecx, dword [ecx]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
jne 0x10006722
mov edi, dword [ebp - 4]
xor eax, eax
cmp eax, esi
mov ebx, eax
jne 0x10006745
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
cmp edi, esi
je 0x10006750
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 0xc

Function at 0x10006759
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x100424f4
call fcn.10035ae0
sub esp, 0x114
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebx]
call fcn.100066b0
mov edi, eax
cmp edi, esi
je 0x100067a3
cmp dword [ebp - 0x10], esi
je 0x1000679c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x10006840
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x10006814
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x10]
push eax
call fcn.10006759
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x10006801
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x120]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x100067c6
cmp dword [ebp - 0x10], esi
je 0x1000680f
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
jmp 0x10006840
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x10006827
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 0x10], esi
mov ebx, eax
je 0x1000683e
push dword [ebp - 0x10]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4