joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10687d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x1068803
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x1068882
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.01067090
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x1068850
mov cx, word [esp]
sub cx, si
jmp 0x1068852
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x1068839
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x1068878
mov cx, word [esp]
sub cx, si
jmp 0x106887a
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x1068861
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x10688df
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.010684a8
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x10688ca
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x10688df
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x10687de
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x106ee14
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x1081c30
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x106ee36
shr eax, 1
xor eax, 0xedb88320
jmp 0x106ee38
shr eax, 1
dec edx
jne 0x106ee24
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x106ee1d
mov byte [0x1082030], 1
pop esi
pop ebx
ret

Function at 0x106ee54
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x1082030], 0
jne 0x106ee6b
call fcn.0106ee14
mov eax, edi
dec eax
test eax, eax
jl 0x106ee94
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x1081c30]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x106ee75
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x10719b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x10719e1
dec al
je 0x1071a1d
dec al
je 0x1071a61
dec al
je 0x1071acc
jmp 0x1071b56
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x1071b56
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x10719f1
jmp 0x1071b56
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x1071b56
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x1071a2d
jmp 0x1071b56
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x1071b56
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x1071a8f
xor ebp, ebp
jmp 0x1071aa0
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x1071aa9
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x1071a71
jmp 0x1071b56
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x1071b56
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x1071b24
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0106ee9c
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x1071ae0
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x107a158
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x107a2bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.01004510
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.010049d0
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x107a2a0
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x107a299
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.01002a38
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x107a2cc
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
mov esi, dword [ebp - 8]
mov eax, dword [esi + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.01008610
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, 0x107a2d8
call fcn.0100481c
push dword [ebx]
mov eax, dword [esi + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.01008610
push dword [ebp - 0x18]
push 0x107a2d8
mov eax, ebx
mov edx, 3
call fcn.01004890
push dword [ebx]
mov eax, dword [esi + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.01008610
push dword [ebp - 0x1c]
push 0x107a2d8
mov eax, ebx
mov edx, 3
call fcn.01004890
mov eax, dword [esi + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.01008610
mov edx, dword [ebp - 0x20]
mov eax, ebx
call fcn.010047d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x107a2a0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.01002a68
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x107a2c2
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.01004534
ret
Function at 0x107a2dc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.010049c0
xor eax, eax
push ebp
push 0x107a479
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov eax, 2
call fcn.01053b20
mov esi, eax
mov dword [ebp - 0x130], 0x128
lea edx, [ebp - 0x130]
mov eax, esi
call fcn.01053b40
mov ebx, eax
jmp 0x107a445
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.01004780
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.01008b7c
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.010081e0
mov eax, dword [ebp - 0x134]
push eax
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 4]
call fcn.010081e0
mov edx, dword [ebp - 0x140]
pop eax
call fcn.0100491c
je 0x107a405
lea eax, [ebp - 0x148]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.01004780
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.010081e0
mov eax, dword [ebp - 0x144]
push eax
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 4]
call fcn.010081e0
mov edx, dword [ebp - 0x14c]
pop eax
call fcn.0100491c
jne 0x107a436
mov eax, dword [edi + 0x2f8]
mov eax, dword [eax + 0x218]
mov edx, 0x107a494
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
mov eax, dword [ebp - 0x128]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 8], eax
lea edx, [ebp - 0x130]
mov eax, esi
call fcn.01053b60
mov ebx, eax
test ebx, ebx
jne 0x107a360
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x107a480
lea eax, [ebp - 0x14c]
mov edx, 7
call fcn.01004534
lea eax, [ebp - 4]
call fcn.01004510
ret
Function at 0x107a4c0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.010049c0
xor eax, eax
push ebp
push 0x107a6e2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.01008cb8
push dword [ebp - 0x10]
push 0x107a6f8
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.01004890
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x15c], edx
mov eax, dword [ebp + 8]
mov byte [eax - 0x15d], 0
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x158]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x164]
mov eax, dword [ebp - 8]
call fcn.01008a88
test eax, eax
jne 0x107a54e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x158]
mov edx, dword [ebp + 8]
mov dword [edx - 0x15c], eax
mov eax, dword [ebp + 8]
push dword [eax - 0x168]
push 0x107a6f8
push dword [ebp - 4]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.01004890
mov eax, dword [ebp - 0xc]
call fcn.01008a0c
test al, al
je 0x107a5c2
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x158]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x164]
mov eax, dword [ebp - 0xc]
call fcn.01008a88
test eax, eax
jne 0x107a5b6
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x158]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0x15c]
je 0x107a5cc
mov eax, dword [ebp + 8]
mov byte [eax - 0x15d], 1
jmp 0x107a5cc
mov eax, dword [ebp + 8]
mov byte [eax - 0x15d], 1
jmp 0x107a5cc
mov eax, dword [ebp + 8]
mov byte [eax - 0x15d], 1
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0107a158
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, 0xfffffe94
call fcn.010045a8
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x16c]
lea eax, [ebp - 0x18]
mov edx, 0x107a704
call fcn.0100481c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x170]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x218]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0107a158
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, 0xfffffe8c
call fcn.010045a8
mov eax, dword [ebp + 8]
cmp byte [eax - 0x15d], 0
je 0x107a6bd
push 0x107a718
push dword [ebp - 8]
push 0x107a728
push dword [ebp - 0xc]
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.01004890
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x170]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x218]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x1080360]
mov eax, dword [eax]
call fcn.0105218c
push 0
mov eax, dword [ebp - 0xc]
call fcn.010049d0
push eax
mov eax, dword [ebp - 8]
call fcn.010049d0
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp + 8]
mov byte [edx - 0x175], al
call sub.kernel32.dll_GetLastError
mov edx, dword [ebp + 8]
mov dword [edx - 0x17c], eax
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.01004564
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x107a6e9
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.01004534
ret
Function at 0x4010d5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x94]
push esi
push eax
call fcn.0040ca30
mov ebx, dword [ebp + 8]
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x94]
push eax
push esi
push esi
push 0x4000020
push esi
push esi
mov dword [ebp - 0x94], edi
mov edi, dword [ebp + 0xc]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401161
push 0x3c
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.0040ca30
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x401166
mov eax, dword [ebp - 8]
jmp 0x401168
mov eax, dword [ebp - 0x50]
jmp 0x401168
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40116d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWAREIntelTvWizard_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4011cd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.IsTvWizardInstalled
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 4], esi
je 0x4011cd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], 1
pop esi
sete al
leave
ret

Function at 0x4011d9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWAREIntelDisplayigfxcuihkcmd
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40123e
push 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.ExpansionAllDisplay
push dword [ebp - 4]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401235
cmp dword [ebp - 8], 1
jne 0x401235
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x403f64
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
sub esp, 0x120
lea ebp, [esp - 4]
mov eax, dword [0x424a00]
xor eax, ebp
mov dword [ebp + 0x120], eax
push 0x20
mov eax, 0x41b49d
call fcn.0040d1c5
mov edi, dword [ebp + 0x12c]
mov esi, 0x104
xor ebx, ebx
push esi
lea eax, [ebp + 0x1c]
push ebx
push eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], esi
call fcn.0040ca30
add esp, 0xc
push ebx
lea ecx, [ebp]
mov byte [ebp - 0xd], 1
mov dword [ebp + 0x18], 0xf
call fcn.00401434
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x1c]
push eax
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 4], ebx
jmp 0x404042
cmp byte [ebp - 0xd], bl
je 0x403ffc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.00401c97
mov byte [ebp - 0xd], bl
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
jne 0x404027
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.00401c97
inc dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x1c]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
push dword [ebp - 0x24]
call edi
test eax, eax
je 0x403fdc
mov eax, dword [ebp - 0x14]
cmp dword [0x425f28], eax
jne 0x404069
cmp dword [ebp + 0x18], 0x10
mov eax, dword [ebp + 4]
jae 0x40405f
lea eax, [ebp + 4]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ebx
push 1
lea ecx, [ebp]
call fcn.004014e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x120]
xor ecx, ebp
call fcn.0040caaa
add ebp, 0x124
leave
ret 4

Function at 0x404bcb
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x404c1e
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, ecx
jne 0x404c34
push 0x80004005
call fcn.00404929
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x404c37
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x405741
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x424a00]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0xa0]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
call fcn.00404b96
mov edi, eax
cmp edi, esi
je 0x4057a9
lea ecx, [ebp - 0x70]
call fcn.00404b31
mov eax, edi
mov ecx, dword [ebp + 0x94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040caaa
add ebp, 0x98
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x4057c1
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.00405741
cmp eax, esi
jne 0x4057f4
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call edi
test eax, eax
je 0x4057b1
lea ecx, [ebp - 0x70]
call fcn.00404b31
push dword [ebp - 0x78]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.00404b31
mov eax, esi
jmp 0x40578f
Function at 0x407119
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
sub esp, 0x404
lea ebp, [esp - 4]
mov eax, dword [0x424a00]
xor eax, ebp
mov dword [ebp + 0x404], eax
push 0x20
mov eax, 0x41b737
call fcn.0040d1f8
mov edi, ecx
mov eax, dword [ebp + 0x414]
mov esi, dword [ebp + 0x410]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
call dword [0x42491c]
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp], ebx
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x4071d3
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
call fcn.004047e4
add esp, 0xc
test eax, eax
jl 0x4071d3
mov edi, dword [ebp - 0x24]
cmp edi, 0x400
jg 0x4071bb
push edi
call fcn.0040564c
test al, al
pop ecx
je 0x4071bb
mov eax, edi
call fcn.0040df20
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x4071c4
push edi
lea ecx, [ebp - 0x20]
call fcn.004058c0
push dword [ebp - 0x1c]
push edi
push esi
push eax
call fcn.004048c5
cmp eax, ebx
jne 0x407218
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x4071e3
lea ecx, [ebp]
call fcn.004055b6
lea ecx, [ebp - 0x20]
call fcn.004054f0
mov eax, 0x8007000e
lea esp, [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0040caaa
add ebp, 0x408
leave
ret 0x10
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x1c], edi
jne 0x407237
call fcn.00404a4d
mov esi, eax
jmp 0x4072fa
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x407254
call fcn.00404a4d
jmp 0x4072ef
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x40724a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x18], esi
jae 0x40729b
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x407287
lea ecx, [ebp]
call fcn.004055b6
mov esi, 0x8007000e
lea ecx, [ebp - 0x20]
call fcn.004054f0
mov eax, esi
jmp 0x4071f0
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.00406417
mov dword [ebp - 4], 1
jmp 0x4072bc
cmp dword [ebp], ebx
jne 0x4072c8
mov esi, 0x8007000e
jmp 0x4072f1
push esi
push dword [ebp - 0x14]
push esi
push dword [ebp]
call fcn.00404976
mov eax, dword [ebp]
add esp, 0x10
push dword [ebp + 0x41c]
mov byte [eax + esi], bl
push dword [ebp]
lea ecx, [ebp - 0x2c]
call fcn.00406faa
mov esi, eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x40728c
lea ecx, [ebp]
call fcn.004055b6
jmp 0x40728c