joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b270
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], esi
push eax
push dword [ebp + 8]
call fcn.0041af70
add esp, 0xc
test esi, esi
pop esi
je 0x41b2aa
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x41b2d0
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp + 0xc], 0
je 0x41b2fa
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41b2fa
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
pop esi
pop ebp
ret

Function at 0x41b300
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 3
push 0
push 0
push 0x80
push dword [ebp + 8]
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41b339
pop edi
mov eax, 0x80004005
pop esi
pop ebp
ret
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x41b360
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jg 0x41b381
mov eax, 0x80004005
pop edi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 4]
push esi
push eax
call fcn.004b4085
add esp, 4
mov esi, eax
push esi
push edi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41b3f0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x4e30ec
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41b3f0
mov edx, dword [ebp - 4]
xor edi, edi
mov eax, dword [ebp + 0xc]
movzx ecx, word [edx + 0xa]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
movzx ecx, word [edx + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
movzx ecx, word [edx + 0xe]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
movzx ecx, word [edx + 0xc]
mov dword [eax], ecx
jmp 0x41b3f5
mov edi, 0x80004005
test esi, esi
je 0x41b402
push esi
call fcn.004b408e
add esp, 4
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41b410
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x50bd24]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
mov dword [ebp - 0x88], ecx
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 8
jb 0x41b443
mov eax, dword [edi]
xor edx, edx
push edx
push ecx
mov word [eax], dx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jle 0x41b483
lea ecx, [ebx + 4]
push ecx
call fcn.004b4085
add esp, 4
mov esi, eax
push esi
push ebx
push 0
push dword [ebp - 0x88]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x41b499
test esi, esi
je 0x41b483
push esi
call fcn.004b408e
add esp, 4
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b42e4
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x90]
mov dword [ebp - 0x90], 0
push eax
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], 0
push eax
push 0x4e30ec
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41b476
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ecx + 8]
mov ebx, eax
movzx eax, ax
mov dword [ebp - 0x98], eax
mov eax, dword [ecx + 0xc]
mov ecx, eax
shr ecx, 0x10
shr ebx, 0x10
movzx eax, ax
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x88], eax
test esi, esi
je 0x41b505
push esi
call fcn.004b408e
add esp, 4
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.004b5de0
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push dword [ebp - 0x94]
push dword [ebp - 0x98]
push ebx
push str._d._d._d._d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x84]
add esp, 0x24
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41b550
sub edx, ecx
lea eax, [ebp - 0x84]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.0041a580
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b42e4
mov esp, ebp
pop ebp
ret

Function at 0x41b610
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
test eax, eax
je 0x41b6b7
cmp dword [ebp + 0xc], 0
je 0x41b6b7
mov edi, dword [ebp + 0x10]
test edi, edi
jle 0x41b6b7
push esi
push 0
push 0x80
push 2
push 0
push 0
push 7
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41b65d
mov edi, 0x80004005
pop esi
mov eax, edi
pop edi
pop ebp
ret
push ebx
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ebx, ebx
nop dword [eax]
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
mov eax, dword [ebp + 0xc]
push edi
add eax, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41b69e
mov eax, dword [ebp + 8]
test eax, eax
jle 0x41b69e
sub edi, eax
add ebx, eax
test edi, edi
jg 0x41b670
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x41b6a7
mov dword [eax], ebx
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
ret
mov eax, 0x86180008
pop edi
pop ebp
ret
Function at 0x41b6c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x50bd24]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp + 0x14]
push 0x800
mov dword [ebp - 0x80c], eax
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004b5de0
add esp, 0xc
lea eax, [ebp - 0x804]
push esi
push 0x3ff
push eax
push edi
push ebx
push dword [ebp - 0x808]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
pop edi
lea eax, [ebp - 0x804]
pop esi
lea edx, [eax + 2]
pop ebx
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41b730
mov ecx, dword [ebp - 0x80c]
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.0041a580
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004b42e4
mov esp, ebp
pop ebp
ret

Function at 0x41c010
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50bd24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x188], 0
jne 0x41c1a9
push str.shell32.dll
mov dword [esi + 0x188], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.SHGetKnownFolderPath
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 4], eax
mov ecx, esi
lea eax, [esi + 0x20]
push eax
push 0x4e52c0
call fcn.0041c1c0
cmp dword [esi + 4], 0
lea eax, [esi + 0x38]
push eax
mov ecx, esi
jne 0x41c07c
push 0x1c
call fcn.0041c2b0
jmp 0x41c086
push 0x4e52b0
call fcn.0041c1c0
lea eax, [esi + 0x50]
mov ecx, esi
push eax
push 0x1c
call fcn.0041c2b0
lea eax, [esi + 8]
mov ecx, esi
push eax
push 0x26
call fcn.0041c2b0
lea eax, [esi + 0x68]
mov ecx, esi
push eax
push 0x4e52f0
call fcn.0041c1c0
lea eax, [esi + 0x80]
mov ecx, esi
push eax
push 0x4e52a0
call fcn.0041c1c0
lea eax, [esi + 0xc8]
mov ecx, esi
push eax
push 0x24
call fcn.0041c2b0
lea eax, [esi + 0xb0]
mov ecx, esi
push eax
push 0x25
call fcn.0041c2b0
lea eax, [esi + 0xe0]
mov ecx, esi
push eax
push 0x10
call fcn.0041c2b0
lea eax, [esi + 0xf8]
mov ecx, esi
push eax
push 2
call fcn.0041c2b0
lea eax, [esi + 0x110]
mov ecx, esi
push eax
push 0x4e52d0
call fcn.0041c1c0
lea eax, [esi + 0x140]
mov ecx, esi
push eax
push 0x19
call fcn.0041c2b0
lea eax, [esi + 0x158]
mov ecx, esi
push eax
push 0x17
call fcn.0041c2b0
lea eax, [esi + 0x128]
mov ecx, esi
push eax
push 0x2e
call fcn.0041c2b0
lea eax, [esi + 0x98]
mov ecx, esi
push eax
push 0x23
call fcn.0041c2b0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004b5de0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c187
sub eax, edx
lea ecx, [esi + 0x170]
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0041a580
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004b42e4
mov esp, ebp
pop ebp
ret
Function at 0x41c2b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50bd24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.004b5de0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c300
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0041a580
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004b42e4
mov esp, ebp
pop ebp
ret 8

Function at 0x41c770
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x14], 0
push esi
mov esi, 2
je 0x41c7a0
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x41c7a0
cmp dword [ebp + 0x14], 0
mov eax, 0x102
cmovne esi, eax
lea eax, [ebp + 0x14]
mov dword [ebp + 0x14], 0
push eax
push esi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c7e7
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
neg eax
sbb esi, esi
and esi, 0x80004005
test edi, edi
je 0x41c7e1
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
ret
neg eax
pop esi
sbb eax, eax
and eax, 0x80004005
pop ebp
ret
Function at 0x41c8e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da770
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x50bd24]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x418], ebx
xor ebx, ebx
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ebx
lea edi, [ebx + 1]
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x18], ebx
je 0x41c971
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x41c971
cmp dword [ebp - 0x414], ebx
mov eax, 0x101
cmovne edi, eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x414], 0
push eax
push edi
push 0
push dword [ebp - 0x418]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x41ca73
mov ebx, dword [ebp - 0x414]
and edi, 0x300
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x428], edi
test esi, esi
jne 0x41ca73
push 0x400
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.004b5de0
add esp, 0xc
mov dword [ebp - 0x414], 0x400
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x418]
push eax
push esi
push dword [ebp - 0x41c]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x41ca73
mov eax, dword [ebp - 0x418]
cmp eax, 1
je 0x41ca1b
cmp eax, 2
je 0x41ca1b
mov esi, 0xd
jmp 0x41ca73
mov eax, dword [ebp - 0x414]
test eax, eax
je 0x41ca3d
test al, 1
jne 0x41ca36
shr eax, 1
cmp word [ebp + eax*2 - 0x412], 0
je 0x41ca46
mov esi, 0xd
jmp 0x41ca73
xor eax, eax
mov word [ebp - 0x410], ax
lea edx, [ebp - 0x410]
xor esi, esi
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41ca51
mov ecx, dword [ebp - 0x420]
lea eax, [ebp - 0x410]
sub edx, edi
sar edx, 1
push edx
push eax
call fcn.0041a580
neg esi
sbb esi, esi
and esi, 0x80004005
test ebx, ebx
je 0x41ca88
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b42e4
mov esp, ebp
pop ebp
ret
Function at 0x41cab0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x50bd24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x214], 0
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x218]
push edi
push edx
mov edi, dword [eax + 4]
or edi, 0x2001f
mov dword [ebp - 0x220], eax
push edi
push 0
push ecx
push dword [eax]
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x41cc0b
mov eax, dword [ebp - 0x214]
xor esi, esi
test eax, eax
je 0x41cb3c
push eax
call ebx
mov esi, eax
mov eax, dword [ebp - 0x218]
and edi, 0x300
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], edi
test esi, esi
jne 0x41cc0b
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x228]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x208], 0x100
push ecx
lea ecx, [ebp - 0x204]
push ecx
push esi
push eax
call edi
test eax, eax
jne 0x41cbd7
nop dword [eax]
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.0041cab0
mov esi, eax
test esi, esi
jne 0x41cc0b
lea eax, [ebp - 0x228]
mov dword [ebp - 0x208], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
call edi
test eax, eax
je 0x41cb90
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x41cbee
push eax
call ebx
mov dword [ebp - 0x214], 0
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x210], 0
call fcn.0041c800
mov esi, eax
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x41cc18
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b42e4
mov esp, ebp
pop ebp
ret 4
Function at 0x41cc30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 0x18]
mov esi, 3
test edi, edi
je 0x41cc65
lea eax, [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x41cc65
cmp dword [ebp + 0x18], 0
mov eax, 0x103
cmovne esi, eax
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 0
push eax
push esi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41cc88
mov edi, dword [ebp + 0x18]
jmp 0x41ccdd
mov esi, 7
test edi, edi
je 0x41ccb2
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x41ccb2
cmp dword [ebp - 4], 0
mov eax, 0x107
cmovne esi, eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41cd0e
mov edi, dword [ebp - 4]
push 4
lea eax, [ebp + 0x14]
push eax
push 3
push 0
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb esi, esi
and esi, 0x80004005
test edi, edi
je 0x41cd06
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
neg eax
pop edi
sbb eax, eax
and eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41cd20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 0x18]
mov esi, 3
test edi, edi
je 0x41cd55
lea eax, [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x41cd55
cmp dword [ebp + 0x18], 0
mov eax, 0x103
cmovne esi, eax
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 0
push eax
push esi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41cd78
mov edi, dword [ebp + 0x18]
jmp 0x41cdcd
mov esi, 7
test edi, edi
je 0x41cda2
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x41cda2
cmp dword [ebp - 4], 0
mov eax, 0x107
cmovne esi, eax
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41ce04
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb esi, esi
and esi, 0x80004005
test edi, edi
je 0x41cdfc
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
neg eax
pop edi
sbb eax, eax
and eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41ce20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 0x18]
mov esi, 3
test edi, edi
je 0x41ce55
lea eax, [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x41ce55
cmp dword [ebp + 0x18], 0
mov eax, 0x103
cmovne esi, eax
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 0
push eax
push esi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41ce78
mov edi, dword [ebp + 0x18]
jmp 0x41cecd
mov esi, 7
test edi, edi
je 0x41cea2
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x41cea2
cmp dword [ebp - 4], 0
mov eax, 0x107
cmovne esi, eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41cf2b
mov edi, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
cmp dword [edx + 0x14], 8
jb 0x41ced8
mov edx, dword [edx]
test edx, edx
jne 0x41cee1
lea esi, [edx + 0xd]
jmp 0x41cf0e
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cee6
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x80004005
test edi, edi
je 0x41cf23
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
neg eax
pop edi
sbb eax, eax
and eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41cf40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x41cf66
pop edi
mov eax, 0x80004005
pop esi
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41cf5d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x41cf8a
pop ebx
pop edi
mov eax, 0x80004005
pop esi
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push ecx
push eax
push ebx
push dword [ebp + 0x10]
call fcn.0041b610
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x41de60
Capabilities:
Create process on windows
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa14
mov eax, dword [0x50bd24]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xa0c]
push 0x800
push 0
push eax
call fcn.004b5de0
add esp, 0xc
mov dword [ebp - 0xa10], 0
lea eax, [ebp - 0xa14]
push eax
push 1
push 0
push str.http_shellopencommand
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41deef
lea eax, [ebp - 0xa10]
mov dword [ebp - 0xa10], 0x400
push eax
lea eax, [ebp - 0xa0c]
push eax
push 0
push 0
push 0x4e1870
push dword [ebp - 0xa14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 0
push 0
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x41df7e
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004b5de0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x26
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41df7e
push str.Internet_Exploreriexplore.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 1
push 0
push edi
lea eax, [ebp - 0x20c]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x41df7e
mov eax, 0x80004005
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b42e4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.004b42e4
mov esp, ebp
pop ebp
ret

Function at 0x41e750
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x50bd24]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.004b5de0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x114]
cmp eax, 6
ja 0x41e7b6
jne 0x41e7a6
cmp dword [ebp - 0x110], 1
jae 0x41e7b6
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b42e4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.004b42e4
mov esp, ebp
pop ebp
ret