joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405cb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
lea eax, [ebp - 4]
push eax
push 0x433d0c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x405d13
mov ecx, 0x43e210
call fcn.004140e0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00422aab
add esp, 4
shl eax, 1
push eax
mov edx, dword [ebp - 0x10]
push edx
push 1
push 0
push 0x433d34
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 8]
call fcn.004030d0
push 0x433db8
lea ecx, [ebp - 8]
call fcn.00403170
push 0x433dbc
lea ecx, [ebp - 8]
call fcn.00403170
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 8]
call fcn.004140e0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x405e62
push 0x433dc4
push 0x433de0
push 0x43e210
lea eax, [ebp - 0x1c]
push eax
call fcn.00406ae0
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00406ae0
lea ecx, [ebp - 0x1c]
call fcn.00401860
lea ecx, [ebp - 0x14]
call fcn.004140e0
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
call fcn.00422aab
add esp, 4
shl eax, 1
push eax
mov eax, dword [ebp - 0x18]
push eax
push 1
push 0
push 0x433de4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x433e04
call fcn.00422aab
add esp, 4
shl eax, 1
push eax
push 0x433e0c
push 1
push 0
push str.DisplayName
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x433e2c
call fcn.00422aab
add esp, 4
shl eax, 1
push eax
push 0x433e38
push 1
push 0
push str.Publisher
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x433e58
call fcn.00422aab
add esp, 4
shl eax, 1
push eax
push str.http:__www.yy.com_
push 1
push 0
push str.URLInfoAbout
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x433ec4
call fcn.00422aab
add esp, 4
shl eax, 1
push eax
push 0x433ed4
push 1
push 0
push str.DisplayVersion
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x14]
call fcn.00401860
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 8]
call fcn.00401860
mov esp, ebp
pop ebp
ret
Function at 0x406510
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [0x43ce30]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
call fcn.00401c10
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
call fcn.00401310
push 0x5c
push 0x2f
lea ecx, [ebp - 4]
call fcn.00406f00
push 0x5c
lea ecx, [ebp - 4]
call fcn.00406f90
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x406754
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 4]
call fcn.00406e90
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 4]
call fcn.00401c30
push 0x434040
lea ecx, [ebp - 0x10]
call fcn.00403330
test eax, eax
jne 0x4065c5
lea edx, [ebp - 0x14]
push edx
push 0x43e210
lea eax, [ebp - 0x434]
push eax
call fcn.00406bc0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00406d30
lea ecx, [ebp - 0x434]
call fcn.00401860
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 1
jmp 0x406744
push str.AppData
lea ecx, [ebp - 0x10]
call fcn.00403330
test eax, eax
jne 0x40665d
lea ecx, [ebp - 0x18]
call fcn.00401bf0
mov ecx, 0x43e210
call fcn.004140e0
push eax
lea edx, [ebp - 0x450]
push edx
call fcn.0041ef60
add esp, 8
mov ecx, eax
call fcn.00407350
push eax
lea ecx, [ebp - 0x18]
call fcn.00401360
lea ecx, [ebp - 0x450]
call fcn.00407330
lea ecx, [ebp - 0x18]
call fcn.004140e0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x454]
push edx
call fcn.00406bc0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00406d30
lea ecx, [ebp - 0x454]
call fcn.00401860
lea ecx, [ebp - 0x18]
call fcn.00401860
jmp 0x406744
push 0x434068
lea ecx, [ebp - 0x10]
call fcn.00403330
test eax, eax
jne 0x4066c6
push 0x104
lea eax, [ebp - 0x228]
push eax
push 0x434074
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x228]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004030d0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x458]
push ecx
call fcn.00406bc0
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00406d30
lea ecx, [ebp - 0x458]
call fcn.00401860
lea ecx, [ebp - 0x1c]
call fcn.00401860
jmp 0x406744
push 0x434080
lea ecx, [ebp - 0x10]
call fcn.00403330
test eax, eax
jne 0x406744
xor edx, edx
mov word [ebp - 0x430], dx
push 0x206
push 0
lea eax, [ebp - 0x42e]
push eax
call fcn.00422790
add esp, 0xc
lea ecx, [ebp - 0x430]
push ecx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x430]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00401360
push str.duowanyyyypip
mov ecx, dword [ebp + 0xc]
call fcn.00403170
mov ecx, dword [ebp + 0xc]
call fcn.004140e0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00406a90
lea ecx, [ebp - 0x14]
call fcn.00401860
lea ecx, [ebp - 0x10]
call fcn.00401860
lea ecx, [ebp - 4]
call fcn.00401860
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00422540
mov esp, ebp
pop ebp
ret
Function at 0x406770
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x68], ecx
push str.yywizard.exe
push 0x4340c8
push 0x43e210
lea eax, [ebp - 0x64]
push eax
call fcn.00406ae0
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.00406ae0
lea ecx, [ebp - 0x64]
call fcn.00401860
mov dword [ebp - 0x60], 0
push 0x40
push 0
lea edx, [ebp - 0x5c]
push edx
call fcn.00422790
add esp, 0xc
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x60], 0x44
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x60]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 4]
call fcn.004140e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x406821
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 4]
call fcn.00401860
mov esp, ebp
pop ebp
ret
Function at 0x40af90
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x3c], ecx
push 0xffffffffffffffff
push 1
mov ecx, dword [ebp - 0x3c]
call fcn.0040bd30
mov eax, dword [ebp - 0x3c]
mov byte [eax + 0x50], 1
lea ecx, [ebp - 0xc]
call fcn.00401bf0
push 0x427
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x3c]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.004140e0
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402360
push 3
lea edx, [ebp - 4]
push edx
mov ecx, 0x43e210
call fcn.00406e90
fldz
fstp qword [ebp - 0x18]
push 8
call fcn.004235a1
add esp, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
lea ecx, [ebp - 4]
call fcn.004140e0
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x40b0ea
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x48], edx
and dword [ebp - 0x40], 0x7fffffff
fild qword [ebp - 0x44]
and dword [ebp - 0x48], 0x80000000
mov dword [ebp - 0x4c], 0
fild qword [ebp - 0x4c]
fchs
faddp st(1)
fdiv qword [0x4348e8]
fstp qword [ebp - 0x18]
sub esp, 8
fld qword [ebp - 0x18]
fstp qword [esp]
push 0x434898
lea eax, [ebp - 0xc]
push eax
call fcn.00408510
add esp, 0x10
lea ecx, [ebp - 0xc]
call fcn.004140e0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004018c0
push 5
lea ecx, [ebp - 0x1c]
call fcn.004030b0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x58], ecx
and dword [ebp - 0x50], 0x7fffffff
fild qword [ebp - 0x54]
and dword [ebp - 0x58], 0x80000000
mov dword [ebp - 0x5c], 0
fild qword [ebp - 0x5c]
fchs
faddp st(1)
fdiv qword [0x4348e0]
fstp qword [ebp - 0x28]
fld qword [0x434880]
fcomp qword [ebp - 0x28]
fnstsw ax
test ah, 0x41
jne 0x40b0e8
mov edx, dword [ebp - 0x3c]
mov byte [edx + 0x50], 0
jmp 0x40b0f4
push 0
lea ecx, [ebp - 0x1c]
call fcn.004030b0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.00422164
add esp, 4
mov dword [ebp - 8], 0
mov dword [ebp - 0x38], 1
lea ecx, [ebp - 4]
call fcn.00401860
lea ecx, [ebp - 0xc]
call fcn.00401860
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40c110
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0
je 0x40c12a
mov eax, dword [ebp - 0x40]
sub eax, 0x50
mov dword [ebp - 0x44], eax
jmp 0x40c131
mov dword [ebp - 0x44], 0
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 1
cmp dword [ebp + 0x14], 0
je 0x40c1bd
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.004140e0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0xffffffff
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.0040a6c0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40c1ac
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.00401f30
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jge 0x40c1bb
mov dword [ebp - 4], 0
jmp 0x40c1d8
mov ecx, dword [ebp + 0xc]
call fcn.004140e0
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.0040a690
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40c1f3
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x50
call fcn.0040a8a0
jmp 0x40c256
cmp dword [ebp + 0x14], 0
je 0x40c256
cmp dword [ebp + 0x18], 0
je 0x40c256
mov ecx, dword [ebp + 0xc]
call fcn.00401c10
cmp eax, dword [ebp + 0x1c]
jle 0x40c256
mov dword [ebp - 0x38], 1
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
call fcn.00401c10
mov dword [ebp - 0x30], eax
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x50
call fcn.0040c3f0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x18
Function at 0x40d900
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x74], 0
jle 0x40d940
push 0x41a
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.004140e0
push eax
lea ecx, [ebp - 0x10]
call fcn.00402360
push 5
lea ecx, [ebp - 0x10]
call fcn.004030b0
push 0x3fe
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.004140e0
push eax
lea ecx, [ebp - 0xc]
call fcn.00402360
push 0
lea ecx, [ebp - 0xc]
call fcn.004030b0
push 0x384
mov ecx, dword [ebp - 0x24]
add ecx, 0x5c
call fcn.00407290
push 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x5c
call fcn.004030b0
push 5
mov ecx, dword [ebp - 0x24]
add ecx, 0x60
call fcn.004030b0
push 0x40b
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00401900
mov ecx, eax
call fcn.004140e0
push eax
lea ecx, [ebp - 8]
call fcn.00402360
push 5
lea ecx, [ebp - 8]
call fcn.004030b0
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 0x74], 0
jne 0x40da00
lea ecx, [ebp - 0x14]
call fcn.00401bf0
push 0xf7
lea ecx, [ebp - 0x14]
call fcn.00401d90
lea ecx, [ebp - 0x14]
call fcn.004140e0
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x64
call fcn.004018c0
lea ecx, [ebp - 0x14]
call fcn.00401860
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x58], 1
push 0
push 0
mov eax, dword [ebp - 0x24]
push eax
push 0x40dc00
push 0
push 0
call fcn.004226dd
add esp, 0x18
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x84], eax
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 4
call fcn.00406b60
push 1
lea ecx, [ebp - 4]
call fcn.0040e300
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40deb0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0x2c], 0x103
jne 0x40dee6
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x80]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x84]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 4], 0x103
jne 0x40df13
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea ecx, [ebp - 0x28]
call fcn.0040c4c0
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403590
cmp eax, 1
jne 0x40df47
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x28]
call fcn.0040c4e0
mov eax, dword [ebp - 0x30]
jmp 0x40df95
cmp dword [ebp - 0x2c], 0x103
jne 0x40df60
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [ebp - 4], 0x103
jne 0x40df79
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x84]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x34], 1
lea ecx, [ebp - 0x28]
call fcn.0040c4e0
mov eax, dword [ebp - 0x34]
jmp 0x40df95
mov esp, ebp
pop ebp
ret

Function at 0x410780
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x43ce30]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, 0x43e210
call fcn.00410d70
test eax, eax
jne 0x4107a6
jmp 0x41084f
lea eax, [ebp - 8]
push eax
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4107f4
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4107f2
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x43e210
call fcn.00401360
push str.duowanyy
mov ecx, 0x43e210
call fcn.00403170
jmp 0x410803
push str.C:Program_Filesduowanyy
mov ecx, 0x43e210
call fcn.00401360
push 0x435714
lea ecx, [ebp - 0xc]
call fcn.004030d0
lea ecx, [ebp - 0xc]
call fcn.00410d70
test eax, eax
jne 0x410847
lea ecx, [ebp - 0xc]
push ecx
push 0x435718
lea edx, [ebp - 0x21c]
push edx
call fcn.00410d90
push eax
mov ecx, 0x43e210
call fcn.00406a90
lea ecx, [ebp - 0x21c]
call fcn.00401860
lea ecx, [ebp - 0xc]
call fcn.00401860
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422540
mov esp, ebp
pop ebp
ret
Function at 0x4109b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x43ce30]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
push 0
lea eax, [ebp - 0x330]
push eax
call fcn.00422790
add esp, 0xc
mov dword [ebp - 0x330], 0x114
lea ecx, [ebp - 0x330]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x32c], 4
jbe 0x410a0b
cmp dword [ebp - 0x32c], 5
jne 0x410a0f
cmp dword [ebp - 0x328], 0
jne 0x410a0f
mov al, 1
jmp 0x410a49
push 0x104
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.00410890
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x410a47
xor al, al
jmp 0x410a49
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422540
mov esp, ebp
pop ebp
ret
Function at 0x4127a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x43ce30]
xor eax, ebp
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x454], ecx
call fcn.004120f0
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x2c]
call fcn.00415270
mov eax, dword [ebp - 0x454]
push eax
lea ecx, [ebp - 0x18]
call fcn.00412a90
lea ecx, [ebp - 0x438]
call fcn.00415270
push 0x400
mov ecx, dword [ebp + 8]
push ecx
call fcn.00412150
add esp, 8
mov dword [ebp - 8], eax
push 2
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41281e
call fcn.00412180
mov dword [ebp - 0x444], eax
jmp 0x412973
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
jne 0x41284f
call fcn.00412180
mov dword [ebp - 0x444], eax
jmp 0x412973
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
jne 0x41287f
call fcn.00412180
mov dword [ebp - 0x444], eax
jmp 0x412973
mov edx, dword [ebp - 0x440]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x1c]
add edx, 1
cmp edx, dword [ebp - 0x1c]
jae 0x4128cf
mov dword [ebp - 0x44c], 0x8007000e
lea ecx, [ebp - 0x438]
call fcn.00415640
lea ecx, [ebp - 0x2c]
call fcn.00415290
mov eax, dword [ebp - 0x44c]
jmp 0x4129a8
mov eax, dword [ebp - 0x1c]
add eax, 1
push eax
lea ecx, [ebp - 0x438]
call fcn.00415610
lea ecx, [ebp - 0x438]
call fcn.004140e0
test eax, eax
jne 0x4128fc
mov dword [ebp - 0x444], 0x8007000e
jmp 0x412973
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x438]
call fcn.004140e0
push eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0
call fcn.004120f0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
jne 0x41293e
call fcn.00412180
mov dword [ebp - 0x444], eax
jmp 0x412973
lea ecx, [ebp - 0x438]
call fcn.004140e0
xor ecx, ecx
mov edx, dword [ebp - 0x43c]
mov word [eax + edx*2], cx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x438]
call fcn.004140e0
push eax
lea ecx, [ebp - 0x18]
call fcn.00412ac0
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x10], 0
je 0x412983
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0x444]
mov dword [ebp - 0x450], edx
lea ecx, [ebp - 0x438]
call fcn.00415640
lea ecx, [ebp - 0x2c]
call fcn.00415290
mov eax, dword [ebp - 0x450]
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.00422540
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4142d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x43ce30]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00414090
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00414270
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41433b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.004140c0
mov eax, dword [ebp - 0x224]
jmp 0x4143cc
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4143a1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004142d0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x414398
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.004140c0
mov eax, dword [ebp - 0x228]
jmp 0x4143cc
mov dword [ebp - 4], 0x100
jmp 0x414342
lea ecx, [ebp - 0x14]
call fcn.004141b0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00414150
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.004140c0
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00422540
mov esp, ebp
pop ebp
ret 4