joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fce21
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x55fe50]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x4fce65
cmp word [edx], bx
jne 0x4fce65
or byte [edi + eax + 0x28], 4
jmp 0x4fce6a
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x4fcfbe
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x4fcf9e
cmp ax, word [ebp - 0x10]
je 0x4fcea3
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x4fcf93
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x4fcec9
push 0xa
pop ecx
cmp word [eax], cx
jne 0x4fceb9
push ecx
pop eax
push 4
jmp 0x4fcebe
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x4fcf8d
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4fcf84
cmp dword [ebp - 0x18], 0
je 0x4fcf84
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x55fe50]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x4fcf50
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x4fcf14
mov word [esi], ax
jmp 0x4fcf48
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x55fe50]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x55fe50]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x55fe50]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x4fcf93
cmp word [ebp - 4], ax
jne 0x4fcf65
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4fcf65
mov word [esi], ax
add esi, 2
jmp 0x4fcf93
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004e912b
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4fcf90
jmp 0x4fcf87
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x4fce83
jmp 0x4fcfbe
mov ecx, dword [ecx*4 + 0x55fe50]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x4fcfb5
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x4fcfbe
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x503032
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00502cd4
Function at 0x401330
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40134b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401382
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40137e
jmp 0x401370
cmp esi, eax
jae 0x401382
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401370
cmp esi, eax
jb 0x401389
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403250
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
call fcn.00427480
mov dword [ebp - 8], eax
push 5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4032a8
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4032c2
push 0x113
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcdlgcore.cpp
call fcn.0043fd50
test eax, eax
je 0x4032c2
int3
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.00403300
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.004031b0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x40afe0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40b010
push 0x477
push 0x6307f8
call fcn.0043fd50
test eax, eax
je 0x40b010
int3
mov eax, dword [ebp - 8]
cmp dword [eax + 0x6c], 0
jne 0x40b056
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00415fb0
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
call fcn.00415fe0
jmp 0x40b070
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x6c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x6c]
mov edx, dword [eax]
mov eax, dword [edx + 0x94]
call eax
mov esp, ebp
pop ebp
ret 4

Function at 0x40b080
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40b0b0
push 0x48c
push 0x6307f8
call fcn.0043fd50
test eax, eax
je 0x40b0b0
int3
push 0x630a27
mov ecx, dword [ebp + 0xc]
call fcn.00401a70
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x68], 0
jne 0x40b117
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40b115
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
add edx, 1
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00415fb0
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.00415fe0
jmp 0x40b138
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.004176c0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40b138
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.0040afe0
mov ecx, dword [ebp + 0xc]
call fcn.00401670
mov esp, ebp
pop ebp
ret 8
Function at 0x412a70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x412af5
call fcn.00427480
mov dword [ebp - 0x10], eax
push pe_nt_image_headers32
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x412af5
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x412ace
xor eax, eax
jmp 0x412b26
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x412af5
push 0x117f
push 0x6307f8
call fcn.0043fd50
test eax, eax
je 0x412af5
int3
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00412b30
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x412b23
cmp dword [ebp - 0xc], 0
je 0x412b23
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004031b0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x417ba0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x619778
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x6912e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x417bf8
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x6c], 0
jne 0x417bf8
push 0x100
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcwinocc.cpp
call fcn.0043fd50
test eax, eax
je 0x417bf8
int3
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x6c], 0
jne 0x417c1a
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x417c7d
lea ecx, [ebp - 0x10]
call fcn.00401d90
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x6c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x6c]
mov edx, dword [edx]
mov eax, dword [edx + 0x94]
call eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00401680
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00417c90
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401bb0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x41b7d0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.0041b420
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x41b826
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.00415fb0
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.00415fe0
jmp 0x41b838
mov ecx, dword [ebp + 0x10]
call fcn.00401680
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00440050
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41b920
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
call fcn.00417730
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 3
cmp eax, 3
je 0x41b95d
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041b420
jmp 0x41b969
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041b450
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x41b9cd
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x41b9a4
mov edx, dword [ebp - 8]
add edx, 1
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00415fb0
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41b9c1
push 0x100
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.00401830
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.00415fe0
jmp 0x41b9fe
mov ecx, dword [ebp + 0x10]
call fcn.00401680
push eax
push 0xffffffffffffffff
push 0x14d
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x41b9fe
mov ecx, dword [ebp + 0x10]
call fcn.00401680
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00440050
mov esp, ebp
pop ebp
ret 0xc
Function at 0x432450
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0
jne 0x432475
push 0x8d
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.0043fd50
test eax, eax
je 0x432475
int3
cmp dword [ebp + 0xc], 0
jne 0x43248f
push 0x8e
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.0043fd50
test eax, eax
je 0x43248f
int3
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x58], 0
je 0x432531
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.004323a0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4324bb
mov eax, dword [ebp + 0x10]
jmp 0x432567
mov dword [ebp - 0xc], 4
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
jne 0x43252a
cmp dword [ebp - 4], 4
je 0x43250b
push 0x9c
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.0043fd50
test eax, eax
je 0x43250b
int3
cmp dword [ebp - 0xc], 4
je 0x432525
push 0x9d
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.0043fd50
test eax, eax
je 0x432525
int3
mov eax, dword [ebp - 0x14]
jmp 0x432567
mov eax, dword [ebp + 0x10]
jmp 0x432567
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x6c], 0
jne 0x43254e
push 0xa4
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfc_appui3.cpp
call fcn.0043fd50
test eax, eax
je 0x43254e
int3
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x6c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4339d0
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x433a58
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x433a18
push str.hAdvAPI32___0
push 0
push 0x28c
push str.f:dd_vctools_vc7libs_ship_atlmfcinclude_atltransactionmanager.h
push 2
call fcn.005e3450
add esp, 0x14
cmp eax, 1
jne 0x433a18
int3
cmp dword [ebp - 8], 0
jne 0x433a25
mov eax, 1
jmp 0x433a76
push str.RegDeleteKeyTransactedA
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x433a56
push 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x433a76
jmp 0x433a71
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 4], 0
je 0x433a71
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x433a76
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x456b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
je 0x456b51
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
jmp 0x456bac
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x456b75
call fcn.0042db00
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x456b94
call fcn.0042db00
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x456bac
call fcn.0042db00
call fcn.00441640
cmp dword [eax + 0x3c], 0
je 0x456bc6
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00456ad0
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00456980
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x7c], 0
je 0x456bf6
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x7c], 0
cmp dword [ebp - 4], 0
je 0x456c0b
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov dword [edx + 0x7c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4699a0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
call fcn.0041a870
movzx eax, al
test eax, eax
jne 0x4699dd
mov ecx, dword [ebp + 8]
call fcn.00401680
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4699dd
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x90
call fcn.004db160
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x46c800
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x46c834
push str.m_hKey___0
push 0
push 0x1629
push 0x638ca8
push 2
call fcn.005e3450
add esp, 0x14
cmp eax, 1
jne 0x46c834
int3
xor edx, edx
jne 0x46c834
xor eax, eax
jne 0x46c80b
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], 0
je 0x46c85c
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 8]
call fcn.004339d0
jmp 0x46c8ca
movzx eax, byte [0x7a5eb4]
test eax, eax
jne 0x46c896
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46c88f
push str.RegDeleteKeyExA
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x7a5eb0], eax
mov byte [0x7a5eb4], 1
cmp dword [0x7a5eb0], 0
je 0x46c8ba
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [0x7a5eb0]
jmp 0x46c8ca
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret 4

Function at 0x46ef30
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x10], 0
je 0x46ef53
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0046f740
mov dword [ebp - 8], eax
jmp 0x46ef64
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x46ef80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00448c20
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46ef90
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0
je 0x46efaf
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0046f6a0
mov dword [ebp - 8], eax
jmp 0x46efbc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x46efd8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00448c20
mov esp, ebp
pop ebp
ret 8
Function at 0x46f6a0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x46f71b
push 0x63d7dc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46f6e8
push str.hKernel32___0
push 0
push 0x191
push str.f:dd_vctools_vc7libs_ship_atlmfcinclude_atltransactionmanager.h
push 2
call fcn.005e3450
add esp, 0x14
cmp eax, 1
jne 0x46f6e8
int3
cmp dword [ebp - 8], 0
jne 0x46f6f2
xor eax, eax
jmp 0x46f732
push str.DeleteFileTransactedA
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46f719
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
jmp 0x46f732
jmp 0x46f730
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
je 0x46f730
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x46f732
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x46f740
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x46f7c5
push 0x63d7dc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x46f788
push str.hKernel32___0
push 0
push 0x1b2
push str.f:dd_vctools_vc7libs_ship_atlmfcinclude_atltransactionmanager.h
push 2
call fcn.005e3450
add esp, 0x14
cmp eax, 1
jne 0x46f788
int3
cmp dword [ebp - 4], 0
jne 0x46f792
xor eax, eax
jmp 0x46f7e0
push str.MoveFileTransactedA
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x46f7c3
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
push 2
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
jmp 0x46f7e0
jmp 0x46f7de
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 4], 0
je 0x46f7de
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x46f7e0
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4986c0
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4986f2
push str.m_hKey___0
push 0
push 0x164f
push 0x638ca8
push 2
call fcn.005e3450
add esp, 0x14
cmp eax, 1
jne 0x4986f2
int3
xor edx, edx
jne 0x4986f2
xor eax, eax
jne 0x4986c9
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret 4