joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bde0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [str.00000000000000000000000000000000]
mov eax, ebp
nop
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43be18
test cl, cl
je 0x43be14
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43be18
add eax, 2
add esi, 2
test cl, cl
jne 0x43bdf0
xor eax, eax
jmp 0x43be1d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43be34
push ebp
mov ecx, 0x4ccb08
call fcn.0044bc70
test eax, eax
je 0x43bf6d
mov al, byte [0x4cc974]
test al, al
je 0x43be89
push str.config_partner.ini
lea eax, [esp + 0x14]
push 0x4cbdc0
push eax
call fcn.004010a0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 1
push str.readwebclick
push str.partner
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [esp + 0x10]
inc bl
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
test bl, bl
jne 0x43bf6d
push edi
push 0x360
call sub.MFC71.DLL_operator_new_1
mov esi, eax
add esp, 4
test esi, esi
je 0x43beaa
mov ecx, 0xd8
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
jmp 0x43beac
xor esi, esi
test ebp, ebp
je 0x43bec0
mov edx, esi
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x43beb6
movzx ecx, byte [esp + 0x38]
mov eax, dword [esp + 0x24]
test eax, eax
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x35c], ecx
mov dword [esi + 0x50], edx
jne 0x43bee3
mov dword [esi + 0x44], 0xffffff
jmp 0x43bee6
mov dword [esi + 0x44], eax
mov eax, dword [esp + 0x28]
mov cx, word [esp + 0x34]
mov dx, word [esp + 0x30]
mov dword [esi + 0x48], eax
mov eax, dword [esp + 0x20]
test eax, eax
mov word [esi + 0x4e], cx
mov word [esi + 0x4c], dx
je 0x43bf2d
mov ecx, eax
lea edi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x43bf10
sub ecx, edi
cmp ecx, 0x20
jae 0x43bf2d
lea edx, [esi + 0x24]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x43bf23
mov eax, dword [esp + 0x18]
test eax, eax
pop edi
je 0x43bf4a
lea edx, [esi + 0x158]
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x43bf40
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43bf61
lea edx, [esi + 0x54]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x43bf57
mov ecx, dword [0x4ccb50]
push esi
call fcn.004244e0
pop esi
pop ebp
pop ebx
ret 0x28
Function at 0x43cb80
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4a6cc1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebp
mov ebp, dword [sym.imp.MSVCR71.dll_malloc]
push esi
push 0x400
mov dword [esp + 0x14], ecx
call ebp
mov esi, eax
add esp, 4
test esi, esi
jne 0x43cbca
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push edi
push esi
xor eax, eax
mov ecx, 0x100
mov edi, esi
push 0x400
rep stosd dword es:[edi], eax
call ebx
cmp eax, 0x400
jle 0x43cc1e
push esi
lea edi, [eax + 1]
call dword [sym.imp.MSVCR71.dll_free]
push edi
call ebp
mov esi, eax
add esp, 8
test esi, esi
jne 0x43cc1a
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
push esi
push edi
call ebx
cdq
and edx, 3
add eax, edx
mov ebp, eax
lea ecx, [esp + 0x1c]
sar ebp, 2
call fcn.004a117a
test ebp, ebp
mov dword [esp + 0x3c], 0
jle 0x43ccce
lea edi, [esp + 0x14]
mov ebx, esi
sub edi, esi
lea ebx, [ebx]
mov dword [esp + 0x14], 0
mov eax, ebx
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x43cc60
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push str._spipi_reserved_cache
push ecx
mov byte [esp + 0x48], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0xc
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x43ccbb
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x2c]
add ecx, 0x24
lea edx, [esp + 0x10]
push edx
push eax
call sub.MFC71.DLL_CStringArray::SetAtGrow_1
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
sub edi, 4
add ebx, 4
dec ebp
jne 0x43cc50
push esi
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 0xffffffff
call sub.MFC71.DLL_CFileFind::CFileFind
mov ecx, dword [esp + 0x34]
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x43e2a9
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4a6eae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call sub.MFC71.DLL_CHtmlView::CHtmlView
xor ebx, ebx
lea ecx, [esi + 0xf4]
mov dword [esp + 0x1c], ebx
mov dword [esi], fcn.0043d7d0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
lea ecx, [esi + 0x124]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
lea edi, [esi + 0x128]
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
push str.config_config.ini
lea eax, [esp + 0x10]
push 0x4cbdc0
push eax
mov byte [esp + 0x28], 3
call fcn.004010a0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push 0x4b377c
push 0x4ac6b4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0xc]
mov dword [esi + 0x11c], eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0xc]
push ecx
mov dword [esi + 0x120], ebx
call fcn.0043db70
add esp, 4
push eax
mov ecx, edi
mov byte [esp + 0x20], 4
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_1]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x118], ebx
mov dword [esi + 0x114], ebx
mov dword [esi + 0x110], ebx
mov dword [esi + 0x10c], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x43ee60
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
call ebx
mov ebp, eax
call ebx
mov ecx, dword [esp + 0x34]
sub eax, ebp
cmp eax, ecx
jae 0x43ef3e
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
add esi, 0x14c8
mov dword [esp + 0x10], esi
test eax, eax
jne 0x43ee9d
mov eax, dword [esp + 0x34]
push 0
push 0x1ff
push eax
mov eax, dword [esp + 0x1c]
push eax
push 1
call edi
mov esi, eax
test esi, esi
je 0x43eeff
cmp esi, 0x102
je 0x43eeff
cmp esi, 0xffffffff
je 0x43eeff
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x43eeff
mov eax, dword [esp + 0x18]
cmp eax, 0x12
je 0x43ef17
cmp eax, dword [0x4ccacc]
je 0x43ef17
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
call ebx
mov ecx, dword [esp + 0x34]
sub eax, ebp
cmp eax, ecx
jb 0x43ee95
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
pop edi
pop esi
pop ebp
mov eax, 0x42b
pop ebx
add esp, 0x20
ret 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x43ef50
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4cbba0]
xor eax, esp
push esi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
push 0
push eax
push 2
call dword [sym.imp.WS2_32.dll_socket]
xor ecx, ecx
mov dword [esp + 0xc], ecx
push 0x10
mov dword [esp + 0x14], ecx
lea edx, [esp + 0x10]
mov dword [esp + 0x18], ecx
mov esi, eax
push edx
push esi
mov dword [esp + 0x24], ecx
mov word [esp + 0x18], 2
mov dword [esp + 0x1c], ecx
mov word [esp + 0x1a], cx
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jl 0x43efe2
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0xffff
push esi
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x43efe2
lea ecx, [esp + 4]
push ecx
push 0x8004667e
push esi
mov dword [esp + 0x10], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x43effe
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004a17d1
add esp, 0x1c
ret 4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004a17d1
add esp, 0x1c
ret 4
Function at 0x447de0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
push edi
lea edi, [eax + 1]
jmp 0x447df0
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x447df0
mov ecx, dword [ecx + 4]
sub eax, edi
inc eax
push eax
mov eax, dword [esp + 0x10]
push esi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret 8

Function at 0x447e20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx + 4]
push 0
push edx
push eax
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x447e63
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov dword [ecx], edx
mov eax, 1
add esp, 8
ret 8
xor eax, eax
add esp, 8
ret 8

Function at 0x447e70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa04
mov eax, dword [0x4cbba0]
xor eax, esp
push esi
mov esi, dword [esp + 0xa10]
lea edx, [esp + 4]
push edx
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0xa10], eax
mov eax, dword [esp + 0xa18]
push 0
push eax
mov eax, dword [ecx + 4]
push eax
mov dword [esp + 0x1c], 0x22a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x447ee5
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
mov eax, 1
pop esi
mov ecx, dword [esp + 0xa00]
xor ecx, esp
call fcn.004a17d1
add esp, 0xa04
ret 8
push 0
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
mov ecx, dword [esp + 0xa04]
pop esi
xor ecx, esp
xor eax, eax
call fcn.004a17d1
add esp, 0xa04
ret 8
Function at 0x44b640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a7813
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x44b820
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4a7855
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
lea ecx, [esp + 0x1c]
call fcn.004a117a
lea ecx, [esp + 4]
mov dword [esp + 0x3c], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
mov bl, 2
push 0
mov byte [esp + 0x40], bl
call dword [sym.imp.MSVCR71.dll__time64]
add esp, 4
mov dword [esp + 0x14], eax
push str._Y_m_d
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], edx
call fcn.00407c50
mov ecx, dword [eax]
push ecx
lea edx, [esp + 0xc]
push str.sys_msg__s.log
push edx
mov byte [esp + 0x48], 3
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0xc
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], bl
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
push 0x4cbdc0
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_1]
push str.config_sys_msg_.log
lea ecx, [esp + 8]
call dword [0x4ab278]
push 0
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea ecx, [esp + 0x24]
call sub.MFC71.DLL_CFileFind::FindFile
test eax, eax
je 0x44b98a
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x24]
call sub.MFC71.DLL_CFileFind::FindNextFileA
mov esi, eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
call sub.MFC71.DLL_CFileFind::GetFileName
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 4
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_1]
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], bl
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Compare]
test eax, eax
je 0x44b980
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x28]
call sub.MFC71.DLL_CFileFind::GetFilePath
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 5
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_1]
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], bl
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call edi
test esi, esi
jne 0x44b8f7
pop edi
pop esi
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 0xffffffff
call sub.MFC71.DLL_CFileFind::CFileFind
mov ecx, dword [esp + 0x34]
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x44cae0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4a7ae4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8c
mov eax, dword [0x4cbba0]
xor eax, esp
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0xb0]
push edi
push eax
mov esi, ecx
push 0x82
mov dword [esp + 0x1c], esi
call fcn.004a105a
push 0
push 0x4000
lea eax, [esi + 0x4138]
lea edi, [esi + 0x74]
push eax
mov ecx, edi
mov dword [esp + 0xb0], 0
call fcn.0048fc00
mov dword [edi], 0x4b46c8
lea edi, [esi + 0xb0]
mov ecx, edi
mov byte [esp + 0xa4], 1
mov dword [esi], 0x4b4568
call sub.MFC71.DLL_CWnd::CWnd
mov dword [edi], 0x4b4400
lea edi, [esi + 0x104]
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
lea ebx, [esi + 0x10c]
mov ecx, ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
lea ecx, [esi + 0x110]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
lea ecx, [esi + 0x114]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
lea ecx, [esi + 0x118]
mov byte [esp + 0xa4], 6
call fcn.004a1282
lea ecx, [esi + 0x128]
mov byte [esp + 0xa4], 7
call fcn.004a1282
push ebp
mov ecx, ebx
mov byte [esp + 0xa8], 8
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
mov ecx, dword [esp + 0xb0]
push str.configenumwindow.ini
lea edx, [esp + 0x14]
push 0x4cbdc0
push edx
mov dword [esi + 0x108], ecx
call fcn.004010a0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x80
lea eax, [esp + 0x20]
push eax
push str.PIPI
push str.NAME
push str.MSGWINDOW
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x18]
push ecx
push str._s
push edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
mov ecx, dword [esp + 0xa8]
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x8c]
pop ebx
xor ecx, esp
call fcn.004a17d1
add esp, 0x98
ret 0xc
Function at 0x44d8d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
mov edx, dword [esp + 0x48]
push edi
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x54]
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x3c
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
add esp, 0x3c
ret

Function at 0x44da30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44daaa
mov eax, 4
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push 0
push str.EnableLUA
push ecx
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, ecx
setne al
add esp, 0x10
ret
Function at 0x44db50
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x804
mov eax, dword [0x4cbba0]
xor eax, esp
push esi
mov esi, ecx
mov dword [esp + 0x804], eax
mov al, byte [esi + 0x14]
test al, al
jne 0x44dc88
push ebx
push ebp
push edi
push 0x400
lea eax, [esp + 0x414]
push eax
mov byte [esp + 0x418], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [sym.imp.MSVCR71.dll_sprintf]
lea ecx, [esp + 0x410]
push ecx
lea edx, [esp + 0x14]
push str._suser32.dll
push edx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x18], eax
je 0x44dbdf
push str.ChangeWindowMessageFilter
push eax
call ebp
mov ecx, dword [esi + 0x18]
push str.ChangeWindowMessageFilterEx
push ecx
mov dword [esi], eax
call ebp
mov dword [esi + 4], eax
lea edx, [esp + 0x410]
push edx
lea eax, [esp + 0x14]
push str._skernel32.dll
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
call ebx
test eax, eax
mov dword [esi + 0x1c], eax
je 0x44dc0f
push str.WTSGetActiveConsoleSessionId
push eax
call ebp
mov dword [esi + 8], eax
lea edx, [esp + 0x410]
push edx
lea eax, [esp + 0x14]
push str._swtsapi32.dll
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
call ebx
test eax, eax
mov dword [esi + 0x20], eax
je 0x44dc3f
push str.WTSQueryUserToken
push eax
call ebp
mov dword [esi + 0xc], eax
lea edx, [esp + 0x410]
push edx
lea eax, [esp + 0x14]
push str._s_advapi32.dll
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
call ebx
test eax, eax
mov dword [esi + 0x24], eax
je 0x44dc81
push str.CreateProcessAsUser
push eax
call ebp
test eax, eax
mov dword [esi + 0x10], eax
jne 0x44dc81
mov edx, dword [esi + 0x24]
push str.CreateProcessAsUserA
push edx
call ebp
mov dword [esi + 0x10], eax
pop edi
pop ebp
mov byte [esi + 0x14], 1
pop ebx
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.004a17d1
add esp, 0x804
ret

Function at 0x44dd10
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4cbba0]
xor eax, esp
mov dword [esp + 0x94], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x44dd62
cmp dword [esp + 0x10], 2
jne 0x44dd62
cmp dword [esp + 4], 6
jb 0x44dd62
mov eax, 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.004a17d1
add esp, 0x98
ret
mov ecx, dword [esp + 0x94]
xor ecx, esp
xor eax, eax
call fcn.004a17d1
add esp, 0x98
ret
Function at 0x44dd80
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x330
mov eax, dword [0x4cbba0]
xor eax, esp
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 2
mov dword [esp + 0x340], eax
mov edi, ecx
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x44ddc1
lea eax, [esp + 0x10]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x44ddc8
xor eax, eax
jmp 0x44dea3
mov ecx, edi
call fcn.0044dd10
test eax, eax
je 0x44de08
mov ecx, dword [str.winlogon.exe]
mov edx, dword [0x4b4ad4]
mov eax, dword [0x4b4ad8]
mov dword [esp + 0x138], ecx
mov cl, byte [0x4b4adc]
mov dword [esp + 0x13c], edx
mov dword [esp + 0x140], eax
mov byte [esp + 0x144], cl
jmp 0x44de3b
mov edx, dword [str.explorer.exe]
mov eax, dword [0x4b4ac4]
mov ecx, dword [0x4b4ac8]
mov dword [esp + 0x138], edx
mov dl, byte [0x4b4acc]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
mov byte [esp + 0x144], dl
mov edi, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push ebp
mov ebp, dword [esp + 0x344]
lea esp, [esp]
lea eax, [esp + 0x13c]
push eax
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.MSVCR71.dll__stricmp]
add esp, 8
test eax, eax
jne 0x44de84
lea edx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
push edx
push eax
call edi
test eax, eax
je 0x44de84
cmp dword [esp + 0x10], ebp
je 0x44de95
lea ecx, [esp + 0x14]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x44de50
jmp 0x44de99
mov ebx, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebp
mov ecx, dword [esp + 0x338]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a17d1
add esp, 0x330
ret 4

Function at 0x44dec0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov dword [esp + 4], eax
lea ecx, [esp + 4]
push ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea edx, [esp + 0x18]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x7c]
push eax
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x44df31
mov eax, dword [esp + 4]
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x44df1d
push eax
call esi
mov eax, dword [esp + 4]
test eax, eax
je 0x44df28
push eax
call esi
mov al, 1
pop esi
add esp, 0x54
ret 4
xor al, al
add esp, 0x54
ret 4
Function at 0x44e950
Capabilities:
Encode data using xor

Disassembly:
mov cx, word [edx]
xor eax, eax
test cx, cx
je 0x44e978
lea ebx, [ebx]
imul eax, eax, 0xf4243
movzx ecx, cx
xor eax, ecx
add edx, 2
xor ecx, ecx
mov cx, word [edx]
test cx, cx
jne 0x44e960
ret