joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8c6edd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x8f98dc
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x919630]
xor eax, esp
mov dword [esp + 0x180], eax
push ebx
push esi
push edi
mov eax, dword [0x919630]
xor eax, esp
push eax
lea eax, [esp + 0x198]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea eax, [esp + 0x108]
mov ebx, ecx
push eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
call fcn.008c5657
pop ecx
and dword [esp + 0x1a0], 0
push edi
lea eax, [esp + 0x128]
call fcn.008c570b
pop ecx
xor edx, edx
inc edx
mov dword [esp + 0x1a0], edx
cmp dword [esp + 0x118], 0
je 0x8c6fa6
push edx
lea eax, [esp + 0x10c]
push eax
lea edi, [esp + 0x148]
call fcn.008c6186
push esi
lea ecx, [esp + 0x128]
push ecx
mov ecx, eax
mov byte [esp + 0x1a8], 2
call fcn.008c6edd
mov esi, edi
mov byte [esp + 0x1a0], 1
call fcn.008c620a
jmp 0x8c7133
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
jb 0x8c6fb7
mov eax, dword [esi]
mov dword [esp + 0x10], eax
jmp 0x8c6fbb
mov dword [esp + 0x10], esi
cmp dword [edi + 0x14], 0x10
jb 0x8c6fc5
mov esi, dword [edi]
jmp 0x8c6fc7
mov esi, edi
mov eax, dword [ebx]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc ecx
push ecx
push dword [esp + 0x14]
push edx
push 0
push esi
push eax
call ebx
mov dword [esp + 0x10], eax
test eax, eax
je 0x8c70b6
push str.set_string_value
lea ecx, [esp + 0xf0]
call fcn.008a5b5f
and dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 0xf
mov byte [esp + 0xd0], 0
push edi
lea eax, [esp + 0xf0]
push eax
lea eax, [esp + 0x148]
push eax
push dword [esp + 0x20]
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1b0], 4
call fcn.008c768b
mov edi, eax
lea esi, [esp + 0x34]
mov byte [esp + 0x1a0], 5
call fcn.008b6c58
push str.System_error
push dword [esp + 0x14]
mov eax, esi
push eax
mov ecx, ebx
lea edi, [esp + 0x34]
mov byte [esp + 0x1ac], 6
call fcn.008caa37
lea ecx, [esp + 0x168]
mov byte [esp + 0x1a0], 7
push ecx
lea esi, [esp + 0x20]
mov ecx, eax
mov dword [esp + 0x20], str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u221_13320_install_src_windows_common_Registry.cpp
mov dword [esp + 0x24], str.Registry::setString
mov dword [esp + 0x28], 0x190
call fcn.008bac4b
lea eax, [esp + 0x16c]
mov dword [esp], 0x90d7a8
push eax
call fcn.008e1a81
cmp dword [0x91d500], 0
jg 0x8c7133
mov eax, dword [esp + 0x14]
mov ecx, edi
lea esi, [esp + 0xd0]
call fcn.008c6442
xor esi, esi
push esi
push dword [esp + 0x1c]
mov byte [esp + 0x1a8], 8
push eax
lea eax, [esp + 0xf8]
push eax
call fcn.008c78f1
add esp, 0x10
push str.Registry::setString
push 0x193
push str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u221_13320_install_src_windows_common_Registry.cpp
push esi
mov edx, eax
mov ecx, 0x91d500
mov byte [esp + 0x1b0], 9
call fcn.008b477b
push esi
push 1
lea ecx, [esp + 0xf4]
call fcn.008a5e43
push esi
push 1
lea ecx, [esp + 0xd8]
call fcn.008a5e43
lea esi, [esp + 0x108]
call fcn.008ab7e8
mov ecx, dword [esp + 0x198]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.008da44f
mov esp, ebp
pop ebp
ret 8
Function at 0x8c7522
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x919630]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x3c]
push eax
mov edi, esi
mov ebx, ecx
call fcn.008c5657
pop ecx
push esi
lea eax, [ebp - 0x20]
call fcn.008c570b
xor edi, edi
pop ecx
cmp dword [ebp - 0x2c], edi
je 0x8c75f0
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
push edi
or ecx, 0x2001f
push ecx
lea ecx, [ebp - 0x3c]
push ecx
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.008c5f8f
add esp, 0x14
cmp dword [ebp - 0x6c], edi
je 0x8c75b2
mov edi, dword [ebp - 0x6c]
cmp byte [ebp - 0x70], 0
je 0x8c7597
push dword [ebp - 0x74]
mov byte [ebp - 0x70], 0
call fcn.008cb11a
pop ecx
lea esi, [ebp - 0x3c]
call fcn.008ab7e8
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.008da44f
leave
ret 8
push 0x91c2a9
lea eax, [ebp - 0x20]
push eax
push ecx
push ecx
mov ecx, dword [ebp - 0x74]
mov eax, esp
mov dword [eax], ecx
mov cl, byte [ebp - 0x70]
mov byte [eax + 4], cl
mov dword [ebp - 0x78], esp
push ebx
lea ecx, [ebp - 0x3c]
lea edi, [ebp - 0x64]
mov byte [ebp - 0x70], 0
call fcn.008c6103
mov ecx, eax
call fcn.008c7522
lea esi, [ebp - 0x64]
mov edi, eax
call fcn.008c620a
jmp 0x8c7584
cmp dword [esi + 0x14], 0x10
jb 0x8c75fa
mov ecx, dword [esi]
jmp 0x8c75fc
mov ecx, esi
mov eax, dword [ebx]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x78], eax
cmp eax, edi
jne 0x8c7683
cmp dword [0x91d500], edi
jg 0x8c7683
lea eax, [ebp - 0x118]
push eax
call fcn.008a9556
lea eax, [ebp - 0x118]
push str.Deleted__
push eax
call fcn.008ab566
sub esp, 0x14
mov ecx, esi
mov esi, esp
mov eax, ebx
mov dword [ebp - 0x7c], esp
call fcn.008c6442
lea esi, [ebp - 0x118]
call fcn.008ab389
mov esi, eax
push str.__value
push esi
call fcn.008ab566
pop ecx
pop ecx
push esi
push 0x1d2
push edi
mov ebx, str.Registry::deleteValue
mov edi, str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u221_13320_install_src_windows_common_Registry.cpp
mov esi, 0x91d500
call fcn.008a78ca
lea eax, [ebp - 0x118]
call fcn.008a78b0
mov edi, dword [ebp - 0x78]
jmp 0x8c7597
Function at 0x8d3d05
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x8f6fb0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x919630]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebx, ebx
lea esi, [esp + 0x14]
mov dword [esp + 0x14], ebx
call 0x8d06ce
mov cl, byte [eax + 4]
mov edi, dword [eax]
mov byte [esp + 0x10], cl
mov dword [esp + 0x1c], edi
mov byte [eax + 4], bl
mov dword [esp + 0x2c], edi
mov byte [esp + 0x30], cl
mov dword [esp + 0x50], ebx
cmp byte [esp + 0x18], bl
je 0x8d3d70
push dword [esp + 0x14]
mov byte [esp + 0x1c], bl
call fcn.008d91be
pop ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov esi, 0x100001
lea eax, [esp + 0x34]
mov byte [esp + 0x50], 1
call fcn.008b5dbc
push edi
mov edi, dword [esp + 0x38]
dec esi
push esi
push 1
push edi
call fcn.008e1786
add esp, 0x10
mov dword [esp + 0x14], eax
cmp eax, esi
jbe 0x8d3dc4
push 0xc8
lea esi, [esp + 0x20]
call fcn.008abf4a
push 0x90d640
mov eax, esi
push eax
call fcn.008e1a81
push dword [esp + 0x1c]
call fcn.008e1514
pop ecx
test eax, eax
je 0x8d3de9
push 0x133
lea esi, [esp + 0x20]
call fcn.008abf4a
push 0x90d640
mov eax, esi
jmp 0x8d3dbe
push dword [esp + 0x1c]
call fcn.008e14ec
pop ecx
test eax, eax
jne 0x8d3e0e
push 0x13b
lea esi, [esp + 0x20]
call fcn.008abf4a
push 0x90d640
mov eax, esi
jmp 0x8d3dbe
mov esi, dword [esp + 0x14]
mov ecx, esi
mov eax, edi
call fcn.008d3cd1
lea eax, [edi + esi]
mov esi, dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
cmp edi, eax
je 0x8d3e3c
sub eax, edi
push eax
push edi
mov ecx, esi
call fcn.008a5ea6
cmp edi, ebx
je 0x8d3e47
push edi
call fcn.008da444
pop ecx
cmp byte [esp + 0x10], bl
je 0x8d3e57
push dword [esp + 0x1c]
call fcn.008d91be
pop ecx
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x8da44f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x919630]
jne 0x8da459
repz ret
jmp fcn.008e46c5
Function at 0x8f00bc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x919630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.008e6d62
and dword [ebp - 0x14], 0
cmp dword [0x91d1f8], 0
mov dword [ebp - 0x18], eax
jne 0x8f016f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x8f0217
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x8f0217
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x91d1f8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x91d1fc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x91d200], eax
call edi
push eax
call esi
mov dword [0x91d208], eax
test eax, eax
je 0x8f016f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x91d204], eax
mov eax, dword [0x91d204]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x8f01c8
cmp dword [0x91d208], ecx
je 0x8f01c8
push eax
call esi
push dword [0x91d208]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x8f01c8
test ebx, ebx
je 0x8f01c8
call edi
test eax, eax
je 0x8f01bf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x8f01bf
test byte [ebp - 8], 1
jne 0x8f01c8
or dword [ebp + 0x10], 0x200000
jmp 0x8f01fb
mov eax, dword [0x91d1fc]
cmp eax, dword [ebp - 0x18]
je 0x8f01fb
push eax
call esi
test eax, eax
je 0x8f01fb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x8f01fb
mov eax, dword [0x91d200]
cmp eax, dword [ebp - 0x18]
je 0x8f01fb
push eax
call esi
test eax, eax
je 0x8f01fb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x91d1f8]
call esi
test eax, eax
je 0x8f0217
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x8f0219
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.008da44f
leave
ret
Function at 0x4366dc
Capabilities:
Get common file path
Get session user name

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, ecx
mov edi, edx
mov esi, eax
mov eax, ebx
mov edx, 0x436884
call fcn.004036a4
mov eax, edi
call fcn.0042cb78
and eax, 0xff
cmp eax, 0xd
ja case.0x43670c.0
jmp dword [eax*4 + 0x436713]
mov eax, ebx
mov edx, dword [esi + 0x1dc]
call fcn.004036a4
jmp case.0x43670c.0
mov edx, ebx
mov eax, dword [esi + 0x200]
call fcn.0040629c
jmp case.0x43670c.0
mov edx, ebx
mov eax, dword [esi + 0x1d4]
call fcn.00406710
jmp case.0x43670c.0
mov edx, ebx
mov eax, dword [esi + 0x1ac]
mov eax, dword [eax + 0x30]
call fcn.0040629c
jmp case.0x43670c.0
mov edx, ebx
mov eax, esi
call fcn.00414b7c
jmp case.0x43670c.0
mov edx, ebx
mov eax, dword [esi + 0x1ac]
mov eax, dword [eax + 0x2c]
call fcn.0040629c
jmp case.0x43670c.0
mov edx, ebx
mov eax, dword [0x44bf40]
call fcn.0040629c
jmp case.0x43670c.0
mov eax, dword [0x44d634]
call fcn.00424514
mov edx, ebx
call fcn.0040629c
jmp case.0x43670c.0
mov eax, dword [0x44d634]
call fcn.0042451c
mov edx, ebx
call fcn.0040629c
jmp case.0x43670c.0
push 0xff
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
jle case.0x43670c.0
mov edx, ebx
lea eax, [esp + 4]
call fcn.004069ec
jmp case.0x43670c.0
mov eax, ebx
mov edx, dword [esi + 0x1d8]
call fcn.004036a4
jmp case.0x43670c.0
mov dword [esp], 0xff
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x436845
mov edx, ebx
lea eax, [esp + 4]
call fcn.004069ec
jmp case.0x43670c.0
mov edx, ebx
mov eax, 0x66
call fcn.00406320
jmp case.0x43670c.0
push 0xff
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
jle case.0x43670c.0
mov edx, ebx
lea eax, [esp + 4]
call fcn.004069ec
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x436afc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov esi, dword [ebp + 8]
add esi, 0xffffffdc
xor eax, eax
push ebp
push 0x436c35
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ebx, dword [eax + 0x1ac]
mov edx, dword [ebx + 0x28]
mov eax, dword [ebp + 8]
mov eax, dword [ebx + 0x24]
call fcn.0040a0b0
lea edx, [ebp - 0x10]
lea ecx, [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00414824
mov eax, dword [esi + 0xc]
call fcn.00447ba0
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 0x10]
call fcn.00441088
push eax
mov eax, dword [esi + 0x14]
call fcn.00447ba0
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ebx, dword [eax + 0x1ac]
mov eax, dword [ebx + 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebx + 0x2c]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0040a0e4
lea eax, [ebp - 0x20]
push eax
mov eax, dword [esi + 4]
call fcn.00447ba0
push eax
mov eax, dword [esi]
call fcn.00447ba0
mov edx, eax
pop ecx
pop eax
call fcn.0042fd64
test al, al
jne 0x436c1a
mov eax, dword [ebp + 8]
push eax
mov edx, 0x436c4c
lea eax, [ebp - 0x24]
call fcn.004036a4
lea eax, [ebp - 0x24]
mov edx, dword [esi + 8]
call fcn.0040378c
lea eax, [ebp - 0x24]
mov edx, 0x436c4c
call fcn.0040378c
lea eax, [ebp - 0x24]
mov edx, 0x436c58
call fcn.0040378c
lea eax, [ebp - 0x24]
mov edx, 0x436c58
call fcn.0040378c
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x69
call fcn.00406320
mov edx, dword [ebp - 0x28]
pop eax
call fcn.0040378c
mov eax, dword [ebp - 0x24]
call fcn.004368c4
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436c3c
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00403630
ret

Function at 0x43aa34
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43aaea
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.004069ec
mov eax, dword [ebp - 0x10c]
lea ecx, [ebp - 4]
mov edx, 0x43ab00
call fcn.00447e44
mov eax, dword [ebp - 4]
call fcn.00403948
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x43aac9
push 0x43ab08
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x43aac3
push 0
push 0
mov edx, dword [0x44a1cc]
push edx
push 0x43ab1c
call eax
push ebx
call sub.kernel32.dll_FreeLibrary
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43aaf1
lea eax, [ebp - 0x10c]
call fcn.00403610
lea eax, [ebp - 4]
call fcn.00403610
ret
Function at 0x43ab24
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43ac45
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
mov dl, 1
mov eax, 0x42d7a8
call fcn.0042d82c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43ac1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0042d8bc
xor ecx, ecx
mov edx, 0x43ac60
mov eax, dword [ebp - 8]
call fcn.0042d920
test al, al
je 0x43ac07
mov edx, 0x43ac80
mov eax, dword [ebp - 8]
call fcn.0042da48
test eax, eax
je 0x43ac07
push 0xff
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x10d]
call fcn.004069ec
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 0xc]
mov edx, 0x43aca0
call fcn.00447e44
mov eax, dword [ebp - 0xc]
call fcn.00403948
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x43ac07
push 0x43acb0
push ebx
call sub.kernel32.dll_GetProcAddress
mov esi, eax
mov eax, dword [0x44d688]
call fcn.00418260
push eax
call esi
mov byte [ebp - 1], al
push ebx
call sub.kernel32.dll_FreeLibrary
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ac24
mov eax, dword [ebp - 8]
call fcn.00402ce4
ret
Function at 0x43dc14
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0x1ba], 0
je 0x43dc42
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x1bc]
call dword [ecx + 0x1b8]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00414670
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00414690
mov eax, dword [0x44d634]
call fcn.0042451c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 4]
add edx, dword [ecx + 0x2c]
cmp eax, edx
jge 0x43dc8a
mov eax, dword [0x44d634]
call fcn.0042451c
mov edx, eax
mov eax, dword [ebp - 4]
sub edx, dword [eax + 0x2c]
mov eax, dword [ebp - 4]
call fcn.00414670
mov eax, dword [0x44d634]
call fcn.00424514
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28]
mov ecx, dword [ebp - 4]
Function at 0x443570
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403938
mov eax, dword [ebp - 8]
call fcn.00403938
xor eax, eax
push ebp
push 0x44379d
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 4]
call fcn.004434d8
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 4]
call fcn.004036a4
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 8]
call fcn.004434d8
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 8]
call fcn.004036a4
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 4]
call fcn.00443524
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0x11c]
call fcn.00406780
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.00447d74
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0xc]
call fcn.004061d0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x118]
call fcn.004036a4
lea eax, [ebp - 0x118]
mov edx, 0x4437b4
call fcn.0040378c
mov eax, dword [ebp - 0x118]
mov edx, 0x4437c0
call fcn.00403a6c
test eax, eax
jne 0x4436ba
lea eax, [ebp - 0x111]
push eax
push 0x4437d4
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 4]
call fcn.00443524
mov eax, dword [ebp - 0x118]
call fcn.00403948
push eax
call sub.shell32.dll_FindExecutableA
mov esi, eax
cmp esi, 0x20
jle 0x4436b8
push dword [ebp - 4]
push 0x4437e0
push dword [ebp - 8]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403844
lea edx, [ebp - 4]
lea eax, [ebp - 0x111]
call fcn.004069ec
jmp 0x4436ba
xor ebx, ebx
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 4]
call fcn.00443524
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0x10]
call fcn.00406710
lea edx, [ebp - 0x11c]
mov eax, dword [ebp - 4]
call fcn.00443524
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.00406748
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 4]
call fcn.004036a4
test bl, bl
je 0x44375f
cmp dword [ebp - 4], 0
jbe 0x44375f
mov dx, 0xfff5
mov eax, dword [0x44d634]
call fcn.00424708
push 1
mov eax, dword [ebp - 0x10]
call fcn.00403948
push eax
mov eax, dword [ebp - 8]
call fcn.00403948
push eax
mov eax, dword [ebp - 4]
call fcn.00403948
push eax
push 0x4437e4
mov eax, dword [0x44d630]
mov eax, dword [eax + 0x20]
push eax
call sub.shell32.dll_ShellExecuteA
mov esi, eax
cmp esi, 0x20
setg bl
xor edx, edx
mov eax, dword [0x44d634]
call fcn.00424708
test bl, bl
jne 0x443772
cmp esi, 0x20
jg 0x443772
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00443268
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4437a4
lea eax, [ebp - 0x11c]
mov edx, 2
call fcn.00403630
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403630
ret
Function at 0x4437ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x443a2a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x111]
mov edx, 0x443a40
call fcn.004068fc
lea eax, [ebp - 8]
call fcn.00403610
lea eax, [ebp - 0xc]
call fcn.00403610
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x111]
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x44391e
mov dword [ebp - 4], 0x101
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x111]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x443882
lea edx, [ebp - 8]
lea eax, [ebp - 0x111]
call fcn.004069ec
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
cmp dword [ebp - 8], 0
jne 0x44389e
lea eax, [ebp - 8]
mov edx, 0x443a40
call fcn.004036a4
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x118]
call fcn.004036a4
lea eax, [ebp - 0x118]
mov edx, 0x443a50
call fcn.0040378c
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x111]
call fcn.004068fc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x111]
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x44391e
mov dword [ebp - 4], 0x101
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x111]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x443915
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x111]
call fcn.004069ec
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
cmp dword [ebp - 0xc], 0
jbe 0x4439de
mov edx, dword [ebp - 0xc]
mov eax, 0x443a6c
call fcn.00403a6c
test eax, eax
jle 0x44394b
lea ecx, [ebp - 0xc]
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0042caa0
jmp 0x4439a1
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 0xc]
call fcn.004061d0
mov edx, dword [ebp - 0x118]
mov eax, 0x443a78
call fcn.00403a6c
test eax, eax
jle 0x4439a1
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 0xc]
call fcn.004061d0
mov edx, dword [ebp - 0x118]
mov eax, 0x443a78
call fcn.00403a6c
mov ecx, eax
add ecx, 4
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00403988
mov edx, 0x443a6c
lea eax, [ebp - 0x118]
call fcn.004036a4
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.0040378c
lea eax, [ebp - 0x118]
mov edx, 0x443a6c
call fcn.0040378c
mov edx, dword [ebp - 0x118]
mov eax, dword [ebp - 0xc]
call fcn.00443570
jmp 0x443a04
mov eax, dword [0x44d688]
mov ecx, dword [eax + 0x228]
mov eax, dword [0x44d688]
mov edx, dword [eax + 0x268]
mov eax, dword [0x44d688]
mov eax, dword [eax + 0x23c]
call fcn.004469e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443a31
lea eax, [ebp - 0x118]
call fcn.00403610
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403630
ret