joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4411f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
sub eax, dword [esi + 0x10]
sub edi, dword [esi + 0xc]
mov ebx, eax
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
cmp dword [esi + 0xc], 0
je 0x441229
cmp edi, eax
jae 0x441229
mov ecx, dword [0x50b39c]
pop edi
pop esi
add ecx, 0xb0
pop ebx
jmp fcn.00430710
cmp dword [esi + 0x10], 0
je 0x441235
shr eax, 1
cmp ebx, eax
jb 0x44125f
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x44125f
push 0
push 0xffff8300
push 0xffff8300
mov ecx, esi
call fcn.00440e10
pop edi
pop esi
pop ebx
ret

Function at 0x441800
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
mov esi, ecx
cmp dword [esi + 0x24], 0
je 0x44181c
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
test eax, eax
jne 0x441875
push 0x110
push eax
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0x114], 0x114
call fcn.004b03e0
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
call edi
mov eax, dword [ebp - 0x110]
cmp eax, 6
jb 0x441867
jne 0x44186e
cmp dword [ebp - 0x10c], 0
jne 0x44186e
mov eax, 1
jmp 0x441825
push str.KernelBase.dll
jmp 0x44187a
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x24], eax
test eax, eax
je 0x441938
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AddAccessAllowedAce
push eax
call edi
mov edx, dword [esi + 0x24]
push str.AddAccessDeniedAce
push edx
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x24]
push 0x4d4340
push eax
call edi
mov ecx, dword [esi + 0x24]
push str.GetLengthSid
push ecx
mov dword [esi + 0x30], eax
call edi
mov edx, dword [esi + 0x24]
push str.InitializeAcl
push edx
mov dword [esi + 0x34], eax
call edi
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x24]
push str.InitializeSecurityDescriptor
push eax
call edi
mov ecx, dword [esi + 0x24]
push str.SetSecurityDescriptorDacl
push ecx
mov dword [esi + 0x3c], eax
call edi
cmp dword [esi + 0x28], 0
mov dword [esi + 0x40], eax
je 0x441923
cmp dword [esi + 0x2c], 0
je 0x441923
cmp dword [esi + 0x30], 0
je 0x441923
cmp dword [esi + 0x34], 0
je 0x441923
cmp dword [esi + 0x38], 0
je 0x441923
cmp dword [esi + 0x3c], 0
je 0x441923
test eax, eax
je 0x441923
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x24]
test eax, eax
je 0x441938
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x24], 0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x442c60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x10]
push eax
push 0xf003f
xor esi, esi
push esi
push 0x4c6d70
push SysReAllocString
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x442d21
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.FullScreen
push eax
mov dword [ebp - 0xc], 4
call esi
test eax, eax
je 0x442cc4
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push ecx
push 0xf003f
push 0
push str.ConEmu
push edx
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x442d15
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push str.FullScreen
push edx
mov dword [ebp - 0xc], 4
call esi
test eax, eax
je 0x442d0d
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x14]
push eax
call edi
jmp 0x442d1b
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
push edx
call edi
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
pop edi
pop esi
test eax, eax
jne 0x442d31
test ecx, ecx
je 0x442d68
cmp dword [0x50b3c4], 6
jb 0x442d68
test eax, eax
jne 0x442d40
mov eax, ecx
push eax
lea eax, [ebp - 0x414]
push str.Warning__nDangerous_values_detected_in_yours_registry_n_nPlease_check__HKEY_CURRENT_USERConsole__and__HKEY_CURRENT_USERConsoleConEmu__keys_n_n_FullScreen__recommended_value_is_dword:00000000_n_nCurrent_value_is_dword:_08X
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0
push 0
lea ecx, [ebp - 0x414]
push 0x40
push ecx
call fcn.00420020
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x444f50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4bf166
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
test esi, esi
je 0x44501a
push str._xml_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x44510a
mov esi, dword [esi + 0x10]
test esi, esi
je 0x444ff1
cmp word [esi], di
je 0x444ff1
push eax
push 0x80
push 4
push eax
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x444fc8
test eax, eax
je 0x444fc8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
jmp 0x445027
push 0
push 0
push 0
push 0
push str.Failed_to_create_xml_file_
call fcn.004200b0
add esp, 0x14
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push 0
push 0xffffffffffffffff
push str.Invalid_xml_path_was_specified_
call fcn.004200b0
add esp, 0x14
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [0x50b39c]
call fcn.0040f8a0
mov esi, eax
test esi, esi
je 0x445054
cmp word [esi], 0
je 0x445054
test edi, edi
jne 0x44505c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44510a
test al, 0x10
jne 0x44510a
mov edi, 1
jmp 0x44505c
test edi, edi
je 0x44510a
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x30
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esi
call fcn.004412a0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x44509a
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
call fcn.00489b40
mov esi, eax
jmp 0x44509c
xor esi, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00489e10
test al, al
jne 0x4450d3
cmp dword [ebp + 8], 0
jne 0x4450c2
mov ecx, dword [0x50b39c]
call fcn.0040f8a0
xor edx, edx
mov word [eax], dx
test esi, esi
je 0x44510a
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
push 1
mov ecx, esi
call edx
jmp 0x44510a
test edi, edi
je 0x445106
test esi, esi
jne 0x44512f
cmp dword [ebp + 8], esi
je 0x44510a
push esi
push esi
push esi
push 0xffffffffffffffff
push str.XML_storage_is_not_available__Check_IXMLDOMDocument_interface_
call fcn.004200b0
add esp, 0x14
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
test esi, esi
jne 0x44512f
push 0x20
call fcn.004412a0
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x44512b
mov ecx, eax
call fcn.00489830
jmp 0x44512d
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4451d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
push 0
push eax
call fcn.00443870
push eax
call fcn.00434410
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, eax
add esp, 4
test esi, esi
je 0x44520f
push esi
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x44521d
pop edi
xor al, al
pop esi
pop ebp
ret 8
cmp byte [ebp + 0xc], 0
jne 0x445232
pop edi
xor al, al
pop esi
pop ebp
ret 8
cmp esi, 0x10
je 0x445245
cmp esi, 0xa0
je 0x445245
cmp esi, 0xa1
je 0x445245
push 0x10
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x445207
cmp esi, 0x12
je 0x44526d
cmp esi, 0xa4
je 0x44526d
cmp esi, 0xa5
je 0x44526d
push 0x12
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x445207
cmp esi, 0x11
je 0x445299
cmp esi, 0xa2
je 0x445299
cmp esi, 0xa3
je 0x445299
push 0x11
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x445207
pop edi
mov al, 1
pop esi
pop ebp
ret 8

Function at 0x447b10
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
cmp byte [ecx + 0x1181a], 0
jne 0x447b2a
xor eax, eax
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x50b39c]
push edi
add eax, 0x5c8
push eax
lea ecx, [ebp - 0x258]
push ecx
call fcn.004456d0
add esp, 8
push str.clinkclink_dll_x86.dll
push 0x122
lea edx, [ebp - 0x258]
push edx
call fcn.00401880
xor edi, edi
lea eax, [ebp - 0x258]
push edi
push eax
call fcn.004acca0
add esp, 8
test eax, eax
je 0x447b7a
cmp word [ebp - 0x258], di
jne 0x447b83
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x50b868]
push esi
cmp eax, edi
jne 0x447c38
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x258]
push edx
mov dword [ebp - 0xc], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
jne 0x447bbc
mov eax, 1
pop esi
mov dword [0x50b868], eax
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
push 1
push esi
call fcn.004412c0
mov ebx, eax
add esp, 8
cmp ebx, edi
je 0x447c32
push ebx
push esi
push edi
lea eax, [ebp - 0x258]
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], 4
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x447c29
push 0x4c9860
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
push ecx
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x447c29
mov esi, dword [ebp - 4]
mov ecx, 0xd
mov edi, 0x50b834
rep movsd dword es:[edi], dword [esi]
mov dword [0x50b868], 2
push ebx
call fcn.00441300
add esp, 4
mov eax, dword [0x50b868]
pop ebx
cmp eax, 1
je 0x447c44
cmp eax, 2
je 0x447c44
xor eax, eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x44ec90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push 0x1fffe
call fcn.004412a0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x44ecad
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0
push str.AutoRun
push ecx
mov dword [ebp - 4], 0x1fffa
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44edea
mov edx, dword [ebp - 4]
shr edx, 1
mov word [ebx + edx*2], ax
cmp byte [ebp + 0xc], al
je 0x44edc0
cmp word [ebx], ax
je 0x44edc0
push edi
push str.ConEmuCmd_Autorun.cmd
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov edi, eax
test edi, edi
je 0x44edbf
push esi
mov esi, edi
cmp edi, ebx
jbe 0x44ed1e
lea ecx, [ecx]
cmp word [esi - 2], 0x26
je 0x44ed1e
add esi, 0xfffffffe
cmp esi, ebx
ja 0x44ed10
push 0x26
push edi
call fcn.004b03ac
add esp, 8
test eax, eax
jne 0x44ed46
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44ed32
sub eax, edx
sar eax, 1
lea eax, [edi + eax*2]
jmp 0x44ed59
cmp word [eax], 0x26
jne 0x44ed59
lea esp, [esp]
add eax, 2
cmp word [eax], 0x26
je 0x44ed50
cmp esi, ebx
ja 0x44ed6a
cmp word [eax], 0
jne 0x44ed8e
xor ecx, ecx
mov word [ebx], cx
jmp 0x44edbe
cmp word [eax], 0
jne 0x44ed8e
movzx eax, word [esi - 2]
cmp ax, 0x26
je 0x44ed80
cmp ax, 0x20
jne 0x44ed87
add esi, 0xfffffffe
cmp esi, ebx
ja 0x44ed70
xor edx, edx
mov word [esi], dx
jmp 0x44edbe
cmp esi, ebx
jne 0x44ed9b
push eax
call fcn.004ad3e0
add esp, 4
mov ecx, eax
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x44eda0
sub ecx, edi
sar ecx, 1
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push esi
call fcn.004b0bb0
add esp, 0xc
pop esi
pop edi
push ebx
call fcn.004ad3e0
add esp, 4
test eax, eax
je 0x44edd3
cmp word [eax], 0
jne 0x44ee01
xor edx, edx
push ebx
mov word [ebx], dx
call fcn.00441300
add esp, 4
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
push ebx
mov word [ebx], ax
call fcn.00441300
add esp, 4
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
cmp word [ebx], 0
jne 0x44ee12
push ebx
call fcn.00441300
add esp, 4
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ee20
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
xor ecx, ecx
push edi
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
cmp ebx, ecx
je 0x44ef25
cmp word [ebx], cx
je 0x44ef25
mov edi, dword [ebp + 8]
cmp edi, ecx
je 0x44ef25
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ecx
je 0x44ee8c
cmp word [eax], cx
je 0x44ee8c
lea edx, [ebp - 0xc]
push edx
push 0xf003f
push ecx
push eax
push edi
call esi
test eax, eax
je 0x44ee89
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push ebx
push edi
call esi
test eax, eax
jne 0x44ef0b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor esi, esi
mov eax, dword [ebp - 8]
push 0
push 0
push 0
push 0
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x218]
push edx
push 0
push eax
mov dword [ebp + 8], 0x104
call ebx
test eax, eax
jne 0x44eeee
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp - 0x10]
push eax
push edx
call fcn.0044ee20
test al, al
je 0x44eeee
inc esi
cmp esi, 0xff
jb 0x44eea7
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x10]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x44ef0b
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x44ef19
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4504d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push SysReAllocString
mov esi, 0x40
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x450537
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push eax
push eax
mov eax, dword [ebp - 8]
push str.EnableBalloonTips
push eax
mov dword [ebp - 4], 1
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45052d
cmp dword [ebp - 4], eax
jne 0x45052d
xor esi, esi
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x451640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
xor bl, bl
mov byte [ebp - 1], bl
call fcn.004ad0f0
neg eax
sbb eax, eax
and eax, 0x100
lea ecx, [ebp - 0x10]
push ecx
or eax, 0x20019
push eax
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionConsoleTrueTypeFont
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45182a
push esi
push edi
xor edx, edx
push 0x3e
push edx
lea eax, [ebp - 0x5a]
push eax
mov word [ebp - 0x5c], dx
call fcn.004b03e0
add esp, 0xc
cmp byte [0x50b4d5], bl
je 0x45178b
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x25c]
push edx
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
xor esi, esi
push esi
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x5c]
push edx
push esi
mov ebx, 0x1fc
push eax
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], ebx
call edi
test eax, eax
jne 0x45178b
mov eax, dword [ebp - 0xc]
inc esi
cmp eax, 0x1f
jbe 0x4516f0
mov eax, 0x1f
xor ecx, ecx
mov word [ebp + eax*2 - 0x5c], cx
mov eax, dword [ebp - 8]
shr eax, 1
cmp eax, 0xfe
jbe 0x451708
mov eax, 0xfe
xor edx, edx
mov word [ebp + eax*2 - 0x25c], dx
push 0xa
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x5c]
push ecx
call fcn.004b0706
add esp, 0xc
test eax, eax
je 0x451759
mov ax, word [ebp - 0x25c]
test ax, ax
je 0x451759
cmp ax, 0x2a
lea eax, [ebp - 0x25a]
je 0x451746
lea eax, [ebp - 0x25c]
mov edx, dword [ebp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x451812
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ebp - 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x5c]
push ecx
push esi
push edx
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], ebx
call edi
test eax, eax
je 0x4516e2
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor esi, esi
xor ecx, ecx
mov word [ebp + esi*2 - 0x5a], cx
mov eax, 0x30
mov word [ebp + esi*2 - 0x5c], ax
lea ecx, [eax + 0x4f]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
lea edi, [ebp - 0x25c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x25c]
push ecx
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
push 0
lea eax, [ebp - 0x5c]
push eax
push ecx
mov dword [ebp - 0x18], 0x1fe
call ebx
test eax, eax
jne 0x451816
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x451812
inc esi
cmp esi, 0x14
jb 0x451793
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452280
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x50b3a0]
movzx ecx, byte [eax + 0xee1]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_CheckDlgButton]
push ecx
push 0x60e
push esi
call edi
mov edx, dword [0x50b3a0]
movzx eax, byte [edx + 0x11286]
push eax
push 0x60f
push esi
call edi
mov edx, dword [0x50b3a0]
xor ecx, ecx
cmp byte [edx + 0x11811], cl
setne cl
push ecx
push 0x601
push esi
call edi
mov eax, dword [0x50b3a0]
movzx ecx, byte [eax + 0x11812]
push ecx
push 0x6b9
push esi
call edi
mov edx, dword [0x50b3a0]
movzx eax, byte [edx + 0x1181c]
push eax
push 0x609
push esi
call edi
mov ecx, dword [0x50b3a0]
movzx edx, byte [ecx + 0x11818]
push edx
push 0x6d8
push esi
call edi
mov eax, dword [0x50b3a0]
movzx ecx, byte [eax + 0x11819]
push ecx
push 0x8cd
push esi
call edi
mov ecx, dword [0x50b3a0]
push 0
call fcn.00447b10
neg eax
sbb eax, eax
neg eax
push eax
push 0x972
push esi
call edi
mov edx, dword [0x50b39c]
mov eax, dword [edx + 0xbe8]
push eax
push 0x6d9
push esi
call edi
mov edx, dword [0x50b39c]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
xor ecx, ecx
cmp dword [edx + 0xbe8], ecx
sete cl
push ecx
push 0x6d9
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0x6bc
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x50b3a0]
xor eax, eax
cmp byte [ecx + 0x1234], al
sete al
push eax
push 0x983
push esi
call edi
mov edx, dword [0x50b3a0]
movzx eax, byte [edx + 0x1245]
push eax
push 0x6b7
push esi
call edi
mov ecx, dword [0x50b3a0]
movzx edx, byte [ecx + 0x121e]
push edx
push 0xa08
push esi
call edi
push 0
push 0x655
push esi
call ebx
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
push 0
push 0x6e1
push esi
call ebx
push eax
call edi
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
Function at 0x4534d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf828
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x10]
xor esi, esi
call fcn.004a4720
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 4], esi
call fcn.0049f8f0
add esp, 8
test eax, eax
jl 0x453515
lea ecx, [ebp - 0x10]
call fcn.004a4800
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, dword [ebp + 8]
push eax
push 0x5e4
push ecx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 1
push 0x578
mov ecx, edi
call fcn.00450200
mov ecx, dword [0x50b39c]
push 1
call fcn.00411df0
mov ecx, dword [0x50b39c]
call fcn.0040c410
test esi, esi
je 0x453563
mov ecx, esi
call fcn.004a4a70
mov ecx, eax
call fcn.00479350
mov ecx, edi
call fcn.00450160
test esi, esi
je 0x453584
mov ecx, esi
call fcn.004a4a70
mov ecx, eax
call fcn.00479160
push eax
mov ecx, edi
call fcn.00450ef0
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004a4770
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x453aa0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xor eax, eax
push 0x8002
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call fcn.004412a0
add esp, 4
mov ebx, eax
mov dword [ebp - 4], 0
test esi, esi
je 0x453c4a
cmp esi, 0xffffffff
je 0x453c4a
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x453c4a
cmp dword [ebp - 0xc], 0
jg 0x453c4a
jl 0x453b1f
cmp dword [ebp - 0x10], 0xffffff
jae 0x453c4a
push 0
lea ecx, [ebp - 4]
push ecx
push 0x7fff
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x453c4a
mov eax, dword [ebp - 4]
test eax, eax
je 0x453c4a
mov byte [eax + ebx], 0
mov edx, dword [ebp - 4]
mov byte [edx + ebx + 1], 0
mov eax, dword [ebp - 4]
push esi
mov byte [eax + ebx + 2], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov dword [ebp - 8], 0
call fcn.004ad2f0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
add esp, 4
mov esi, eax
push str..bat
push esi
call edi
test eax, eax
je 0x453baf
push str..cmd
push esi
call edi
test eax, eax
je 0x453baf
mov ecx, dword [ebp - 4]
xor eax, eax
test ecx, ecx
jbe 0x453baf
lea esp, [esp]
cmp byte [eax + ebx], 0
je 0x453c47
inc eax
cmp eax, ecx
jb 0x453ba0
mov ecx, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ecx
call esi
mov edx, dword [ebp + 8]
mov edi, eax
mov eax, dword [edx]
push eax
add edi, edi
call esi
mov ecx, dword [ebp - 4]
add eax, edi
lea edi, [eax + ecx + 0x15]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [edi + edi]
push edx
push ecx
call fcn.004412e0
mov esi, eax
add esp, 8
test esi, esi
je 0x453c47
push str._r_n_r_n___
push edi
push esi
call fcn.00401880
mov edx, dword [ebp + 0xc]
push edx
push edi
push esi
call fcn.00401880
push 0x4c2ecc
push edi
push esi
call fcn.00401880
mov eax, dword [ebp - 4]
inc eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 4]
lea ecx, [esi + eax*2]
push ecx
inc edx
push edx
push ebx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push str._r_n___
push edi
push esi
call fcn.00401880
mov eax, dword [ebp + 0xc]
push eax
push edi
push esi
call fcn.00401880
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov esi, dword [ebp - 8]
push ebx
call fcn.00441300
add esp, 4
test esi, esi
je 0x453c63
cmp esi, 0xffffffff
je 0x453c63
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8