joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4327b0
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, dword [esp + 0x1c]
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x43281e
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
test eax, eax
je 0x432817
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x432817
lea edx, [esp + 8]
push edx
push 0
mov eax, edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x28]
and ecx, 0x27
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
add esp, 0x10
ret

Function at 0x432950
Capabilities:
Check for time delay via gettickcount
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x4329cc
mov eax, dword [esi + 4]
push ebx
push ebp
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebx, eax
call edi
mov ebp, dword [esp + 0x14]
sub eax, ebx
cmp eax, ebp
jae 0x432997
lea ecx, [ecx]
mov eax, dword [esi + 8]
test eax, eax
je 0x4329c9
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
sub eax, ebx
cmp eax, ebp
jb 0x432980
lea edi, [esi + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 8]
test eax, eax
je 0x4329c2
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebp
pop ebx
pop esi
ret 4

Function at 0x432b90
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x20
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
push ebx
mov dword [esp + 0x18], eax
push esi
mov dword [esp + 0x20], eax
push edi
mov edi, dword [esp + 0x30]
mov word [esp + 0x28], ax
mov eax, dword [edi + 0x14]
add eax, 2
xor ebx, ebx
push eax
mov dword [esp + 0x10], ebx
call fcn.0046934d
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x432c29
cmp dword [edi + 0x18], 0x10
mov ecx, dword [edi + 0x14]
jb 0x432be2
mov eax, dword [edi + 4]
jmp 0x432be5
lea eax, [edi + 4]
add ecx, 2
push ecx
push eax
push esi
call fcn.00450fd0
mov ecx, dword [edi + 0x14]
add esp, 0xc
mov byte [esi + ecx + 1], bl
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], esi
mov word [esp + 0x20], 0x414
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov ebx, eax
neg ebx
sbb bl, bl
push esi
inc bl
call fcn.00469348
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x20
ret
Function at 0x436a10
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x47c740
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [0x4bc364]
push ebx
push ebp
push esi
xor ebp, ebp
mov dword [esp + 0x40], eax
push edi
xor esi, esi
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
mov ebx, dword [esp + 0x58]
cmp dword [ebx + 0x18], 0x10
mov dword [esp + 0x50], ebp
mov dword [esp + 0x14], ebp
lea edi, [ebx + 4]
jb 0x436a63
mov eax, dword [edi]
jmp 0x436a65
mov eax, edi
lea ecx, [esp + 0x14]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, ebp
jbe 0x436b14
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
push ebp
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x58], 1
call fcn.004141ba
mov ebp, dword [esp + 0x1c]
test ebp, ebp
jne 0x436aa0
xor eax, eax
jmp 0x436aa6
mov eax, dword [esp + 0x20]
sub eax, ebp
cmp dword [ebx + 0x18], 0x10
jb 0x436aae
mov edi, dword [edi]
push ebp
push eax
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x436b05
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x14]
push eax
push 0x497c90
push ebp
mov dword [esp + 0x20], edi
mov dword [esp + 0x68], edi
call sub.VERSION.dll_VerQueryValueW
mov esi, eax
cmp esi, edi
je 0x436b05
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x10]
cmp ecx, 0x10005
mov eax, dword [eax + 0x14]
jb 0x436b03
ja 0x436afc
cmp eax, 0x32
jb 0x436b03
mov esi, 1
jmp 0x436b05
xor esi, esi
cmp ebp, edi
je 0x436b12
push ebp
call fcn.00469348
add esp, 4
xor ebp, ebp
mov ecx, dword [esp + 0x48]
cmp esi, ebp
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x38]
setne al
pop ebx
call fcn.0044e944
add esp, 0x44
ret 4

Function at 0x437010
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x4bc364]
push ebx
push esi
push edi
mov dword [esp + 0x134], eax
mov esi, ecx
xor ebx, ebx
xor eax, eax
mov byte [esp + 0x28], bl
mov ecx, 0x40
lea edi, [esp + 0x29]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
push 0x23
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4370b3
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0042f610
mov ecx, dword [eax + 0x18]
mov edi, 0x10
cmp ecx, edi
jb 0x437074
mov eax, dword [eax + 4]
jmp 0x437077
add eax, 4
push eax
lea edx, [esp + 0x2c]
push edx
push str._hsWildTangent_hsCacheHotSauce.hsdat
push 0x104
add esi, 0x6d6
push esi
call fcn.00436ba0
mov esi, eax
mov eax, dword [esp + 0x38]
add esp, 0x14
cmp eax, edi
jb 0x4370ad
mov eax, dword [esp + 0x10]
push eax
call fcn.00469348
add esp, 4
cmp esi, ebx
mov al, 1
jge 0x4370b5
mov al, bl
mov ecx, dword [esp + 0x134]
call fcn.0044e944
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43a060
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x47cab8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
lea ebp, [ebx + ebx + 2]
cmp ebp, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x14], ebx
jge 0x43a148
lea esp, [esp]
mov esi, dword [esp + 0x28]
mov eax, ebp
imul eax, eax, 0x1c
mov ecx, dword [eax + esi - 4]
mov edi, dword [eax + esi - 8]
add eax, esi
cmp ecx, 0x10
mov dword [esp + 0x10], edi
jb 0x43a0c5
mov ecx, dword [eax - 0x18]
mov dword [esp + 0x2c], ecx
jmp 0x43a0cc
lea edx, [eax - 0x18]
mov dword [esp + 0x2c], edx
mov edx, dword [eax + 0x14]
mov ecx, edx
cmp ecx, edx
jae 0x43a0d5
test edx, edx
je 0x43a10c
cmp edx, edi
mov ecx, edx
jb 0x43a0e1
mov ecx, edi
cmp dword [eax + 0x18], 0x10
jb 0x43a0ec
mov eax, dword [eax + 4]
jmp 0x43a0ef
add eax, 4
mov edi, dword [esp + 0x2c]
mov esi, eax
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x43a100
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov esi, dword [esp + 0x28]
jne 0x43a119
mov edi, dword [esp + 0x10]
cmp edx, edi
jb 0x43a11b
xor eax, eax
cmp edx, edi
setne al
test eax, eax
jge 0x43a11c
dec ebp
mov eax, ebp
imul eax, eax, 0x1c
mov ecx, ebx
imul ecx, ecx, 0x1c
push 0xffffffffffffffff
add eax, esi
push 0
add ecx, esi
push eax
call fcn.00401500
mov eax, dword [esp + 0x30]
mov ebx, ebp
lea ebp, [ebp + ebp + 2]
cmp ebp, eax
jl 0x43a0a0
jmp 0x43a14c
mov esi, dword [esp + 0x28]
cmp ebp, eax
jne 0x43a16f
imul eax, eax, 0x1c
mov ecx, ebx
imul ecx, ecx, 0x1c
push 0xffffffffffffffff
lea eax, [eax + esi - 0x1c]
push 0
add ecx, esi
push eax
call fcn.00401500
mov eax, dword [esp + 0x30]
lea ebx, [eax - 1]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x58]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push edx
mov byte [ecx + 4], 0
call fcn.00401500
mov eax, dword [esp + 0x30]
push eax
push ebx
push esi
call fcn.00439d90
mov eax, dword [esp + 0x74]
add esp, 0x28
cmp eax, 0x10
jb 0x43a1bd
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00469348
add esp, 4
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret

Function at 0x43cb40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push edi
mov edi, ecx
mov al, byte [edi + 4]
test al, al
jne 0x43cb6a
push 0x4bb0c0
lea ecx, [esp + 8]
call fcn.0044ee54
push 0x4b3ed8
lea eax, [esp + 8]
push eax
call fcn.0044e8d9
mov eax, dword [edi + 0x3cc]
xor edx, edx
test eax, eax
jle 0x43cb97
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
mov cl, byte [esi]
mov bl, byte [eax]
xor bl, cl
inc esi
mov byte [eax], bl
mov ecx, dword [edi + 0x3cc]
inc eax
inc edx
cmp edx, ecx
jl 0x43cb80
pop esi
pop ebx
pop edi
add esp, 0xc
ret 8
Function at 0x43eca0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x43eccb
movsx ecx, byte [esp]
push ecx
call fcn.0044facd
add esp, 4
test eax, eax
jne 0x43ecd4
mov al, 0x43
add esp, 0x104
ret
movsx edx, byte [esp]
push edx
call fcn.00450936
add esp, 4
add esp, 0x104
ret

Function at 0x43ede0
Capabilities:
Get mac address on windows

Disassembly:
mov eax, 0x2904
call fcn.0044f4b0
push ebx
push esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x110]
xor ebx, ebx
mov dword [esp + 0xc], ebx
push ecx
mov dword [esp + 0x10], 0x2800
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
je 0x43ee3c
mov esi, dword [esp + 0x2910]
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x497880
mov ecx, esi
mov byte [esi + 4], bl
call fcn.004015f0
mov eax, esi
pop esi
pop ebx
add esp, 0x2904
ret
mov edx, dword [esp + 0x2914]
lea eax, [esp + 0x10c]
xor ecx, ecx
push edi
lea ecx, [ecx]
movzx esi, byte [eax + 0x196]
movzx edi, byte [eax + 0x197]
shl esi, 8
add esi, edi
movzx edi, byte [eax + 0x198]
shl esi, 8
add esi, edi
movzx edi, byte [eax + 0x199]
shl esi, 8
add esi, edi
je 0x43ef18
cmp edx, ebx
jl 0x43ee8d
cmp edx, ecx
jne 0x43ef1c
movzx edx, byte [eax + 0x199]
movzx ecx, byte [eax + 0x198]
push edx
movzx edx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push edx
movzx edx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push edx
push eax
push str._02X__02X__02X__02X__02X__02X
lea ecx, [esp + 0x2c]
push 0x100
push ecx
call fcn.0045378a
mov esi, dword [esp + 0x2938]
lea eax, [esp + 0x34]
mov byte [esp + 0x133], bl
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
add esp, 0x24
mov byte [esi + 4], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x43eef6
sub eax, edx
push eax
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.004015f0
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x2904
ret
cmp edx, ecx
je 0x43ef27
mov eax, dword [eax]
inc ecx
cmp eax, ebx
jne 0x43ee50
mov esi, dword [esp + 0x2914]
mov ecx, esi
push 0x497880
call fcn.004016e0
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x2904
ret
Function at 0x43ef50
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47cfab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x234
mov al, byte [ebp + 8]
test al, al
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [esi], 0
jne 0x43efcf
push 0x104
lea eax, [esp + 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x43efa0
mov byte [ebp + 8], 0x43
jmp 0x43efcf
movsx ecx, byte [esp + 0x130]
push ecx
call fcn.0044facd
add esp, 4
test eax, eax
jne 0x43efbb
mov byte [ebp + 8], 0x43
jmp 0x43efcf
movsx edx, byte [esp + 0x130]
push edx
call fcn.00450936
add esp, 4
mov byte [ebp + 8], al
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
mov eax, dword [ebp + 8]
push eax
push 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x24c], 0
call fcn.00402630
push 2
push 0x49f8fc
lea ecx, [esp + 0x14]
call fcn.00402040
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x24]
mov edi, 0x10
cmp eax, edi
mov eax, dword [esp + 0x10]
jae 0x43f030
lea eax, [esp + 0x10]
push 0
push 0
push 0
push 0
push esi
push 0x104
lea ecx, [esp + 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x43f05b
cmp dword [esp + 0x24], edi
jb 0x43f08c
mov edx, dword [esp + 0x10]
push edx
jmp 0x43f084
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43f062
mov ecx, dword [ebp + 0x10]
sub eax, edx
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004015f0
cmp dword [esp + 0x24], edi
jb 0x43f08c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00469348
add esp, 4
mov ecx, dword [esp + 0x23c]
pop edi
mov al, 1
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x441960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx + edi + 0x78]
add ecx, edi
add eax, edi
cmp word [ecx + 0x18], 0x10b
je 0x441982
xor eax, eax
pop edi
add esp, 8
ret
mov ecx, dword [eax + 0x1c]
add ecx, edi
push ebx
push ebp
mov ebp, dword [eax + 0x20]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
add ecx, edi
add ebp, edi
xor edx, edx
test eax, eax
push esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], eax
jbe 0x4419f6
lea esp, [esp]
mov eax, dword [ebp + edx*4]
mov esi, dword [esp + 0x20]
add eax, edi
lea ebx, [ebx]
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x4419e4
test cl, cl
je 0x4419e0
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x4419e4
add eax, 2
add esi, 2
test cl, cl
jne 0x4419c0
xor eax, eax
jmp 0x4419e9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x441a00
mov eax, dword [esp + 0x1c]
inc edx
cmp edx, eax
jb 0x4419b0
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 8
ret
mov eax, dword [esp + 0x10]
movzx ecx, word [eax + edx*2]
mov edx, dword [esp + 0x14]
mov eax, dword [edx + ecx*4]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x441a20
Capabilities:
Check for software breakpoints
Resolve function by parsing pe exports

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov eax, dword [edx + 0x3c]
add eax, edx
push ebx
mov ebx, dword [eax + 0x78]
add ebx, edx
cmp word [eax + 0x18], 0x10b
mov dword [esp + 0xc], ebx
je 0x441a41
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x18]
push ebp
mov ebp, dword [ebx + 0x24]
push esi
push edi
mov edi, dword [ebx + 0x1c]
add eax, edx
add edi, edx
add ebp, edx
xor esi, esi
test ecx, ecx
mov dword [esp + 0x10], eax
jbe 0x441ae1
jmp 0x441a70
mov eax, dword [esp + 0x10]
lea ebx, [ebx]
mov ecx, dword [eax + esi*4]
movzx eax, word [ebp + esi*2]
mov eax, dword [edi + eax*4]
add ecx, edx
add eax, edx
cmp dword [0x4bf8e0], 0
jne 0x441a99
cmp byte [eax], 0xb8
jne 0x441ad9
cmp byte [eax + 9], 0xcd
jne 0x441ad9
cmp byte [eax + 0xa], 0x2e
jmp 0x441ac3
cmp dword [0x4bf8e0], 1
jne 0x441ad9
cmp byte [eax], 0xb8
jne 0x441ad9
cmp byte [eax + 5], 0xba
jne 0x441ad9
cmp byte [eax + 6], 0
jne 0x441ad9
cmp byte [eax + 7], 3
jne 0x441ad9
cmp byte [eax + 8], 0xfe
jne 0x441ad9
cmp byte [eax + 9], 0x7f
jne 0x441ad9
mov eax, dword [eax + 1]
cmp eax, dword [esp + 0x20]
jae 0x441ad5
mov ebx, dword [esp + 0x1c]
mov dword [ebx + eax*4], ecx
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 0x18]
inc esi
cmp esi, eax
jb 0x441a66
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x441af0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.RtlAnsiStringToUnicodeString
push esi
call edi
push str.RtlInitAnsiString
push esi
mov dword [0x4bf8dc], eax
call edi
push str.RtlInitUnicodeString
push esi
mov dword [0x4bf8d8], eax
call edi
push str.RtlFreeUnicodeString
push esi
mov dword [0x4bf8d4], eax
call edi
push str.NtOpenSection
push esi
mov dword [0x4bf8d0], eax
call edi
push str.NtMapViewOfSection
push esi
mov dword [0x4bf8cc], eax
call edi
push str.NtUnmapViewOfSection
push esi
mov dword [0x4bf8c8], eax
call edi
push str.ZwQuerySystemInformation
push esi
mov dword [0x4bf8c4], eax
call edi
mov ecx, dword [0x4bf8dc]
test ecx, ecx
pop edi
mov dword [0x4bf8c0], eax
pop esi
je 0x441bbf
mov ecx, dword [0x4bf8d8]
test ecx, ecx
je 0x441bbf
mov ecx, dword [0x4bf8d4]
test ecx, ecx
je 0x441bbf
mov ecx, dword [0x4bf8d0]
test ecx, ecx
je 0x441bbf
mov ecx, dword [0x4bf8cc]
test ecx, ecx
je 0x441bbf
mov ecx, dword [0x4bf8c8]
test ecx, ecx
je 0x441bbf
mov ecx, dword [0x4bf8c4]
test ecx, ecx
je 0x441bbf
test eax, eax
je 0x441bbf
mov eax, 1
ret
xor eax, eax
ret
Function at 0x443110
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
lea eax, [esp + 4]
push eax
push 1
xor edi, edi
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x443186
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
push ebp
lea edx, [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
push str.ProgramFilesDir
push eax
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x443179
test esi, esi
jbe 0x443174
mov byte [esi + ebp - 1], al
mov edi, 1
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
mov eax, edi
pop edi
add esp, 0xc
ret

Function at 0x443200
Capabilities:
Access peb ldr_data
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x47d48b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], ebx
mov byte [esp + 0xc], bl
push 1
push 0x26
lea eax, [esp + 0x30]
push eax
push ebx
mov dword [esp + 0x144], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x443266
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x443255
sub eax, edx
push eax
lea ecx, [esp + 0x2c]
push ecx
jmp 0x4432bf
lea edx, [esp + 0x28]
push 0x104
push edx
call fcn.00443110
add esp, 8
test eax, eax
je 0x443294
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x443283
sub eax, edx
push eax
lea eax, [esp + 0x2c]
push eax
jmp 0x4432bf
push 0x104
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x4432c8
lea eax, [esp + 0x28]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4432b0
sub eax, edx
push eax
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x10]
call fcn.004015f0
mov esi, dword [esp + 0x13c]
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x10]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00401500
cmp dword [esp + 0x20], 0x10
jb 0x4432ff
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00469348
add esp, 4
mov ecx, dword [esp + 0x12c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x130
ret
Function at 0x444a81
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x444ad4
call fcn.00472916
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x444ad4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x444aca
xor eax, eax
jmp 0x444bed
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x444b04
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x444b04
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x444bea
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x444b31
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.004445f1
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x444bea
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x444b7a
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x444b7a
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x444b74
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.004445f1
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x444bda
and dword [ebp + 0xc], 0
jmp 0x444bda
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x444bda
push 0xc
call fcn.0046931d
mov esi, eax
test esi, esi
pop ecx
je 0x444bbc
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x444bbe
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x444bd5
push dword [ebp - 8]
call fcn.00468df0
jmp 0x444bda
call fcn.00468dc7
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x444b3f
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc