joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4385a0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x510852
mov eax, dword fs:[0]
push eax
sub esp, 0x5bc
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x5b4], eax
push ebx
push ebp
push esi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x5cc]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x5dc]
mov ebx, ecx
mov dword [esp + 0x10], ebx
test ebp, ebp
je 0x438728
lea esi, [esp + 0x26c]
call fcn.00425230
xor esi, esi
mov dword [esp + method.t_fileRead.virtual_0], vtable.t_fileRead.0
mov dword [esp + 0x5b8], 0x54bd20
mov dword [esp + 0x5bc], esi
mov dword [esp + 0x5c0], esi
mov dword [esp + 0x5d4], esi
mov byte [esp + 0x18], 0
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x20]
call fcn.004174b0
mov eax, ebx
lea edx, [esp + 0x20]
call fcn.00417710
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x274]
mov byte [esp + 0x5dc], 3
call fcn.00427790
test al, al
mov byte [esp + 0x5d4], 1
sete bl
cmp byte [esp + 0x13c], 0
mov dword [esp + 0x20], vtable.t_str.0
jne 0x438697
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x2c]
cmp eax, edx
je 0x438697
push eax
call fcn.004ed7b6
add esp, 4
test bl, bl
jne 0x4386f2
mov ecx, dword [esp + 0x270]
lea eax, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4386c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x4386c5
mov esi, ebx
push esi
mov ecx, ebp
call fcn.00405c10
push esi
mov ebx, eax
push ebx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x5c4]
call fcn.004277f0
test al, al
jne 0x43872f
lea ecx, [esp + 0x26c]
call fcn.00425580
lea ecx, [esp + 0x14]
call fcn.004163d0
mov dword [esp + 0x5d4], 0xffffffff
lea ecx, [esp + 0x26c]
mov dword [esp + method.t_fileRead.virtual_0], vtable.t_fileRead.0
mov dword [esp + 0x5b8], 0x54bd40
call fcn.004252a0
xor al, al
jmp 0x4387ed
lea ecx, [esp + 0x144]
call fcn.004174b0
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x144]
call fcn.00417710
lea ecx, [esp + 0x144]
mov byte [esp + 0x5d4], 5
call fcn.0041fa50
mov dword [esp + 0x10], eax
mov eax, dword [edi + 4]
mov eax, dword [eax]
lea ecx, [edi + 4]
push ebp
lea edx, [esp + 0x14]
push edx
call eax
lea ecx, [esp + 0x26c]
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], ebx
call fcn.00425580
cmp byte [esp + 0x260], 0
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jne 0x4387b5
mov eax, dword [esp + 0x14c]
lea ecx, [esp + 0x150]
cmp eax, ecx
je 0x4387b5
push eax
call fcn.004ed7b6
add esp, 4
lea ecx, [esp + 0x14]
call fcn.004163d0
mov dword [esp + 0x5d4], 0xffffffff
lea ecx, [esp + 0x26c]
mov dword [esp + method.t_fileRead.virtual_0], vtable.t_fileRead.0
mov dword [esp + 0x5b8], 0x54bd40
call fcn.004252a0
mov al, 1
mov ecx, dword [esp + 0x5cc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5b4]
xor ecx, esp
call fcn.004ecddb
add esp, 0x5c8
ret 4
Function at 0x439c70
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x514056
mov eax, dword fs:[0]
push eax
sub esp, 0x36c
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x364], eax
push ebx
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x378]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, esi
call fcn.0041e510
test al, al
jne 0x439cc3
xor al, al
jmp 0x439e77
mov eax, dword [ebx + 4]
mov edx, dword [eax + 8]
lea ecx, [ebx + 4]
xor edi, edi
mov dword [ebx + 0x10], edi
call edx
lea ecx, [ebx + 0x18]
mov dword [ebx + 0x14], edi
call fcn.00405700
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x439ced
mov eax, dword [esi + 8]
add eax, 4
push eax
lea eax, [esp + 0x168]
push str._s.
push eax
call fcn.00411b10
add esp, 0xc
push 0x5779c0
lea ecx, [esp + 0x168]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x439cbc
mov ecx, 0x546720
mov eax, 0x5779ec
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x439d56
test dx, dx
je 0x439d52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x439d56
add eax, 4
add ecx, 4
test dx, dx
jne 0x439d30
xor eax, eax
jmp 0x439d5b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x439e5a
mov ecx, 0x546724
mov eax, 0x5779ec
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x439d96
test dx, dx
je 0x439d92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x439d96
add eax, 4
add ecx, 4
test dx, dx
jne 0x439d70
xor eax, eax
jmp 0x439d9b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x439e5a
push 0x5779ec
mov ecx, esi
call fcn.00417d60
push eax
lea edx, [esp + 0x16c]
push 0x54672c
push edx
call fcn.00411b10
add esp, 0x10
lea ecx, [esp + 0x3c]
call fcn.004174b0
lea eax, [esp + 0x164]
lea edx, [esp + 0x3c]
call fcn.00417710
mov dword [esp + 0x380], 1
cmp byte [esp + 0x158], 0
lea eax, [esp + 0x48]
jne 0x439dfb
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0xc]
push ecx
add eax, 4
push eax
call fcn.004eea16
add esp, 8
test eax, eax
jne 0x439e28
test dword [esp + 0x12], 0x4000
jne 0x439e28
push eax
push eax
lea ecx, [esp + 0x16c]
call fcn.00438ef0
mov dword [esp + 0x380], 0xffffffff
cmp byte [esp + 0x158], 0
mov dword [esp + 0x3c], vtable.t_str.0
jne 0x439e5a
mov eax, dword [esp + 0x44]
lea edx, [esp + 0x48]
cmp eax, edx
je 0x439e5a
push eax
call fcn.004ed7b6
add esp, 4
push 0x5779c0
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x439d20
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov ecx, dword [esp + 0x378]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x364]
xor ecx, esp
call fcn.004ecddb
mov esp, ebp
pop ebp
ret
Function at 0x43da60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x512008
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4c]
xor ebx, ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], 0xff
mov byte [esp + 0x34], 1
mov byte [esp + 0x35], bl
mov eax, dword [esp + 0x48]
lea esi, [esp + 0xc]
mov dword [esp + 0x40], ebx
call fcn.0043db10
cmp byte [esp + 0x34], bl
jne 0x43daee
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x38
ret 0x14

Function at 0x441830
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [esi]
mov edx, dword [eax + 0xb8]
push 0
mov ecx, esi
mov byte [esi + 0x20a], 0
mov byte [esi + 0x38], 0
mov byte [esi + 0x208], 0
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x78]
push 0
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x84]
push 1
mov ecx, esi
call edx
mov ecx, esi
call fcn.00435620
mov eax, dword [esi + 0x1e8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x4437d0
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x5c
push ebx
xor eax, eax
xor ecx, ecx
push edi
test edx, edx
je 0x4437e2
mov eax, dword [edx]
mov ecx, dword [edx + 4]
push 2
push ecx
push eax
call dword [sym.imp.USER32.dll_MonitorFromPoint]
lea ecx, [esp + 0x38]
push ecx
push eax
mov dword [esp + 0x40], 0x28
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x443825
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov dword [esi], edx
mov edx, dword [esp + 0x58]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
pop edi
pop ebx
add esp, 0x5c
ret
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
push 1
mov ebx, eax
call edi
xor edx, edx
xor ecx, ecx
mov dword [esi], ecx
mov dword [esi + 4], edx
push edx
mov dword [esi + 8], ebx
push 0x54d67c
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
mov dword [esi + 0xc], eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x443896
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.USER32.dll_IntersectRect]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_SubtractRect]
pop edi
pop ebx
add esp, 0x5c
ret
Function at 0x444360
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 0x10], esi
je 0x4444df
lea eax, [esp + 0x30]
push eax
push edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
call fcn.00444630
cmp dword [edi + 0x18], 0x5a
jge 0x4443a4
mov eax, dword [edi + 0x10]
mov dword [esp + 0x10], eax
jmp 0x4443b5
mov edi, dword [edi + 0x14]
cmp edi, esi
je 0x4444df
mov dword [esp + 0x10], edi
mov eax, edi
mov ecx, dword [eax + 0x28]
sub ecx, dword [eax + 0x20]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
sub edi, dword [esp + 0x30]
sub ebx, dword [esp + 0x34]
mov dword [esp + 0x48], ecx
mov ecx, dword [eax + 0x2c]
sub ecx, dword [eax + 0x24]
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
push eax
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x60], esi
call dword [sym.imp.USER32.dll_GetDC]
push ebx
push edi
push eax
lea esi, [esp + 0x5c]
mov dword [esp + 0x20], eax
call fcn.0043d8c0
mov edx, dword [esp + 0x20]
add esp, 0xc
push edx
test al, al
jne 0x444439
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
call fcn.0043d5e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [eax]
mov eax, dword [esp + 0x58]
push ecx
push 0
push 0
push edx
push ebx
push edi
push 0
push 0
push eax
call dword [sym.imp.MSIMG32.dll_AlphaBlend]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
xor edx, edx
push edx
push ebx
push edi
push ecx
mov dword [esp + 0x3c], ecx
mov ecx, dword [esi + 4]
push eax
push ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], ebx
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [esp + 0x50]
push 2
lea edx, [esp + 0x60]
push edx
push 0
lea eax, [esp + 0x24]
push eax
push ecx
mov ecx, dword [esi + 4]
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x40]
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
mov edx, dword [esi + 4]
push 4
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
lea esi, [esp + 0x50]
call fcn.0043d5e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x445300
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x56b3f8]
test eax, eax
jne 0x445318
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], 0xffffffff
xor al, al
ret 8
push edi
mov edi, dword [esi + 0xc]
test edi, edi
jge 0x44533d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 8]
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], ecx
xor al, al
pop edi
ret 8
mov edx, dword [esp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 4]
push ebx
mov bl, byte [esi + 0x18]
push ebp
mov ebp, edx
sub ebp, eax
cmp ebp, ecx
jle 0x44535a
mov byte [esi + 0x18], 1
jmp 0x445364
sub eax, edx
cmp eax, ecx
jle 0x445372
mov byte [esi + 0x18], 0
mov dword [esi + 0x10], edx
test edi, edi
jne 0x44537a
mov dword [esi + 0xc], 1
pop ebp
pop ebx
xor al, al
pop edi
ret 8
cmp bl, byte [esi + 0x18]
je 0x445372
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [esi + 0x14]
mov dword [esi + 0x14], eax
cmp edx, dword [esi + 8]
ja 0x445372
inc dword [esi + 0xc]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
pop ebp
inc ecx
cmp eax, ecx
pop ebx
sete al
pop edi
ret 8
Function at 0x446770
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x22c
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0x230]
push ebx
push ebp
push esi
push edi
xor edi, edi
push 0x206
mov esi, ecx
mov dword [esp + 0x24], eax
mov dword [eax], edi
lea ecx, [esp + 0x2e]
mov ebx, edx
xor eax, eax
push edi
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], edi
mov word [esp + 0x34], ax
call fcn.004f2770
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFontLinkSystemLink
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 0x208
lea ebp, [esp + 0x34]
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x44680f
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x14]
mov ecx, ebp
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
push str.SimSun
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44680f
cmp dword [esp + 0x14], 7
je 0x44682e
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x44681e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esi + 4]
push ebx
call fcn.0044a150
xor al, al
jmp 0x44693a
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x28]
mov dword [esp + 0x10], edi
call fcn.00446730
mov edi, eax
mov esi, edi
imul esi, esi, 0x20c
add esi, 0x490
push esi
mov dword [esp + 0x20], edi
call fcn.004ed893
add esp, 4
push esi
mov ebx, eax
push 0
push ebx
call fcn.004f2770
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x250]
add esp, 0xc
add edi, 2
mov dword [ebx + 0xc], edi
push str.NSimSun
lea eax, [ebx + 0x78]
mov dword [ebx + 4], edx
lea edi, [ebx + 0x1c]
mov ecx, 0x17
push 0x104
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [ebx + 0x10], 0
call fcn.004ee6af
add esp, 0xc
push str.SurSong
lea ecx, [ebx + 0x284]
push 0x104
push ecx
call fcn.004ee6af
mov eax, dword [esp + 0x28]
add esp, 0xc
test eax, eax
jle 0x44691e
lea esi, [ebx + 0x490]
mov edi, eax
push 0x2c
push ebp
call fcn.004ef15a
add esp, 8
test eax, eax
je 0x4468e9
add eax, 2
jmp 0x4468eb
mov eax, ebp
push eax
push 0x104
push esi
call fcn.004ee6af
mov eax, ebp
add esp, 0xc
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x446900
sub eax, edx
sar eax, 1
add esi, 0x20c
sub edi, 1
lea ebp, [ebp + eax*2 + 2]
jne 0x4468d5
mov eax, dword [esp + 0x24c]
mov edx, dword [esp + 0x248]
mov ecx, dword [esp + 0x20]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], edx
mov dword [ecx], ebx
mov al, 1
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ecddb
add esp, 0x22c
ret
Function at 0x44ae10
Capabilities:
Get common file path

Disassembly:
push 0x5c
push ebx
call fcn.004ef15a
add esp, 8
test eax, eax
jne 0x44ae2e
push 0x2f
push ebx
call fcn.004ef15a
add esp, 8
test eax, eax
je 0x44ae69
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44ae33
push 0
push 0
push 0x104
push edi
sub eax, edx
sar eax, 1
push eax
push ebx
push 0
push 0x3a8
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jg 0x44ae62
xor al, al
ret
mov byte [eax + edi], 0
mov al, 1
ret
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x44ae5f
push str._fonts_
push 0x104
push edi
call fcn.004f501b
mov eax, edi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44ae91
sub eax, edx
push esi
mov esi, eax
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44aea2
push 0
push 0
mov ecx, 0x104
sub eax, edx
sub ecx, esi
push ecx
lea edx, [esi + edi]
push edx
sar eax, 1
push eax
push ebx
push 0
push 0x3a8
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jg 0x44aed8
xor al, al
pop esi
ret
add eax, esi
mov byte [eax + edi], 0
mov al, 1
pop esi
ret
Function at 0x44b1a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x440
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x43c], eax
mov eax, dword [esp + 0x444]
push ebx
push edi
mov edi, edx
xor ebx, ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], ecx
cmp edi, ebx
je 0x44b37b
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44b1d6
sub eax, edx
sar eax, 1
je 0x44b37b
lea edx, [esp + 0x10]
push edx
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFonts
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x1f], bl
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44b37b
mov ecx, dword [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
mov dword [esp + 0x44], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x44b351
push ebp
xor ebp, ebp
mov dword [esp + 0x10], ebp
cmp dword [esp + 0x18], ebx
jbe 0x44b350
push esi
mov edi, edi
push 0
push 0
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x24]
push 0
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x50]
push ecx
push ebx
mov esi, 1
push edx
mov dword [esp + 0x4c], 0x104
mov dword [esp + 0x44], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x44b327
cmp dword [esp + 0x24], esi
jne 0x44b327
mov ecx, dword [esp + 0x458]
mov dword [esp + 0x20], eax
push edi
lea eax, [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x4c]
mov esi, ebp
call fcn.0044b080
mov ebp, dword [esp + 0x24]
add esp, 0x10
test al, al
je 0x44b315
cmp ebp, esi
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], 0x208
jle 0x44b30f
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x248]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x30]
push edx
push 0
lea eax, [esp + 0x4c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x44b303
mov ebp, esi
mov dword [esp + 0x14], ebp
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
mov dword [eax], edx
jmp 0x44b315
mov ebp, esi
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x458]
mov edx, ebp
call fcn.0044aef0
test al, al
jne 0x44b332
inc ebx
cmp ebx, dword [esp + 0x1c]
jb 0x44b250
pop esi
test ebp, ebp
je 0x44b350
mov edi, dword [esp + 0x2c]
lea ebx, [esp + 0x240]
call fcn.0044ae10
test al, al
je 0x44b350
mov byte [esp + 0xf], 1
pop ebp
mov eax, dword [esp + 0x10]
test eax, eax
je 0x44b360
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 0xb]
pop edi
pop ebx
mov ecx, dword [esp + 0x43c]
xor ecx, esp
call fcn.004ecddb
add esp, 0x440
ret
mov ecx, dword [esp + 0x444]
pop edi
pop ebx
xor ecx, esp
xor al, al
call fcn.004ecddb
add esp, 0x440
ret
Function at 0x44b6e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50c3a8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
push 1
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x14], bl
call dword [sym.imp.GDI32.dll_SetBkMode]
mov dword [esp + 0x20], ebx
mov byte [esp + 0xd], bl
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x30], ebx
mov eax, dword [esi]
mov eax, dword [eax + 4]
push ecx
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call eax
lea esi, [esp + 0xc]
call fcn.0043a530
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44b770
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push edi
push 0x3c
call fcn.004ed893
mov edi, eax
xor ebx, ebx
add esp, 4
cmp edi, ebx
jne 0x44b7af
pop edi
mov dword [0x572454], 0x6d
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004ecddb
add esp, 0xc
ret
push esi
push 0x3c
push ebx
push edi
call fcn.004f2770
push 0x6148
call fcn.004ed893
mov esi, eax
add esp, 0x10
cmp esi, ebx
jne 0x44b7f3
push edi
mov dword [0x572454], 0x6d
call fcn.004ed7b6
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004ecddb
add esp, 0xc
ret
mov eax, dword [esp + 0x1c]
mov dword [edi + 0x38], esi
mov dword [esi + 4], ebx
mov dword [esi + 0x38], ebx
mov dword [esi], 8
mov dword [esi + 0x3c], 0x4403a0
mov ecx, dword [edi + 0x38]
mov dword [edi + 0x34], eax
mov eax, dword [ecx + 0x3c]
cmp eax, ebx
je 0x44b829
push 6
lea ecx, [esp + 0x10]
push ecx
push edi
call eax
add esp, 0xc
jmp 0x44b83e
mov edx, dword [ecx + 0x38]
push edx
push 6
lea eax, [esp + 0x14]
push 1
push eax
call fcn.004f1680
add esp, 0x10
cmp eax, 6
je 0x44b84f
mov dword [0x572454], 0x66
jmp 0x44b875
push 3
lea ecx, [esp + 0x10]
push ecx
push str.GIFVER
mov byte [esp + 0x1e], bl
call fcn.004f52b8
add esp, 0xc
test eax, eax
je 0x44b898
mov dword [0x572454], 0x67
push esi
call fcn.004ed7b6
push edi
call fcn.004ed7b6
add esp, 8
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004ecddb
add esp, 0xc
ret
call fcn.0044b8c0
test eax, eax
je 0x44b875
mov ecx, dword [esp + 0x14]
pop esi
mov eax, edi
pop edi
mov dword [0x572454], ebx
pop ebx
xor ecx, esp
call fcn.004ecddb
add esp, 0xc
ret