joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4be28135
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe54
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0x1ac]
mov eax, 0x4be55fe4
call fcn.4be44284
mov word [ebp - 0x22], 0
xor edx, edx
mov dword [ebp - 0x28], edx
push dword [ebp + 8]
call fcn.4be279cc
mov word [ebp - 0x10], 8
test esi, esi
jne 0x4be2817c
mov word [ebp - 0x22], 0x2208
jmp 0x4be28292
lea ecx, [ebp - 0x28]
push ecx
call fcn.4be0a600
mov word [ebp - 0x22], ax
test ax, ax
jne 0x4be28292
push 0x4be560ce
push 0x4be560c3
push dword [ebp - 0x28]
call sub.KERNEL32.dll_FindResourceA
push eax
push dword [ebp - 0x28]
call sub.KERNEL32.dll_LoadResource
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
call sub.KERNEL32.dll_LockResource
mov ebx, eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xac]
push eax
call fcn.4be41cfc
add esp, 8
cmp byte [esi], 0
je 0x4be281f5
push 0x4be560d9
lea edx, [ebp - 0xac]
push edx
call fcn.4be41c6c
add esp, 8
push esi
lea ecx, [ebp - 0xac]
push ecx
call fcn.4be41c6c
add esp, 8
xor esi, esi
jmp 0x4be28254
xor eax, eax
jmp 0x4be28207
mov dl, byte [ebx]
mov byte [ebp + eax - 0x12c], dl
inc eax
mov cl, byte [ebx]
inc ebx
cmp cl, 0x2c
jne 0x4be281fd
mov byte [ebp + eax - 0x12d], 0
mov al, byte [ebx]
mov byte [edi], al
mov eax, 1
jmp 0x4be28228
mov dl, byte [ebx]
mov byte [edi + eax], dl
inc eax
mov cl, byte [ebx]
inc ebx
cmp cl, 0x7d
jne 0x4be28222
mov byte [edi + eax - 1], 0
lea eax, [ebp - 0xac]
push eax
lea edx, [ebp - 0x12c]
push edx
call fcn.4be41cd0
add esp, 8
test eax, eax
jne 0x4be28254
mov esi, 1
cmp byte [ebx], 0
je 0x4be2825d
test esi, esi
je 0x4be281f9
push dword [ebp - 0x2c]
call sub.KERNEL32.dll_GlobalUnlock
test esi, esi
je 0x4be2828c
push edi
call fcn.4be47b30
pop ecx
mov ebx, eax
add ebx, 0x3b00
push 0x80
push dword [ebp + 0x14]
push ebx
call sym.idapi32.dll_OsLoadString
mov word [ebp - 0x22], ax
jmp 0x4be28292
mov word [ebp - 0x22], 0x3106
mov word [ebp - 0x10], 0
jmp 0x4be282a7
push dword [ebp + 8]
call fcn.4be279e0
mov ax, word [ebp - 0x22]
mov edx, dword [ebp - 0x20]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4be2972a
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
push esi
push edi
mov dword [ebp - 4], 1
xor esi, esi
push 0x9b0
call sym.idapi32.dll__OsMalloc
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4be29762
push 0x1400
call sym.idapi32.dll__OsMalloc
pop ecx
mov esi, eax
test eax, eax
jne 0x4be2976b
mov bx, 0x2501
jmp 0x4be29958
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
lea edi, [ebp - 0x1c]
push 0
push 0x4be56228
push 0x4be56220
push 0x4be55763
lea eax, [ebp - 0x124]
push eax
push edi
call sym.idapi32.dll__CfgBuildPath
add esp, 0x18
push esi
push dword [ebp - 0xc]
lea edx, [ebp - 6]
push edx
lea ecx, [ebp - 0x124]
push ecx
push edi
call fcn.4be287a2
mov ax, word [ebp - 6]
push eax
push dword [ebp - 0xc]
push esi
push 0x4be55793
lea edx, [ebp - 0x1a8]
push edx
call fcn.4be29120
test eax, eax
jne 0x4be29853
push 0
push 0
push 0x4be55906
push 0x4be5575c
lea ecx, [ebp - 0x124]
push ecx
push edi
call sym.idapi32.dll__CfgBuildPath
add esp, 0x18
push esi
push dword [ebp - 0xc]
lea eax, [ebp - 6]
push eax
lea edx, [ebp - 0x124]
push edx
push edi
call fcn.4be287a2
mov ebx, eax
mov ax, word [ebp - 6]
push eax
push dword [ebp - 0xc]
push esi
push 0x4be55793
lea edx, [ebp - 0x1a8]
push edx
call fcn.4be29120
test eax, eax
jne 0x4be2982e
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x4be2987b
push 0
push 0x4be55793
push 0x4be55906
push 0x4be5575c
lea eax, [ebp - 0x124]
push eax
push edi
call sym.idapi32.dll__CfgBuildPath
add esp, 0x18
mov ebx, eax
jmp 0x4be2987b
push 0
push 0x4be55793
push 0x4be56235
push 0x4be5622d
push 0x4be55763
lea eax, [ebp - 0x124]
push eax
push edi
call sym.idapi32.dll__CfgBuildPath
add esp, 0x1c
mov ebx, eax
cmp dword [ebp - 4], 0
jne 0x4be2993f
push 0
push 0x4be56242
push 0x4be5623a
push 0x4be55763
lea eax, [ebp - 0x124]
push eax
push edi
call sym.idapi32.dll__CfgBuildPath
add esp, 0x18
mov ebx, eax
test bx, bx
jne 0x4be2993f
lea eax, [ebp - 0x124]
push eax
push dword [ebp + 8]
call fcn.4be2a887
push 0
push 2
push 1
push 0x4be56247
push dword [ebp + 8]
call fcn.4be2abc3
mov ebx, eax
test bx, bx
jne 0x4be29919
push 0x80
push esi
push 0x3ac4
call sym.idapi32.dll_OsLoadString
mov al, byte [esi]
mov byte [ebp - 0xd], al
mov bl, 0x41
mov byte [esi], bl
push esi
call sub.KERNEL32.dll_GetDriveTypeA
cmp eax, 3
je 0x4be29904
inc ebx
cmp bl, 0x5a
jbe 0x4be298f1
cmp bl, 0x5a
jbe 0x4be2990e
mov al, byte [ebp - 0xd]
mov byte [esi], al
push esi
push dword [ebp + 8]
call fcn.4be2adbc
mov ebx, eax
push 0
push 0x4be5625c
push 0x4be56257
push 0x4be5624f
push 0x4be55763
lea eax, [ebp - 0x124]
push eax
push edi
call sym.idapi32.dll__CfgBuildPath
add esp, 0x1c
lea edx, [ebp - 0x124]
push edx
push dword [ebp + 8]
call fcn.4be2a887
push 2
push dword [ebp + 8]
call fcn.4be2b1c4
push dword [ebp - 0xc]
call sym.idapi32.dll__OsFree
pop ecx
push esi
call sym.idapi32.dll__OsFree
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4be2b5b8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x84]
push 0x80
push edi
push 0x3a07
call sym.idapi32.dll_OsLoadString
test ax, ax
jne 0x4be2b634
push 0
push 1
push 1
push edi
push esi
call fcn.4be2abc3
push 0x80
push edi
push 0x3ac4
call sym.idapi32.dll_OsLoadString
mov al, byte [edi]
mov byte [ebp - 1], al
mov bl, 0x41
jmp 0x4be2b616
mov byte [edi], bl
push edi
call sub.KERNEL32.dll_GetDriveTypeA
cmp eax, 3
je 0x4be2b61f
inc ebx
xor eax, eax
mov al, bl
cmp eax, 0x5a
jle 0x4be2b608
xor edx, edx
mov dl, bl
cmp edx, 0x5a
jle 0x4be2b62d
mov cl, byte [ebp - 1]
mov byte [edi], cl
push edi
push esi
call fcn.4be2adbc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4be2bc0a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0
push 0
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x110]
push edx
push esi
call fcn.4be2aa7c
mov ebx, eax
test bx, bx
jne 0x4be2bd06
cmp dword [ebp - 8], 0
jne 0x4be2bc8f
lea eax, [ebp - 0x218]
push eax
lea edx, [ebp - 0x110]
push edx
call sub.USER32.dll_OemToCharA
lea ecx, [ebp - 4]
push ecx
lea eax, [ebp - 0x218]
push eax
push edi
call sub.ADVAPI32.dll_RegCreateKeyA
test eax, eax
jne 0x4be2bcfd
push esi
call fcn.4be2a9be
push esi
push dword [ebp - 4]
call fcn.4be2bc0a
push esi
call fcn.4be2aa2b
mov ebx, eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
jmp 0x4be2bcfd
lea eax, [ebp - 0x320]
push eax
push 0x80
push esi
call fcn.4be2ad30
mov ebx, eax
test bx, bx
jne 0x4be2bcfd
lea eax, [ebp - 0x218]
push eax
lea edx, [ebp - 0x110]
push edx
call sub.USER32.dll_OemToCharA
lea ecx, [ebp - 0x428]
push ecx
lea eax, [ebp - 0x320]
push eax
call sub.USER32.dll_OemToCharA
lea edx, [ebp - 0x428]
push edx
call fcn.4be41d2c
pop ecx
inc eax
push eax
lea ecx, [ebp - 0x428]
push ecx
push 1
push 0
lea eax, [ebp - 0x218]
push eax
push edi
call sub.ADVAPI32.dll_RegSetValueExA
test eax, eax
je 0x4be2bcfd
mov bx, 0x2503
test bx, bx
je 0x4be2bc1c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4be2bd11
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
mov ebx, dword [ebp + 8]
jmp 0x4be2bd52
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x10c]
push edx
push ebx
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4be2bd52
push dword [ebp - 4]
call fcn.4be2bd11
lea ecx, [ebp - 0x10c]
push ecx
push ebx
call sub.ADVAPI32.dll_RegDeleteKeyA
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
push 0x105
lea eax, [ebp - 0x10c]
push eax
push 0
push ebx
call sub.ADVAPI32.dll_RegEnumKeyA
test eax, eax
je 0x4be2bd20
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4be2be0e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
push 0
push 0
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x2c]
push edx
push ebx
call fcn.4be2aa7c
test ax, ax
jne 0x4be2bf92
test ax, ax
je 0x4be2be54
cmp ax, 0x2205
jne 0x4be2bf92
xor eax, eax
jmp 0x4be2bf92
cmp dword [ebp - 4], 0
je 0x4be2bf07
test ax, ax
jne 0x4be2bf89
lea edx, [ebp - 8]
push edx
push esi
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4be2bede
lea ecx, [ebp - 0x154]
push ecx
push 0x80
push ebx
call fcn.4be2ad30
lea eax, [ebp - 0x4c]
push eax
lea edx, [ebp - 0x2c]
push edx
call sub.USER32.dll_OemToCharA
lea ecx, [ebp - 0x25c]
push ecx
lea eax, [ebp - 0x154]
push eax
call sub.USER32.dll_OemToCharA
lea edx, [ebp - 0x25c]
push edx
call fcn.4be41d2c
pop ecx
inc eax
push eax
lea ecx, [ebp - 0x25c]
push ecx
push 1
push 0
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegSetValueExA
test eax, eax
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegCloseKey
jmp 0x4be2bee7
mov ax, 0x2105
jmp 0x4be2bf92
push 0
push 0
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 0x2c]
push ecx
push ebx
call fcn.4be2aa7c
test ax, ax
je 0x4be2be67
jmp 0x4be2bf89
push edi
call fcn.4be41d2c
pop ecx
mov word [ebp - 0xa], ax
push esi
call fcn.4be41d2c
pop ecx
mov word [ebp - 0xc], ax
push 0x4be567f5
push edi
call fcn.4be41c6c
add esp, 8
push 0x4be567f7
push esi
call fcn.4be41c6c
add esp, 8
lea eax, [ebp - 0x2c]
push eax
push edi
call fcn.4be41c6c
add esp, 8
lea edx, [ebp - 0x2c]
push edx
push esi
call fcn.4be41c6c
add esp, 8
push ebx
call fcn.4be2a9be
push ebx
push edi
push esi
call fcn.4be2be0e
push ebx
call fcn.4be2aa2b
movzx ecx, word [ebp - 0xa]
mov byte [edi + ecx], 0
movzx eax, word [ebp - 0xc]
mov byte [esi + eax], 0
push 0
push 0
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 0x2c]
push ecx
push ebx
call fcn.4be2aa7c
test ax, ax
je 0x4be2be3e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4be2c04c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff8bc
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x105
lea eax, [ebp - 0x114]
push eax
push 0
push edi
call sub.ADVAPI32.dll_RegEnumKeyA
test eax, eax
jne 0x4be2c0ea
xor ebx, ebx
jmp 0x4be2c0d3
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x114]
push edx
push edi
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4be2c0d2
lea ecx, [ebp - 0x21c]
push ecx
lea eax, [ebp - 0x114]
push eax
call sub.USER32.dll_CharToOemA
push 0
push 1
push 0
lea edx, [ebp - 0x21c]
push edx
push esi
call fcn.4be2abc3
push esi
call fcn.4be2a9be
push dword [ebp - 4]
push esi
call fcn.4be2c04c
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
push esi
call fcn.4be2aa2b
inc ebx
push 0x105
lea ecx, [ebp - 0x114]
push ecx
push ebx
push edi
call sub.ADVAPI32.dll_RegEnumKeyA
test eax, eax
je 0x4be2c07a
xor ebx, ebx
mov dword [ebp - 0xc], 0x105
mov dword [ebp - 8], 0x105
jmp 0x4be2c151
lea eax, [ebp - 0x744]
push eax
lea edx, [ebp - 0x63c]
push edx
call sub.USER32.dll_CharToOemA
lea ecx, [ebp - 0x534]
push ecx
lea eax, [ebp - 0x42c]
push eax
call sub.USER32.dll_CharToOemA
push 0
push 1
push 1
lea edx, [ebp - 0x534]
push edx
push esi
call fcn.4be2abc3
lea ecx, [ebp - 0x744]
push ecx
push esi
call fcn.4be2adbc
inc ebx
mov dword [ebp - 0xc], 0x105
mov dword [ebp - 8], 0x105
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x63c]
push edx
push 0
push 0
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x42c]
push eax
push ebx
push edi
call sub.ADVAPI32.dll_RegEnumValueA
test eax, eax
je 0x4be2c0fc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4be31a59
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, 0x4be5740c
call fcn.4be44284
mov word [ebp - 0x22], 0
cmp dword [ebx + 0x16], 0
je 0x4be31a83
mov edx, dword [ebx + 0x16]
mov esi, dword [edx + 0xc]
jmp 0x4be31a92
mov eax, dword [0x4be576f0]
push dword [eax + 0x3b]
call sub.KERNEL32.dll_TlsGetValue
mov esi, eax
push 0
push 0
call sym.idapi32.dll_SysLock
mov word [ebp - 0x10], 8
cmp word [ebx + 0x14], 0
je 0x4be31ab8
movzx eax, word [ebx + 0x14]
mov edx, dword [esi + 0x13c]
cmp ebx, dword [edx + eax*4 - 4]
je 0x4be31ae3
push esi
call fcn.4be319d0
test ax, ax
jne 0x4be31acb
mov word [ebp - 0x22], 0x250b
jmp 0x4be31ae3
movsx ecx, ax
mov edx, dword [esi + 0x13c]
mov dword [edx + ecx*4 - 4], ebx
inc word [esi + 0x36]
mov dword [ebx + 0x10], esi
mov word [ebx + 0x14], ax
mov word [ebp - 0x10], 0
jmp 0x4be31af8
push 0
push 0
call sym.idapi32.dll_SysUnlock
mov ax, word [ebp - 0x22]
mov ecx, dword [ebp - 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4be31b18
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4be576f0]
push dword [eax + 0x3b]
call sub.KERNEL32.dll_TlsGetValue
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], eax
xor eax, eax
pop ebp
ret 4

Function at 0x4be31d5f
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov eax, dword [0x4be576f0]
push dword [eax + 0x3b]
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
push 0
push 0
call sym.idapi32.dll_SysLock
mov eax, esi
shl eax, 3
sub eax, esi
cmp dword [ebx + eax*2 + 0x14a], 0
jne 0x4be31d96
xor esi, esi
mov eax, esi
shl eax, 3
sub eax, esi
cmp dword [ebx + eax*2 + 0x14a], 0
je 0x4be31e11
cmp dword [ebp + 0xc], 0
je 0x4be31dc0
mov edx, esi
shl edx, 3
sub edx, esi
mov ecx, dword [ebx + edx*2 + 0x140]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
cmp dword [ebp + 0x10], 0
je 0x4be31ddb
mov edx, esi
shl edx, 3
sub edx, esi
mov cx, word [ebx + edx*2 + 0x144]
mov eax, dword [ebp + 0x10]
mov word [eax], cx
cmp dword [ebp + 0x14], 0
je 0x4be31df4
mov edx, esi
shl edx, 3
sub edx, esi
mov ecx, dword [ebx + edx*2 + 0x146]
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov edx, esi
shl edx, 3
sub edx, esi
mov ecx, dword [ebx + edx*2 + 0x14a]
mov dword [edi], ecx
push 0
push 0
call sym.idapi32.dll_SysUnlock
xor eax, eax
jmp 0x4be31e22
xor edx, edx
mov dword [edi], edx
push 0
push 0
call sym.idapi32.dll_SysUnlock
mov ax, 0x2720
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x4be31f68
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [0x4be576f0]
push dword [eax + 0x3b]
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
test esi, esi
je 0x4be31f8c
cmp byte [esi], 0
jne 0x4be31f9a
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
xor eax, eax
jmp 0x4be32007
lea edx, [ebp - 0x24]
push edx
push esi
call sub.USER32.dll_OemToCharA
lea ecx, [ebp - 0x24]
push ecx
call sub.USER32.dll_CharUpperA
lea eax, [ebp - 0x44]
push eax
lea edx, [ebp - 0x24]
push edx
call sub.USER32.dll_CharToOemA
xor esi, esi
mov word [ebp - 2], 0
jmp 0x4be31ff3
movzx eax, si
mov edx, dword [ebx + 0x3c]
mov edi, dword [edx + eax*4]
test edi, edi
je 0x4be31ff2
lea eax, [ebp - 0x44]
push eax
lea edx, [edi + 0x12]
push edx
call fcn.4be41cd0
add esp, 8
test eax, eax
jne 0x4be31fee
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edi
xor eax, eax
jmp 0x4be32007
inc word [ebp - 2]
inc esi
cmp si, word [ebx + 0x40]
jae 0x4be32003
mov dx, word [ebp - 2]
cmp dx, word [ebx + 0x32]
jb 0x4be31fc4
mov ax, 0x273c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4be336dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, 0x4be578fd
call fcn.4be44284
mov esi, 0x4be577d8
lea edi, [ebp - 0x4c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4be577f8
lea edi, [ebp - 0x154]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x2c], 0x1f
push 1
push 0x4be62d00
call sub.ADVAPI32.dll_InitializeSecurityDescriptor
push 0
push 0
push 1
push 0x4be62d00
call sub.ADVAPI32.dll_SetSecurityDescriptorDacl
mov dword [0x4be62cf4], 0xc
xor eax, eax
mov dword [0x4be62cfc], eax
mov dword [0x4be62cf8], 0x4be62d00
cmp dword [ebp + 0xc], 0
jne 0x4be33870
push 0x4be57b83
lea edx, [ebp - 0x154]
push edx
call fcn.4be41cfc
add esp, 8
push 0x4be57ba4
lea ecx, [ebp - 0x154]
push ecx
call fcn.4be41c6c
add esp, 8
push 0x4be57baf
lea eax, [ebp - 0x154]
push eax
call fcn.4be41c6c
add esp, 8
push 0x4be57bb6
lea edx, [ebp - 0x154]
push edx
call fcn.4be41c6c
add esp, 8
lea ecx, [ebp - 0x28]
push ecx
lea eax, [ebp - 0x154]
push eax
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4be3380b
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x4c]
push ecx
push 0
push 0
push 0x4be57bbc
push dword [ebp - 0x28]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x4be33803
lea eax, [ebp + 0xc]
push eax
push 0x4be57bce
lea edx, [ebp - 0x4c]
push edx
call fcn.4be45c64
add esp, 0xc
mov ecx, dword [ebp + 0xc]
shl ecx, 0x10
mov dword [ebp + 0xc], ecx
push dword [ebp - 0x28]
call sub.ADVAPI32.dll_RegCloseKey
call sym.idapi32.dll_OsGetOSType
sub eax, 4
je 0x4be3381a
dec eax
je 0x4be33846
jmp 0x4be33870
cmp dword [ebp + 0xc], 0
je 0x4be33837
cmp dword [ebp + 0xc], 0x90000000
jb 0x4be33832
cmp dword [ebp + 0xc], 0xffff0000
jbe 0x4be33837
xor eax, eax
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x4be33870
mov dword [ebp + 0xc], 0xebde0000
jmp 0x4be33870
cmp dword [ebp + 0xc], 0
je 0x4be33863
cmp dword [ebp + 0xc], 0x10000000
jb 0x4be3385e
cmp dword [ebp + 0xc], 0x7f000000
jbe 0x4be33863
xor edx, edx
mov dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0
jne 0x4be33870
mov dword [ebp + 0xc], 0x6bde0000
mov word [ebp - 0x10], 8
push dword [ebp + 0xc]
push ebx
call fcn.4be338e8
mov word [ebp - 0x22], ax
test ax, ax
jne 0x4be338bd
call fcn.4be33c3c
mov word [ebp - 0x22], ax
test ax, ax
jne 0x4be338b7
push 0x4be577cc
push 0
push 0x4be57bd1
call sym.idapi32.dll_OsMuxCreate
mov word [ebp - 0x22], ax
test ax, ax
je 0x4be338bd
call fcn.4be33f13
jmp 0x4be338bd
push ebx
call fcn.4be33e7f
mov word [ebp - 0x10], 0
jmp 0x4be338d2
mov ax, word [ebp - 0x22]
mov edx, dword [ebp - 0x20]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4be33c3c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
xor ebx, ebx
xor esi, esi
push esi
mov esi, 0x4be57a36
lea edi, [ebp - 0x110]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
push esi
mov esi, 0x4be57b3b
lea edi, [ebp - 0x130]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
mov dword [ebp - 8], 0x1f
push 0x4be62cdc
call sub.KERNEL32.dll_InitializeCriticalSection
push 0x4be62cdc
call sub.KERNEL32.dll_EnterCriticalSection
cmp dword [0x4be577d4], 0
je 0x4be33ca2
mov bx, 0x2a04
jmp 0x4be33de9
push 0x4be57c37
lea eax, [ebp - 0x110]
push eax
call fcn.4be41cfc
add esp, 8
push 0x4be57c58
lea edx, [ebp - 0x110]
push edx
call fcn.4be41c6c
add esp, 8
push 0x4be57c63
lea ecx, [ebp - 0x110]
push ecx
call fcn.4be41c6c
add esp, 8
push 0x4be57c6a
lea eax, [ebp - 0x110]
push eax
call fcn.4be41c6c
add esp, 8
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 0x110]
push ecx
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4be33d42
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x130]
push edx
push 0
push 0
push 0x4be57c70
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x4be33d3a
lea ecx, [ebp - 0x130]
push ecx
call fcn.4be47b30
pop ecx
mov esi, eax
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
cmp esi, 0x10
jae 0x4be33d53
mov esi, 0x1000000
mov edi, pe_nt_image_headers32
jmp 0x4be33d6d
cmp esi, 0xcb
jbe 0x4be33d62
mov esi, 0xcbc0000
jmp 0x4be33d68
shl esi, 0xa
shl esi, 0xa
mov edi, esi
shr edi, 0x10
push 4
push 0x2000
push esi
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov dword [0x4be577d4], eax
test eax, eax
je 0x4be33dbe
push 4
push 0x1000
push 0x10000
push dword [0x4be577d4]
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
jne 0x4be33da6
mov bx, 0x2501
jmp 0x4be33dc2
push dword [0x4be577d4]
push edi
call fcn.4be33bbb
mov eax, dword [0x4be577d4]
xor edx, edx
mov dword [eax + 0x4c], edx
jmp 0x4be33dc2
mov bx, 0x2501
test bx, bx
je 0x4be33dff
cmp dword [0x4be577d4], 0
je 0x4be33de9
push 0x8000
push 0
push dword [0x4be577d4]
call sub.KERNEL32.dll_VirtualFree
xor eax, eax
mov dword [0x4be577d4], eax
push 0x4be62cdc
call sub.KERNEL32.dll_LeaveCriticalSection
push 0x4be62cdc
call sub.KERNEL32.dll_DeleteCriticalSection
jmp 0x4be33e09
push 0x4be62cdc
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4be3479f
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 0x20], 0x20
lea eax, [ebp - 0x20]
push eax
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4be347bc
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
lea eax, [ebp - 0x20]
push eax
call sub.KERNEL32.dll_GlobalMemoryStatus
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x4be3a2ff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4be59aa2
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x4be3a357
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x4be59ac3
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
je 0x4be3a34d
mov bx, 0x2a04
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
jmp 0x4be3a35b
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4be46a8c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
lea ecx, [ebp - 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
push 0
push edi
mov edx, dword [ebp + 0x14]
push edx
push ecx
push 3
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4be46ad4
call fcn.4be472b4
jmp 0x4be46b35
mov esi, 0x8000
push ebx
call fcn.4be47624
pop ecx
test eax, eax
je 0x4be46aea
or esi, 0x2000
test edi, 1
jne 0x4be46af8
or esi, 0x100
call fcn.4be46ea8
push esi
push ebx
call fcn.4be46fa8
add esp, 8
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
inc eax
jne 0x4be46b2c
mov esi, 4
push esi
call fcn.4be47268
pop ecx
push ebx
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_DeleteFileA
jmp 0x4be46b2e
xor esi, esi
call fcn.4be46edc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4be46c58
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xff
mov eax, dword [ebp + 8]
push eax
push 0x4be63090
call fcn.4be46e0c
add esp, 0xc
lea edx, [ebp - 8]
push 0
push 0
push 0
push edx
push 0x4be63090
call fcn.4be0982c
add esp, 0x14
push 0x4be5e5b4
lea ecx, [ebp - 8]
push ecx
call fcn.4be41c6c
add esp, 8
mov byte [0x4be63090], 0
push 0
push 0
push 0
push 0
push 0
push 0xff
push 0x4be63090
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.dll_GetVolumeInformationA
test eax, eax
je 0x4be46ccb
mov eax, 0x4be63090
jmp 0x4be46ccd
xor eax, eax
pop ecx
pop ecx
pop ebp
ret