joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42be60
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor edi, edi
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
mov dword [ebp - 8], eax
movzx edx, bx
mov eax, esi
call fcn.00415af4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x42bf2b
and bx, 0xf
cmp bx, 2
jne 0x42bea8
mov ebx, 8
mov esi, 1
jmp 0x42beb2
mov ebx, 2
mov esi, 4
push 0
push 0
push 0
push ebx
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CreateFileMappingW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42bed6
push ebp
call fcn.0042be00
pop ecx
jmp 0x42bf2b
push 0
push 0
push 0
push esi
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_MapViewOfFile
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42bef8
push ebp
call fcn.0042be00
pop ecx
jmp 0x42bf2b
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetFileSize
cmp eax, 0xffffffff
jne 0x42bf11
push ebp
call fcn.0042be00
pop ecx
jmp 0x42bf2b
mov edx, dword [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push edx
push eax
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x42bc3c]
call fcn.0042c370
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42c6f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
xor esi, esi
push 0x40
push ebx
call sub.KERNEL32.DLL_IsBadReadPtr
test eax, eax
jne 0x42c73f
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x42c73f
cmp dword [eax + 0x3c], 0
je 0x42c73f
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
push 0xf8
push esi
call sub.KERNEL32.DLL_IsBadReadPtr
test eax, eax
jne 0x42c73d
cmp dword [esi], 0x4550
je 0x42c73f
xor esi, esi
mov eax, esi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x42c750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
xor esi, esi
push 0x40
push ebx
call sub.KERNEL32.DLL_IsBadReadPtr
test eax, eax
jne 0x42c79f
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x42c79f
cmp dword [eax + 0x3c], 0
je 0x42c79f
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
push 0x108
push esi
call sub.KERNEL32.DLL_IsBadReadPtr
test eax, eax
jne 0x42c79d
cmp dword [esi], 0x4550
je 0x42c79f
xor esi, esi
mov eax, esi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x435010
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x29], 0
je 0x435033
mov eax, dword [ebp - 8]
call fcn.00407780
push eax
call sub.KERNEL32.DLL_OutputDebugStringW
pop ecx
pop ecx
pop ebp
ret
Function at 0x43eb00
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
call fcn.0040591c
mov ebx, edx
mov esi, eax
cmp byte [esi + 0x18], 0
jne 0x43eb30
mov edx, dword [esi + 0x24]
mov eax, esi
call fcn.0043ebd0
test al, al
jne 0x43eb30
push 1
mov eax, dword [esi + 4]
push eax
call sub.KERNEL32.DLL_TerminateThread
mov dl, 0xfc
and dl, bl
mov eax, esi
call fcn.0043ece0
lea eax, [esi + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx], ecx
call fcn.00405598
lea eax, [esi + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
xor ecx, ecx
mov dword [edx], ecx
call fcn.00405598
test bl, bl
jle 0x43eb74
mov eax, esi
call fcn.004058c4
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x43ece0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0040591c
mov ebx, edx
mov esi, eax
cmp dword [esi + 8], 0
je 0x43ed2d
cmp byte [esi + 0x18], 0
jne 0x43ed2d
mov eax, esi
call fcn.0043f010
cmp byte [esi + 0xc], 0
je 0x43ed26
mov eax, dword [esi + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov edi, eax
test edi, edi
setge dl
mov eax, esi
call fcn.0043f100
dec edi
jne 0x43ed26
mov byte [esi + 0xe], 0
mov eax, esi
call fcn.0043f020
mov eax, dword [esi + 4]
test eax, eax
je 0x43ed3f
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
mov dword [esi + 4], eax
mov dl, 0xfc
and dl, bl
mov eax, esi
call fcn.00405588
mov eax, dword [esi + 0x14]
call fcn.00405598
test bl, bl
jle 0x43ed5d
mov eax, esi
call fcn.004058c4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x43edc0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x43edc8
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x43ef23
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xc]
je 0x43eee7
cmp byte [ebx + 0x18], 0
jne 0x43eee7
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0
mov eax, ebx
call fcn.0043ed70
mov edi, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
cmp esi, 1
je 0x43ef08
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.0043ed70
mov dword [ebp - 4], eax
push 0xbb8
call sub.KERNEL32.DLL_Sleep
mov eax, ebx
call fcn.0043ed70
mov ebx, eax
lea edx, [ebp - 0x10]
mov eax, dword [0x46f2c0]
call fcn.0040b788
push dword [ebp - 0x10]
push 0x43ef40
push 0x43ef58
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.00415508
push dword [ebp - 0x14]
push 0x43ef74
mov eax, edi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.00415508
push dword [ebp - 0x18]
push 0x43ef94
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.00415508
push dword [ebp - 0x1c]
push 0x43efb4
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00415508
push dword [ebp - 0x20]
push 0x43efd4
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00415508
push dword [ebp - 0x24]
lea eax, [ebp - 0xc]
mov edx, 0xc
call fcn.004079e0
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x42355c]
call fcn.0041ab28
call fcn.00406340
jmp 0x43ef08
lea edx, [ebp - 0x28]
mov eax, dword [0x46f2c0]
call fcn.0040b788
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x42355c]
call fcn.0041ab28
call fcn.00406340
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ef2a
lea eax, [ebp - 0x28]
mov edx, 8
call fcn.00406ca4
ret

Function at 0x43f370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00407780
jmp 0x43f3a2
mov ecx, ebx
add ecx, ecx
add ecx, ecx
shr ebx, 0x1e
or ecx, ebx
movzx edx, dx
xor ecx, edx
mov ebx, ecx
add eax, 2
movzx edx, word [eax]
test dx, dx
jne 0x43f38d
mov edi, ebx
and edi, 0xff
mov edx, dword [0x43f128]
mov eax, 0xc
call fcn.00408510
mov ebx, eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.00406fd8
mov eax, dword [ebp - 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + edi*4 + 4]
mov dword [ebx], eax
mov dword [esi + edi*4 + 4], ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x43f460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, esi
call fcn.00407780
jmp 0x43f48c
mov ecx, ebx
add ecx, ecx
add ecx, ecx
shr ebx, 0x1e
or ecx, ebx
movzx edx, dx
xor ecx, edx
mov ebx, ecx
add eax, 2
movzx edx, word [eax]
test dx, dx
jne 0x43f477
mov eax, ebx
and eax, 0xff
mov edx, dword [ebp - 4]
lea ebx, [edx + eax*4 + 4]
jmp 0x43f4b2
mov eax, dword [edi + 4]
mov edx, esi
call fcn.00407a90
je 0x43f4b8
mov ebx, edi
mov edi, dword [ebx]
test edi, edi
jne 0x43f4a4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4424c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x4c]
mov edx, 0x3c
call fcn.00423e10
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x540
mov eax, dword [ebp - 4]
call fcn.00407780
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
call fcn.00407780
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0xc], 0
je 0x442511
mov eax, dword [ebp - 0xc]
call fcn.00407780
mov dword [ebp - 0x38], eax
cmp dword [ebp + 0x10], 0
je 0x442522
mov eax, dword [ebp + 0x10]
call fcn.00407780
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
inc dword [0x46e3e8]
xor eax, eax
push ebp
push 0x442559
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442560
dec dword [0x46e3e8]
ret

Function at 0x4425d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4426b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00406c44
lea eax, [ebp - 0x10]
call fcn.00406c44
mov eax, dword [0x46f2e4]
cmp dword [eax], 0
je 0x442661
mov edx, dword [0x46f1bc]
mov eax, dword [ebp - 8]
mov ecx, 0x10
call fcn.00414e8c
test al, al
jne 0x442661
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x4000
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x46f2e4]
mov eax, dword [eax]
call eax
test eax, eax
jne 0x442661
cmp dword [ebp - 0x14], 0
je 0x442661
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.004077d8
mov eax, dword [ebp - 0x14]
push eax
call sub.ole32.dll_CoTaskMemFree
jmp 0x4426a3
lea eax, [ebp - 0x10]
mov edx, 0x105
call fcn.00407880
cmp dword [ebp - 4], 0
jl 0x4426a3
mov eax, dword [ebp - 0x10]
call fcn.00407780
push eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
test eax, eax
jne 0x4426a3
lea eax, [ebp - 0x10]
call fcn.00424ed0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00406fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4426c0
lea eax, [ebp - 0x10]
call fcn.00406c44
ret
Function at 0x4429a0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x442b69
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00407020
cmp dword [ebp - 4], 0
je 0x4429e3
mov eax, dword [ebp - 4]
cmp word [eax], 0x5c
jne 0x4429e3
xor eax, eax
jmp 0x4429e5
mov al, 1
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x442a00
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00407b10
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00442d10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x442ae0
xor edx, edx
push ebp
push 0x442ad9
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00443380
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00442dc0
test al, al
je 0x442ab7
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00406d80
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x442ab7
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0xc]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00407780
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [esi + 0x1c], eax
test eax, eax
sete al
test al, al
je 0x442ab1
mov eax, dword [ebp - 8]
call fcn.00407780
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004077d8
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004429a0
dec ebx
cmp ebx, 0xffffffff
jne 0x442a5f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442ae0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00443380
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey
ret
cmp dword [0x46e3ec], 0
je 0x442b20
mov ebx, dword [ebp - 0xc]
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.00407780
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00442bb0
push eax
call dword [0x46e3ec]
mov dword [ebx + 0x1c], eax
test eax, eax
sete bl
jmp 0x442b46
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00407780
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00442bb0
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov dword [ebx + 0x1c], eax
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442b70
lea eax, [ebp - 0x3c]
call fcn.00406c44
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ca4
ret
Function at 0x442bd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 8], eax
mov esi, ebx
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, edi
call fcn.00407780
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov dword [esi + 0x1c], eax
test eax, eax
sete al
test al, al
jne 0x442c1c
xor eax, eax
mov dword [ebp + 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
cmp dword [ebp - 8], 1
jne 0x442c29
mov al, 1
jmp 0x442c49
cmp dword [ebp - 8], 2
jne 0x442c33
mov al, 2
jmp 0x442c49
cmp dword [ebp - 8], 4
jne 0x442c3d
mov al, 3
jmp 0x442c49
cmp dword [ebp - 8], 3
jne 0x442c47
mov al, 4
jmp 0x442c49
xor eax, eax
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov eax, edx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x442c60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, esi
xor ecx, ecx
mov edx, 8
call fcn.004051b8
mov edi, ebx
lea eax, [esi + 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00407780
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov dword [edi + 0x1c], eax
test eax, eax
sete dl
cmp dword [ebp - 8], 1
jne 0x442cb0
mov al, 1
jmp 0x442cd0
cmp dword [ebp - 8], 2
jne 0x442cba
mov al, 2
jmp 0x442cd0
cmp dword [ebp - 8], 4
jne 0x442cc4
mov al, 3
jmp 0x442cd0
cmp dword [ebp - 8], 3
jne 0x442cce
mov al, 4
jmp 0x442cd0
xor eax, eax
mov byte [esi], al
mov eax, edx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4433c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x443480
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 4]
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.00442dc0
test al, al
je 0x443462
mov ecx, dword [ebp - 0x28]
add ecx, 2
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406d80
mov ebx, dword [ebp - 0x2c]
dec ebx
test ebx, ebx
jl 0x443462
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00407780
push eax
push esi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.00407780
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.004077d8
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
call fcn.00429770
inc esi
dec ebx
jne 0x443416
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443487
lea eax, [ebp - 0x30]
call fcn.00406c44
lea eax, [ebp - 4]
call fcn.00406c44
ret
Function at 0x443490
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x443550
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 4]
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.00442dc0
test al, al
je 0x443532
mov ecx, dword [ebp - 0x20]
add ecx, 2
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406d80
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x443532
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00407780
push eax
push esi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegEnumValueW
mov eax, dword [ebp - 4]
call fcn.00407780
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.004077d8
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
call fcn.00429770
inc esi
dec ebx
jne 0x4434e6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443557
lea eax, [ebp - 0x30]
call fcn.00406c44
lea eax, [ebp - 4]
call fcn.00406c44
ret
Function at 0x44cd50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44d0d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x44cd97
push 2
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00407780
push eax
call sub.KERNEL32.DLL_LoadLibraryExW
mov dword [ebp - 0x28], eax
jmp 0x44cda0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x44d0bb
xor eax, eax
push ebp
push 0x44ced0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xc]
push eax
push 1
push 0x10
mov eax, dword [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_FindResourceExW
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x44cde0
call fcn.00406434
jmp 0x44d0bb
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x44ce00
call fcn.00406434
jmp 0x44d0bb
xor eax, eax
push ebp
push 0x44cea9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.KERNEL32.DLL_SizeofResource
mov edx, eax
mov eax, dword [ebp - 4]
add eax, 0x10
xor ecx, ecx
call fcn.004075ac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.004070f4
test eax, eax
jle 0x44ce92
mov eax, dword [ebp - 0x30]
push eax
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0x34], eax
xor eax, eax
push ebp
push 0x44ce8b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
call fcn.004070f4
push eax
mov eax, dword [ebp - 4]
add eax, 0x10
call fcn.004071b8
mov edx, eax
mov eax, dword [ebp - 0x34]
pop ecx
call fcn.00404f38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ce92
mov eax, dword [ebp - 0x30]
call fcn.0040cb88
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ceb0
mov eax, dword [ebp - 0x30]
push eax
call sub.KERNEL32.DLL_FreeResource
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d0e0
lea eax, [ebp - 0x14]
call fcn.00406c44
lea eax, [ebp - 0xc]
call fcn.00406c44
ret

Function at 0x44e510
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff48
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x56
lea eax, [ebp - 0xb8]
push eax
push 0x59
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x44e550
mov ecx, dword [ebp - 0xc]
dec ecx
lea edx, [ebp - 0xb8]
mov eax, dword [ebp - 8]
call fcn.00406d80
jmp 0x44e558
mov eax, dword [ebp - 8]
call fcn.00406c44
mov esp, ebp
pop ebp
ret
Function at 0x451690
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.00451580
lea eax, [ebp - 0x4c]
mov edx, 0x3c
call fcn.00423e10
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x540
mov eax, dword [ebp - 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xc]
call fcn.00407780
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
call fcn.00407780
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
call fcn.00407780
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 1
mov eax, dword [ebp - 4]
call fcn.00407780
mov dword [ebp - 0x40], eax
inc dword [0x46ef14]
xor eax, eax
push ebp
push 0x451755
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp dword [ebp + 8], 0
je 0x451732
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetProcessId
mov edx, dword [ebp + 8]
mov dword [edx], eax
cmp dword [ebp - 0x14], 0
je 0x451741
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45175c
dec dword [0x46ef14]
ret