joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f3dc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45f4f6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6874fc], 0
jne 0x45f431
push 0x45f504
call fcn.0040dc34
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x6874fc], eax
push 0x45f504
call fcn.0040dc34
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x687500], eax
mov eax, dword [0x45f51c]
mov dword [ebp - 0xb], eax
mov ax, word [0x45f520]
mov word [ebp - 7], ax
mov al, byte [0x45f522]
mov byte [ebp - 5], al
push 6
lea eax, [ebp - 0xb]
push eax
push 0x1004
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 4]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040529c
call sub.kernel32.dll_GetACP_1
mov edx, eax
test edx, edx
jns 0x45f483
call fcn.00403edc
mov eax, dword [ebp - 4]
call fcn.0042882c
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x10]
mov ecx, 2
call fcn.0045f3bc
mov eax, dword [ebp - 0x30]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.00428770
push dword [ebp - 0x34]
push 0x45f52c
mov eax, dword [ebp - 0x2c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x38]
call fcn.00428770
push dword [ebp - 0x38]
mov eax, ebx
mov edx, 3
call fcn.004053cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f4fd
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00405050
lea eax, [ebp - 4]
call fcn.0040502c
ret

Function at 0x45f570
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [ebp - 1], 0
push 0x45f62c
call fcn.0040dc00
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
test ebx, ebx
je 0x45f5ed
lea eax, [ebp - 0x41]
xor ecx, ecx
mov edx, 0x40
call fcn.004038b8
mov dword [ebp - 0x41], 0x40
lea eax, [ebp - 0x41]
push eax
call ebx
test eax, eax
je 0x45f5ed
mov eax, dword [ebp - 0x39]
mov dword [edi], eax
mov eax, dword [ebp - 0x35]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x31]
mov dword [esi], eax
mov eax, dword [ebp - 0x2d]
mov dword [esi + 4], eax
mov byte [ebp - 1], 1
jmp 0x45f620
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x20
call fcn.004038b8
mov dword [ebp - 0x64], 0x20
lea eax, [ebp - 0x64]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x5c]
xor edx, edx
mov dword [edi], eax
mov dword [edi + 4], edx
mov eax, dword [ebp - 0x58]
xor edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46035c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4604c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040502c
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.0040550c
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x46049f
mov eax, dword [ebp - 8]
call fcn.0040309c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x460498
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x46047f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4604d0
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46047f
push 0x4604f4
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov edx, 4
call fcn.00428798
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.00428798
push dword [ebp - 0x20]
push 0x460510
lea eax, [ebp - 4]
mov edx, 4
call fcn.004053cc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46047f
cmp dword [ebp - 0x10], 1
jbe 0x46047f
mov ebx, dword [ebp - 0x18]
mov eax, ebx
call fcn.00429320
mov ecx, eax
mov eax, esi
mov edx, ebx
call fcn.0040511c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46049f
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.004030b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4604c9
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00405050
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x460558
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004054fc
xor eax, eax
push ebp
push 0x460659
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040502c
cmp dword [ebp - 4], 0
je 0x4605bf
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x4605a0
cmp eax, dword [edx - 4]
jb 0x4605a5
call fcn.00403edc
inc eax
cmp byte [edx + eax - 1], 0x5c
jne 0x4605bf
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.004055ac
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x460643
mov eax, ebx
mov edx, 0x400
call fcn.00405794
mov eax, dword [ebx]
call fcn.00405308
test eax, eax
jns 0x4605f9
call fcn.00403edc
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx]
call fcn.0040550c
push eax
test edi, edi
jns 0x460619
call fcn.00403edc
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x460633
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.00405794
jmp 0x46063a
mov eax, ebx
call fcn.0040502c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460660
lea eax, [ebp - 4]
call fcn.0040502c
ret

Function at 0x46066c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004054fc
mov eax, dword [ebp - 8]
call fcn.004054fc
xor eax, eax
push ebp
push 0x460759
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x4606d5
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x4606b6
cmp eax, dword [edx - 4]
jb 0x4606bb
call fcn.00403edc
inc eax
cmp byte [edx + eax - 1], 0x5c
jne 0x4606d5
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.004055ac
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46073e
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040550c
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x460735
cmp dword [ebp - 0x14], 4
jne 0x460735
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460760
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405050
ret
Function at 0x460fe4
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push 0x461078
call sub.kernel32.dll_GetModuleHandleA_2
test eax, eax
je 0x461007
mov eax, ebx
mov edx, 0x46108c
call fcn.00405080
pop ebx
pop ebp
ret
push 0
push ebx
mov ecx, 0x4610a0
mov edx, 0x4610b4
mov eax, 0x80000002
call fcn.00467230
mov eax, dword [ebx]
mov edx, 0x4610e8
call fcn.00405458
jne 0x461038
mov eax, ebx
mov edx, 0x461108
call fcn.00405080
mov eax, dword [ebx]
mov edx, 0x461118
call fcn.00405458
jne 0x461052
mov eax, ebx
mov edx, 0x461138
call fcn.00405080
mov eax, dword [ebx]
mov edx, 0x46114c
call fcn.00405458
jne 0x46106e
mov eax, ebx
mov edx, 0x46116c
call fcn.00405080
jmp 0x461075
mov eax, ebx
call fcn.0040502c
pop ebx
pop ebp
ret

Function at 0x46151c
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
call fcn.004611b4
test al, al
jne 0x46152f
xor eax, eax
jmp 0x461569
mov dword [ebp - 4], 0x40000000
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.00461174
cmp dword [ebp - 8], 0x61774d56
jne 0x461563
cmp dword [ebp - 0xc], 0x4d566572
jne 0x461563
cmp dword [ebp - 0x10], 0x65726177
je 0x461567
xor eax, eax
jmp 0x461569
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x461760
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], 0x40000000
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.00461174
cmp dword [ebp - 8], 0x7263694d
jne 0x46179a
cmp dword [ebp - 0xc], 0x666f736f
jne 0x46179a
cmp dword [ebp - 0x10], 0x76482074
je 0x46179e
xor eax, eax
jmp 0x4617a0
mov al, 1
test al, al
je 0x4617c7
mov dword [ebp - 4], 0x40000001
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.00461174
cmp dword [ebp - 4], 0x31237648
sete al
mov esp, ebp
pop ebp
ret
Function at 0x461ad8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x461bfc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x57b880], 0xff
je 0x461b06
movzx ebx, byte [0x57b880]
jmp 0x461be1
xor ebx, ebx
call fcn.0040ede8
test al, al
jne 0x461be1
mov eax, dword [0x581f78]
cmp dword [eax], 0
je 0x461be1
push 4
lea eax, [ebp - 4]
push eax
push 0x461c0c
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
ja 0x461be1
push 4
lea eax, [ebp - 4]
push eax
push 0x461c24
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
ja 0x461be1
call fcn.00403544
mov esi, eax
test esi, esi
jle 0x461b90
mov dword [ebp - 4], 1
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004035a4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00427d08
mov eax, dword [ebp - 8]
mov edx, 0x461c40
call fcn.00405458
je 0x461be1
inc dword [ebp - 4]
dec esi
jne 0x461b65
xor eax, eax
call fcn.00447128
test al, al
je 0x461bd5
xor edx, edx
xor eax, eax
call fcn.00447134
xor eax, eax
push ebp
push 0x461bce
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004619b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461bda
mov dl, 1
xor eax, eax
call fcn.00447134
ret
call fcn.004619b4
movzx ebx, byte [0x57b880]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461c03
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405050
ret
Function at 0x461e18
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x461fec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040502c
lea eax, [ebp - 0xc]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x461fc9
xor eax, eax
push ebp
push 0x461fc2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [ebp - 0x10]
call fcn.0040309c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x461fa4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x461f8e
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
dec edi
test edi, edi
jns 0x461ec4
call fcn.00403edc
test edi, edi
jl 0x461f8e
inc edi
xor ebx, ebx
cmp ebx, 0x400
jbe 0x461edc
call fcn.00403edc
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x14]
add edx, 4
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [edx + eax*4 + 4]
mov dword [ebp - 0x1c], ecx
cmp ebx, 0x400
jbe 0x461eff
call fcn.00403edc
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x14]
add edx, 4
mov eax, dword [edx + eax*4 + 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00405794
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
lea eax, [ebp - 0x20]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00405794
push dword [esi]
lea ecx, [ebp - 0x24]
mov edx, 0x1f
mov eax, dword [ebp - 8]
call fcn.00461dd4
push dword [ebp - 0x24]
push ebp
lea eax, [ebp - 0x28]
call fcn.00461d08
pop ecx
push dword [ebp - 0x28]
push 0x462004
mov eax, esi
mov edx, 4
call fcn.004053cc
inc ebx
dec edi
jne 0x461ecf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461fab
mov eax, dword [ebp - 0x14]
call fcn.004030b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461ff3
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405050
lea eax, [ebp - 8]
call fcn.0040502c
ret
Function at 0x462734
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
call fcn.0046392c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00462f9c
test al, al
jne 0x4627ea
xor eax, eax
mov dword [ebp - 4], eax
push 0x46281c
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4627ea
xor eax, eax
push ebp
push 0x4627e3
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
push 0
push 0
push 4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4627cc
xor eax, eax
push ebp
push 0x4627c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4627cc
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4627ea
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
cmp dword [ebp - 4], 0
je 0x462813
push 0x462840
push 0x46285c
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
mov ebx, esi
test esi, esi
je 0x462813
mov eax, dword [ebp - 4]
push eax
call ebx
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x462868
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x188], ecx
mov dword [ebp - 4], ecx
mov esi, edx
lea edi, [ebp - 0x184]
mov ecx, 0x5e
rep movsd dword es:[edi], dword [esi]
mov esi, eax
xor eax, eax
push ebp
push 0x462966
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00462734
mov ebx, eax
push 0x462980
push esi
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x188]
call fcn.00428770
push dword [ebp - 0x188]
lea eax, [ebp - 4]
mov edx, 3
call fcn.004053cc
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x462943
xor eax, eax
push ebp
push 0x462938
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0xc]
push eax
push 0x178
lea eax, [ebp - 0x184]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46293f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46296d
lea eax, [ebp - 0x188]
call fcn.0040502c
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x462990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7c0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x840], ecx
mov dword [ebp - 4], ecx
mov esi, edx
lea edi, [ebp - 0x83c]
mov ecx, 0x20c
rep movsd dword es:[edi], dword [esi]
mov esi, eax
xor eax, eax
push ebp
push 0x462a93
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00462734
mov ebx, eax
push 0x462aac
push esi
push 0x462ac4
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x840]
call fcn.00428770
push dword [ebp - 0x840]
lea eax, [ebp - 4]
mov edx, 4
call fcn.004053cc
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x462a70
xor eax, eax
push ebp
push 0x462a65
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0xc]
push eax
push 0x830
lea eax, [ebp - 0x83c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462a6c
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462a9a
lea eax, [ebp - 0x840]
call fcn.0040502c
lea eax, [ebp - 4]
call fcn.0040502c
ret

Function at 0x462f9c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
test eax, eax
je 0x462fc1
mov dword [ebp - 5], eax
mov byte [ebp - 1], 0
lea eax, [ebp - 5]
push eax
push 0x462f04
call sub.user32.dll_EnumWindows
movzx edx, byte [ebp - 1]
mov eax, edx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4638a8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x14], eax
push 0x80000001
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x80000001
mov edx, 0x7fffffff
mov eax, 0x7fffffff
call fcn.00439fc4
lea esi, [ebp - 0x24]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
test eax, eax
jns 0x4638e9
call fcn.00403edc
push eax
push 0x463828
call sub.user32.dll_EnumWindows
test eax, eax
je 0x463901
mov edi, ebx
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebx], 0x7fffffff
jne 0x463917
push 0
push ebx
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00439fc4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4663c4
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, 0x4663f0
call fcn.004663ac
test al, al
je 0x4663e1
mov dword [ebx], 1
pop ebx
pop ebp
ret
xor eax, eax
mov dword [ebx], eax
pop ebx
pop ebp
ret

Function at 0x466404
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
cmp dword [eax], 0
je 0x46641a
xor edx, edx
mov dword [eax], edx
mov eax, 0x466424
call fcn.004663b8
pop ebp
ret
Function at 0x467630
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x467752
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, edi
call fcn.004050c4
cmp dword [ebp - 4], 0
je 0x467697
mov eax, 1
mov edx, dword [ebp - 4]
dec eax
test edx, edx
je 0x467678
cmp eax, dword [edx - 4]
jb 0x46767d
call fcn.00403edc
inc eax
cmp byte [edx + eax - 1], 0x5c
jne 0x467697
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.004055ac
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExA
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x467737
xor eax, eax
push ebp
push 0x467730
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405308
test eax, eax
jns 0x4676e6
call fcn.00403edc
push eax
mov eax, ebx
call fcn.0040550c
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x467719
call fcn.0042dff0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46773c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
call fcn.0042dff0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467759
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x4677e8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x467942
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x467824
mov ecx, 0x40b
mov edx, 0x46795c
mov eax, 0x467984
call fcn.00404f58
test edi, edi
jne 0x46783c
mov ecx, 0x40c
mov edx, 0x46795c
mov eax, 0x467984
call fcn.00404f58
mov edx, ebx
mov eax, 0x4679a0
call fcn.00405650
test eax, eax
je 0x467860
mov ecx, 0x40d
mov edx, 0x46795c
mov eax, 0x467984
call fcn.00404f58
mov edx, ebx
mov eax, 0x4679ac
call fcn.00405650
test eax, eax
je 0x467884
mov ecx, 0x40e
mov edx, 0x46795c
mov eax, 0x467984
call fcn.00404f58
cmp byte [0x68753c], 0
je 0x4678bc
mov eax, dword [ebp - 4]
push eax
push esi
push dword [0x687540]
push 0x4679a0
push ebx
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053cc
mov edx, dword [ebp - 8]
mov ecx, edi
mov eax, 0x80000001
call fcn.00467230
jmp 0x467927
mov eax, esi
mov edx, 0x2800
call fcn.00405794
mov eax, dword [0x687540]
call fcn.0040550c
push eax
mov eax, dword [esi]
call fcn.00405308
test eax, eax
jns 0x4678e3
call fcn.00403edc
push eax
mov eax, dword [esi]
call fcn.0040550c
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
mov eax, edi
call fcn.0040550c
push eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov edx, eax
mov eax, esi
call fcn.00405794
lea edx, [ebp - 0xc]
mov eax, dword [esi]
call fcn.00466fe4
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00405080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467949
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405050
ret