joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433ef0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x28]
push edi
mov edi, dword [ebp + 0x10]
push edx
push 0x20019
push 0
push eax
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x433f72
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
test ebx, ebx
je 0x433f67
jmp 0x433f30
push esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x2c], 4
push 0x4b6aa0
push eax
call fcn.0042fef0
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
push edi
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc esi
add edi, 4
cmp esi, ebx
jb 0x433f30
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 0xc

Function at 0x433f90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 4
movsx eax, word [esi]
mov dword [ebp + 0xc], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 0x10]
test eax, eax
movzx edx, word [ebp + 0xc]
movzx ecx, cx
cmovne edx, ecx
push 0x60
mov word [esi], dx
push dword [0x4dfbec]
movsx eax, dx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov word [esi], ax
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x433ff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], edx
lea edx, [ebp - 0x28]
push edx
push 0x20019
push 0
push eax
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x434091
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x434086
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MulDiv]
push esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x34], 4
push 0x4b6aa0
push eax
call fcn.0042fef0
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x434080
movzx eax, word [ebp - 0x2c]
push 0x60
push dword [0x4dfbec]
push eax
call ebx
mov ecx, dword [ebp - 0x30]
mov word [ecx + esi*2], ax
inc esi
cmp esi, edi
jb 0x434034
pop ebx
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x434ce0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0xc], esi
lea ebx, [esi + 4]
push ebx
push 0
push 0x20006
push 0
push 0
push 0
push dword [esi]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x434e33
push edi
mov edi, dword [ebp + 8]
cmp dword [edi], eax
je 0x434e2a
mov edx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add edi, 0xc
lea ebx, [ebx]
mov eax, dword [edi - 8]
cmp eax, 7
ja case.default.0x434d3c
jmp dword [eax*4 + 0x434e3c]
mov eax, dword [edi]
push 4
mov eax, dword [eax]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 4
jmp 0x434e0e
mov eax, dword [edi]
push 4
movzx eax, byte [eax]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
jmp 0x434e0e
mov eax, dword [edi]
push 8
movsd xmm0, qword [eax]
lea eax, [ebp - 0x14]
movsd qword [ebp - 0x14], xmm0
push eax
jmp 0x434e0c
mov eax, dword [edi]
push dword [0x4dfbec]
mov esi, dword [edi - 0xc]
push 0x60
movzx eax, word [eax]
cwde
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0
push esi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [ebp - 0xc]
jmp 0x434e17
mov ecx, dword [edi]
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434dc0
sub ecx, dword [ebp - 4]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [edi]
push 1
jmp 0x434e0e
push dword [edi]
mov eax, dword [edi - 4]
mov ecx, esi
shr eax, 2
push eax
push dword [edi - 0xc]
call fcn.00434e60
jmp 0x434e17
push dword [edi]
mov eax, dword [edi - 4]
mov ecx, esi
shr eax, 1
push eax
push dword [edi - 0xc]
call fcn.00434f00
jmp 0x434e17
push dword [edi - 4]
push dword [edi]
push 3
push 0
push dword [edi - 0xc]
push dword [ebx]
call edx
mov edx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add edi, 0x18
cmp dword [edi - 0xc], 0
jne 0x434d30
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x434e60
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x28]
push edi
mov edi, dword [ebp + 0x10]
push 0
push edx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x434eed
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
test ebx, ebx
je 0x434ee2
push esi
lea eax, [ebp - 0x24]
push 0x4b6aa0
push eax
call fcn.0042fef0
add esp, 0xc
lea eax, [ebp - 0x24]
cmp dword [edi], 0
je 0x434ed0
push 4
push edi
push 4
push 0
push eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x434eda
push eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
inc esi
add edi, 4
cmp esi, ebx
jb 0x434ea3
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 0xc

Function at 0x434f00
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], edx
lea edx, [ebp - 0x28]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x434fb8
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x434fad
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea esp, [esp]
push esi
lea eax, [ebp - 0x24]
push 0x4b6aa0
push eax
call fcn.0042fef0
mov eax, dword [ebp - 0x2c]
add esp, 0xc
push dword [0x4dfbec]
movzx eax, word [eax + esi*2]
push 0x60
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
cmp word [eax + esi*2], 0
je 0x434f9e
push 4
lea eax, [ebp - 0x30]
push eax
push 4
push 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x434fa7
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
call ebx
inc esi
cmp esi, edi
jb 0x434f50
pop ebx
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x437240
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac340
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
push edi
mov eax, dword [0x4dc6e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
cmp word [esi], 0x48
jne 0x43728d
push esi
push dword [ebp + 8]
call fcn.00407700
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x3c
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], 0x44
push 0
push eax
mov dword [ebp - 0x6c], 0
call fcn.004906c0
add esp, 0xc
lea ecx, [ebp - 0x14]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x2c], xmm0
push 0x4ba02c
call fcn.00436dc0
push esi
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0
push eax
call fcn.00436f20
add esp, 0xc
mov edx, dword [ebp - 0x14]
or edi, 0xffffffff
add edx, 0xfffffff0
mov byte [ebp - 4], 2
mov eax, edi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4372f8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4373c2
push 0x4ba050
lea ecx, [ebp - 0x1c]
call fcn.00436dc0
push esi
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
call fcn.00436f20
push 0x4b66f0
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 4
push eax
call fcn.00436f20
mov edx, dword [ebp - 0x18]
add esp, 0x18
add edx, 0xfffffff0
mov byte [ebp - 4], 3
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x437371
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
mov ecx, edi
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x437391
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x30
push 0x4b0220
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [ebp - 0x10]
mov ecx, edi
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4373d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4373d2
push dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2c]
call esi
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x4373f3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x437410
Capabilities:
Create thread

Disassembly:
push 0x4dfc28
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0x404510
call fcn.00493b6c
add esp, 0xc
ret
Function at 0x4381b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4381c5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x438204
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x438200
lea ebx, [ebx]
cmp esi, edx
jae 0x438204
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4381f0
cmp esi, edx
jb 0x438209
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x438cc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac438
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4dc6e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [esi], vtable.CResizer.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x2c], 0x32
mov dword [esi + 0x30], 0x43
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov byte [esi + 0x34], 1
test eax, eax
je 0x438d31
push eax
call fcn.004397a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4399c0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
push eax
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
push eax
push 0x4399a0
push 0
push 0
call fcn.004929fc
add esp, 0x18
mov esi, eax
push 0x3a98
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x439a1c
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x5b4
pop esi
mov esp, ebp
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x43a780
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x434], eax
push edi
mov byte [ebp - 0x42d], 0
mov dword [eax], esi
lea ecx, [ecx]
push ebx
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0x18
je 0x43a7b0
cmp edi, 0xffffffff
je 0x43a94c
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x42c], 0x428
push eax
push edi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x43a811
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x43a94e
pop edi
movzx eax, ax
pop esi
or eax, 0x80070000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x40c]
push 0x4ba588
push eax
call fcn.004913b3
add esp, 8
test eax, eax
je 0x43a836
mov bl, 1
mov byte [ebp - 0x42d], bl
jmp 0x43a920
lea eax, [ebp - 0x40c]
push 0x4ba59c
push eax
call fcn.00491646
add esp, 8
test eax, eax
je 0x43a882
lea eax, [ebp - 0x40c]
push 0x4ba5ac
push eax
call fcn.00491646
add esp, 8
test eax, eax
je 0x43a882
lea eax, [ebp - 0x40c]
push 0x4ba5c8
push eax
call fcn.00491646
add esp, 8
test eax, eax
jne 0x43a91a
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0049130d
add esp, 8
test eax, eax
je 0x43a91a
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0049130d
add esp, 8
test eax, eax
je 0x43a91a
lea edx, [eax + 2]
mov ecx, edx
lea ebx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43a8c0
sub ecx, ebx
sar ecx, 1
cmp ecx, 4
jb 0x43a91a
movzx eax, word [edx + 2]
cmp eax, 0x31
jne 0x43a8f9
cmp word [edx + 6], 0x30
jne 0x43a8e9
or esi, 1
jmp 0x43a91a
cmp eax, 0x31
jne 0x43a8f9
cmp word [edx + 6], ax
jne 0x43a8f9
or esi, 2
jmp 0x43a91a
cmp eax, 0x32
jne 0x43a903
or esi, 4
jmp 0x43a91a
cmp eax, 0x34
je 0x43a917
cmp eax, 0x35
je 0x43a917
cmp eax, 0x36
je 0x43a917
cmp eax, 0x37
jne 0x43a91a
or esi, 8
mov bl, byte [ebp - 0x42d]
lea eax, [ebp - 0x42c]
push eax
push edi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x43a811
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x43a94c
test esi, esi
je 0x43a94c
mov eax, dword [ebp - 0x434]
mov dword [eax], esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
Function at 0x43e5f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
test eax, eax
jne 0x43e622
mov esi, 0x4ba8e0
mov ebx, 0x4ba8f8
jmp 0x43e635
cmp eax, 1
jne 0x43e778
mov esi, 0x4ba914
mov ebx, 0x4ba92c
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0x20019
push 0
push 0x4ba940
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43e778
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push ebx
push dword [ebp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call ebx
push dword [ebp + 8]
test eax, eax
je 0x43e693
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocStringLen
call ebx
test eax, eax
jne 0x43e778
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048f2de
add esp, 4
mov dword [edi + 8], eax
lea ecx, [ebp - 4]
push ecx
push eax
push 0
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocStringLen
call ebx
test eax, eax
jne 0x43e70c
mov eax, dword [edi]
xor ecx, ecx
inc eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048f2de
mov ecx, eax
add esp, 4
mov dword [edi + 4], ecx
test ecx, ecx
jne 0x43e722
push dword [edi + 8]
call fcn.0049243b
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
lea eax, [eax*4 + 4]
push eax
push 0
push ecx
call fcn.004906c0
mov esi, dword [edi + 8]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
test ebx, ebx
je 0x43e778
push esi
call fcn.00492994
add esp, 4
cmp eax, dword [edi]
ja 0x43e778
mov ecx, dword [edi + 4]
lea esi, [esi + ebx*2]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esi, 2
push esi
mov dword [ecx + eax*4], esi
call ebx
lea esi, [esi + eax*2]
add esi, 2
push esi
call ebx
mov ebx, eax
test ebx, ebx
jne 0x43e747
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43ea80
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0x4ba9c4
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x43eaa2
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x4ba9d4
push dword [ebp + 0xc]
mov esi, eax
lea eax, [ebp - 4]
push eax
call fcn.00492cfa
add esp, 0xc
test eax, eax
je 0x43eae2
pop esi
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
push edi
push 1
push esi
call fcn.00493ef3
push dword [ebp - 4]
call fcn.00492e75
add esp, 0x14
mov al, 1
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x443250
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push 0x30
lea eax, [ebp - 0x30]
push 0
push eax
call fcn.004906c0
push 0x188
mov dword [ebp - 0x34], 0xd
mov dword [ebp - 0x30], SysReAllocStringLen
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x18], 0
call fcn.0048fb2f
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x4432af
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
mov ecx, 0x62
lea esi, [ebp + 0xc]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx], 1
mov dword [ebx + 0x164], 0
mov dword [ebx + 0x168], 0
mov dword [ebx + 0x160], 0
mov dword [ebx + 4], 1
mov eax, dword [0x4e4f6c]
inc eax
mov dword [ebx + 8], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x104d
push dword [ebp + 8]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
cmp eax, 0xffffffff
je 0x4432a8
mov dword [ebx + 0x184], 0
mov eax, dword [0x4e0294]
mov dword [ebx + 0x180], eax
mov eax, dword [0x4e0294]
test eax, eax
je 0x443333
mov dword [eax + 0x184], ebx
cmp byte [0x4e45c6], 0
mov dword [0x4e0294], ebx
je 0x443359
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push ebx
push 0
push 0x48aa90
call fcn.00493b6c
add esp, 0xc
xor ecx, ecx
mov eax, 2
cmp byte [0x4e45d0], cl
cmovne eax, ecx
push eax
mov eax, dword [ebx + 0x2c]
shr eax, 1
not al
and al, 1
movzx eax, al
push eax
push ebx
call fcn.0048cde0
add esp, 0xc
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x448e60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
push 0x30
lea eax, [ebp - 0x30]
mov dword [ebp - 0x34], 0
push 0
push eax
call fcn.004906c0
mov esi, dword [ebp + 8]
add esp, 0xc
cmp esi, 0x65
jne 0x448e8f
mov edi, dword [0x4e5184]
jmp 0x448eab
cmp esi, 0x66
jne 0x448e9c
mov edi, dword [0x4e518c]
jmp 0x448eab
cmp esi, 0x68
jne 0x448f94
mov edi, dword [0x4e5190]
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x448f94
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x104b
push edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 4
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x448f94
cmp esi, 0x65
jne 0x448f08
push dword [ebp - 0x14]
call fcn.00481660
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 0x66
jne 0x448f21
push dword [ebp - 0x14]
push edi
call fcn.00481320
add esp, 8
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 0x68
jne 0x448f94
mov esi, dword [ebp - 0x14]
test byte [esi + 0x2c], 8
je 0x448f4f
push 0x10
push 0x4b6248
push 0x4bbcf8
push dword [0x4e5184]
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x38], 0
jne 0x448f75
push 0x10
push 0x4b0220
push 0x4bbd64
push dword [0x4e5180]
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [0x4db654]
push esi
push 0
push 0x481690
mov dword [esi + 0x28], eax
call fcn.00493b6c
add esp, 0xc
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44e170
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push esi
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44e1e9
push ebx
push dword [ebp - 4]
call fcn.0048fb2f
add esp, 4
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44e1df
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x44e1df
lea eax, [edi + edi]
push eax
call fcn.0048fb2f
add esp, 4
mov esi, eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
call fcn.0048faf7
add esp, 4
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44e790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x4bc710
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x44e850
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x4bc770
push dword [ebp - 4]
call esi
test eax, eax
jne 0x44e84f
mov eax, dword [ebp - 8]
test eax, eax
je 0x44e84f
push edi
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x44e84e
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x4bc770
push dword [ebp - 4]
call esi
test eax, eax
jne 0x44e847
cmp dword [ebp - 0xc], 7
jne 0x44e847
mov esi, edi
cmp word [edi], bx
je 0x44e847
lea esp, [esp]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x44e842
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2]
add esi, 2
cmp word [esi], bx
jne 0x44e820
jmp 0x44e847
mov ebx, 1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x44e85e
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret