joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f6744
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x71f57c], 0
jne 0x5f6767
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, 0x5f66b8
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x71f57c], eax
ret

Function at 0x606f44
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00409d44
xor eax, eax
push ebp
push 0x607083
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x607056
xor edx, edx
push ebp
push 0x60704f
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, dword [ebp - 4]
mov eax, esi
test eax, eax
je 0x606f91
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x607024
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x607013
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
test eax, eax
je 0x606fd6
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call fcn.0040abbc
lea ecx, [esi + 2]
mov edx, ebx
call fcn.004066ec
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60701a
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x717e98]
mov dl, 1
mov eax, dword [0x44a854]
call fcn.00457630
call fcn.00409320
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60708a
lea eax, [ebp - 4]
call fcn.00409c60
ret

Function at 0x60dd54
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
movzx ebx, word [0x60dd90]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x60dd6c
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x60dd7c
or bx, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x60dd8c
or bx, 2
mov eax, ebx
pop ebx
ret

Function at 0x62d9b4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.0062da64
test eax, eax
je 0x62d9ef
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.0062da64
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409de8
jmp 0x62d9fd
mov ecx, esi
mov edx, 0x62da1c
mov eax, ebx
call fcn.0062d93c
lea eax, [ebx + 0x1c]
mov edx, dword [esi]
call fcn.0040a040
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x64b664
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00409c60
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x64b6b6
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x64b6af
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040ac78
jmp 0x64b6b6
mov eax, esi
call fcn.00409c60
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x650e44
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x650fa3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x715ce8], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x56a758]
call fcn.0056b8a4
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x650f79
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0056b98c
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040ac78
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x650fbc
call fcn.0040ae28
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0056bc18
test al, al
je 0x650f63
lea ecx, [ebp - 4]
mov edx, 0x651030
mov eax, dword [ebp - 0xc]
call fcn.0056c4a0
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00459cbc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x650f63
xor edx, edx
push ebp
push 0x650f5c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x651048
mov eax, dword [ebp - 8]
push eax
call fcn.00412e30
test eax, eax
je 0x650f45
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x650f45
call fcn.00650dd0
test eax, eax
je 0x650f35
mov eax, dword [ebx + 0x50]
jmp 0x650f38
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x715ce8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x650f63
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x650f80
mov eax, dword [ebp - 0xc]
call fcn.00407f1c
ret

Function at 0x6510ac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x6510f3
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6510d6
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6510e7
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x6510f3
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x65b7a0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x65b7c7
test edi, 0x40000
je 0x65b7e1
test bl, bl
jne 0x65b870
mov eax, 0x40000
and eax, edi
cmp eax, 0x40000
jne 0x65b870
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x65b814
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x65b830
mov eax, esi
mov edx, 0xffffffec
mov ecx, 0x40000
or ecx, edi
push ecx
push edx
push eax
call sub.user32.dll_SetWindowLongW
jmp 0x65b846
mov eax, esi
mov edx, 0xffffffec
mov ecx, 0xfffbffff
and ecx, edi
push ecx
push edx
push eax
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x65b857
cmp byte [esp + 2], 0
je 0x65b870
cmp byte [esp + 2], 0
je 0x65b868
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x65b870
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x65bb20
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x65bb46
mov eax, esp
push eax
push 0x65bae8
call sub.user32.dll_EnumWindows
jmp 0x65bb59
mov eax, esp
push eax
push 0x65bac8
call sub.kernel32.dll_GetCurrentThreadId
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x65bc1c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x65bc6c]
test bl, 4
je 0x65bc30
or si, 1
test bl, 8
je 0x65bc39
or si, 4
test bl, 1
je 0x65bc42
or si, 8
test bl, 2
je 0x65bc4b
or si, 0x10
test bl, 0x10
je 0x65bc54
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x65bc64
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x65bc70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x65bcac]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x65bc8b
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x65bc9b
or bx, 4
test esi, 0x20000000
je 0x65bca7
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x65bd00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.0065bcb0
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret
Function at 0x66fbf0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x66fc6a
mov eax, dword [ebx + 8]
call fcn.005a58bc
mov ecx, eax
mov dl, 1
mov eax, dword [0x5b6940]
call fcn.0059fbec
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.005c2598
mov dword [esi + 0x2b4], ebx
mov dword [esi + 0x2b0], 0x66f4e8
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.005a58bc
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.005a58bc
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x66fce0
mov eax, dword [ebx + 8]
call fcn.005a58bc
mov ecx, eax
mov dl, 1
mov eax, dword [0x5b6940]
call fcn.0059fbec
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.005c2598
mov dword [esi + 0x2b4], ebx
mov dword [esi + 0x2b0], 0x66f534
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.005a58bc
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.005a58bc
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x66fd4c
mov eax, dword [ebx + 8]
call fcn.005a58bc
mov ecx, eax
mov dl, 1
mov eax, dword [0x5b73b0]
call fcn.0059fbec
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x288], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.005a58bc
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.005a58bc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x411219
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x447d51
call fcn.00415350
push ecx
mov eax, dword [0x456654]
push ebx
mov ebx, ecx
mov dword [0x456d94], eax
push esi
xor eax, eax
mov dword [ebx], 0x401f30
mov dword [ebx + 4], 0x401ee0
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebx + 8], eax
mov dword [ebp - 4], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
lea ecx, [ebx + 0x50]
push eax
push ecx
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x4c], eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea ecx, [ebx + 0x54]
mov byte [ebp - 4], 8
call fcn.00418760
lea ecx, [ebx + 0x5c]
mov byte [ebp - 4], 9
call fcn.00418acf
lea ecx, [ebx + 0x74]
call fcn.00418acf
lea ecx, [ebx + 0x8c]
call fcn.00418acf
lea ecx, [ebx + 0xa8]
call fcn.0040d480
mov dword [ebx + 0xc0], 5
lea edi, [ebx + 0x3c]
mov esi, 0x40bb98
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x5c]
mov byte [ebp - 4], 0xa
mov byte [ebx + 0x34], 0
call fcn.00418be5
lea ecx, [ebx + 0x74]
call fcn.00418be5
lea ecx, [ebx + 0x8c]
call fcn.00418be5
lea eax, [ebx + 0xbc]
push eax
lea eax, [ebx + 0xb8]
push eax
call fcn.00415c49
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x411e02
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x447eb3
call fcn.00415350
push ecx
push esi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004109e3
and dword [ebp - 4], 0
mov dword [esi], 0x4022d4
mov dword [esi + 4], 0x402290
mov dword [esi + 8], 0x401794
mov dword [esi + 0xc], 0x401780
and dword [esi + 0x30], 0
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004109c8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x41288c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4480fa
call fcn.00415350
push ecx
push esi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00411131
and dword [ebp - 4], 0
mov dword [esi], 0x402858
mov dword [esi + 4], 0x40282c
mov dword [esi + 8], 0x401d3c
mov dword [esi + 0xc], 0x40281c
and dword [esi + 0x30], 0
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004109c8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41519d
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov edx, dword [0x456d48]
test edx, edx
mov eax, dword [0x4560a0]
mov dword [ebp + 0x2a4], eax
je 0x4150ed
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x80], 0xc0000409
call edx
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.0041519d
add ebp, 0x2a8
leave
ret
cmp ecx, dword [0x4560a0]
jne 0x4151a6
ret
jmp 0x415098
Function at 0x4227d7
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x449296
call fcn.00415350
mov eax, 0x104c
call fcn.00442fe0
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x1058]
call fcn.004216bc
mov eax, dword [esi + 0x20]
lea edi, [esi + 0x28]
push edi
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x800
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x422976
cmp byte [esi + 0x5c], bl
jne 0x422976
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x1c]
push eax
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.ole32.dll_StringFromCLSID]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x422965
push 0x40618c
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1058]
push 0x40617c
call fcn.0041a109
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x422965
mov eax, dword [ebp - 0x1054]
lea ecx, [ebp - 0x10]
push ecx
push 0x20019
push ebx
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42291c
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1054]
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x40615c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42291c
cmp dword [ebp - 0x20], ebx
jbe 0x42291c
mov eax, dword [ebp - 0x1054]
mov edi, dword [sym.imp.msvcrt.dll_wcscmp]
push 0x406150
push eax
call edi
test eax, eax
pop ecx
pop ecx
jne 0x4228f0
push dword [esi + 0x20]
mov eax, 0x8000ffff
push eax
push 0x7f5
push 0x827
mov dword [ebp - 0x14], eax
call fcn.00418538
add esp, 0x10
jmp 0x422965
mov eax, dword [ebp - 0x1054]
push 0x406144
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x422918
mov eax, dword [ebp - 0x1054]
push 0x406134
push eax
call edi
test eax, eax
pop ecx
pop ecx
jne 0x42291c
mov byte [esi + 0x5d], 1
cmp byte [esi + 0x5d], bl
mov byte [esi + 0x5c], 1
je 0x422965
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x18]
push eax
push 0x402e00
push 7
push ebx
lea eax, [esi + 0x28]
push eax
mov byte [ebp - 4], 2
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x422957
push dword [ebp - 0x18]
lea ecx, [esi + 0x10]
call fcn.004215a2
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00431393
pop ecx
cmp dword [ebp - 0x10], ebx
je 0x422976
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x1c], ebx
pop edi
pop esi
pop ebx
je 0x422987
push dword [ebp - 0x1c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1058]
call fcn.00419db0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov dword fs:[0], ecx
leave
ret
Function at 0x42c3ef
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x44a044
call fcn.00415350
mov eax, 0x104c
call fcn.00442fe0
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], 0x800
mov dword [ebp - 0x1c], ebx
mov eax, dword [esi + 0xc]
lea edi, [esi + 0x14]
push edi
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jge 0x42c44a
push dword [esi + 0xc]
push eax
push 0x7d6
push 0x84e
call fcn.00418538
add esp, 0x10
jmp 0x42c5a8
cmp dword [esi + 4], ebx
je 0x42c5a8
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x1058]
mov byte [ebp - 4], 1
call fcn.004216bc
lea eax, [ebp - 0x18]
push eax
push edi
mov byte [ebp - 4], 2
mov dword [esi + 4], ebx
call dword [sym.imp.ole32.dll_StringFromCLSID]
cmp eax, ebx
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x1058]
jl 0x42c4a3
push 0x40618c
push dword [ebp - 0x18]
push 0x40617c
call fcn.0041a109
cmp eax, ebx
mov dword [ebp - 0x14], eax
jge 0x42c4c6
lea ecx, [ebp - 0x1058]
mov byte [ebp - 4], 1
call fcn.00419db0
cmp dword [ebp - 0x10], ebx
je 0x42c5a8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
jmp 0x42c5a8
mov eax, dword [ebp - 0x1054]
lea ecx, [ebp - 0x10]
push ecx
push 0x20019
push ebx
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42c54e
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1054]
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x40615c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42c555
cmp dword [ebp - 0x20], ebx
jbe 0x42c555
mov eax, dword [ebp - 0x1054]
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x406144
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x42c54e
mov eax, dword [ebp - 0x1054]
push 0x406150
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x42c54e
mov eax, dword [ebp - 0x1054]
push 0x406134
push eax
call edi
test eax, eax
pop ecx
pop ecx
jne 0x42c555
mov dword [esi + 4], 1
lea ecx, [ebp - 0x1058]
mov byte [ebp - 4], 1
call fcn.00419db0
cmp dword [ebp - 0x10], ebx
mov byte [ebp - 4], bl
je 0x42c578
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
cmp dword [esi + 4], ebx
je 0x42c5a8
lea eax, [ebp - 0x1c]
push eax
push 0x404924
push 7
push ebx
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x42c5a8
push dword [ebp - 0x1c]
lea ecx, [esi + 8]
call fcn.0042b9b5
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], ebx
pop edi
pop esi
pop ebx
je 0x42c5b9
push dword [ebp - 0x18]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x1c]
push eax
call fcn.00431393
mov eax, dword [ebp - 0x14]
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x433d35
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x44aa98
call fcn.00415350
mov eax, 0x1058
call fcn.00442fe0
mov eax, dword [0x4560a0]
push ebx
push esi
push edi
lea ecx, [ebp - 0x1064]
mov dword [ebp - 0x10], eax
call fcn.00424d60
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], 0x800
xor esi, esi
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 1
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
mov edi, eax
cmp edi, ebx
jl 0x433e6a
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov edi, eax
cmp edi, ebx
jl 0x433e6a
push 0x40618c
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1064]
push 0x40617c
call fcn.0041a109
mov edi, eax
cmp edi, ebx
jl 0x433e6a
mov eax, dword [ebp - 0x1060]
lea ecx, [ebp - 0x24]
push ecx
push 0x20019
push ebx
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x433e3f
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x1060]
lea eax, [ebp - 0x30]
push eax
push ebx
push 0x40615c
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x433e3f
cmp dword [ebp - 0x2c], ebx
jbe 0x433e3f
mov eax, dword [ebp - 0x1060]
mov edi, dword [sym.imp.msvcrt.dll_wcscmp]
push 0x406144
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x433e3c
mov eax, dword [ebp - 0x1060]
push 0x406134
push eax
call edi
test eax, eax
pop ecx
pop ecx
jne 0x433e3f
xor esi, esi
inc esi
neg esi
sbb esi, esi
and esi, 0x7ff8ffa9
add esi, 0x80070057
mov edi, esi
js 0x433e6a
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push 0x402ea0
push 7
push ebx
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
cmp dword [ebp - 0x28], ebx
je 0x433e78
push dword [ebp - 0x28]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp edi, ebx
jge 0x433e92
push dword [ebp + 8]
push edi
push 0x7d6
push 0x89f
call fcn.00418538
add esp, 0x10
cmp dword [ebp - 0x24], ebx
je 0x433ea3
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1064]
call fcn.00419db0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0041519d
leave
ret 8
Function at 0x437468
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x44af0b
call fcn.00415350
push ecx
mov eax, dword [0x456798]
push ebx
mov dword [0x456dc8], eax
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi], 0x408d74
mov dword [esi + 4], 0x408cd0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [0x456570]
push edi
lea ecx, [esi + 0x14]
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], eax
call fcn.0043639b
lea ecx, [esi + 0x24]
mov dword [ebp - 4], ebx
call fcn.00438561
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea eax, [esi + 0x2c]
push ebx
push eax
call edi
lea eax, [esi + 0x30]
push ebx
push eax
call edi
mov dword [esi + 0x34], ebx
lea edi, [esi + 0x58]
mov ecx, edi
mov byte [ebp - 4], 4
mov byte [esi + 0x38], bl
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x54], bl
call fcn.00431e26
mov ecx, dword [ebp - 0xc]
mov dword [edi], 0x408c68
mov byte [esi + 0x2cc], bl
or eax, 0xffffffff
lea edi, [esi + 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret