joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d6d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [eax]
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
and esi, 7
cmp eax, 5
jae 0x43d6f0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
push ebx
mov ebx, dword [ebp + 8]
sub eax, 4
add ebx, eax
mov dword [ebp - 4], ebx
mov edx, dword [ebp + 8]
add edx, edi
cmp edx, ebx
jae 0x43d71d
lea esp, [esp]
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x43d71d
inc edx
cmp edx, ebx
jb 0x43d710
mov eax, dword [ebp + 8]
mov ecx, edx
sub ecx, edi
mov edi, edx
sub ecx, eax
sub edi, eax
cmp edx, ebx
jae 0x43d7f5
cmp ecx, 2
jbe 0x43d774
xor esi, esi
movzx ecx, byte [edx + 4]
lea eax, [ecx + 1]
test al, 0xfe
jne 0x43d792
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or eax, ecx
mov ecx, dword [ebp + 0x10]
add ecx, edi
add edi, 5
cmp dword [ebp + 0x18], 0
mov dword [ebp + 0xc], ecx
je 0x43d79d
add eax, ecx
jmp 0x43d79f
shr esi, cl
test esi, esi
je 0x43d739
cmp esi, 4
ja 0x43d792
cmp esi, 3
je 0x43d792
mov ecx, esi
shr ecx, 1
movzx eax, byte [ecx + edx + 1]
inc eax
test al, 0xfe
jne 0x43d739
or esi, 8
shr esi, 1
inc edi
jmp 0x43d700
sub eax, ecx
test esi, esi
je 0x43d7d3
and esi, 6
add esi, esi
add esi, esi
mov ebx, eax
mov ecx, esi
shr ebx, cl
inc ebx
test bl, 0xfe
jne 0x43d7ce
mov ebx, 0x100
shl ebx, cl
dec ebx
xor eax, ebx
cmp dword [ebp + 0x18], 0
je 0x43d7cb
add eax, dword [ebp + 0xc]
jmp 0x43d7ce
sub eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
xor esi, esi
mov ecx, eax
shr ecx, 8
mov byte [edx + 1], al
mov byte [edx + 2], cl
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
and al, 1
neg al
mov byte [edx + 3], cl
mov byte [edx + 4], al
jmp 0x43d700
pop ebx
cmp ecx, 2
jbe 0x43d80a
mov edx, dword [ebp + 0x14]
xor esi, esi
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x14]
shr esi, cl
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4414e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4414fd
test al, 0x10
jne 0x4414fd
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x441510
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x44152d
test al, 0x10
je 0x44152d
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4415f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
lea ecx, [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
push esi
lea edx, [ebp + 0x14]
push edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
push 0
push eax
push ecx
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x441624
cmp eax, 0xea
jne 0x441631
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x441639
cmp eax, 2
je 0x441639
mov byte [esi], 0
xor al, al
pop esi
pop ebp
ret
mov al, 1
pop esi
pop ebp
ret

Function at 0x4416a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
sub esp, 0x400
push 0x400
lea eax, [ebp - 0x400]
push eax
push ecx
push edx
call fcn.004415f0
add esp, 0x10
test al, al
jne 0x4416d5
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
xor al, al
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x400], 0x22
push esi
push edi
jne 0x4416fd
lea esi, [ebp - 0x3ff]
mov ecx, esi
push 0x22
push ecx
call dword [sym.imp.msvcrt.dll_strchr]
add esp, 8
test eax, eax
je 0x441703
mov byte [eax], 0
jmp 0x441703
lea esi, [ebp - 0x400]
mov edi, dword [ebp + 0x10]
push 0x400
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x44172a
mov edx, edi
mov eax, esi
sub edx, esi
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x441720
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x442770
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
mov esi, ecx
cmp byte [esi + 5], 0
mov byte [esi + 4], 0
je 0x44278f
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push edi
jmp 0x4427a0
mov eax, dword [esi + 0x548]
test eax, eax
je 0x4427e2
lea edi, [esi + 0x408]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x442811
mov eax, dword [esi + 0x548]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebx
mov dword [esi + 0x548], 0
mov byte [esi + 5], 1
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
lea eax, [esi + 6]
push eax
lea ecx, [ebp - 0x400]
push ecx
call fcn.0045b740
add esp, 8
lea edi, [esi + 0x408]
push edi
lea edx, [ebp - 0x400]
push edx
mov dword [eax], 0x2a2e2a
call ebx
mov dword [esi + 0x548], eax
cmp byte [esi + 0x434], 0x2e
jne 0x442839
mov al, byte [esi + 0x435]
test al, al
je 0x4427a0
cmp al, 0x2e
jne 0x442839
cmp byte [esi + 0x436], 0
je 0x4427a0
test byte [edi], 2
jne 0x4427a0
mov edx, dword [ebp + 8]
lea ecx, [esi + 6]
push ecx
push edx
lea edi, [esi + 0x434]
call fcn.0045b740
add esp, 8
sub eax, edi
lea ebx, [ebx]
mov cl, byte [edi]
mov byte [eax + edi], cl
inc edi
test cl, cl
jne 0x442860
pop edi
pop ebx
mov byte [esi + 4], 1
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x44aaf0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df500
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x118], 0
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], 0
jne 0x44ab3b
push 0x637c4c
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
mov ecx, esi
call fcn.0044a830
mov ebx, dword [esi + 8]
test ebx, ebx
jne 0x44ab59
mov ecx, dword [esi + 0x118]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov edi, dword [ebp + 8]
test edi, edi
je 0x44ab68
cmp ebx, edi
jbe 0x44ab6a
mov ebx, edi
jmp 0x44ab6a
mov edi, ebx
mov eax, dword [esi + 0xc]
mov dword [ebp + 8], eax
cmp eax, ebx
jbe 0x44ab77
mov dword [ebp + 8], ebx
mov edx, dword [esi + 0x118]
push 0
push edi
push 0
push 4
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 0x11c], eax
test eax, eax
jne 0x44abac
push 0x637c4c
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
push edi
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x20], eax
mov dword [esi + 0x120], eax
test eax, eax
jne 0x44abdc
push 0x637c4c
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
mov ecx, dword [esi + 4]
lea edx, [esi + 0x14]
cmp ecx, edx
je 0x44abfb
cmp byte [esi + 0x114], 0
jne 0x44abfb
push ecx
call fcn.0040107c
mov eax, dword [ebp - 0x20]
add esp, 4
mov dword [esi + 4], eax
mov dword [esi + 0x10], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], 0
mov byte [esi + 0x114], 1
cmp ebx, edi
jbe 0x44ac21
push ebx
mov ecx, esi
call fcn.00401b40
mov dword [esi + 8], ebx
mov eax, dword [ebp + 8]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], 0
cmp eax, ebx
jbe 0x44ac61
push 0x637c4c
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
mov esi, dword [ebp - 0x28]
mov ecx, esi
call fcn.0044a830
mov ecx, esi
call fcn.0044a870
push 0
push 0
call sub.msvcrt.dll__CxxThrowException
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [esi + 0xc], eax
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44ad30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x44ad3e
xor eax, eax
pop ebp
ret
mov edx, dword [ebp + 0xc]
or eax, 0xffffffff
push esi
cmp edx, 8
jb 0x44ae11
mov esi, edx
shr esi, 3
push edi
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6064b8]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6064b8]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6064b8]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6064b8]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6064b8]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6064b8]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6064b8]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6064b8]
add ecx, 8
sub edx, 8
dec esi
jne 0x44ad54
pop edi
test edx, edx
je 0x44ae2e
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6064b8]
inc ecx
dec edx
jne 0x44ae15
not eax
pop esi
pop ebp
ret

Function at 0x44ae40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x44ae4e
xor eax, eax
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
not eax
cmp edx, 8
jb 0x44af2d
mov esi, edx
shr esi, 3
push edi
jmp 0x44ae70
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6064b8]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6064b8]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6064b8]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6064b8]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6064b8]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6064b8]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6064b8]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x6064b8]
add ecx, 8
sub edx, 8
dec esi
jne 0x44ae70
pop edi
test edx, edx
je 0x44af4a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6064b8]
inc ecx
dec edx
jne 0x44af31
not eax
pop esi
pop ebp
ret
Function at 0x44f1c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, str.ding.wav
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_strchr]
add esp, 8
test eax, eax
jne 0x44f228
push 0x104
lea eax, [ebp - 0x104]
push eax
push str._SystemRoot_media_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x104]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x44f200
mov ecx, dword [str.ding.wav]
mov edx, dword [0x606a3c]
mov dword [eax], ecx
mov cl, byte [0x606a40]
mov dword [eax + 4], edx
mov byte [eax + 8], cl
lea esi, [ebp - 0x104]
push 0x20013
push 0
push esi
call dword [sym.imp.WINMM.dll_PlaySoundA]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44f240
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, str.start.wav
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_strchr]
add esp, 8
test eax, eax
jne 0x44f2aa
push 0x104
lea eax, [ebp - 0x104]
push eax
push str._SystemRoot_media_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x104]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x44f280
mov ecx, dword [str.start.wav]
mov edx, dword [0x606a48]
mov dword [eax], ecx
mov cx, word [0x606a4c]
mov dword [eax + 4], edx
mov word [eax + 8], cx
lea esi, [ebp - 0x104]
push 0x20013
push 0
push esi
call dword [sym.imp.WINMM.dll_PlaySoundA]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44f2c0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.AppEventsSchemesAppsExplorerNavigating.Current
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44f37e
push esi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x44f37e
mov eax, dword [ebp - 0xc]
cmp eax, 1
je 0x44f36a
cmp eax, 2
jne 0x44f37e
xor eax, eax
lea ebx, [ebx]
mov cl, byte [ebp + eax - 0x40c]
mov byte [ebp + eax - 0x80c], cl
inc eax
test cl, cl
jne 0x44f330
push 0x400
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x80c]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 8], eax
test eax, eax
je 0x44f37e
cmp eax, 0x400
jae 0x44f37e
push 0x20003
push 0
lea edx, [ebp - 0x40c]
push edx
call dword [sym.imp.WINMM.dll_PlaySoundA]
mov esp, ebp
pop ebp
ret
Function at 0x44f730
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
mov esi, ecx
mov ebx, 3
call fcn.0044f010
test al, al
je 0x44f81d
mov ecx, dword [ebp + 8]
cmp byte [esi + ecx*8 + 0x44], 0
je 0x44f81d
mov al, byte [esi + ecx*8 + 0x45]
cmp al, byte [esi + 0x117]
jae 0x44f76e
mov ebx, 0x13
mov byte [esi + 0x117], al
mov esi, dword [esi + ecx*8 + 0x48]
test esi, esi
je 0x44f81d
push edi
push esi
call fcn.0044f0e0
mov edi, eax
add esp, 4
test edi, edi
je 0x44f7b3
call sub.MFC42.dll_AfxGetModuleState
mov eax, dword [eax + 8]
or ebx, 0x40004
push ebx
push eax
movzx eax, di
push eax
call dword [sym.imp.WINMM.dll_PlaySoundA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_strchr]
add esp, 8
test eax, eax
jne 0x44f80c
push 0x104
lea ecx, [ebp - 0x104]
push ecx
push str._SystemRoot_media_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, esi
mov edx, esi
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44f7e0
lea edi, [ebp - 0x104]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x44f7f0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebp - 0x104]
or ebx, 0x20000
push ebx
push 0
push esi
call dword [sym.imp.WINMM.dll_PlaySoundA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x44fab0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df73b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94c
lea ecx, [ebp - 0x958]
call fcn.004426e0
push 0x400
lea eax, [ebp - 0x40c]
push eax
push str._SystemRoot_media_
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [ebp - 0x40c]
push ecx
lea ecx, [ebp - 0x958]
call fcn.00442730
lea edx, [ebp - 0x40c]
push edx
lea ecx, [ebp - 0x958]
call sym.GameRanger.exe_public_virtual:_char___thiscall_CFileIterator::Next_struct_FileSpec__
test al, al
je 0x44fb84
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x958]
call sym.GameRanger.exe_public_virtual:_char___thiscall_CFileIterator::IsFile_void_
test al, al
je 0x44fb6d
lea eax, [ebp - 0x40c]
push str..wav
push eax
call sym.GameRanger.exe_long_int___cdecl_strcasesuffix_char_const___char_const__
add esp, 8
test eax, eax
je 0x44fb6d
lea ecx, [ebp - 0x40c]
push ecx
call sym.GameRanger.exe_char_const____cdecl_GetSpecPathFile_struct_FileSpec_const__
push eax
call sym.GameRanger.exe_char____cdecl_new_string_char_const__
add esp, 8
lea edx, [ebp + 8]
push edx
mov ecx, esi
mov dword [ebp + 8], eax
call fcn.0044fa90
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x958]
call sym.GameRanger.exe_public_virtual:_char___thiscall_CFileIterator::Next_struct_FileSpec__
test al, al
jne 0x44fb23
pop esi
lea ecx, [ebp - 0x958]
mov dword [ebp - 4], 0xffffffff
call sym.GameRanger.exe_public:_void___thiscall_CFileIterator::destructor_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x450a60
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareClasses_
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x450aab
mov ecx, dword [ebp - 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.gameranger
push ecx
call esi
mov edx, dword [ebp - 4]
push 0x606b5c
push edx
call esi
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x451230
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp byte [0x6a31ac], 0
je 0x451248
xor al, al
mov esp, ebp
pop ebp
ret
push esi
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
mov byte [0x6a31ac], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
push eax
push str.elev:e:_tid_d_n
call fcn.005152d0
add esp, 8
push 0
push 0
push str._admin
lea ecx, [ebp - 0x104]
push ecx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x4512ca
call esi
push eax
push str.elev:e:_se_failed__tid_d_n
call fcn.005152d0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
jne 0x4512c3
mov dword [0x6ea840], 0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4512f7
call esi
push eax
push str.elev:e:_to__tid_d_n
call fcn.005152d0
add esp, 8
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x451610
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push 0x44
lea eax, [ebp - 0x44]
push 0
push eax
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 8]
lea eax, [esi + 0x418]
add esp, 0xc
cmp byte [eax], 0
mov ecx, 1
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], 1
mov word [ebp - 0x14], cx
jne 0x45164f
xor eax, eax
lea ebx, [esi + 0x620]
push ebx
lea edx, [ebp - 0x44]
push edx
push eax
mov eax, dword [esi + 0x630]
push 0
push eax
push 0
push 0
push 0
lea ecx, [esi + 0x210]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [esi + 0x644], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0x644], 0
mov dword [esi + 0x648], eax
je 0x4516f5
mov edx, dword [esi + 4]
push edi
push edx
push 0
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4516f4
mov ebx, dword [ebx]
push 2
push 0
push 0
lea eax, [esi + 0x620]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push 2
push 0
lea eax, [esi + 0x624]
mov esi, dword [eax]
push 0
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push esi
call ebx
push edi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451890
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
push eax
push 0
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp + 8], ebx
test ebx, ebx
je 0x45198e
push edi
push 0x44
lea ecx, [ebp - 0x44]
push 0
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
lea edi, [esi + 0x620]
push edi
lea eax, [ebp - 0x44]
push eax
lea ecx, [esi + 0x418]
push ecx
push 0
mov edx, 1
mov word [ebp - 0x14], dx
mov edx, dword [esi + 0x630]
push edx
push 0
push 0
push 0
lea eax, [esi + 0x210]
push eax
lea ecx, [esi + 8]
push ecx
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [esi + 0x644], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0x644], 0
mov dword [esi + 0x648], eax
je 0x451984
mov edx, dword [ebp + 8]
mov ebx, dword [edi]
push 2
push 0
push 0
push edi
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call edi
mov eax, dword [ebp + 8]
mov ebx, dword [esi + 0x624]
push 2
push 0
push 0
add esi, 0x624
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
call edi
mov ebx, dword [ebp + 8]
push ebx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451ad0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x44
lea eax, [ebp - 0x58]
push 0
push eax
mov dword [ebp - 8], 0x2e4
call sub.msvcrt.dll_memset
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
add esp, 0xc
push ebx
mov ecx, 1
push esi
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], cx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.elev:cpae:_tid_d_n____cmd_s_n____wd_s_n
call fcn.005152d0
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
add esp, 0x10
push edx
lea eax, [ebp - 0x58]
push eax
push ebx
push 0
push ecx
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jne 0x451c2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2e4
jne 0x451c2d
call fcn.00451600
test al, al
jne 0x451c2d
lea edx, [ebp - 0x14]
push edx
call fcn.004510b0
add esp, 4
test al, al
je 0x451c1a
mov edi, dword [ebp - 0x10]
lea edx, [edi + 0x210]
mov dword [edi], 1
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x451b93
test ebx, ebx
je 0x451bba
lea edx, [edi + 0x418]
mov eax, ebx
sub edx, ebx
jmp 0x451bb0
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x451bb0
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push ecx
mov dword [edi + 0x630], eax
call fcn.00451230
add esp, 4
test al, al
je 0x451c0b
mov edx, dword [edi + 0x620]
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
mov ecx, dword [edi + 0x624]
mov dword [eax + 4], ecx
mov edx, dword [edi + 0x628]
mov dword [eax + 8], edx
mov ecx, dword [edi + 0x62c]
mov dword [eax + 0xc], ecx
mov edx, dword [edi + 0x648]
mov eax, dword [edi + 0x644]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00451300
mov edi, dword [ebp - 4]
add esp, 4
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.elev:cpae:_r_d_e_d_n
call fcn.005152d0
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret