joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422730
Capabilities:
Query or enumerate registry key

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
je 0x422755
push 0x20019
push eax
mov eax, dword [esp + 0x1c]
push eax
call fcn.00420d10
add esp, 0xc
mov ebx, eax
jmp 0x422759
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
push 0xffffffffffffffff
push ebp
call fcn.0045c6c7
cmp ebx, ebp
je 0x422843
push ebp
push ebp
push ebp
push ebp
push ebp
lea ecx, [esp + 0x2c]
push ebp
lea edx, [esp + 0x24]
push ecx
push edx
push ebp
push ebp
push ebp
push ebx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x48], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x422834
cmp dword [esp + 0xc], ebp
jbe 0x422834
mov eax, dword [esp + 0x18]
cmp eax, 0x104
jae 0x4227b5
mov eax, 0x104
mov dword [esp + 0x18], eax
inc eax
push eax
call fcn.0045e1f2
mov esi, eax
add esp, 4
cmp esi, ebp
je 0x422834
cmp dword [esp + 0xc], ebp
jbe 0x422810
push edi
mov eax, dword [esp + 0x1c]
mov edi, esi
lea ecx, [eax + 1]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x422806
mov ecx, dword [esp + 0x20]
push esi
mov edx, dword [ecx + 8]
push edx
call fcn.0045c8dd
mov eax, dword [esp + 0x10]
inc ebp
cmp ebp, eax
jb 0x4227cc
pop edi
push esi
call fcn.0045e21b
mov eax, dword [esp + 0x18]
add esp, 4
cmp ebx, eax
je 0x42282a
push ebx
call fcn.00420d60
add esp, 4
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
cmp ebx, dword [esp + 0x14]
je 0x422843
push ebx
call fcn.00420d60
add esp, 4
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x4229e0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
test ebx, ebx
je 0x422a02
mov edi, dword [esp + 0x10]
push 0x2001f
push ebx
push edi
call fcn.00420d10
add esp, 0xc
mov esi, eax
jmp 0x422a08
mov edi, dword [esp + 0x10]
mov esi, edi
test esi, esi
je 0x422a6e
mov eax, dword [esp + 0x18]
test eax, eax
je 0x422a36
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x422a61
cmp esi, edi
je 0x422a2d
push esi
call fcn.00420d60
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
ret
push esi
call fcn.00422a80
add esp, 4
test eax, eax
je 0x422a61
cmp esi, edi
je 0x422a50
push esi
call fcn.00420d60
add esp, 4
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
ret
cmp esi, edi
je 0x422a6e
push esi
call fcn.00420d60
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x422a80
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebx, dword [esp + 0x20]
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push 0
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x422b89
mov eax, dword [esp + 0x10]
test eax, eax
je 0x422b9a
mov eax, dword [esp + 0x18]
cmp eax, 0x104
jae 0x422ad4
mov eax, 0x104
mov dword [esp + 0x18], eax
inc eax
push eax
call fcn.0045e1f2
mov esi, eax
add esp, 4
test esi, esi
je 0x422b89
mov edx, dword [esp + 0x18]
xor eax, eax
mov edi, esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [edx + 1]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
inc eax
push eax
push esi
push 0
push ebx
call ebp
test eax, eax
jne 0x422b80
push 0x2001f
push esi
push ebx
call fcn.00420d10
mov edi, eax
add esp, 0xc
test edi, edi
je 0x422b80
push edi
call fcn.00422a80
add esp, 4
test eax, eax
push edi
je 0x422ba5
call fcn.00420d60
add esp, 4
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x422b80
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
je 0x422b91
mov ecx, dword [esp + 0x18]
xor eax, eax
inc ecx
mov edi, esi
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
inc eax
push eax
push esi
push 0
push ebx
call ebp
test eax, eax
je 0x422b17
push esi
call fcn.0045e21b
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push esi
call fcn.0045e21b
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
call fcn.00420d60
push esi
call fcn.0045e21b
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x422d00
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
push ebx
test eax, eax
push edi
mov ebx, ecx
je 0x422d21
push 0x20019
push eax
mov eax, dword [ebx]
push eax
call fcn.00420d10
add esp, 0xc
mov edi, eax
jmp 0x422d23
mov edi, dword [ebx]
test edi, edi
je 0x422db0
mov eax, dword [esp + 0x10]
push esi
lea ecx, [esp + 0x14]
xor esi, esi
push ecx
lea edx, [esp + 0x14]
push esi
push edx
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x422d53.2
mov eax, dword [esp + 0x18]
cmp eax, 4
ja case.0x422d53.2
jmp dword [eax*4 + 0x422db8]
mov esi, 1
jmp case.0x422d53.2
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, 4
sete cl
mov esi, ecx
jmp case.0x422d53.2
mov eax, dword [esp + 0x10]
cmp eax, 1
je case.0x422d53.0
cmp eax, 2
je case.0x422d53.0
cmp eax, 6
je case.0x422d53.0
cmp eax, 7
je case.0x422d53.0
xor esi, esi
jmp case.0x422d53.2
mov eax, dword [esp + 0x10]
xor edx, edx
cmp eax, 3
sete dl
mov esi, edx
cmp edi, dword [ebx]
je 0x422da8
push edi
call fcn.00420d60
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
ret 0xc
pop edi
xor eax, eax
pop ebx
ret 0xc
Function at 0x427850
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, eax
push esi
mov esi, dword [esp + 0x10]
and ebp, 0xf
shr eax, 4
inc eax
push edi
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x4278a9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4278a9
xor edi, edi
xor ebx, ebx
mov bx, word [esi]
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebp, edi
je 0x4278b0
inc edi
lea esi, [esi + ebx*2]
cmp edi, 0x10
jl 0x42788d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, ecx
xor eax, eax
mov edi, ebp
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
dec eax
push eax
push ebp
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x4278ab
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x42d380
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x42d3d0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x42d3d0
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x42d3d5
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x42d3bb
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x42d3e2
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x437cd0
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x488b54]
test eax, eax
jne 0x437daa
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x4889f0
mov dword [0x488b54], 1
mov dword [0x4889f0], 0x94
call esi
mov edx, dword [0x488a00]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x4840a0], eax
je 0x437d9e
push edi
push 0x488a88
mov dword [0x488a88], 0x9c
call esi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x488b4c], eax
call edi
mov dword [0x488b50], eax
mov eax, dword [0x488b4c]
pop edi
test eax, eax
push 0x488b28
je 0x437d6c
call eax
jmp 0x437d72
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x488a8c]
cmp eax, 6
jae 0x437d8a
cmp eax, 5
jne 0x437d9e
cmp dword [0x488a90], 2
jb 0x437d9e
cmp word [0x488b28], 9
jne 0x437d9e
mov dword [0x4889e4], 1
call fcn.00437db0
mov eax, 1
pop esi
ret
mov eax, 1
ret

Function at 0x438810
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472040
push 0x4183c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x488b58]
xor ebx, ebx
cmp eax, ebx
jne 0x438970
mov byte [ebp - 0x11c], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x43896b
mov byte [ebp - 0x224], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x223]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.user32.dll
lea ecx, [ebp - 0x11c]
push ecx
push 0x47c054
lea edx, [ebp - 0x224]
push edx
call fcn.0041198f
add esp, 0x10
mov dword [ebp - 0x22c], ebx
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x120], eax
push eax
call fcn.0045e1f2
add esp, 4
mov esi, eax
mov dword [ebp - 0x238], esi
cmp esi, ebx
je 0x43896b
push esi
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x438962
mov dword [ebp - 0x230], ebx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x230]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x438962
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x234], eax
mov ecx, dword [eax]
mov dword [0x488b58], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x438962
push esi
call fcn.0045e21b
add esp, 4
mov eax, dword [0x488b58]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ba90
Capabilities:
Get user security identifier

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
xor ebx, ebx
push eax
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ebp
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x43badb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x43badb
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
push esi
push eax
call fcn.0045e1f2
mov ecx, dword [esp + 0x14]
mov dword [edi], eax
push ecx
call fcn.0045e1f2
mov esi, eax
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0x43bb1d
test esi, esi
je 0x43bb2e
lea edx, [esp + 0x20]
lea ecx, [esp + 0x10]
push edx
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push eax
push ebp
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov ebx, eax
test esi, esi
je 0x43bb2a
push esi
call fcn.0045e21b
add esp, 4
test ebx, ebx
jne 0x43bb3d
mov edi, dword [edi]
test edi, edi
je 0x43bb3d
push edi
call fcn.0045e21b
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 8
ret
Function at 0x442f80
Capabilities:
Accept command line arguments
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c870
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x200
push ebx
push esi
push edi
mov ecx, 0x7c
xor eax, eax
lea edi, [ebp - 0x20b]
mov byte [ebp - 0x20c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], edi
call esi
mov ebx, dword [ebp + 8]
cmp eax, ebx
jne 0x443050
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, eax
test edx, edx
je 0x443027
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 0x10]
not ecx
dec ecx
mov esi, ecx
cmp esi, eax
jb 0x442ff5
lea esi, [eax - 1]
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x443038
test eax, eax
jbe 0x443038
push esi
push edx
push edi
call fcn.00411280
add esp, 0xc
mov byte [esi + edi], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x443038
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jbe 0x443038
mov byte [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.004380e0
test eax, eax
je 0x44306b
push 1
push str.SeDebugPrivilege
call esi
push eax
call fcn.0043ac10
add esp, 0xc
push ebx
push 0
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
mov dword [ebp - 0x18], esi
jne 0x443092
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 4], 0
mov ecx, dword [eax + 1]
mov dword [ebp + 8], ecx
call fcn.004380e0
test eax, eax
je 0x4430fd
mov ecx, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea edx, [ebp - 0x14]
lea eax, [ebp + 8]
push edx
push 4
push eax
push ecx
push esi
call ebx
test eax, eax
je 0x4430fd
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x20c]
push 0x1f4
push eax
push ecx
push esi
call ebx
test eax, eax
je 0x4430fd
mov edi, 1
jmp 0x4430fd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x443151
mov eax, dword [ebp - 0x14]
xor edi, edi
cmp eax, 0x1f4
jb 0x44311c
mov eax, 0x1f3
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x10]
cmp eax, ecx
jb 0x443129
lea eax, [ecx - 1]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x443151
test ecx, ecx
jbe 0x443151
lea edx, [ebp - 0x20c]
push eax
push edx
push esi
call fcn.00411280
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov edi, 1
mov byte [eax + esi], 0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x443c50
Capabilities:
Get user security identifier

Disassembly:
mov eax, dword [0x488c7c]
sub esp, 0xa0
push ebx
xor ebx, ebx
push ebp
cmp eax, ebx
push edi
jne 0x443c9c
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esp + 0x28]
mov eax, 1
cmp ecx, 2
jne 0x443c97
mov dword [0x488c80], eax
mov dword [0x488c7c], eax
cmp dword [0x488c80], ebx
jne 0x443cb0
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa0
ret
mov ebp, dword [esp + 0xb0]
mov edi, dword [esp + 0xb4]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
lea eax, [esp + 0x14]
push ebx
push eax
push ebx
push ebp
push ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x443cfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x443cfc
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa0
ret
mov ecx, dword [esp + 0xc]
push esi
push ecx
call fcn.0045e1f2
mov edx, dword [esp + 0x18]
mov dword [edi], eax
lea eax, [edx + edx]
push eax
call fcn.0045e1f2
mov esi, eax
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0x443d41
test esi, esi
je 0x443d52
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x18]
push esi
push ecx
push eax
push ebp
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test esi, esi
je 0x443d4e
push esi
call fcn.0045e21b
add esp, 4
test ebx, ebx
jne 0x443d61
mov edi, dword [edi]
test edi, edi
je 0x443d61
push edi
call fcn.0045e21b
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x444720
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x444770
lea eax, [esi + 4]
push eax
push 4
push esi
push 0x444940
push 0
push 0
call fcn.004147aa
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x444770
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x44475f
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4447c0
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x4447d4
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 8]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 8]
push 0
push ecx
push 2
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esi + 8]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x444821
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push ecx
call edi
mov edx, dword [esi + 0x14]
push edx
call edi
mov dword [esi + 0xc], 0
pop edi
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x445710
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46c95f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x472034]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
mov edi, dword [ecx]
test eax, eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x14], edi
je 0x445777
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x445779
mov esi, edi
test esi, esi
je 0x445861
mov ebx, dword [esp + 0x38]
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x3c]
push 0
push eax
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x445849
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x4457bf
cmp eax, 2
je 0x4457bf
cmp eax, 6
je 0x4457bf
cmp eax, 7
jne 0x445849
mov ecx, dword [esp + 0x34]
add ecx, 2
push ecx
call fcn.0045e1f2
mov edx, dword [esp + 0x38]
mov ebp, eax
xor eax, eax
mov edi, ebp
lea ecx, [edx + 2]
add esp, 4
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebp
jne 0x44582f
lea ecx, [esp + 0x14]
call fcn.00423cc0
cmp esi, dword [esp + 0x14]
je 0x445824
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x445824
push 0
push 0
call fcn.00413200
push ebp
call fcn.0045e21b
add esp, 4
jmp 0x445873
call fcn.0045e21b
add esp, 4
lea ecx, [esp + 0x10]
push 0x4858e0
call fcn.00423cc0
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x445861
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x445861
push 0
push 0
call fcn.00413200
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x445873
push eax
lea ecx, [esp + 0x14]
call fcn.00423cc0
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00422f70
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.00423a00
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x446770
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46ca68
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
test eax, eax
je 0x4467c4
lea ecx, [esp + 0x24]
mov ebp, dword [esp + 0x20]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
mov eax, dword [esp + 0x20]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x4467ca
mov ebp, dword [esp + 0x20]
mov esi, ebp
test esi, esi
je 0x44693c
call fcn.004380e0
test eax, eax
je 0x446874
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x20]
push eax
call fcn.004289e0
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x20]
push ebx
mov dword [esp + 0x1c], 0
call fcn.00410fb4
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
push ebx
mov ebx, 1
push ebx
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x44685e
cmp esi, ebp
je 0x446838
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x446838
push 0
push 0
call fcn.00413200
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.00429360
mov eax, ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.00429360
jmp 0x446924
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x24]
push edx
call fcn.00423060
mov eax, dword [esp + 0x2c]
mov ebx, 1
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], ebx
call fcn.00423200
mov eax, dword [esp + 0x28]
mov byte [esp + 0x18], 2
mov ecx, dword [eax - 8]
inc ecx
push ecx
mov ecx, dword [esp + 0x28]
push eax
push ebx
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x446906
cmp esi, ebp
je 0x4468d3
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4468d3
push 0
push 0
call fcn.00413200
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], bl
call fcn.00423a00
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call fcn.00423a00
mov eax, ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], bl
call fcn.00423a00
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call fcn.00423a00
cmp esi, ebp
je 0x44693c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x44693c
push 0
push 0
call fcn.00413200
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret