joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445eb0
Capabilities:
Get proxy

Disassembly:
push 0xffffffffffffffff
push 0x4d7fa6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x420
push ebx
push ebp
push esi
xor esi, esi
mov ebx, ecx
xor ebp, ebp
mov dword [esp + 0x18], esi
mov dword [esp + 0xc], 0x104
push 0x206
lea eax, [esp + 0x22]
push ebp
mov dword [esp + 0x43c], ebp
push eax
mov word [esp + 0x28], bp
call fcn.004a4620
push 0x206
lea ecx, [esp + 0x236]
push ebp
push ecx
mov word [esp + 0x23c], bp
call fcn.004a4620
add esp, 0x18
call fcn.004460a0
test eax, eax
je 0x44607e
lea edx, [esp + 0x10]
push edx
push 1
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
mov dword [esp + 0x24], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x44607e
mov eax, dword [esp + 0x10]
push edi
push str.ProxyServer
lea ecx, [esp + 0x1c]
push ecx
lea edi, [esp + 0x18]
lea esi, [esp + 0x28]
mov dword [esp + 0x20], eax
call fcn.0040fe90
cmp eax, ebp
pop edi
jne 0x44606b
cmp word [esp + 0x1c], bp
je 0x44606b
mov edx, esi
push edx
call fcn.004a14b0
mov eax, esi
push str.socks
push eax
mov dword [ebx], 2
call fcn.004a1751
add esp, 0xc
cmp eax, ebp
je 0x445fc4
add eax, 0xc
lea edx, [esp + 0x224]
mov dword [ebx], 3
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bp
jne 0x445fb3
jmp 0x446025
lea ecx, [esp + 0x1c]
push str.http
push ecx
call fcn.004a1751
add esp, 8
cmp eax, ebp
mov dword [ebx], 2
je 0x446001
add eax, 0xa
lea edx, [esp + 0x224]
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bp
jne 0x445ff0
jmp 0x446025
xor eax, eax
jmp 0x446010
movzx ecx, word [esp + eax + 0x1c]
mov word [esp + eax + 0x224], cx
add eax, 2
cmp cx, bp
jne 0x446010
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x228]
call fcn.004034e0
mov eax, dword [esp + 0x43c]
mov esi, dword [esp + 0x440]
push eax
mov ecx, esi
lea ebx, [esp + 0x10]
mov byte [esp + 0x438], 1
call fcn.00446120
mov ecx, ebx
call fcn.00403580
mov ecx, dword [esi]
cmp dword [ecx - 0xc], ebp
mov esi, 1
jne 0x44606f
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x44607e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x42c]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x42c
ret 8
Function at 0x4460a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebp
push esi
push edi
lea eax, [esp + 0xc]
push eax
push 1
xor esi, esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x446108
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push str.ProxyEnable
push esi
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x446108
push esi
call ebp
xor esi, esi
test esi, esi
mov edi, dword [esp + 0x10]
je 0x446113
push esi
call ebp
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x10
ret

Function at 0x4466a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4d7f86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov dword [esi], vtable.KDirectInfoc::KInstallSerialize.0
push 0x400
mov dword [esi + 8], 0x400
call fcn.0049f25a
xor edi, edi
add esp, 4
mov dword [esi + 4], eax
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x14], edi
push 0x400
mov dword [esi + 0x18], 0x400
call fcn.0049f25a
add esp, 4
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov word [esi + 0x34], di
mov dword [esi + 0x38], 1
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 4
Function at 0x4467d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8948
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x507fec]
mov edx, dword [eax + 0xc]
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x507fec
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
call dword [section..data]
test ebx, ebx
jne 0x44681c
xor ecx, ecx
xor eax, eax
jmp 0x44687b
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jg 0x44685e
lea edi, [eax + eax]
mov eax, edi
call fcn.004adc80
mov esi, esp
test esi, esi
je 0x44685e
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x446860
xor eax, eax
mov ecx, eax
test ecx, ecx
je 0x44687b
mov eax, ecx
lea esi, [eax + 1]
jmp 0x446870
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x446870
sub eax, esi
mov edi, eax
push ecx
lea eax, [ebp - 0x10]
call fcn.00403d70
mov edi, dword [ebp - 0x10]
mov eax, dword [edi - 0xc]
movzx ecx, ax
mov dword [ebp - 0x14], ecx
movzx ecx, ax
xor eax, eax
test ecx, ecx
jle 0x4468ab
jmp 0x4468a0
xor byte [eax + edi], 0x88
add eax, 1
cmp eax, ecx
jl 0x4468a0
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x14]
add esi, 4
push edx
mov ebx, 2
call fcn.004465c0
movzx ebx, word [ebp - 0x14]
push edi
call fcn.004465c0
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4468ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esp, [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x446e70
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
mov edx, dword [ecx]
push 0
push eax
push edx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x446ea9
mov eax, dword [esp + 0xc]
sub eax, 4
neg eax
sbb eax, eax
and eax, 0xd
pop ecx
ret 8
Function at 0x447550
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
push ebp
xor ebp, ebp
cmp eax, ebp
mov byte [esp + 8], 0
mov dword [esp + 9], ebp
mov dword [esp + 4], ebp
je 0x447633
cmp word [eax], bp
je 0x447633
push edi
push ebp
push 0x80
push 3
push ebp
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x44762b
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebp
jbe 0x44761b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x20]
push ecx
push edi
call ebx
test eax, eax
je 0x44761a
lea ecx, [esp + 0x14]
call fcn.00447690
test eax, eax
je 0x44761a
add esi, 0xfffffffc
lea edx, [esi + 1]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebp, eax
test ebp, ebp
je 0x44761a
mov eax, dword [esp + 0x20]
push 0
push 0
push 4
push edi
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
push ebp
push edi
call ebx
test eax, eax
je 0x44761a
mov ecx, ebp
call fcn.00447640
test eax, eax
jge 0x44761a
push ebp
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor ebp, ebp
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov eax, ebp
pop ebp
add esp, 0xc
ret
pop edi
mov eax, ebp
pop ebp
add esp, 0xc
ret
mov eax, ebp
pop ebp
add esp, 0xc
ret

Function at 0x447640
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x44767e
test esi, esi
jbe 0x44767e
mov edx, esi
shr edx, 2
mov eax, 0
je 0x447662
xor dword [ecx + eax*4], 0xd8d8d8d8
add eax, 1
cmp eax, edx
jb 0x447654
add eax, eax
add eax, eax
cmp eax, esi
jae 0x44767b
lea ebx, [ebx]
xor byte [eax + ecx], 0xd8
add eax, 1
cmp eax, esi
jb 0x447670
xor eax, eax
ret
mov eax, 0x80004005
ret

Function at 0x4476b0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 8
push edi
xor edi, edi
push edi
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x4476da
lea eax, [edi + 1]
pop edi
add esp, 8
ret
cmp dword [esi], edi
je 0x4476e5
mov edi, 1
jmp 0x44773b
lea eax, [esp + 8]
push eax
push 0x4ebf74
push 1
push 0
push 0x4ebf64
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x447709
mov edi, 2
jmp 0x44773b
mov eax, dword [esp + 8]
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
test eax, eax
jge 0x447725
mov edi, 3
jmp 0x44773b
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push esi
push eax
call edx
test eax, eax
jge 0x44773b
mov edi, 4
mov eax, dword [esp + 4]
test eax, eax
je 0x44774b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 8]
test eax, eax
je 0x44775b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, edi
pop edi
add esp, 8
ret
Function at 0x447d60
Capabilities:
Get process image filename

Disassembly:
sub esp, 0x410
push esi
xor esi, esi
cmp eax, esi
je 0x447e5d
cmp eax, 4
je 0x447e5d
cmp eax, 8
je 0x447e5d
push edi
push eax
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, esi
je 0x447e50
push 0x206
lea eax, [esp + 0xe]
push esi
push eax
mov word [esp + 0x14], si
call fcn.004a4620
add esp, 0xc
push 0x103
lea ecx, [esp + 0xc]
push ecx
push esi
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jne 0x447e13
push 0x206
lea edx, [esp + 0x216]
push esi
push edx
mov word [esp + 0x21c], si
call fcn.004a4620
add esp, 0xc
push 0x104
lea eax, [esp + 0x214]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x447e49
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x214]
push edx
call fcn.00447e70
test eax, eax
je 0x447e49
lea eax, [esp + 8]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x447e20
sub eax, edx
sar eax, 1
push ebx
lea ecx, [esp + 0xc]
mov ebx, eax
mov eax, dword [esp + 0x420]
push ecx
call fcn.00403b90
mov esi, 1
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
add esp, 0x410
ret 4
mov eax, esi
pop esi
add esp, 0x410
ret 4

Function at 0x447e70
Capabilities:
Get disk information

Disassembly:
sub esp, 0x4b8
cmp dword [esp + 0x4c0], 0
jne 0x447e8b
xor eax, eax
add esp, 0x4b8
ret 8
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0xe0]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x447f5d
xor ebx, ebx
cmp word [esp + 0xe0], bx
je 0x447f5d
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea esi, [esp + 0xe0]
xor edi, edi
lea esp, [esp]
push 0x4ebff0
push esi
call ebp
test eax, eax
je 0x447f41
push 0x4ebff8
push esi
call ebp
test eax, eax
je 0x447f41
mov cx, word [esi]
mov dx, word [esp + edi + 0xe2]
push 0x64
lea eax, [esp + 0x1c]
mov word [esp + 0x14], cx
push eax
lea ecx, [esp + 0x18]
push ecx
mov word [esp + 0x1e], dx
mov word [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x447f73
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [esp + 0x4cc]
mov esi, eax
push esi
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.004a1897
add esp, 0xc
test eax, eax
je 0x447f82
add ebx, 4
lea edi, [ebx + ebx]
cmp word [esp + edi + 0xe0], 0
lea esi, [esp + edi + 0xe0]
jne 0x447ed0
mov eax, dword [esp + 0x4cc]
mov ecx, dword [esp + 0x4d0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4b8
ret 8
mov ebx, dword [esp + 0x4d0]
lea ecx, [esp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [edi + esi*2]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4b8
ret 8
Function at 0x448bf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7363
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x414
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call dword [section..data]
xor edi, edi
mov dword [ebp - 0x14], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x420], edi
mov ecx, dword [ebp + 0xc]
push 2
push edi
push ecx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, edi
mov dword [ebp + 8], ebx
jne 0x448c57
call fcn.00448820
mov esi, eax
jmp 0x448d60
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push edx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
jne 0x448c76
call fcn.00448820
jmp 0x448d57
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
mov dword [ebp + 0x14], eax
jne 0x448c8f
call fcn.00448820
jmp 0x448d57
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
mov dword [ebp + 0xc], edi
jae 0x448cdc
lea ecx, [ebp - 0x41c]
cmp dword [ebp - 0x420], ecx
je 0x448cbc
lea eax, [ebp - 0x420]
call fcn.00448db0
lea esi, [ebp - 0x14]
call fcn.00448800
mov eax, 0x8007000e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
lea esi, [ebp - 0x420]
mov byte [ebp - 4], 2
call fcn.00448dc0
mov dword [ebp - 4], 1
jmp 0x448d07
mov esi, dword [ebp - 0x420]
test esi, esi
jne 0x448d18
mov esi, 0x8007000e
jmp 0x448d59
call dword [section..data]
mov edx, dword [ebp + 0x14]
push edi
push esi
push edi
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x448d39
call fcn.00448820
jmp 0x448d57
mov ecx, dword [ebp - 0x420]
mov edx, dword [ebp + 0x18]
mov word [ecx + eax*2], 0
mov ecx, dword [ebp - 0x420]
push edx
lea edx, [ebp - 0x1c]
call fcn.00448e00
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x448d80
lea eax, [ebp - 0x420]
call fcn.00448db0
lea esp, [esp]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x449fa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x449fb3
push 0x80004005
call fcn.00401020
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x449fc0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x44a140
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x218
mov edx, dword [esp + 0x21c]
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
push edx
push eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 8]
mov esi, eax
test esi, esi
jne 0x44a19e
test ecx, ecx
je 0x44a190
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x10]
mov esi, eax
mov dword [esp + 8], ecx
je 0x44a1ba
test ecx, ecx
je 0x44a25d
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 0x218
ret 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push ecx
mov dword [esp + 0x2c], 0x100
call esi
test eax, eax
jne 0x44a224
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0xc]
call fcn.0044a140
mov edi, eax
test edi, edi
jne 0x44a26a
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0xc]
push eax
push eax
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x34]
push ecx
push edi
push edx
mov dword [esp + 0x2c], 0x100
call esi
test eax, eax
je 0x44a1e6
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 8]
test eax, eax
je 0x44a23b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 8], 0
mov eax, dword [esp + 0x224]
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x44a25d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 0x218
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x44a279
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 0x218
ret 4
Function at 0x44aba0
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x10
push edi
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x44ac19
lea eax, [esp + 8]
push eax
push edi
push edi
push esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x44ac19
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esp + 8], ecx
mov ecx, eax
and eax, 0x7fffffff
mov dword [esp + 0xc], eax
fild qword [esp + 8]
and ecx, 0x80000000
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
fild qword [esp + 8]
fchs
faddp st(1)
fmul qword [0x4f00a0]
fmul qword [0x4f0098]
fcomp qword [0x4f0090]
fnstsw ax
test ah, 1
lea eax, [edi + 1]
je 0x44ac1b
mov eax, edi
pop edi
add esp, 0x10
ret
Function at 0x44bde0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x20]
sub eax, dword [ebp + 0x18]
sub ebx, dword [ebp + 0x14]
mov edx, dword [ebp]
push esi
push edi
push 1
push eax
xor esi, esi
mov dword [esp + 0x3c], eax
mov eax, dword [edx + 0x6c]
push ebx
mov ecx, ebp
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x1c], esi
call eax
mov edi, dword [ebp + 0x100]
cmp edi, esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
je 0x44bf68
call fcn.0048c010
mov esi, eax
test esi, esi
je 0x44bf1e
mov ecx, dword [esi + 0x10]
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push 2
mov dword [esp + 0x18], ecx
push 0
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x34]
mov ecx, esi
call eax
test eax, eax
je 0x44be6f
lea ebx, [esi + 0x14]
call fcn.0047d8c0
mov ebx, dword [esp + 0x30]
movzx edi, word [esp + 0x34]
mov edx, dword [esi]
mov edx, dword [edx + 0x4c]
xor eax, eax
movzx ecx, bx
mov dword [esp + 0x18], eax
mov dword [esi + 0xc0], eax
lea eax, [esp + 0x18]
push eax
shl edi, 0x10
or edi, ecx
mov ecx, dword [esp + 0x30]
push edi
push ecx
push 0x202
push 0
mov ecx, esi
call edx
mov eax, dword [esp + 0x1c]
cmp dword [ebp + 0x100], eax
jne 0x44bee2
mov eax, dword [esi + 0x40]
test eax, eax
je 0x44bed2
cmp word [eax], 0
je 0x44bed2
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x44bf1e
cmp dword [esi + 0x10], 0
je 0x44bf1e
mov dword [esp + 0x28], 1
jmp 0x44bf1e
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push 1
push 0
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x34]
mov ecx, esi
call eax
test eax, eax
je 0x44bf04
lea ebx, [esi + 0x14]
call fcn.0047d8c0
mov ecx, dword [esp + 0x2c]
push edi
push ecx
push 0x2a3
mov ecx, esi
call fcn.0048c330
mov dword [esp + 0x10], 1
xor eax, eax
cmp dword [esp + 0x28], eax
mov dword [ebp + 0x100], eax
je 0x44bf40
push 0x67
push esi
mov ebx, ebp
call fcn.0044b870
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
cmp dword [esp + 0x10], eax
je 0x44bf68
cmp dword [esp + 0x14], eax
je 0x44bf68
mov edx, dword [esp + 0x20]
cmp edx, dword [ebp + 0xfc]
jne 0x44bf5e
mov dword [ebp + 0xfc], eax
push 0x6a
push esi
mov ebx, ebp
call fcn.0044b870
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
Function at 0x44e860
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4d7eb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push edi
lea eax, [esp + 4]
push eax
call fcn.004034e0
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x16]
movzx eax, word [esp + 0x14]
movzx ecx, word [esp + 0x12]
push edx
movzx edx, word [esp + 0x14]
push eax
push ecx
push edx
push str.__02d__02d__02d__03d__n
lea edi, [esp + 0x18]
call fcn.004041b0
mov eax, dword [esp + 0x18]
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44e8f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop edi
add esp, 0x20
ret