joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442f8a
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20c
mov eax, dword [0x46a010]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x2c]
add eax, 0x136c
push eax
call fcn.0043fe6c
mov esi, eax
test esi, esi
jne 0x443008
mov ecx, dword [0x46a020]
cmp ecx, 0x46a020
je 0x443182
test byte [ecx + 0x1c], 1
je 0x443182
cmp byte [ecx + 0x19], 2
jb 0x443182
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x407834
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x13
pop ecx
call fcn.004110b1
jmp 0x443182
push ecx
mov ecx, edi
call fcn.00450b99
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xc
call esi
push eax
push 0xb
call esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0x32d4
push 0x3382
push dword [edi + 4]
call esi
push eax
mov ecx, edi
call fcn.0045150b
mov eax, dword [edi + 0x2c]
add eax, 0x136c
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, 0x337c
lea ebx, [edi + 0x38]
push eax
mov dword [edi + 0x3c], eax
push dword [edi + 4]
call esi
mov dword [ebx], eax
mov eax, 0x337d
push eax
mov dword [edi + 0x450], eax
push dword [edi + 4]
call esi
mov dword [edi + 0x44c], eax
mov eax, 0x337e
push eax
mov dword [edi + 0x864], eax
push dword [edi + 4]
call esi
mov dword [edi + 0x860], eax
mov eax, 0x337f
push eax
mov dword [edi + 0xc78], eax
push dword [edi + 4]
call esi
mov dword [edi + 0xc74], eax
mov eax, 0x3380
push eax
mov dword [edi + 0x108c], eax
push dword [edi + 4]
call esi
mov dword [edi + 0x1088], eax
xor eax, eax
inc eax
push eax
push dword [edi + 0x3c]
mov dword [esp + 0x14], eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_CheckDlgButton]
and dword [edi + 0x14a0], 0
xor esi, esi
lea eax, [ebx + 0x14]
cmp dword [eax - 0xc], 0
je 0x4430f4
cmp esi, 5
jae 0x443108
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x443108
push 0
push dword [ebx]
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
inc esi
add ebx, 0x414
cmp esi, 5
jb 0x4430db
mov eax, dword [edi + 0x149c]
cmp eax, 5
jge 0x443133
imul eax, eax, 0x414
sub esp, 0x10
mov ecx, edi
push dword [eax + edi + 0x3c]
call fcn.004513e7
mov ecx, dword [edi + 0x2c]
lea eax, [esp + 0x10]
push 0x100
push eax
add ecx, 0x54
call fcn.004501ab
test eax, eax
js 0x443158
lea ecx, [esp + 0x10]
call fcn.0045b449
push eax
jmp 0x44315a
push 0
push 0x3381
mov ecx, edi
call fcn.00450bc7
push 2
push ecx
push dword [edi + 8]
mov ecx, edi
call fcn.00450bf5
push 9
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x214]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00468719
mov esp, ebp
pop ebp
ret
Function at 0x4457fd
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
je 0x445854
movzx eax, word [esi]
push 2
pop ecx
push 0x20
pop edi
push 0x22
pop edx
cmp ax, dx
jne 0x445835
add esi, ecx
movzx eax, word [esi]
test ax, ax
je 0x44582e
cmp ax, dx
jne 0x44581f
cmp word [esi], dx
jne 0x44584a
jmp 0x445848
cmp ax, di
jbe 0x44584a
add esi, ecx
cmp word [esi], di
ja 0x44583a
jmp 0x44584a
cmp ax, di
ja 0x44588a
add esi, ecx
movzx eax, word [esi]
test ax, ax
jne 0x445843
jmp 0x44588a
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x44588a
test byte [eax + 0x1c], 1
je 0x44588a
cmp byte [eax + 0x19], 2
jb 0x44588a
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x407ea8
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.004110b1
pop edi
mov eax, esi
pop esi
pop ecx
ret
Function at 0x445bb7
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x46a010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x407c7c
push 0x407c8c
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x214], ebx
test esi, esi
je 0x445c8b
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x214]
je 0x445c8b
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
jne 0x445c57
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x445c8b
test byte [eax + 0x1c], 8
je 0x445c8b
cmp byte [eax + 0x19], 2
jb 0x445c8b
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x407ea8
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x12
pop ecx
call fcn.004110b1
jmp 0x445c8b
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0x407cfc
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, esi
lea ecx, [ebp - 0x210]
call fcn.00445990
xor ebx, ebx
test eax, eax
setns bl
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00468719
mov esp, ebp
pop ebp
ret
Function at 0x449acf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, edx
mov edx, ecx
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push edi
test ecx, ecx
jne 0x449b29
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x449bbc
test byte [eax + 0x1c], 8
je 0x449bbc
cmp byte [eax + 0x19], 2
jb 0x449bbc
push 0x408520
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x21
jmp 0x449bb1
mov ebx, dword [ebp + 8]
mov dword [ecx], esi
test ebx, ebx
jne 0x449b59
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x449bbc
test byte [eax + 0x1c], 8
je 0x449bbc
cmp byte [eax + 0x19], 2
jb 0x449bbc
push 0x408538
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x22
jmp 0x449bb1
mov dword [ebx], esi
test eax, eax
jne 0x449b86
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x449bbc
test byte [eax + 0x1c], 8
je 0x449bbc
cmp byte [eax + 0x19], 2
jb 0x449bbc
push 0x408508
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x23
jmp 0x449bb1
mov dword [eax], esi
test edx, edx
jne 0x449bc6
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x449bbc
test byte [eax + 0x1c], 8
je 0x449bbc
cmp byte [eax + 0x19], 2
jb 0x449bbc
push 0x408558
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x24
mov edx, 0x408670
pop ecx
call fcn.004336e5
mov esi, 0x80070057
jmp 0x449c75
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x408568
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x449c35
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x449c22
test byte [eax + 0x1c], 1
je 0x449c22
cmp byte [eax + 0x19], 3
jb 0x449c22
push edi
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x408670
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x25
pop ecx
call fcn.00412c68
test edi, edi
jg 0x449c2a
mov esi, edi
jmp 0x449c75
movzx esi, di
or esi, 0x80070000
jmp 0x449c75
cmp dword [ebp - 8], esi
je 0x449c75
mov eax, dword [ebp - 0xc]
xor edi, edi
inc edi
mov dword [ebp - 4], 4
mov dword [eax], 2
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x40857c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x449c73
cmp dword [ebp - 8], esi
jne 0x449c75
mov dword [ebx], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x449c85
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push edi
test eax, eax
jne 0x449cd8
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x449d72
test byte [eax + 0x1c], 8
je 0x449d72
cmp byte [eax + 0x19], 2
jb 0x449d72
push 0x408520
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x26
jmp 0x449d67
mov ebx, dword [ebp + 0xc]
mov dword [eax], esi
test ebx, ebx
jne 0x449d0c
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x449d72
test byte [eax + 0x1c], 8
je 0x449d72
cmp byte [eax + 0x19], 2
jb 0x449d72
push 0x408538
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x27
jmp 0x449d67
mov dword [ebx], esi
test edx, edx
jne 0x449d39
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x449d72
test byte [eax + 0x1c], 8
je 0x449d72
cmp byte [eax + 0x19], 2
jb 0x449d72
push 0x4085a8
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x28
jmp 0x449d67
xor eax, eax
mov word [edx], ax
test ecx, ecx
jne 0x449d7c
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x449d72
test byte [eax + 0x1c], 8
je 0x449d72
cmp byte [eax + 0x19], 2
jb 0x449d72
push 0x408558
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x29
mov edx, 0x408670
pop ecx
call fcn.004336e5
mov esi, 0x80070057
jmp 0x449e5e
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
push edx
lea eax, [ebp + 0xc]
push eax
push esi
push 0x4085c4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x449deb
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x449dd8
test byte [eax + 0x1c], 1
je 0x449dd8
cmp byte [eax + 0x19], 3
jb 0x449dd8
push edi
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x408670
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2a
pop ecx
call fcn.00412c68
test edi, edi
jg 0x449de0
mov esi, edi
jmp 0x449e5e
movzx esi, di
or esi, 0x80070000
jmp 0x449e5e
xor edi, edi
inc edi
cmp dword [ebp + 0xc], edi
jne 0x449e24
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], 4
mov dword [eax], edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x4085d8
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x449e20
cmp dword [ebp - 8], esi
jne 0x449e5e
mov dword [ebx], edi
jmp 0x449e5e
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x449e5e
test byte [eax + 0x1c], 1
je 0x449e5e
cmp byte [eax + 0x19], 2
jb 0x449e5e
push esi
push ecx
call fcn.00411040
pop ecx
mov ecx, dword [0x46a020]
mov edx, 0x408670
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x2b
pop ecx
call fcn.00412c68
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x449e70
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, edx
mov edx, ecx
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push edi
test ecx, ecx
jne 0x449eca
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x449f65
test byte [eax + 0x1c], 8
je 0x449f65
cmp byte [eax + 0x19], 2
jb 0x449f65
push 0x408520
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2c
jmp 0x449f5a
mov ebx, dword [ebp + 8]
mov dword [ecx], esi
test ebx, ebx
jne 0x449efe
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x449f65
test byte [eax + 0x1c], 8
je 0x449f65
cmp byte [eax + 0x19], 2
jb 0x449f65
push 0x408538
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2d
jmp 0x449f5a
mov dword [ebx], esi
test eax, eax
jne 0x449f2b
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x449f65
test byte [eax + 0x1c], 8
je 0x449f65
cmp byte [eax + 0x19], 2
jb 0x449f65
push 0x408608
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2e
jmp 0x449f5a
mov dword [eax], 6
test edx, edx
jne 0x449f6f
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x449f65
test byte [eax + 0x1c], 8
je 0x449f65
cmp byte [eax + 0x19], 2
jb 0x449f65
push 0x408558
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2f
mov edx, 0x408670
pop ecx
call fcn.004336e5
mov esi, 0x80070057
jmp 0x44a018
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x408624
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x449fde
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x449fcb
test byte [eax + 0x1c], 1
je 0x449fcb
cmp byte [eax + 0x19], 3
jb 0x449fcb
push edi
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x408670
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x30
pop ecx
call fcn.00412c68
test edi, edi
jg 0x449fd3
mov esi, edi
jmp 0x44a018
movzx esi, di
or esi, 0x80070000
jmp 0x44a018
mov ecx, dword [ebp - 0xc]
xor edi, edi
mov eax, dword [ebp - 8]
inc edi
mov dword [ebp - 4], 4
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x40863c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a016
cmp dword [ebp - 8], esi
jne 0x44a018
mov dword [ebx], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44a2f3
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x46a010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x10c]
xor ebx, ebx
push eax
push 0x20019
push ebx
push 0x4086c4
push SysReAllocStringLen
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44a3b6
push edi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x110], 1
push eax
lea eax, [ebp - 0x108]
mov edi, 0x104
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x114], edi
push eax
push ebx
push ebx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44a3a5
cmp dword [ebp - 0x110], 2
lea eax, [ebp - 0x108]
mov byte [ebp - 5], bl
jne 0x44a396
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb ebx, ebx
inc ebx
jmp 0x44a3a5
push eax
mov ecx, esi
call fcn.0044a2af
xor ebx, ebx
test eax, eax
setns bl
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop edi
jmp 0x44a3b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00468719
mov esp, ebp
pop ebp
ret
Function at 0x44a727
Capabilities:
Encrypt data using dpapi

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x408724
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x44a7d3
push 0x40873c
push edi
call ebx
mov dword [esi + 0x30], eax
test eax, eax
jne 0x44a78e
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x44a78e
test byte [eax + 0x1c], 1
je 0x44a78e
cmp byte [eax + 0x19], 3
jb 0x44a78e
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x4088b8
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xf
pop ecx
call fcn.004110b1
push 0x408750
push edi
call ebx
mov dword [esi + 0x34], eax
test eax, eax
jne 0x44a7d3
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x44a7d3
test byte [eax + 0x1c], 1
je 0x44a7d3
cmp byte [eax + 0x19], 3
jb 0x44a7d3
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x4088b8
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x10
pop ecx
call fcn.004110b1
xor eax, eax
cmp dword [esi + 0x30], eax
je 0x44a7e3
cmp dword [esi + 0x34], eax
jne 0x44a89f
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
test edi, edi
je 0x44a7f4
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x4019c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x44a893
push 0x408768
push edi
call ebx
mov dword [esi + 0x28], eax
test eax, eax
jne 0x44a84e
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x44a84e
test byte [eax + 0x1c], 1
je 0x44a84e
cmp byte [eax + 0x19], 3
jb 0x44a84e
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x4088b8
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x11
pop ecx
call fcn.004110b1
push 0x40877c
push edi
call ebx
mov dword [esi + 0x2c], eax
test eax, eax
jne 0x44a893
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x44a893
test byte [eax + 0x1c], 1
je 0x44a893
cmp byte [eax + 0x19], 3
jb 0x44a893
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x4088b8
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x12
pop ecx
call fcn.004110b1
xor eax, eax
cmp dword [esi + 0x28], eax
je 0x44a8ab
cmp dword [esi + 0x2c], eax
je 0x44a8ab
mov dword [esi + 0x38], 1
mov dword [esi + 0x3c], edi
jmp 0x44a8bc
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
test edi, edi
je 0x44a8bc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 0x38]
pop edi
pop esi
pop ebx
ret
Function at 0x44b0b3
Capabilities:
Prompt user for credentials

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 8], edx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ecx, ecx
je 0x44b1d6
cmp dword [ebp + 0x18], edx
je 0x44b1d6
mov edi, dword [ebp + 0x24]
test edi, edi
je 0x44b1d6
mov ebx, dword [ebp + 0x28]
test ebx, ebx
je 0x44b1d6
test byte [ebp + 0x20], 2
lea eax, [ecx + 4]
mov dword [ebp - 0x14], eax
lea eax, [ecx + 0x104]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
mov dword [edi], edx
mov dword [ebx], edx
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], eax
je 0x44b17f
lea eax, [ebp - 0xc]
push eax
push ecx
call fcn.0044b603
test eax, eax
jns 0x44b177
mov ecx, dword [0x46a020]
cmp ecx, 0x46a020
je 0x44b170
test byte [ecx + 0x1c], 8
je 0x44b170
cmp byte [ecx + 0x19], 2
jb 0x44b170
push eax
push 0x4087ec
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x4088b8
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x26
pop ecx
call fcn.00410eec
push 5
jmp 0x44b20e
mov eax, dword [ebp + 0x1c]
or eax, 0x10
jmp 0x44b182
mov eax, dword [ebp + 0x1c]
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.credui.dll_CredUIPromptForWindowsCredentialsW]
mov esi, eax
test esi, esi
jne 0x44b20f
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [edi], eax
test eax, eax
jne 0x44b1c0
push 8
jmp 0x44b20e
push dword [ebp - 4]
push dword [ebp - 8]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [ebx], eax
jmp 0x44b20f
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x44b20c
test byte [eax + 0x1c], 1
je 0x44b20c
cmp byte [eax + 0x19], 2
jb 0x44b20c
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x4088b8
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x25
pop ecx
call fcn.004110b1
push 0x57
pop esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x44b22d
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x44b224
mov byte [eax], 0
inc eax
dec ecx
jne 0x44b21d
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x44d92c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x46a010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push edx
push 0x408b10
mov ebx, 0x109
lea eax, [ebp - 0x220]
push ebx
xor esi, esi
mov edi, ecx
push eax
mov dword [ebp - 0x43c], esi
call fcn.004145d2
lea ecx, [ebp - 0x220]
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x44d972
sub ecx, edx
sar ecx, 1
je 0x44d998
cmp word [ebp + ecx*2 - 0x222], 0x5c
jne 0x44d998
xor eax, eax
mov word [ebp + ecx*2 - 0x222], ax
lea eax, [ebp - 0x43c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x220]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test ecx, ecx
je 0x44da03
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x44dad4
test byte [eax + 0x1c], 1
je 0x44dad4
cmp byte [eax + 0x19], 4
jb 0x44dad4
push ecx
lea eax, [ebp - 0x220]
push eax
call fcn.00411040
push eax
mov eax, dword [0x46a020]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.0044d6ec
jmp 0x44dad4
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x440]
mov dword [ebp - 0x440], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, esi
push eax
lea eax, [ebp - 0x438]
push eax
push esi
jmp 0x44da7c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x438]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44da55
test dx, dx
je 0x44da51
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44da55
add eax, 4
add ecx, 4
test dx, dx
jne 0x44da2f
mov eax, esi
jmp 0x44da5a
sbb eax, eax
or eax, 1
test eax, eax
je 0x44da8a
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x440]
mov dword [ebp - 0x440], 0x109
push eax
lea eax, [ebp - 0x438]
inc edi
push eax
push edi
push dword [ebp - 0x43c]
call ebx
test eax, eax
je 0x44da26
jmp 0x44da8d
xor esi, esi
inc esi
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
test ecx, ecx
je 0x44dad4
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x44dad4
test byte [eax + 0x1c], 1
je 0x44dad4
cmp byte [eax + 0x19], 2
jb 0x44dad4
push ecx
push ecx
call fcn.00411040
pop ecx
mov ecx, dword [0x46a020]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xb
pop ecx
call fcn.0044d6b9
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468719
mov esp, ebp
pop ebp
ret 4