joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f60b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push dword [ebp + 8]
call fcn.00424cbd
test eax, eax
jne 0x42f648
push 0x10
push 0x44e65c
push str.File_not_found
push dword [0x4fb1c0]
call fcn.0044757f
mov dword [0x4fb8cc], 1
xor eax, eax
jmp 0x42f86c
mov eax, dword [0x4fd630]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x42f661
push eax
call fcn.0043ffc9
pop ecx
mov dword [0x4fd630], ebx
push 0x4fd630
push dword [ebp + 8]
call fcn.004283eb
cmp eax, 0x64
jge 0x42f692
mov eax, dword [0x4fd630]
cmp eax, ebx
je 0x42f869
push eax
call fcn.0043ffc9
pop ecx
mov dword [0x4fd630], ebx
jmp 0x42f869
push str.Report
push ebx
push 0x7f02
call fcn.0042ee26
push dword [0x4fb1d8]
mov dword [0x4fb180], 1
call fcn.0042e4fa
push dword [0x4fb1e0]
call fcn.0042e4fa
push dword [0x4fb1c8]
push dword [0x4fd630]
call fcn.00447755
test eax, eax
je 0x42f863
push esi
push edi
xor eax, eax
push 0x3fe
mov word [ebp - 0x408], ax
lea eax, [ebp - 0x406]
push ebx
push eax
call fcn.0043fd94
add esp, 0xc
push 0x1ff
lea eax, [ebp - 0x408]
push eax
push dword [0x4fb1c0]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x42f769
mov esi, 0x44cf50
push esi
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp eax, ebx
je 0x42f733
xor ecx, ecx
mov word [eax], cx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x408]
push eax
call esi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x408]
push eax
call esi
lea eax, [ebp - 0x408]
push eax
push dword [0x4fb1c0]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [0x4fd618]
mov esi, dword [sym.imp.USER32.dll_UnregisterDeviceNotification]
cmp eax, ebx
je 0x42f77b
push eax
call esi
mov eax, dword [0x4fd61c]
mov dword [0x4fd618], ebx
cmp eax, ebx
je 0x42f78d
push eax
call esi
mov ecx, dword [0x4fd5c4]
mov dword [0x4fd61c], ebx
call fcn.004014d1
mov ecx, dword [0x4fd5c0]
call fcn.00406fe0
mov ecx, dword [0x4fd5bc]
call fcn.0040c69d
mov ecx, dword [0x4fd5c8]
call fcn.0043d73a
mov esi, dword [sym.imp.USER32.dll_GetMenu]
push ebx
push dword [0x4fb1c0]
call esi
mov edi, dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call edi
push 2
push dword [0x4fb1c0]
mov dword [ebp - 8], eax
call esi
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
push 1
push 0x9cae
push dword [ebp - 8]
mov dword [ebp - 4], eax
call esi
xor edi, edi
push 0x401
push edi
push dword [ebp - 4]
call esi
inc edi
cmp edi, 0xe
jl 0x42f7fe
push dword [0x4fab14]
push dword [0x4face4]
push dword [0x4fb0b8]
push dword [0x4fa570]
push str.Host_Controllers:__i____Root_Hubs:__i____Standard_Hubs:__i____Peripheral_Devices:__i
push ebx
push ebx
push dword [0x4fb8f0]
call fcn.00405677
add esp, 0x20
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push 0x454bc0
push ebx
push 1
push dword [0x4fb8f0]
call fcn.00405677
add esp, 0x14
xor eax, eax
pop edi
inc eax
pop esi
jmp 0x42f86b
mov dword [0x4fb180], ebx
xor eax, eax
pop ebx
leave
ret 4
Function at 0x42f963
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
xor edi, edi
push edi
push edi
push 0xce
push dword [0x4fb1cc]
call esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
push eax
push edi
push 0x4dd
push dword [0x4fb1cc]
call esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0xb0
push dword [0x4fb1cc]
call esi
push edi
push edi
push 0xb
push dword [0x4fb1cc]
call esi
mov ebx, 0x4fc398
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [0x4fb0b4]
push 0xffffffffffffffff
push edi
push dword [0x4fb1cc]
cmp eax, 2
jae 0x42f9e6
call fcn.00426a3d
jmp 0x42fb0b
call fcn.00426a3d
push dword [0x4fb1cc]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x42fb0b
xor eax, eax
push 0x7fe
mov word [ebp - 0x82c], ax
lea eax, [ebp - 0x82a]
push edi
push eax
call fcn.0043fd94
mov edi, dword [ebp - 4]
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043ff54
add esp, 0x10
inc edi
push edi
push eax
push dword [0x4fb1cc]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push ebx
push dword [ebp - 4]
jmp 0x42faef
mov edi, dword [ebp - 8]
sub edi, dword [ebp - 4]
push ebx
sar edi, 1
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push dword [0x4fb1cc]
add eax, edi
mov dword [ebp - 0x14], eax
call fcn.004269ca
push 0
push edi
push 0xc9
push dword [0x4fb1cc]
mov dword [ebp - 0x1c], eax
call esi
lea ecx, [ebp - 0x82c]
push ecx
push eax
push 0xc4
push dword [0x4fb1cc]
mov dword [ebp - 0x82c], 0x3ff
call esi
cmp eax, 1
jle 0x42fae7
push 0x3a
lea eax, [ebp - 0x82c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov ecx, eax
lea edx, [ebp - 0x82c]
sub eax, edx
sar eax, 1
neg ecx
sbb ecx, ecx
and ecx, eax
cmp dword [ebp - 0x1c], ecx
jle 0x42fae7
push dword [0x493a34]
push dword [ebp - 0x14]
push edi
push dword [0x4fb1cc]
call fcn.00426a3d
mov eax, dword [ebp - 8]
push ebx
add eax, 2
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x42fa55
push dword [ebp - 4]
call fcn.0043ffc9
pop ecx
xor edi, edi
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push 0xb1
push dword [0x4fb1cc]
call esi
push edi
push edi
push 0xce
push dword [0x4fb1cc]
call esi
mov ecx, dword [ebp - 0x10]
cmp ecx, eax
je 0x42fb45
sub ecx, eax
push ecx
push edi
push 0xb6
push dword [0x4fb1cc]
call esi
lea eax, [ebp - 0x2c]
push eax
push edi
push 0x4dd
push dword [0x4fb1cc]
call esi
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2c], eax
je 0x42fb77
movzx eax, ax
push edi
shl eax, 0x10
or eax, 4
push eax
push 0x114
push dword [0x4fb1cc]
call esi
push edi
push 1
push 0xb
push dword [0x4fb1cc]
call esi
push 5
push edi
push edi
push dword [0x4fb1cc]
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4336b6
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 4
pop ebx
cmp dword [0x507a24], ebx
jl 0x43371c
mov eax, edi
test edi, edi
jne 0x4336db
mov eax, 0x44aa5c
lea ecx, [esi + 0xcf6]
push ecx
push eax
push dword [esi + 0x81c]
push str.ChangeLeaf_name_s__text_s______s
push ebx
call fcn.00445f0b
add esp, 0x14
cmp dword [0x507a24], ebx
jl 0x43371c
push dword [esi + 8]
push dword [0x4fb1c8]
call fcn.0042fd9a
push eax
push str._currenttext_s
push ebx
call fcn.00445f0b
add esp, 0xc
push dword [esi + 8]
push dword [0x4fb1c8]
call fcn.00426830
test eax, eax
jne 0x433747
cmp dword [0x507a24], ebx
jl 0x433827
push dword [esi + 8]
push str._0x_08Ix_is_not_a_tree_item____abort
jmp 0x43381e
push 0x34
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.0043fd94
mov eax, dword [esi + 8]
mov dword [ebp - 0x34], eax
xor eax, eax
add esp, 0xc
test edi, edi
setne al
push esi
mov dword [ebp - 0x28], edi
or eax, 0x22
mov dword [ebp - 0x38], eax
call fcn.004330cd
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x38]
push eax
xor esi, esi
push esi
push 0x113f
push dword [0x4fb1c8]
mov dword [0x4fb1a0], esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x43380a
push dword [0x4fb1c8]
mov dword [0x4fb1a0], esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [ebp - 0x34]
cmp eax, dword [0x4fb8e4]
jne 0x433805
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x506bc0]
cmp eax, 0xbb8
jae 0x4337e7
push 0x4146be
push 0xa
push 0x12340005
push dword [0x4fb1c0]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4337fe
push dword [0x4fb8e4]
push dword [0x4fb1c8]
push dword [0x4fb1cc]
call fcn.00414562
call esi
mov dword [0x506bc0], eax
xor eax, eax
inc eax
jmp 0x433829
cmp dword [0x507a24], ebx
jl 0x433827
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._TreeView_SetItem_err_u
push ebx
call fcn.00445f0b
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x433b34
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push ebx
push esi
push edi
push str.Report
xor edi, edi
push edi
push 0x7f02
call fcn.0042ee26
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push edi
push eax
call fcn.0043fd94
xor eax, eax
push esi
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push edi
push eax
call fcn.0043fd94
xor eax, eax
push esi
mov word [ebp - 0x618], ax
lea eax, [ebp - 0x616]
push edi
push eax
call fcn.0043fd94
add esp, 0x24
push 0x4fa908
mov esi, 0x104
push esi
lea eax, [ebp - 0x410]
push eax
push 0x44ad64
mov ebx, str.ReportPath
push ebx
mov edi, 0x44e6b4
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00426293
test eax, eax
je 0x433c3c
lea eax, [ebp - 0x208]
push eax
call fcn.0042f60b
mov esi, eax
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.004284b7
push 0x4fa908
lea eax, [ebp - 0x208]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Report
push 0
push 0x7f00
call fcn.0042ee26
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
xor esi, esi
jmp 0x433c24
Function at 0x436495
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
push edi
push str.Report
xor edi, edi
push edi
push 0x7f02
call fcn.0042ee26
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.0043fd94
xor eax, eax
push esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push edi
push eax
call fcn.0043fd94
xor eax, eax
push esi
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push edi
push eax
call fcn.0043fd94
push 0x4fa600
lea eax, [ebp - 0x20c]
push str.UsbTreeView_report__s.txt
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x30
push 0x4fa908
mov esi, 0x104
push esi
lea eax, [ebp - 0x414]
push eax
push 0x44ad64
mov ebx, str.ReportPath
push ebx
mov edi, 0x44e6b4
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0042611f
test eax, eax
je 0x4365bf
push dword [0x4fb1c0]
call dword [sym.imp.USER32.dll_UpdateWindow]
lea eax, [ebp - 0x20c]
push eax
call fcn.004363e6
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x4365bf
lea ecx, [ebp - 0x20c]
cmp eax, ecx
jbe 0x4365bf
xor ecx, ecx
push 0x4fa908
mov word [eax - 2], cx
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Report
push 0
push 0x7f00
call fcn.0042ee26
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4365d8
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc18
push edi
push str.Report
xor edi, edi
push edi
push 0x7f02
call fcn.0042ee26
push dword [0x4fb8e4]
call fcn.0042ed1a
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x436622
push 0x40
push 0x44e65c
push str.No_device_selected
push dword [0x4fb1c0]
call fcn.0044757f
jmp 0x436801
push ebx
push esi
xor eax, eax
push 0x7fe
mov word [ebp - 0xc18], ax
lea eax, [ebp - 0xc16]
push edi
push eax
call fcn.0043fd94
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.0043fd94
xor eax, eax
push esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push edi
push eax
call fcn.0043fd94
add esp, 0x24
push 0x4fa908
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
push 0x44ad64
push str.DevReportPath
mov ebx, 0x44e6b4
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp word [ebp - 0x418], di
je 0x4366c9
push 0x5c
lea eax, [ebp - 0x210]
push eax
call fcn.00424af4
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0xfc0]
cmp eax, edi
je 0x4366ea
lea ecx, [eax + 0x1734]
cmp word [ecx], di
jne 0x4366e7
lea ecx, [eax + 0x1834]
push ecx
jmp 0x4366f0
push dword [ecx + 0x81c]
lea eax, [ebp - 0xc18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x20
lea eax, [ebp - 0xc18]
push eax
call fcn.004268ed
push str..txt
lea eax, [ebp - 0xc18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0xc18]
push eax
call fcn.0042611f
test eax, eax
je 0x4367ef
cmp dword [0x4fb180], edi
jne 0x436751
push edi
push fcn.0041442d
push dword [0x4fb8e4]
call fcn.0042ea62
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [0x4fb8e4]
mov dword [ebp - 4], edi
call fcn.00434436
mov esi, dword [ebp - 4]
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043ff54
pop ecx
push edi
xor ecx, ecx
mov dword [0x4fd638], eax
mov word [eax], cx
push 0x42f545
push dword [0x4fb8e4]
mov dword [0x4fd63c], esi
call fcn.0042ea62
lea eax, [ebp - 0xc18]
push eax
call fcn.0040cc06
push dword [0x4fd638]
call fcn.0043ffc9
pop ecx
lea eax, [ebp - 0xc18]
push eax
mov dword [0x4fd638], edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, edi
je 0x4367ef
xor ecx, ecx
push 0x4fa908
mov word [eax], cx
lea eax, [ebp - 0xc18]
push eax
push str.DevReportPath
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Report
push edi
push 0x7f00
call fcn.0042ee26
pop esi
pop ebx
pop edi
leave
ret
Function at 0x4369b8
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
push edi
push str.Report
xor edi, edi
push edi
push 0x7f02
call fcn.0042ee26
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.0043fd94
xor eax, eax
push esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push edi
push eax
call fcn.0043fd94
xor eax, eax
push esi
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push edi
push eax
call fcn.0043fd94
push 0x4fa600
lea eax, [ebp - 0x20c]
push str.UsbTreeView_report__s.xml
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x30
push 0x4fa908
mov esi, 0x104
push esi
lea eax, [ebp - 0x414]
push eax
push 0x44ad64
mov ebx, str.ReportPath
push ebx
mov edi, 0x44e6b4
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004261d9
test eax, eax
je 0x436af8
push dword [0x4fb1c0]
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.0040c9e2
push 0
call fcn.0040ca20
lea eax, [ebp - 0x20c]
push eax
call fcn.00436804
mov dword [ebp - 4], eax
call fcn.0040ca60
call fcn.0040ca01
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x436af8
lea ecx, [ebp - 0x20c]
cmp eax, ecx
jbe 0x436af8
xor ecx, ecx
push 0x4fa908
mov word [eax - 2], cx
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.Report
push 0
push 0x7f00
call fcn.0042ee26
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43d15a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe24
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
mov dword [ebp - 0xc], ecx
call fcn.0043fd94
add esp, 0xc
push 0x23
push 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 4], eax
test eax, eax
je 0x43d2ba
mov esi, 0x44b7cc
lea edi, [ebp - 0xa24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x3f6
xor esi, esi
lea eax, [ebp - 0xa1a]
push esi
push eax
call fcn.0043fd94
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0xa1c]
push eax
call ebx
lea eax, [ebp - 0xa24]
push eax
mov eax, dword [ebp - 4]
add eax, 2
push eax
push str.SystemCurrentControlSetControlDeviceClasses
lea eax, [ebp - 0xe24]
push 0x44b0bc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
lea eax, [ebp - 0xe24]
push eax
push 0x80000002
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43d2ba
cmp dword [ebp - 8], esi
je 0x43d2ba
and dword [ebp - 4], esi
mov edi, 0x104
push edi
lea eax, [ebp - 0x624]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x43d29d
cmp word [ebp - 0x624], 0x23
jne 0x43d28f
push 0x44b7c8
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x43d2a8
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x214]
push eax
call ebx
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
push 0x5c
pop eax
mov word [ebp - 0x214], ax
inc dword [ebp - 4]
push edi
lea eax, [ebp - 0x624]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call esi
test eax, eax
je 0x43d248
jmp 0x43d2b1
xor eax, eax
mov word [ebp - 0x214], ax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x44d748
lea edi, [ebp - 0x41c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1fe
lea eax, [ebp - 0x412]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0043fd94
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0x414]
push eax
call ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
lea eax, [ebp - 0x41c]
push eax
call fcn.004274e4
mov esi, dword [ebp - 0xc]
push dword [ebp + 0xc]
mov dword [esi], eax
call fcn.0042748c
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x43e275
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
test byte [0x506c28], 1
jne 0x43e29e
or dword [0x506c28], 1
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x506c24], eax
test byte [0x506c28], 2
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x43e2c8
or dword [0x506c28], 2
push str.GetModuleFileNameExW
push dword [0x506c24]
call esi
mov dword [0x506c20], eax
test byte [0x506c28], 4
jne 0x43e2ea
or dword [0x506c28], 4
push str.GetProcessImageFileNameW
push dword [0x506c24]
call esi
mov dword [0x506c1c], eax
test byte [0x506c28], 8
jne 0x43e312
or dword [0x506c28], 8
cmp dword [0x4fabc0], 6
sbb eax, eax
and eax, 0xfffff400
add eax, 0x1000
mov dword [0x506c18], eax
xor ebx, ebx
cmp dword [0x506c1c], ebx
jne 0x43e323
xor eax, eax
jmp 0x43e4be
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x43e31c
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0043fd94
xor eax, eax
push 0x246
mov word [ebp - 0x684], ax
lea eax, [ebp - 0x682]
push ebx
push eax
call fcn.0043fd94
push 0x228
lea eax, [ebp - 0x438]
push ebx
push eax
mov dword [ebp - 0x43c], 0x22c
call fcn.0043fd94
add esp, 0x24
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x43e4b2
push edi
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 0x434], 4
je 0x43e47d
push dword [ebp - 0x434]
mov eax, dword [0x506c18]
push ebx
or eax, 0x50
push eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x43e47d
xor eax, eax
mov word [ebp - 0x210], ax
mov word [ebp - 0x684], ax
push 0x124
lea eax, [ebp - 0x684]
push eax
push esi
call dword [0x506c1c]
push 0x104
lea eax, [ebp - 0x210]
push eax
push ebx
push esi
call dword [0x506c20]
test eax, eax
jne 0x43e426
push 0x104
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x684]
push eax
call fcn.00427950
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [ebp - 0x210]
push 0x44aed4
mov eax, esi
push eax
call fcn.0042580f
test eax, eax
je 0x43e44a
lea esi, [ebp - 0x208]
push dword [ebp + 8]
lea eax, [ebp - 0x684]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x43e47d
push esi
call fcn.0042748c
inc dword [ebp - 4]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x434]
mov dword [edi], eax
mov eax, dword [ebp - 4]
add edi, 0x10
cmp eax, dword [ebp + 0x10]
jge 0x43e496
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43e3a6
jmp 0x43e4b1
cmp dword [0x507a24], 5
jl 0x43e4b1
push dword [ebp - 4]
push str.max_number_of_processes_reached___i_____abort
push 5
call fcn.00445f0b
add esp, 0xc
pop edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc
Function at 0x43e4ca
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push 0x43e4c4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x43e522
push 0x32
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x43e514
and dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
jmp 0x43e524
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x100
jmp 0x43e524
xor eax, eax
pop esi
leave
ret 4

Function at 0x43e54f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x810
mov dword [ebp - 4], 0x102
call fcn.0043ff54
mov esi, eax
mov eax, dword [ebp + 8]
or dword [esi + 0x80c], 0xffffffff
pop ecx
mov dword [esi], eax
lea eax, [esi + 0xc]
mov dword [esi + 8], eax
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov word [esi + 4], ax
mov eax, 0x800
mov word [esi + 6], ax
lea eax, [ebp - 8]
push eax
xor edi, edi
push edi
push esi
push 0x43e529
push 0x10000
push edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, edi
jne 0x43e5c1
push esi
call fcn.0043ffc9
pop ecx
xor eax, eax
jmp 0x43e658
push dword [ebp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x43e63f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x80c]
mov dword [ebp - 4], eax
movzx eax, word [esi + 4]
cmp ax, di
je 0x43e655
mov ecx, dword [esi + 8]
cmp word [ecx], di
je 0x43e655
mov ebx, dword [ebp + 0x10]
movzx eax, ax
dec ebx
cmp eax, ebx
jge 0x43e5fd
mov ebx, eax
mov edi, dword [ebp + 0xc]
push ebx
push ecx
push edi
call fcn.0043fdfe
push esi
call fcn.0043ffc9
mov eax, ebx
xor ecx, ecx
shr eax, 1
add esp, 0x10
mov word [edi + eax*2], cx
cmp dword [ebp - 4], ecx
je 0x43e655
cmp dword [ebp - 4], 0xc000026e
jne 0x43e5ba
add ebx, 0xe
cmp ebx, dword [ebp + 0x10]
jge 0x43e655
push str.dismounted
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x43e655
push str.__timeout_
push 3
call fcn.00445f0b
pop ecx
pop ecx
push 0x79
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x43f694
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x43f6a6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x43f686
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
pop esi
pop ecx
ret