joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402120
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x18]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40908c
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call eax
sub esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40223a
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x1c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x20]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40909e
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call eax
sub esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40223d
cmp dword [ebp - 0x10], 2
jne 0x402240
mov dword [esp], 4
call fcn.00402d14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402243
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00401ee9
mov edx, eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40909e
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call eax
sub esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x402246
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
jmp 0x402247
nop
jmp 0x402247
nop
jmp 0x402247
nop
jmp 0x402247
nop
jmp 0x402247
nop
cmp dword [ebp - 0xc], 0
je 0x402258
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00401e9b
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40226f
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, dword [ebp - 0x20]
leave
ret
Function at 0x4024b9
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 5
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jne 0x402505
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
jmp 0x402508
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x18]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x28
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call eax
sub esp, 0xc
test eax, eax
jne 0x402544
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 5
jne 0x402603
mov dword [ebp - 0xc], 1
jmp 0x40260d
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x20]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x4c
lea edx, [ebp - 0x6c]
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call eax
sub esp, 0x14
test eax, eax
je 0x402606
lea eax, [ebp - 0x1c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x12
mov dword [esp + 4], 1
lea eax, [ebp - 0x12]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call eax
sub esp, 0x2c
test eax, eax
je 0x402609
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x6c]
mov eax, dword [eax]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_EqualSid]
call eax
sub esp, 8
test eax, eax
je 0x40260c
mov dword [ebp - 0xc], 1
jmp 0x40260d
nop
jmp 0x40260d
nop
jmp 0x40260d
nop
jmp 0x40260d
nop
mov eax, dword [ebp - 0x18]
cmp eax, 0xffffffff
je 0x402625
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40263c
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_FreeSid]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x402641
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0xc], 0
je 0x40275c
cmp dword [ebp + 0x10], 0
je 0x40275c
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov ebx, eax
cmp dword [ebp + 8], 0
jne 0x402699
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call eax
sub esp, 4
jmp 0x40269c
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindResourceW]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40275f
cmp dword [ebp + 8], 0
jne 0x4026da
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call eax
sub esp, 4
jmp 0x4026dd
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadResource]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402762
cmp dword [ebp + 8], 0
jne 0x402713
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call eax
sub esp, 4
jmp 0x402716
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SizeofResource]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x402765
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LockResource]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402768
cmp dword [ebp + 0x14], 0
je 0x40275c
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
jmp 0x402769
nop
jmp 0x402769
nop
jmp 0x402769
nop
jmp 0x402769
nop
jmp 0x402769
nop
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4029e3
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
je 0x402afc
mov eax, dword [ebp + 8]
movzx eax, word [eax]
test ax, ax
je 0x402aff
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileW]
call eax
sub esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x402b02
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSize]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
je 0x402b05
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.00401de8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402b08
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
test eax, eax
jne 0x402aec
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00401e9b
test eax, eax
je 0x402b0b
mov dword [ebp - 0x10], 0
jmp 0x402b0b
cmp dword [ebp + 0xc], 0
je 0x402b0e
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x402b0f
nop
jmp 0x402b0f
nop
jmp 0x402b0f
nop
jmp 0x402b0f
nop
jmp 0x402b0f
nop
jmp 0x402b0f
nop
jmp 0x402b0f
nop
cmp dword [ebp - 0xc], 0xffffffff
je 0x402b25
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x402c52
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jae 0x402ce9
mov dword [esp + 0x10], 0xf0000040
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
call eax
sub esp, 0x14
test eax, eax
je 0x402cec
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
mov dword [esp + 8], edx
mov dword [esp + 4], 4
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
call eax
sub esp, 0xc
test eax, eax
je 0x402cef
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea ecx, [edx + 1]
mov edx, 0
div ecx
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
jmp 0x402cf0
nop
jmp 0x402cf0
nop
jmp 0x402cf0
nop
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x402d0f
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x402d14
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x402dbc
mov dword [esp + 0x10], 0xf0000040
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
call eax
sub esp, 0x14
test eax, eax
je 0x402dbf
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.00401de8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402dc2
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
call eax
sub esp, 0xc
test eax, eax
jne 0x402dc5
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00401e9b
test eax, eax
je 0x402dc8
mov dword [ebp - 0xc], 0
jmp 0x402dc8
nop
jmp 0x402dc9
nop
jmp 0x402dc9
nop
jmp 0x402dc9
nop
jmp 0x402dc9
nop
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x402de8
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x42ce20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 4]
mov dword [esp + 4], eax
jmp fcn.0045c4ae

Function at 0x42d140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push edi
mov edi, dword [esp + 0x14]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
test ebp, ebp
jne 0x42d168
pop edi
pop ebp
pop ebx
ret
push esi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x42d17e
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x42d175
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x42d1b2
nop dword [eax + eax]
cmp esi, ecx
jae 0x42d175
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x42d1a0
cmp esi, ecx
jae 0x42d175
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
ret

Function at 0x42d260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [esp + 0x10]
mov ebp, ecx
push edi
call fcn.0045bb73
mov ebx, eax
test ebx, ebx
jne 0x42d27b
pop edi
pop ebp
pop ebx
ret 4
mov eax, edi
shr eax, 4
push esi
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x42d343
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42d343
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x42d343
push dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x42d2e2
nop
cmp esi, ecx
jae 0x42d343
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x42d2d0
cmp esi, ecx
jae 0x42d343
cmp word [esi], 0
je 0x42d343
mov eax, dword [ebp]
mov ecx, 1
movzx edi, word [esi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x42d30b
push edi
mov ecx, ebp
call fcn.0042d4e0
movzx ecx, word [esi]
lea eax, [esi + 2]
push ecx
push eax
push edi
push dword [ebp]
call fcn.0047bacc
push eax
call fcn.0042d1d0
mov eax, dword [ebp]
add esp, 0x14
cmp edi, dword [eax - 8]
jg 0x42d34c
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebp]
pop esi
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop ebp
pop ebx
ret 4
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
ret 4
push 0x80070057
call fcn.0042d860
int3
Function at 0x441c80
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e816
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x5025d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.0045b674
mov ecx, eax
test ecx, ecx
je 0x441d92
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, 0x4b5248
mov dword [ebp - 4], 1
mov ecx, esi
test eax, 0xffff0000
jne 0x441cf2
movzx eax, ax
push eax
call fcn.0042d260
jmp 0x441cfe
push 0
push 0x4b5248
call fcn.0042d630
mov dword [ebp - 4], 0
mov ecx, 1
mov dword [ebp - 0x14], 0x101
mov eax, dword [esi]
mov dword [ebp - 0x10], 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x101
or eax, ecx
jge 0x441d35
push 0x101
mov ecx, esi
call fcn.0042d4e0
lea eax, [ebp - 0x14]
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [ebp - 4], 2
mov eax, dword [esi]
test eax, eax
jne 0x441d52
xor ecx, ecx
jmp 0x441d64
push dword [eax - 8]
push eax
call fcn.0047d596
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x441d88
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x441d88
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.0042d860
push 0x80004005
call fcn.0042d860
int3
Function at 0x45c418
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x45c460
call fcn.00468e89
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x45c460
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x45c46d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x45c4a9
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x45c48c
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x45c495
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x45c4a7
test di, di
jne 0x45c4a7
test dx, dx
je 0x45c4a9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45c802
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x4a7f75
call fcn.00476d6d
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.00468e89
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x45c861
call fcn.00468e89
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x45c875
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x45c871
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x45c87d
or eax, 0xffffffff
jmp 0x45c9cf
mov ecx, edi
call fcn.0045ce0d
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.0045e0ca
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x45c909
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x45c909
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x45c909
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.0045c382
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x45c906
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [0x4ab540]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x45c906
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.0045d25d
test eax, eax
je 0x45c906
push 0
mov ecx, esi
call fcn.0045d081
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.0045df1b
push ebx
call fcn.0045f400
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.0045c7a5
test eax, eax
jne 0x45c952
cmp dword [edi + 0x9c], eax
jne 0x45c952
call fcn.00468e89
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.0045f400
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.0045c7a5
and dword [edi + 0x9c], 0
jmp 0x45c97d
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x45c991
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.0045d081
test esi, esi
je 0x45c99e
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x45c9b4
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x45c9b4
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x4ab540]
mov ecx, edi
call esi
mov ecx, edi
call fcn.0045cdc4
mov eax, dword [edi + 0x68]
call fcn.00476cd2
ret
Function at 0x45f393
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x45f3d2
call fcn.00468e89
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x45f3d2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45f3da
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.0045ae44
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x45fa2f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x45fabb
cmp dword [esi + 0x20], 0
je 0x45fabb
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45fabb
cmp dword [ebp + 8], 0
je 0x45fabb
xor edi, edi
mov ebx, edi
call fcn.00468e89
push 0x4acc88
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x45fa9f
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45fabb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.0046ede5
mov edi, eax
add esp, 0xc
test edi, edi
je 0x45fab7
mov ecx, esi
call fcn.0045f809
mov eax, edi
jmp 0x45fabd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x467c17
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x4a8510
call fcn.00476d04
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x467cbf
push dword [ebp + 8]
call fcn.00467f42
mov dword [ebp - 0x10], eax
test eax, eax
je 0x467d51
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x467ca8
push ecx
call fcn.0046b913
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x467ca8
xor edi, edi
inc edi
jmp 0x467cb2
push dword [ebx]
call fcn.0046b91c
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.00467b3c
jmp 0x467d4f
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [0x4ab540]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x467d47
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.0046b913
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x467d41
mov esi, dword [ebp + 0x10]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
push ecx
lea ecx, [ebp - 0x10]
call fcn.00467b18
lea ecx, [edi + edi]
mov bl, al
push ecx
lea ecx, [ebp - 0x10]
call fcn.00467b18
mov ecx, dword [esi]
shl bl, 4
sub bl, 0x51
add al, bl
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x18]
add ecx, 2
mov dword [ebp - 0x18], ecx
cmp edi, dword [eax]
jb 0x467d0c
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.0042d8b0
mov eax, edi
call fcn.00476cd2
ret 0x10

Function at 0x467d59
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x467dac
push esi
push dword [ebp + 8]
call fcn.00467f42
mov edi, eax
test edi, edi
je 0x467da7
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x467da7
mov eax, dword [ebp - 8]
jmp 0x467dbe
mov eax, dword [ebp + 0x10]
jmp 0x467dbe
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc