joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44cf80
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x50c8ff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x543c98]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x44cfeb
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x44cfed
mov esi, edi
test esi, esi
je 0x44d0b7
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44d0ac
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x44d02f
cmp eax, 2
je 0x44d02f
cmp eax, 6
je 0x44d02f
cmp eax, 7
jne 0x44d0ac
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.004eae0a
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
jne 0x44d092
lea ecx, [esp + 0x14]
call fcn.004ea8d8
cmp esi, dword [esp + 0x14]
je 0x44d087
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.004eae33
add esp, 4
jmp 0x44d0c9
call fcn.004eae33
add esp, 4
lea ecx, [esp + 0x10]
push 0x556998
call fcn.004ea8d8
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x44d0b7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x44d0c9
push eax
lea ecx, [esp + 0x14]
call fcn.004ea8d8
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.004ea4ae
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.004ea741
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x44d210
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
je 0x44d247
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
or edx, 0x20019
push ecx
push edx
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x44d24a
mov esi, dword [ebp + 8]
test esi, esi
je 0x44d3fd
call fcn.00481ac0
test eax, eax
je 0x44d2f5
mov eax, dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 0x14]
push 0
push edx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44d3f1
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x44d299
cmp eax, 2
je 0x44d299
cmp eax, 6
je 0x44d299
cmp eax, 7
jne 0x44d3f1
mov ecx, dword [ebp + 0xc]
add ecx, 2
push ecx
call fcn.004eae0a
mov edx, dword [ebp + 0xc]
mov ebx, eax
xor eax, eax
mov edi, ebx
lea ecx, [edx + 2]
add esp, 4
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebx
jne 0x44d3dc
mov ecx, dword [ebp + 0x18]
call fcn.00455b00
cmp esi, dword [ebp + 8]
je 0x44d3c6
jmp 0x44d3bf
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x44d301
mov dword [ebp + 0x10], eax
jmp 0x44d336
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.00435360
mov edx, dword [ebp + 0x10]
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push edx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp + 0x10], edi
mov edx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp + 0x14]
push 0
push ecx
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44d3f1
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x44d370
cmp eax, 2
je 0x44d370
cmp eax, 6
je 0x44d370
cmp eax, 7
jne 0x44d3f1
mov eax, dword [ebp + 0xc]
add eax, 2
push eax
call fcn.004eae0a
mov ecx, dword [ebp + 0xc]
mov ebx, eax
add ecx, 2
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 4
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebx
jne 0x44d3dc
mov ecx, dword [ebp + 0x18]
call fcn.00455bd0
cmp esi, dword [ebp + 8]
je 0x44d3c6
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.004eae33
add esp, 4
mov eax, 1
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.004eae33
mov ecx, dword [ebp + 0x18]
add esp, 4
push 0x556998
call fcn.00455b00
cmp esi, dword [ebp + 8]
je 0x44d3fd
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x44dcf0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x44dd1c
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push edx
push 3
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x44dd1c
mov eax, 1
ret 0xc
xor eax, eax
ret 0xc

Function at 0x44ddd0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [ecx]
test esi, esi
je 0x44de09
push edi
mov edi, dword [esp + 0x10]
push edi
call fcn.0043533b
mov ecx, dword [esp + 0x10]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop edi
jne 0x44de09
mov eax, 1
pop esi
ret 8
xor eax, eax
pop esi
ret 8

Function at 0x44de40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50c9c8
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x44de96
lea ecx, [ebp + 0x14]
mov ebx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x14]
lea edx, [ebp + 0xc]
or ecx, 0x20006
push edx
push 0
push ecx
push 0
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x44de9b
mov esi, dword [ebp + 8]
mov ebx, esi
test esi, esi
je 0x44df8a
call fcn.00481ac0
test eax, eax
je 0x44deea
mov edi, dword [ebp + 0x18]
push edi
call fcn.0043533b
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [ebp + 0x10]
push edx
push edi
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x44df7f
cmp esi, ebx
je 0x44dee0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x44df8c
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x44def5
xor edi, edi
jmp 0x44df2a
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.00435360
mov ecx, dword [ebp + 0x10]
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0xc]
push edx
call fcn.0044f880
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x44df70
cmp esi, ebx
je 0x44df5a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.00450090
mov eax, 1
jmp 0x44df8c
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.00450090
cmp esi, ebx
je 0x44df8a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44eac0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [ecx]
mov ecx, dword [esp + 0x18]
push esi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
call fcn.004e7b60
cmp ebp, ebx
je 0x44ebaf
push ebx
push ebx
lea eax, [esp + 0x14]
push ebx
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebp
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x44ebaf
cmp dword [esp + 0x10], ebx
jbe 0x44ebaf
mov edx, dword [esp + 0xc]
lea eax, [edx + edx]
cmp eax, 0x104
ja 0x44eb25
mov eax, 0x104
mov dword [esp + 0xc], eax
lea eax, [eax + eax + 2]
push eax
call fcn.004eae0a
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x44ebaf
cmp dword [esp + 0x10], ebx
jbe 0x44eb98
push edi
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edi, esi
push 0
lea ecx, [ecx + ecx + 2]
push 0
mov edx, ecx
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x28]
push ecx
push esi
inc eax
push ebx
push ebp
mov dword [esp + 0x38], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x44eb8e
mov ecx, dword [esp + 0x20]
push esi
mov edx, dword [ecx + 8]
push edx
call fcn.004e7d76
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, eax
jb 0x44eb43
pop edi
push esi
call fcn.004eae33
add esp, 4
mov eax, 1
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
Function at 0x44ec90
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 8
lea eax, [esp + 0xc]
lea ecx, [esp]
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x44ee0d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x44edec
mov eax, dword [esp + 0x1c]
cmp eax, 0x104
jae 0x44ece6
mov eax, 0x104
mov dword [esp + 0x1c], eax
lea edx, [eax + eax + 2]
push edx
call fcn.004eae0a
mov esi, eax
add esp, 4
test esi, esi
je 0x44ee0d
mov eax, dword [esp + 0x1c]
mov edi, esi
lea ecx, [eax + eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x44ee04
mov ebp, dword [esp + 0x20]
mov eax, ebp
or eax, 0x2001f
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
push ecx
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44ee04
mov edi, dword [esp + 0x20]
test edi, edi
je 0x44ee04
push ebp
push edi
call fcn.0044ec90
add esp, 8
test eax, eax
je 0x44edf9
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x55b97c]
test eax, eax
je 0x44ed95
test ebp, ebp
je 0x44ed95
push 0
push ebp
push esi
push ebx
call eax
test eax, eax
jne 0x44ee04
jmp 0x44eda1
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x44ee04
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
je 0x44ede3
mov edx, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
lea ecx, [edx + edx + 2]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x44ee04
mov eax, dword [esp + 0x14]
jmp 0x44ed3e
push esi
call fcn.004eae33
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
test edi, edi
je 0x44ee04
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.004eae33
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret

Function at 0x44f1f0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x44f240
lea eax, [esi + 4]
push eax
push 4
push esi
push 0x44f410
push 0
push 0
call fcn.00436528
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x44f240
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x44f22f
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x44f290
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x44f2a4
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 8]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 8]
push 0
push ecx
push 2
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esi + 8]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x44f2f1
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push ecx
call edi
mov edx, dword [esi + 0x14]
push edx
call edi
mov dword [esi + 0xc], 0
pop edi
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x453d10
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, eax
push esi
mov esi, dword [esp + 0x10]
and ebp, 0xf
shr eax, 4
inc eax
push edi
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x453d69
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x453d69
xor edi, edi
xor ebx, ebx
mov bx, word [esi]
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebp, edi
je 0x453d70
inc edi
lea esi, [esi + ebx*2]
cmp edi, 0x10
jl 0x453d4d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, ecx
xor eax, eax
mov edi, ebp
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
dec eax
push eax
push ebp
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x453d6b
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x459840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x459890
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x459890
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x459895
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x45987b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x4598a2
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x465b50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x50d4bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x543c98]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 8]
mov dword [edi], eax
mov ecx, dword [0x543c98]
lea ebp, [esi + 0x18]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [ebp], ecx
mov edx, dword [0x543c98]
mov dword [esi + 0x20], edx
lea ecx, [esi + 0x28]
mov byte [esp + 0x1c], 2
call fcn.004e8042
mov eax, dword [esp + 0x24]
mov ecx, edi
push eax
mov byte [esp + 0x20], 3
mov dword [esi], 0x51afc4
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
mov word [esi + 0x24], 0xffff
call fcn.004ea8d8
mov eax, dword [esp + 0x28]
mov cx, word [esp + 0x30]
test eax, 0xffff0000
mov word [esi + 0x24], cx
mov dword [esi + 0x14], eax
je 0x465bf3
push eax
mov ecx, ebp
call fcn.004ea8d8
mov edx, dword [ebp]
mov dword [esi + 0x14], edx
mov eax, dword [esp + 0x2c]
test eax, 0xffff0000
mov dword [esi + 0x1c], eax
je 0x465c11
lea edi, [esi + 0x20]
push eax
mov ecx, edi
call fcn.004ea8d8
mov eax, dword [edi]
mov dword [esi + 0x1c], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x469670
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51b010
push 0x43a0c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edx
je 0x469702
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x4696fb
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x4696fb
cmp word [eax + 0x14], dx
je 0x4696fb
cmp dword [ebp + 0xc], edx
je 0x4696d5
cmp word [eax + 4], 0x14c
jne 0x4696fb
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4697f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
je 0x46983d
mov edi, dword [esp + 0x18]
test edi, edi
je 0x46983d
mov eax, dword [ebx + 0x3c]
xor ecx, ecx
add eax, ebx
xor edx, edx
mov cx, word [eax + 0x14]
mov dx, word [eax + 6]
lea esi, [ecx + eax + 0x18]
xor ecx, ecx
test edx, edx
mov dword [esp + 0x14], esi
jbe 0x46983d
lea eax, [esi + 0x10]
mov esi, dword [eax - 4]
cmp edi, esi
jb 0x469835
mov ebp, dword [eax]
add ebp, esi
cmp edi, ebp
jb 0x469844
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x469826
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x14]
lea edx, [ecx + ecx*4]
mov esi, dword [eax + edx*8 + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [eax + edx*8 + 0x14]
sub eax, esi
add eax, ebx
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x46a110
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51b020
push 0x43a0c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
mov edi, dword [ebp + 0x14]
push edi
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00469890
add esp, 0x10
mov esi, eax
cmp esi, ebx
je 0x46a1c3
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 0x20]
push eax
call edi
add esp, 8
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 0x10]
sub edi, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x30]
push ecx
push 0x40
push 4
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
test eax, eax
je 0x46a1bc
mov dword [esi], edi
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x30]
push eax
push 4
push esi
call ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46eea0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, eax
shr eax, 4
and esi, 0xf
inc eax
push edi
mov edi, dword [esp + 0xc]
and eax, 0xffff
push ecx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x46eeee
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x46eeee
xor edx, edx
xor ecx, ecx
mov cx, word [eax]
add eax, 2
cmp esi, edx
je 0x46eef3
inc edx
lea eax, [eax + ecx*2]
cmp edx, 0x10
jl 0x46eed9
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x46ef03
test esi, esi
jne 0x46ef21
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x46ef1f
mov byte [eax + esi - 1], 0
jne 0x46ef28
mov byte [esi + edi - 1], 0
mov eax, edi
pop edi
dec eax
pop esi
ret
Function at 0x474610
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x474660
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x474660
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x474665
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x47464b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x474672
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret

Function at 0x479ee0
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x55bd58]
sub esp, 0x114
test eax, eax
jne 0x47a02d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push edi
push 0x55baf0
mov dword [0x55bd58], 1
mov dword [0x55baf0], 0x114
call esi
mov edx, dword [0x55bb00]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x548af0], eax
je 0x47a008
push ebx
push 0x55bc08
mov dword [0x55bc08], 0x11c
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x53ed9c
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x55bd4c], eax
call edi
mov dword [0x55bd50], eax
mov eax, dword [0x55bd4c]
test eax, eax
push 0x55bd28
je 0x479f84
call eax
jmp 0x479f8a
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x55bc0c]
cmp eax, 6
jae 0x479fa2
cmp eax, 5
jne 0x479fb6
cmp dword [0x55bc10], 2
jb 0x479fb6
cmp word [0x55bd28], 9
jne 0x479fb6
mov dword [0x55bae4], 1
push str.Ntdll.dll
call ebx
test eax, eax
pop ebx
je 0x479fd4
push str.RtlGetVersion
push eax
call edi
mov edx, eax
mov dword [0x55bd54], edx
jmp 0x479fda
mov edx, dword [0x55bd54]
test edx, edx
je 0x47a008
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x114
push eax
call edx
test eax, eax
jne 0x47a008
mov ecx, dword [esp + 0x14]
mov dword [0x55bafc], ecx
push 0x55baf8
push 0x55baf4
call fcn.0047a3d0
add esp, 8
call fcn.0047a040
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
mov eax, 1
add esp, 0x114
ret