joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420c8a
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
add eax, 0x80000002
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042212d
add esp, 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x420d7d
push 0
call fcn.00420e0f
add esp, 4
push 1
call fcn.00420e0f
add esp, 4
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x420d7d
mov eax, dword [ebp - 0xc]
push eax
call fcn.00410532
add esp, 4
cmp dword [ebp + 8], 0
je 0x420d73
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0
je 0x420d45
xor edx, edx
test edx, edx
je 0x420d45
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x14], ecx
jmp 0x420d4c
mov dword [ebp - 0x14], 0xffffffc1
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x14], eax
push 0
push 0xff
push 0
push 0
push 0x1de
push 0xffffffffffffffc1
mov ecx, dword [ebp + 8]
push ecx
call fcn.004105d0
add esp, 0x1c
mov eax, 1
jmp 0x420e0b
mov edx, dword [ebp - 0xc]
push edx
call fcn.00410532
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x420da5
cmp dword [ebp + 0x14], 0
jne 0x420db5
mov eax, dword [ebp + 0x10]
push eax
call fcn.00405b80
add esp, 4
test eax, eax
jne 0x420db5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x420dff
cmp dword [ebp + 0x14], 0
je 0x420dc3
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
jmp 0x420dd5
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00405b80
add esp, 4
add eax, 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x14]
neg ecx
sbb ecx, ecx
and ecx, 2
add ecx, 1
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043b18d
add esp, 0x18
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42af4d
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
push esi
push edi
mov byte [ebp - 0x404], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x403]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x80c], 0
mov dword [ebp - 0x808], 0
mov byte [ebp - 0x804], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x803]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0x400
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x50]
push ecx
push 0x490700
lea edx, [ebp - 0x404]
push edx
call fcn.00404911
add esp, 0xc
lea eax, [ebp - 0x80c]
push eax
push 0x20007
push 0
push 0x49070c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42b03e
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0
je 0x42afff
xor edx, edx
test edx, edx
je 0x42afff
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x810], ecx
jmp 0x42b009
mov dword [ebp - 0x810], 0xffffff86
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x810]
mov dword [edx + 0x14], eax
push 0
push 0xff
push 0
push 0
push 0x267
push 0xffffffffffffff86
mov ecx, dword [ebp + 8]
push ecx
call fcn.004105d0
add esp, 0x1c
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
jmp 0x42b15f
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x804]
push ecx
mov edx, dword [ebp - 0x808]
mov dword [ebp - 0x814], edx
mov eax, dword [ebp - 0x814]
push eax
mov ecx, dword [ebp - 0x80c]
push ecx
mov edx, dword [ebp - 0x808]
add edx, 1
mov dword [ebp - 0x808], edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x42b150
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x804], 0
lea ecx, [ebp - 0x404]
push ecx
call fcn.00405b80
add esp, 4
push eax
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x804]
push eax
call fcn.004047f0
add esp, 0xc
test eax, eax
jne 0x42b144
mov ecx, dword [ebp + 0xc]
add ecx, 4
push ecx
call fcn.00405b80
add esp, 4
push eax
mov edx, dword [ebp + 0xc]
add edx, 4
push edx
lea eax, [ebp - 0x804]
push eax
call fcn.00405b80
add esp, 4
mov esi, eax
mov ecx, dword [ebp + 0xc]
add ecx, 4
push ecx
call fcn.00405b80
add esp, 4
sub esi, eax
lea edx, [ebp + esi - 0x804]
push edx
call fcn.004047f0
add esp, 0xc
test eax, eax
jne 0x42b144
lea eax, [ebp - 0x804]
push eax
mov ecx, dword [ebp - 0x80c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.LM_BORROW
mov edx, dword [ebp - 0x80c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042b165
add esp, 8
mov dword [ebp - 4], 0x400
jmp 0x42b03e
mov edx, dword [ebp - 0x80c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42bed0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x490824
lea eax, [ebp - 0x14]
push eax
call fcn.0040c6a0
add esp, 8
mov dword [ebp - 0x24], 0
jmp 0x42bef9
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 3
jge 0x42bf1a
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x42bf10
jmp 0x42bf1a
mov al, byte [ebp - 0x14]
add al, 1
mov byte [ebp - 0x14], al
jmp 0x42bef0
push 0
push 0
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret

Function at 0x42cba9
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x48f100
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004513f0
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004515f9
add esp, 8
push 0x40
push 0x1000
mov edx, dword [ebp - 8]
add edx, 0xa
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42cbfd
xor eax, eax
jmp 0x42cc32
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00405170
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004059c0
add esp, 0xc
mov edx, dword [ebp - 0xc]
push edx
call fcn.00410532
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x43aed1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x43af12
cmp dword [ebp + 0x10], 0
je 0x43af12
cmp dword [ebp + 0x14], 0
je 0x43af12
cmp dword [ebp + 0x18], 0
jne 0x43af17
jmp 0x43aff6
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043a4d3
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43aff6
cmp dword [ebp - 0xc], 0
je 0x43aff6
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43aff6
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00410450
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43aff6
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43aff6
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 1
je 0x43afc8
mov edx, dword [ebp + 0x14]
cmp dword [edx], 2
jne 0x43afe1
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0043a82e
add esp, 0xc
mov dword [ebp - 8], eax
jmp 0x43aff6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
cmp dword [ebp - 0x10], 0
je 0x43b00f
mov eax, dword [ebp - 0x10]
push eax
call fcn.00410532
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x14], 0
je 0x43b028
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00410532
add esp, 4
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x43b02f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x43b070
cmp dword [ebp + 0x10], 0
je 0x43b070
cmp dword [ebp + 0x14], 0
je 0x43b070
cmp dword [ebp + 0x18], 0
jne 0x43b075
jmp 0x43b154
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043a6af
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43b154
cmp dword [ebp - 0xc], 0
je 0x43b154
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43b154
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00410450
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43b154
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43b154
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 1
je 0x43b126
mov edx, dword [ebp + 0x14]
cmp dword [edx], 2
jne 0x43b13f
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0043a758
add esp, 0xc
mov dword [ebp - 8], eax
jmp 0x43b154
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
cmp dword [ebp - 0x14], 0
je 0x43b16d
mov eax, dword [ebp - 0x14]
push eax
call fcn.00410532
add esp, 4
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x10], 0
je 0x43b186
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00410532
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x43b1f1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x43b22b
cmp dword [ebp + 0x10], 0
je 0x43b22b
cmp dword [ebp + 0x18], 0
je 0x43b22b
cmp dword [ebp + 0x1c], 0
jne 0x43b230
jmp 0x43b2ba
cmp dword [ebp + 0x14], 1
je 0x43b23c
cmp dword [ebp + 0x14], 2
jne 0x43b29b
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0043a4d3
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43b25b
jmp 0x43b2ba
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0043a4d3
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43b27a
jmp 0x43b2ba
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
jmp 0x43b2ba
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x10], 0
je 0x43b2d3
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00410532
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [ebp - 8], 0
je 0x43b2ec
mov edx, dword [ebp - 8]
push edx
call fcn.00410532
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x43b2f3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x43b32d
cmp dword [ebp + 0x10], 0
je 0x43b32d
cmp dword [ebp + 0x18], 0
je 0x43b32d
cmp dword [ebp + 0x1c], 0
jne 0x43b332
jmp 0x43b3c4
cmp dword [ebp + 0x14], 1
je 0x43b33e
cmp dword [ebp + 0x14], 2
jne 0x43b3a5
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0043a6af
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43b35d
jmp 0x43b3c4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0043a6af
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43b37c
jmp 0x43b3c4
mov eax, dword [ebp - 0xc]
shl eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
jmp 0x43b3c4
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x10], 0
je 0x43b3dd
mov edx, dword [ebp - 0x10]
push edx
call fcn.00410532
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [ebp - 8], 0
je 0x43b3f6
mov eax, dword [ebp - 8]
push eax
call fcn.00410532
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x43b449
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
je 0x43b483
cmp dword [ebp + 0xc], 0
jne 0x43b483
jmp 0x43b52b
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp dword [ebp - 0x10], 0
je 0x43b52b
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00410450
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43b52b
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43b52b
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0043a82e
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43b52b
cmp dword [ebp + 0x10], 0
je 0x43b525
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x10]
jle 0x43b4ff
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.004059c0
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00405170
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
cmp dword [ebp - 0xc], 0
je 0x43b544
mov edx, dword [ebp - 0xc]
push edx
call fcn.00410532
add esp, 4
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x43b55d
mov eax, dword [ebp - 0xc]
push eax
call fcn.00410532
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x43b564
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
je 0x43b59e
cmp dword [ebp + 0xc], 0
jne 0x43b59e
jmp 0x43b648
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [ebp - 0x10], 0
je 0x43b648
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00410450
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43b648
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43b648
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0043a758
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43b648
cmp dword [ebp + 0x10], 0
je 0x43b642
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x10]
jle 0x43b61c
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.004059c0
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00405170
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 0
je 0x43b661
mov edx, dword [ebp - 8]
push edx
call fcn.00410532
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
je 0x43b67a
mov eax, dword [ebp - 0xc]
push eax
call fcn.00410532
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x43b78a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0043a4d3
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43b890
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43b890
cmp dword [ebp + 0x14], 0
je 0x43b890
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00410450
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43b890
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43b890
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0043a82e
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43b877
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x14]
jle 0x43b858
mov ecx, dword [ebp + 0x14]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004046b0
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 0x10]
mov byte [edx], 0
jmp 0x43b890
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004059c0
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x43b8a9
mov edx, dword [ebp - 8]
push edx
call fcn.00410532
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x43b8c2
mov eax, dword [ebp - 4]
push eax
call fcn.00410532
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
je 0x43b8db
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00410532
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x43b8e2
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0043a6af
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43b9ea
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43b9ea
cmp dword [ebp + 0x14], 0
je 0x43b9ea
mov ecx, dword [ebp - 0x10]
shl ecx, 1
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00410450
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43b9ea
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43b9ea
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0043a758
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43b9d1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x14]
jle 0x43b9b2
mov ecx, dword [ebp + 0x14]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004046b0
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 0x10]
mov byte [edx], 0
jmp 0x43b9ea
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004059c0
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x43ba03
mov edx, dword [ebp - 8]
push edx
call fcn.00410532
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x43ba1c
mov eax, dword [ebp - 4]
push eax
call fcn.00410532
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
je 0x43ba35
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00410532
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret