joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449ab0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [0x530df4]
mov esi, ecx
cmp edi, 1
ja 0x449b1a
push 0x530df4
call fcn.00435680
add esp, 4
test al, al
je 0x449b14
mov edi, 0x530df8
mov dword [0x530dfc], 0
mov dword [0x530df8], 0xffffffff
mov ecx, 0x530df8
push 0
call fcn.0044a940
push 0x530df4
push 0
push 0x530df8
push 0x530df4
call fcn.00435730
add esp, 0x10
jmp 0x449b1a
mov edi, dword [0x530df4]
push dword [0x52e140]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ecx, ecx
and eax, 0xfffffffc
je 0x449b3b
mov edx, dword [edi]
mov ebx, dword [eax + edx*8 + 4]
cmp ebx, dword [edi + 4]
jne 0x449b3b
mov ecx, dword [eax + edx*8]
mov dword [esi], ecx
mov ebx, dword [0x530e00]
cmp ebx, 1
ja 0x449b9f
push 0x530e00
call fcn.00435680
add esp, 4
test al, al
je 0x449b99
mov ebx, 0x530e04
mov dword [0x530e08], 0
mov dword [0x530e04], 0xffffffff
mov ecx, 0x530e04
push 0
call fcn.0044a940
push 0x530e00
push 0
push 0x530e04
push 0x530e00
call fcn.00435730
add esp, 0x10
jmp 0x449b9f
mov ebx, dword [0x530e00]
mov edi, dword [ebp + 8]
push dword [0x52e140]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ecx, ecx
and eax, 0xfffffffc
je 0x449bc6
mov edx, dword [ebx]
mov edi, dword [eax + edx*8 + 4]
cmp edi, dword [ebx + 4]
mov edi, dword [ebp + 8]
jne 0x449bc6
mov ecx, dword [eax + edx*8]
mov al, 1
cmp edi, 1
mov dword [esi + 4], ecx
je 0x449bdb
test ecx, ecx
je 0x449bd9
mov al, byte [ecx + 8]
jmp 0x449bdb
xor eax, eax
mov byte [esi + 8], al
mov ebx, dword [0x530e00]
cmp ebx, 1
ja 0x449c40
push 0x530e00
call fcn.00435680
add esp, 4
test al, al
je 0x449c3a
mov ebx, 0x530e04
mov dword [0x530e08], 0
mov dword [0x530e04], 0xffffffff
mov ecx, 0x530e04
push 0
call fcn.0044a940
push 0x530e00
push 0
push 0x530e04
push 0x530e00
call fcn.00435730
add esp, 0x10
jmp 0x449c40
mov ebx, dword [0x530e00]
push dword [0x52e140]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
jne 0x449c56
call fcn.0044aa20
mov ecx, dword [ebx]
mov dword [eax + ecx*8], esi
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [eax + ecx*8 + 4], edx
mov ecx, dword [esi]
test ecx, ecx
je 0x449c89
mov eax, dword [esi + 4]
test eax, eax
je 0x449c83
cmp edi, 1
jne 0x449c89
cmp byte [eax + 8], 0
jne 0x449c89
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x449c89
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x449ca0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x52efc0]
mov esi, ecx
lea ecx, [ebp - 0x18]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00443670
mov edi, dword [0x530e00]
cmp edi, 1
ja 0x449d1f
push 0x530e00
call fcn.00435680
add esp, 4
test al, al
je 0x449d19
mov edi, 0x530e04
mov dword [0x530e08], 0
mov dword [0x530e04], 0xffffffff
mov ecx, 0x530e04
push 0
call fcn.0044a940
push 0x530e00
push 0
push 0x530e04
push 0x530e00
call fcn.00435730
add esp, 0x10
jmp 0x449d1f
mov edi, dword [0x530e00]
mov ebx, dword [esi + 4]
push dword [0x52e140]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
jne 0x449d3c
test ebx, ebx
je 0x449d4a
call fcn.0044aa20
mov ecx, dword [edi]
mov dword [eax + ecx*8], ebx
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov dword [eax + ecx*8 + 4], edx
mov ecx, dword [esi]
test ecx, ecx
je 0x449d5b
cmp dword [esi + 4], 0
jne 0x449d5b
mov eax, dword [ecx]
call dword [eax + 0xc]
lea ecx, [ebp - 0x18]
call fcn.004436a0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x44a300
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [0x530e0c]
mov bl, byte [ebp + 8]
cmp esi, 1
ja 0x44a36b
push 0x530e0c
call fcn.00435680
add esp, 4
test al, al
je 0x44a365
mov esi, 0x530e10
mov dword [0x530e14], 0
mov dword [0x530e10], 0xffffffff
mov ecx, 0x530e10
push 0
call fcn.0044a940
push 0x530e0c
push 0
push 0x530e10
push 0x530e0c
call fcn.00435730
add esp, 0x10
jmp 0x44a36b
mov esi, dword [0x530e0c]
xor edi, edi
test bl, bl
cmovne edi, esi
push dword [0x52e140]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
jne 0x44a38c
test edi, edi
je 0x44a39a
call fcn.0044aa20
mov ecx, dword [esi]
mov dword [eax + ecx*8], edi
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov dword [eax + ecx*8 + 4], edx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x44a490
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x52e140]
cmp eax, 0xffffffff
je 0x44a4b0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x44a4c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x531a20]
cmp esi, 1
ja 0x44a526
push 0x531a20
call fcn.00435680
add esp, 4
test al, al
je 0x44a520
mov esi, 0x531a24
mov dword [0x531a28], 0
mov dword [0x531a24], 0xffffffff
mov ecx, 0x531a24
push 0
call fcn.0044a940
push 0x531a20
push 0
push 0x531a24
push 0x531a20
call fcn.00435730
add esp, 0x10
jmp 0x44a526
mov esi, dword [0x531a20]
push dword [0x52e140]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x44a54b
mov ecx, dword [esi]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [esi + 4]
jne 0x44a54b
cmp dword [eax + ecx*8], 0
setne al
jmp 0x44a54d
xor eax, eax
pop esi
pop ebp
ret
Function at 0x44a7d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.004aeed0
mov eax, dword [0x52efc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x52e140]
cmp eax, 0xffffffff
je 0x44a8fd
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x44a8fd
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.004b76d0
add esp, 0xc
mov esi, dword [0x52e140]
lea eax, [ebp - 0x80f]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test ebx, ebx
je 0x44a843
push ebx
call fcn.004aeafc
add esp, 4
mov eax, dword [0x531a50]
mov dword [ebp - 0x1414], esi
test al, 1
je 0x44a912
mov esi, dword [0x531a4c]
mov ecx, esi
call fcn.00448a40
lea eax, [ebp - 0x1410]
push 0xc00
push 0x530e20
push eax
call fcn.004b76d0
add esp, 0xc
mov ecx, esi
call fcn.00448a50
mov esi, 0x100
mov al, 1
test al, 1
jne 0x44a89c
jmp 0x44a8ef
cmp esi, 2
lea esi, [esi - 1]
jb 0x44a8ef
test al, 1
je 0x44a8ef
mov ebx, 0xfffff400
xor eax, eax
lea edi, [ebp - 0x810]
jmp 0x44a8b8
add edi, 8
add ebx, 0xc
je 0x44a890
mov ecx, dword [edi]
test ecx, ecx
je 0x44a8b0
cmp dword [ebp + ebx - 0x810], 0
je 0x44a8b0
mov edx, dword [edi + 4]
cmp edx, dword [ebp + ebx - 0x808]
jne 0x44a8b0
mov edx, dword [ebp + ebx - 0x80c]
test edx, edx
je 0x44a8b0
mov dword [edi], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x44a8b0
push 2
push dword [ebp - 0x1414]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
or eax, 1
mov dword [0x531a50], eax
push 4
call fcn.004aea96
add esp, 4
mov ecx, eax
mov esi, eax
call fcn.004489c0
mov dword [0x531a4c], esi
jmp 0x44a85c

Function at 0x44a940
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x52e140]
mov esi, ecx
cmp eax, 0xffffffff
je 0x44a95d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x44a962
call fcn.0044aa20
mov eax, dword [0x531a50]
test al, 1
je 0x44a9f2
mov edi, dword [0x531a4c]
mov ecx, edi
call fcn.00448a40
mov eax, dword [0x530e1c]
mov ecx, 0x100
inc eax
nop word [eax + eax]
movzx edx, al
lea ebx, [edx + edx*2]
cmp dword [ebx*4 + 0x530e20], 0
je 0x44a9a6
inc eax
dec ecx
jne 0x44a990
jmp 0x44a9d6
mov ecx, dword [ebp + 8]
lea eax, [ebx*4 + 0x530e20]
mov dword [0x530e1c], edx
mov dword [eax], 1
lea eax, [edx*4]
mov dword [eax + eax*2 + 0x530e24], ecx
mov dword [esi], edx
mov eax, dword [eax + eax*2 + 0x530e28]
mov dword [esi + 4], eax
mov ecx, edi
call fcn.00448a50
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x44aa18
cmp eax, 0x100
jge 0x44aa1b
pop esi
pop edi
pop ebx
pop ebp
ret 4
or eax, 1
mov dword [0x531a50], eax
push 4
call fcn.004aea96
add esp, 4
mov ecx, eax
mov edi, eax
call fcn.004489c0
mov dword [0x531a4c], edi
jmp 0x44a975
int3
int3
Function at 0x44aa20
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x804
mov eax, dword [0x52efc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [0x52e140]
cmp esi, 0xffffffff
jne 0x44aa6e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x44aae2
mov esi, eax
mov eax, 0xffffffff
lock cmpxchg dword [0x52e140], esi
je 0x44aa6e
push esi
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov esi, dword [0x52e140]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x44aadf
lea ebx, [ebp - 0x810]
push 0x800
push 0
push ebx
call fcn.004b81d0
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x800
call fcn.004aeaf3
add esp, 4
mov edi, eax
push 0x800
push ebx
push eax
call fcn.004b76d0
add esp, 0xc
mov eax, edi
or eax, 3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
mov eax, edi
add esp, 0x804
pop esi
pop edi
pop ebx
pop ebp
ret
int3
int3

Function at 0x44abc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x531a20]
cmp esi, 1
ja 0x44ac26
push 0x531a20
call fcn.00435680
add esp, 4
test al, al
je 0x44ac20
mov esi, 0x531a24
mov dword [0x531a28], 0
mov dword [0x531a24], 0xffffffff
mov ecx, 0x531a24
push 0
call fcn.0044a940
push 0x531a20
push 0
push 0x531a24
push 0x531a20
call fcn.00435730
add esp, 0x10
jmp 0x44ac26
mov esi, dword [0x531a20]
push dword [0x52e140]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 0xfffffffc
je 0x44ac4c
mov ecx, dword [esi]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [esi + 4]
jne 0x44ac4c
mov eax, dword [eax + ecx*8]
test eax, eax
je 0x44ac4c
pop esi
pop ebp
ret
int3

Function at 0x44c440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x52efc0]
xor eax, ebp
mov dword [esp + 0x18], eax
mov edi, dword [ecx + 0x38]
test edi, edi
jne 0x44c513
mov esi, ecx
mov dword [esp + 0x10], 0
mov byte [esp + 0x13], 9
mov dword [esp + 0xc], 0x65647261
mov dword [esp + 8], 0x63736964
mov word [esp + 0x10], 0x64
push 0x40
call fcn.004aea96
add esp, 4
lea edx, [esp + 8]
mov ebx, eax
mov eax, esp
mov ecx, esi
push edx
push eax
call fcn.0044c2e0
mov edi, dword [esi + 0x28]
lea eax, [esp + 8]
mov ecx, ebx
push eax
call fcn.00427566
movsd xmm0, qword [esp]
movsd qword [ebx + 0x10], xmm0
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], 0
mov byte [ebx + 0x20], 0
mov byte [ebx + 0x28], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
mov edi, dword [esi + 0x38]
mov dword [esi + 0x38], ebx
test edi, edi
je 0x44c4fd
mov ecx, edi
call fcn.0044b730
push edi
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0x13], 0
jns 0x44c510
push dword [esp + 8]
call fcn.004aeac6
add esp, 4
mov edi, dword [esi + 0x38]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.004aeb01
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44e810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov dword [ecx + 0x14], 0xffffffff
mov dword [ecx + 0x10], 0xffffffff
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x28], 0
mov esi, ecx
mov al, byte [ecx + 0x50]
test al, al
je 0x44e872
xor edi, edi
cmp byte [esi + edi + 0x51], 8
je 0x44e85f
nop word [eax + eax]
inc edi
movzx ecx, al
cmp edi, ecx
jae 0x44e872
cmp byte [esi + edi + 0x51], 8
jne 0x44e850
mov ecx, dword [esi + edi*8 + 0x60]
test ecx, ecx
je 0x44e850
mov eax, dword [ecx]
push 1
call dword [eax]
mov al, byte [esi + 0x50]
jmp 0x44e850
mov byte [esi + 0x50], 0
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x3c]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x48]
mov eax, dword [esi + 0x48]
test eax, eax
je 0x44e898
push eax
call fcn.00459fc0
mov edx, dword [ebp + 0x3c]
mov ecx, dword [ebp + 0x40]
add esp, 4
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x48], 0
mov dword [esi], ebx
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 0x38]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 0x28]
mov dword [esi + 0x40], eax
mov eax, dword [ebp + 0x2c]
mov dword [esi + 0x44], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x70], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edx
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x24], eax
lea eax, [esi + 0x30]
mov dword [ebp - 0x14], eax
mov al, byte [ebp + 0x24]
mov byte [esi + 0x80], al
lea eax, [esi + 0x44]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x44]
test eax, eax
je 0x44e970
lea ebx, [esi + 0x50]
cmp ebx, eax
je 0x44e970
mov al, byte [ebx]
test al, al
je 0x44e941
xor edi, edi
cmp byte [esi + edi + 0x51], 8
je 0x44e92f
nop
inc edi
movzx ecx, al
cmp edi, ecx
jae 0x44e941
cmp byte [esi + edi + 0x51], 8
jne 0x44e920
mov ecx, dword [esi + edi*8 + 0x60]
test ecx, ecx
je 0x44e920
mov eax, dword [ecx]
push 1
call dword [eax]
mov al, byte [ebx]
jmp 0x44e920
mov eax, dword [ebp + 0x44]
movsd xmm0, qword [eax + 0x18]
movsd qword [ebx + 0x18], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [ebx + 0x10], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
movsd qword [ebx + 8], xmm1
movsd qword [ebx], xmm0
mov byte [eax], 0
mov edi, dword [esi + 0x74]
lea ecx, [esi + 0x50]
and edi, 1
add esi, 0x48
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push edi
push esi
call fcn.0044cdc0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x44
Function at 0x457270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov edx, dword [0x52efc0]
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x10]
xor edx, ebp
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 0
push edx
push esi
push edi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x4572d8
mov eax, dword [ebp - 0x10]
mov esi, 0x3f4
add eax, 0xfffffffd
cmp eax, 1
ja 0x4572d8
cmp dword [ebp - 0x14], 4
jne 0x4572d8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
xor esi, esi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004aeb01
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret 8

Function at 0x4572f0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1010
call fcn.004aeed0
mov eax, dword [0x52efc0]
mov ebx, dword [ebp + 0xc]
lea edx, [ebp - 0x1018]
lea esi, [ebp - 0x1014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x810]
mov dword [ebp - 0x1014], 1
mov dword [ebp - 0x1018], 0x800
push edx
push eax
push esi
push 0
push dword [ebp + 8]
mov dword [ebp - 0x101c], ecx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [ebp - 0x1018]
cmp eax, 0xea
je 0x45736d
mov edi, eax
cmp esi, 0x401
jae 0x45736d
test edi, edi
jne 0x457488
jmp 0x457432
add esi, esi
mov eax, 0xffffffff
cmovb esi, eax
push esi
call fcn.004aeaf3
add esp, 4
mov ebx, eax
push esi
push 0
push eax
call fcn.004b81d0
add esp, 0xc
push 0x14
call fcn.004aea96
add esp, 4
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax], method.std::__1::locale::facet.virtual_0
mov esi, eax
mov dword [eax + 0xc], ebx
lea eax, [ebp - 0x1018]
push eax
push ebx
lea eax, [ebp - 0x1014]
push eax
push 0
push dword [ebp + 8]
mov eax, dword [ebp - 0x101c]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x45740f
cmp dword [ebp - 0x1014], 1
jne 0x45740f
mov ecx, dword [ebp + 0xc]
push ebx
call fcn.00428a50
mov eax, 0xffffffff
xor edi, edi
lock xadd dword [esi + 4], eax
test eax, eax
jne 0x457488
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, esi
call fcn.0042713c
jmp 0x457488
mov eax, 0xffffffff
lock xadd dword [esi + 4], eax
test eax, eax
jne 0x45742b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, esi
call fcn.0042713c
mov ebx, dword [ebp + 0xc]
test edi, edi
jne 0x457488
mov eax, dword [ebp - 0x1014]
cmp eax, 2
je 0x457452
mov edi, 0x3f4
cmp eax, 1
jne 0x457488
mov ecx, ebx
lea eax, [ebp - 0x810]
push eax
jmp 0x457481
lea esi, [ebp - 0x1010]
push 0x400
push esi
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
dec eax
mov edi, 0xea
cmp eax, 0x3ff
ja 0x457488
mov ecx, ebx
push esi
call fcn.00428a50
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
mov eax, edi
add esp, 0x1010
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4574b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push eax
mov edx, dword [0x52efc0]
mov eax, dword [ebp + 8]
xor edx, ebp
mov dword [ebp - 8], edx
lea edx, [ebp + 0xc]
push 4
push edx
push 4
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 8]
mov esi, eax
xor ecx, ebp
call fcn.004aeb01
mov eax, esi
add esp, 4
pop esi
pop ebp
ret 8
Function at 0x45a590
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x18
mov eax, dword [0x52efc0]
xor eax, ebp
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x1c]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x45a5f4
lea eax, [ebp - 0x14]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x45a5f8
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
lea eax, [ebp - 0x18]
push 0
push 0
push 0x10
push eax
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, eax
jmp 0x45a5fa
xor esi, esi
jmp 0x45a603
xor esi, esi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004aeb01
mov eax, esi
add esp, 0x18
pop esi
pop ebp
ret

Function at 0x45a620
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x428
mov eax, dword [0x52efc0]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor eax, ebp
mov dword [esp + 0x420], eax
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
push ebx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test eax, eax
je 0x45a6aa
lea ebx, [esp + 0x10]
push 0x410
push 0
push ebx
call fcn.004b81d0
add esp, 0xc
push 0x208
push ebx
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
dec eax
cmp eax, 0x206
ja 0x45a712
cmp byte [ebp + 0x10], 0
je 0x45a6c9
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ecx, esi
push eax
call fcn.00428a50
jmp 0x45a712
call fcn.0045a590
test eax, eax
je 0x45a719
push ebx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test eax, eax
jne 0x45a66b
jmp 0x45a719
mov ecx, esi
push ebx
call fcn.00428a50
mov ebx, esp
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
push ebx
push esi
call fcn.0045a0a0
add esp, 8
test al, al
je 0x45a700
mov ecx, esi
push ebx
call fcn.004283b4
cmp byte [esp + 0xb], 0
jns 0x45a712
push dword [esp]
call fcn.004aeac6
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x420]
xor ecx, ebp
call fcn.004aeb01
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45a740
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x52efc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.004586f0
mov eax, dword [0x531ce8]
xor esi, esi
cmp dword [eax], 1
jne 0x45a7ed
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x45a78d
cmp byte [ebp + 0xc], 0
mov esi, 0xffffffff
je 0x45a7ed
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x45a801
mov dword [ebp - 0x14], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
mov esi, 0xffffffff
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0xc]
mov ebx, dword [edi]
cmp ebx, edi
jne 0x45a7c6
jmp 0x45a7ed
mov ebx, dword [ebx]
cmp ebx, edi
je 0x45a7ed
cmp dword [ebx + 0x1c], 0
je 0x45a7c0
movzx eax, word [ebx + 0x2c]
shr eax, 1
push eax
push dword [ebp + 8]
push dword [ebx + 0x30]
call fcn.004cbcb1
add esp, 0xc
test eax, eax
jne 0x45a7c0
xor esi, esi
mov word [ebx + 0x38], 0xffff
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
int3