joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4455f0
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
cmp byte [eax + 0x2c], 0
mov dword [ebp - 0x18], ebx
jne 0x445628
mov eax, 0x3f0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push 0
push 0
push 3
push dword [eax + 0x24]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x445660
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret 4
push esi
push eax
call fcn.0042c075
add esp, 4
mov esi, eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x24], esi
push eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
push esi
push 3
push dword [eax + 0x24]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4456aa
push esi
call fcn.0041e6ef
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret 4
cmp dword [esi], 0
mov dword [ebp - 0x20], 0
jbe 0x44577f
add esi, 4
push edi
nop
test ebx, ebx
je 0x44573d
mov edi, dword [ebx]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, 0x2aaaaaab
mov ecx, dword [ebx + 4]
sub ecx, edi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x44573d
xor ebx, ebx
xorps xmm0, xmm0
lea eax, [ebx + edi]
movq qword [ebp - 0xc], xmm0
cmp dword [eax + 0x14], 8
jb 0x4456f8
mov eax, dword [eax]
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esi + 4]
cmp eax, dword [ebp - 8]
jne 0x445714
mov eax, dword [esi]
cmp eax, dword [ebp - 0xc]
je 0x445764
mov eax, dword [ebp - 0x18]
add ebx, 0x18
inc dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov edi, dword [eax]
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x14], eax
jb 0x4456e5
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xc
mov edx, dword [ecx + 4]
cmp dword [ecx + 8], edx
je 0x44575b
mov eax, dword [esi]
mov dword [edx], eax
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
add dword [ecx + 4], 8
jmp 0x445767
push esi
push edx
call fcn.004457a0
jmp 0x445767
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
add esi, 0xc
mov ecx, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [ecx]
jb 0x4456c0
mov esi, ecx
pop edi
push esi
call fcn.0041e6ef
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop esi
pop ebx
call fcn.0040154f
mov esp, ebp
pop ebp
ret 4
Function at 0x445c80
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
mov dword [ebp - 0x24], eax
xor bl, bl
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x2c], ecx
push eax
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], ebx
push eax
push 0
push 0
push 4
push 6
push ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x445ddb
push edi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x28], edi
test edi, edi
je 0x445dda
push 2
mov dword [ebp - 8], eax
xorps xmm0, xmm0
push 0xc
lea eax, [ebp - 0x10]
movq qword [ebp - 0x10], xmm0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x445dda
push esi
mov esi, dword [ebp - 0xc]
add esi, 8
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x445dd6
push 2
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x445dcf
mov eax, dword [ebp - 0x10]
xor esi, esi
test eax, eax
je 0x445da4
nop word [eax + eax]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x445da1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x445da1
cmp byte [ecx], 0
mov edi, ecx
jne 0x445d7f
mov ecx, dword [ebp - 0x24]
call fcn.004084b0
push eax
lea eax, [edi + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x445d94
mov ecx, dword [ebp - 0x14]
movzx eax, word [edi + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x445da1
mov eax, dword [ebp - 0x10]
inc esi
mov edi, dword [ebp - 0x28]
cmp esi, eax
jb 0x445d40
jmp 0x445da4
mov eax, dword [ebp - 0x10]
cmp esi, eax
jne 0x445dcf
push 0
push ebx
push 0
push 0
push 4
push 6
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov ecx, dword [ebp - 0x20]
test eax, eax
movzx ecx, cl
mov edx, 1
cmove ecx, edx
mov dword [ebp - 0x20], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [ebp - 0x20]
pop esi
pop edi
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x445de9
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0040154f
mov esp, ebp
pop ebp
ret
Function at 0x447280
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
call fcn.004473e0
test eax, eax
jne 0x4473db
movaps xmm0, xmmword [0x5918a0]
push esi
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x7f03
xor esi, esi
mov dword [ebp - 8], 0x7f01
mov dword [ebp - 4], 0x7f04
push dword [ebp + esi*4 - 0x1c]
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
mov ecx, edi
call fcn.004473e0
test eax, eax
jne 0x4473da
inc esi
cmp esi, 7
jb 0x4472c3
movaps xmm0, xmmword [0x591890]
xor esi, esi
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 8], 0x7f84
movaps xmm0, xmmword [0x5918c0]
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 4], 0x7f04
movaps xmm0, xmmword [0x5918b0]
movups xmmword [ebp - 0x18], xmm0
nop word [eax + eax]
push dword [ebp + esi*4 - 0x38]
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
mov ecx, edi
call fcn.004473e0
test eax, eax
jne 0x4473da
inc esi
cmp esi, 0xe
jb 0x447320
push str._AcroAppTimer
push str.apptimer.exe
call fcn.00447420
add esp, 8
test eax, eax
je 0x447364
push eax
mov ecx, edi
call fcn.004473e0
test eax, eax
jne 0x4473da
push str.SafeNet_Borderless_Single_Sign_On.....
push str.DKAXSvr.exe
call fcn.00447420
add esp, 8
test eax, eax
je 0x447386
push eax
mov ecx, edi
call fcn.004473e0
test eax, eax
jne 0x4473da
push 0
call fcn.00419bf0
add esp, 4
test al, al
je 0x4473d8
push str.PrivateOutputChannelHelperWindow
push str.QTPro.exe
call fcn.00447420
add esp, 8
test eax, eax
je 0x4473b6
push eax
mov ecx, edi
call fcn.004473e0
test eax, eax
jne 0x4473da
push str.ZinorKnisaPatuach
push str.QTPro.exe
call fcn.00447420
add esp, 8
test eax, eax
je 0x4473d8
push eax
mov ecx, edi
call fcn.004473e0
test eax, eax
jne 0x4473da
xor eax, eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x448b10
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x1c], eax
xor bl, bl
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x15], bl
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
test eax, eax
je 0x448c4b
mov dword [eax], 0
test edi, edi
je 0x448c4b
push 2
push 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
push edi
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x448c4b
push esi
mov esi, dword [ebp - 0xc]
add esi, 8
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x448c37
push 2
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x448c30
mov eax, dword [ebp - 0x10]
xor esi, esi
test eax, eax
je 0x448c14
nop word [eax + eax]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x448c11
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x448c11
cmp byte [ecx], 0
mov edi, ecx
jne 0x448bef
mov ecx, dword [ebp - 0x1c]
call fcn.004084b0
push eax
lea eax, [edi + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x448c04
mov ecx, dword [ebp - 0x14]
movzx eax, word [edi + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x448c11
mov eax, dword [ebp - 0x10]
inc esi
mov edi, dword [ebp - 0x20]
cmp esi, eax
jb 0x448bb0
jmp 0x448c14
mov eax, dword [ebp - 0x10]
cmp esi, eax
jne 0x448c30
mov ecx, dword [ebp - 0x24]
mov al, 1
pop esi
pop edi
mov dword [ecx], ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, byte [ebp - 0x15]
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.0040154f
mov esp, ebp
pop ebp
ret
Function at 0x44df60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
push ebx
mov ebx, ecx
jne 0x44df92
cmp dword [ebx + 8], 0
jne 0x44dfc4
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret 4
push 0
push 0x402080
push 1
push str.NtMapViewOfSection
push 0x574828
call fcn.0044a630
push 1
push 0x404d50
push 1
push str.NtUnmapViewOfSection
push 0x574828
mov ecx, ebx
call fcn.0044a630
mov eax, dword [ebx]
push esi
push 1
push 0x2000
mov eax, dword [eax]
push 0x10000
push 0
push eax
mov dword [ebp - 0x64], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, dword [ebx + 8]
shl esi, 6
add esi, 0x50
mov dword [ebp - 0x68], eax
cmp esi, 0x10000
jbe 0x44dffa
call fcn.004013a0
push edi
mov edi, 0x10000
sub edi, esi
lea eax, [ebp - 8]
push eax
call fcn.00448e8e
movzx ecx, word [ebp - 8]
add esp, 4
mov dword [ebp - 8], ecx
cmp ecx, edi
ja 0x44e002
mov eax, 0x800
mov edi, 0x1000
cmp esi, eax
ja 0x44e02f
mov edi, eax
shr eax, 1
cmp eax, esi
jae 0x44e027
neg edi
and edi, ecx
mov ecx, dword [ebp - 0x68]
mov eax, edi
and edi, 0xfff
and eax, 0xfffff000
add ecx, eax
lea eax, [esi + 0xfff]
push 0x40
push 0x1000
and eax, 0xfffff000
push eax
push ecx
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
test eax, eax
jne 0x44e071
call fcn.004013a0
mov eax, dword [ebp - 0x68]
add edi, eax
jne 0x44e08b
lea eax, [edi + 7]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret 4
push 0x4c8
push 0
push 0x5ccf68
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x5c], 0x10
call fcn.005290f0
add esp, 0xc
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push esi
push edi
call fcn.0044e140
test eax, eax
jne 0x44e12a
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x10
lea eax, [ebp - 0x60]
push eax
push edi
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x44e125
cmp dword [ebp - 0xc], 0x10
jne 0x44e125
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x20
push esi
push edi
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebx]
push 0
push 0x4c8
push 0x5ccf68
push str.g_originals
call fcn.00449310
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret 4
mov eax, 0x2a
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040154f
mov esp, ebp
pop ebp
ret 4
Function at 0x44fb30
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005290f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x101
ja 0x44fb94
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x44fb94
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret
Function at 0x455fd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x559f88
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5cda2c]
mov esi, dword [ebp + 8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5cd594]
cmp eax, dword [ecx + 4]
jg 0x4561c5
cmp byte [0x5cd590], 0
jne 0x45619c
lea eax, [ebp - 0x48]
mov byte [0x5cd590], 1
push eax
call fcn.00456200
add esp, 4
cmp dword [ebp - 0x38], 0
mov dword [ebp - 4], 0
je 0x45618d
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0049e3d0
add esp, 8
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], 1
je 0x456185
lea eax, [ebp - 0x28]
xor bl, bl
push 0
push eax
call fcn.00424aa0
add esp, 8
test al, al
je 0x456161
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHELL32.dll_PathIsExe]
test eax, eax
jne 0x4560a9
push 4
push 0x58e7c0
lea ecx, [ebp - 0x28]
call fcn.0040cd80
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push str.drwtsn32.exe
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0040b363
add esp, 8
test eax, eax
jne 0x4560ed
push eax
push str.drwtsn32.exe
lea eax, [ebp - 0x7c]
push 0x29
push eax
call fcn.0043d270
add esp, 0x10
lea ecx, [ebp - 0x28]
push eax
call fcn.0042a225
lea ecx, [ebp - 0x7c]
call fcn.00408e50
jmp 0x456161
lea ecx, [ebp - 0x64]
call fcn.0048f750
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.0048fb30
test al, al
je 0x456151
xorps xmm0, xmm0
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x30], xmm0
call fcn.0048f6f0
xor eax, eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x7c]
push 1
push eax
call fcn.0049e2e0
add esp, 0xc
lea ecx, [ebp - 0x7c]
mov bl, al
call fcn.00408e50
lea ecx, [ebp - 0x30]
call fcn.0048f780
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.0048f7d0
test bl, bl
je 0x456185
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x456185
lea eax, [ebp - 0x28]
mov ecx, 0x5c7910
push eax
call fcn.00428c90
lea ecx, [ebp - 0x28]
call fcn.00408e50
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0xffffffff
call fcn.00408e50
push 0x5c7910
mov ecx, esi
call fcn.00409a20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret
push 0x5cd594
call fcn.0040fbfe
add esp, 4
cmp dword [0x5cd594], 0xffffffff
jne 0x45601d
push 0x566c20
call fcn.00405e79
push 0x5cd594
call fcn.0040fc50
add esp, 8
jmp 0x45601d
Function at 0x456200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5cda2c]
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5cd58c]
cmp eax, dword [ecx + 4]
jg 0x45631f
cmp byte [0x5cd588], 0
jne 0x456302
lea eax, [ebp - 0x420]
mov byte [0x5cd588], 1
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAeDebug
push 0x80000002
mov dword [ebp - 0x420], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x456302
push 0x410
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x414]
push eax
call fcn.005290f0
add esp, 0xc
mov dword [ebp - 0x418], 0x410
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0
push str.Debugger
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4562f6
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4562d5
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
mov ecx, 0x5c78f8
call fcn.00408740
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x5c78f8
mov ecx, esi
call fcn.00409a20
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040154f
mov esp, ebp
pop ebp
ret
push 0x5cd58c
call fcn.0040fbfe
add esp, 4
cmp dword [0x5cd58c], 0xffffffff
jne 0x456237
push 0x566c10
call fcn.00405e79
push 0x5cd58c
call fcn.0040fc50
add esp, 8
jmp 0x456237
Function at 0x457e90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a220
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor bl, bl
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
cmp dword [esi + 0x10], 0
je 0x457ffd
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x457edd
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x457ffd
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x457ef6
mov eax, dword [esi]
push eax
call dword [sym.imp.SHELL32.dll_PathIsExe]
test eax, eax
je 0x457ffd
push 0
push str.ime_shared
lea eax, [ebp - 0x40]
push 0x25
push eax
call fcn.0043d270
push 0
push str.ime_shared
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push 0x24
push eax
call fcn.0043d270
mov ebx, dword [ebp - 0x44]
lea eax, [ebp - 0x40]
push ebx
push edi
push esi
push eax
mov byte [ebp - 4], 1
call fcn.00458030
add esp, 0x30
test al, al
jne 0x457f70
push ebx
push edi
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00458030
add esp, 0x10
test al, al
jne 0x457f70
push ebx
push edi
push esi
call fcn.00458e70
add esp, 0xc
test al, al
jne 0x457f70
xor bl, bl
jmp 0x457f72
mov bl, 1
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x457fac
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x457fa2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45801b
push edx
push ecx
call fcn.004097e6
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 4], 3
cmp edx, 8
jb 0x457ffd
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x457ff3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x458020
push edx
push ecx
call fcn.004097e6
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret
call fcn.0052cae1
call fcn.0052cae1
int3
Function at 0x459100
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push esi
push 0x20019
push 0
push eax
push ecx
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x459162
push eax
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x45916a
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], 0
jmp 0x4591a0
mov eax, dword [ebp - 8]
mov edx, dword [esi]
dec eax
mov dword [esi + 4], eax
test edx, edx
je 0x4591a0
test eax, eax
js 0x4591a0
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], 0x104
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 8]
push ecx
lea ecx, [esi + 8]
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4591a6
xor eax, eax
mov word [esi + 8], ax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040154f
mov esp, ebp
pop ebp
ret 8
Function at 0x45b790
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
cmp esi, 0x804
ja 0x45b7cd
je case.0x45b7c6.1027
lea eax, [esi - 0x403]
cmp eax, 0x2a
ja case.0x45b7c6.1032
movzx eax, byte [eax + 0x45b820]
jmp dword [eax*4 + 0x45b818]
cmp esi, 0xc0a
je case.0x45b7c6.1027
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.005290f0
add esp, 0xc
lea eax, [ebp - 0x404]
push 0x200
push eax
push 3
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x45b806
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0040154f
mov esp, ebp
pop ebp
ret

Function at 0x45c9a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555f98
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5c7cec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [edi + 0x28], 0
mov dword [ebp - 4], 0
jne 0x45ca69
mov al, byte [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov byte [edi + 0x2a], al
mov eax, dword [ebp + 0xc]
mov byte [edi + 0x28], 1
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], eax
mov dword [edi + 0x34], 0
test ecx, ecx
je 0x45ca69
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov dword [edi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [edi + 0x2c], 0
mov dword [edi + 0x30], eax
je 0x45ca69
test eax, eax
je 0x45ca69
cmp byte [edi + 0x2a], 0
lea esi, [edi + 0x20]
push esi
push 0
push edi
mov ecx, 0x4fa680
mov dword [esi], 0
mov eax, 0x45cb90
cmovne eax, ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esi], 0
mov dword [edi + 0x24], eax
je 0x45ca69
test eax, eax
je 0x45ca69
mov byte [edi + 0x29], 1
mov bl, byte [edi + 0x29]
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc