joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f7ad
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4d5e88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
test esi, esi
je 0x42f827
push 0
lea eax, [ebp - 0x408]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x408]
cmp ecx, 2
jb 0x42f80e
movzx eax, byte [ebp - 0x404]
cmp eax, 0xffffffff
jne 0x42f80e
movzx eax, byte [ebp - 0x403]
cmp eax, 0xfffffffe
jne 0x42f80e
inc bl
jmp 0x42f827
xor eax, eax
test ecx, ecx
je 0x42f827
test bl, bl
jne 0x42f827
cmp byte [ebp + eax - 0x404], bl
sete bl
inc eax
cmp eax, ecx
jb 0x42f814
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00458e9f
leave
ret 4

Function at 0x430133
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x4d5e88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x430239
cmp byte [ebp + 0xc], 0
jne 0x4301e7
lea eax, [edi + 1]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x430239
and dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
push edi
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
je 0x43022a
call fcn.00459b20
lea edi, [eax + 1]
pop ecx
cmp edi, 0x3fffffff
jle 0x4301b6
xor eax, eax
jmp 0x4301ca
lea eax, [edi + edi]
call fcn.0045cba0
mov eax, esp
push 3
push edi
push esi
push eax
call fcn.0042c620
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00432ebf
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
jmp 0x43023b
lea eax, [edi + 3]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x430239
and dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
push edi
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x430229
mov ecx, 0xfeff
mov eax, esi
cmp word [esi], cx
jne 0x4301ca
lea eax, [esi + 2]
jmp 0x4301ca
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00458e9f
leave
ret 0xc
Function at 0x430672
Capabilities:
Persist via run registry key

Disassembly:
push 0x44
mov eax, 0x4a3f33
call fcn.0045a4e9
mov edi, ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
call fcn.0042f087
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
push ebx
mov ecx, edi
mov esi, eax
call fcn.0042f087
push str.SYSTEMCurrentControlSetControlSession_ManagerFileRenameOperations
push ebx
mov ecx, edi
mov dword [ebp - 0x50], eax
call fcn.0042f087
push str.PendingFileRenameOperations
push str.SYSTEMCurrentControlSetControlSession_Manager
push ebx
mov ecx, edi
mov dword [ebp - 0x4c], eax
call fcn.0042efc1
push str.rename
push str._WindowsFolder_Wininit.ini
mov ecx, edi
mov dword [ebp - 0x48], eax
call fcn.0042ed81
mov ebx, eax
push 0
lea eax, [ebp - 0x41]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x4c0ee0
mov dword [ebp - 0x18], 0x4c13e4
call fcn.00403f50
and dword [ebp - 4], 0
cmp esi, dword [edi + 0x440]
jle 0x430709
push str.RunOnce
jmp 0x43074c
mov eax, dword [ebp - 0x50]
cmp eax, dword [edi + 0x444]
jle 0x43071b
push str.RunOnceEx
jmp 0x43074c
mov eax, dword [ebp - 0x48]
cmp eax, dword [edi + 0x448]
jle 0x43072d
push str.PendingFileRenameOperations
jmp 0x43074c
mov eax, dword [ebp - 0x4c]
cmp eax, dword [edi + 0x44c]
jle 0x43073f
push str.FileRenameOperations
jmp 0x43074c
cmp ebx, dword [edi + 0x450]
jle 0x43075d
push str.Wininit.ini_rename
lea eax, [ebp - 0x40]
push str.Reboot_required____s_key_added
push eax
call fcn.00403b50
add esp, 0xc
cmp dword [ebp - 0x2c], 0
je 0x430776
xor ebx, ebx
push 0
inc ebx
push ebx
lea eax, [ebp - 0x40]
push eax
mov ecx, edi
call fcn.0042c534
jmp 0x430778
xor bl, bl
lea ecx, [ebp - 0x40]
call fcn.00401ac0
mov al, bl
call fcn.0045a498
ret

Function at 0x4368c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [ebp + 8], 0
je 0x4368de
mov ecx, esi
call fcn.004366f7
pop esi
pop ebp
ret 4
Function at 0x4372d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x4d5e88]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
lea edi, [eax + 4]
mov dword [ebp - 0x9c], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x2c]
cmp byte [eax + 0x13], 0
je 0x437461
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x437460
cmp dword [0x4d7940], esi
je 0x437460
mov eax, dword [0x4d7948]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4d7940], esi
test al, 1
jne 0x437346
or eax, 1
mov dword [0x4d7948], eax
call ebx
mov dword [0x4d7944], eax
call ebx
mov ecx, eax
sub ecx, dword [0x4d7944]
cmp byte [0x4d554b], 0
mov dword [0x4d7944], eax
jne 0x437367
cmp ecx, 0x64
jb 0x43745f
push 0xa
pop eax
push 0x14
pop ecx
cmp esi, 0x100000
cmovg eax, ecx
imul esi, esi, 0xa
movzx eax, ax
mov cl, al
mov dword [ebp - 0xa0], eax
push 0
lea eax, [ebp - 0x95]
sar esi, cl
push eax
lea ecx, [ebp - 0x34]
mov byte [0x4d554b], 0
mov dword [ebp - 0x34], 0x4c0f30
mov dword [ebp - 0xc], 0x4c0ed0
call fcn.00404200
lea eax, [ebp - 0x64]
push 0x758
push eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x2c]
mov ecx, eax
call fcn.0040d268
lea ebx, [eax + 4]
cmp dword [ebx + 0x14], 8
jb 0x4373ce
mov ebx, dword [ebx]
push 0x14
xor eax, eax
pop ecx
cmp word [ebp - 0xa0], cx
mov ecx, edi
setne al
add eax, 0x652
push eax
lea eax, [ebp - 0x94]
push eax
mov eax, dword [edi]
call dword [eax + 0x2c]
mov ecx, eax
call fcn.0040d268
lea ecx, [eax + 4]
cmp dword [ecx + 0x14], 8
jb 0x437403
mov ecx, dword [ecx]
push 0xa
mov eax, esi
pop esi
xor edx, edx
div esi
push ebx
push ecx
push edx
push eax
lea eax, [ebp - 0x34]
push str._01d._01d__s_s
push eax
call fcn.0040dd64
add esp, 0x18
lea ecx, [ebp - 0x94]
call fcn.00401b80
lea ecx, [ebp - 0x64]
call fcn.00401b80
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x9c]
push 0x134
push dword [eax + 0x26c]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
lea ecx, [ebp - 0x34]
call fcn.00401b80
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.00458e9f
leave
ret 8

Function at 0x437e6c
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x437e87
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x43adc4
Capabilities:
Write file on windows

Disassembly:
push 0x88
mov eax, 0x4a4b22
call fcn.0045a4e9
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor ebx, ebx
push 0
inc ebx
cmp eax, 0xffffffff
lea ecx, [ebp - 0x94]
push ecx
cmove eax, ebx
push eax
push edx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43ae3c
push eax
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x4ac9c4
mov dword [ebp - 0x18], 0x4ac9cc
call fcn.00408e82
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x90]
call fcn.00416a1f
push 0x4c7b58
lea eax, [ebp - 0x90]
push eax
call fcn.00458eae
mov eax, dword [ebp - 0x94]
call fcn.0045a498
ret 8

Function at 0x43ae4a
Capabilities:
Write file on windows

Disassembly:
push 0x88
mov eax, 0x4a4b52
call fcn.0045a4e9
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor ebx, ebx
push 0
inc ebx
cmp eax, 0xffffffff
lea ecx, [ebp - 0x94]
push ecx
cmove eax, ebx
push eax
push edx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43aec2
push eax
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x4ac9c4
mov dword [ebp - 0x18], 0x4ac9cc
call fcn.00408e82
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x90]
call fcn.00416a1f
push 0x4c7b58
lea eax, [ebp - 0x90]
push eax
call fcn.00458eae
mov eax, dword [ebp - 0x94]
call fcn.0045a498
ret 8

Function at 0x43aed0
Capabilities:
Write file on windows

Disassembly:
push 0x88
mov eax, 0x4a4b82
call fcn.0045a4e9
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor ebx, ebx
push 0
inc ebx
cmp eax, 0xffffffff
lea ecx, [ebp - 0x94]
push ecx
cmove eax, ebx
push eax
push edx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43af48
push eax
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x4ac9c4
mov dword [ebp - 0x18], 0x4ac9cc
call fcn.00408e82
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x90]
call fcn.00416a1f
push 0x4c7b58
lea eax, [ebp - 0x90]
push eax
call fcn.00458eae
mov eax, dword [ebp - 0x94]
call fcn.0045a498
ret 8

Function at 0x43af56
Capabilities:
Write file on windows

Disassembly:
push 0x88
mov eax, 0x4a4bb2
call fcn.0045a4e9
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 4
pop ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
lea ecx, [ebp - 0x94]
push ecx
push eax
push edx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43afcf
push eax
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x4ac9c4
mov dword [ebp - 0x18], 0x4ac9cc
call fcn.00408e82
and dword [ebp - 4], 0
push 1
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x90]
call fcn.00416a1f
push 0x4c7b58
lea eax, [ebp - 0x90]
push eax
call fcn.00458eae
mov eax, dword [ebp - 0x94]
call fcn.0045a498
ret 8
Function at 0x43bee5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
add ecx, 4
cmp dword [ecx + 0x14], 8
jb 0x43bef0
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
ret

Function at 0x43c2ac
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x148
mov eax, 0x4a4eb6
call fcn.0045a4e9
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x113]
push ebx
push eax
mov dword [ebp - 0x154], ebx
mov byte [ebp - 0x114], bl
call fcn.00458f10
add esp, 0xc
mov dword [ebp - 0x14c], ebx
lea eax, [ebp - 0x14c]
push eax
push 0x4af9c0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x43c39b
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
mov ecx, str.ProgramFilesDir
push ebx
mov eax, str.CommonFilesDir
cmp edi, 1
cmovne eax, ecx
push eax
push dword [ebp - 0x14c]
mov dword [ebp - 0x150], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
lea eax, [ebp - 0x145]
push eax
lea eax, [ebp - 0x114]
mov edi, 0x4ac9c4
mov ebx, 0x4ac9cc
push eax
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x144], edi
mov dword [ebp - 0x11c], ebx
call fcn.00415c07
push 0x4ac8e8
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 1
call fcn.0040b9f3
lea ecx, [ebp - 0x144]
call fcn.0043c652
lea eax, [ebp - 0x144]
jmp 0x43c3e0
push 0
lea eax, [ebp - 0x145]
push eax
lea eax, [ebp - 0x114]
mov edi, 0x4ac9c4
mov ebx, 0x4ac9cc
push eax
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x144], edi
mov dword [ebp - 0x11c], ebx
call fcn.00415c07
push 0x4ac8e8
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 2
call fcn.0040b9f3
push 0
push eax
mov ecx, esi
mov dword [esi], edi
mov dword [esi + 0x28], ebx
call fcn.00408e82
lea ecx, [ebp - 0x144]
call fcn.00401b80
lea ecx, [ebp - 0x14c]
call fcn.0043303c
mov eax, esi
call fcn.0045a498
ret
Function at 0x43e1e0
Capabilities:
Get common file path

Disassembly:
push 0x78
mov eax, 0x4a514b
call fcn.0045a4e9
mov esi, dword [ebp + 8]
xor ebx, ebx
push ebx
lea eax, [ebp - 0x71]
push eax
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x70], 0x4ae018
mov dword [ebp - 0x48], 0x4ae020
call fcn.00404200
mov edi, 0x104
lea eax, [ebp - 0x80]
push edi
lea ecx, [ebp - 0x70]
push eax
mov dword [ebp - 4], ebx
call fcn.0044367c
cmp dword [ebp + 0xc], 1
jne 0x43e298
mov ecx, dword [eax]
mov byte [ebp - 4], 1
mov byte [eax + 4], 1
call fcn.0040a0f0
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebx, eax
neg ebx
lea ecx, [ebp - 0x80]
sbb bl, bl
mov byte [ebp - 4], 0
call fcn.00409574
inc bl
je 0x43e271
lea ecx, [ebp - 0x2c]
call fcn.0040b827
push 0x4c4a28
lea eax, [ebp - 0x2c]
push eax
call fcn.00458eae
push 0
lea eax, [ebp - 0x71]
push eax
push str.sysnative
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x4c0f30
mov dword [ebp - 0x18], 0x4c0ed0
call fcn.00408f6d
mov byte [ebp - 4], 2
jmp 0x43e2f1
cmp dword [ebp + 0xc], 2
jne 0x43e30b
mov ecx, dword [eax]
mov byte [ebp - 4], 3
mov byte [eax + 4], 1
call fcn.0040a0f0
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebx, eax
neg ebx
lea ecx, [ebp - 0x80]
sbb bl, bl
mov byte [ebp - 4], 0
call fcn.00409574
inc bl
jne 0x43e25b
push 0
lea eax, [ebp - 0x71]
push eax
push str.syswow64
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x4c0f30
mov dword [ebp - 0x18], 0x4c0ed0
call fcn.00408f6d
mov byte [ebp - 4], 4
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x70]
call fcn.0043f333
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.00401b80
jmp 0x43e33d
mov ecx, dword [eax]
mov byte [ebp - 4], 5
mov byte [eax + 4], 1
call fcn.0040a0f0
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
neg ebx
lea ecx, [ebp - 0x80]
sbb bl, bl
mov byte [ebp - 4], 0
call fcn.00409574
inc bl
jne 0x43e25b
push 0x4ac8e8
lea ecx, [ebp - 0x70]
call fcn.0042c1d1
push 0
push eax
mov ecx, esi
mov dword [esi], 0x4ae018
mov dword [esi + 0x28], 0x4ae020
call fcn.00408e82
lea ecx, [ebp - 0x70]
call fcn.00401b80
mov eax, esi
call fcn.0045a498
ret
Function at 0x43f481
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x43f506
mov esi, dword [ebp + 8]
push edi
push esi
lea eax, [ebp + 0x10]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 0x10], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x43f4ff
mov ecx, dword [edi]
test ecx, ecx
je 0x43f4fa
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x43f4f0
cmp edx, 2
jbe 0x43f4e2
cmp edx, 7
jne 0x43f4f0
test cl, 1
jne 0x43f4f0
shr ecx, 1
cmp ecx, 1
jb 0x43f4f0
cmp word [esi + ecx*2 - 2], bx
jne 0x43f4f0
cmp ecx, 1
jbe 0x43f4ff
cmp word [esi + ecx*2 - 4], bx
jmp 0x43f4ee
test cl, 1
jne 0x43f4f0
shr ecx, 1
cmp word [esi + ecx*2 - 2], bx
je 0x43f4ff
xor eax, eax
push 0xd
mov word [esi], ax
pop eax
jmp 0x43f4ff
xor ecx, ecx
mov word [esi], cx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
push 0x80004005
call fcn.00408936
int3

Function at 0x43f589
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
push edi
mov edi, ecx
je 0x43f5de
mov bl, byte [ebp + 0x10]
mov eax, dword [ebp + 0x14]
test bl, bl
je 0x43f5aa
cmp eax, 0xffffffff
jne 0x43f5b9
push 0x57
pop eax
jmp 0x43f5d8
cmp eax, 0xffffffff
jne 0x43f5b9
push dword [ebp + 8]
call fcn.0045a1f4
pop ecx
inc eax
add eax, eax
push eax
push dword [ebp + 8]
xor eax, eax
push 7
pop ecx
inc eax
test bl, bl
cmovne eax, ecx
push eax
push 0
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop ebp
ret 0x10
push 0x80004005
call fcn.00408936
int3
Function at 0x441d3e
Capabilities:
Check if file exists

Disassembly:
push 0xc8
mov eax, 0x4a56f4
call fcn.0045a4e9
xor ebx, ebx
test byte [ebp + 0x38], 0x10
mov dword [ebp - 4], ebx
je 0x441d9c
lea ecx, [ebp + 8]
call fcn.00424c9d
test al, al
je 0x441d9c
push dword [ebp + 0x38]
lea eax, [ebp + 8]
sub esp, 0x30
mov ecx, esp
push ebx
push eax
mov dword [ecx], 0x4c0f30
mov dword [ecx + 0x28], 0x4c0ed0
call fcn.00408e82
call fcn.00441f21
add esp, 0x34
mov bl, al
lea ecx, [ebp + 8]
call fcn.00401b80
mov al, bl
jmp 0x441f1b
sub esp, 0x30
mov ecx, esp
push ebx
lea eax, [ebp + 8]
push eax
mov dword [ecx], 0x4c0f30
mov dword [ecx + 0x28], 0x4c0ed0
call fcn.00408e82
call fcn.004436c9
add esp, 0x30
cmp eax, 0xffffffff
je 0x441ddd
test byte [ebp + 0x38], 4
je 0x441dcf
test al, 0x10
je 0x441dd9
test byte [ebp + 0x38], 8
je 0x441d8d
test al, 0x10
je 0x441d8d
mov bl, 1
jmp 0x441d8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x441f11
cmp esi, 3
je 0x441f11
cmp esi, 5
jne 0x441ec5
lea ecx, [ebp - 0xcc]
call fcn.0043e9ab
or dword [ebp - 0xd0], 0xffffffff
lea eax, [ebp - 0xcc]
push eax
sub esp, 0x30
mov ecx, esp
push ebx
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 2
mov dword [ecx], 0x4c0f30
mov dword [ecx + 0x28], 0x4c0ed0
call fcn.00408e82
call fcn.004430a3
mov esi, eax
add esp, 0x34
cmp esi, 0xffffffff
je 0x441e9c
lea ecx, [ebp - 0xd0]
call fcn.004238e0
test byte [ebp + 0x38], 4
mov dword [ebp - 0xd0], esi
je 0x441e68
test byte [ebp - 0xcc], 0x10
je 0x441e77
test byte [ebp + 0x38], 8
je 0x441e79
test byte [ebp - 0xcc], 0x10
je 0x441e79
mov bl, 1
lea ecx, [ebp - 0xd0]
call fcn.004238e0
lea ecx, [ebp - 0x70]
call fcn.00401b80
lea ecx, [ebp - 0xa0]
call fcn.00401b80
jmp 0x441d8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0xd0]
mov esi, eax
call fcn.004238e0
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], bl
call fcn.00401b80
lea ecx, [ebp - 0xa0]
call fcn.00401b80
test byte [ebp + 0x38], 0x20
je 0x441d8d
push ebx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x4ac9c4
mov dword [ebp - 0x18], 0x4ac9cc
call fcn.00408e82
push 1
push esi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 3
call fcn.00416a83
push 0x4c7b58
lea eax, [ebp - 0x90]
push eax
call fcn.00458eae
lea ecx, [ebp + 8]
call fcn.00401b80
xor al, al
call fcn.0045a498
ret
Function at 0x444b32
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4d5e88]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x4b4404
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x444b68
push 0x4b4420
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x444b68
call eax
jmp 0x444c1d
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x14]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push str..DefaultControl_PaneldesktopResourceLocale
push SysReAllocStringLen
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 0xa
call esi
test eax, eax
jne 0x444bb2
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 0x4c0d0c
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x444bfe
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push ebx
push str..DEFAULTControl_PanelInternational
push SysReAllocStringLen
mov dword [ebp - 0x18], ebx
call esi
mov esi, eax
test esi, esi
jne 0x444beb
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push str.Locale
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
lea ecx, [ebp - 0x18]
call fcn.0043303c
test esi, esi
je 0x444bfe
mov esi, 0x409
jmp 0x444c10
push 0x10
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.004605f2
add esp, 0xc
movzx esi, ax
lea ecx, [ebp - 0x14]
call fcn.0043303c
mov ax, si
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00458e9f
leave
ret
Function at 0x445213
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4d5e88]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ecx, ecx
push esi
mov esi, dword [ebp + 0xc]
mov dword [eax], ecx
lea eax, [ebp - 0x118]
push eax
mov dword [esi], ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x108], ebx
jne 0x4452a2
mov eax, dword [ebp - 0x110]
test eax, eax
je 0x445295
cmp eax, 0xa
je 0x445274
cmp eax, 0x5a
je 0x44526c
xor ebx, ebx
mov dword [esi], 0x80
jmp 0x44529b
call fcn.00445d69
test al, al
mov al, bl
je 0x44528a
mov dword [esi], 0x80
jmp 0x445328
mov dword [esi], 0x40
jmp 0x445328
mov dword [esi], 0x10
mov al, bl
jmp 0x445328
cmp dword [ebp - 0x108], 2
jne 0x445326
mov ecx, dword [ebp - 0x114]
sub ecx, 4
je 0x44531b
mov eax, dword [ebp - 0x110]
dec ecx
je 0x4452ce
dec ecx
jne 0x445311
test eax, eax
jne 0x4452f3
mov dword [esi], 0x1000000
jmp 0x44529b
test eax, eax
jne 0x4452da
mov dword [esi], 0x100000
jmp 0x44529b
cmp eax, ebx
jne 0x4452e6
mov dword [esi], 0x400000
jmp 0x44529b
cmp eax, 2
jne 0x4452c2
mov dword [esi], 0x800000
jmp 0x44529b
cmp eax, ebx
jne 0x4452ff
mov dword [esi], 0x2000000
jmp 0x44529b
cmp eax, 2
jne 0x44530c
mov dword [esi], 0x4000000
jmp 0x44529b
cmp eax, 3
je 0x445313
xor ebx, ebx
mov dword [esi], 0x8000000
jmp 0x44529b
mov dword [esi], 0x10000
jmp 0x44529b
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00458e9f
leave
ret
Function at 0x4465c5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x38
mov eax, 0x4a6432
call fcn.0045a4e9
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
push dword [eax]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
push ecx
and esi, 0xf
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4465f1
mov al, 1
jmp 0x44660d
xor ecx, ecx
movzx edx, word [eax]
add eax, 2
test dx, dx
je 0x446605
cmp ecx, esi
je 0x446613
lea eax, [eax + edx*2]
inc ecx
cmp ecx, 0x10
jl 0x4465f3
xor al, al
call fcn.0045a498
ret
push 1
lea ecx, [ebp - 0x41]
push ecx
push edx
push eax
lea ecx, [ebp - 0x40]
call fcn.004091f0
and dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.004095e2
lea ecx, [ebp - 0x40]
call fcn.00401b80
jmp 0x4465ed

Function at 0x4478ea
Capabilities:
Enumerate process modules

Disassembly:
push 0x4a0
mov eax, 0x4a65fc
call fcn.0045a4e9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x488], eax
lea eax, [ebp - 0x484]
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
call sub.PSAPI.DLL_EnumProcesses
push str.NtQueryInformationProcess
push str.Ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x447a42
xor edi, edi
cmp dword [ebp - 0x484], edi
jbe 0x447a42
push dword [ebp + edi*4 - 0x410]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x480], esi
and dword [ebp - 4], 0
test esi, esi
je 0x447a26
push 0x18
lea eax, [ebp - 0x4a4]
push 0
push eax
call fcn.00458f10
add esp, 0xc
lea eax, [ebp - 0x48c]
push eax
push 0x18
lea eax, [ebp - 0x4a4]
push eax
push 0
push esi
call ebx
test eax, eax
js 0x447a26
cmp dword [ebp - 0x494], 0
je 0x447a26
lea ecx, [ebp - 0x444]
call fcn.0043ea40
mov eax, dword [ebp - 0x490]
push 0x4c0d0c
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x444], eax
call fcn.00406a00
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x478]
call fcn.0043ea11
mov ecx, dword [ebp - 0x488]
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x4ac]
push eax
mov byte [ebp - 4], 2
call fcn.00445c3a
lea ecx, [ebp - 0x474]
call fcn.00401b80
lea ecx, [ebp - 0x440]
call fcn.00401b80
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x480]
call fcn.00405170
inc edi
cmp edi, dword [ebp - 0x484]
jb 0x447949
call fcn.0045a498
ret