joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4428a0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x2c], 0
mov dword [ebp - 0x1c], edi
jne 0x4428da
pop edi
mov eax, 0x3f0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push 2
push dword [ebx + 0x24]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [ebp - 8]
test eax, eax
jne 0x442913
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret 4
push esi
push eax
call fcn.0041c49f
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], esi
push eax
push dword [ebp - 8]
push esi
push 2
push dword [ebx + 0x24]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x44295b
push esi
call fcn.0041c2b1
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret 4
xor ebx, ebx
mov dword [ebp - 0x14], ebx
cmp dword [esi], ebx
jbe 0x442a61
mov eax, dword [ebp - 0x10]
add esi, 4
nop
test dword [esi + 4], 0xc0000020
jne 0x442a4f
xor al, al
mov byte [ebp - 9], al
test edi, edi
je 0x4429f4
mov ebx, dword [edi]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov eax, 0x78787879
mov ecx, dword [edi + 4]
sub ecx, ebx
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4429ee
xor edi, edi
nop word [eax + eax]
push dword [esi]
lea ecx, [edi + ebx]
call fcn.00408ba0
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x442a38
mov eax, dword [ebp - 0x1c]
add edi, 0x44
inc dword [ebp - 0x18]
mov ecx, dword [eax + 4]
mov ebx, dword [eax]
sub ecx, ebx
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x18], eax
jb 0x4429b0
mov edi, dword [ebp - 0x1c]
mov al, byte [ebp - 9]
mov ebx, dword [ebp - 0x14]
test al, al
jne 0x442a4c
push dword [esi]
lea ecx, [ebp - 0x64]
call fcn.004110b0
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + 0x1c]
cmp ecx, dword [edx + 0x20]
je 0x442a3f
movups xmm0, xmmword [ebp - 0x64]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [ebp - 0x54]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [ebp - 0x44]
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [ebp - 0x34]
movups xmmword [ecx + 0x30], xmm0
mov eax, dword [ebp - 0x24]
mov dword [ecx + 0x40], eax
add dword [edx + 0x1c], 0x44
jmp 0x442a4c
mov edi, dword [ebp - 0x1c]
mov al, 1
jmp 0x4429f1
lea eax, [ebp - 0x64]
push eax
push ecx
lea ecx, [edx + 0x18]
call fcn.00442500
mov eax, dword [ebp - 0x10]
inc ebx
add esi, 8
mov dword [ebp - 0x14], ebx
cmp ebx, dword [eax]
jb 0x442970
mov esi, dword [ebp - 0x10]
push esi
call fcn.0041c2b1
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop esi
pop edi
pop ebx
call fcn.00401682
mov esp, ebp
pop ebp
ret 4
Function at 0x442a80
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
cmp byte [eax + 0x2c], 0
mov dword [ebp - 0x18], ebx
jne 0x442ab8
mov eax, 0x3f0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push 0
push 0
push 3
push dword [eax + 0x24]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x442af0
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret 4
push esi
push eax
call fcn.0041c49f
add esp, 4
mov esi, eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x24], esi
push eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
push esi
push 3
push dword [eax + 0x24]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x442b3a
push esi
call fcn.0041c2b1
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret 4
cmp dword [esi], 0
mov dword [ebp - 0x20], 0
jbe 0x442c0f
add esi, 4
push edi
nop
test ebx, ebx
je 0x442bcd
mov edi, dword [ebx]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, 0x2aaaaaab
mov ecx, dword [ebx + 4]
sub ecx, edi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x442bcd
xor ebx, ebx
xorps xmm0, xmm0
lea eax, [ebx + edi]
movlpd qword [ebp - 0xc], xmm0
cmp dword [eax + 0x14], 8
jb 0x442b88
mov eax, dword [eax]
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esi + 4]
cmp eax, dword [ebp - 8]
jne 0x442ba4
mov eax, dword [esi]
cmp eax, dword [ebp - 0xc]
je 0x442bf4
mov eax, dword [ebp - 0x18]
add ebx, 0x18
inc dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov edi, dword [eax]
sub ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x14], eax
jb 0x442b75
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xc
mov edx, dword [ecx + 4]
cmp edx, dword [ecx + 8]
je 0x442beb
mov eax, dword [esi]
mov dword [edx], eax
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
add dword [ecx + 4], 8
jmp 0x442bf7
push esi
push edx
call fcn.00442c30
jmp 0x442bf7
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
add esi, 0xc
mov ecx, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [ecx]
jb 0x442b50
mov esi, ecx
pop edi
push esi
call fcn.0041c2b1
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop esi
pop ebx
call fcn.00401682
mov esp, ebp
pop ebp
ret 4
Function at 0x443170
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
mov dword [ebp - 0x24], eax
xor bl, bl
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x2c], ecx
push eax
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], ebx
push eax
push 0
push 0
push 4
push 6
push ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x4432cb
push edi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x28], edi
test edi, edi
je 0x4432ca
push 2
mov dword [ebp - 8], eax
xorps xmm0, xmm0
push 0xc
lea eax, [ebp - 0x10]
movq qword [ebp - 0x10], xmm0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x4432ca
push esi
mov esi, dword [ebp - 0xc]
add esi, 8
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4432c6
push 2
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x4432bf
mov eax, dword [ebp - 0x10]
xor esi, esi
test eax, eax
je 0x443294
nop word [eax + eax]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x443291
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x443291
cmp byte [ecx], 0
mov edi, ecx
jne 0x44326f
mov ecx, dword [ebp - 0x24]
call fcn.00408ba0
push eax
lea eax, [edi + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x443284
mov ecx, dword [ebp - 0x14]
movzx eax, word [edi + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x443291
mov eax, dword [ebp - 0x10]
inc esi
mov edi, dword [ebp - 0x28]
cmp esi, eax
jb 0x443230
jmp 0x443294
mov eax, dword [ebp - 0x10]
cmp esi, eax
jne 0x4432bf
push 0
push ebx
push 0
push 0
push 4
push 6
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov ecx, dword [ebp - 0x20]
test eax, eax
movzx ecx, cl
mov edx, 1
cmove ecx, edx
mov dword [ebp - 0x20], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [ebp - 0x20]
pop esi
pop edi
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4432d9
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00401682
mov esp, ebp
pop ebp
ret
Function at 0x445380
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x1c], eax
xor bl, bl
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x15], bl
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
test eax, eax
je 0x4454bb
mov dword [eax], 0
test edi, edi
je 0x4454bb
push 2
push 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
push edi
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x4454bb
push esi
mov esi, dword [ebp - 0xc]
add esi, 8
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4454a7
push 2
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x4454a0
mov eax, dword [ebp - 0x10]
xor esi, esi
test eax, eax
je 0x445484
nop word [eax + eax]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x445481
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x445481
cmp byte [ecx], 0
mov edi, ecx
jne 0x44545f
mov ecx, dword [ebp - 0x1c]
call fcn.00408ba0
push eax
lea eax, [edi + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x445474
mov ecx, dword [ebp - 0x14]
movzx eax, word [edi + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x445481
mov eax, dword [ebp - 0x10]
inc esi
mov edi, dword [ebp - 0x20]
cmp esi, eax
jb 0x445420
jmp 0x445484
mov eax, dword [ebp - 0x10]
cmp esi, eax
jne 0x4454a0
mov ecx, dword [ebp - 0x24]
mov al, 1
pop esi
pop edi
mov dword [ecx], ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, byte [ebp - 0x15]
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.00401682
mov esp, ebp
pop ebp
ret
Function at 0x445f10
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push esi
push 0x20019
push 0
push eax
push ecx
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x445f72
push eax
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x445f7a
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], 0
jmp 0x445fb0
mov eax, dword [ebp - 8]
mov edx, dword [esi]
dec eax
mov dword [esi + 4], eax
test edx, edx
je 0x445fb0
test eax, eax
js 0x445fb0
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], 0x104
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 8]
push ecx
lea ecx, [esi + 8]
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x445fb6
xor eax, eax
mov word [esi + 8], ax
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00401682
mov esp, ebp
pop ebp
ret 8
Function at 0x44dbc0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor ecx, ecx
mov esi, 0x5f38fc
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x44dc16
push 0x58f240
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x44dc02
push 0x58f240
call fcn.0042ec60
add esp, 4
test eax, eax
je 0x44dc16
push str.SystemFunction036
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [esi], ecx
mov dword [ebp - 8], 0
xor ecx, ecx
xor eax, eax
lock cmpxchg dword [esi], ecx
mov esi, eax
test esi, esi
je 0x44dc51
push 4
lea eax, [ebp - 8]
mov ecx, esi
push eax
call dword [0x5817c0]
call esi
test al, al
je 0x44dc51
mov eax, dword [ebp - 8]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
call fcn.0044d7bb
add esp, 4
test eax, eax
jne 0x44dc7a
mov eax, dword [ebp - 0xc]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0054bcaf
add esp, 4
call fcn.0054bc8e
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401682
mov esp, ebp
pop ebp
ret
Function at 0x451fc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
push ebx
mov ebx, ecx
jne 0x451ff2
cmp dword [ebx + 8], 0
jne 0x452024
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret 4
push 0
push 0x402240
push 1
push str.NtMapViewOfSection
push 0x593680
call fcn.0044eb60
push 1
push 0x404fa0
push 1
push str.NtUnmapViewOfSection
push 0x593680
mov ecx, ebx
call fcn.0044eb60
mov eax, dword [ebx]
push esi
push 1
push 0x2000
mov eax, dword [eax]
push 0x10000
push 0
push eax
mov dword [ebp - 0x64], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, dword [ebx + 8]
shl esi, 6
add esi, 0x50
mov dword [ebp - 0x68], eax
cmp esi, 0x10000
jbe 0x45205a
call fcn.004014a0
push edi
mov edi, 0x10000
sub edi, esi
lea eax, [ebp - 8]
push eax
call fcn.0044d7bb
movzx ecx, word [ebp - 8]
add esp, 4
mov dword [ebp - 8], ecx
cmp ecx, edi
ja 0x452062
mov eax, 0x800
mov edi, 0x1000
cmp esi, eax
ja 0x45208f
mov edi, eax
shr eax, 1
cmp eax, esi
jae 0x452087
neg edi
and edi, ecx
mov ecx, dword [ebp - 0x68]
mov eax, edi
and edi, 0xfff
and eax, 0xfffff000
add ecx, eax
lea eax, [esi + 0xfff]
push 0x40
push 0x1000
and eax, 0xfffff000
push eax
push ecx
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
test eax, eax
jne 0x4520d1
call fcn.004014a0
mov eax, dword [ebp - 0x68]
add edi, eax
jne 0x4520eb
lea eax, [edi + 7]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret 4
push 0x4e0
push 0
push 0x5f3ae0
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x5c], 0x10
call fcn.0053f340
add esp, 0xc
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push esi
push edi
call fcn.004521a0
test eax, eax
jne 0x45218a
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x10
lea eax, [ebp - 0x60]
push eax
push edi
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x452185
cmp dword [ebp - 0xc], 0x10
jne 0x452185
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x20
push esi
push edi
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebx]
push 0
push 0x4e0
push 0x5f3ae0
push str.g_originals
call fcn.0044dca0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret 4
mov eax, 0x2a
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401682
mov esp, ebp
pop ebp
ret 4
Function at 0x453b30
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0053f340
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x101
ja 0x453b94
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x453b94
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
Function at 0x45b1a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x418], esi
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5f4760]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5f4110]
cmp eax, dword [ecx + 4]
jg 0x45b2ca
cmp byte [0x5f410c], 0
jne 0x45b2ad
lea eax, [ebp - 0x420]
mov byte [0x5f410c], 1
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAeDebug
push 0x80000002
mov dword [ebp - 0x420], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45b2ad
push 0x410
push eax
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x414]
push eax
call fcn.0053f340
add esp, 0xc
mov dword [ebp - 0x41c], 0x410
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push str.Debugger
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45b2a1
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45b280
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
mov ecx, 0x5ed980
call fcn.00408f30
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x5ed980
mov ecx, esi
call fcn.0040a1e0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00401682
mov esp, ebp
pop ebp
ret
push 0x5f4110
call fcn.00410499
add esp, 4
cmp dword [0x5f4110], 0xffffffff
jne 0x45b1dd
push 0x57f7d0
call fcn.00405ffc
push 0x5f4110
call fcn.00410720
add esp, 8
jmp 0x45b1dd
Function at 0x45da40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x571870
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor bl, bl
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
cmp dword [esi + 0x10], 0
je 0x45dbb8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x45da8d
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45dbb8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x45daa6
mov eax, dword [esi]
push eax
call dword [sym.imp.SHELL32.dll_PathIsExe]
test eax, eax
je 0x45dbb8
push 0
push str.ime_shared
lea eax, [ebp - 0x40]
push 0x25
push eax
call fcn.0042f230
push 0
push str.ime_shared
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push 0x24
push eax
call fcn.0042f230
mov ebx, dword [ebp - 0x44]
lea eax, [ebp - 0x40]
push ebx
push edi
push esi
push eax
mov byte [ebp - 4], 1
call fcn.0045dbe0
add esp, 0x30
test al, al
jne 0x45db20
push ebx
push edi
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0045dbe0
add esp, 0x10
test al, al
jne 0x45db20
push ebx
push edi
push esi
call fcn.0045f5d0
add esp, 0xc
test al, al
jne 0x45db20
xor bl, bl
jmp 0x45db22
mov bl, 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x45db60
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 2
cmp edx, 0x1000
jb 0x45db56
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45dbd6
push edx
push ecx
call fcn.00409f25
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x45dbb8
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 3
cmp edx, 0x1000
jb 0x45dbae
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45dbd6
push edx
push ecx
call fcn.00409f25
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret
call fcn.0054223b
int3
Function at 0x462520
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
cmp esi, 0x804
ja 0x46255d
je case.0x462556.1027
lea eax, [esi - 0x403]
cmp eax, 0x2a
ja case.0x462556.1032
movzx eax, byte [eax + 0x4625b0]
jmp dword [eax*4 + 0x4625a8]
cmp esi, 0xc0a
je case.0x462556.1027
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.0053f340
add esp, 0xc
lea eax, [ebp - 0x404]
push 0x200
push eax
push 3
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x462596
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00401682
mov esp, ebp
pop ebp
ret

Function at 0x463810
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56efa8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5edd38]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [edi + 0x28], 0
mov dword [ebp - 4], 0
jne 0x4638d9
mov al, byte [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov byte [edi + 0x2a], al
mov eax, dword [ebp + 0xc]
mov byte [edi + 0x28], 1
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], eax
mov dword [edi + 0x34], 0
test ecx, ecx
je 0x4638d9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov dword [edi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [edi + 0x2c], 0
mov dword [edi + 0x30], eax
je 0x4638d9
test eax, eax
je 0x4638d9
cmp byte [edi + 0x2a], 0
lea esi, [edi + 0x20]
push esi
push 0
push edi
mov ecx, 0x508350
mov dword [esi], 0
mov eax, 0x463a00
cmovne eax, ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esi], 0
mov dword [edi + 0x24], eax
je 0x4638d9
test eax, eax
je 0x4638d9
mov byte [edi + 0x29], 1
mov bl, byte [edi + 0x29]
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x466bd0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x466c6a
push str.dwmapi.dll
call fcn.0042ec60
add esp, 4
mov dword [esi + 0x20], eax
test eax, eax
je 0x466c66
push str.DwmInvalidateIconicBitmaps
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DwmSetIconicThumbnail
push dword [esi + 0x20]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DwmSetIconicLivePreviewBitmap
push dword [esi + 0x20]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DwmSetWindowAttribute
push dword [esi + 0x20]
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DwmGetWindowAttribute
push dword [esi + 0x20]
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DwmExtendFrameIntoClientArea
push dword [esi + 0x20]
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DwmDefWindowProc
push dword [esi + 0x20]
mov dword [esi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x1c], eax
mov byte [esi + 0x24], 1
pop esi
ret