joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c040
Capabilities:
Get file version info
Read file on windows

Disassembly:
mov eax, 0x2980
call fcn.00453b40
mov eax, dword [0x46e3d0]
xor eax, esp
mov dword [esp + 0x2978], eax
push ebp
push esi
mov esi, ecx
xor ebp, ebp
cmp esi, ebp
push edi
je 0x43c248
cmp word [esi], bp
je 0x43c248
cmp ebx, ebp
je 0x43c248
push ebp
push ebp
push 3
push ebp
push 3
push SysReAllocString
push esi
mov word [ebx], bp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x43c248
push ebp
push esi
mov dword [esp + 0x20], ebp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebp
je 0x43c13a
push 0x27ff
lea eax, [esp + 0x185]
push ebp
push eax
mov byte [esp + 0x18c], 0
call fcn.00443e10
add esp, 0xc
lea ecx, [esp + 0x180]
push ecx
push edi
push ebp
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43c13a
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
push 0x46042c
lea ecx, [esp + 0x18c]
push ecx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x20], ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43c13a
mov eax, dword [esp + 0x20]
movzx edx, word [eax + 0xc]
movzx ecx, word [eax + 0xe]
push edx
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push edx
push eax
push str._d._d._d._d
push 0x78
push ebx
call fcn.0043f9ed
add esp, 0x1c
mov dword [esp + 0x18], 1
mov eax, ebx
mov word [ebx + 0xee], bp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x43c146
mov esi, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x18]
push ecx
sub eax, edx
push 0x40
lea edx, [esp + 0x14c]
push edx
sar eax, 1
push esi
mov ebp, eax
call edi
test eax, eax
je 0x43c225
cmp dword [esp + 0x14], 0x40
jne 0x43c225
mov eax, dword [esp + 0x17c]
push 0
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0xf8
lea edx, [esp + 0x54]
push edx
push esi
call edi
test eax, eax
je 0x43c225
cmp dword [esp + 0x14], 0xf8
jne 0x43c225
cmp ebp, 0x78
jae 0x43c225
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], eax
call fcn.0044190f
mov esi, eax
mov ecx, 9
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x48]
push edx
add eax, 1
push eax
add ecx, 0x76c
push ecx
mov edx, 0x78
push str.__04d__02d__02d__02d:_02d:_02d_GMT
sub edx, ebp
push edx
lea eax, [ebx + ebp*2]
push eax
call fcn.0043f9ed
mov esi, dword [esp + 0x44]
add esp, 0x28
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x2978]
xor ecx, esp
call fcn.0043ef12
add esp, 0x2980
ret
mov ecx, dword [esp + 0x2984]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0043ef12
add esp, 0x2980
ret
Function at 0x43db10
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [0x471c48]
push edi
xor edi, edi
cmp esi, edi
jne 0x43db4b
push 0x20
call fcn.0043f2d6
add esp, 4
cmp eax, edi
je 0x43db42
mov dword [eax], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x18], edi
mov dword [eax + 0x1c], edi
jmp 0x43db44
xor eax, eax
mov dword [0x471c48], eax
mov esi, eax
mov eax, dword [esi + 0x14]
cmp eax, edi
jne 0x43db57
pop edi
xor eax, eax
pop esi
ret
cmp dword [esi + 0x1c], edi
mov dword [esi + 0x18], 1
je 0x43db73
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43db7f
mov eax, dword [esi + 0x14]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x14], edi
pop edi
mov eax, 1
pop esi
ret

Function at 0x43dc60
Capabilities:
Set registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x46e3d0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x21c]
push edi
mov edi, dword [esp + 0x21c]
test edi, edi
je 0x43dd9b
test ebx, ebx
je 0x43dd9b
push 0x206
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call fcn.00443e10
push str.SOFTWARETencent_bugReport_
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.00441a94
mov eax, str.SOFTWARETencent_bugReport_
add esp, 0x18
lea edx, [eax + 2]
jmp 0x43dcd0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43dcd0
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, str.SOFTWARETencent_bugReport_
push esi
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43dcf0
sub eax, esi
mov ecx, 0x104
sub ecx, edx
sar eax, 1
push edi
push ecx
lea edx, [esp + eax*2 + 0x18]
push edx
call fcn.00441a1a
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
lea ecx, [esp + 0x1c]
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
pop esi
je 0x43dd5e
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43dd9b
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43dd63
sub eax, edx
mov edx, dword [esp + 8]
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push ebx
push 1
push 0
push str.ExtRptFile
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x43ddb4
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0043ef12
add esp, 0x210
ret
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x214]
pop edi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0043ef12
add esp, 0x210
ret
Function at 0x43de00
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x46e3d0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x21c]
push ebp
mov ebp, dword [esp + 0x224]
push edi
mov edi, dword [esp + 0x220]
test edi, edi
je 0x43dfb1
test ebx, ebx
je 0x43dfb1
push 0x206
lea eax, [esp + 0x16]
push 0
push eax
mov word [esp + 0x1c], 0
call fcn.00443e10
push str.SOFTWARETencent_bugReport_
lea ecx, [esp + 0x20]
push 0x104
push ecx
call fcn.00441a94
mov eax, str.SOFTWARETencent_bugReport_
add esp, 0x18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43de73
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, str.SOFTWARETencent_bugReport_
push esi
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43de90
sub eax, esi
mov ecx, 0x104
sub ecx, edx
sar eax, 1
push edi
push ecx
lea edx, [esp + eax*2 + 0x1c]
push edx
call fcn.00441a1a
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
lea ecx, [esp + 0x20]
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43defd
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43df74
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43df02
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push ebx
push 1
push 0
push str.InstallDir
push edx
call esi
test eax, eax
jne 0x43df69
test ebp, ebp
je 0x43df8f
cmp word [ebp], ax
je 0x43df8f
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43df40
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push ebp
push 1
push 0
push str.ExcDir
push edx
call esi
test eax, eax
je 0x43df9f
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0043ef12
add esp, 0x210
ret
mov ecx, dword [esp + 0x10]
push str.ExcDir
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x43df76
mov ecx, dword [esp + 0x218]
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0043ef12
add esp, 0x210
ret
Function at 0x43e3b0
Capabilities:
Enumerate threads

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, eax
test ebx, ebx
push esi
push edi
jne 0x43e3c4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
xor eax, eax
push eax
push 4
xor edi, edi
mov dword [esp + 0x14], 0x1c
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x43e416
cmp ebx, dword [esp + 0x18]
je 0x43e41f
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x43e401
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x43e840
Capabilities:
Link many functions at runtime

Disassembly:
push eax
mov dword [esi], vtable.CDataReport.0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi + 4], eax
je 0x43e92f
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitializeDataReport
push eax
call edi
mov ecx, dword [esi + 4]
push str.UninitalizeDataReport
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi + 4]
push str.SetClientVersion
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 4]
push str.SetClientUin
push eax
call edi
mov ecx, dword [esi + 4]
push str.ReportString
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi + 4]
push str.ReportBinary
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 4]
push str.ReportFile
push eax
call edi
mov ecx, dword [esi + 4]
push str.ReportSystemInfo
push ecx
mov dword [esi + 0x20], eax
call edi
mov edx, dword [esi + 4]
push str.ArraySetValueDW
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi + 4]
push str.ArraySetValueDB
push eax
call edi
mov ecx, dword [esi + 4]
push str.ArrayIncValueDW
push ecx
mov dword [esi + 0x2c], eax
call edi
mov edx, dword [esi + 4]
push str.ArrayIncValueDB
push edx
mov dword [esi + 0x30], eax
call edi
mov dword [esi + 0x34], eax
mov eax, dword [esi + 4]
push str.ArrayDecValueDW
push eax
call edi
mov ecx, dword [esi + 4]
push str.ArrayDecValueDB
push ecx
mov dword [esi + 0x38], eax
call edi
mov edx, dword [esi + 4]
push str.Flush
push edx
mov dword [esi + 0x3c], eax
call edi
mov dword [esi + 0x40], eax
pop edi
mov eax, esi
ret

Function at 0x43ef12
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46e3d0]
jne 0x43ef1c
repz ret
jmp fcn.00443247
Function at 0x440ad6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x440b13
cmp dword [ebp + 0x14], edi
je 0x440b13
cmp ecx, edi
jne 0x440b1a
call fcn.00441d89
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0043f797
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x440b2e
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x440b4f
cmp ebx, 0xffffffff
je 0x440b3e
push ebx
push edi
push ecx
call fcn.00443e10
add esp, 0xc
cmp esi, edi
je 0x440afb
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x440afb
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x440b6b
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x440b72
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x440c63
test word [esi + 0xc], 0x10c
je 0x440bc6
mov eax, dword [esi + 4]
test eax, eax
je 0x440bc6
jl 0x440cc4
cmp ebx, eax
mov edi, ebx
jb 0x440b97
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x440c6b
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0043ef45
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x440c5b
cmp ebx, dword [ebp - 0xc]
jb 0x440c33
cmp dword [ebp - 0xc], 0
je 0x440bf0
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x440be5
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x440bec
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x440bfb
mov eax, SysReAllocString
cmp ebx, eax
ja 0x440bfb
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x440c97
push eax
push dword [ebp - 8]
push esi
call fcn.00446fc8
pop ecx
push eax
call fcn.00449400
add esp, 0xc
test eax, eax
je 0x440cd6
cmp eax, 0xffffffff
je 0x440cc4
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x440c5b
push esi
call fcn.00448d1f
cmp eax, 0xffffffff
pop ecx
je 0x440cc8
cmp dword [ebp - 4], 0
je 0x440c97
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x440b7a
mov eax, dword [ebp + 0x14]
jmp 0x440b15
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x440c82
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00443e10
add esp, 0xc
call fcn.00441d89
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x440b0b
cmp dword [ebp + 0xc], 0xffffffff
je 0x440cad
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00443e10
add esp, 0xc
call fcn.00441d89
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x440b0b
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x440b15
or dword [esi + 0xc], 0x10
jmp 0x440cc8
Function at 0x443042
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x46e318]
je 0x44305d
inc edi
cmp edi, 0x17
jb 0x44304e
cmp edi, 0x17
jae 0x4431dd
push ebp
push 3
call fcn.0044c5ef
cmp eax, 1
pop ecx
je 0x4431a9
push 3
call fcn.0044c5ef
test eax, eax
pop ecx
jne 0x443091
cmp dword [0x46e070], 1
je 0x4431a9
cmp ebx, 0xfc
je 0x4431dc
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x470030
push ebp
call fcn.00444c95
add esp, 0xc
test eax, eax
je 0x4430c7
push esi
push esi
push esi
push esi
push esi
call fcn.0043f69b
add esp, 0x14
push 0x104
mov esi, 0x470049
push esi
push 0
mov byte [0x47014d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x44310b
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00444c95
add esp, 0xc
test eax, eax
je 0x44310b
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0043f69b
add esp, 0x14
push esi
call fcn.00444d00
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x443150
push esi
call fcn.00444d00
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x470344
push 0x45db8c
sub ecx, eax
push ecx
push eax
call fcn.0044c53c
add esp, 0x14
test eax, eax
je 0x443150
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0043f69b
add esp, 0x14
jmp 0x443152
xor esi, esi
push 0x45db88
push ebx
push ebp
call fcn.0044c4cb
add esp, 0xc
test eax, eax
je 0x443172
push esi
push esi
push esi
push esi
push esi
call fcn.0043f69b
add esp, 0x14
push dword [edi*8 + 0x46e31c]
push ebx
push ebp
call fcn.0044c4cb
add esp, 0xc
test eax, eax
je 0x443194
push esi
push esi
push esi
push esi
push esi
call fcn.0043f69b
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0044c30e
add esp, 0xc
jmp 0x4431dc
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4431dc
cmp ebp, 0xffffffff
je 0x4431dc
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x46e31c]
push dword [esi]
call fcn.00444d00
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x44c30e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004442cf
xor ebx, ebx
cmp dword [0x470930], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x44c3e4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x44c4c4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x44c4c4
push eax
call fcn.00444261
mov dword [esp], 0x45df34
push edi
mov dword [0x470930], eax
call esi
push eax
call fcn.00444261
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x470934], eax
call esi
push eax
call fcn.00444261
mov dword [0x470938], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00442dcf
test eax, eax
pop ecx
pop ecx
je 0x44c3b2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043f69b
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x44c3e4
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00444261
cmp eax, ebx
pop ecx
mov dword [0x470940], eax
je 0x44c3e4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00444261
pop ecx
mov dword [0x47093c], eax
mov eax, dword [0x47093c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x44c469
cmp dword [0x470940], ecx
je 0x44c469
push eax
call fcn.004442d8
push dword [0x470940]
mov esi, eax
call fcn.004442d8
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x44c469
cmp edi, ebx
je 0x44c469
call esi
cmp eax, ebx
je 0x44c436
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44c436
test byte [ebp - 0x18], 1
jne 0x44c469
lea eax, [ebp - 0x10]
push eax
call fcn.00442e06
test eax, eax
pop ecx
je 0x44c451
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043f69b
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x44c460
or dword [ebp + 0x10], 0x200000
jmp 0x44c4a4
or dword [ebp + 0x10], 0x40000
jmp 0x44c4a4
mov eax, dword [0x470934]
cmp eax, dword [ebp - 8]
je 0x44c4a4
push eax
call fcn.004442d8
cmp eax, ebx
pop ecx
je 0x44c4a4
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x44c4a4
mov eax, dword [0x470938]
cmp eax, dword [ebp - 8]
je 0x44c4a4
push eax
call fcn.004442d8
cmp eax, ebx
pop ecx
je 0x44c4a4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x470930]
call fcn.004442d8
cmp eax, ebx
pop ecx
je 0x44c4c4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44c4c6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4558d0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x46e3d0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0045580f
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00443e10
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x45591f
cmp dword [ebp - 0x1c], 5
jb 0x455937
jmp 0x455933
cmp dword [ebp - 0x10], 1
jne 0x455937
cmp dword [ebp - 0x1c], 4
ja 0x455933
jne 0x455937
cmp dword [ebp - 0x18], 0
jbe 0x455937
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x45f8b8
call fcn.004556a5
test eax, eax
jge 0x455958
mov byte [0x4728e8], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043ef12
add ebp, 0x78
leave
ret
Function at 0x40e370
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4700eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004649b6
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40e3f2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004628cd
mov eax, dword [eax]
push 0x5541c0
push eax
call fcn.00455744
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00464c41
test bl, bl
je 0x40e3f2
push 0x5541c0
lea ecx, [esp + 0xc]
call fcn.00464fd1
push 0x557d3c
lea ecx, [esp + 0xc]
call fcn.00464fd1
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40e42e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00464c41
jmp 0x40e4f9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40e4b2
lea edx, [esp + 0x7c]
push 0x557d38
push edx
call fcn.00455744
add esp, 8
test eax, eax
je 0x40e4b2
lea eax, [esp + 0x7c]
push 0x557d34
push eax
call fcn.00455744
add esp, 8
test eax, eax
je 0x40e4b2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e442
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00464c41
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40ed10
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40ed72
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc