joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4387be
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x438962
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x438849
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x438824
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x438844
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x438844
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
jmp 0x438960
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x438915
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x438891
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 2
jg 0x438913
push 2
lea ecx, [ebp - 0x6c]
call fcn.00431d6e
mov dword [ebp - 0x10], 0
jmp 0x4388b3
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x4388cc
push dword [ebp - 0x10]
lea ecx, [ebp - 0x6c]
call fcn.00431e5c
mov dword [eax], 0xfff8
jmp 0x4388ac
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4388ee
push 0
push 0
push 0x906
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
lea ecx, [ebp - 0x6c]
call fcn.00431e5c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
lea ecx, [ebp - 0x6c]
call fcn.00431e40
jmp 0x438886
jmp 0x438960
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x438943
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 4
jge 0x438960
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x60]
call fcn.00431e5c
mov dword [eax], 0x84edc02
jmp 0x438938
jmp 0x438973
push 1
push 0
push 0x17d1
call fcn.0045685e
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x43ffa2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x43ffd4
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x18], eax
push 0
push dword [ebp - 0x18]
push 0x4fb2
push 0xc74
push 1
call fcn.00450ff8
add esp, 0x14
jmp 0x440155
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x44003f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 1
push 0x52c2
push 0x55a8
call fcn.0043e6f5
add esp, 0x14
jmp 0x440155
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x44008d
push 0x1c86
push 0
push 0x204c
push 0x2121
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x440155
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x78], eax
push 0
mov ecx, dword [ebp - 4]
call fcn.00431e5c
mov eax, dword [ebp - 0x74]
mov dword [eax], 9
push 0
mov ecx, dword [ebp - 4]
call fcn.00431e5c
cmp dword [eax], 9
jg 0x4400f9
mov eax, dword [ebp - 0x78]
cmp dword [eax], 0
jne 0x4400f9
and dword [ebp - 8], 0
jmp 0x440100
mov dword [ebp - 8], 1
push 0
mov ecx, dword [ebp - 0xc]
call fcn.00431e5c
mov eax, dword [eax]
cmp eax, dword [ebp - 8]
jg 0x44011a
mov dword [ebp - 0x10], 1
jmp 0x44011e
and dword [ebp - 0x10], 0
push 0
mov ecx, dword [ebp - 4]
call fcn.00431e5c
push dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.00431e5c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x10]
jge 0x440142
mov dword [ebp - 0x14], 1
jmp 0x440146
and dword [ebp - 0x14], 0
push 0
mov ecx, dword [ebp - 0x7c]
call fcn.00431e5c
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x450da8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x450e95
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x450e0c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 1
call fcn.00450f7a
add esp, 0xc
jmp 0x450e90
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x450e75
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x450e56
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x450e73
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.00431e5c
mov dword [eax], 0x57b790eb
jmp 0x450e4b
jmp 0x450e90
push 0x1c86
push 0
push 0x204c
push 0x2121
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x450f76
lea eax, [ebp + 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x44]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x450f0d
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push 0x95b
push 0x31db
push 0x5c54
push 0x7950
push 0x5d2b
push 0x68ab
push 0xeb1
push dword [ebp - 0x48]
push 1
call fcn.00436c73
add esp, 0x24
jmp 0x450f76
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x80], eax
push dword [ebp - 0x68]
push 0x7f60
push 0x1e5e
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push 0x238
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push 0x722a
push 1
push dword [ebp - 0x7c]
push 0x48bf
push 0x3aae
push 0
push dword [ebp - 0x80]
call fcn.00433845
add esp, 0x3c
mov esp, ebp
pop ebp
ret
Function at 0x452f10
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x452f3f
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
push 1
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
push 0x33ef
call fcn.00453020
add esp, 0xc
jmp 0x45301c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x452f94
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 0x49af
push 1
push 0x7671
push dword [ebp - 0x14]
push 0x5740
call fcn.0044d209
add esp, 0x14
jmp 0x45301c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x453000
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x452fe4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x452ffe
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.00431e5c
and dword [eax], 0
jmp 0x452fd9
jmp 0x45301c
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x45301c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov esp, ebp
pop ebp
ret
Function at 0x453376
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4534e0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x45347f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x453435
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x453416
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x453433
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.00431e5c
mov dword [eax], 3
jmp 0x45340b
jmp 0x45347d
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x453463
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 3
jge 0x45347d
mov eax, dword [ebp - 0xc]
push dword [eax]
mov ecx, dword [ebp - 0x50]
call fcn.00431e5c
or dword [eax], 0xffffffff
jmp 0x453458
jmp 0x4534de
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
push 0x1c8f
push 1
push 0x65a0
push 0
push 0x1559
push 0x6898
push 0x7ec9
push 0x5ed4
push 0x15f2
push 0x5838
push dword [ebp - 0x58]
push 0x2813
push 0x75fe
push 1
push 0x3a3f
push 0x7ea8
push 0x6e2a
push 1
push 0x12e2
call fcn.0045609a
add esp, 0x4c
jmp 0x45353e
lea eax, [ebp + 0x10]
mov dword [ebp - 0x60], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax]
test eax, eax
je 0x453500
push 1
call fcn.00441a00
pop ecx
jmp 0x45353e
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
movzx eax, byte [eax]
test eax, eax
je 0x45352d
push 0x1c86
push 0
push 0x204c
push 0x2121
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x45353e
mov byte [ebp - 1], 0
push 0
lea eax, [ebp - 1]
push eax
call fcn.00454d9b
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x453d50
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x453dff
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x453dc8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x453dae
mov byte [ebp - 1], 0
push 1
push 0
lea eax, [ebp - 1]
push eax
push 1
push 1
call fcn.00453c2e
add esp, 0x14
jmp 0x453dc6
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x453dc6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x453dfa
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 0x499f
push 0
push 0x6c77
push 0x186f
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 1
push 0x3ae7
call fcn.00443015
add esp, 0x20
jmp 0x453e84
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x453e48
push 0x157e
push 0x4d23
push 0x3715
push 0
call fcn.00454888
add esp, 0x10
jmp 0x453e84
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x3c]
push 0x1ae8
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 0
push dword [ebp - 0x4c]
call fcn.0043e06a
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x459037
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x459116
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4590c5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4590ae
mov byte [ebp - 1], 0
push 0x7fdf
push 1
lea eax, [ebp - 1]
push eax
push 0
push 1
push 0x706b
push 0x6d7b
call fcn.00446d08
add esp, 0x1c
jmp 0x4590c3
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], 1
jmp 0x459111
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x2c]
push 1
push 1
push 0x77a5
push 0x558a
push dword [ebp - 0x30]
push 0xab1
push 0x3421
push 0x6f94
push 1
push 0
push 0x7990
push 1
push 0x1e5a
push 0x3c4e
call fcn.0044ef24
add esp, 0x3c
jmp 0x45920c
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x4591d7
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x4591b2
mov byte [ebp - 2], 0
push 0x1a52
push 0
push 0x739c
push 0x3028
push 0x5c38
push 1
push 0x2292
push 0x6b5c
push 0x422a
push 0x3bf4
push 0x81d
push 0x6024
push 0x7818
push 0x14b5
push 0x35f6
push 0x8d4
lea eax, [ebp - 2]
push eax
push 1
push 1
call fcn.0045a1e9
add esp, 0x4c
jmp 0x4591d5
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x4591d5
push 0x35c
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
jmp 0x45920c
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x459202
push 0
push 0
push 0
push 0
push 0
push 0
push 0x482
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x45920c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
mov esp, ebp
pop ebp
ret
Function at 0x4596df
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x459866
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x459820
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4597fb
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x1c], 0xa60d0058
mov dword [ebp - 0x18], 0
push 3
lea ecx, [ebp - 0x5c]
call fcn.00431d6e
push 0x7387
push 1
push 0
push 0x4691
push 1
push 0
push 0x41be
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x5c]
push eax
push 1
push 0x531a
call fcn.004536db
add esp, 0x2c
lea eax, [ebp - 0x14]
push eax
push 0x6f6
push 0x24bc
push 0x2de4
lea eax, [ebp - 0x18]
push eax
push 1
push 0x7752
lea eax, [ebp - 0x5c]
push eax
push 0
push 1
push 0x66aa
push 1
push 1
lea eax, [ebp - 0x1c]
push eax
push 0xa0c
call fcn.0044fe70
add esp, 0x3c
push 1
push 0xa24
push 0x61f5
push 0x3670
push 1
push 1
push 0x5467
push 0x1a12
push 0x59b9
push 1
push 0x7399
call fcn.0044674b
add esp, 0x2c
lea ecx, [ebp - 0x5c]
call fcn.00431e40
jmp 0x45981e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x45981e
push 0
push 0x2386
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x459864
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push 0x528e
push 0x1366
push 1
push 0x3394
push 0
push 0x2d97
push 0x521
push 0x30a5
push 0x7d03
push 0x2c1c
push 1
push dword [ebp - 0x30]
push 0x59d1
call fcn.0043c5f3
add esp, 0x34
jmp 0x4598cd
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x4598a7
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push 0x6389
push 0x43a2
push 1
call fcn.004359a7
add esp, 0x10
jmp 0x4598cd
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
push 0
push dword [ebp - 0x4c]
push 0x59f9
push 0x6f1
call fcn.00436d4d
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x488d31
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret