joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c1b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x47ea94]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x428], 0
push 0x412
push 0
lea eax, [ebp - 0x418]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x424], 0x208
lea ecx, [ebp - 0x418]
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x42c], 0
cmp dword [ebp + 0xc], 0
jne 0x43c21d
mov eax, 0x57
jmp 0x43c3eb
lea edx, [ebp - 0x428]
push edx
push 0x20019
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
je 0x43c253
mov eax, dword [ebp - 0x420]
jmp 0x43c3eb
mov dword [ebp - 0x424], 0x208
push 0x412
push 0
lea edx, [ebp - 0x418]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x418]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x420], 0
lea ecx, [ebp - 0x424]
push ecx
mov edx, dword [ebp - 0x41c]
push edx
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0xea
jne 0x43c364
mov edx, dword [ebp - 0x42c]
add edx, 1
mov dword [ebp - 0x42c], edx
cmp dword [ebp - 0x42c], 4
jbe 0x43c2f0
mov dword [ebp - 0x420], 8
jmp 0x43c364
mov eax, dword [ebp - 0x424]
add eax, 0x209
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x41c], 0
je 0x43c332
lea ecx, [ebp - 0x418]
cmp ecx, dword [ebp - 0x41c]
je 0x43c332
mov edx, dword [ebp - 0x41c]
push edx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x424]
shl eax, 1
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x43c35f
mov dword [ebp - 0x420], 8
jmp 0x43c364
jmp 0x43c293
cmp dword [ebp - 0x420], 0
jne 0x43c387
cmp dword [ebp - 0x41c], 0
je 0x43c387
mov ecx, dword [ebp - 0x41c]
push ecx
mov ecx, dword [ebp + 0x14]
call fcn.00408a70
jmp 0x43c394
push 0x468380
mov ecx, dword [ebp + 0x14]
call fcn.00408a70
cmp dword [ebp - 0x41c], 0
je 0x43c3c5
lea edx, [ebp - 0x418]
cmp edx, dword [ebp - 0x41c]
je 0x43c3c5
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [ebp - 0x41c], 0
cmp dword [ebp - 0x428], 0
je 0x43c3e5
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045be1b
mov esp, ebp
pop ebp
ret
Function at 0x43c400
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x43c43b
jmp 0x43c464
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x43c459
jmp 0x43c464
mov dword [ebp - 8], 1
xor eax, eax
jne 0x43c414
cmp dword [ebp - 4], 0
je 0x43c47b
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x43c490
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 4
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43c4d3
xor eax, eax
jmp 0x43c522
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x43c509
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 0
je 0x43c513
xor eax, eax
jmp 0x43c522
cmp dword [ebp - 0xc], 4
je 0x43c51d
xor eax, eax
jmp 0x43c522
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x441b30
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11d8
call fcn.0045be30
mov eax, dword [0x47ea94]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xfa0
push 0
lea eax, [ebp - 0xfa4]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x11c4], 0
mov dword [ebp - 0x11c8], 0
mov dword [ebp - 0x11c0], 0
mov dword [ebp - 0x11d0], 0
push 0x214
push 0
lea ecx, [ebp - 0x11b8]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea edx, [ebp - 0x11c4]
push edx
push 0xfa0
lea eax, [ebp - 0xfa4]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x441bc2
cmp dword [ebp - 0x11c4], 0
jne 0x441bc9
xor eax, eax
jmp 0x441d51
lea ecx, [ebp - 0x11cc]
call fcn.0042de50
mov ecx, dword [ebp - 0x11c4]
shr ecx, 2
mov dword [ebp - 0x11c8], ecx
mov dword [ebp - 0x11bc], 0
jmp 0x441bfe
mov edx, dword [ebp - 0x11bc]
add edx, 1
mov dword [ebp - 0x11bc], edx
mov eax, dword [ebp - 0x11bc]
cmp eax, dword [ebp - 0x11c8]
jae 0x441d4c
mov ecx, dword [ebp - 0x11bc]
lea edx, [ebp + ecx*4 - 0xfa4]
push edx
lea eax, [ebp - 0x11d4]
push eax
mov ecx, dword [ebp + 8]
call fcn.00445490
mov ecx, dword [eax]
mov dword [ebp - 0x11cc], ecx
lea edx, [ebp - 0x11d8]
push edx
mov ecx, dword [ebp + 8]
call fcn.00430050
push eax
lea ecx, [ebp - 0x11cc]
call fcn.0042e480
movzx eax, al
test eax, eax
je 0x441c59
jmp 0x441bef
mov ecx, dword [ebp - 0x11bc]
mov edx, dword [ebp + ecx*4 - 0xfa4]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x11c0], eax
cmp dword [ebp - 0x11c0], 0
jne 0x441c88
jmp 0x441bef
mov dword [ebp - 0x11d0], 0
push 0x214
push 0
lea eax, [ebp - 0x11b8]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x11c4]
push ecx
push 4
lea edx, [ebp - 0x11d0]
push edx
mov eax, dword [ebp - 0x11c0]
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x441d30
push 0x104
lea ecx, [ebp - 0x11b0]
push ecx
push 0
mov edx, dword [ebp - 0x11c0]
push edx
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
je 0x441d30
lea eax, [ebp - 0x11b0]
push eax
call fcn.0043b6b0
add esp, 4
mov dword [ebp - 0x11b4], 0
mov ecx, dword [ebp - 0x11bc]
mov edx, dword [ebp + ecx*4 - 0xfa4]
mov dword [ebp - 0x11b8], edx
lea eax, [ebp - 0x11b8]
push eax
mov ecx, dword [ebp + 8]
call fcn.00444c70
mov ecx, 0x85
lea esi, [ebp - 0x11b8]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x11c0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x11c0], 0
jmp 0x441bef
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045be1b
mov esp, ebp
pop ebp
ret
Function at 0x441d70
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11c4
call fcn.0045be30
mov eax, dword [0x47ea94]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xfa0
push 0
lea eax, [ebp - 0x11b0]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x11bc], 0
mov dword [ebp - 0x11c0], 0
push 0x20a
push 0
lea ecx, [ebp - 0x210]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x11b4], 0
mov dword [ebp - 0x11c4], 0
cmp dword [ebp + 8], 0
je 0x441deb
mov edx, dword [ebp + 8]
movzx eax, word [edx]
test eax, eax
jne 0x441df2
xor eax, eax
jmp 0x441f4b
lea ecx, [ebp - 0x11bc]
push ecx
push 0xfa0
lea edx, [ebp - 0x11b0]
push edx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x441e17
cmp dword [ebp - 0x11bc], 0
jne 0x441e1e
xor eax, eax
jmp 0x441f4b
mov eax, dword [ebp - 0x11bc]
shr eax, 2
mov dword [ebp - 0x11c0], eax
mov dword [ebp - 0x11b8], 0
jmp 0x441e48
mov ecx, dword [ebp - 0x11b8]
add ecx, 1
mov dword [ebp - 0x11b8], ecx
mov edx, dword [ebp - 0x11b8]
cmp edx, dword [ebp - 0x11c0]
jae 0x441f49
mov eax, dword [ebp - 0x11b8]
mov ecx, dword [ebp + eax*4 - 0x11b0]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x11b4], eax
cmp dword [ebp - 0x11b4], 0
jne 0x441e86
jmp 0x441e39
mov dword [ebp - 0x11c4], 0
push 0x20a
push 0
lea edx, [ebp - 0x210]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x11bc]
push eax
push 4
lea ecx, [ebp - 0x11c4]
push ecx
mov edx, dword [ebp - 0x11b4]
push edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x441f2d
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
mov ecx, dword [ebp - 0x11b4]
push ecx
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
je 0x441f2d
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x441f2d
cmp dword [ebp + 0xc], 0
je 0x441f0f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x11b4]
mov dword [ecx], edx
jmp 0x441f1c
mov eax, dword [ebp - 0x11b4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x11b4], 0
mov eax, 1
jmp 0x441f4b
mov ecx, dword [ebp - 0x11b4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x11b4], 0
jmp 0x441e39
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045be1b
mov esp, ebp
pop ebp
ret
Function at 0x443340
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x47ea94]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x224], 0
cmp dword [0x4804f8], 0
jne 0x4433de
mov dword [ebp - 0x228], 0
push 0x20a
push 0
lea eax, [ebp - 0x210]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
jne 0x4433b8
xor eax, eax
jmp 0x443590
push str.System32wintrust.dll
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call fcn.0043ba10
add esp, 4
mov dword [0x4804f8], eax
cmp dword [0x4804f8], 0
jne 0x4433ee
xor eax, eax
jmp 0x443590
cmp dword [0x4804f4], 0
jne 0x44340e
push str.WinVerifyTrust
mov ecx, dword [0x4804f8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4804f4], eax
cmp dword [0x4804f4], 0
jne 0x44341e
xor eax, eax
jmp 0x443590
push 0x10
push 0
lea edx, [ebp - 0x23c]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x23c], 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x220], 0xaac56b
mov ecx, 0xcd44
mov word [ebp - 0x21c], cx
mov edx, 0x11d0
mov word [ebp - 0x21a], dx
mov byte [ebp - 0x218], 0x8c
mov byte [ebp - 0x217], 0xc2
mov byte [ebp - 0x216], 0
mov byte [ebp - 0x215], 0xc0
mov byte [ebp - 0x214], 0x4f
mov byte [ebp - 0x213], 0xc2
mov byte [ebp - 0x212], 0x95
mov byte [ebp - 0x211], 0xee
push 0x30
push 0
lea eax, [ebp - 0x26c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x26c], 0x30
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x260], 2
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x258], 1
mov dword [ebp - 0x250], 1
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x240], 0
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x254], ecx
lea edx, [ebp - 0x26c]
push edx
lea eax, [ebp - 0x220]
push eax
push 0xffffffffffffffff
call dword [0x4804f4]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x443564
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x250], 2
lea ecx, [ebp - 0x26c]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
call dword [0x4804f4]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045be1b
mov esp, ebp
pop ebp
ret
Function at 0x44b3f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460f1a
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x47ea94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0
push 0
push str.GetFileVersion
lea ecx, [ebp - 0x18]
call fcn.00407b80
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x44b561
lea ecx, [ebp - 0x38]
call fcn.0044bcc0
mov byte [ebp - 4], 1
push 0xffffffffffffffff
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x38]
call fcn.0044c030
movzx eax, al
test eax, eax
jne 0x44b4a6
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.0044bd00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00407aa0
mov eax, dword [ebp - 0x20]
jmp 0x44b57a
lea ecx, [ebp - 0x38]
call fcn.0041fa10
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x44b555
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x469a24
lea ecx, [ebp - 0x38]
call fcn.0041fa10
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x44b555
cmp dword [ebp - 0x10], 0
je 0x44b555
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
shr eax, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
and eax, 0xffff
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
shr eax, 0x10
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
and eax, 0xffff
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov dword [ebp - 0x24], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.0044bd00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00407aa0
mov eax, dword [ebp - 0x24]
jmp 0x44b57a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.0044bd00
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00407aa0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x44bab0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460fb5
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x47ea94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0
push 0
push str.SetIE11HomePageUnsafe
lea ecx, [ebp - 0x220]
call fcn.00407b80
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 0
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
je 0x44bb67
mov dword [ebp - 0x230], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00407aa0
mov eax, dword [ebp - 0x230]
jmp 0x44bca3
push str.ieframe.dll
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x44bbb1
mov dword [ebp - 0x234], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00407aa0
mov eax, dword [ebp - 0x234]
jmp 0x44bca3
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x218]
push edx
call fcn.0044b3f0
add esp, 0x14
test eax, eax
je 0x44bc7f
cmp dword [ebp - 0x238], 0xb
jne 0x44bc7f
cmp dword [ebp - 0x224], 0x4540
jae 0x44bc13
cmp dword [ebp - 0x228], 0x2710
jb 0x44bc27
mov eax, dword [ebp + 8]
push eax
call fcn.0044b180
add esp, 4
mov dword [ebp - 0x21c], eax
jmp 0x44bc39
mov ecx, dword [ebp + 8]
push ecx
call fcn.0044af10
add esp, 4
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x44bc5b
push 0
mov ecx, dword [ebp + 8]
call fcn.0040be60
push eax
call fcn.0044b590
add esp, 4
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x228], 0x2710
jbe 0x44bc7f
mov edx, dword [ebp + 8]
push edx
call fcn.004479b0
add esp, 4
and eax, dword [ebp - 0x21c]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00407aa0
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045be1b
mov esp, ebp
pop ebp
ret
Function at 0x44c350
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46104b
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x47ea94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x26c], ecx
push 0
push 0
push 0
push 0
push 0
push str.CalcuteMachineID::GetMachineSerialID
lea ecx, [ebp - 0x27c]
call fcn.00407b80
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x274], 0x10
lea ecx, [ebp - 0x268]
call fcn.00408ae0
mov byte [ebp - 4], 1
push 0x208
push 0
lea ecx, [ebp - 0x238]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x284], 0
push 0x46ae54
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x270], eax
push 0x46a6c4
mov edx, dword [ebp - 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x288], eax
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x44c48b
push 0x208
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x26c]
call fcn.0044c500
test eax, eax
je 0x44c48b
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x250]
push edx
mov ecx, dword [ebp - 0x26c]
call fcn.0044c790
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
push eax
mov ecx, dword [ebp + 8]
call fcn.004090e0
lea ecx, [ebp - 0x250]
call fcn.00405b50
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x26c]
call fcn.0044c600
test eax, eax
jne 0x44c4b0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [ebp - 0x280], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x268]
call fcn.00405b50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x27c]
call fcn.00407aa0
mov eax, dword [ebp - 0x280]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045be1b
mov esp, ebp
pop ebp
ret 8
Function at 0x44c500
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
push 0
push 0
push 0
push 0
push 0
push str.CalcuteMachineID::AddAccessRights
lea ecx, [ebp - 0x18]
call fcn.00407b80
push 0x208
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0x208
cmp dword [ebp - 4], 0
je 0x44c5c1
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x44c5c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x44c5c1
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0x10]
ja 0x44c5c1
cmp dword [ebp - 8], 0x80
jbe 0x44c59e
mov edx, dword [ebp - 8]
shl edx, 1
mov dword [ebp - 8], edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x44c5e1
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x18]
call fcn.00407aa0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44c600
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46107e
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x47ea94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x23c], ecx
push 0
push 0
push 0
push 0
push 0
push str.CalcuteMachineID::GetSystemVolumeSerialNumber
lea ecx, [ebp - 0x220]
call fcn.00407b80
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x44c67f
mov dword [ebp - 0x22c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00407aa0
mov eax, dword [ebp - 0x22c]
jmp 0x44c773
mov eax, dword [ebp + 8]
mov dword [eax], 0
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x44c6c5
mov dword [ebp - 0x230], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00407aa0
mov eax, dword [ebp - 0x230]
jmp 0x44c773
push 0x46ae64
lea edx, [ebp - 0x21c]
push edx
call fcn.0044f880
add esp, 8
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x44c6f4
xor eax, eax
mov ecx, dword [ebp - 0x224]
mov word [ecx + 2], ax
mov dword [ebp - 0x228], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x228]
push edx
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x44c746
mov dword [ebp - 0x234], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00407aa0
mov eax, dword [ebp - 0x234]
jmp 0x44c773
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x228]
mov dword [ecx], edx
mov dword [ebp - 0x238], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00407aa0
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045be1b
mov esp, ebp
pop ebp
ret 4