joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431240
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [ecx + 4]
mov edx, 8
cmp esi, edx
lea eax, [ecx + 8]
pop esi
jbe 0x43127b
push ebp
xor dword [eax], 0xf05643b7
xor dword [eax + 4], 0x3759814b
xor dword [eax + 8], 0x93aad9e1
xor dword [eax + 0xc], 0x903622a2
mov ebp, dword [ecx + 4]
add edx, 0x10
cmp edx, ebp
lea eax, [edx + ecx]
jb 0x431252
pop ebp
ret

Function at 0x432590
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, dword [esp + 0x1c]
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4325fe
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
test eax, eax
je 0x4325f7
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x4325f7
lea edx, [esp + 8]
push edx
push 0
mov eax, edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x28]
and ecx, 0x27
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
add esp, 0x10
ret

Function at 0x4326b0
Capabilities:
Check for time delay via gettickcount
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x43272c
mov eax, dword [esi + 4]
push ebx
push ebp
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebx, eax
call edi
mov ebp, dword [esp + 0x14]
sub eax, ebx
cmp eax, ebp
jae 0x4326f7
lea ecx, [ecx]
mov eax, dword [esi + 8]
test eax, eax
je 0x432729
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
sub eax, ebx
cmp eax, ebp
jb 0x4326e0
lea edi, [esi + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 8]
test eax, eax
je 0x432722
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebp
pop ebx
pop esi
ret 4
Function at 0x4328f0
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x20
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
push ebx
mov dword [esp + 0x18], eax
push esi
mov dword [esp + 0x20], eax
push edi
mov edi, dword [esp + 0x30]
mov word [esp + 0x28], ax
mov eax, dword [edi + 0x14]
add eax, 2
xor ebx, ebx
push eax
mov dword [esp + 0x10], ebx
call fcn.004683cd
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x432989
cmp dword [edi + 0x18], 0x10
mov ecx, dword [edi + 0x14]
jb 0x432942
mov eax, dword [edi + 4]
jmp 0x432945
lea eax, [edi + 4]
add ecx, 2
push ecx
push eax
push esi
call fcn.004500a0
mov ecx, dword [edi + 0x14]
add esp, 0xc
mov byte [esi + ecx + 1], bl
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], esi
mov word [esp + 0x20], 0x414
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov ebx, eax
neg ebx
sbb bl, bl
push esi
inc bl
call fcn.004683c8
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x20
ret
Function at 0x436380
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
xor eax, eax
push edi
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.WTPROCIN_d
push edi
call fcn.0044f500
mov al, byte [esp + 0x18]
add esp, 0xc
test al, al
je 0x436472
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x494884
mov dword [esi + 4], eax
call edi
push str.USER32.DLL
mov ebx, eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x498860
push ebx
mov ebp, eax
call edi
push 0x49884c
push ebx
mov dword [esi + 0x34], eax
call edi
push 0x498840
push ebx
mov dword [esi + 0x30], eax
call edi
push 0x498830
push ebx
mov dword [esi + 0x2c], eax
call edi
push 0x498820
push ebx
mov dword [esi + 0x38], eax
call edi
push 0x498814
push ebx
mov dword [esi + 0x44], eax
call edi
push 0x498804
push ebx
mov dword [esi + 0x58], eax
call edi
push 0x4987f4
push ebx
mov dword [esi + 0x48], eax
call edi
push 0x4987e8
push ebx
mov dword [esi + 0x4c], eax
call edi
push 0x4987dc
push ebx
mov dword [esi + 0x50], eax
call edi
push str.AllowSetForegroundWindow
push ebp
mov dword [esi + 0x54], eax
call edi
push 0x4987ac
push ebp
mov dword [esi + 0x3c], eax
call edi
pop ebp
mov dword [esi + 0x40], eax
pop ebx
pop edi
pop esi
ret 4
Function at 0x4365f0
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x47b7b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [0x4b9314]
push ebx
push ebp
push esi
xor ebp, ebp
mov dword [esp + 0x40], eax
push edi
xor esi, esi
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
mov ebx, dword [esp + 0x58]
cmp dword [ebx + 0x18], 0x10
mov dword [esp + 0x50], ebp
mov dword [esp + 0x14], ebp
lea edi, [ebx + 4]
jb 0x436643
mov eax, dword [edi]
jmp 0x436645
mov eax, edi
lea ecx, [esp + 0x14]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, ebp
jbe 0x4366f4
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
push ebp
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x58], 1
call fcn.00413afa
mov ebp, dword [esp + 0x1c]
test ebp, ebp
jne 0x436680
xor eax, eax
jmp 0x436686
mov eax, dword [esp + 0x20]
sub eax, ebp
cmp dword [ebx + 0x18], 0x10
jb 0x43668e
mov edi, dword [edi]
push ebp
push eax
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x4366e5
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x14]
push eax
push 0x494bc4
push ebp
mov dword [esp + 0x20], edi
mov dword [esp + 0x68], edi
call sub.VERSION.dll_VerQueryValueW
mov esi, eax
cmp esi, edi
je 0x4366e5
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x10]
cmp ecx, 0x10005
mov eax, dword [eax + 0x14]
jb 0x4366e3
ja 0x4366dc
cmp eax, 0x32
jb 0x4366e3
mov esi, 1
jmp 0x4366e5
xor esi, esi
cmp ebp, edi
je 0x4366f2
push ebp
call fcn.004683c8
add esp, 4
xor ebp, ebp
mov ecx, dword [esp + 0x48]
cmp esi, ebp
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x38]
setne al
pop ebx
call fcn.0044da14
add esp, 0x44
ret 4

Function at 0x436bf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x4b9314]
push ebx
push esi
push edi
mov dword [esp + 0x134], eax
mov esi, ecx
xor ebx, ebx
xor eax, eax
mov byte [esp + 0x28], bl
mov ecx, 0x40
lea edi, [esp + 0x29]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
push 0x23
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x436c93
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0042f550
mov ecx, dword [eax + 0x18]
mov edi, 0x10
cmp ecx, edi
jb 0x436c54
mov eax, dword [eax + 4]
jmp 0x436c57
add eax, 4
push eax
lea edx, [esp + 0x2c]
push edx
push str._hsWildTangent_hsCacheHotSauce.hsdat
push 0x104
add esi, 0x6d6
push esi
call fcn.00436780
mov esi, eax
mov eax, dword [esp + 0x38]
add esp, 0x14
cmp eax, edi
jb 0x436c8d
mov eax, dword [esp + 0x10]
push eax
call fcn.004683c8
add esp, 4
cmp esi, ebx
mov al, 1
jge 0x436c95
mov al, bl
mov ecx, dword [esp + 0x134]
call fcn.0044da14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x437be0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x47b8d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
lea ebp, [ebx + ebx + 2]
cmp ebp, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x14], ebx
jge 0x437cc8
lea esp, [esp]
mov esi, dword [esp + 0x28]
mov eax, ebp
imul eax, eax, 0x1c
mov ecx, dword [eax + esi - 4]
mov edi, dword [eax + esi - 8]
add eax, esi
cmp ecx, 0x10
mov dword [esp + 0x10], edi
jb 0x437c45
mov ecx, dword [eax - 0x18]
mov dword [esp + 0x2c], ecx
jmp 0x437c4c
lea edx, [eax - 0x18]
mov dword [esp + 0x2c], edx
mov edx, dword [eax + 0x14]
mov ecx, edx
cmp ecx, edx
jae 0x437c55
test edx, edx
je 0x437c8c
cmp edx, edi
mov ecx, edx
jb 0x437c61
mov ecx, edi
cmp dword [eax + 0x18], 0x10
jb 0x437c6c
mov eax, dword [eax + 4]
jmp 0x437c6f
add eax, 4
mov edi, dword [esp + 0x2c]
mov esi, eax
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x437c80
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov esi, dword [esp + 0x28]
jne 0x437c99
mov edi, dword [esp + 0x10]
cmp edx, edi
jb 0x437c9b
xor eax, eax
cmp edx, edi
setne al
test eax, eax
jge 0x437c9c
dec ebp
mov eax, ebp
imul eax, eax, 0x1c
mov ecx, ebx
imul ecx, ecx, 0x1c
push 0xffffffffffffffff
add eax, esi
push 0
add ecx, esi
push eax
call fcn.004014d0
mov eax, dword [esp + 0x30]
mov ebx, ebp
lea ebp, [ebp + ebp + 2]
cmp ebp, eax
jl 0x437c20
jmp 0x437ccc
mov esi, dword [esp + 0x28]
cmp ebp, eax
jne 0x437cef
imul eax, eax, 0x1c
mov ecx, ebx
imul ecx, ecx, 0x1c
push 0xffffffffffffffff
lea eax, [eax + esi - 0x1c]
push 0
add ecx, esi
push eax
call fcn.004014d0
mov eax, dword [esp + 0x30]
lea ebx, [eax - 1]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x58]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push edx
mov byte [ecx + 4], 0
call fcn.004014d0
mov eax, dword [esp + 0x30]
push eax
push ebx
push esi
call fcn.00437910
mov eax, dword [esp + 0x74]
add esp, 0x28
cmp eax, 0x10
jb 0x437d3d
mov ecx, dword [esp + 0x38]
push ecx
call fcn.004683c8
add esp, 4
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret

Function at 0x43bad0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push edi
mov edi, ecx
mov al, byte [edi + 4]
test al, al
jne 0x43bafa
push 0x4b8070
lea ecx, [esp + 8]
call fcn.0044df24
push 0x4b0b38
lea eax, [esp + 8]
push eax
call fcn.0044d9a9
mov eax, dword [edi + 0x3cc]
xor edx, edx
test eax, eax
jle 0x43bb27
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
mov cl, byte [esi]
mov bl, byte [eax]
xor bl, cl
inc esi
mov byte [eax], bl
mov ecx, dword [edi + 0x3cc]
inc eax
inc edx
cmp edx, ecx
jl 0x43bb10
pop esi
pop ebx
pop edi
add esp, 0xc
ret 8
Function at 0x43dbd0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x43dbfb
movsx ecx, byte [esp]
push ecx
call fcn.0044eb9d
add esp, 4
test eax, eax
jne 0x43dc04
mov al, 0x43
add esp, 0x104
ret
movsx edx, byte [esp]
push edx
call fcn.0044fa06
add esp, 4
add esp, 0x104
ret

Function at 0x43dd10
Capabilities:
Get mac address on windows

Disassembly:
mov eax, 0x2904
call fcn.0044e580
push ebx
push esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x110]
xor ebx, ebx
mov dword [esp + 0xc], ebx
push ecx
mov dword [esp + 0x10], 0x2800
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
je 0x43dd6c
mov esi, dword [esp + 0x2910]
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x494870
mov ecx, esi
mov byte [esi + 4], bl
call fcn.004015c0
mov eax, esi
pop esi
pop ebx
add esp, 0x2904
ret
mov edx, dword [esp + 0x2914]
lea eax, [esp + 0x10c]
xor ecx, ecx
push edi
lea ecx, [ecx]
movzx esi, byte [eax + 0x196]
movzx edi, byte [eax + 0x197]
shl esi, 8
add esi, edi
movzx edi, byte [eax + 0x198]
shl esi, 8
add esi, edi
movzx edi, byte [eax + 0x199]
shl esi, 8
add esi, edi
je 0x43de48
cmp edx, ebx
jl 0x43ddbd
cmp edx, ecx
jne 0x43de4c
movzx edx, byte [eax + 0x199]
movzx ecx, byte [eax + 0x198]
push edx
movzx edx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push edx
movzx edx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push edx
push eax
push str._02X__02X__02X__02X__02X__02X
lea ecx, [esp + 0x2c]
push 0x100
push ecx
call fcn.00452825
mov esi, dword [esp + 0x2938]
lea eax, [esp + 0x34]
mov byte [esp + 0x133], bl
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
add esp, 0x24
mov byte [esi + 4], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x43de26
sub eax, edx
push eax
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.004015c0
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x2904
ret
cmp edx, ecx
je 0x43de57
mov eax, dword [eax]
inc ecx
cmp eax, ebx
jne 0x43dd80
mov esi, dword [esp + 0x2914]
mov ecx, esi
push 0x494870
call fcn.004016b0
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x2904
ret
Function at 0x43de80
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47bf5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x234
mov al, byte [ebp + 8]
test al, al
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [esi], 0
jne 0x43deff
push 0x104
lea eax, [esp + 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x43ded0
mov byte [ebp + 8], 0x43
jmp 0x43deff
movsx ecx, byte [esp + 0x130]
push ecx
call fcn.0044eb9d
add esp, 4
test eax, eax
jne 0x43deeb
mov byte [ebp + 8], 0x43
jmp 0x43deff
movsx edx, byte [esp + 0x130]
push edx
call fcn.0044fa06
add esp, 4
mov byte [ebp + 8], al
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
mov eax, dword [ebp + 8]
push eax
push 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x24c], 0
call fcn.004025f0
push 2
push 0x49c5d4
lea ecx, [esp + 0x14]
call fcn.00401fd0
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x24]
mov edi, 0x10
cmp eax, edi
mov eax, dword [esp + 0x10]
jae 0x43df60
lea eax, [esp + 0x10]
push 0
push 0
push 0
push 0
push esi
push 0x104
lea ecx, [esp + 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x43df8b
cmp dword [esp + 0x24], edi
jb 0x43dfbc
mov edx, dword [esp + 0x10]
push edx
jmp 0x43dfb4
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43df92
mov ecx, dword [ebp + 0x10]
sub eax, edx
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004015c0
cmp dword [esp + 0x24], edi
jb 0x43dfbc
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004683c8
add esp, 4
mov ecx, dword [esp + 0x23c]
pop edi
mov al, 1
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x440890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx + edi + 0x78]
add ecx, edi
add eax, edi
cmp word [ecx + 0x18], 0x10b
je 0x4408b2
xor eax, eax
pop edi
add esp, 8
ret
mov ecx, dword [eax + 0x1c]
add ecx, edi
push ebx
push ebp
mov ebp, dword [eax + 0x20]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
add ecx, edi
add ebp, edi
xor edx, edx
test eax, eax
push esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], eax
jbe 0x440926
lea esp, [esp]
mov eax, dword [ebp + edx*4]
mov esi, dword [esp + 0x20]
add eax, edi
lea ebx, [ebx]
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x440914
test cl, cl
je 0x440910
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x440914
add eax, 2
add esi, 2
test cl, cl
jne 0x4408f0
xor eax, eax
jmp 0x440919
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x440930
mov eax, dword [esp + 0x1c]
inc edx
cmp edx, eax
jb 0x4408e0
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 8
ret
mov eax, dword [esp + 0x10]
movzx ecx, word [eax + edx*2]
mov edx, dword [esp + 0x14]
mov eax, dword [edx + ecx*4]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x440950
Capabilities:
Check for software breakpoints
Resolve function by parsing pe exports

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov eax, dword [edx + 0x3c]
add eax, edx
push ebx
mov ebx, dword [eax + 0x78]
add ebx, edx
cmp word [eax + 0x18], 0x10b
mov dword [esp + 0xc], ebx
je 0x440971
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x18]
push ebp
mov ebp, dword [ebx + 0x24]
push esi
push edi
mov edi, dword [ebx + 0x1c]
add eax, edx
add edi, edx
add ebp, edx
xor esi, esi
test ecx, ecx
mov dword [esp + 0x10], eax
jbe 0x440a11
jmp 0x4409a0
mov eax, dword [esp + 0x10]
lea ebx, [ebx]
mov ecx, dword [eax + esi*4]
movzx eax, word [ebp + esi*2]
mov eax, dword [edi + eax*4]
add ecx, edx
add eax, edx
cmp dword [0x4bc8a8], 0
jne 0x4409c9
cmp byte [eax], 0xb8
jne 0x440a09
cmp byte [eax + 9], 0xcd
jne 0x440a09
cmp byte [eax + 0xa], 0x2e
jmp 0x4409f3
cmp dword [0x4bc8a8], 1
jne 0x440a09
cmp byte [eax], 0xb8
jne 0x440a09
cmp byte [eax + 5], 0xba
jne 0x440a09
cmp byte [eax + 6], 0
jne 0x440a09
cmp byte [eax + 7], 3
jne 0x440a09
cmp byte [eax + 8], 0xfe
jne 0x440a09
cmp byte [eax + 9], 0x7f
jne 0x440a09
mov eax, dword [eax + 1]
cmp eax, dword [esp + 0x20]
jae 0x440a05
mov ebx, dword [esp + 0x1c]
mov dword [ebx + eax*4], ecx
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 0x18]
inc esi
cmp esi, eax
jb 0x440996
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x440a20
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.RtlAnsiStringToUnicodeString
push esi
call edi
push str.RtlInitAnsiString
push esi
mov dword [0x4bc8a4], eax
call edi
push str.RtlInitUnicodeString
push esi
mov dword [0x4bc8a0], eax
call edi
push str.RtlFreeUnicodeString
push esi
mov dword [0x4bc89c], eax
call edi
push str.NtOpenSection
push esi
mov dword [0x4bc898], eax
call edi
push str.NtMapViewOfSection
push esi
mov dword [0x4bc894], eax
call edi
push str.NtUnmapViewOfSection
push esi
mov dword [0x4bc890], eax
call edi
push str.ZwQuerySystemInformation
push esi
mov dword [0x4bc88c], eax
call edi
mov ecx, dword [0x4bc8a4]
test ecx, ecx
pop edi
mov dword [0x4bc888], eax
pop esi
je 0x440aef
mov ecx, dword [0x4bc8a0]
test ecx, ecx
je 0x440aef
mov ecx, dword [0x4bc89c]
test ecx, ecx
je 0x440aef
mov ecx, dword [0x4bc898]
test ecx, ecx
je 0x440aef
mov ecx, dword [0x4bc894]
test ecx, ecx
je 0x440aef
mov ecx, dword [0x4bc890]
test ecx, ecx
je 0x440aef
mov ecx, dword [0x4bc88c]
test ecx, ecx
je 0x440aef
test eax, eax
je 0x440aef
mov eax, 1
ret
xor eax, eax
ret
Function at 0x4420a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
lea eax, [esp + 4]
push eax
push 1
xor edi, edi
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x442116
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
push ebp
lea edx, [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
push str.ProgramFilesDir
push eax
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x442109
test esi, esi
jbe 0x442104
mov byte [esi + ebp - 1], al
mov edi, 1
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
mov eax, edi
pop edi
add esp, 0xc
ret

Function at 0x442190
Capabilities:
Access peb ldr_data
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x47c43b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], ebx
mov byte [esp + 0xc], bl
push 1
push 0x26
lea eax, [esp + 0x30]
push eax
push ebx
mov dword [esp + 0x144], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4421f6
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4421e5
sub eax, edx
push eax
lea ecx, [esp + 0x2c]
push ecx
jmp 0x44224f
lea edx, [esp + 0x28]
push 0x104
push edx
call fcn.004420a0
add esp, 8
test eax, eax
je 0x442224
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x442213
sub eax, edx
push eax
lea eax, [esp + 0x2c]
push eax
jmp 0x44224f
push 0x104
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x442258
lea eax, [esp + 0x28]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x442240
sub eax, edx
push eax
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x10]
call fcn.004015c0
mov esi, dword [esp + 0x13c]
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x10]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.004014d0
cmp dword [esp + 0x20], 0x10
jb 0x44228f
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004683c8
add esp, 4
mov ecx, dword [esp + 0x12c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x130
ret
Function at 0x443b45
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x443b98
call fcn.00471996
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x443b98
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x443b8e
xor eax, eax
jmp 0x443cb1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x443bc8
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x443bc8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x443cae
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x443bf5
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.004436b5
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x443cae
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x443c3e
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x443c3e
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x443c38
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.004436b5
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x443c9e
and dword [ebp + 0xc], 0
jmp 0x443c9e
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x443c9e
push 0xc
call fcn.0046839d
mov esi, eax
test esi, esi
pop ecx
je 0x443c80
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x443c82
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x443c99
push dword [ebp - 8]
call fcn.00467e70
jmp 0x443c9e
call fcn.00467e47
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x443c03
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc