joyce8/EMBER2024-capa huggingface dataset:
Function at 0x98a68c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x98a6b3
call fcn.0092cbf8
mov dword [eax], esi
call fcn.0092cbe5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0092d83a
mov eax, esi
jmp 0x98a708
test dword [ebp + 0xc], 0xfffffff9
jne 0x98a699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x98a6e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0092cc0b
pop ecx
call fcn.0092cbe5
mov eax, dword [eax]
jmp 0x98a708
test al, 0x10
jne 0x98a706
test al, 1
je 0x98a706
test byte [ebp + 0xc], 2
je 0x98a706
call fcn.0092cbf8
mov dword [eax], 5
call fcn.0092cbe5
mov dword [eax], 0xd
jmp 0x98a6d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x79065ef9
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x76fd60d3
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x435217
Capabilities:
Enumerate gui resources
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x4352c4
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43527c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x435261
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x43527a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43527a
push 0x14f1
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x4352c2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4352a4
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
jmp 0x4352c2
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x4352c2
push 0xf4f
push 0x1b9
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x435320
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4352fa
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 1
push 0x2f9
push dword [ebp - 0x24]
call fcn.00433cdf
add esp, 0xc
jmp 0x435320
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
push 1
push 0x3027
push dword [ebp - 0x2c]
push 0x1eb6
push 0
push 1
push 0x507c
call fcn.0042e609
add esp, 0x1c
mov esp, ebp
pop ebp
ret

Function at 0x43600a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x4360ab
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x436048
push 0x1f05
push 1
call fcn.004360cb
pop ecx
pop ecx
jmp 0x4360a9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43608a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x436088
push 0x1534
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4360a9
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4360a9
push 0
push 0x1e20
push 0
push 0
call fcn.0043e7d3
add esp, 0x10
jmp 0x4360c7
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
push 1
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
push eax
push 0x29ca
call fcn.0043071e
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x436b8c
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x436c22
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x436bfc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x436be4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
and dword [eax], 0
jmp 0x436bfa
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x436bfa
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x436c20
push 1
push 0x1aed
push 0
push 0x7f03
push 1
push 0x4211
push 0x341
push 0
call fcn.0043f7d2
add esp, 0x20
jmp 0x436c3a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
push 0
push 0x68e5
push dword [ebp - 0x24]
call fcn.0043664b
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x436e1e
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x436ebd
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x436eaa
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x436e81
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x436e7f
push 0x6e09
push 0
push 0
call fcn.0043fa4f
add esp, 0xc
jmp 0x436ea8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x436ea8
push 0x163c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x436ebb
push 0
push 0x925
push 0
call fcn.00433a46
add esp, 0xc
jmp 0x436f2b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x436f16
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x436f07
push 0x1cf8
push 0x189d
push 0x147c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
jmp 0x436f14
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x436f2b
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 0
push dword [ebp - 0x34]
push 1
call fcn.00433a46
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x436f2f
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 8]
test eax, eax
je 0x436f5c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 1
push 0x239b
push 0
push dword [ebp - 4]
call fcn.00442ea0
add esp, 0x10
jmp 0x436fe0
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x436f8e
push 0x274e
push 0
call fcn.00434f87
pop ecx
pop ecx
jmp 0x436fe0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x436fd6
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
movzx eax, word [eax]
and eax, 0xfff
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
jmp 0x436fe0
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esp, ebp
pop ebp
ret
Function at 0x43ed0d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x43ed28
push 1
call fcn.0043eed0
pop ecx
jmp 0x43eecc
lea eax, [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43eeab
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x43ee78
mov dword [ebp - 4], 0xbe4438be
mov dword [ebp - 0xc], 0xffff
mov dword [ebp - 0x64], 0x20274952
mov dword [ebp - 0x60], 0x20274952
mov dword [ebp - 0x5c], 0x20274952
mov dword [ebp - 0x58], 0x20274952
mov dword [ebp - 0x10], 0x6e3e45bb
mov dword [ebp - 0x38], 0xfa2ef703
cmp dword [ebp - 4], 0
je 0x43ee23
mov eax, dword [ebp - 4]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 4], eax
jne 0x43edbd
mov dword [ebp - 8], 1
jmp 0x43edc1
and dword [ebp - 8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 8]
mov dword [ebp + eax - 0x64], ecx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jle 0x43eddf
mov dword [ebp - 0x14], 1
jmp 0x43ede3
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x14], eax
jge 0x43edf4
mov dword [ebp - 0x18], 1
jmp 0x43edf8
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x18], eax
jge 0x43ee09
mov dword [ebp - 0x1c], 1
jmp 0x43ee0d
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
add eax, 0x4e828d47
cmp dword [ebp - 4], eax
jne 0x43ee23
mov dword [ebp - 0x20], 1
jmp 0x43ee27
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 4]
sub eax, 0x22a5bc4
jne 0x43ee49
cmp dword [ebp - 0x10], 0
jne 0x43ee49
and dword [ebp - 0x24], 0
jmp 0x43ee50
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
push 1
push 0
push 0x2838
push 0x46c8
push 0x4dc7
push 0x2576
call fcn.00443be9
add esp, 0x18
jmp 0x43eea9
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x43eea9
push 0
push 0
push 0x1611
push 0xad2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
jmp 0x43eecc
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
push 0x5cca
push 1
push 1
push dword [ebp - 0x4c]
push 0xbe0
push 0
call fcn.00433c51
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x43f7d2
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x43f86f
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x43f858
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43f84c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x43f856
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x43f86d
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x34]
push 1
push 1
call fcn.0042bad6
add esp, 0xc
jmp 0x43f88f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x38]
push 0
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
push eax
call fcn.00433ead
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x4435a2
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x443725
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4436db
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x4436d1
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x68]
mov dword [eax], 2
mov eax, dword [ebp - 0x6c]
cmp dword [eax], 0
jne 0x443690
mov eax, dword [ebp - 8]
xor ecx, ecx
sub ecx, dword [eax]
jne 0x443690
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x443690
and dword [ebp - 0xc], 0
jmp 0x443697
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax]
cmp ecx, 1
jle 0x4436ad
mov dword [ebp - 0x10], 1
jmp 0x4436b1
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0xf5720e83
jb 0x4436c3
mov dword [ebp - 0x18], 1
jmp 0x4436c7
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
jmp 0x4436d9
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x443723
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
movzx eax, byte [eax]
test eax, eax
je 0x44370d
mov byte [ebp - 1], 0
push 1
push 0x1221
push 1
push 0x5523
lea eax, [ebp - 1]
push eax
push 0
call fcn.004360ec
add esp, 0x18
jmp 0x443723
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
jmp 0x44373f
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x78], eax
push dword [ebp - 0x78]
push 1
push 0x326c
push 0
call fcn.00430566
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x44469d
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x4446e9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x66e4
call fcn.00444758
add esp, 0x1c
jmp 0x444754
lea eax, [ebp + 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x44471b
push 0x75bf
push 0
push 0x30fd
call fcn.004337a2
add esp, 0xc
jmp 0x444754
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x44474a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x444754
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esp, ebp
pop ebp
ret
Function at 0x45071f
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x45074e
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
push 0
push 0x338a
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
call fcn.004508ec
add esp, 0xc
jmp 0x4507ec
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4507c9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4507a7
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4507a5
push 0x206f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
jmp 0x4507c7
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4507c7
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x4507ec
push 0x4940
push 0x3686
push 0
push 0x6fea
push 0x619
push 0x6e42
call fcn.00462633
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x4528bb
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x45293d
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4528f5
push 1
push 0x41d3
call fcn.00452949
pop ecx
pop ecx
jmp 0x45293b
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x452931
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x45292f
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
jmp 0x45293b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x452945
push 1
call fcn.00450817
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x452dbd
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x452e84
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x452e65
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x452e39
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x452e37
push 0x1534
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x452e63
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x452e63
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
jmp 0x452e82
push 0x22b7
push 0x950
push 1
push 0x58e7
push 1
push 1
call fcn.004523f3
add esp, 0x18
jmp 0x452e8c
push 0
call fcn.0045ad53
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4556be
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x455723
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x1c], eax
push 0x701c
push dword [ebp - 4]
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
push eax
call fcn.004557b0
add esp, 0x24
jmp 0x4557ac
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x45579b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x455793
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 0xf
push 5
call fcn.0044cad4
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
mov dword [ecx + 4], eax
jmp 0x455799
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x4557ac
push 0
push 0x2e32
push 0
call fcn.0045edf9
add esp, 0xc
mov esp, ebp
pop ebp
ret