joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x449429
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, 0xf
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ebx
push edi
mov dword [esp + 0xc], esi
mov byte [esi + 4], bl
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ebx
mov dword [esp + 0x18], ebx
mov byte [esi + 0x20], bl
lea edi, [esi + 0x38]
mov ecx, edi
mov byte [esp + 0x18], 1
call fcn.0040b470
mov dword [edi + 4], eax
mov byte [eax + 0x65], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x44]
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.0040b470
mov dword [edi + 4], eax
mov byte [eax + 0x65], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x50]
mov ecx, edi
mov byte [esp + 0x18], 3
call fcn.0040b470
mov ecx, dword [esp + 0x10]
mov dword [edi + 4], eax
mov byte [eax + 0x65], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x41fc90
Capabilities:
Parse url

Disassembly:
sub esp, 0x83c
mov eax, dword [0x45d874]
xor eax, esp
push edi
mov edi, dword [esp + 0x844]
test edi, edi
mov dword [esp + 0x83c], eax
mov eax, dword [esp + 0x848]
mov dword [esp + 8], ecx
mov dword [esp + 0x10], edx
je 0x41fdc7
test ebx, ebx
je 0x41fdc7
push ebp
push esi
mov esi, eax
and eax, 0xc0000000
and esi, 0x3e000000
push esi
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebx
mov dword [esp + 0x1c], 0x824
mov dword [esp + 0x24], 0
call dword [0x44b648]
test eax, eax
jne 0x41fd5d
call dword [0x44b37c]
cmp eax, 0x7a
jne 0x41fd41
mov edx, dword [esp + 0xc]
push edx
call fcn.0043afbf
add esp, 4
mov ebp, eax
push esi
lea eax, [esp + 0x10]
push eax
push ebp
push ebx
mov dword [esp + 0x24], 1
call dword [0x44b648]
test eax, eax
jne 0x41fd61
push ebp
call fcn.0043afc4
add esp, 4
xor eax, eax
pop esi
pop ebp
pop edi
mov ecx, dword [esp + 0x838]
xor ecx, esp
call fcn.0042c5af
add esp, 0x83c
ret 8
lea ebp, [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edi
push ecx
push 0
push ebp
call dword [0x44b644]
mov esi, eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41fd83
push ebp
call fcn.0043afc4
add esp, 4
test esi, esi
jne 0x41fd95
mov edx, dword [esp + 0x10]
mov dword [edx], 0xffffffff
mov eax, esi
jmp 0x41fd43
mov ax, word [edi + 0x18]
mov ecx, dword [esp + 0x18]
mov word [ecx], ax
mov edi, dword [edi + 0xc]
test edi, edi
jle 0x41fdb6
cmp edi, 7
jg 0x41fdb6
mov edx, dword [esp + 0x10]
mov dword [edx], edi
mov eax, esi
jmp 0x41fd43
mov eax, dword [esp + 0x10]
mov dword [eax], 0xffffffff
mov eax, esi
jmp 0x41fd43
mov ecx, dword [esp + 0x83c]
pop edi
xor ecx, esp
xor eax, eax
call fcn.0042c5af
add esp, 0x83c
ret 8
Function at 0x420a00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [0x45d874]
xor eax, esp
mov dword [esp + 0x108], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 8]
push edx
push 0x44b917
push str.SoftwareRedTooDownload
push 0x80000002
mov dword [esp + 0x1c], 0xff
call dword [0x44b3cc]
test eax, eax
jne 0x420b93
cmp dword [esp], 1
jne 0x420b93
push edi
lea edi, [esp + 0xc]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x420a58
mov eax, dword [str.SoDALib.dll]
mov ecx, dword [0x44f9a4]
mov edx, dword [0x44f9a8]
mov dword [edi], eax
mov al, byte [0x44f9ac]
mov dword [edi + 4], ecx
lea ecx, [esp + 0xc]
mov dword [edi + 8], edx
push ecx
mov byte [edi + 0xc], al
call dword [0x44b2a0]
test eax, eax
mov dword [0x45e910], eax
pop edi
je 0x420b93
push esi
mov esi, dword [0x44b2a4]
push str.CreateSoDATask
push eax
call esi
mov edx, dword [0x45e910]
push str.SoDASetCallback
push edx
mov dword [0x45e8f0], eax
call esi
mov dword [0x45e900], eax
mov eax, dword [0x45e910]
push str.SoDASetDownloadMode
push eax
call esi
mov ecx, dword [0x45e910]
push str.SoDASetPingback
push ecx
mov dword [0x45e8ec], eax
call esi
mov edx, dword [0x45e910]
push str.SoDADownloadUrl
push edx
mov dword [0x45e8f8], eax
call esi
mov dword [0x45e8e4], eax
mov eax, dword [0x45e910]
push str.SoDAResumeFile
push eax
call esi
mov ecx, dword [0x45e910]
push str.SoDASetFileName
push ecx
mov dword [0x45e90c], eax
call esi
mov edx, dword [0x45e910]
push str.SoDAPauseDownload
push edx
mov dword [0x45e8f4], eax
call esi
mov dword [0x45e8e8], eax
mov eax, dword [0x45e910]
push str.SoDACancelDownload
push eax
call esi
mov ecx, dword [0x45e910]
push str.SoDAGetStatusInfo
push ecx
mov dword [0x45e8fc], eax
call esi
mov edx, dword [0x45e910]
push str.SoDAWaitDownload
push edx
mov dword [0x45e908], eax
call esi
mov dword [0x45e904], eax
mov eax, dword [0x45e910]
push str.DestroySoDATask
push eax
call esi
mov dword [0x45e914], eax
mov al, 1
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0042c5af
add esp, 0x10c
ret
mov ecx, dword [esp + 0x108]
xor ecx, esp
xor al, al
call fcn.0042c5af
add esp, 0x10c
ret
Function at 0x422c60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x449c36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esi + 8]
push edi
xor edi, edi
mov dword [esi], 0x44fb18
mov dword [esp + 8], esi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [esp + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov eax, dword [esp + 0x28]
push edi
push eax
mov byte [esp + 0x28], 1
mov dword [esi + 4], edi
call fcn.00422a50
mov eax, dword [esp + 0x2c]
push edi
push eax
push edi
push edi
mov dword [esi + 0x2c], eax
call dword [0x44b280]
cmp eax, edi
mov dword [esi + 0x30], eax
jne 0x422cf4
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], str.Cant_Create_QueueAccessSemaphone
call fcn.0042dcbf
push 0x458024
lea edx, [esp + 0x10]
push edx
call fcn.0042da54
lea eax, [esi + 0x34]
push eax
call dword [0x44b304]
push edi
push edi
push 1
push edi
call dword [0x44b2b0]
cmp eax, edi
mov dword [esi + 0x4c], eax
jne 0x422d35
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], str.Cant_Create_QueueNotFullEvent
call fcn.0042dcbf
push 0x458024
lea edx, [esp + 0x10]
push edx
call fcn.0042da54
push eax
call dword [0x44b2c0]
mov ecx, dword [esp + 0x18]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x435675
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x4356a3
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x4356aa
cmp ebx, dword [eax + 4]
jae 0x4356aa
xor eax, eax
jmp 0x43589a
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x4356bb
xor eax, eax
inc eax
jmp 0x435899
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4356d1
cmp ecx, edx
jae 0x435816
cmp dword [eax + 4], 0
je 0x4356da
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4356c2
cmp dword [ebp + 8], 0
je 0x4356fc
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x435816
cmp eax, esi
jae 0x435816
mov eax, dword [0x461388]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x435721
cmp dword [esi*4 + 0x461390], edi
je 0x43581a
inc esi
cmp esi, eax
jl 0x43570f
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x44b13c]
test eax, eax
je 0x435896
cmp dword [ebp - 8], 0x1000000
jne 0x435896
test byte [ebp - 0xc], 0xcc
je 0x43579f
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x435896
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x435896
cmp word [eax + 0x18], 0x10b
jne 0x435896
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x435896
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x43579f
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x43579f
test byte [ecx + 0x27], 0x80
jne 0x435816
push 1
push 0x4613d0
call dword [0x44b378]
test eax, eax
jne 0x4356b3
mov ecx, dword [0x461388]
test ecx, ecx
mov edx, ecx
jle 0x4357d3
lea eax, [ecx*4 + 0x46138c]
cmp dword [eax], edi
je 0x4357d3
dec edx
sub eax, 4
test edx, edx
jg 0x4357c7
test edx, edx
jne 0x435804
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4357e0
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4357f8
lea eax, [edx*4 + 0x461390]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4357e6
cmp ecx, 0x10
jge 0x435804
inc ecx
mov dword [0x461388], ecx
push 0
push 0x4613d0
call dword [0x44b378]
jmp 0x4356b3
xor eax, eax
jmp 0x435899
test esi, esi
jle 0x4356b3
mov ebx, dword [0x44b378]
push 1
push 0x4613d0
call ebx
test eax, eax
jne 0x4356b3
cmp dword [esi*4 + 0x461390], edi
je 0x435870
mov eax, dword [0x461388]
lea esi, [eax - 1]
test esi, esi
jl 0x43585e
cmp dword [esi*4 + 0x461390], edi
je 0x43585a
dec esi
jns 0x43584e
test esi, esi
jge 0x43586e
cmp eax, 0x10
jge 0x435869
inc eax
mov dword [0x461388], eax
lea esi, [eax - 1]
jmp 0x435870
je 0x435888
xor ecx, ecx
test esi, esi
jl 0x435888
lea eax, [ecx*4 + 0x461390]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x435876
push 0
push 0x4613d0
call ebx
jmp 0x4356b3
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43d39d
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x43d3d6
push dword [esi + 0x1c]
call dword [0x44b448]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00422fa0
push eax
push dword [esi + 0x1c]
call dword [0x44b44c]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00422f7b
pop esi
ret 4
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x440468
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x449ed4
call fcn.0042f2e0
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x440482
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x1c]
call dword [0x44b44c]
jmp 0x4404ce
call fcn.0043b0b5
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [0x44b268]
push dword [ebp + 8]
call dword [0x44b2f4]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004018f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x442927
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x45d874]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor eax, ebp
push edi
mov dword [ebp - 4], eax
call dword [0x44b2f4]
mov ebx, eax
mov eax, 0x100
cmp ebx, eax
ja 0x44297a
push eax
lea eax, [ebp - 0x104]
push eax
push esi
call dword [0x44b44c]
cmp eax, ebx
jne 0x44297a
push edi
lea eax, [ebp - 0x104]
push eax
call dword [0x44b250]
test eax, eax
je 0x442982
push edi
push esi
call dword [0x44b5f0]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c5af
leave
ret 8

Function at 0x44364f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x45d874]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor eax, ebp
mov esi, ecx
cmp dword [esi + 0x50], 0
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
je 0x4436a0
push edi
call fcn.0044633e
mov esi, eax
test esi, esi
je 0x4436c4
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push ebx
push esi
call dword [0x44b028]
push esi
mov edi, eax
call dword [0x44b020]
xor eax, eax
test edi, edi
sete al
jmp 0x4436c4
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0x44f5d0
push eax
call dword [0x44b5e0]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
call dword [0x44b34c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c5af
leave
ret 0xc
Function at 0x443f93
Capabilities:
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x7c8]
sub esp, 0x848
mov eax, dword [0x45d874]
mov ecx, dword [ebp + 0x7d4]
xor eax, ebp
mov dword [ebp + 0x7c4], eax
mov eax, dword [ebp + 0x7d8]
push ebx
mov ebx, dword [ebp + 0x7d0]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x7dc]
xor edx, edx
cmp ecx, edx
push esi
push edi
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x7c], eax
je 0x4440b7
cmp ebx, edx
je 0x4440b7
mov eax, dword [ebp + 0x7e0]
mov esi, eax
mov edi, eax
and esi, 0x2e000000
and edi, 0x40000000
test eax, 0x90000000
mov dword [ebp - 0x6c], 0x824
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x74], edx
je 0x44402c
cmp dword [ecx + 0x30], edx
je 0x44402c
test eax, 0x2000000
je 0x444026
mov dword [ebp - 0x74], 1
jmp 0x44402c
or edi, 0x80000000
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
mov ebx, dword [0x44b648]
call ebx
test eax, eax
jne 0x444078
call dword [0x44b37c]
cmp eax, 0x7a
jne 0x4440b7
push dword [ebp - 0x6c]
call fcn.0043af94
test eax, eax
pop ecx
mov dword [ebp - 0x78], eax
je 0x4440b7
push esi
lea ecx, [ebp - 0x6c]
push ecx
push eax
push dword [ebp - 0x80]
mov dword [ebp - 0x68], 1
call ebx
test eax, eax
jne 0x44407d
push dword [ebp - 0x78]
jmp 0x4440b1
lea ebx, [ebp - 0x60]
jmp 0x444080
mov ebx, dword [ebp - 0x78]
mov esi, dword [ebp - 0x70]
push esi
push edi
xor edi, edi
push edi
push ebx
call dword [0x44b644]
cmp dword [ebp - 0x74], edi
mov dword [ebp - 0x70], eax
je 0x4440df
push 0x2100000
push edi
push edi
push dword [esi + 0x2c]
call dword [0x44b3dc]
test eax, eax
jge 0x4440d3
cmp dword [ebp - 0x68], edi
je 0x4440b7
push ebx
call fcn.0043afc4
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x7c4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c5af
add ebp, 0x7c8
leave
ret 0x14
push dword [esi + 0x2c]
call dword [0x44b2f4]
mov dword [esi + 0x30], eax
cmp dword [ebp - 0x68], edi
je 0x4440eb
push ebx
call fcn.0043afc4
pop ecx
mov eax, dword [ebp - 0x70]
cmp eax, edi
jne 0x4440fd
mov ecx, dword [ebp - 0x64]
mov dword [ecx], 0x1000
jmp 0x4440b9
mov cx, word [esi + 0x18]
mov edx, dword [ebp - 0x7c]
mov word [edx], cx
mov esi, dword [esi + 0xc]
dec esi
mov ecx, dword [ebp - 0x64]
je 0x44415e
dec esi
je 0x444153
dec esi
je 0x444148
dec esi
je 0x44413d
dec esi
je 0x444132
dec esi
je 0x44412a
dec esi
jne 0x4440f5
mov dword [ecx], 0x1002
jmp 0x4440b9
mov dword [ecx], 0x1006
jmp 0x4440b9
mov dword [ecx], 0x1001
jmp 0x4440b9
mov dword [ecx], 0x100b
jmp 0x4440b9
mov dword [ecx], 3
jmp 0x4440b9
mov dword [ecx], 2
jmp 0x4440b9
mov dword [ecx], 1
jmp 0x4440b9
Function at 0x4444fd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x45d874]
push ebx
push esi
xor eax, ebp
push edi
mov edi, dword [0x44b318]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [0x44b2a4]
cmp eax, ebx
je 0x4445a7
call eax
mov esi, dword [0x44b254]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
call dword [0x44b2a4]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x38], eax
call esi
mov dword [ebp - 0x34], eax
push 4
xor ebx, ebx
jmp 0x4446a9
call dword [0x44b2fc]
test eax, eax
jns 0x444657
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push 0x80000001
mov dword [ebp - 0x1c], ebx
call dword [0x44b03c]
test eax, eax
jne 0x4446aa
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [0x44b040]
test eax, eax
jne 0x44464c
cmp dword [ebp - 0x24], 1
jne 0x44464c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x44c4f8
push eax
call fcn.0042c54a
add esp, 0xc
cmp eax, 1
jne 0x44464c
mov eax, dword [ebp - 0x28]
mov esi, dword [0x44b254]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x40], eax
call esi
push 2
mov dword [ebp - 0x3c], eax
pop esi
push dword [ebp - 0x1c]
call dword [0x44b020]
jmp 0x4446aa
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x4446aa
lea ecx, [ebp - 0x18]
push ecx
push 0x4444e7
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [0x44b258]
cmp word [ebp - 0x18], bx
je 0x4446aa
movzx eax, word [ebp - 0x18]
mov esi, dword [0x44b254]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x40], eax
call esi
mov dword [ebp - 0x3c], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x40], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x4446cf
push dword [ebp + edi*4 - 0x40]
mov ecx, dword [ebp - 0x2c]
call fcn.0044445e
cmp eax, ebx
pop ecx
jne 0x4446d1
inc edi
cmp edi, esi
jl 0x4446b9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c5af
leave
ret 4
Function at 0x4446e2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x45cb10
je 0x44479e
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push 0x80000001
call dword [0x44b03c]
test eax, eax
jne 0x444786
mov esi, dword [ebx + 4]
jmp 0x444780
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [0x44b040]
test eax, eax
jne 0x444770
cmp dword [ebp - 0xc], 4
jne 0x444770
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x444768
or dword [eax + 0x9c], ecx
jmp 0x444770
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x444734
push dword [ebp - 4]
call dword [0x44b020]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x444717
pop esi
push edi
call dword [0x44b020]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x445344
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x449dd5
call fcn.0042f2e0
sub esp, 0x124
mov eax, dword [0x45d874]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, ebp
mov dword [ebp - 0x10], esp
lea edx, [ebp - 0x124]
mov dword [ebp - 0x14], eax
mov eax, dword [edi]
push edx
push eax
push ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], edi
call dword [0x44b024]
mov esi, eax
test esi, esi
jne 0x445452
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [0x44b034]
mov esi, eax
test esi, esi
jne 0x445426
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00402150
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.00445344
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004018f0
test bl, bl
jne 0x445426
or dword [ebp - 4], 0xffffffff
jmp 0x445391
cmp esi, 0x103
je 0x445436
cmp esi, 0x3f2
jne 0x445446
push dword [edi]
push dword [ebp - 0x12c]
call dword [0x44b038]
mov esi, eax
push dword [ebp - 0x124]
call dword [0x44b020]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c5af
leave
ret 8
Function at 0x4482f7
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x449ec2
call fcn.0042f2e0
sub esp, 0x198
mov eax, dword [0x45d874]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, ebp
push 0x44577d
mov ecx, 0x460dd4
mov dword [ebp - 0x10], eax
call fcn.00445dee
mov edi, eax
xor ebx, ebx
cmp dword [edi + 0xc], ebx
jne 0x44835b
cmp esi, ebx
jne 0x448339
lea esi, [ebp - 0x1a0]
push esi
push 0x101
call dword [0x44b674]
cmp eax, ebx
jne 0x44838d
cmp byte [esi], 1
jne 0x448387
cmp byte [esi + 1], 1
jne 0x448387
mov dword [edi + 0xc], 0x4482c4
call fcn.00445aa0
mov esi, eax
cmp dword [esi + 0x30], ebx
jne 0x44839a
push 0x1c
call fcn.0043af94
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x448391
push 0xa
call fcn.0043ae88
jmp 0x448393
call dword [0x44b670]
xor eax, eax
jmp 0x4483fd
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x30], eax
cmp dword [esi + 0x34], ebx
jne 0x4483cc
push 0x1c
call fcn.0043af94
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 1
je 0x4483c3
push 0xa
call fcn.0043ae88
jmp 0x4483c5
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x34], eax
cmp dword [esi + 0x38], ebx
jne 0x4483fa
push 0x1c
call fcn.0043af94
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 2
je 0x4483f5
push 0xa
call fcn.0043a990
jmp 0x4483f7
xor eax, eax
mov dword [esi + 0x38], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c5af
leave
ret 4