joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4321b0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4e24e0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ecx]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ecx + 4]
push edi
mov dword [ebp - 0x220], ecx
lea ecx, [ebp - 0x21c]
push ecx
xor ebx, ebx
or esi, 0x2001f
push esi
push ebx
push edx
push eax
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x21c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x214]
mov edi, eax
cmp edi, ebx
jne 0x43223c
xor eax, eax
cmp ecx, ebx
je 0x43221e
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x21c]
and esi, 0x300
mov edi, eax
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], esi
cmp eax, ebx
je 0x43225c
cmp ecx, ebx
je 0x432247
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044557a
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [ebp - 0x22c]
push edx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
lea edx, [ebp - 0x20c]
push edx
push ebx
push ecx
mov dword [ebp - 0x218], pe_nt_image_headers32
call esi
test eax, eax
jne 0x4322dc
lea esp, [esp]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.004321b0
mov edi, eax
cmp edi, ebx
jne 0x432332
lea ecx, [ebp - 0x22c]
push ecx
mov ecx, dword [ebp - 0x214]
push ebx
push ebx
push ebx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x20c]
push eax
push ebx
push ecx
mov dword [ebp - 0x218], pe_nt_image_headers32
call esi
test eax, eax
je 0x432290
mov eax, dword [ebp - 0x214]
cmp eax, ebx
je 0x4322f3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x214], ebx
mov edi, dword [ebp - 0x224]
mov esi, dword [ebp - 0x220]
mov dword [ebp - 0x210], ebx
call fcn.00432100
mov esi, eax
mov eax, dword [ebp - 0x214]
cmp eax, ebx
je 0x43231d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044557a
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x214]
cmp eax, ebx
je 0x432343
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044557a
mov esp, ebp
pop ebp
ret 4
Function at 0x432850
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5606
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x4e24e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x420], edi
cmp edi, ebx
jne 0x4328d0
call fcn.0040d910
mov esi, eax
jmp 0x4329dc
mov eax, dword [ebp - 0x41c]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x4328ef
call fcn.0040d910
jmp 0x4329d3
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
cmp eax, ebx
jne 0x43290b
call fcn.0040d910
jmp 0x4329d3
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [eax + 1]
mov dword [ebp - 0x41c], eax
cmp ecx, eax
jae 0x43294e
lea ecx, [ebp - 0x414]
cmp dword [ebp - 0x418], ecx
je 0x432939
lea eax, [ebp - 0x418]
call fcn.00434850
lea esi, [ebp - 0x424]
call fcn.0042cdb0
mov eax, 0x8007000e
jmp 0x432a02
mov eax, ecx
lea esi, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.00434630
mov dword [ebp - 4], 1
jmp 0x43297d
mov ecx, dword [ebp - 0x418]
cmp ecx, ebx
jne 0x43298e
mov esi, 0x8007000e
jmp 0x4329d5
mov eax, dword [ebp - 0x41c]
mov edx, dword [ebp - 0x428]
push eax
push ecx
push eax
push edx
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x4329b2
call fcn.0040d910
jmp 0x4329d3
mov edx, dword [ebp - 0x418]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x418]
push eax
lea edx, [ebp - 0x430]
call fcn.004336f0
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x414]
cmp dword [ebp - 0x418], ecx
je 0x432a00
lea eax, [ebp - 0x418]
call fcn.00434850
jmp 0x432a00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044557a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4345a0
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [0x4ebb88]
test eax, eax
jne 0x4345b3
call fcn.0040da20
mov dword [0x4ebb88], eax
mov eax, dword [eax + 0x140]
cmp eax, 2
jne 0x4345d6
mov eax, dword [0x4ebb88]
mov ecx, dword [eax + 0x140]
cmp ecx, 2
jne 0x4345d6
mov eax, dword [eax + 0x88]
jmp 0x4345d8
xor eax, eax
push esi
test eax, eax
je 0x4345e0
call eax
ret
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
ret

Function at 0x43b210
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x4e24e0]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0043ede0
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.0043ee80
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.0044557a
add esp, 0x68
ret
Function at 0x43b380
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
push edi
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push 0x20119
xor edi, edi
push edi
push str.SOFTWARE360MachineSignature
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43b513
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esi + 0x10], eax
push ebx
mov dword [esi + 0x14], eax
lea edx, [esp + 0x20]
push edx
mov dword [esi + 0x18], eax
push eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x2c]
push str.Operator
mov edi, 0x400
push eax
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43b415
cmp dword [esp + 0x18], 1
jne 0x43b4fa
mov eax, dword [esp + 0x14]
sub edi, eax
mov dword [esi], ebx
lea ebx, [eax + ebx]
je 0x43b4fa
mov eax, dword [esp + 0x1c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0
push str.IssueDate
push eax
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x43b45a
cmp dword [esp + 0x18], 1
jne 0x43b4fa
mov eax, dword [esp + 0x14]
mov dword [esi + 4], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x43b4fa
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0
push str.ExpirationDate
push eax
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x43b491
cmp dword [esp + 0x18], 1
jne 0x43b4fa
mov eax, dword [esp + 0x14]
mov dword [esi + 8], ebx
sub edi, eax
add ebx, eax
test edi, edi
je 0x43b4fa
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push 0
push str.SignData
push eax
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x43b4fa
cmp dword [esp + 0x18], 3
jne 0x43b4fa
mov eax, dword [esp + 0x14]
sub edi, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
je 0x43b4fa
lea eax, [esi + 0xc]
call fcn.0043b280
test eax, eax
je 0x43b4fa
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
mov ecx, 0x400
sub ecx, edi
push eax
mov dword [edx], ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x43b910
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x4e24e0]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
mov ebx, dword [esp + 0x78]
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.0043d910
add esp, 8
test eax, eax
jne 0x43b981
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0044557a
add esp, 0x6c
ret
mov eax, dword [esp + 0x78]
test eax, eax
jbe 0x43b996
push esi
lea ecx, [esp + 0x14]
call fcn.0043ede0
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.0043ee80
test edi, edi
je 0x43b9b4
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0044557a
add esp, 0x6c
ret

Function at 0x43b9f0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x4e24e0]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
mov ebx, dword [esp + 0x6c]
xor eax, eax
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
push edi
lea eax, [esp + 0x10]
mov edi, ecx
push eax
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.0043db00
add esp, 4
test eax, eax
jne 0x43ba54
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0044557a
add esp, 0x64
ret
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.0043ee80
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0044557a
add esp, 0x64
ret

Function at 0x43ba80
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x4e24e0]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.0043dbe0
add esp, 8
test eax, eax
jne 0x43baff
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0044557a
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.0043e9e0
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call fcn.0044557a
add esp, 0x74
ret

Function at 0x43c470
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43c49b
push 0x4ccfb4
mov eax, 0x4ccfb4
call fcn.0043f8e0
add esp, 4
xor eax, eax
pop ecx
ret
mov eax, 1
cmp esi, dword [esp]
je 0x43c4b4
push 0x4ccfb4
call fcn.0043f950
add esp, 4
xor eax, eax
pop ecx
ret
Function at 0x43cd60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x4e24e0]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
cmp eax, ebx
jne 0x43cd93
mov dword [esp + 0x10], 0xffffffff
jmp 0x43cd99
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push ebx
push ebx
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x43cdc7
push 0x4ccfb4
mov eax, 0x4ccfb4
call fcn.0043f8e0
add esp, 4
jmp 0x43cea7
push 0
lea edx, [esp + 0x1c]
push edx
push 8
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43cdf7
push 0x4ccfb4
mov eax, 0x4ccfb4
call fcn.0043f8e0
add esp, 4
jmp 0x43cea7
mov eax, 8
cmp dword [esp + 0x18], eax
je 0x43ce19
mov eax, 1
push 0x4ccfb4
call fcn.0043f950
add esp, 4
jmp 0x43cea7
cmp dword [esp + 0x40], ebx
je 0x43ce55
mov ebx, eax
cmp dword [esp + 0x10], eax
jae 0x43ce3b
mov eax, 5
push 0x4ccfb4
call fcn.0043f950
add esp, 4
jmp 0x43cea7
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov dword [esi], ecx
mov cx, word [esp + 0x2a]
mov word [esi + 4], dx
mov word [esi + 6], cx
jmp 0x43ce9f
mov esi, dword [esp + 0x24]
cmp esi, dword [esp + 0x10]
jbe 0x43ce63
mov ebx, esi
jmp 0x43ce27
mov edx, dword [esp + 0x38]
xor ebx, ebx
push ebx
push ebx
push ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x43ce8c
push 0x4ccfb4
mov eax, 0x4ccfb4
call fcn.0043f8e0
add esp, 4
jmp 0x43cea7
mov ecx, dword [esp + 0x20]
mov edx, edi
call fcn.0043c470
test eax, eax
je 0x43cea7
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x43ceb1
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044557a
add esp, 0x28
ret
Function at 0x43d790
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push eax
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x43d7d6
push 0x4ccfb4
mov eax, 0x4ccfb4
call fcn.0043f8e0
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 0xb4]
xor edx, edx
sub ebx, edi
mov edi, dword [esp + 0x14]
sbb edi, edx
sub ebx, 0x298
sbb edi, ebp
xor eax, eax
cmp edi, eax
jl 0x43d868
jg 0x43d7fe
cmp ebx, ecx
jb 0x43d868
mov ebp, dword [esi]
push 0
push 0
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x43d82d
push 0x4ccfb4
mov eax, 0x4ccfb4
call fcn.0043f8e0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
mov esi, 0x298
mov edx, ebp
call fcn.0043c470
test eax, eax
je 0x43d823
mov eax, dword [esp + 0x20]
test eax, eax
je 0x43d84e
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x43d875
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x43d875
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x43e120
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4e24e0]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
cmp eax, ebp
je 0x43e261
cmp dword [esp + 0x28], ebp
je 0x43e261
push edi
push 0x2800
call fcn.00445dc6
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x43e183
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0044557a
add esp, 0x1c
ret
push ebx
push esi
xor ebx, ebx
jmp 0x43e190
push ebx
push str..PhysicalDrive_d
push 0x2800
call fcn.0043c340
add esp, 0xc
push ebp
push 0x80
push 3
push ebp
push 3
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x43e237
xor eax, eax
push 0x2800
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.0044b7d0
add esp, 0xc
push ebp
lea eax, [esp + 0x18]
push eax
push 0x2800
push edi
push 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x43e22a
mov eax, dword [edi + 0x18]
cmp eax, ebp
jbe 0x43e22a
mov edx, dword [esp + 0x34]
add eax, edi
push eax
mov eax, dword [esp + 0x1c]
push edx
push eax
push str.DISKID:
call fcn.0043deb0
add esp, 0x10
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], ebp
jne 0x43e241
inc ebx
cmp ebx, 0x10
jl 0x43e190
push edi
call fcn.00445f81
mov eax, dword [esp + 0x14]
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0044557a
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.0044557a
add esp, 0x1c
ret
Function at 0x43e310
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor esi, esi
xor ebx, ebx
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
cmp dword [esp + 0x30], esi
je 0x43e34a
cmp dword [esp + 0x34], esi
je 0x43e34a
push 0x200
call fcn.00445dc6
mov edi, eax
add esp, 4
cmp edi, esi
jne 0x43e355
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0x14]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43e4b5
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push edi
push esi
push edx
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
test eax, eax
jne 0x43e44a
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x43e3ad
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
push ecx
push 0x20119
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43e423
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43e418
mov eax, edi
mov dword [edi], 0x5c2e5c5c
call fcn.0043e280
cmp edx, ebx
jb 0x43e418
ja 0x43e412
cmp eax, dword [esp + 0x24]
jbe 0x43e418
mov dword [esp + 0x24], eax
mov ebx, edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push edi
inc esi
push esi
push edx
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
test eax, eax
je 0x43e3a0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
ja 0x43e460
cmp dword [esp + 0x24], 0
jbe 0x43e4b5
mov ecx, dword [esp + 0x24]
push ebx
push ecx
push str._012I64X
push 0x200
call fcn.0043c340
add esp, 0x10
test eax, eax
jne 0x43e499
push edi
mov dword [esp + 0x1c], 0xffffffff
call fcn.00445f81
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edi
push edx
push eax
push str.MAC:
call fcn.0043deb0
add esp, 0x10
mov dword [esp + 0x18], eax
push edi
call fcn.00445f81
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x440da0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x88
push 0xffffffffffffffff
push 0x4a4a9b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4e24e0]
xor eax, ebp
mov dword [ebp + 0x84], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [0x4eb758], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
lea eax, [ebp]
push eax
lea ecx, [ebx + 0x41]
call fcn.00440b20
add esp, 0x10
xor ecx, ecx
mov word [ebp + 0x80], cx
xor esi, esi
lea edx, [ebp]
push edx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, ebx
je 0x440ef5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x440e3f
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], ebx
call fcn.00440b90
cmp eax, ebx
je 0x440e55
mov dword [0x4eb758], eax
jmp 0x440ed6
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, ebx
je 0x440e70
push 0x5c0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x440e84
push edi
push esi
call fcn.00441220
jmp 0x440e86
xor eax, eax
mov byte [ebp - 4], bl
mov dword [0x4eb758], eax
cmp eax, ebx
jne 0x440ea7
mov dword [ebp - 0x1c], 1
push 0x4d4df0
lea eax, [ebp - 0x1c]
push eax
call fcn.0044ba3c
mov esi, 1
mov dword [ebp - 0x24], esi
push eax
call fcn.00440c60
add esp, 4
test eax, eax
jne 0x440ed1
mov dword [ebp - 0x18], 3
push 0x4d4df0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0044ba3c
mov eax, dword [0x4eb758]
inc dword [eax + 0x5bc]
mov dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp esi, ebx
jne 0x440ef5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x4eb758
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
call fcn.0044557a
add ebp, 0x88
mov esp, ebp
pop ebp
ret
Function at 0x440fe0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ef10
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4e24e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x4eb758]
xor edi, edi
cmp ecx, edi
jne 0x44102b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x441038
mov dword [ebp - 0x14], edi
jmp 0x441050
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x4410f6
mov ecx, dword [0x4eb758]
mov eax, dword [ecx]
cmp eax, edi
je 0x441017
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x441017
mov dword [ebp - 4], edi
push 0x4eb758
call fcn.00441110
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x44108e
mov dword [ebp - 0x18], 1
push 0x4d4df0
lea eax, [ebp - 0x18]
push eax
call fcn.0044ba3c
mov ecx, dword [0x4eb758]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x4410a8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
jne 0x4410bd
mov dword [ebp - 0x1c], 4
push 0x4d4df0
lea edx, [ebp - 0x1c]
push edx
call fcn.0044ba3c
mov dword [ebp - 4], 0xffffffff
jmp 0x4410e2
mov eax, dword [0x4eb758]
mov eax, dword [eax]
test eax, eax
je 0x4410f4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret