joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d6a5
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push str.HKLMSoftwareMicrosoftOffice11.0Registration
call fcn.00420a92
test eax, eax
je 0x41d7b5
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41d71e
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x41d715
mov eax, dword [ebp - 8]
inc eax
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00406235
test al, al
jne 0x41d725
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x41d7b4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
mov edi, dword [ebp - 0x1c]
cmp dword [ebp - 0x10], ebx
jbe 0x41d79f
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x41d7c7
push edi
call fcn.0041d7d7
test eax, eax
je 0x41d799
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41d799
push 3
push 0x4b8290
push 0x4b828c
push 0x4b8798
push dword [ebp - 0xc]
call fcn.00420a02
push dword [ebp - 0xc]
test eax, eax
jne 0x41d7b9
call esi
inc ebx
cmp ebx, dword [ebp - 0x10]
jb 0x41d735
push edi
call fcn.0046d68f
pop ecx
push dword [ebp - 4]
call esi
cmp ebx, dword [ebp - 0x10]
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x4b8288], 1
call esi
jmp 0x41d79f
push dword [ebp - 4]
call esi
push edi
call fcn.0046d68f
pop ecx
xor eax, eax
jmp 0x41d7b2

Function at 0x41d894
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
or ebx, 0xffffffff
cmp dword [edi], ebx
jne 0x41d8a7
xor eax, eax
jmp 0x41d90d
push esi
xor esi, esi
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi + 0xc], eax
cmp eax, ebx
je 0x41d900
test eax, eax
je 0x41d900
push esi
push eax
push esi
push 8
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [edi + 4], eax
test eax, eax
je 0x41d900
push esi
push esi
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 8], eax
test eax, eax
jne 0x41d8fb
push dword [edi + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [edi]
and dword [edi + 4], 0
call esi
jmp 0x41d908
xor eax, eax
inc eax
jmp 0x41d90c
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], ebx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x41e024
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x96c
mov eax, dword [0x4b8f40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x96c]
push edi
push 0x3c
pop edi
push edi
push 0
push eax
mov dword [ebp - 0x930], 0x824
call fcn.0044f154
add esp, 0xc
mov dword [ebp - 0x96c], edi
mov dword [ebp - 0x958], 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x95c], eax
test esi, esi
je 0x41e1bc
mov edi, 0x10000000
lea eax, [ebp - 0x930]
push edi
push eax
lea eax, [ebp - 0x92c]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
test eax, eax
je 0x41e1bc
lea eax, [ebp - 0x96c]
push eax
push edi
push dword [ebp - 0x930]
lea eax, [ebp - 0x92c]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x41e1bc
cmp dword [ebp - 0x960], 3
je 0x41e0dc
cmp dword [ebp - 0x960], 4
jne 0x41e1bc
push dword [ebp - 0x95c]
call fcn.00406215
mov esi, str.http:__
mov edi, eax
push esi
call fcn.00406215
push eax
lea eax, [ebp - 0x92c]
push esi
push eax
call fcn.0046b636
add esp, 0xc
test eax, eax
je 0x41e12d
mov esi, str.https:__
push esi
call fcn.00406215
push eax
lea eax, [ebp - 0x92c]
push esi
push eax
call fcn.0046b636
add esp, 0xc
test eax, eax
jne 0x41e1bc
push esi
call fcn.00406215
lea eax, [ebp + eax - 0x92c]
jmp 0x41e141
test cl, cl
je 0x41e1bc
inc eax
mov cl, byte [eax]
cmp cl, 0x2f
jne 0x41e13c
test cl, cl
je 0x41e1bc
mov esi, dword [ebp - 0x95c]
mov ebx, str..microsoft.com
push ebx
add esi, edi
call fcn.00406215
cmp edi, eax
jl 0x41e17b
push eax
mov ecx, esi
sub ecx, eax
push ebx
push ecx
call fcn.0046b636
add esp, 0xc
test eax, eax
jne 0x41e17b
xor eax, eax
inc eax
jmp 0x41e1be
mov ebx, str..msn.com
push ebx
call fcn.00406215
cmp edi, eax
jl 0x41e19b
push eax
sub esi, eax
push ebx
push esi
call fcn.0046b636
add esp, 0xc
test eax, eax
je 0x41e176
mov esi, str.microsoft.com
push esi
call fcn.00406215
cmp edi, eax
jne 0x41e1bc
push esi
push dword [ebp - 0x95c]
call fcn.0046b557
pop ecx
pop ecx
test eax, eax
je 0x41e176
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044d772
mov esp, ebp
pop ebp
ret 4
Function at 0x41efc1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x864
mov eax, dword [0x4b8f40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x41f09a
call fcn.0041e1d1
test eax, eax
je 0x41f003
push str.Launching_browser_with_URL
call fcn.0041fda5
push esi
call fcn.0041fda5
push 0x47e068
call fcn.0041fda5
cmp dword [0x4bcc7c], 0
jne 0x41f016
push esi
call fcn.0041df5f
test eax, eax
je 0x41f020
push esi
call fcn.0041d591
test eax, eax
jne 0x41f09a
push 0x824
lea eax, [ebp - 0x828]
push eax
push esi
call fcn.00401f74
cmp dword [ebp + 0xc], 0
je 0x41f046
lea eax, [ebp - 0x828]
push eax
call fcn.0041fcd2
jmp 0x41f09a
push 0x38
lea eax, [ebp - 0x860]
push 0
push eax
call fcn.0044f154
add esp, 0xc
mov dword [ebp - 0x864], 0x3c
lea eax, [ebp - 0x828]
mov dword [ebp - 0x848], 0xa
mov dword [ebp - 0x854], eax
lea eax, [ebp - 0x864]
mov dword [ebp - 0x860], 0x100
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x41f09a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044d772
mov esp, ebp
pop ebp
ret 8

Function at 0x41f10c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
jne 0x41f11b
xor eax, eax
jmp 0x41f181
cmp dword [ebp + 0x10], 0
push esi
je 0x41f145
push 0
push dword [ebp + 0x10]
call fcn.0042036b
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41f180
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0044ec08
add esp, 0xc
jmp 0x41f148
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push 0
push esi
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
test eax, eax
jne 0x41f169
push esi
call dword [ebp + 8]
jmp 0x41f17d
mov ecx, dword [0x4bcc84]
test ecx, ecx
je 0x41f180
lea eax, [ebp - 4]
push eax
push ecx
call fcn.0044b692
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41f734
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], 0x44
push 0x40
lea eax, [ebp - 0x54]
xorps xmm0, xmm0
push ebx
mov esi, ebx
push eax
mov dword [ebp - 4], esi
movups xmmword [ebp - 0x14], xmm0
call fcn.0044f154
add esp, 0xc
push 0xfa0
push dword [0x4bf994]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [ebp + 8]
test edi, edi
je 0x41f7b5
push ebx
push ebx
push 0xffffffffffffffff
push edi
push ebx
push dword [0x4bcc74]
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call ebx
lea esi, [eax + 1]
lea ecx, [esi + esi]
push ecx
lea eax, [ebp - 4]
push eax
call fcn.00406235
test al, al
je 0x41f7f4
push esi
mov esi, dword [ebp - 4]
push esi
push 0xffffffffffffffff
push edi
push 0
push dword [0x4bcc74]
call ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x4000000
push ebx
push ebx
push ebx
push esi
push 0x4bfbc4
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test esi, esi
je 0x41f7e0
push esi
call fcn.0046d68f
pop ecx
test edi, edi
je 0x41f7f4
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41fa08
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x4b8f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x114]
push esi
mov esi, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x118]
push ecx
push eax
call fcn.00420a92
test eax, eax
je 0x41fbcf
push edi
push 0x104
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x114]
call fcn.00401f74
lea eax, [ebp - 0x108]
push eax
call fcn.0041f644
mov edi, eax
cmp byte [edi], 0x5c
jne 0x41fbce
push ebx
lea eax, [ebp - 0x110]
xor ebx, ebx
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x108]
mov byte [edi], bl
push eax
push dword [ebp - 0x118]
inc edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41fbcd
mov eax, dword [esi + 0xc]
sub eax, ebx
je 0x41fb93
sub eax, 1
je 0x41fb73
sub eax, 1
je 0x41fb57
sub eax, 1
jne 0x41fbc1
mov dword [ebp - 0x10c], ebx
lea eax, [ebp - 0x128]
inc ebx
push ebx
push eax
lea eax, [ebp - 0x10c]
push eax
push edi
push dword [ebp - 0x110]
call fcn.00420a02
test eax, eax
je 0x41fbc1
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push dword [ebp - 0x10c]
push eax
push eax
call edi
mov dword [ebp - 0x11c], eax
add eax, eax
push 0
push eax
mov dword [ebp - 0x120], eax
call fcn.0042036b
mov dword [esi + 4], eax
pop ecx
pop ecx
test eax, eax
je 0x41fb40
push dword [ebp - 0x11c]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x10c]
push 0
push 0
call edi
mov eax, dword [ebp - 0x120]
mov dword [esi + 8], eax
mov dword [esi], ebx
cmp dword [ebp - 0x10c], 0
je 0x41fbc1
push dword [ebp - 0x10c]
call fcn.0046d68f
pop ecx
jmp 0x41fbc1
push 3
lea eax, [esi + 8]
push eax
lea eax, [esi + 4]
push eax
push edi
push dword [ebp - 0x110]
call fcn.00420a02
test eax, eax
je 0x41fbc1
jmp 0x41fbbb
xor ebx, ebx
lea eax, [esi + 8]
inc ebx
push ebx
push eax
lea eax, [esi + 4]
push eax
push edi
push dword [ebp - 0x110]
call fcn.00420a02
test eax, eax
je 0x41fbc1
mov dword [esi], ebx
jmp 0x41fbc1
lea eax, [ebp - 0x124]
mov dword [ebp - 0x124], 4
push eax
lea eax, [esi + 4]
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41fbc1
mov dword [esi], 1
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044d772
mov esp, ebp
pop ebp
ret 8

Function at 0x41fcd2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00406215
xor ebx, ebx
push ebx
lea esi, [eax + 1]
push esi
call fcn.0042036b
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x41fd12
push esi
push edi
push dword [ebp + 8]
call fcn.00401f74
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0x41fc7e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x420643
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebp
ret 4
Function at 0x420933
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x420962
xor eax, eax
jmp 0x42098b
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
xor ecx, ecx
test eax, eax
cmovne esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x420992
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4b8f40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4209f3
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0044d772
mov esp, ebp
pop ebp
ret

Function at 0x420e2f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x4b8f40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x464]
push edi
push 0x40
xor edi, edi
mov dword [ebp - 0x468], 0x44
push edi
push eax
call fcn.0044f154
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0x424], xmm0
push esi
call fcn.00401f4a
cmp eax, 0x104
jg 0x420edd
push dword [ebp + 0xc]
lea eax, [ebp - 0x414]
push 0x6b
push esi
push str.__s____c__u
push 0x208
push eax
call fcn.004026a1
add esp, 0x18
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x468]
push eax
push edi
push edi
push 0x4000020
push edi
push edi
push edi
lea eax, [ebp - 0x414]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x420edd
push dword [ebp - 0x424]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x420]
call esi
jmp 0x420ee7
push 0x30303030
call fcn.0044b12a
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044d772
mov esp, ebp
pop ebp
ret 8
Function at 0x4212cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00420a92
test eax, eax
je 0x42133d
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42133d
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push str.DWReporteeName
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x421333
cmp dword [ebp - 0x10], 1
je 0x421333
mov word [esi], ax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x424757
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478caf
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4b8f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 0x10]
mov dword [ebx], 0x48026c
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x28], edx
or dword [ebx + 0x2c], 0xffffffff
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x44], edx
mov dword [ebx + 0x48], edx
mov dword [ebx + 0x4c], edx
mov dword [ebx + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], ecx
mov eax, dword [ecx + 4]
and dword [ebx + 0x8c], 0xffffffc0
and byte [ebx + 0x91], 0x80
or dword [ebx + 0x94], 0xffffffff
or dword [ebx + 0x98], 0xffffffff
mov dword [ebx + 0x64], eax
xor eax, eax
inc eax
mov dword [ebx + 0x68], edx
mov dword [ebx + 0x6c], edx
mov dword [ebx + 0x70], edx
mov dword [ebx + 0x74], edx
mov byte [ebx + 0x90], 0x4f
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], edx
mov dword [ebx + 0xa8], edx
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x424832
mov eax, dword [ecx + 0x24]
mov dword [ebx + 0x78], eax
mov dword [ecx + 0x24], ebx
mov eax, dword [ebx + 0x5c]
lea edi, [ebx + 0x58]
push 1
push edx
push edi
mov dword [eax + 4], ebx
lea esi, [ebx + 0x54]
mov ecx, dword [ebx + 0x60]
push esi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
push 4
push dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_MulDiv]
push 6
call esi
push 8
push dword [edi]
mov dword [ebx + 0x7c], eax
push 2
call esi
mov ecx, dword [ebx + 0x7c]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x88], eax
mov eax, ebx
mov dword [ebx + 0x84], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43449e
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x478e14
call fcn.0044dd39
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4344b8
xor al, al
jmp 0x434589
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x4344c9
xor ecx, ecx
cmp dword [0x4d172c], ecx
jmp 0x4344d3
push esi
call fcn.004342b1
xor ecx, ecx
test al, al
sete cl
test ecx, ecx
jne 0x4344b1
xor edi, edi
lea ecx, [ebp + 0xf]
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], edi
call fcn.0043377b
xor ecx, ecx
mov dword [ebp - 4], edi
push 2
test bl, bl
pop eax
cmovne ecx, eax
movzx eax, word [esi + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp - 0x14], ecx
or eax, ecx
jmp 0x43455d
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x434513
mov eax, dword [ebx]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
push edi
call fcn.004342db
push ebx
test eax, eax
je 0x434577
mov eax, dword [esi + 0xc]
xor edi, edi
mov ecx, 0x4d1418
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
mov dword [eax + 0x4b8818], edi
call fcn.004341a8
movzx eax, word [esi + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp + 8], edi
or eax, dword [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 0xc]
call fcn.00433821
mov edi, eax
test edi, edi
je 0x434507
jmp 0x43457c
call fcn.00434b82
lea ecx, [ebp + 0xf]
call fcn.004337c0
test edi, edi
sete al
call fcn.0044dd0a
ret 8
Function at 0x4346ca
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x4346f0
cmp dword [0x4d172c], edi
je 0x4347e1
push 2
pop esi
jmp 0x434709
cmp edi, 1
jne 0x4347e1
push ebx
call fcn.004342b1
test al, al
je 0x4347e1
xor esi, esi
lea ecx, [ebp + 0xb]
mov dword [ebp - 0xc], esi
call fcn.0043377b
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
push eax
movzx eax, word [ebx + 0x10]
shr eax, 1
and eax, 0x10
or eax, esi
jmp 0x434790
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
test eax, eax
jne 0x43473e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push esi
call fcn.004342db
push dword [ebp - 4]
test eax, eax
je 0x4347a9
mov eax, dword [ebx + 0xc]
xor esi, esi
mov ecx, 0x4d1418
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
mov dword [eax + 0x4b8818], esi
call fcn.004341a8
movzx eax, word [ebx + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp - 4], esi
or eax, dword [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebx + 0xc]
call fcn.00433821
mov esi, eax
test esi, esi
je 0x43472a
jmp 0x4347d9
call fcn.00434b82
test esi, esi
jne 0x4347d9
movzx ecx, word [ebx + 0x10]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x10], eax
je 0x4347f6
cmp dword [ebp - 0x10], 3
jne 0x4347d6
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
jne 0x4347d6
and cl, 0xf
cmp cl, 4
je 0x4347f6
push 2
pop esi
lea ecx, [ebp + 0xb]
call fcn.004337c0
inc edi
cmp edi, 2
jl 0x4346d8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp + 0xb]
mov dword [eax], 1
call fcn.004337c0
xor eax, eax
jmp 0x4347ed
Function at 0x4358f7
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x4b8f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x408], eax
test esi, esi
jne 0x435940
xor eax, eax
jmp 0x435aa5
and dword [esi], 0
push ebx
push edi
xor edi, edi
inc edi
push edi
push eax
push ecx
push 0x400
lea eax, [ebp - 0x404]
push eax
call fcn.00436b5d
mov edx, dword [ebp - 0x408]
mov ecx, eax
mov eax, edx
mov dword [ebp - 0x418], ecx
shr eax, 0x1a
xor ebx, ebx
and dword [ebp - 0x41c], ebx
not eax
and eax, edi
mov dword [ebp - 0x414], eax
test ecx, ecx
je 0x4359a7
mov eax, edx
shr eax, 0x17
push ecx
and eax, edi
push eax
push 0x120001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov edx, dword [ebp - 0x408]
mov dword [esi], eax
mov eax, dword [ebp - 0x414]
cmp dword [esi], ebx
jne 0x435a4a
test eax, eax
je 0x435a4a
xor eax, eax
push edi
lea eax, [ebp - 0x40c]
push eax
push edx
call fcn.00436913
test eax, eax
je 0x435a3a
mov eax, dword [ebp - 0x408]
push dword [ebp - 0x418]
shr eax, 0x19
and eax, edi
push eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x40c]
push edi
push eax
push dword [ebp - 0x408]
call fcn.00436a47
mov eax, dword [ebp - 0x410]
cmp eax, 5
jne 0x435a3c
cmp dword [ebp - 0x41c], ebx
jne 0x435a3c
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x418]
mov edx, dword [ebp - 0x408]
mov dword [ebp - 0x41c], edi
jmp 0x435981
mov eax, ebx
cmp dword [esi], ebx
je 0x435a4a
xor ebx, ebx
cmp eax, 0xb7
setne bl
cmp dword [esi], 0
je 0x435a54
cmp dword [esi], 0xffffffff
jne 0x435a6e
cmp dword [ebp - 0x414], 0
je 0x435a67
push 0x1631e1
call fcn.0044b12a
and dword [esi], 0
xor ebx, ebx
xor edi, edi
mov edx, dword [ebp - 0x420]
test edx, edx
je 0x435a95
mov ecx, dword [ebp - 0x418]
mov eax, 0x47c7e1
test ecx, ecx
cmovne eax, ecx
push eax
push dword [ebp + 0x14]
push edx
call fcn.0046d1be
add esp, 0xc
mov eax, dword [ebp - 0x424]
test eax, eax
je 0x435aa1
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044d772
mov esp, ebp
pop ebp
ret 0x1c