joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f814
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x49d654
cmp dword [edi], 0
jne 0x41f890
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [reloc.user32.dll_IsWindowVisible]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x49b594
mov ecx, 2
call fcn.00402738
mov edx, 0x41f7ec
lea eax, [esi + 5]
call fcn.0041f80c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041f80c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41f865
mov dword [reloc.user32.dll_IsWindowVisible], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41f994
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41f9e4]
test si, 4
je 0x41f9a8
or bl, 1
test si, 8
je 0x41f9b2
or bl, 4
test si, 1
je 0x41f9bc
or bl, 8
test si, 2
je 0x41f9c6
or bl, 0x10
test si, 0x10
je 0x41f9d0
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41f9df
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x41f9e8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x41fa20]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41fa01
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x41fa10
or bl, 4
test esi, 0x20000000
je 0x41fa1b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4239b4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [reloc.user32.dll_MessageBeep]
cmp byte [eax + 0x7f], 0
jne 0x423a07
cmp dword [reloc.user32.dll_IsWindow], 0
jne 0x4239e3
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, 0x423970
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [reloc.user32.dll_IsWindow], eax
cmp dword [reloc.user32.dll_IsRectEmpty], 0
jne 0x423a07
push esp
push 0
push 0
push 0x423920
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [reloc.user32.dll_IsRectEmpty], eax
pop edx
ret

Function at 0x423a0c
Capabilities:
Terminate thread

Disassembly:
cmp dword [reloc.user32.dll_IsWindow], 0
je 0x423a20
mov eax, dword [reloc.user32.dll_IsWindow]
push eax
call sub.user32.dll_UnhookWindowsHookEx
xor eax, eax
mov dword [reloc.user32.dll_IsWindow], eax
cmp dword [reloc.user32.dll_IsRectEmpty], 0
je 0x423a3d
push 0
mov eax, dword [reloc.user32.dll_IsRectEmpty]
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
mov dword [reloc.user32.dll_IsRectEmpty], eax
ret

Function at 0x423adc
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x423af3
add esp, 0xfffffff0
call fcn.00402d30
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00410480
mov dl, 1
mov eax, 0x40a724
call fcn.00402b30
mov dword [ebx + 0x70], eax
mov dl, 1
mov eax, 0x40a724
call fcn.00402b30
mov dword [ebx + 0x80], eax
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x3c], 0x80000018
mov dword [ebx + 0x54], 0x1f4
mov dword [ebx + 0x58], 0x32
mov dword [ebx + 0x5c], 0x9c4
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x7d], 1
mov dl, 1
mov eax, 0x419e4c
call fcn.0041de64
mov esi, eax
mov dword [ebx + 0x78], esi
push 0x423c34
mov eax, dword [0x49d014]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041e1f0
mov eax, dword [ebx + 0x78]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x424ef4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x49d014]
push eax
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.00407910
test eax, eax
je 0x423bd0
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00407778
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.004078f0
test eax, eax
je 0x423be4
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x6c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.0040355c
cmp byte [0x49d034], 0
jne 0x423c14
mov eax, ebx
call fcn.00423cc4
mov byte [ebx + 0x39], 1
mov byte [ebx + 0x3a], 1
cmp byte [ebp - 1], 0
je 0x423c2c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4246cc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x7e], 0
je 0x4246fe
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x20]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004034e0
jmp 0x424708
mov eax, esi
mov edx, dword [ebx + 0x6c]
call fcn.00403494
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4250cc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x60]
test esi, esi
je 0x425104
mov eax, esi
call fcn.004187c8
test al, al
je 0x425104
mov eax, dword [ebx + 0x60]
call fcn.00418630
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x425104
push 0
mov eax, dword [ebx + 0x60]
call fcn.00418630
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x42d11c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x42d164
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0042d010
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d16b
lea eax, [ebp - 4]
call fcn.00403400
ret

Function at 0x42d174
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x42d18d
test al, 0x10
je 0x42d191
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x42d1e4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
call fcn.00403728
xor eax, eax
push ebp
push 0x42d2d6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00403744
mov ebx, pe_nt_image_headers32
mov eax, esi
mov ecx, ebx
xor edx, edx
call fcn.004034e0
cmp dword [ebp + 0xc], 0
je 0x42d261
mov eax, dword [ebp + 0xc]
call fcn.00403738
push eax
push ebx
mov eax, esi
call fcn.00403744
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403738
push eax
mov eax, dword [ebp - 8]
call fcn.00403738
push eax
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
jmp 0x42d28a
push ebx
mov eax, esi
call fcn.00403744
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403738
push eax
mov eax, dword [ebp - 8]
call fcn.00403738
push eax
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_GetProfileStringA
test eax, eax
je 0x42d29a
mov eax, dword [esi]
call fcn.00403738
call fcn.00407710
mov edx, ebx
sub edx, 8
cmp eax, edx
jl 0x42d2ab
cmp ebx, 0x10000
jl 0x42d2b5
mov edx, esi
xchg edx, eax
call fcn.004038a4
jmp 0x42d2c0
mov eax, ebx
add eax, eax
mov ebx, eax
jmp 0x42d21c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d2dd
lea eax, [ebp - 0xc]
call fcn.00403400
ret
Function at 0x42d3ac
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov byte [ebp - 8], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x42d3f4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00403738
push eax
push 8
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00403738
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00403738
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
jmp 0x42d418
push 8
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00403738
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00403738
push eax
call sub.kernel32.dll_GetProfileStringA
push ebx
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
sete al
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x42d478
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov ebx, edx
mov esi, eax
mov byte [esp], 0
test ebx, ebx
je 0x42d4b4
mov eax, ebx
call fcn.00403738
push eax
push pe_nt_image_headers32
lea eax, [esp + 8]
push eax
push 0x42d4e4
push 0
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
jmp 0x42d4d2
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push 0x42d4e4
push 0
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_GetProfileStringA
cmp byte [esp], 0
sete al
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x42d89c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42d92a
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x42d8e7
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.004034e0
jmp 0x42d914
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x42d8fb
lea eax, [ebp - 4]
call fcn.00403400
jmp 0x42d90a
lea edx, [ebp - 4]
call fcn.0042d6f0
test ebx, ebx
je 0x42d90a
dec ebx
jmp 0x42d8ec
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403494
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d931
lea eax, [ebp - 4]
call fcn.00403400
ret

Function at 0x42dce8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00407934
add esp, 0x104
pop ebx
ret

Function at 0x42dd14
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00407934
add esp, 0x104
pop ebx
ret
Function at 0x42ddc4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42de41
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x42de1f
call sub.kernel32.dll_GetVersion
and ax, 0xff
cmp ax, 6
jb 0x42de1f
lea eax, [ebp - 8]
call fcn.0042dd14
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0042c84c
lea eax, [ebp - 4]
mov edx, 0x42de58
call fcn.0040357c
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.0042cc54
jmp 0x42de26
mov eax, esi
call fcn.00403400
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42de48
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403420
ret

Function at 0x42e050
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x42e188
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x42e172
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x42e0ad
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x42e172
cmp dword [ebp - 0x10], 0
jne 0x42e0c2
mov eax, dword [ebp - 8]
call fcn.00403400
mov bl, 1
jmp 0x42e172
cmp dword [ebp - 0x10], 0x70000000
jb 0x42e0d0
call fcn.00409050
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
lea eax, [ebp - 0x14]
mov ecx, esi
xor edx, edx
call fcn.004034e0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.00403744
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x42e076
test eax, eax
jne 0x42e172
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x42e120
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x42e172
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
jmp 0x42e12b
dec esi
test esi, esi
je 0x42e139
mov eax, dword [ebp - 0x14]
cmp byte [eax + esi - 1], 0
je 0x42e12a
cmp dword [ebp - 0xc], 7
jne 0x42e144
test esi, esi
je 0x42e144
inc esi
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.004038a4
cmp dword [ebp - 0xc], 7
jne 0x42e165
test esi, esi
je 0x42e165
lea eax, [ebp - 0x14]
call fcn.00403744
mov byte [eax + esi - 1], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.00403450
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e18f
lea eax, [ebp - 0x14]
call fcn.00403400
ret
Function at 0x42e1b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
mov edi, eax
push 0
push 0
push 0
push 0
push esi
push edi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
sete bl
test bl, bl
je 0x42e229
test esi, esi
je 0x42e1df
cmp byte [esi], 0
jne 0x42e229
cmp dword [0x49b0dc], 2
je 0x42e229
xor ebx, ebx
xor esi, esi
mov dword [esp + 4], 2
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push esi
push edi
call sub.advapi32.dll_RegEnumValueA
test eax, eax
je 0x42e218
cmp eax, 0xea
jne 0x42e229
test eax, eax
jne 0x42e226
cmp byte [esp], 0
jne 0x42e226
mov bl, 1
jmp 0x42e229
inc esi
jmp 0x42e1ec
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x42e294
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp al, 2
je 0x42e2a8
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyA
pop esi
pop ebx
ret
cmp dword [reloc.user32.dll_IsIconic], 0
jne 0x42e2cb
push 0x42e2f0
push 0x42e300
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [reloc.user32.dll_IsIconic], eax
cmp dword [reloc.user32.dll_IsIconic], 0
je 0x42e2e5
push 0
push pe_nt_image_headers32
push esi
push ebx
call dword [0x49d660]
jmp 0x42e2ea
mov eax, 0x7f
pop esi
pop ebx
ret

Function at 0x42e295
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp al, 2
je 0x42e2a8
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyA
pop esi
pop ebx
ret
cmp dword [reloc.user32.dll_IsIconic], 0
jne 0x42e2cb
push 0x42e2f0
push 0x42e300
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [reloc.user32.dll_IsIconic], eax
cmp dword [reloc.user32.dll_IsIconic], 0
je 0x42e2e5
push 0
push pe_nt_image_headers32
push esi
push ebx
call dword [0x49d660]
jmp 0x42e2ea
mov eax, 0x7f
pop esi
pop ebx
ret
Function at 0x42e310
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x42e453
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x42e343
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
jne 0x42e34d
mov ebx, 0x57
jmp 0x42e43d
cmp dword [0x49b0dc], 2
jne 0x42e42d
push 0
push 8
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov al, byte [ebp - 1]
call fcn.0042e26c
test eax, eax
jne 0x42e42d
xor edx, edx
push ebp
push 0x42e426
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
mov ecx, pe_nt_image_headers32
xor edx, edx
call fcn.004034e0
xor ebx, ebx
mov eax, dword [ebp - 0x14]
call fcn.00403574
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
call fcn.00403744
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0xea
jne 0x42e3ef
mov eax, dword [ebp - 0x14]
call fcn.00403574
cmp eax, 0x10000
jge 0x42e40f
mov eax, dword [ebp - 0x14]
call fcn.00403574
mov ecx, eax
add ecx, ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004034e0
jmp 0x42e397
test eax, eax
jne 0x42e40f
mov eax, dword [ebp - 0x14]
call fcn.00403738
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov al, byte [ebp - 1]
call fcn.0042e310
test eax, eax
je 0x42e397
inc ebx
jmp 0x42e397
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e42d
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov al, byte [ebp - 1]
call fcn.0042e294
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e45a
lea eax, [ebp - 0x14]
call fcn.00403400
ret

Function at 0x42e464
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov edi, edx
mov ebx, eax
push 0
push 1
lea eax, [esp + 8]
push eax
mov ecx, ebp
mov edx, edi
mov eax, ebx
call fcn.0042e26c
mov esi, eax
test esi, esi
jne 0x42e4e2
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x2c]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov esi, eax
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
test esi, esi
jne 0x42e4e2
cmp dword [esp + 4], 0
jne 0x42e4dd
cmp dword [esp + 8], 0
jne 0x42e4dd
mov ecx, ebp
mov edx, edi
mov eax, ebx
call fcn.0042e294
mov esi, eax
jmp 0x42e4e2
mov esi, 0x91
mov eax, esi
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42e4ec
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
cmp dword [0x49b0dc], 2
je 0x42e508
mov byte [ebp - 1], 1
jmp 0x42e6d7
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x49b788
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x42e6d7
xor eax, eax
push ebp
push 0x42e6d0
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and ax, 0xff
cmp ax, 5
jb 0x42e569
push 0x42e6e0
push 0x42e6f8
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x42e592
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x42e6b9
mov eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 1], al
jmp 0x42e6b9
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 1
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x42e5e3
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
je 0x42e5c4
call fcn.004031bc
jmp 0x42e6d7
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x42e5e3
call fcn.004031bc
jmp 0x42e6d7
xor eax, eax
push ebp
push 0x42e6b2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x42e626
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
je 0x42e626
call fcn.004031bc
call fcn.004031bc
jmp 0x42e6d7
mov eax, dword [ebp - 0x14]
call fcn.00402648
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x42e658
call fcn.004031bc
call fcn.004031bc
jmp 0x42e6d7
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x42e693
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x42e68f
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x42e68f
mov byte [ebp - 1], 1
jmp 0x42e693
inc ebx
dec esi
jne 0x42e665
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e6b9
mov eax, dword [ebp - 0x18]
call fcn.00402660
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e6d7
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f0d8
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x42f178
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49b0dc], 2
jne 0x42f11c
push 1
mov eax, esi
call fcn.00403738
push eax
mov eax, edi
call fcn.00403738
push eax
call sub.kernel32.dll_MoveFileExA
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
jmp 0x42f162
mov eax, esi
call fcn.00403738
mov edx, eax
lea eax, [ebp - 4]
call fcn.0040352c
mov eax, dword [ebp - 4]
call fcn.004073a0
mov ebx, eax
test bl, bl
jne 0x42f145
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
jne 0x42f162
mov eax, esi
call fcn.00403738
push eax
mov eax, edi
call fcn.00403738
push eax
call sub.kernel32.dll_MoveFileA
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f17f
lea eax, [ebp - 4]
call fcn.00403400
ret

Function at 0x431208
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
ret