joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4345c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesAeFilterMaintenanceModeECL
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x434600
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0
push str.AddToCEcl
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], eax
setne al
mov esp, ebp
pop ebp
ret

Function at 0x434640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesAeFilterMaintenanceModeECL
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43468a
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + 0x200]
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0
push str.IncludeDll
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], eax
setne al
mov esp, ebp
pop ebp
ret 4

Function at 0x4346c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesAeFilterMaintenanceModeECL
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x434700
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0
push str.PolicyStatus
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], eax
setne al
mov esp, ebp
pop ebp
ret
Function at 0x4349b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesAeFilterMaintenanceModeECL
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4349eb
xor eax, eax
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 0
push str.PolicyList
push edx
call edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x434a59
shr eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
push esi
neg ecx
or ecx, eax
push ecx
call fcn.004d4853
mov esi, eax
add esp, 4
test esi, esi
je 0x434a58
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push str.PolicyList
push ecx
call edi
mov edi, dword [ebp + 8]
mov edx, esi
call fcn.00401ec0
push esi
call fcn.004d632b
add esp, 4
pop esi
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x436950
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push 0x208
push ecx
lea edx, [ebp - 0x20e]
push edx
mov dword [ebp - 0x454], eax
mov word [ebp - 0x210], cx
call fcn.004da450
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4369b2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4
push esi
lea ecx, [ebp - 0x460]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
jne 0x4369de
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4
push ebx
push esi
call fcn.004d4853
mov ebx, eax
add esp, 4
xor eax, eax
test ebx, ebx
je 0x436ade
push edi
push 0x208
xor edi, edi
lea ecx, [ebp - 0x41a]
push edi
push ecx
mov word [ebp - 0x41c], ax
call fcn.004da450
mov edx, dword [ebp - 0x460]
add esp, 0xc
push ebx
push esi
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x436ad1
lea ecx, [ebp - 0x45c]
push ecx
lea edx, [ebp - 0x458]
push edx
push 0x504a74
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x436ad1
cmp dword [ebp - 0x45c], 0x34
jne 0x436ad1
mov eax, dword [ebp - 0x458]
push 0x34
push eax
lea ecx, [ebp - 0x450]
push ecx
call fcn.004da560
mov eax, dword [ebp - 0x43c]
movzx edx, ax
mov edi, eax
mov eax, dword [ebp - 0x440]
push edx
movzx ecx, ax
shr edi, 0x10
push edi
push ecx
shr eax, 0x10
push eax
lea edx, [ebp - 0x41c]
push str._d._d._d._d
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x41c]
add esp, 0x24
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x436ab0
mov esi, dword [ebp - 0x454]
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x41c]
call fcn.004027c0
push ebx
call fcn.004d5559
add esp, 4
mov ax, di
pop edi
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
pop esi
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4
Function at 0x437410
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x802]
push edx
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x808], 0
mov word [ebp - 0x804], cx
call fcn.004da450
push esi
lea eax, [ebp - 0x804]
push str.SYSTEMCurrentControlSetServices_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea ecx, [ebp - 0x808]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x804]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x80c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4374b5
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x808]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x80c]
push eax
push 0
push 0
push 0
push str.ImagePath
push ecx
call edi
mov eax, dword [ebp - 0x80c]
test eax, eax
je 0x43754e
shr eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d4853
mov esi, eax
add esp, 4
test esi, esi
je 0x43754e
mov ecx, dword [ebp - 0x808]
lea eax, [ebp - 0x80c]
push eax
push esi
push 0
push 0
push str.ImagePath
push ecx
call edi
test eax, eax
jne 0x437545
mov edx, dword [ebp - 0x80c]
mov eax, dword [ebp - 0x814]
shr edx, 1
push esi
inc edx
push edx
push eax
call fcn.004d72e3
add esp, 0xc
mov dword [ebp - 0x810], 1
push esi
call fcn.004d632b
add esp, 4
mov ecx, dword [ebp - 0x808]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x810]
pop edi
xor ecx, ebp
pop esi
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4
Function at 0x438ae0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x208
push eax
lea ecx, [ebp - 0x20e]
push ecx
xor esi, esi
mov word [ebp - 0x210], ax
call fcn.004da450
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 1
push esi
push 0x23
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x438bf5
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x438b40
sub eax, edx
sar eax, 1
lea esi, [eax + 0x14]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.004d4853
mov edi, eax
add esp, 4
mov dword [ebx], edi
test edi, edi
je 0x438be3
test esi, esi
je 0x438b91
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, esi
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edx, dword [ebx]
lea ecx, [ebp - 0x210]
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x438ba0
mov edi, dword [ebx]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x438bb6
mov ecx, 0xa
mov esi, str.AEORGAEConfig.xml
rep movsd dword es:[edi], dword [esi]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004d5564
mov esp, ebp
pop ebp
ret
Function at 0x438ce0
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
mov edi, ebx
mov dword [ebp - 0x80c], ebx
call fcn.00438eb0
push str._ECL__ITEMS___ITEMS___ECL_
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
test edi, edi
jne 0x438d25
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret
push esi
lea esi, [ebx + 0x2c]
call fcn.004d1380
push edi
test al, al
jne 0x438d4c
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
add ebx, 0x30
push esi
mov esi, ebx
call fcn.004d1450
add esp, 4
test al, al
je 0x438d39
mov esi, dword [ebp - 0x80c]
lea ecx, [esi + 0x4c0]
call fcn.00434740
lea edi, [esi + 0x4c4]
push edi
call fcn.004349b0
mov edx, dword [edi]
push ebx
mov ecx, str.POLICYLIST
call fcn.004d1860
add esp, 4
call fcn.004345c0
test eax, eax
je 0x438db1
call fcn.004346c0
test eax, eax
je 0x438daa
mov edx, str.Allow
jmp 0x438db6
mov edx, str.Block
jmp 0x438db6
mov edx, 0x517384
push ebx
mov ecx, str.POLICYSTATUS
call fcn.004d1860
add esp, 4
call fcn.004345c0
mov edx, 0x50dfc0
test eax, eax
jne 0x438dd7
mov edx, 0x50dfc4
push ebx
mov ecx, str.ADDTOCCL
call fcn.004d1860
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
add esp, 4
mov ecx, 0x100
lea edi, [ebp - 0x804]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x804]
push ecx
push 0
mov dword [ebp - 0x808], 0x200
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x100
lea edi, [ebp - 0x404]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x404]
push ecx
mov dword [ebp - 0x808], 0x200
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push ebx
lea edx, [ebp - 0x404]
mov ecx, str.USERNAME
call fcn.004d1860
push ebx
lea edx, [ebp - 0x804]
mov ecx, str.MACHINENAME
call fcn.004d1860
add esp, 8
add esi, 0x34
mov eax, str.ITEMS
call fcn.004d15d0
mov ecx, dword [ebp - 4]
xor edx, edx
test al, al
setne dl
pop esi
pop edi
xor ecx, ebp
pop ebx
mov eax, edx
call fcn.004d5564
mov esp, ebp
pop ebp
ret
Function at 0x439150
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc618
mov eax, dword fs:[0]
push eax
sub esp, 0x8bc
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x354], esi
je 0x439374
lea eax, [ebp - 0x8c8]
push eax
call fcn.0045f4f0
mov dword [ebp - 4], esi
push 1
mov dword [ebp - 0x870], esi
call fcn.00409870
mov dword [ebp - 0x874], eax
mov dword [eax], eax
mov eax, dword [ebp - 0x874]
add esp, 4
mov dword [eax + 4], eax
mov byte [ebp - 4], 2
lea esi, [ebp - 0x8c8]
call fcn.0045f6c0
lea eax, [edi + 0x2bc]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 0x8c0], eax
lea eax, [edi + 0x2dc]
lea ebx, [edi + 0x2cc]
lea ecx, [ebp - 0x874]
add edi, 0x30c
mov dword [ebp - 0x8c4], ebx
mov dword [ebp - 0x878], eax
mov dword [ebp - 0x8bc], eax
mov dword [ebp - 0x8b8], edi
mov dword [ebp - 0x8b4], ecx
call fcn.0045f630
call fcn.00443200
lea edx, [ebp - 0x860]
push edx
mov esi, eax
call fcn.0040a1d0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x868]
push eax
push 4
push 0x82170
lea edx, [ebp - 0x864]
lea ecx, [ebp - 0x860]
mov dword [ebp - 0x864], esi
mov dword [ebp - 0x868], 0
call fcn.0040a620
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x860]
push ecx
call fcn.0040a310
cmp dword [ebp - 0x8ac], 0
jne 0x43929e
lea edx, [ebp - 0x8a8]
push edx
push 0
lea eax, [ebp - 0x8c8]
push eax
push 0x45f790
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x8ac], eax
lea esi, [ebp - 0x8c8]
call fcn.00460540
call fcn.00443200
lea ecx, [ebp - 0x860]
push ecx
mov esi, eax
call fcn.0040a1d0
mov byte [ebp - 4], 4
lea edx, [ebp - 0x864]
push edx
push 4
push 0x82174
lea edx, [ebp - 0x868]
lea ecx, [ebp - 0x860]
mov dword [ebp - 0x868], esi
mov dword [ebp - 0x864], 0
call fcn.0040a620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x860]
push eax
call fcn.0040a310
lea ecx, [ebp - 0x874]
push ecx
push ebx
call fcn.0043b060
mov eax, dword [ebp - 0x87c]
lea edx, [ebp - 0x874]
push edx
push eax
call fcn.0043b060
mov edx, dword [ebp - 0x878]
lea ecx, [ebp - 0x874]
push ecx
push edx
call fcn.0043b060
lea eax, [ebp - 0x874]
push eax
push edi
call fcn.0043b060
mov byte [ebp - 4], 5
lea ebx, [ebp - 0x874]
call fcn.00409750
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x874]
push ecx
call fcn.004d5559
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x8c8]
push edx
call fcn.0045f580
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret
Function at 0x43d320
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f82f0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5365f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.00462560
test eax, eax
je 0x43d423
lea eax, [ebp - 0x10]
push eax
mov ecx, str.AlertIcon.bmp
call fcn.00401db0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
push esi
lea ecx, [ebp - 0x10]
push ecx
call fcn.00449c80
push esi
call fcn.004d5559
mov eax, dword [edi]
add esp, 4
cmp dword [eax - 0xc], 0
jne 0x43d3d7
lea eax, [ebp - 0x10]
call fcn.00402620
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43d3c1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43d3ec
push 0x80004005
call fcn.00401110
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.004d5750
add esp, 8
test eax, eax
jne 0x43d436
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43d423
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov eax, dword [edi]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
test esi, esi
je 0x43d453
lea eax, [ebp - 0x10]
call fcn.00402620
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43d479
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43f4f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, edx
lea edx, [ebp - 0x408]
push edx
push 0x20019
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43f584
push 0x3ff
push eax
mov dword [ebp - 0x40c], eax
mov byte [ebp - 0x404], al
lea eax, [ebp - 0x403]
push eax
mov dword [ebp - 0x410], 0x400
call fcn.004da450
add esp, 0xc
lea ecx, [ebp - 0x410]
push ecx
mov ecx, dword [ebp - 0x408]
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x40c]
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x43f597
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x40c]
cmp eax, 1
je 0x43f5c7
cmp eax, 2
je 0x43f5c7
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0x404]
call fcn.00401ec0
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop edi
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4

Function at 0x4410e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f39f8
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x5365f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov esi, dword [ebp + 0x1c]
xor bl, bl
test eax, eax
jne 0x44111b
test esi, esi
je 0x44113d
cmp dword [ebp + 0x20], 8
mov edx, dword [ebp + 0xc]
jae 0x441127
lea edx, [ebp + 0xc]
add esi, esi
push esi
push edx
push 1
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x44113d
mov bl, 1
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x20], 8
jb 0x441156
mov eax, dword [ebp + 0xc]
push eax
call fcn.004d5559
add esp, 4
xor ecx, ecx
mov dword [ebp + 0x20], 7
mov dword [ebp + 0x1c], 0
mov word [ebp + 0xc], cx
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x441770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5208
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5365f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesAeFilterUsersInfo
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x441806
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4417f1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
push 0
push edx
push eax
call edi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x44186f
shr eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d4853
mov esi, eax
add esp, 4
test esi, esi
je 0x44186f
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 0
push ecx
push edx
call edi
mov edi, dword [ebp + 0xc]
mov edx, esi
call fcn.00401ec0
push esi
call fcn.004d632b
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44189f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x442470
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
push ebx
xor ebx, ebx
cmp word [eax], bx
jne 0x44248a
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
push ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx ecx, word [ebp + 8]
push 0x51565c
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
je 0x44256a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x44256a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x44256a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x44256a
mov edx, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x442553
push 0
push ebx
push 0
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x442556
push 0
push 0
push 0
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x442553
mov eax, dword [ebp + 8]
push ebx
push eax
push esi
call fcn.004da560
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x442563
push edi
call ebx
test esi, esi
je 0x44256a
push esi
call ebx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8