joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ae18
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x43ae49
je 0x43aea3
sub eax, 7
je 0x43ae6a
dec eax
je 0x43ae94
sub eax, 0x17
je 0x43af48
jmp 0x43af86
add eax, 0xffffff00
sub eax, 9
jb 0x43af34
add eax, 0xffffff09
sub eax, 0xb
jb 0x43aefc
jmp 0x43af86
mov eax, ebx
call fcn.00421e48
mov edi, eax
test edi, edi
je 0x43afe6
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x43afef
jmp 0x43afe6
test byte [ebx + 0x44], 0x20
jne 0x43afef
jmp 0x43afe6
mov edx, esi
mov eax, ebx
call fcn.00438418
cmp dword [esi + 0xc], 0xffffffff
jne 0x43afef
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00406c2c
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.00436f64
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.0043acf0
test eax, eax
je 0x43afef
mov dword [esi + 0xc], 1
jmp 0x43afef
mov edx, esi
mov eax, ebx
call fcn.0043ad84
test al, al
je 0x43afe6
cmp dword [esi + 0xc], 0
jne 0x43afef
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.0043d480
push eax
call sub.user32.dll_DefWindowProcA
jmp 0x43afef
mov eax, ebx
call fcn.00437ab4
test al, al
jne 0x43afef
jmp 0x43afe6
mov eax, ebx
call fcn.0043d480
mov edi, eax
call sub.user32.dll_GetCapture
cmp edi, eax
jne 0x43afe6
cmp dword [0x454914], 0
je 0x43afe6
mov eax, dword [0x454914]
cmp ebx, dword [eax + 0x24]
jne 0x43afe6
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x454914]
call fcn.0043834c
jmp 0x43afe6
mov eax, dword [0x455784]
cmp byte [eax + 0x20], 0
je 0x43afe6
mov eax, dword [0x455784]
cmp dword [eax + 0x1c], 0
je 0x43afe6
mov eax, dword [esi]
mov edx, dword [0x455784]
cmp eax, dword [edx + 0x1c]
jne 0x43afe6
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.00421d8c
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.00402e30
jmp 0x43afef
mov edx, esi
mov eax, ebx
call fcn.00438418
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b4b0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x43b4cc
cmp dword [esi + 4], 0
je 0x43b4f9
test byte [ebx + 0x45], 1
jne 0x43b4eb
mov eax, ebx
call fcn.0043a3e8
test eax, eax
jne 0x43b4eb
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x43b609
mov edx, esi
mov eax, ebx
call fcn.0043b128
jmp 0x43b609
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43b602
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043d480
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0043834c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0043b4b0
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043d480
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b609
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x443c44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403d94
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x443c9c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x454f9c]
mov dl, 1
mov eax, dword [0x4436b0]
call fcn.004092c0
call fcn.004033ac
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004437b8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x445144
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [0x454e34]
mov eax, dword [eax]
call fcn.0042a184
push 1
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp esi, eax
ja 0x44514f
pop esi
pop ebx
ret

Function at 0x445170
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x105
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00403b80
add esp, 0x108
pop ebx
ret

Function at 0x4452f8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
lea eax, [ebp + 8]
call fcn.00404194
xor eax, eax
push ebp
push 0x4453c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov dl, 1
mov eax, dword [0x40c4b0]
call fcn.00402c24
mov esi, eax
mov eax, esi
call fcn.004451c0
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jge 0x445342
mov eax, esi
call fcn.00402c54
jmp 0x44539e
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
call fcn.00403b98
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x50]
inc eax
jle 0x445397
lea eax, [ebp - 8]
mov edx, dword [ebp + 8]
call fcn.00403b98
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x18]
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
neg eax
sbb eax, eax
neg eax
mov ebx, eax
mov eax, esi
call fcn.00402c54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4453c8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403974
lea eax, [ebp + 8]
call fcn.00403f80
ret
Function at 0x445848
Capabilities:
Create service
Delete service
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44598c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x12c]
call fcn.00445170
lea eax, [ebp - 0x12c]
mov edx, 0x4459a4
call fcn.00403bd8
mov edx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
call fcn.00408298
lea eax, [ebp - 0x128]
mov edx, ebx
call fcn.004082dc
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x44595e
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x128]
push eax
push 0
push 3
push 1
push 0x10030
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_CreateServiceA
mov esi, eax
test esi, esi
jne 0x445919
call sub.kernel32.dll_GetLastError_1
mov edi, eax
push 0x10030
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
push esi
call sub.advapi32.dll_DeleteService
jmp 0x445965
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceA
test eax, eax
jne 0x44595a
call sub.kernel32.dll_GetLastError_1
mov edi, eax
push 0x10030
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
push esi
call sub.advapi32.dll_DeleteService
jmp 0x445965
xor edi, edi
jmp 0x445965
call sub.kernel32.dll_GetLastError_1
mov edi, eax
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov ebx, edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445993
lea eax, [ebp - 0x12c]
call fcn.00403950
ret

Function at 0x4459a8
Capabilities:
Delete service
Pause service
Stop service

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
mov ebx, eax
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
push 0x10030
push ebx
push esi
call sub.advapi32.dll_OpenServiceA
mov ebx, eax
push esp
push 1
push ebx
call sub.advapi32.dll_ControlService
push ebx
call sub.advapi32.dll_DeleteService
push ebx
call sub.advapi32.dll_CloseServiceHandle
push esi
call sub.advapi32.dll_CloseServiceHandle
add esp, 0x1c
pop esi
pop ebx
ret
Function at 0x445b54
Capabilities:
Create service
Delete service
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x445c98
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x12c]
call fcn.004081ac
lea eax, [ebp - 0x12c]
mov edx, 0x445cb0
call fcn.00403bd8
mov edx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
call fcn.00408298
lea eax, [ebp - 0x128]
mov edx, ebx
call fcn.004082dc
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x445c6a
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x128]
push eax
push 0
push 3
push 1
push 0x10030
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_CreateServiceA
mov esi, eax
test esi, esi
jne 0x445c25
call sub.kernel32.dll_GetLastError_1
mov edi, eax
push 0x10030
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
push esi
call sub.advapi32.dll_DeleteService
jmp 0x445c71
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceA
test eax, eax
jne 0x445c66
call sub.kernel32.dll_GetLastError_1
mov edi, eax
push 0x10030
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
push esi
call sub.advapi32.dll_DeleteService
jmp 0x445c71
xor edi, edi
jmp 0x445c71
call sub.kernel32.dll_GetLastError_1
mov edi, eax
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov ebx, edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445c9f
lea eax, [ebp - 0x12c]
call fcn.00403950
ret

Function at 0x445cb4
Capabilities:
Delete service
Pause service
Stop service

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
mov ebx, eax
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
push 0x10030
push ebx
push esi
call sub.advapi32.dll_OpenServiceA
mov ebx, eax
push esp
push 1
push ebx
call sub.advapi32.dll_ControlService
push ebx
call sub.advapi32.dll_DeleteService
push ebx
call sub.advapi32.dll_CloseServiceHandle
push esi
call sub.advapi32.dll_CloseServiceHandle
add esp, 0x1c
pop esi
pop ebx
ret
Function at 0x4461d0
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor eax, eax
mov dword [ebp - 0x10c], eax
xor eax, eax
push ebp
push 0x44629e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10c]
call fcn.00445170
lea eax, [ebp - 0x10c]
mov edx, 0x4462b4
call fcn.00403bd8
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.00408298
mov edx, 0x4462b8
lea eax, [ebp - 0x105]
call fcn.004082dc
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
ja 0x446241
xor eax, eax
jmp 0x446283
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x105]
push eax
push 1
push 2
push 1
push 0xf01ff
push 0x4462c8
push 0x4462c8
push ebx
call sub.advapi32.dll_CreateServiceA
test eax, eax
ja 0x44627b
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
jmp 0x446283
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov al, 1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4462a5
lea eax, [ebp - 0x10c]
call fcn.00403950
ret

Function at 0x4462d4
Capabilities:
Start service

Disassembly:
push ebx
push esi
push ecx
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
xor ebx, ebx
test esi, esi
jbe 0x446306
push 0x10
push 0x446318
push esi
call sub.advapi32.dll_OpenServiceA
test eax, eax
jbe 0x446306
push esp
push 0
push eax
call sub.advapi32.dll_StartServiceA
mov bl, 1
test bl, bl
jne 0x446310
push esi
call sub.advapi32.dll_CloseServiceHandle
mov eax, ebx
pop edx
pop esi
pop ebx
ret

Function at 0x446324
Capabilities:
Delete service
Stop service

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
xor ebx, ebx
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
test esi, esi
jbe 0x446364
push 0xf01ff
push 0x446378
push esi
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
jbe 0x446364
push esp
push 1
push edi
call sub.advapi32.dll_ControlService
push edi
call sub.advapi32.dll_DeleteService
mov bl, 1
test bl, bl
jne 0x44636e
push esi
call sub.advapi32.dll_CloseServiceHandle
mov eax, ebx
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x446384
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor eax, eax
mov dword [ebp - 0x10c], eax
xor eax, eax
push ebp
push 0x446452
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10c]
call fcn.00445170
lea eax, [ebp - 0x10c]
mov edx, 0x446468
call fcn.00403bd8
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.00408298
mov edx, 0x44646c
lea eax, [ebp - 0x105]
call fcn.004082dc
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
ja 0x4463f5
xor eax, eax
jmp 0x446437
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x105]
push eax
push 1
push 2
push 1
push 0xf01ff
push 0x44647c
push 0x44647c
push ebx
call sub.advapi32.dll_CreateServiceA
test eax, eax
ja 0x44642f
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
jmp 0x446437
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov al, 1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446459
lea eax, [ebp - 0x10c]
call fcn.00403950
ret

Function at 0x446488
Capabilities:
Start service

Disassembly:
push ebx
push esi
push ecx
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
xor ebx, ebx
test esi, esi
jbe 0x4464ba
push 0x10
push 0x4464cc
push esi
call sub.advapi32.dll_OpenServiceA
test eax, eax
jbe 0x4464ba
push esp
push 0
push eax
call sub.advapi32.dll_StartServiceA
mov bl, 1
test bl, bl
jne 0x4464c4
push esi
call sub.advapi32.dll_CloseServiceHandle
mov eax, ebx
pop edx
pop esi
pop ebx
ret

Function at 0x4464d8
Capabilities:
Delete service
Stop service

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
xor ebx, ebx
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
test esi, esi
jbe 0x446518
push 0xf01ff
push 0x44652c
push esi
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
jbe 0x446518
push esp
push 1
push edi
call sub.advapi32.dll_ControlService
push edi
call sub.advapi32.dll_DeleteService
mov bl, 1
test bl, bl
jne 0x446522
push esi
call sub.advapi32.dll_CloseServiceHandle
mov eax, ebx
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x44bf14
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x44bf1c
push ecx
push ebx
xor eax, eax
push ebp
push 0x44c0cf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00445170
push 0x44c0e4
push 0x44c0ec
mov ecx, dword [0x4554dc]
mov dl, 1
mov eax, dword [0x40c7cc]
call fcn.0040f700
mov ebx, eax
push dword [ebp - 4]
push 0x44c0f8
push 0x44c104
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403c90
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040f53c
mov eax, ebx
call fcn.00402c54
push 0x44c118
push 0x44c124
mov ecx, dword [0x4554dc]
mov dl, 1
mov eax, dword [0x40c7cc]
call fcn.0040f700
mov ebx, eax
push dword [ebp - 4]
push 0x44c0f8
push 0x44c130
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403c90
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0040f53c
mov eax, ebx
call fcn.00402c54
push 0
lea eax, [ebp - 0x10]
mov ecx, 0x44c0f8
mov edx, dword [ebp - 4]
call fcn.00403c1c
mov eax, dword [ebp - 0x10]
call fcn.00403d94
push eax
push 0
push 0x44c140
push 0x44c150
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x64
call fcn.00445144
mov eax, 1
call fcn.00445144
lea eax, [ebp - 0x18]
call fcn.00445170
push dword [ebp - 0x18]
push 0x44c0f8
lea eax, [ebp - 0x1c]
mov edx, 0x44c158
call fcn.00403b08
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403c90
mov eax, dword [ebp - 0x14]
call fcn.00403d94
push eax
push 0
call sub.user32.dll_FindWindowA
test eax, eax
jne 0x44c005
mov eax, 0x3e8
call fcn.00445144
push dword [ebp - 4]
push 0x44c0f8
lea eax, [ebp - 0x24]
mov edx, 0x44c160
call fcn.00403b08
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403c90
mov eax, dword [ebp - 0x20]
call fcn.00408020
push dword [ebp - 4]
push 0x44c0f8
lea eax, [ebp - 0x2c]
mov edx, 0x44c140
call fcn.00403b08
push dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00403c90
mov eax, dword [ebp - 0x28]
call fcn.00408020
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c0d6
lea eax, [ebp - 0x2c]
mov edx, 0xb
call fcn.00403974
ret
Function at 0x44c16c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x44c174
push ecx
push ebx
xor eax, eax
push ebp
push 0x44c327
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00445170
push 0x44c33c
push 0x44c344
mov ecx, dword [0x4554dc]
mov dl, 1
mov eax, dword [0x40c7cc]
call fcn.0040f700
mov ebx, eax
push dword [ebp - 4]
push 0x44c350
push 0x44c35c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403c90
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0040f53c
mov eax, ebx
call fcn.00402c54
push 0x44c370
push 0x44c378
mov ecx, dword [0x4554dc]
mov dl, 1
mov eax, dword [0x40c7cc]
call fcn.0040f700
mov ebx, eax
push dword [ebp - 4]
push 0x44c350
push 0x44c384
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403c90
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0040f53c
mov eax, ebx
call fcn.00402c54
push 0
lea eax, [ebp - 0x10]
mov ecx, 0x44c350
mov edx, dword [ebp - 4]
call fcn.00403c1c
mov eax, dword [ebp - 0x10]
call fcn.00403d94
push eax
push 0
push 0x44c390
push 0x44c39c
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, 0x64
call fcn.00445144
mov eax, 1
call fcn.00445144
lea eax, [ebp - 0x18]
call fcn.00445170
push dword [ebp - 0x18]
push 0x44c350
lea eax, [ebp - 0x1c]
mov edx, 0x44c3a4
call fcn.00403b08
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403c90
mov eax, dword [ebp - 0x14]
call fcn.00403d94
push eax
push 0
call sub.user32.dll_FindWindowA
test eax, eax
jne 0x44c25d
mov eax, 0x3e8
call fcn.00445144
push dword [ebp - 4]
push 0x44c350
lea eax, [ebp - 0x24]
mov edx, 0x44c3ac
call fcn.00403b08
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403c90
mov eax, dword [ebp - 0x20]
call fcn.00408020
push dword [ebp - 4]
push 0x44c350
lea eax, [ebp - 0x2c]
mov edx, 0x44c390
call fcn.00403b08
push dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00403c90
mov eax, dword [ebp - 0x28]
call fcn.00408020
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c32e
lea eax, [ebp - 0x2c]
mov edx, 0xb
call fcn.00403974
ret
Function at 0x44c894
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44c9b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x40]
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, ebx
call fcn.00403d94
push eax
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x44c985
cmp dword [ebp - 4], 7
jne 0x44c96d
mov eax, dword [ebp - 8]
call fcn.004026c8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x44c966
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, ebx
call fcn.00403d94
push eax
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, dword [ebp - 0xc]
jmp 0x44c94b
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403b08
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
push ebx
call sub.kernel32.dll_lstrlenA_1
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x44c92e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c99b
mov eax, dword [ebp - 0xc]
call fcn.004026e0
ret
mov ecx, 0x44c9c8
mov dl, 1
mov eax, dword [0x4436b0]
call fcn.004091c8
call fcn.004033ac
jmp 0x44c99b
mov ecx, 0x44c9e8
mov dl, 1
mov eax, dword [0x407084]
call fcn.004091c8
call fcn.004033ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c9b8
lea eax, [ebp - 0x10]
call fcn.00403950
ret