joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d2dc
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x43d314
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push 1
push 0x4504
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
call fcn.0043d3ab
add esp, 0x10
jmp 0x43d3a7
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43d364
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 0
push 0x75ee
push dword [ebp - 0x1c]
push 0x5169
call fcn.00453756
add esp, 0x14
jmp 0x43d3a7
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43d39c
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x43d39a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x43d3a7
push 0x1154
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov esp, ebp
pop ebp
ret
Function at 0x443127
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x443160
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x71a7
push 0
push 0x25e3
call fcn.0044c8a7
add esp, 0x14
jmp 0x443243
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x443227
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4431da
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x4431d8
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x443225
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x443208
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x443225
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.00431cde
mov dword [eax], 3
jmp 0x4431fd
jmp 0x443243
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
push dword [ebp - 0x50]
push 0
push dword [ebp - 0x54]
call fcn.0043bd9a
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x446267
Capabilities:
Compare security identifiers
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x446323
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4462ee
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4462e2
mov byte [ebp - 1], 0
push 0x479
push 0x43d0
push 1
push 0x20fa
push 0x6f81
push 0x172b
push 1
push 1
push 0
push 0x46d7
push 0x5fc0
lea eax, [ebp - 1]
push eax
call fcn.004416c0
add esp, 0x30
jmp 0x4462ec
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x44631e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 1
push 0x3553
push dword [ebp - 0x18]
push 0x4730
push 0x1b23
push 0x4ff9
push 0x40e3
push 1
push 1
call fcn.0043b91b
add esp, 0x24
jmp 0x4463ea
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4463a9
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x44638e
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
mov dword [eax + 8], ecx
jmp 0x4463a7
push 0
push 0
push 0
push 0
push 0
push 0
push 0x837
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x4463ea
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
push 0x4ca
push 0x1801
push 0xcf6
push 0x43c6
push 0x30f7
push dword [ebp - 0x4c]
push 0xc
push 0x7663
push 0xdf8
push 1
push 0
push 0
push 0x53c8
call fcn.0043a174
add esp, 0x34
mov esp, ebp
pop ebp
ret
Function at 0x446ddd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x446e3b
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x446e17
push 0x3fb7
push 1
push 0x7f33
call fcn.00446edf
add esp, 0xc
jmp 0x446e36
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0
push 1
push dword [ebp - 0x10]
push 0x4a7e
push 0x59a3
call fcn.004390fd
add esp, 0x14
jmp 0x446edb
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x446eb5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x446e8c
mov byte [ebp - 1], 0
push 0
lea eax, [ebp - 1]
push eax
push 0x1599
call fcn.004457b7
add esp, 0xc
jmp 0x446eb3
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x446eb3
push 0
push 0x19b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x446edb
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 0
push dword [ebp - 0x34]
push 0x432d
push 1
push 0x6034
push 0
push 0x69b8
call fcn.00438ae8
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x447777
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x4478d5
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4477c4
push 0x51cb
push 1
push 0xecb
call fcn.0044798e
add esp, 0xc
jmp 0x4478d0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x447870
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
imul eax, dword [eax], 0xe446
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x44783a
mov dword [ebp - 0x34], 0xa07e4fc2
push 0x43f0
push 0xf29
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 8]
push 1
push 0
push 1
call fcn.00441a7d
add esp, 0x1c
jmp 0x44786e
mov byte [ebp - 1], 0
push 1
push 0x3a74
push 0
push 0xc3f
lea eax, [ebp - 1]
push eax
push 0x313b
push 1
push 0x2d50
push 0x1138
push 0x17ea
call fcn.00443127
add esp, 0x28
jmp 0x4478d0
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x4478d0
push 0x1309
push 0x325
push 0x4ae3
push 0x48e7
push 0x5eb4
push 0x341e
push 0x7cda
push 0x1d13
push 1
push 0x27a3
push 0x6cc1
push 0
push 0x5e7
push 0x3c3a
push 0xe1f
push 0x5f96
push 1
call fcn.00440708
add esp, 0x44
jmp 0x44798a
lea eax, [ebp + 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x447950
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x447933
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x447931
push 0x581d
push 0
call fcn.00447f2d
pop ecx
pop ecx
jmp 0x44794e
push 0x24f9
push 0
push 0xea6
push 0xee4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x44798a
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
push 0x7211
push 0x20c6
push 0x6ea6
push 0x3777
push 0x65e7
push 0x2088
push 1
push 1
push 0x15aa
push dword [ebp - 0x58]
push 1
call fcn.0043b1b1
add esp, 0x2c
mov esp, ebp
pop ebp
ret
Function at 0x44aa8f
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x44ab63
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x44ab45
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x44aae9
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x44ab43
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x44ab43
push 0x1032
push 1
push 1
push 0x7c64
push 0x152c
push 0x6d7f
push 0x1033
push 0x65ec
push 0x1bc5
push 0x74d2
push 0
push 0x3c8c
push 0
push 1
push 0x4bb6
call fcn.004466e3
add esp, 0x3c
jmp 0x44ab61
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.00454fa6
add esp, 0xc
jmp 0x44ab80
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
push 0x48f4
push 1
push dword [ebp - 0x30]
push 0x5473
call fcn.004376cd
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x44ca25
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x44cb1e
lea eax, [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x44cab6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x44caac
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x44cab4
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x44cb1c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x44caf3
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x44caf1
push 0
push 0
push 0x2ba
push 1
call fcn.00437552
add esp, 0x10
jmp 0x44cb1c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov esi, dword [eax]
push 1
mov ecx, dword [ebp - 0x58]
call fcn.00431cde
mov dword [eax], esi
jmp 0x44cb38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
push 0x4f51
push 0
push dword [ebp - 0x5c]
push 1
call fcn.0043d3ab
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44e0b3
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x44e17b
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x44e163
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x44e132
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x44e130
push 1
push 1
push 0x3ffc
push 1
push 1
push 0
call fcn.0044eb3e
add esp, 0x18
jmp 0x44e161
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x44e161
push 0
push 0
push 0
push 0
push 0
push 0
push 0x837
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x44e179
push 1
push 0x3646
push 0x6b7
push 1
call fcn.00433b8e
add esp, 0x10
jmp 0x44e1d1
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push 1
call fcn.00437fbe
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x44f4ed
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 8]
test eax, eax
je 0x44f51f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x174b
push 0xff8
push 1
push 1
call fcn.0044f5d8
add esp, 0x14
jmp 0x44f5d4
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x44f5c9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x44f57c
push 0
push 0
push 0
push 0
push 0
push 0
push 0x837
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x44f5c7
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x44f5aa
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x44f5c7
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.00431cde
mov dword [eax], 1
jmp 0x44f59f
jmp 0x44f5d4
push 0
push 1
call fcn.00439016
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x450101
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x450134
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
push 1
push 1
push 0x69e9
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
push 0x8fa
call fcn.004501ae
add esp, 0x14
jmp 0x4501aa
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x45016f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 0x316f
push 1
push dword [ebp - 0x14]
push 0x4f44
call fcn.0043e320
add esp, 0x10
jmp 0x4501aa
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x450195
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x450193
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x4501aa
push 0x1b47
push 0x1469
push 0xaab
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov esp, ebp
pop ebp
ret
Function at 0x453248
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x45327c
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push 0x2d20
push 0x4b17
push 1
call fcn.00453388
add esp, 0x10
jmp 0x453384
lea eax, [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x453348
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4532fb
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x4532f9
push 0
push 0x1fe7
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x453346
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x453329
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x453346
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.00431cde
mov dword [eax], 0xfffffffa
jmp 0x45331e
jmp 0x453384
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x453364
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x453384
mov byte [ebp - 1], 0
push 0x6216
push 0xb8b
push 0
push 1
lea eax, [ebp - 1]
push eax
push 0
call fcn.00438a0e
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x454192
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4541ce
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x10]
push 1
call fcn.004542a8
add esp, 0x10
jmp 0x4542a4
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x454275
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x45422b
push 0
push 0x19b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x454273
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x454259
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x454273
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.00431cde
and dword [eax], 0
jmp 0x45424e
jmp 0x4542a4
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
push 0x52fe
push dword [ebp - 0x44]
push 1
push 0x3382
push 0xf59
push dword [ebp - 0x48]
push 0
push 0
call fcn.00439fc3
add esp, 0x20
mov esp, ebp
pop ebp
ret