joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430d21
Capabilities:
Get graphical window text

Disassembly:
push 0x108
mov eax, 0x46cb16
call fcn.0045f4d4
mov esi, ecx
cmp dword [esi + 0x514], 0
jne 0x430f38
push 0x141
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x430d99
push 0x104
lea edi, [esi + 0x2fe]
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
push 0x2e
push edi
call fcn.0043efa9
pop ecx
pop ecx
test eax, eax
je 0x430d99
jmp 0x430d95
cmp word [eax], 0x2e
jne 0x430d99
cmp word [eax + 2], 0
jne 0x430d99
push eax
xor ecx, ecx
push edi
mov word [eax], cx
call dword [sym.imp.USER32.dll_CharPrevW]
cmp eax, edi
jne 0x430d7b
lea edx, [esi + 0x2fe]
mov eax, edx
push 2
lea edi, [eax + 2]
pop ebx
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x430da7
sub eax, edi
mov edi, dword [esi + 0x548]
sar eax, 1
cmp eax, edi
jb 0x430e7e
xor eax, eax
push 0xc6
mov word [ebp - 0xd8], ax
xor ebx, ebx
lea eax, [ebp - 0xd6]
push ebx
push eax
call fcn.00443420
push edi
push 0x40eeec
push 0xffffffffffffffff
lea eax, [ebp - 0xd8]
push 0x64
push eax
call fcn.0043f0c4
add esp, 0x20
cmp dword [esi + 0x54c], ebx
je 0x430f38
lea eax, [ebp - 0xd8]
push eax
push 0x1268
lea eax, [ebp - 0x114]
push eax
call fcn.0044be86
mov dword [ebp - 4], ebx
cmp dword [eax + 0x18], 8
jb 0x430e2b
mov eax, dword [eax + 4]
jmp 0x430e2e
add eax, 4
push eax
lea ecx, [ebp - 0xf8]
call fcn.004132cd
mov byte [ebp - 4], 1
mov esi, dword [esi + 0x54c]
lea ecx, [esi + 0x28]
mov eax, dword [ecx]
push 0x10
lea edx, [ebp - 0xf8]
push edx
call dword [eax + 0xc]
mov byte [ebp - 4], 0
push ebx
push 1
lea ecx, [ebp - 0xf8]
call fcn.00411dad
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x114]
call fcn.00411dad
jmp 0x430f38
push edx
lea ecx, [ebp - 0xdc]
call fcn.0042981d
mov dword [ebp - 4], ebx
mov edi, eax
call fcn.0043083f
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0xdc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test bl, bl
je 0x430f23
xor edi, edi
cmp dword [esi + 0x54c], edi
je 0x430f38
push 0x12c9
lea eax, [ebp - 0x114]
push eax
call fcn.0044be4b
mov dword [ebp - 4], 3
cmp dword [eax + 0x18], 8
jb 0x430edd
mov eax, dword [eax + 4]
jmp 0x430ee0
add eax, 4
push eax
lea ecx, [ebp - 0xf8]
call fcn.004132cd
mov byte [ebp - 4], 4
mov esi, dword [esi + 0x54c]
lea ecx, [esi + 0x28]
mov eax, dword [ecx]
push 0x10
lea edx, [ebp - 0xf8]
push edx
call dword [eax + 0xc]
mov byte [ebp - 4], 3
push edi
push 1
lea ecx, [ebp - 0xf8]
call fcn.00411dad
or dword [ebp - 4], 0xffffffff
push edi
jmp 0x430e6c
movzx eax, word [ebp + 8]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov edi, esi
call fcn.00430bde
xor eax, eax
call fcn.0045f566
ret 4
Function at 0x431081
Capabilities:
Terminate thread

Disassembly:
push 0
mov eax, 0x46f823
call fcn.0045f461
mov esi, dword [ebp + 8]
mov dword [esi], 0x40ef58
mov dword [ebp - 4], 6
mov eax, dword [esi + 0x514]
test eax, eax
je 0x4310d8
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4310c5
push 0
push dword [esi + 0x514]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x514]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x514], 0
mov byte [ebp - 4], 5
push 0
push 1
lea ecx, [esi + 0x528]
call fcn.00411dad
mov byte [ebp - 4], 4
push dword [esi + 0x510]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 3
lea eax, [esi + 0xc8]
push eax
call fcn.004309cc
mov byte [ebp - 4], 2
lea eax, [esi + 0xb0]
push eax
call fcn.004309cc
mov byte [ebp - 4], 1
lea eax, [esi + 0x98]
push eax
call fcn.004309cc
mov byte [ebp - 4], 0
lea eax, [esi + 0x20]
push eax
call fcn.0042ed80
or dword [ebp - 4], 0xffffffff
push esi
call fcn.00420344
call fcn.0045f54d
ret 4

Function at 0x4320d2
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x47c144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x141
push dword [edi + 4]
call esi
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x43214c
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00443420
add esp, 0xc
push 0x105
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x210], 0
je 0x43214a
push 1
push dword [edi + 4]
call esi
push 1
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e052
leave
ret

Function at 0x432409
Capabilities:
Create thread

Disassembly:
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetCapture]
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea eax, [esi + 0x518]
push eax
push 0
push esi
push 0x43244b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x514], eax
ret
Function at 0x43609e
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x4360ae
push 0xd
pop eax
jmp 0x4360e1
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x4360b5
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x437130
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x46d49f
call fcn.0045f50f
mov eax, dword [ebp + 8]
mov esi, edx
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, ebx
jne 0x437188
call fcn.00428d2a
mov esi, eax
jmp 0x4372a8
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x4371a1
call fcn.00428d2a
jmp 0x43729a
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, ebx
je 0x437197
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x424], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x437201
mov byte [ebp - 4], bl
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4371f0
lea eax, [ebp - 0x418]
call fcn.00435b5b
mov eax, 0x8007000e
or dword [ebp - 4], 0xffffffff
call fcn.0045f57a
ret 0xc
mov byte [ebp - 4], 2
push 2
call fcn.004360ea
cmp eax, 0x400
jbe 0x437222
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.00436074
jmp 0x43722e
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x43724c
cmp dword [ebp - 0x418], ebx
jne 0x43725b
mov esi, 0x8007000e
jmp 0x43729c
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x437197
xor ecx, ecx
mov edx, dword [ebp - 0x418]
mov word [edx + eax*2], cx
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x418]
lea edx, [ebp - 0x42c]
call fcn.00436fe1
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], bl
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4372c4
lea eax, [ebp - 0x418]
call fcn.00435b5b
mov eax, esi
jmp 0x4371f5
Function at 0x437dec
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x46acb7
call fcn.0045f461
xor esi, esi
inc esi
mov dword [ebp - 4], esi
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp dword [ebp + 0x20], 8
mov dword [ebp - 0x14], ebx
jae 0x437e0f
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x14]
push ecx
push esi
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x437e4a
mov byte [ebp - 4], bl
push ebx
push esi
lea ecx, [ebp + 8]
call fcn.00411dad
or dword [ebp - 4], 0xffffffff
push ebx
push esi
lea ecx, [ebp + 0x24]
call fcn.00411dad
xor al, al
call fcn.0045f54d
ret 0x38
cmp dword [ebp + 0x3c], 8
push 4
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x18], ebx
jae 0x437e62
lea eax, [ebp + 0x28]
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push ebx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
test eax, eax
je 0x437ea9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0xd], bl
mov byte [ebp - 4], bl
push ebx
push esi
lea ecx, [ebp + 8]
call fcn.00411dad
or dword [ebp - 4], 0xffffffff
push ebx
push esi
lea ecx, [ebp + 0x24]
call fcn.00411dad
mov al, byte [ebp - 0xd]
jmp 0x437e42
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
mov dword [edi], eax
mov byte [ebp - 0xd], 1
jmp 0x437e89

Function at 0x437ebf
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x47c144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x114
xor ebx, ebx
lea eax, [ebp - 0x118]
push ebx
push eax
call fcn.00443420
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x437f26
cmp dword [ebp - 0x108], 2
jne 0x437f26
cmp dword [ebp - 0x114], 5
jne 0x437f26
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp + 8]
jne 0x437f26
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0043e052
leave
ret 4

Function at 0x43e052
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47c144]
jne 0x43e05c
repz ret
jmp fcn.0044179c
Function at 0x4467b5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00440ebc
and dword [ebp - 4], 0
cmp dword [0x47ec58], 0
mov ebx, eax
jne 0x446866
push 0x401d30
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x446917
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401d24
push edi
call esi
test eax, eax
je 0x446917
push eax
call fcn.00440e45
mov dword [esp], 0x401d14
push edi
mov dword [0x47ec58], eax
call esi
push eax
call fcn.00440e45
mov dword [esp], 0x401d00
push edi
mov dword [0x47ec5c], eax
call esi
push eax
call fcn.00440e45
mov dword [esp], 0x401ce4
push edi
mov dword [0x47ec60], eax
call esi
push eax
call fcn.00440e45
pop ecx
mov dword [0x47ec68], eax
test eax, eax
je 0x446866
push 0x401ccc
push edi
call esi
push eax
call fcn.00440e45
pop ecx
mov dword [0x47ec64], eax
mov eax, dword [0x47ec64]
cmp eax, ebx
je 0x4468be
cmp dword [0x47ec68], ebx
je 0x4468be
push eax
call fcn.00440eca
push dword [0x47ec68]
mov esi, eax
call fcn.00440eca
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4468be
test edi, edi
je 0x4468be
call esi
test eax, eax
je 0x4468b5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4468b5
test byte [ebp - 0xc], 1
jne 0x4468be
or dword [ebp + 0x10], 0x200000
jmp 0x4468f7
mov eax, dword [0x47ec5c]
cmp eax, ebx
je 0x4468f7
push eax
call fcn.00440eca
pop ecx
test eax, eax
je 0x4468f7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4468f7
mov eax, dword [0x47ec60]
cmp eax, ebx
je 0x4468f7
push eax
call fcn.00440eca
pop ecx
test eax, eax
je 0x4468f7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x47ec58]
call fcn.00440eca
pop ecx
test eax, eax
je 0x446917
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x446919
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44b5cb
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x47edbc], 0
push esi
jne 0x44b539
call fcn.0044b455
test eax, eax
je 0x44b57c
mov eax, dword [0x47edbc]
cmp eax, 1
jne 0x44b55a
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x44b57c
pop esi
ret
push eax
call dword [0x47edc4]
test eax, eax
jne 0x44b5c4
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x44b580
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x47edbc]
call dword [0x47edc4]
mov edi, eax
test edi, edi
je 0x44b5a5
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x44b5c1
mov edi, esi
add esi, 0xff0
push edi
push dword [0x47edbc]
call dword [0x47edc0]
add edi, 0x10
cmp edi, esi
jb 0x44b5ad
mov eax, edi
pop edi
pop esi
ret
jmp 0x44b526
Function at 0x44c043
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44c0a9
cmp dword [ebp - 4], eax
je 0x44c0a9
mov eax, dword [ebp + 0x14]
push esi
add eax, eax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 8]
push eax
push 0
push 0x403018
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x44c0a9
cmp dword [ebp + 8], 1
jne 0x44c0a9
xor eax, eax
inc eax
jmp 0x44c0ab
xor eax, eax
leave
ret 0x10
Function at 0x4512ae
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x47c144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x14
pop ecx
mov esi, 0x40fcc0
lea edi, [ebp - 0x70]
rep movsd dword es:[edi], dword [esi]
push 5
pop ecx
movsw word es:[edi], word [esi]
mov esi, 0x40fca8
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x74]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x70]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x451305
xor eax, eax
jmp 0x45133a
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x74]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x451301
movzx eax, word [ebp - 0x78]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043e052
leave
ret

Function at 0x45134d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x47c144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.00451296
test al, al
je 0x4513dc
push 0x3f
lea eax, [ebp - 0x43]
push 0
push eax
mov byte [ebp - 0x44], 0xff
call fcn.00443420
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
push 0x404098
push reloc.OLEAUT32.dll_SysReAllocString
call dword [0x47e084]
test eax, eax
jne 0x4513dc
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0x40406c
push dword [ebp - 0x48]
mov dword [ebp - 0x4c], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4513d3
cmp dword [ebp - 0x50], 3
jne 0x4513d3
cmp dword [ebp - 0x4c], 8
jb 0x4513d3
cmp dword [ebp - 0x40], eax
je 0x4513d3
mov byte [esi + 0x35], 1
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043e052
leave
ret
Function at 0x4513ee
Capabilities:
Check os version
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x928
mov eax, dword [0x47c144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
test ebx, ebx
je 0x4515c5
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ebx
stosd dword es:[edi], eax
push ebx
lea eax, [esi - 1]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor edi, edi
cmp eax, edi
je 0x4515c1
cmp eax, esi
ja 0x4515c1
mov esi, 0x114
push esi
lea eax, [ebp - 0x918]
push edi
push eax
call fcn.00443420
add esp, 0xc
lea eax, [ebp - 0x918]
push eax
mov dword [ebp - 0x918], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x45146c
cmp dword [ebp - 0x914], 5
ja 0x45148f
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x45148f
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x451480
jmp 0x4515bb
lea eax, [ebp - 0x91c]
push eax
push 0x20019
push edi
push 0x40c3a8
push reloc.OLEAUT32.dll_SysReAllocString
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45157f
lea eax, [ebp - 0x924]
push eax
lea eax, [ebp - 0x920]
push eax
push edi
push edi
push 0x40c40c
push dword [ebp - 0x91c]
mov dword [ebp - 0x920], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x924], 4
call edi
test eax, eax
jne 0x4514fc
cmp dword [ebp - 0x920], esi
sete al
mov esi, eax
test esi, esi
jne 0x45155c
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
call fcn.00443420
add esp, 0xc
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x804]
push eax
push 0
push 0
push 0x40c430
push dword [ebp - 0x91c]
mov dword [ebp - 0x928], 0x400
call edi
test eax, eax
jne 0x45155c
lea eax, [ebp - 0x804]
push eax
call fcn.0043f32a
mov esi, eax
neg esi
sbb esi, esi
pop ecx
neg esi
push dword [ebp - 0x91c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x45157d
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x451571
jmp 0x4515bb
xor edi, edi
push 0x5c
push ebx
call fcn.0043efa9
pop ecx
pop ecx
cmp eax, edi
je 0x451598
cmp word [eax + 2], di
jne 0x451598
xor ecx, ecx
mov word [eax], cx
push 0x5c
push ebx
call fcn.0043efa9
pop ecx
pop ecx
cmp eax, edi
je 0x4515ac
xor ecx, ecx
mov word [eax + 2], cx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x4515b1
sub eax, edx
sar eax, 1
jmp 0x4515c3
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0043e052
leave
ret 8
Function at 0x4519bc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x47c144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push 0x15
pop ecx
push 5
mov byte [ebx + 0x17], 0
mov byte [ebx + 0x34], 0
mov byte [ebx + 0x35], 0
mov esi, 0x404160
lea edi, [ebp - 0x6c]
rep movsd dword es:[edi], dword [esi]
pop ecx
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x6c]
push eax
mov esi, 0x404148
lea edi, [ebp - 0x18]
push reloc.OLEAUT32.dll_SysReAllocString
rep movsd dword es:[edi], dword [esi]
call dword [0x47e084]
test eax, eax
jne 0x451b3e
push 0x3e6
push eax
mov word [ebp - 0x454], ax
lea eax, [ebp - 0x452]
push eax
call fcn.00443420
add esp, 0xc
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x45c]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x458]
mov dword [ebp - 0x460], 0x3e8
mov dword [ebp - 0x45c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x451b32
lea eax, [ebp - 0x454]
push 0x1f4
push eax
call fcn.0046000e
pop ecx
pop ecx
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebx + 0x18]
call fcn.00413ccf
lea eax, [ebp - 0x454]
push 0x404140
push eax
call fcn.0043f33a
pop ecx
test eax, eax
pop ecx
setne al
mov ecx, ebx
mov byte [ebx + 0x17], al
call fcn.00451296
test al, al
je 0x451b32
push 5
pop esi
push esi
lea eax, [ebp - 0x454]
push 0x404134
push eax
call fcn.0043e8a8
add esp, 0xc
test eax, eax
je 0x451b2e
push esi
lea eax, [ebp - 0x454]
push 0x404128
push eax
call fcn.0043e8a8
add esp, 0xc
test eax, eax
je 0x451b2e
push esi
lea eax, [ebp - 0x454]
push 0x40411c
push eax
call fcn.0043e8a8
add esp, 0xc
test eax, eax
je 0x451b2e
push esi
lea eax, [ebp - 0x454]
push 0x404110
push eax
call fcn.0043e8a8
add esp, 0xc
test eax, eax
jne 0x451b32
mov byte [ebx + 0x35], 1
jmp 0x451b32
mov byte [ebx + 0x34], 1
push dword [ebp - 0x458]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e052
leave
ret

Function at 0x451d3f
Capabilities:
Get hostname

Disassembly:
push 0x248
mov eax, 0x4682e0
call fcn.0045f4d4
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
xor ebx, ebx
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.00443420
add esp, 0xc
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x254], 0x104
xor esi, esi
call fcn.00451c7d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24c], 2
jne 0x451d9a
cmp dword [ebp - 0x248], 5
jae 0x451db1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.004517bb
mov al, bl
call fcn.0045f566
ret
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x218]
push eax
push 7
call sub.Secur32.dll_GetComputerObjectNameW
test al, al
je 0x451e10
lea eax, [ebp - 0x218]
push 0x2f
push eax
call fcn.0043f8a1
pop ecx
pop ecx
cmp eax, ebx
je 0x451e10
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0043ecd9
lea eax, [ebp - 0x218]
push 0x4041b4
push eax
call fcn.0043f33a
add esp, 0x10
mov esi, eax
neg esi
sbb esi, esi
neg esi
cmp esi, ebx
setne bl
jmp 0x451d9a
Function at 0x4553ad
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp byte [ecx + 0x38], bl
jne 0x4553bf
xor al, al
jmp 0x455433
cmp dword [ecx + 0x34], 8
mov dword [ebp - 4], ebx
jb 0x4553cd
mov ecx, dword [ecx + 0x20]
jmp 0x4553d0
add ecx, 0x20
push esi
push ebx
push 0x80
push 3
push ebx
push 1
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x455430
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x455429
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x455405
sub eax, edx
push ebx
sar eax, 1
lea ecx, [ebp - 4]
push ecx
add eax, eax
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x455438
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
pop ebx
leave
ret 4
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x45543e
sub eax, edx
sar eax, 1
add eax, eax
cmp dword [ebp - 4], eax
je 0x45545e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x455432
mov bl, 1
jmp 0x455453

Function at 0x45573f
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x47c144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [esi + 0x14], ebx
jne 0x455764
xor al, al
jmp 0x4557df
xor ecx, ecx
cmp byte [ebp + 0xc], bl
setne cl
cmp dword [esi + 0x18], 8
lea ecx, [ecx + ecx + 2]
jb 0x45577b
mov eax, dword [esi + 4]
jmp 0x45577e
lea eax, [esi + 4]
push ebx
push 0x80
push ecx
push ebx
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x455760
push ebx
lea ecx, [ebp - 0x14]
push ecx
push 6
lea ecx, [ebp - 0xc]
push ecx
push eax
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xc], 0xff
mov byte [ebp - 0xb], 0xfe
mov byte [ebp - 0xa], 0xd
mov byte [ebp - 9], bl
mov byte [ebp - 8], 0xa
mov byte [ebp - 7], bl
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea ecx, [edi + 0x1c]
call fcn.00411d93
mov byte [edi + 0x38], 1
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e052
leave
ret 8