joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bae0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key

Disassembly:
mov eax, 0x1114
call fcn.00467540
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x1120]
push eax
push 0xf003f
push 0
push esi
push 0x80000002
mov byte [esp + 0x112f], 0
mov byte [esp + 0x130], 0
call ebp
test eax, eax
je 0x43bb69
push eax
push esi
push 0x4e5e60
lea ecx, [esp + 0x128]
push 0xfff
push ecx
call fcn.00466ca7
mov edx, dword [0x4d25a4]
push 0x8d6
push str.MacMonitor__
lea eax, [esp + 0x138]
push edx
push eax
call fcn.0043c750
add esp, 0x24
mov eax, 0x33
pop esi
pop ebp
add esp, 0x1114
ret
mov eax, dword [esp + 0xc]
push ebx
push edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push 0
lea edx, [esp + 0x30]
push ecx
push edx
push 0
push eax
mov dword [esp + 0x38], 0x104
mov edi, 1
call ebx
mov esi, eax
test esi, esi
jne 0x43bc6a
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
lea edx, [esp + 0x28]
push 0
push edx
push eax
call ebp
test eax, eax
jne 0x43bc3b
mov ecx, dword [str.NetworkAddress]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [str.NdiParamsNetworkAddress]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push 0
push ecx
push edx
call ebp
test eax, eax
jne 0x43bc30
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004753b0
and eax, 0xfffeffff
cmp eax, 0x40a
jb 0x43bc1f
mov ecx, dword [str.NdiParamsNetworkAddress]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
jmp 0x43bc30
mov eax, dword [str.NdiParamsNetworkAddress]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push 0
lea edx, [esp + 0x30]
mov eax, edi
push ecx
push edx
push eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x34], 0x104
push eax
inc edi
call ebx
mov esi, eax
test esi, esi
je 0x43bba3
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
cmp esi, 0x103
pop ebx
je 0x43bcc5
push esi
push 0x4e5e30
lea edx, [esp + 0x124]
push 0xfff
push edx
call fcn.00466ca7
mov eax, dword [0x4d25a4]
push 0x8fa
push str.MacMonitor__
lea ecx, [esp + 0x134]
push eax
push ecx
call fcn.0043c750
add esp, 0x20
mov eax, 0x10
pop esi
pop ebp
add esp, 0x1114
ret
pop esi
xor eax, eax
pop ebp
add esp, 0x1114
ret
Function at 0x43c3a0
Capabilities:
Set registry value

Disassembly:
mov eax, 0x1014
call fcn.00467540
mov eax, dword [str.AddSafeBoot__]
mov ecx, dword [0x4e6064]
mov edx, dword [0x4e6068]
push esi
mov esi, dword [esp + 0x101c]
mov dword [esp + 8], eax
mov ax, word [0x4e606c]
push edi
test esi, esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov word [esp + 0x18], ax
je 0x43c4ff
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x43c4ff
lea ecx, [esp + 8]
push ecx
push 0x20006
push eax
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43c476
lea edx, [esp + 8]
push 0
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x43c476
push eax
push esi
push 0x4e6040
lea eax, [esp + 0x28]
push 0xfff
push eax
call fcn.00466ca7
mov edx, dword [0x4d25a4]
lea ecx, [esp + 0x20]
push 0xa1b
push ecx
lea eax, [esp + 0x38]
push edx
push eax
call fcn.0043c750
add esp, 0x24
mov eax, 0x10
pop edi
pop esi
add esp, 0x1014
ret
mov edx, dword [str.Service]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x43c4e9
push eax
push esi
push 0x4e601c
lea edx, [esp + 0x28]
push 0xfff
push edx
call fcn.00466ca7
mov ecx, dword [0x4d25a4]
lea eax, [esp + 0x20]
push 0xa23
push eax
lea edx, [esp + 0x38]
push ecx
push edx
call fcn.0043c750
mov eax, dword [esp + 0x2c]
add esp, 0x24
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 0x10
pop esi
add esp, 0x1014
ret
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0x1014
ret
push 0x4e6004
lea edx, [esp + 0x20]
push 0xfff
push edx
call fcn.00466ca7
mov ecx, dword [0x4d25a4]
lea eax, [esp + 0x18]
push 0xa11
push eax
lea edx, [esp + 0x30]
push ecx
push edx
call fcn.0043c750
add esp, 0x1c
mov eax, 0x10
pop edi
pop esi
add esp, 0x1014
ret
Function at 0x4405e0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x408
push ebx
mov ebx, dword [esp + 0x410]
push ebp
push edi
test ebx, ebx
mov edi, ecx
je 0x4407cc
mov ebp, dword [esp + 0x41c]
test ebp, ebp
je 0x4407cc
push esi
mov esi, dword [ebp + 0x44]
test esi, esi
je 0x44074d
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test ebx, ebx
je 0x4406eb
cmp ebx, 2
je 0x44067e
lea ecx, [esp + 0x14]
push ecx
push ebx
mov ecx, edi
call fcn.00440b30
push eax
push ebx
push esi
push ebp
push 0x4e6694
lea edx, [edi + 0x40c]
push 0xfff
push edx
call fcn.00466ca7
mov eax, dword [0x4d2880]
add esp, 0x1c
mov ecx, edi
push 0x30e
push str.WriteKey__
push eax
call fcn.0043ff70
jmp 0x44073b
mov edx, dword [esp + 0x41c]
lea ecx, [esp + 0x10]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, eax
test ebx, ebx
je 0x4406eb
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push ebx
call fcn.00440b30
push eax
push ebx
push esi
push ebp
push 0x4e6694
lea ecx, [edi + 0x40c]
push 0xfff
push ecx
call fcn.00466ca7
mov edx, dword [0x4d2880]
add esp, 0x1c
mov ecx, edi
push 0x319
push str.WriteKey__
push edx
call fcn.0043ff70
jmp 0x44073b
mov eax, dword [esp + 0x10]
push esi
push eax
mov ecx, edi
call fcn.004405e0
cmp eax, 0x10
jb 0x440730
push esi
push ebp
push 0x4e6670
lea ecx, [edi + 0x40c]
push 0xfff
push ecx
call fcn.00466ca7
mov edx, dword [0x4d2880]
add esp, 0x14
mov ecx, edi
push 0x321
push str.WriteKey__
push edx
call fcn.0043ff70
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esi + 0x4c]
mov ebx, dword [esp + 0x41c]
test esi, esi
jne 0x440615
push ebx
mov ecx, edi
call fcn.00440a20
mov esi, dword [ebp + 0x48]
test esi, esi
je 0x4407bd
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x48]
push eax
push ecx
push edx
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4407b6
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, edi
call fcn.00440b30
push eax
push esi
push ebp
push 0x4e664c
lea edx, [edi + 0x40c]
push 0xfff
push edx
call fcn.00466ca7
mov eax, dword [0x4d2880]
add esp, 0x18
mov ecx, edi
push 0x331
push str.WriteKey__
push eax
call fcn.0043ff70
mov esi, dword [esi + 0x50]
test esi, esi
jne 0x44075c
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x408
ret 8
push 0x4e6560
lea ecx, [edi + 0x40c]
push 0xfff
push ecx
call fcn.00466ca7
mov edx, dword [0x4d2880]
add esp, 0xc
mov ecx, edi
push 0x303
push str.WriteKey__
push edx
call fcn.0043ff70
pop edi
pop ebp
mov eax, 0x51
pop ebx
add esp, 0x408
ret 8
Function at 0x440810
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x450
lea eax, [esp]
push esi
push edi
mov edi, dword [esp + 0x45c]
mov esi, ecx
push eax
push 0xf003f
mov ecx, dword [esi + 0x404]
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x44087a
cmp eax, 2
je 0x440a06
lea edx, [esp + 0x54]
mov ecx, esi
push edx
push eax
call fcn.00440b30
push eax
push edi
push 0x4e64a4
lea eax, [esi + 0x40c]
push 0xfff
push eax
call fcn.00466ca7
add esp, 0x14
push 0x348
jmp 0x4409e3
push ebx
mov ecx, dword [esp + 0xc]
xor ebx, ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push ebx
lea eax, [esp + 0x28]
push edx
push eax
push ebx
push ecx
mov dword [esp + 0x34], 0x41
call ebp
test eax, eax
jne 0x440935
lea edx, [esp + 0x18]
lea eax, [esp + 0x5c]
push edx
push edi
push 0x4df9ac
push eax
call fcn.00467d68
add esp, 0x10
lea ecx, [esp + 0x5c]
push ecx
mov ecx, esi
call fcn.00440810
cmp eax, 0x10
jb 0x44090b
lea edx, [esp + 0x18]
lea eax, [esi + 0x40c]
push edx
push edi
push 0x4e66f8
push 0xfff
push eax
call fcn.00466ca7
mov ecx, dword [0x4d2880]
add esp, 0x14
push 0x358
push str.DeleteRegKey__
push ecx
mov ecx, esi
call fcn.0043ff70
inc ebx
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
lea edx, [esp + 0x20]
push 0
lea eax, [esp + 0x28]
push edx
push eax
push ebx
push ecx
mov dword [esp + 0x34], 0x41
call ebp
test eax, eax
je 0x4408aa
pop ebp
cmp eax, 0x103
pop ebx
je 0x440999
lea edx, [esp + 0x54]
mov ecx, esi
push edx
push eax
call fcn.00440b30
push eax
push edi
push 0x4e65cc
lea eax, [esi + 0x40c]
push 0xfff
push eax
call fcn.00466ca7
mov ecx, dword [0x4d2880]
add esp, 0x14
push 0x361
push str.DeleteRegKey__
push ecx
mov ecx, esi
call fcn.0043ff70
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 0x10
pop esi
add esp, 0x450
ret 4
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esi + 0x404]
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x440a06
lea edx, [esp + 0x54]
mov ecx, esi
push edx
push eax
call fcn.00440b30
push eax
push edi
push 0x4e66c4
lea eax, [esi + 0x40c]
push 0xfff
push eax
call fcn.00466ca7
add esp, 0x14
push 0x36b
mov ecx, dword [0x4d2880]
push str.DeleteRegKey__
push ecx
mov ecx, esi
call fcn.0043ff70
pop edi
mov eax, 0x10
pop esi
add esp, 0x450
ret 4
pop edi
xor eax, eax
pop esi
add esp, 0x450
ret 4
Function at 0x440a20
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0x44c
push ebx
mov ebx, dword [esp + 0x454]
push esi
mov esi, ecx
test ebx, ebx
jne 0x440a76
push 0x4e6560
lea eax, [esi + 0x40c]
push 0xfff
push eax
call fcn.00466ca7
mov ecx, dword [0x4d2880]
add esp, 0xc
push 0x37e
push str.DeleteRegValue__
push ecx
mov ecx, esi
call fcn.0043ff70
pop esi
mov eax, 0x51
pop ebx
add esp, 0x44c
ret 4
push ebp
push edi
xor edi, edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push edi
push edi
push edi
lea edx, [esp + 0x1c]
push edi
lea eax, [esp + 0x24]
push edx
push eax
push edi
push ebx
mov dword [esp + 0x30], 0x41
call ebp
test eax, eax
jne 0x440b15
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x440af3
lea edx, [esp + 0x58]
mov ecx, esi
push edx
push eax
call fcn.00440b30
push eax
lea eax, [esp + 0x18]
push eax
push 0x4e6710
lea ecx, [esi + 0x40c]
push 0xfff
push ecx
call fcn.00466ca7
mov edx, dword [0x4d2880]
add esp, 0x14
mov ecx, esi
push 0x38a
push str.DeleteRegValue__
push edx
call fcn.0043ff70
inc edi
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push 0
lea ecx, [esp + 0x24]
push eax
push ecx
push edi
push ebx
mov dword [esp + 0x30], 0x41
call ebp
test eax, eax
je 0x440a9e
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x44c
ret 4
Function at 0x4430b0
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x4ce1b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
mov eax, dword [esp + 0x240]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0042dce0
xor ebp, ebp
lea ecx, [esp + 0x14]
push ebp
mov dword [esp + 0x24c], ebp
mov dword [esi], 0x4d2c04
call fcn.00458110
mov byte [esp + 0x248], 1
mov dword [esi + 0x4c], 4
call fcn.004753b0
test eax, 0x10000
je 0x4431d7
mov ebx, dword [esp + 0x34]
mov edx, dword [str.AgentAdminUserLogin]
mov eax, dword [str.Global]
lea ecx, [esp + 0x14]
neg ebx
sbb ebx, ebx
push edx
and ebx, ecx
push eax
push 0x4df9ac
lea ecx, [esp + 0x148]
push 0x103
push ecx
call fcn.00466ca7
add esp, 0x14
push 0x4e6c7c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebp
jne 0x443180
mov dword [esi + 0x119c], ebp
mov dword [esi + 0x11a0], ebp
mov dword [esi + 0x11a4], ebp
mov dword [esi + 0x11a8], ebp
mov dword [esi + 0x11ac], ebp
jmp 0x4431fa
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ConvertStringSidToSidA
push edi
call ebp
push str.LookupAccountSidA
push edi
mov dword [esi + 0x119c], eax
call ebp
push str.OpenProcessToken
push edi
mov dword [esi + 0x11a0], eax
call ebp
push str.GetTokenInformation
push edi
mov dword [esi + 0x11a4], eax
call ebp
push str.ConvertSidToStringSidA
push edi
mov dword [esi + 0x11a8], eax
call ebp
push edi
mov dword [esi + 0x11ac], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebp, ebp
jmp 0x4431fa
mov edx, dword [str.AgentAdminUserLogin]
lea eax, [esp + 0x13c]
push edx
push 0x4df9a8
push 0x103
push eax
xor ebx, ebx
call fcn.00466ca7
add esp, 0x10
push ebp
push ebp
push 1
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
call ebp
push 0
push 0
push 1
push 0
mov dword [esi + 0x1058], eax
call ebp
push 0
push 0
push 1
push 0
mov dword [esi + 0x105c], eax
call ebp
push 0
push 1
push 1
push 0
mov dword [esi + 0x1060], eax
call ebp
lea ecx, [esp + 0x13c]
mov dword [esi + 0x1064], eax
push ecx
push 0
push 1
push ebx
call ebp
mov dword [esi + 0x1068], eax
lea eax, [esi + 0x106c]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [esi + 0x107c], eax
xor eax, eax
push eax
mov ecx, 0x41
lea edi, [esi + 0x1080]
push eax
push 1
push eax
rep stosd dword es:[edi], eax
call ebp
push 0
push 0
push 1
push 0
mov dword [esi + 0x1188], eax
call ebp
push 0
push 0
push 1
push 0
mov dword [esi + 0x118c], eax
call ebp
push 0
push 0
push 1
push 0
mov dword [esi + 0x1190], eax
call ebp
push 0
push 0
push 1
push 0
mov dword [esi + 0x1194], eax
call ebp
mov ecx, esi
mov dword [esi + 0x1198], eax
call fcn.00443310
lea ecx, [esp + 0x14]
mov byte [esp + 0x248], 0
call fcn.00458150
mov eax, esi
mov ecx, dword [esp + 0x240]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x23c
ret 4
Function at 0x447730
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push esi
push edi
push 0
mov edi, ecx
push 2
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x44777b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e74d0
lea eax, [edi + 0x55]
push 0xfff
push eax
call fcn.00466ca7
mov edx, dword [edi]
add esp, 0x10
push 0x80b
jmp 0x44780b
lea ecx, [esp + 8]
push ebx
push ecx
push esi
xor bl, bl
call sub.KERNEL32.dll_Process32First
mov edx, dword [str.AgentAdmin.exe]
lea eax, [esp + 0x30]
push edx
push eax
call fcn.00468480
add esp, 8
test eax, eax
jne 0x4477d9
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4477db
mov edx, dword [str.AgentAdmin.exe]
lea eax, [esp + 0x30]
push edx
push eax
call fcn.00468480
add esp, 8
test eax, eax
jne 0x4477d9
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4477b0
jmp 0x4477db
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
pop ebx
jne 0x447826
mov edx, dword [str.AgentAdmin.exe]
lea eax, [edi + 0x55]
push edx
push 0x4e74b8
push 0xfff
push eax
call fcn.00466ca7
mov edx, dword [edi]
add esp, 0x10
push 0x825
mov eax, dword [0x4d29e4]
push str.OpenAdminHandle__
push eax
mov ecx, edi
call dword [edx + 0x10]
pop edi
xor eax, eax
pop esi
add esp, 0x128
ret
mov ecx, dword [esp + 0x10]
push ecx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x447879
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [str.AgentAdmin.exe]
push eax
push edx
push 0x4e7480
lea eax, [edi + 0x55]
push 0xfff
push eax
call fcn.00466ca7
mov eax, dword [0x4d29e4]
mov edx, dword [edi]
add esp, 0x14
mov ecx, edi
push 0x82d
push str.OpenAdminHandle__
push eax
call dword [edx + 0x10]
mov eax, esi
pop edi
pop esi
add esp, 0x128
ret
Function at 0x44b380
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4ce513
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
lea ecx, [edi + 0x10]
mov dword [esp + 0x14], ecx
call fcn.00428be0
push 0x38
call fcn.00467824
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x30], 0
test esi, esi
je 0x44b3f2
mov ecx, esi
call fcn.00428920
push 0xfa0
push 0
push ebx
mov ecx, esi
mov byte [esp + 0x3c], 1
call fcn.00428950
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x34], eax
jmp 0x44b3f4
xor esi, esi
mov ebp, dword [edi + 4]
mov ecx, dword [0x4f9340]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], esi
mov edi, dword [ebp + 4]
mov edx, ebp
cmp edi, ecx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x38], edx
mov al, 1
je 0x44b46a
mov esi, dword [edi + 0xc]
mov dword [esp + 0x38], edi
mov eax, ebx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x44b449
test cl, cl
je 0x44b445
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x44b449
add eax, 2
add esi, 2
test cl, cl
jne 0x44b425
xor eax, eax
jmp 0x44b44e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setl al
test al, al
je 0x44b45b
mov edi, dword [edi]
jmp 0x44b45e
mov edi, dword [edi + 8]
cmp edi, dword [0x4f9340]
jne 0x44b41c
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x10]
mov bl, byte [ecx + 8]
test bl, bl
je 0x44b48d
lea eax, [esp + 0x20]
push eax
push edx
lea edx, [esp + 0x20]
push edi
push edx
call fcn.0044c010
mov bl, 1
jmp 0x44b513
test al, al
mov dword [esp + 0x3c], edx
je 0x44b4b8
cmp edx, dword [ebp]
jne 0x44b4af
lea eax, [esp + 0x20]
push eax
push edx
lea edx, [esp + 0x24]
push edi
push edx
call fcn.0044c010
mov bl, 1
jmp 0x44b513
lea ecx, [esp + 0x3c]
call fcn.0044c3b0
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x20]
mov eax, dword [eax + 0xc]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x44b4eb
test cl, cl
je 0x44b4e7
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x44b4eb
add eax, 2
add esi, 2
test cl, cl
jne 0x44b4c3
xor eax, eax
jmp 0x44b4f0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jge 0x44b511
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x20]
push eax
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x40]
push edi
push edx
call fcn.0044c010
mov bl, 1
jmp 0x44b513
xor bl, bl
mov ecx, dword [esp + 0x14]
call fcn.00428cd0
mov ecx, dword [esp + 0x28]
pop edi
neg bl
sbb ebx, ebx
pop esi
and ebx, 0xffffffbe
pop ebp
add ebx, 0x42
mov dword fs:[0], ecx
mov eax, ebx
pop ebx
add esp, 0x24
ret 8
Function at 0x44b840
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4ce533
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov al, byte [esp + 3]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov cl, byte [esp + 0x13]
xor ebx, ebx
push 0x18
mov dword [esp + 0x1c], esi
mov byte [esi], al
mov byte [esi + 1], cl
mov byte [esi + 8], bl
call fcn.00467824
mov edi, eax
add esp, 4
lea ecx, [esp + 0x14]
mov ebp, edi
mov dword [edi + 4], ebx
mov dword [edi + 0x14], 1
call fcn.00465cc3
cmp dword [0x4f9340], ebx
jne 0x44b8b0
mov dword [0x4f9340], edi
mov dword [edi], ebx
mov edx, dword [0x4f9340]
xor ebp, ebp
mov dword [edx + 8], ebx
mov ecx, dword [0x4f9344]
inc ecx
mov dword [0x4f9344], ecx
lea ecx, [esp + 0x14]
call fcn.00465d5f
cmp ebp, ebx
je 0x44b8d3
push ebp
call fcn.00463c78
add esp, 4
mov edi, dword [0x4f9340]
push 0x18
call fcn.00467824
mov dword [eax + 4], edi
mov dword [eax + 0x14], ebx
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [eax], eax
mov eax, dword [esi + 4]
add esp, 4
mov dword [eax + 8], eax
lea edi, [esi + 0x10]
mov dword [esp + 0x24], ebx
mov ecx, edi
call fcn.00428920
push 0xfa0
push ebx
push ebx
mov ecx, edi
mov byte [esp + 0x30], 1
call fcn.00428950
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x452aa0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x18
mov ecx, 5
push ebx
push ebp
push esi
push edi
mov esi, str.LoadVolumeFunction__
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.KERNEL32.DLL
movsb byte es:[edi], byte [esi]
call ebp
mov esi, eax
test esi, esi
jne 0x452ae9
push 0x4e85fc
push 0xfff
push 0x4f93e8
call fcn.00466ca7
push 0x8df
jmp 0x452c8e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DeleteVolumeMountPointA
push esi
call edi
push str.GetVolumeNameForVolumeMountPointA
push esi
mov dword [0x4fa3f0], eax
call edi
push str.SetVolumeMountPointA
push esi
mov dword [0x4fa3e8], eax
call edi
push str.FindFirstVolumeA
push esi
mov dword [0x4fa408], eax
call edi
push str.FindNextVolumeA
push esi
mov dword [0x4fa400], eax
call edi
push str.FindVolumeClose
push esi
mov dword [0x4fa410], eax
call edi
push str.GetVolumeInformationA
push esi
mov dword [0x4fa414], eax
call edi
push str.FindFirstVolumeMountPointA
push esi
mov dword [0x4fa40c], eax
call edi
push str.FindNextVolumeMountPointA
push esi
mov dword [0x4fa418], eax
call edi
push str.FindVolumeMountPointClose
push esi
mov dword [0x4fa3ec], eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
mov dword [0x4fa404], eax
call ebx
mov eax, dword [0x4fa3f0]
test eax, eax
je 0x452c75
mov eax, dword [0x4fa3e8]
test eax, eax
je 0x452c75
mov eax, dword [0x4fa408]
test eax, eax
je 0x452c75
mov eax, dword [0x4fa400]
test eax, eax
je 0x452c75
mov eax, dword [0x4fa410]
test eax, eax
je 0x452c75
mov eax, dword [0x4fa414]
test eax, eax
je 0x452c75
mov eax, dword [0x4fa40c]
test eax, eax
je 0x452c75
mov eax, dword [0x4fa418]
test eax, eax
je 0x452c75
mov eax, dword [0x4fa3ec]
test eax, eax
je 0x452c75
mov eax, dword [0x4fa404]
test eax, eax
je 0x452c75
push 0x4e6c7c
call ebp
mov esi, eax
test esi, esi
jne 0x452c2b
push 0x4e84e4
push 0xfff
push 0x4f93e8
call fcn.00466ca7
mov eax, dword [0x4d2de4]
lea edx, [esp + 0x1c]
push 0x902
push edx
push eax
jmp 0x452c9a
push str.LookupAccountSidA
push esi
call edi
push esi
mov dword [0x4fa3f4], eax
call ebx
mov eax, dword [0x4fa3f4]
test eax, eax
jne 0x452c6b
push 0x4e84d0
push 0xfff
push 0x4f93e8
call fcn.00466ca7
mov edx, dword [0x4d2de4]
lea ecx, [esp + 0x1c]
push 0x90c
push ecx
push edx
jmp 0x452c9a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
push 0x4e84b8
push 0xfff
push 0x4f93e8
call fcn.00466ca7
push 0x8fb
mov ecx, dword [0x4d2de4]
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.0044fa60
add esp, 0x18
mov eax, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret