joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448220
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, eax
push edx
push 0x4481dc
call sub.user32.dll_EnumWindows
push esi
push ebx
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x44824d
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
pop esi
pop ebx
ret
mov al, 1
pop esi
pop ebx
ret

Function at 0x448221
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, eax
push edx
push 0x4481dc
call sub.user32.dll_EnumWindows
push esi
push ebx
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x44824d
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
pop esi
pop ebx
ret
mov al, 1
pop esi
pop ebx
ret

Function at 0x448254
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040710c
xor eax, eax
push ebp
push 0x448399
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
cmp dword [ebp - 4], 0
je 0x44837e
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4482a8
mov eax, ebx
sub eax, 0xa
cmp word [eax], 2
je 0x4482a8
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406474
mov ebx, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4482c5
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4482c5
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406474
test eax, eax
je 0x4482ce
sub eax, 4
mov eax, dword [eax]
cmp word [ebx + eax*2 - 2], 0x5c
je 0x4482e3
lea eax, [ebp - 4]
mov edx, 0x4483b8
call fcn.00407520
mov eax, dword [ebp - 4]
test eax, eax
je 0x448300
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x448300
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406474
test eax, eax
je 0x448309
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x44837a
mov ebx, 1
mov eax, dword [ebp - 4]
test eax, eax
je 0x448331
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x448331
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406474
cmp word [eax + ebx*2 - 2], 0x5c
jne 0x448376
lea eax, [ebp - 8]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004078ec
mov eax, dword [ebp - 8]
call fcn.004071b0
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x448370
push 0
push edi
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x448376
jmp 0x44837e
test al, 0x10
jne 0x448376
jmp 0x44837e
inc ebx
dec esi
jne 0x448314
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4483a0
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040711c
ret
Function at 0x4483bc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040710c
mov eax, dword [ebp - 8]
call fcn.0040710c
xor eax, eax
push ebp
push 0x44844c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00407124
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004071b0
mov edi, eax
push edi
call sub.kernel32.dll_GetEnvironmentVariableW
mov ebx, eax
test ebx, ebx
jbe 0x448431
mov eax, esi
mov edx, ebx
call fcn.00407488
push ebx
mov eax, dword [esi]
call fcn.004071b0
push eax
push edi
call sub.kernel32.dll_GetEnvironmentVariableW
mov edx, ebx
dec edx
mov eax, esi
call fcn.00407488
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448453
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040711c
ret

Function at 0x44845c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040710c
mov eax, dword [ebp - 8]
call fcn.0040710c
xor eax, eax
push ebp
push 0x448544
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00407114
mov edx, eax
lea eax, [ebp - 4]
call fcn.00447b4c
mov eax, dword [ebp - 4]
call fcn.0044a924
mov ebx, eax
test ebx, ebx
je 0x448529
mov eax, dword [ebp - 8]
test eax, eax
je 0x4484ca
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4484ca
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.00406474
test eax, eax
je 0x4484d3
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x448504
mov eax, dword [ebp - 8]
test eax, eax
je 0x4484f4
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4484f4
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.00406474
test eax, eax
je 0x4484fd
sub eax, 4
mov eax, dword [eax]
inc eax
mov esi, eax
add esi, esi
jmp 0x448506
xor esi, esi
push esi
mov eax, dword [ebp - 8]
call fcn.004071b0
push eax
push 1
push 0
mov eax, dword [ebp - 0xc]
call fcn.004071b0
push eax
push ebx
call sub.advapi32.dll_RegSetValueExW
push ebx
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44854b
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040711c
ret
Function at 0x448650
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040710c
xor eax, eax
push ebp
push 0x448732
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406288
lea eax, [ebp - 8]
call fcn.00407114
mov edx, eax
lea eax, [ebp - 4]
call fcn.00447b4c
mov eax, dword [ebp - 4]
call fcn.0044a924
mov ebx, eax
test ebx, ebx
je 0x448717
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004071b0
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
cmp dword [ebp - 0xc], 3
jne 0x448711
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004071b0
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
mov eax, esi
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00406c4c
cmp dword [ebp - 0x10], 0
je 0x448711
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.00406a50
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004071b0
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExW_1
push ebx
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448739
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040711c
ret

Function at 0x448bfc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040710c
mov eax, dword [ebp - 8]
call fcn.004069c8
xor eax, eax
push ebp
push 0x448d14
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.004071b0
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x448cf6
mov eax, dword [ebp - 8]
test eax, eax
je 0x448c77
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x448c77
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.004064a4
test eax, eax
je 0x448c80
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x448cf0
mov esi, dword [ebp - 8]
test esi, esi
je 0x448ca5
mov eax, esi
sub eax, 0xa
cmp word [eax], 1
je 0x448ca5
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.004064a4
mov esi, eax
lea eax, [ebp - 8]
call fcn.00406a50
mov esi, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x448cce
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x448cce
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.004064a4
mov edi, eax
test edi, edi
je 0x448cd9
sub edi, 4
mov edi, dword [edi]
push 0
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push ebx
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448d1b
lea eax, [ebp - 8]
call fcn.00406288
lea eax, [ebp - 4]
call fcn.00407114
ret
Function at 0x448d28
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 8], edx
mov dword [esp], eax
mov eax, dword [esp + 8]
xor edx, edx
call fcn.00407124
mov esi, dword [esp]
shr esi, 4
inc esi
call fcn.0041ac0c
and ax, 0x3ff
or ax, 0x400
movzx eax, ax
push eax
mov edi, esi
push edi
push 6
mov eax, dword [0x4b0c38]
push eax
call sub.kernel32.dll_FindResourceExW
mov ebx, eax
test ebx, ebx
jne 0x448d85
mov eax, 0x409
push eax
push edi
push 6
mov eax, dword [0x4b0c38]
push eax
call sub.kernel32.dll_FindResourceExW
mov ebx, eax
test ebx, ebx
je 0x448e08
push ebx
mov eax, dword [0x4b0c38]
push eax
call sub.kernel32.dll_SizeofResource
mov esi, eax
push ebx
mov eax, dword [0x4b0c38]
push eax
call sub.kernel32.dll_LoadResource
mov ebp, eax
test esi, esi
je 0x448e02
test ebp, ebp
je 0x448e02
push ebp
call sub.kernel32.dll_LockResource
mov ebx, eax
mov eax, ebx
cdq
push edx
push eax
mov eax, esi
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [esp + 0xc], eax
xor edi, edi
cmp ebx, dword [esp + 0xc]
jae 0x448e02
movzx esi, word [ebx]
add ebx, 2
mov eax, dword [esp]
and eax, 0xf
cmp edi, eax
jne 0x448df4
movzx ecx, si
mov eax, dword [esp + 8]
mov edx, ebx
call fcn.00407260
jmp 0x448e02
inc edi
movzx eax, si
add eax, eax
add ebx, eax
cmp ebx, dword [esp + 0xc]
jb 0x448dd4
push ebp
call sub.kernel32.dll_FreeResource
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x44963c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040710c
xor eax, eax
push ebp
push 0x4496f2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040483c
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.0040483c
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], 1
test edi, edi
jne 0x44969d
lea esi, [ebp - 0x58]
jmp 0x44969f
mov esi, edi
push esi
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004071b0
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x4496dc
test edi, edi
jne 0x4496da
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4496f9
lea eax, [ebp - 4]
call fcn.00407114
ret
Function at 0x449c9c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040710c
xor eax, eax
push ebp
push 0x449d21
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
call fcn.00407114
mov edx, eax
lea eax, [ebp - 4]
call fcn.00447b4c
mov eax, dword [ebp - 4]
call fcn.0044a2ec
mov esi, eax
test esi, esi
je 0x449d06
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004071b0
push eax
push esi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
push esi
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449d28
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040711c
ret

Function at 0x449f80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x250], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040710c
mov eax, dword [ebp - 8]
call fcn.0040710c
xor eax, eax
push ebp
push 0x44a070
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.0040483c
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x540
lea eax, [ebp - 0x250]
call fcn.0044757c
mov eax, dword [ebp - 0x250]
call fcn.004071b0
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.004071b0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.004071b0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x24c]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW_1
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
call fcn.0041ac70
mov ebx, eax
test esi, esi
je 0x44a04a
mov eax, esi
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], edx
xor edx, edx
mov dword [eax + 8], edx
xor edx, edx
mov dword [eax + 0xc], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a077
lea eax, [ebp - 0x250]
call fcn.00407114
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040711c
ret

Function at 0x44a4ec
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf8
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00407124
mov eax, esp
xor ecx, ecx
mov edx, 0x208
call fcn.0040483c
push esp
push 0
push 0
push esi
push 0
call sub.shell32.dll_SHGetFolderPathW
test eax, eax
jne 0x44a545
push esp
call sub.kernel32.dll_lstrlenW_1
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.00407488
mov eax, ebx
call fcn.00407a8c
mov edx, eax
mov ecx, esi
add ecx, ecx
mov eax, esp
call fcn.00404350
add esp, 0x208
pop esi
pop ebx
ret
Function at 0x44a550
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda8
push ebx
push esi
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040710c
xor eax, eax
push ebp
push 0x44a62c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp byte [ebp - 5], 0
je 0x44a5c2
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 4]
call fcn.004071b0
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov esi, eax
cmp esi, 0xffffffff
je 0x44a616
test byte [ebp - 0x258], 0x10
sete bl
test bl, bl
jne 0x44a5ba
lea eax, [ebp - 0x258]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x44a59b
push esi
call sub.kernel32.dll_FindClose_1
jmp 0x44a616
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004071b0
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
setne bl
test bl, bl
je 0x44a5f6
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x44a616
push esi
call sub.shlwapi.dll_PathFileExistsW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x44a616
push esi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x44a616
test al, 0x10
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a633
lea eax, [ebp - 4]
call fcn.00407114
ret

Function at 0x44a74c
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda8
push ebx
push esi
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040710c
xor eax, eax
push ebp
push 0x44a7ec
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp byte [ebp - 5], 0
je 0x44a7be
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 4]
call fcn.004071b0
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov esi, eax
cmp esi, 0xffffffff
je 0x44a7d6
test byte [ebp - 0x258], 0x10
setne bl
test bl, bl
jne 0x44a7b6
lea eax, [ebp - 0x258]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x44a797
push esi
call sub.kernel32.dll_FindClose_1
jmp 0x44a7d6
mov eax, dword [ebp - 4]
call fcn.004071b0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x44a7d6
test al, 0x10
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a7f3
lea eax, [ebp - 4]
call fcn.00407114
ret
Function at 0x44a9d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040710c
xor eax, eax
push ebp
push 0x44aa7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406288
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004071b0
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44aa66
push 2
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov dword [ebp - 8], eax
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
mov eax, esi
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00406c4c
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, esi
call fcn.00406a50
push eax
push ebx
call sub.kernel32.dll_ReadFile
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44aa83
lea eax, [ebp - 4]
call fcn.00407114
ret
Function at 0x44e3b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x44e406
test eax, edx
je 0x44e409
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x44e3c9
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x44e3ef
add ecx, 4
js 0x44e3df
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x44e3ec
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x44e415
test edx, edx
jne 0x44e3bc
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x44fe00
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x44feb8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0044fd94
test al, al
je 0x44fe9a
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407260
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x44fe9a
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004071b0
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.004071b0
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004072d0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x44fe53
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44febf
lea eax, [ebp - 0x2c]
call fcn.00407114
lea eax, [ebp - 4]
call fcn.00407114
ret

Function at 0x450170
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004071b0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.0044fb0c
test al, al
jne 0x4501d1
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4adb8c]
mov dl, 1
mov eax, dword [0x44e7e8]
call fcn.00414f54
call fcn.00405ac0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0044fa38
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x464140
Capabilities:
Create thread

Disassembly:
push ebx
mov eax, dword [0x4ad78c]
mov byte [eax], 1
mov edx, dword [0x462eec]
xor eax, eax
call fcn.004631c8
mov ebx, eax
mov byte [ebx + 0x18], 1
lea eax, [ebx + 0x1e]
push eax
push 4
push ebx
push 0x464130
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [ebx + 0x1a], eax
mov eax, ebx
pop ebx
ret

Function at 0x464280
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x18], 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jbe 0x46429b
mov byte [ebx + 0x18], 1
pop ebx
ret
cmp word [ebx + 0x2c], 0
je 0x4642aa
mov edx, ebx
mov eax, dword [ebx + 0x2e]
call dword [ebx + 0x2a]
pop ebx
ret

Function at 0x465e9c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
and dword [ebx + 0x24], 0xefffffff
test dl, dl
je 0x465eb1
or dword [ebx + 0x24], 0x10000000
cmp dword [ebx + 0x1c], 0
je 0x465ee7
test dl, dl
je 0x465ed0
mov eax, ebx
call dword [0x4ad3f8]
push 5
mov eax, dword [ebx + 0x1c]
push eax
call sub.user32.dll_ShowWindow
jmp 0x465ee7
and byte [ebx + 0x37], 0xfe
push 0
mov eax, dword [ebx + 0x1c]
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
call dword [0x4ad3f8]
pop ebx
ret
Function at 0x46ede4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46eeef
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
call fcn.0046c95c
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00407328
lea eax, [ebx + 4]
mov edx, esi
call fcn.0046f3c4
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.0046f3c4
lea eax, [ebx + 0x14]
mov edx, esi
call fcn.0046f3c4
lea edx, [ebp - 8]
mov eax, esi
call fcn.0046c95c
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x1c]
call fcn.00407328
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.0046c95c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x20]
call fcn.00407328
lea edx, [ebx + 0x24]
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0046c95c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00407328
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.0046c95c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x2c]
call fcn.00407328
mov eax, esi
call fcn.0046c91c
mov dword [ebx + 0x30], eax
mov eax, esi
call fcn.0046c91c
mov dword [ebx + 0x34], eax
mov eax, esi
call fcn.0046c91c
mov dword [ebx + 0x38], eax
mov eax, esi
call fcn.0046c91c
mov dword [ebx + 0x3c], eax
mov eax, esi
call fcn.0046c91c
mov dword [ebx + 0x40], eax
lea eax, [ebx + 0x44]
mov edx, esi
call fcn.0046dec8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46eef6
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004062ac
ret