joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441fc0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d9128
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x659fd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 0
je 0x4421b3
cmp dword [esi + 0xc], 0
je 0x4421b3
cmp dword [esi + 0x18], 0
je 0x4421b3
cmp dword [esi + 0x10], 0
je 0x4421b3
push 1
lea ecx, [ebp - 0x48]
call fcn.0045db10
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 0
push eax
push 0
push 0x116fb
mov ecx, esi
call fcn.0045cf50
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0x441f70
mov dword [ebp - 0x3c], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x442158
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x442158
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x10028
push eax
push edi
mov dword [ebp - 0x34], 0x25
mov dword [ebp - 0x30], 0x1800
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x20000000
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.GDI32.dll_ChoosePixelFormat]
test eax, eax
je 0x442158
lea ecx, [ebp - 0x38]
push ecx
push eax
push edi
call dword [sym.imp.GDI32.dll_SetPixelFormat]
test eax, eax
je 0x442158
mov eax, dword [esi + 0xc]
push edi
call eax
mov dword [esi + 8], eax
test eax, eax
je 0x442158
push eax
mov eax, dword [esi + 0x10]
push edi
call eax
test eax, eax
je 0x442158
mov eax, dword [esi + 0x18]
push str.glGetStringi
call eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
test eax, eax
jne 0x442118
push str.glGetStringi
push dword [esi + 4]
call edi
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x18]
push str.glGetString
call eax
mov dword [esi + 0x24], eax
test eax, eax
jne 0x442136
push str.glGetString
push dword [esi + 4]
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x18]
push str.glGetIntegerv
call eax
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x442154
push str.glGetIntegerv
push dword [esi + 4]
call edi
mov dword [esi + 0x1c], eax
mov bl, 1
jmp 0x44215a
xor bl, bl
mov dword [ebp - 4], 5
or eax, 0xffffffff
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4421a8
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4421d1
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4421d1
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 4], 0xffffffff
mov al, bl
jmp 0x4421b5
mov dword [ebp - 4], 0xffffffff
mov al, bl
jmp 0x4421b5
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a7b5f
mov esp, ebp
pop ebp
ret
mov ecx, edx
call esi
jmp 0x4421a8
Function at 0x447b70
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d9601
mov eax, dword fs:[0]
push eax
sub esp, 0x350
mov eax, dword [0x659fd4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x348], eax
mov byte [eax], 0
cmp byte [ecx + 0x1c], 0
jne 0x447bba
xor al, al
jmp 0x447dac
lea eax, [ebp - 0x344]
mov dword [ebp - 4], 0
push eax
push str.SELECT__FROM_Win32_NetworkAdapter
call fcn.00449970
test al, al
je 0x447daa
mov eax, dword [ebp - 0x344]
lea edx, [ebp - 0x33c]
push edx
lea edx, [ebp - 0x334]
mov dword [ebp - 0x33c], 0
push edx
mov ecx, dword [eax]
push 0xc8
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x447daa
xor edi, edi
nop
cmp edi, dword [ebp - 0x33c]
jae 0x447daa
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x358]
mov byte [ebp - 4], 1
push eax
push str.PhysicalAdapter
push dword [ebp + edi*4 - 0x334]
call fcn.004497d0
test al, al
je 0x447d80
lea ecx, [ebp - 0x358]
call fcn.0044aa80
test al, al
je 0x447d80
lea eax, [ebp - 0x358]
push eax
push str.NetConnectionStatus
push dword [ebp + edi*4 - 0x334]
call fcn.004497d0
test al, al
je 0x447d80
lea ecx, [ebp - 0x358]
call fcn.0044a9e0
cmp eax, 2
jne 0x447d80
lea eax, [ebp - 0x358]
push eax
push str.Name
push dword [ebp + edi*4 - 0x334]
call fcn.004497d0
test al, al
je 0x447d80
lea eax, [ebp - 0x335]
mov byte [ebp - 0x335], 0
push eax
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x340]
call fcn.0044a930
mov byte [ebp - 4], 2
mov eax, dword [eax]
test eax, eax
je 0x447ce2
mov eax, dword [eax]
jmp 0x447ce4
xor eax, eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x35c], esp
push eax
call fcn.004076f8
mov byte [ebp - 4], 3
call fcn.0045be10
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0045bea0
mov byte [ebp - 4], 1
mov bl, al
mov esi, dword [ebp - 0x340]
test esi, esi
je 0x447d6a
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x447d60
test esi, esi
je 0x447d60
mov eax, dword [esi]
test eax, eax
je 0x447d3e
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x447d55
push eax
call fcn.0046128b
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.005a7e2d
add esp, 8
mov dword [ebp - 0x340], 0
test bl, bl
je 0x447d80
cmp byte [ebp - 0x335], 0
je 0x447d80
mov eax, dword [ebp - 0x348]
mov byte [eax], 1
mov eax, dword [ebp + edi*4 - 0x334]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x358]
mov byte [ebp - 4], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
inc edi
jmp 0x447c10
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005a7b5f
mov esp, ebp
pop ebp
ret 4
Function at 0x447dd0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d9651
mov eax, dword fs:[0]
push eax
sub esp, 0x350
mov eax, dword [0x659fd4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x348], eax
mov byte [eax], 0
cmp byte [ecx + 0x1c], 0
jne 0x447e1a
xor al, al
jmp 0x44800c
lea eax, [ebp - 0x344]
mov dword [ebp - 4], 0
push eax
push str.SELECT__FROM_Win32_NetworkAdapter
call fcn.00449970
test al, al
je 0x44800a
mov eax, dword [ebp - 0x344]
lea edx, [ebp - 0x33c]
push edx
lea edx, [ebp - 0x334]
mov dword [ebp - 0x33c], 0
push edx
mov ecx, dword [eax]
push 0xc8
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x44800a
xor edi, edi
nop
cmp edi, dword [ebp - 0x33c]
jae 0x44800a
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x358]
mov byte [ebp - 4], 1
push eax
push str.PhysicalAdapter
push dword [ebp + edi*4 - 0x334]
call fcn.004497d0
test al, al
je 0x447fe0
lea ecx, [ebp - 0x358]
call fcn.0044aa80
test al, al
je 0x447fe0
lea eax, [ebp - 0x358]
push eax
push str.NetConnectionStatus
push dword [ebp + edi*4 - 0x334]
call fcn.004497d0
test al, al
je 0x447fe0
lea ecx, [ebp - 0x358]
call fcn.0044a9e0
cmp eax, 2
jne 0x447fe0
lea eax, [ebp - 0x358]
push eax
push str.Name
push dword [ebp + edi*4 - 0x334]
call fcn.004497d0
test al, al
je 0x447fe0
lea eax, [ebp - 0x335]
mov byte [ebp - 0x335], 0
push eax
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x340]
call fcn.0044a930
mov byte [ebp - 4], 2
mov eax, dword [eax]
test eax, eax
je 0x447f42
mov eax, dword [eax]
jmp 0x447f44
xor eax, eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x35c], esp
push eax
call fcn.004076f8
mov byte [ebp - 4], 3
call fcn.0045be10
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0045c140
mov byte [ebp - 4], 1
mov bl, al
mov esi, dword [ebp - 0x340]
test esi, esi
je 0x447fca
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x447fc0
test esi, esi
je 0x447fc0
mov eax, dword [esi]
test eax, eax
je 0x447f9e
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x447fb5
push eax
call fcn.0046128b
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.005a7e2d
add esp, 8
mov dword [ebp - 0x340], 0
test bl, bl
je 0x447fe0
cmp byte [ebp - 0x335], 0
je 0x447fe0
mov eax, dword [ebp - 0x348]
mov byte [eax], 1
mov eax, dword [ebp + edi*4 - 0x334]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x358]
mov byte [ebp - 4], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
inc edi
jmp 0x447e70
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005a7b5f
mov esp, ebp
pop ebp
ret 4
Function at 0x449490
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d98e0
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x659fd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [ecx + 0x1c], 0
jne 0x4494d7
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
xor bl, bl
push str.SELECT__FROM_Win32_SoundDevice
mov byte [ebp - 0x15], bl
call fcn.00449970
test al, al
je 0x4495b0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push edx
push 1
mov dword [ebp - 0x24], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
jne 0x44959c
lea ecx, [ebp - 0x50]
call fcn.004296a0
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 2
push eax
push str.Name
push dword [ebp - 0x1c]
mov bl, 1
mov byte [ebp - 0x15], bl
call fcn.004497d0
test al, al
je 0x44955c
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x50]
call fcn.00449ee0
lea eax, [ebp - 0x34]
push eax
push str.DeviceID
push dword [ebp - 0x1c]
call fcn.004497d0
test al, al
je 0x44957d
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00449ee0
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.00429220
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x4495b0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4495d0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d990b
mov eax, dword fs:[0]
push eax
sub esp, 0x344
mov eax, dword [0x659fd4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [ecx + 0x1c], 0
mov edi, dword [ebp + 8]
jne 0x449611
xor al, al
jmp 0x4497a3
lea eax, [ebp - 0x33c]
mov dword [ebp - 4], 0
push eax
xor bl, bl
mov dword [ebp - 0x33c], 0
push str.SELECT__FROM_Win32_BaseBoard
mov byte [ebp - 0x335], bl
call fcn.00449970
test al, al
je 0x4497a1
mov eax, dword [ebp - 0x33c]
lea edx, [ebp - 0x340]
push edx
lea edx, [ebp - 0x334]
mov dword [ebp - 0x340], 0
push edx
mov ecx, dword [eax]
push 0xc8
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x449749
xor esi, esi
nop dword [eax + eax]
cmp esi, dword [ebp - 0x340]
jae 0x449749
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 1
push eax
push str.Manufacturer
push dword [ebp + esi*4 - 0x334]
call fcn.004497d0
test al, al
je 0x4496cf
lea eax, [ebp - 0x350]
mov ecx, edi
push eax
call fcn.00449ee0
mov bl, 1
mov byte [ebp - 0x335], bl
lea eax, [ebp - 0x350]
push eax
push str.Product
push dword [ebp + esi*4 - 0x334]
call fcn.004497d0
test al, al
je 0x4496fa
lea eax, [ebp - 0x350]
push eax
lea ecx, [edi + 4]
call fcn.00449ee0
lea eax, [ebp - 0x350]
push eax
push 0x62a360
push dword [ebp + esi*4 - 0x334]
call fcn.004497d0
test al, al
je 0x449725
lea eax, [ebp - 0x350]
push eax
lea ecx, [edi + 8]
call fcn.00449ee0
mov eax, dword [ebp + esi*4 - 0x334]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
inc esi
jmp 0x449680
mov eax, dword [ebp - 0x33c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x4497a1
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005a7b5f
mov esp, ebp
pop ebp
ret 4
Function at 0x44a470
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d9ade
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x659fd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00442b90
lea eax, [esi + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 8]
call fcn.00442b90
lea eax, [esi + 0x10]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x10]
call fcn.00442b90
lea eax, [esi + 0x18]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x18]
call fcn.00442b90
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x20], al
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], vtable.srl::Exists.0
movzx eax, byte [esi + 0x2c]
mov byte [edi + 0x2c], al
mov dword [edi + 0x30], vtable.srl::Exists.0
movzx eax, byte [esi + 0x34]
mov byte [edi + 0x34], al
mov dword [edi + 0x38], vtable.srl::Exists.0
movzx eax, byte [esi + 0x3c]
mov byte [edi + 0x3c], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x452e90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
test esi, esi
je 0x452eaf
cmp dword [edi], 2
jae 0x452eaf
pop edi
mov eax, 0x7a
pop esi
pop ebp
ret 0xc
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x452f17
cmp dword [ebp + 0x10], 7
jne 0x452f12
mov ecx, dword [ebp + 0xc]
test esi, esi
je 0x452f06
test cl, 1
jne 0x452f12
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x452f12
cmp word [esi + eax*2 - 2], 0
jne 0x452f12
cmp eax, 1
jbe 0x452f06
cmp word [esi + eax*2 - 4], 0
jne 0x452f12
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
mov eax, 0xd
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x45bc90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, edx
mov ebx, ecx
test edi, edi
jne 0x45bcab
pop edi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
je 0x45bd36
push eax
call fcn.00461290
mov esi, eax
add esp, 4
test esi, esi
jne 0x45bcd9
pop esi
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp - 4]
push 0
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x45bd2d
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
push eax
push 0x62a0f8
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x45bd2d
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x45bd2d
mov eax, dword [ecx + 8]
mov dword [edi + 4], eax
mov eax, dword [ecx + 0xc]
push esi
mov dword [edi], eax
call fcn.0046128b
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.0046128b
add esp, 4
pop esi
pop edi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45dbf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db060
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x659fd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor bl, bl
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0x20019
mov dword [ebp - 4], 0
push dword [edx]
push ecx
lea ecx, [ebp - 0x24]
call fcn.0042f890
mov ecx, dword [ebp - 0x24]
test eax, eax
jne 0x45dd57
xor esi, esi
mov dword [ebp - 0x10], esi
mov eax, 0x3e8
mov byte [ebp - 4], 1
mov edx, 2
mul edx
test edx, edx
ja 0x45dc82
jb 0x45dc71
cmp eax, 0xffffffff
ja 0x45dc82
push eax
call fcn.005b4418
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0x24]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x7d0
push eax
push esi
lea eax, [ebp - 0x18]
xor edi, edi
push eax
push edi
push dword [ebx]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x45dcc8
cmp eax, 0xea
jne 0x45dd09
push 0x7d0
push esi
call fcn.005b1e89
mov ecx, dword [ebp - 0x24]
add esp, 8
test eax, eax
je 0x45dc85
mov esi, eax
mov dword [ebp - 0x10], esi
jmp 0x45dc85
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x45dcdc
cmp eax, 2
je 0x45dcdc
mov eax, 0xd
jmp 0x45dd09
mov ecx, dword [ebp - 0x14]
test esi, esi
je 0x45dd03
test ecx, ecx
je 0x45dcfe
test cl, 1
jne 0x45dcf7
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], di
je 0x45dd03
mov eax, 0xd
jmp 0x45dd09
xor eax, eax
mov word [esi], ax
mov edi, ecx
shr edi, 1
xor eax, eax
test eax, eax
sete bl
test eax, eax
jne 0x45dd3c
mov word [esi + edi*2], ax
test esi, esi
jne 0x45dd1e
xor ecx, ecx
jmp 0x45dd32
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45dd23
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp + 0xc]
push esi
call fcn.004020e5
push esi
mov byte [ebp - 4], 2
call fcn.005b1e01
mov byte [ebp - 4], 0
add esp, 4
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x45dd70
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], 0
mov al, bl
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461160
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x659fd4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], 0
mov dword [edi], 0
movq xmm0, qword [str.Data_Buffer]
mov eax, dword [0x62e600]
movq qword [ebp - 0x24], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
push 0x3c
mov esi, eax
call fcn.005b4418
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x24]
push 0x3e8
push 0x3c
push ebx
push 0
push 0x20
push eax
push 0xee9f5836
push esi
call dword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
test eax, eax
je 0x4611ed
mov eax, dword [ebx + 8]
mov dword [edi], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a7b5f
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005a7b5f
mov esp, ebp
pop ebp
ret 8

Function at 0x464476
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x4644c0
call fcn.0047c9d9
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4644bd
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x464510
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x4644ed
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5eaa74]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x4644ed
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x46450e
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call dword [0x5eaa74]
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4719aa
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x4719fd
push esi
push dword [ebp + 8]
call fcn.00471b93
mov edi, eax
test edi, edi
je 0x4719f8
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4719f8
mov eax, dword [ebp - 8]
jmp 0x471a0f
mov eax, dword [ebp + 0x10]
jmp 0x471a0f
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc