joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433980
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x553948]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edi
xor edi, edi
lea edx, [ebp - 0x20]
push edx
push edi
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x24]
push ecx
push edi
push edi
push 4
push 6
push eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x433abe
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x30], ecx
cmp ecx, edi
je 0x433abe
push 2
push 0xc
lea edx, [ebp - 0x10]
push edx
push ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x433abe
push ebx
push esi
mov esi, dword [ebp - 0xc]
add esi, 8
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, edi
je 0x433abc
push 2
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x433ab5
xor esi, esi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x10], edi
jbe 0x433a93
lea esp, [esp]
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x18]
push eax
push esi
push ecx
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x433a93
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x433a93
cmp byte [eax], 0
mov edi, eax
jne 0x433a75
mov ecx, dword [ebp - 0x28]
lea esi, [eax + 8]
call fcn.0040b390
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esi, dword [ebp - 0x1c]
test eax, eax
jne 0x433a8a
mov eax, dword [ebp - 0x18]
movzx edx, word [edi + 2]
push edx
push eax
push 0xffffffffffffffff
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x433a93
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, dword [ebp - 0x10]
jb 0x433a30
cmp esi, dword [ebp - 0x10]
jne 0x433ab5
mov eax, dword [ebp - 0x2c]
push 0
push ebx
push 0
push 0
push 4
push 6
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
jne 0x433ab5
mov byte [ebp - 0x11], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
pop ebx
mov eax, dword [ebp - 0x20]
pop edi
test eax, eax
je 0x433acd
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x11]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
Function at 0x434050
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [ebp + 8]
push eax
mov ecx, edi
call fcn.004341f0
test eax, eax
jne 0x4341e9
push ebx
mov ebx, dword [sym.imp.USER32.dll_LoadIconW]
mov ecx, 0x7f01
mov eax, 0x7f03
push esi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0x7f02
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x7f05
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x7f04
xor esi, esi
mov eax, dword [ebp + esi*4 - 0x1c]
push eax
push 0
call ebx
push eax
mov ecx, edi
call fcn.004341f0
test eax, eax
jne 0x4341e7
inc esi
cmp esi, 7
jb 0x4340a5
mov ebx, dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x38], 0x7f02
mov dword [ebp - 0x34], 0x7f8a
mov dword [ebp - 0x30], 0x7f00
mov dword [ebp - 0x2c], 0x7f03
mov dword [ebp - 0x28], 0x7f89
mov dword [ebp - 0x24], 0x7f8b
mov dword [ebp - 0x20], 0x7f01
mov dword [ebp - 0x1c], 0x7f88
mov dword [ebp - 0x18], 0x7f86
mov dword [ebp - 0x14], 0x7f83
mov dword [ebp - 0x10], 0x7f85
mov dword [ebp - 0xc], 0x7f82
mov dword [ebp - 8], 0x7f84
mov dword [ebp - 4], 0x7f04
xor esi, esi
mov edi, edi
mov ecx, dword [ebp + esi*4 - 0x38]
push ecx
push 0
call ebx
push eax
mov ecx, edi
call fcn.004341f0
test eax, eax
jne 0x4341e7
inc esi
cmp esi, 0xe
jb 0x434130
push str._AcroAppTimer
push str.apptimer.exe
call fcn.00434230
add esp, 8
test eax, eax
je 0x434171
push eax
mov ecx, edi
call fcn.004341f0
test eax, eax
jne 0x4341e7
push str.SafeNet_Borderless_Single_Sign_On.....
push str.DKAXSvr.exe
call fcn.00434230
add esp, 8
test eax, eax
je 0x434193
push eax
mov ecx, edi
call fcn.004341f0
test eax, eax
jne 0x4341e7
push 0
call fcn.004150e0
add esp, 4
test al, al
je 0x4341e5
push str.PrivateOutputChannelHelperWindow
push str.QTPro.exe
call fcn.00434230
add esp, 8
test eax, eax
je 0x4341c3
push eax
mov ecx, edi
call fcn.004341f0
test eax, eax
jne 0x4341e7
push 0x535950
push str.QTPro.exe
call fcn.00434230
add esp, 8
test eax, eax
je 0x4341e5
push eax
mov ecx, edi
call fcn.004341f0
test eax, eax
jne 0x4341e7
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x435070
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x553948]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
xor bl, bl
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4351a3
mov dword [eax], 0
test edi, edi
je 0x4351a3
push 2
push 0xc
lea ecx, [ebp - 0x10]
xor eax, eax
push ecx
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x4351a3
push esi
mov esi, dword [ebp - 0xc]
add esi, 8
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x435190
push 2
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x435189
xor ebx, ebx
cmp ebx, dword [ebp - 0x10]
jae 0x435169
jmp 0x435109
mov edi, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
push edx
push ebx
push edi
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x435166
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x435166
cmp byte [eax], 0
mov edi, eax
jne 0x435148
mov ecx, dword [ebp - 0x24]
lea esi, [eax + 8]
call fcn.0040b390
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x435160
mov eax, dword [ebp - 0x18]
movzx ecx, word [edi + 2]
mov edx, dword [ebp - 0x14]
push ecx
push eax
push 0xffffffffffffffff
push 2
push edx
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
je 0x435166
inc ebx
cmp ebx, dword [ebp - 0x10]
jb 0x435106
cmp ebx, dword [ebp - 0x10]
jne 0x435186
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
pop esi
pop edi
mov al, 1
mov dword [edx], ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00401316
mov esp, ebp
pop ebp
ret
Function at 0x438680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x553948]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20a]
push edx
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x214], 0
mov word [ebp - 0x20c], cx
call fcn.004e41d0
mov bx, word [ebp + 0x10]
xor eax, eax
add esp, 0xc
cmp dword [ebp + 0xc], eax
mov dword [ebp - 0x21c], 0
sete al
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x224], 4
mov dword [ebp - 0x210], eax
test bx, bx
je 0x438711
push str.SoftwareAdobeAcrobat_Reader11.0FeatureState
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
jmp 0x438722
push str.SoftwareAdobeAdobe_Acrobat11.0FeatureState
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.00402c49
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x20c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4387f4
lea edx, [ebp - 0x224]
push edx
mov edx, dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 0x214]
lea ecx, [ebp - 0x21c]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4387bf
cmp dword [ebp - 0x21c], 4
jne 0x4387bf
mov eax, dword [ebp - 0x214]
xor ecx, ecx
cmp dword [ebp - 0x218], ecx
push eax
setne cl
mov dword [ebp - 0x210], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, word [ebp - 0x210]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
test bx, bx
je 0x4387d0
test esi, esi
je 0x4387d0
mov edx, 1
mov word [esi], dx
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, word [ebp - 0x210]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
test bx, bx
je 0x438805
test esi, esi
je 0x438805
mov ecx, 1
mov word [esi], cx
mov ecx, dword [ebp - 4]
mov ax, word [ebp - 0x210]
pop esi
xor ecx, ebp
pop ebx
call fcn.00401316
mov esp, ebp
pop ebp
ret
Function at 0x439d90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x553948]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
push edi
mov edi, ecx
mov dword [ebp - 0x60], 0
jne 0x439dc9
cmp dword [edi + 8], 0
jne 0x439dfb
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret 4
push 0
push 0x401480
push 1
push str.NtMapViewOfSection
push 0x517c70
call fcn.004365c0
push 1
push 0x4049f0
push 1
push str.NtUnmapViewOfSection
push 0x517c70
mov ecx, edi
call fcn.004365c0
mov eax, dword [edi]
push ebx
mov ebx, dword [eax]
push esi
push 1
push 0x2000
push 0x10000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, dword [edi + 8]
shl esi, 6
add esi, 0x50
push esi
mov dword [ebp - 0x58], eax
call fcn.00439f40
mov ecx, dword [ebp - 0x58]
mov edx, eax
add esp, 4
and eax, 0xfff
push 0x40
mov dword [ebp - 0x64], eax
push 0x1000
lea eax, [esi + 0xfff]
and edx, 0xfffff000
and eax, 0xfffff000
push eax
add ecx, edx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x58], eax
test eax, eax
jne 0x439e6a
call fcn.0040c740
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x64]
mov dword [ebp - 0x58], eax
je 0x439f1c
push 0x49c
push 0
push 0x556588
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x50], 0x10
call fcn.004e41d0
mov eax, dword [ebp - 0x58]
add esp, 0xc
lea edx, [ebp - 0x54]
push edx
push esi
push eax
mov ecx, edi
call fcn.00439fb0
test al, al
je 0x439f1c
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x5c]
push ecx
push 0x10
lea edx, [ebp - 0x54]
push edx
push eax
push ebx
mov dword [ebp - 0x5c], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x439f1c
cmp dword [ebp - 0x5c], 0x10
jne 0x439f1c
mov edx, dword [ebp - 0x58]
lea ecx, [ebp - 0x60]
push ecx
push 0x20
push esi
push edx
push ebx
mov dword [ebp - 0x60], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [edi]
push 0x49c
push 0x556588
push str.g_originals
call fcn.00435510
pop esi
test eax, eax
pop ebx
sete al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
xor al, al
pop edi
call fcn.00401316
mov esp, ebp
pop ebp
ret 4
Function at 0x43adc0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0x14]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push eax
push ebx
push 0x8000004
push ebx
push 0xffffffffffffffff
mov esi, ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
mov eax, dword [esi + 0x18]
cmp eax, edi
je 0x43ae23
cmp eax, ebx
je 0x43ae12
cmp eax, 0xffffffff
je 0x43ae12
call fcn.00416dd0
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x43ae0f
call fcn.0040c740
mov dword [esi + 0x18], ebx
cmp edi, ebx
je 0x43ae23
cmp edi, 0xffffffff
je 0x43ae23
mov dword [esi + 0x18], edi
call fcn.00416dd0
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x43ae2f
cmp eax, 0xffffffff
jne 0x43ae3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esi]
push ebx
push ebx
push 6
lea edx, [ebp - 4]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x43ae2f
mov eax, dword [esi + 0x18]
push ebx
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x43ae2f
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [ebx + edi]
push eax
push ecx
push edx
call fcn.0043af90
mov eax, dword [ebp - 4]
add esp, 0xc
push 4
push 0x556494
push str.g_shared_section
mov ecx, esi
mov dword [0x556494], eax
call fcn.00435510
mov dword [0x556494], 0
test eax, eax
je 0x43aec7
cmp eax, 1
je 0x43ae2f
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 4
push 0x556550
push str.g_shared_IPC_size
mov ecx, esi
mov dword [0x556550], edi
call fcn.00435510
xor edi, edi
mov dword [0x556550], edi
cmp eax, edi
jne 0x43aeb0
mov ecx, dword [ebp + 0x14]
push 4
push 0x556554
mov dword [0x556554], ecx
push str.g_shared_policy_size
mov ecx, esi
call fcn.00435510
mov dword [0x556554], edi
cmp eax, edi
jne 0x43aeb0
push 0x24
call fcn.004051ca
add esp, 4
cmp eax, edi
je 0x43af3c
mov ecx, dword [ebp + 8]
mov edx, dword [esi + 8]
mov edi, dword [esi]
push ecx
mov ecx, dword [esi + 0x24]
push ecx
mov ecx, dword [esi + 0x1c]
push ecx
push edx
push edi
mov ecx, eax
call fcn.0043afd0
jmp 0x43af3e
xor eax, eax
push eax
lea ecx, [esi + 0x20]
call fcn.0043b070
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi + 0x20]
push 0x20000
push edx
push ebx
call fcn.0043b0a0
test al, al
jne 0x43af6b
pop edi
pop esi
mov eax, 8
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, esi
call fcn.0043b350
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43b510
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x553948]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.004e41d0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x101
ja 0x43b57c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x43b57c
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
call fcn.00401316
mov esp, ebp
pop ebp
ret
Function at 0x43e780
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x553948]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
cmp esi, 0x804
ja 0x43e7bd
je case.0x43e7b6.1027
lea eax, [esi - 0x403]
cmp eax, 0x2a
ja case.0x43e7b6.1032
movzx eax, byte [eax + 0x43e810]
jmp dword [eax*4 + 0x43e808]
cmp esi, 0xc0a
je case.0x43e7b6.1027
push 0x400
lea ecx, [ebp - 0x404]
push 0
push ecx
call fcn.004e41d0
add esp, 0xc
push 0x200
lea edx, [ebp - 0x404]
push edx
push 3
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x43e7f6
mov bl, 1
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00401316
mov esp, ebp
pop ebp
ret

Function at 0x43e7c5
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x553948]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
cmp esi, 0x804
ja 0x43e7bd
je case.0x43e7b6.1027
lea eax, [esi - 0x403]
cmp eax, 0x2a
ja case.0x43e7b6.1032
movzx eax, byte [eax + 0x43e810]
jmp dword [eax*4 + 0x43e808]
cmp esi, 0xc0a
je case.0x43e7b6.1027
push 0x400
lea ecx, [ebp - 0x404]
push 0
push ecx
call fcn.004e41d0
add esp, 0xc
push 0x200
lea edx, [ebp - 0x404]
push edx
push 3
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x43e7f6
mov bl, 1
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00401316
mov esp, ebp
pop ebp
ret
Function at 0x4414f0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5050db
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x553948]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
lea ecx, [esi + 4]
call fcn.004415b0
xor edi, edi
mov dword [esi], vtable.sandbox_dde::CDdeTopic.0
push 0x18
mov dword [ebp - 4], edi
mov dword [esi + 0x30], edi
call fcn.004051ca
add esp, 4
cmp eax, edi
je 0x44157f
mov dword [esi + 0x2c], eax
mov dword [eax], eax
mov eax, dword [esi + 0x2c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x2c]
mov dword [eax + 8], eax
mov edx, dword [esi + 0x2c]
mov al, 1
mov byte [edx + 0x14], al
mov ecx, dword [esi + 0x2c]
mov byte [ecx + 0x15], al
mov dword [esi + 0x38], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
lea edx, [ebp + 0xc]
push edx
lea ecx, [ebp - 0x1c]
mov dword [ebp + 0xc], edi
call fcn.004e3c5a
push 0x53fa68
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call fcn.004e3d99
int3
Function at 0x444630
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
push edi
mov dword [ebp - 4], 0
lea edi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x444645
mov edx, dword [ebp + 8]
sub eax, edi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ecx]
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x447c30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x553948]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x555270]
test eax, eax
jne 0x447d97
push 0x114
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004e41d0
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x114]
cmp eax, 6
ja case.default.0x447d26
jmp dword [eax*4 + 0x447da8]
mov eax, 1
mov dword [0x555270], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x110]
sub eax, 0
je 0x447d03
dec eax
je 0x447ceb
dec eax
je 0x447cd3
mov eax, 0x67
mov dword [0x555270], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, 0x66
mov dword [0x555270], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, 0x65
mov dword [0x555270], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, 0x64
mov dword [0x555270], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x110]
cmp eax, 3
ja case.default.0x447d26
jmp dword [eax*4 + 0x447dc4]
mov eax, 0x68
mov dword [0x555270], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, 0x69
mov dword [0x555270], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, 0x6a
mov dword [0x555270], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, 0x6b
mov dword [0x555270], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
mov eax, 0x6c
mov dword [0x555270], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret
Function at 0x448090
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test edi, edi
je 0x4481bb
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x190000
push 3
push 0
push 3
push 0xc0000000
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x448119
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x4481b6
mov eax, dword [ebp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x4481b6
push 0
push 0x190000
push 3
push 0
push 3
push 0xc0000000
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x4481b6
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x44819c
mov edi, dword [ebp + 0x24]
test edi, edi
je 0x448161
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0xa0]
test eax, eax
je 0x448161
lea edx, [ebp + 8]
push edx
push esi
mov dword [ebp + 8], 0
call eax
test eax, eax
je 0x448161
mov eax, dword [ebp + 8]
test eax, eax
je 0x448161
cmp eax, edi
je 0x448161
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp + 8], eax
jne 0x44819c
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov dword [ebp - 0xc], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x44819c
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
push 0
push ecx
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov edi, eax
jmp 0x44819f
mov edi, dword [ebp - 4]
cmp esi, 0xffffffff
je 0x4481ab
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0x20
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0x20