joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43162d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4316c2
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4316b8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4316a7
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4316a5
push 0x3269
push 0
push 0x55a3
push 0x21d7
push 0x46dd
call fcn.0043c95d
add esp, 0x14
jmp 0x4316b6
push 0x2672
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x4316c0
push 0
call fcn.004412c2
pop ecx
jmp 0x4316de
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x20]
push 1
push dword [ebp - 0x24]
call fcn.0042d932
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x4324fb
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x4325ac
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x432581
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43255d
mov byte [ebp - 1], 0
push 0
push 0x1c0d
lea eax, [ebp - 1]
push eax
push 1
push 0x6032
push 1
push 0
call fcn.004411d9
add esp, 0x1c
jmp 0x43257f
push 0
push 0
push 0x2260
push 0
push 0x237a
push 0
push 0x173c
push 0x13bc
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x4325aa
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43259b
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x4325aa
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
jmp 0x432622
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4325ea
push 0xa19
push 0x2d9d
push 0
call fcn.00439f29
add esp, 0xc
jmp 0x432622
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
push 0x3bae
push dword [ebp - 0x34]
push 0
push 0x2b98
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.00434c2f
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x433901
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4339dc
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4339aa
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4339a0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
shl eax, 2
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx]
sub ecx, eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov dword [eax + 0x20], ecx
jmp 0x4339a8
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x4339da
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 0
push dword [ebp - 0x44]
push 0x46b0
push 0x21a5
push 0x5a02
push 0x5dec
push 1
push 0x48a1
push 1
call fcn.00432e63
add esp, 0x24
jmp 0x433a1c
lea eax, [ebp + 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x433a06
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
push 1
push dword [ebp - 0x50]
call fcn.00430f66
pop ecx
pop ecx
jmp 0x433a1c
push 0x249e
push 0
push 1
push 0x54dc
call fcn.0043723d
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x434234
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x4342fc
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4342c7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43429d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43429b
push 1
push 0
push 0x3007
call fcn.0043c681
add esp, 0xc
jmp 0x4342c5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4342c5
push 1
push 0x2610
push 0xd85
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x4342f7
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x7597
push 1
push 1
push 0x759e
push 0x5876
push 0x3af1
push dword [ebp - 0x28]
push 0x686
push 1
call fcn.00431256
add esp, 0x24
jmp 0x4343c4
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x434364
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x434344
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x434342
push 0
call fcn.004357cf
pop ecx
jmp 0x434362
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x434362
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
jmp 0x4343c4
push 0x4617
push 0x3c81
push 1
push 1
push 0x665f
push 0x11fe
push 0x5dd6
push 0xccb
push 0
push 0
push 0x7720
push 0x3914
push 0x1781
push 0x6de9
push 0x6554
push 0x20ad
push 0x6de3
push 0x4209
push 0x78c0
push 0x795
call fcn.00442247
add esp, 0x50
mov esp, ebp
pop ebp
ret
Function at 0x43586e
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x435900
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4358dd
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4358ce
mov byte [ebp - 1], 0
push 0x2498
push 0
lea eax, [ebp - 1]
push eax
push 1
push 0x29d8
push 1
call fcn.0042f803
add esp, 0x18
jmp 0x4358db
push 0
push 0x2175
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x4358fe
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
push dword [ebp - 0x18]
push 1
push 1
push 0x3ef0
push 0x2538
call fcn.00439f48
add esp, 0x18
jmp 0x435920
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
push eax
push 0
push dword [ebp - 0x20]
call fcn.0042f975
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x4360d0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x436194
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x436133
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push 0x3189
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 1
call fcn.004361d4
add esp, 0x10
jmp 0x436192
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x436174
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x436172
push 0
push 0x2175
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x436192
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
call fcn.0046b186
pop ecx
jmp 0x4361d0
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
push 1
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
push eax
push 0x473f
push dword [ebp - 0x48]
push 0xc8b
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call fcn.0043497a
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x4379cf
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x437aeb
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x437aa9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x437a7e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x437a57
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xc
jg 0x437a7c
push dword [ebp - 0x30]
push 0x2d69
push 0x3817
push 0
push 1
push 1
call fcn.004399b5
add esp, 0x18
jmp 0x437a4c
jmp 0x437aa7
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x437aa7
push 1
push 0x7eb8
push 0x411d
push 1
push 0
push 0x7022
call fcn.0043162d
add esp, 0x18
jmp 0x437ae9
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 0x12c3
push 0x4d67
push 0x8f
push 0x71ec
push 0x74a2
push dword [ebp - 0x38]
push 0x736f
push 0
push 0x6b56
push 0x3a57
push 0x6c24
call fcn.004426a8
add esp, 0x2c
jmp 0x437b40
lea eax, [ebp + 0x20]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x437b25
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x437b1b
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x437b23
push 0x61
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
jmp 0x437b40
push 1
push 0x1e1c
push 0x759d
push 0x59bc
push 0
call fcn.004376a1
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x43873c
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4387c3
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43878a
push 1
push 0x3bf2
push 0x4c25
push 0x2582
push 0x44f1
push 0xefe
push 0x1282
call fcn.00438826
add esp, 0x1c
jmp 0x4387c1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4387b7
mov byte [ebp - 1], 0
push 0
push 1
push 0
lea eax, [ebp - 1]
push eax
push 0x4093
call fcn.00439164
add esp, 0x14
jmp 0x4387c1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x438822
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x438804
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push 0x28f5
push 0x4d29
push 0
call fcn.004406de
add esp, 0x10
jmp 0x438822
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push 1
push 0
push dword [ebp - 0x2c]
call fcn.0042ea5e
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x439187
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x43925f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x439216
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43920c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43920a
push 0x227
push 1
push 1
push 0x7b20
push 0x27d
push 1
call fcn.004308d3
add esp, 0x18
jmp 0x439214
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x43925d
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x439236
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x43925d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x43925d
push 0
push 0
push 0x1cd4
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x439271
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
push 0
push dword [ebp - 0x38]
call fcn.00437115
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x439681
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x439743
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43972e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43971a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4396e7
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x2f
jg 0x439718
mov byte [ebp - 1], 0
push 1
push 1
push 1
lea eax, [ebp - 1]
push eax
push 0x198b
push 0x23e3
push 0
push 0x5dce
call fcn.00432672
add esp, 0x20
jmp 0x4396dc
jmp 0x43972c
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x439741
push 1
push 0
push 0x3c78
push 1
call fcn.0043ec7d
add esp, 0x10
jmp 0x439763
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
push eax
push 1
call fcn.00439662
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x439fdc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x43a0fe
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43a0d7
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43a0cd
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x43a06e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x43a0cb
mov dword [ebp - 8], 0xef307d7c
push 1
push 0
push 0x4665
push 1
push 1
lea eax, [ebp - 8]
push eax
push 0x276
push 0x3ed
call fcn.0043d7a0
add esp, 0x20
push 0x558e
push 0x67e
push 0x3915
push 1
push 1
push dword [ebp - 0x30]
push 0x6926
push 0
lea eax, [ebp - 8]
push eax
call fcn.004335e2
add esp, 0x24
jmp 0x43a063
jmp 0x43a0d5
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x43a0fc
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push 0
push dword [ebp - 0x40]
push 1
push 0x1137
push 1
call fcn.0043cd48
add esp, 0x18
jmp 0x43a11c
lea eax, [ebp + 0x14]
mov dword [ebp - 0x44], eax
push 0x2d0e
push 1
push 0
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
push eax
call fcn.004397e2
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x43a8e5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 8]
test eax, eax
je 0x43a9c5
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43a9a9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43a957
mov byte [ebp - 1], 0
push 1
push 1
push 1
push 0x53ae
push 0x3794
push 1
lea eax, [ebp - 1]
push eax
call fcn.004312f7
add esp, 0x1c
jmp 0x43a9a7
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x1b
jmp 0x43a979
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xf
jle 0x43a9a7
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x43a9a5
push 0
push 0x17cc
push 0
push 0
push 0x9cd
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x43a96e
jmp 0x43a9c3
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push 0
push 0x5a5d
push 1
call fcn.00434622
add esp, 0x10
jmp 0x43a9ee
lea eax, [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
push eax
push 1
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.00430fa5
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x43ac74
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43ad42
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43ad14
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43acf2
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43acf0
push 0x6536
push 1
push 0x3c9
push 1
push 0x36ea
push 0x2676
push 0
push 1
push 1
call fcn.004324fb
add esp, 0x24
jmp 0x43ad12
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43ad12
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x43ad3d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0x3d1d
push 0x5907
push 1
push 0x7340
push dword [ebp - 0x28]
push 0x5f31
push 0
call fcn.0043652c
add esp, 0x1c
jmp 0x43adc7
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x43ad6e
push 1
push 0x75c6
call fcn.00436ec3
pop ecx
pop ecx
jmp 0x43adc7
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x43adb0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x43adae
push 0x2586
push 0
push 0x180
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x43adc7
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x43adc7
push 0x1654
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov esp, ebp
pop ebp
ret