joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4610d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push esp
push 1
push 0
push 0x461148
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
cmp dword [esp], 0
je 0x461144
mov dword [esp + 4], 0x104
mov eax, 0x4a84fc
mov ecx, 0x104
xor edx, edx
call fcn.00405518
lea eax, [esp + 4]
push eax
mov eax, dword [0x4a84fc]
push eax
push 0
push 0
push 0x46115c
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46113b
mov edx, ebx
mov eax, dword [0x4a84fc]
call fcn.00460e34
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop ecx
pop edx
pop ebx
ret
Function at 0x461bd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x461cbf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x461ccc
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x461c39
mov dword [ebp - 0xc], pe_nt_image_headers32
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x110]
push eax
call sub.user32.dll_CharLowerA
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405620
mov eax, dword [ebp - 4]
cmp byte [eax], 0x22
jne 0x461c7c
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x461cf0
call fcn.00405a04
mov ecx, eax
add ecx, 2
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.00405920
jmp 0x461c9f
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x461cf0
call fcn.00405a04
mov ecx, eax
add ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405920
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040547c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461cc6
lea eax, [ebp - 4]
call fcn.00405428
ret
Function at 0x4627b4
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x462834
movzx eax, word [ebx + 0x3e]
push eax
movzx eax, byte [ebx + 0x44]
mov eax, dword [eax*4 + 0x4a1924]
push eax
movzx eax, byte [ebx + 0x3c]
mov eax, dword [eax*4 + 0x4a18c4]
push eax
call sub.wsock32.dll_socket
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov esi, eax
mov dword [ebx + 0x40], esi
inc esi
setne al
mov byte [ebx + 0x30], al
test al, al
je 0x462834
cmp byte [ebx + 0x31], 1
jne 0x46281f
mov dword [esp], 1
push esp
push 0x8004667e
mov eax, dword [ebx + 0x40]
push eax
call sub.wsock32.dll_ioctlsocket
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
mov dword [ebx + 0x34], eax
xor eax, eax
mov dword [ebx + 0x38], eax
mov eax, ebx
mov si, 0xffef
call fcn.004047f8
pop edx
pop esi
pop ebx
ret

Function at 0x462a34
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov esi, ecx
mov ebx, edx
mov eax, esi
call fcn.00405428
test ebx, ebx
je 0x462ad2
movzx eax, byte [ebx]
add al, 0xd0
sub al, 0xa
jae 0x462a71
mov eax, ebx
call fcn.004058b8
push eax
call sub.wsock32.dll_inet_addr
inc eax
je 0x462ade
mov eax, esi
mov edx, ebx
call fcn.0040547c
jmp 0x462ade
mov eax, ebx
call fcn.004058b8
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x462ade
mov ebx, eax
push esi
mov eax, dword [ebx + 0xc]
mov edi, dword [eax]
movzx eax, byte [edi]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
movzx eax, byte [edi + 1]
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], 0
movzx eax, byte [edi + 2]
mov dword [esp + 0x14], eax
mov byte [esp + 0x18], 0
movzx eax, byte [edi + 3]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], 0
lea edx, [esp + 4]
mov ecx, 3
mov eax, 0x462af0
call fcn.0040af68
jmp 0x462ade
mov eax, esi
mov edx, 0x462b04
call fcn.0040547c
add esp, 0x20
pop edi
pop esi
pop ebx
ret

Function at 0x462b48
Capabilities:
Get hostname

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00405428
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
test eax, eax
jne 0x462b85
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00405698
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4636b8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x463717
xor eax, eax
push ebp
push 0x463710
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463717
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
pop ecx
pop ecx
pop ebp
ret
Function at 0x4637e4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
xor edx, edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a8
xor eax, eax
push ebp
push 0x4638d7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d4]
call fcn.00463964
lea eax, [ebp - 0x1d4]
mov edx, 0x4638ec
call fcn.004056f4
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00403764
lea eax, [ebp - 0x1d0]
call fcn.004034f4
call fcn.0040304c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00405bac
call fcn.00404058
call fcn.0040304c
lea eax, [ebp - 0x1d0]
call fcn.004038e4
call fcn.0040304c
push 0
push 0
push 0
lea eax, [ebp - 0x1d8]
call fcn.00463964
lea eax, [ebp - 0x1d8]
mov edx, 0x4638ec
call fcn.004056f4
mov eax, dword [ebp - 0x1d8]
call fcn.004058b8
push eax
push 0x4638f8
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4638de
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.0040544c
lea eax, [ebp - 4]
call fcn.00405428
ret
Function at 0x4639a4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd14
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2ec], ecx
mov dword [ebp - 0x2e8], ecx
mov dword [ebp - 0x2e4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a8
lea eax, [ebp - 0x178]
mov edx, dword [0x408ad8]
call fcn.00405ec4
xor eax, eax
push ebp
push 0x463bc1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x463b54
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2e4]
mov ecx, 0x463bd8
mov edx, dword [ebp - 4]
call fcn.00405740
mov eax, dword [ebp - 0x2e4]
lea ecx, [ebp - 0x178]
mov edx, 0x3f
call fcn.0040a3ec
mov ebx, eax
test ebx, ebx
jne 0x463b4a
test dword [ebp - 0x168], 0x10
jle 0x463a6c
push dword [ebp - 8]
push dword [ebp - 0x164]
push 0x463be4
lea eax, [ebp - 8]
mov edx, 3
call fcn.004057bc
jmp 0x463b35
mov eax, dword [ebp - 0x178]
call fcn.0040a720
fstp qword [ebp - 0x180]
wait
push dword [ebp - 0x17c]
push dword [ebp - 0x180]
mov edx, dword [0x4a2528]
mov edx, dword [edx]
lea eax, [ebp - 0x18]
call fcn.0040c858
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
call fcn.004054c0
push 0x400
push 0x160
lea eax, [ebp - 0x2e0]
push eax
push 0
lea eax, [ebp - 0x2e8]
mov ecx, dword [ebp - 0x164]
mov edx, dword [ebp - 4]
call fcn.00405740
mov eax, dword [ebp - 0x2e8]
call fcn.004058b8
push eax
call sub.shell32.dll_SHGetFileInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x1d0]
mov ecx, 0x50
call fcn.00405698
push dword [ebp - 0xc]
push dword [ebp - 0x164]
push 0x463bf0
push dword [ebp - 0x16c]
push dword [ebp - 0x170]
lea eax, [ebp - 0x2ec]
call fcn.00409dc0
push dword [ebp - 0x2ec]
push 0x463bf0
push dword [ebp - 0x10]
push 0x463be4
lea eax, [ebp - 0xc]
mov edx, 7
call fcn.004057bc
lea eax, [ebp - 0x178]
call fcn.0040a43c
mov ebx, eax
test ebx, ebx
je 0x463a40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x463b63
lea eax, [ebp - 0x178]
call fcn.0040a460
push dword [ebp - 8]
push 0x463bfc
push dword [ebp - 0xc]
mov eax, esi
mov edx, 3
call fcn.004057bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463bc8
lea eax, [ebp - 0x2ec]
mov edx, 3
call fcn.0040544c
lea eax, [ebp - 0x178]
mov edx, dword [0x408ad8]
call fcn.00405f94
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040544c
ret
Function at 0x463c00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x463cbc
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 0x41
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405610
lea eax, [ebp - 8]
mov edx, 0x463cd4
call fcn.004056f4
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
call sub.kernel32.dll_GetDriveTypeA
mov esi, eax
cmp esi, 1
jle 0x463c91
push dword [ebp - 4]
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00405610
push dword [ebp - 0xc]
push 0x463cd4
push 0x463ce0
lea eax, [ebp - 0x10]
mov edx, esi
add edx, edx
add edx, edx
add edx, edx
sub edx, esi
add edx, 0x4a1938
call fcn.0040568c
push dword [ebp - 0x10]
push 0x463cec
lea eax, [ebp - 4]
mov edx, 6
call fcn.004057bc
inc ebx
cmp bl, 0x5b
jne 0x463c1e
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.0040547c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463cc3
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040544c
ret

Function at 0x463cf0
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x11
call fcn.00405698
add esp, 0x18
pop ebx
ret

Function at 0x463d60
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x463d94
call sub.user32.dll_FindWindowA
push 0
push 0x463da4
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push 0x463db4
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x463dc4
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x463df8
call sub.user32.dll_FindWindowA
push 0
push 0x463e08
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push 0x463e18
push 0
push eax
call sub.user32.dll_FindWindowExA
push 5
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x463e28
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x463e4c
call sub.user32.dll_FindWindowA
push 0
push 0x463e5c
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x463e6c
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x463e90
call sub.user32.dll_FindWindowA
push 0
push 0x463ea0
push 0
push eax
call sub.user32.dll_FindWindowExA
push 5
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x463eb0
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x463ed4
call sub.user32.dll_FindWindowA
push 0
push 0x463ee4
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x463ef4
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x463f18
call sub.user32.dll_FindWindowA
push 0
push 0x463f28
push 0
push eax
call sub.user32.dll_FindWindowExA
push 5
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x463f38
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x463f54
push 0
push 0
call sub.user32.dll_FindWindowExA
push 0
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x463f5c
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x463f78
push 0
push 0
call sub.user32.dll_FindWindowExA
push 5
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x463f80
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a8
mov eax, dword [ebp - 8]
call fcn.004058a8
xor eax, eax
push ebp
push 0x46403b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.004058b8
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x464020
xor eax, eax
push ebp
push 0x464019
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov ebx, eax
lea eax, [ebp - 0x28]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464020
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464042
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040544c
ret

Function at 0x464048
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a8
mov eax, dword [ebp - 8]
call fcn.004058a8
xor eax, eax
push ebp
push 0x464108
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.004058b8
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4640ed
xor eax, eax
push ebp
push 0x4640e6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
call sub.advapi32.dll_StartServiceA
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4640ed
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46410f
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040544c
ret
Function at 0x464a44
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a8
mov eax, dword [ebp - 8]
call fcn.004058a8
mov eax, dword [ebp - 0xc]
call fcn.004058a8
xor eax, eax
push ebp
push 0x464ba0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409e40
cmp eax, 5
ja case.default.0x464a8a
jmp dword [eax*4 + 0x464a91]
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x464a8a
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x464a8a
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x464a8a
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x464a8a
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
push 0x80000005
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x464a8a
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
mov eax, dword [ebp - 0xc]
call fcn.004058b8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464ba7
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040544c
ret
Function at 0x464bac
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a8
mov eax, dword [ebp - 8]
call fcn.004058a8
xor eax, eax
push ebp
push 0x464cf9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409e40
cmp eax, 5
ja case.default.0x464be7
jmp dword [eax*4 + 0x464bee]
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x464be7
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x464be7
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x464be7
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x464be7
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
push 0x80000005
call sub.advapi32.dll_RegOpenKeyExA_1
jmp case.default.0x464be7
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.004058b8
push eax
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
push 0x464d04
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464d00
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040544c
ret
Function at 0x464d44
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
xor ebx, ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a8
mov eax, dword [ebp - 8]
call fcn.004058a8
mov eax, dword [ebp - 0xc]
call fcn.004058a8
xor eax, eax
push ebp
push 0x464eb2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x464e6e
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x124]
mov eax, dword [0x4a2600]
call fcn.0041676c
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 0x14]
mov ecx, 0x464ec0
call fcn.00407118
mov eax, dword [ebp - 0xc]
call fcn.004058b8
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
mov eax, dword [ebp - 4]
call fcn.004058b8
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
push 5
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
lea eax, [ebp - 0x128]
lea edx, [ebp - 0x11d]
mov ecx, 0x105
call fcn.00405698
push dword [ebp - 0x128]
push 0x464ed8
push dword [ebp - 8]
push 0x464ee4
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004057bc
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
call fcn.00406398
push eax
lea eax, [ebp - 0x12c]
mov edx, dword [ebp - 0x14]
mov ecx, 0x464eec
call fcn.00407118
mov eax, dword [ebp - 0x12c]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464eb9
lea eax, [ebp - 0x12c]
call fcn.004070d4
lea eax, [ebp - 0x128]
call fcn.00405428
lea eax, [ebp - 0x124]
call fcn.004070d4
lea eax, [ebp - 0x14]
call fcn.004070d4
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040544c
ret
Function at 0x464f04
Capabilities:
Get system information on windows

Disassembly:
push ebx
add esp, 0xfffffe68
xor ebx, ebx
push 0
push 0x2c
lea eax, [esp + 0x160]
push eax
push 0
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x46504b
push 0
push 0x20
lea eax, [esp + 0x140]
push eax
push 3
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x46504b
push 0
push 0x138
lea eax, [esp + 8]
push eax
push 2
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x46504b
cmp dword [0x4a1970], 0
jne 0x464f6e
cmp dword [0x4a196c], 0
je 0x46501e
mov eax, dword [esp]
mov edx, dword [esp + 4]
sub eax, dword [0x4a196c]
sbb edx, dword [0x4a1970]
mov dword [esp + 0x184], eax
mov dword [esp + 0x188], edx
fild qword [esp + 0x184]
mov eax, dword [esp + 0x140]
mov edx, dword [esp + 0x144]
sub eax, dword [0x4a1974]
sbb edx, dword [0x4a1978]
mov dword [esp + 0x18c], eax
mov dword [esp + 0x190], edx
fild qword [esp + 0x18c]
fdivp st(1)
fmul dword [0x465058]
movzx eax, byte [esp + 0x180]
mov dword [esp + 0x194], eax
fild dword [esp + 0x194]
fdivp st(1)
fsubr dword [0x465058]
fadd dword [0x46505c]
call fcn.00403450
mov dword [0x4a197c], eax
mov eax, dword [0x4a197c]
xor edx, edx
cmp edx, dword [0x4a1970]
jne 0x465016
cmp eax, dword [0x4a196c]
je 0x46501e
mov ebx, dword [0x4a197c]
mov eax, dword [esp]
mov dword [0x4a196c], eax
mov eax, dword [esp + 4]
mov dword [0x4a1970], eax
mov eax, dword [esp + 0x140]
mov dword [0x4a1974], eax
mov eax, dword [esp + 0x144]
mov dword [0x4a1978], eax
mov eax, ebx
add esp, 0x198
pop ebx
ret
Function at 0x46a638
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x46a666
mov eax, ebx
call fcn.0046b0ec
cmp dword [ebx + 0x40], 0
je 0x46a65f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x46a6d7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x46a6c9
cmp dword [ebx + 8], 0
je 0x46a688
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x46a69a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46a6c9
cmp dword [ebx + 8], 0
je 0x46a67b
cmp eax, 3
je 0x46a6ad
dec eax
jne 0x46a67b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46a67b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x46a67b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x46a6f5
cmp dword [ebx + 0x14], 0xcc
je 0x46a6f5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046a700
pop ebx
ret

Function at 0x47ad90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
movzx eax, bl
cmp eax, 0x5b
jge 0x47adcc
cmp eax, 0x2e
jge 0x47adb4
sub eax, 0x23
je 0x47ae1a
sub eax, 2
je 0x47adfb
sub eax, 6
je 0x47adfb
jmp 0x47ae35
add eax, 0xffffffd2
sub eax, 0xc
jb 0x47adfb
sub eax, 5
je 0x47adfb
dec eax
je 0x47ae1a
dec eax
sub eax, 0x1a
jb 0x47adfb
jmp 0x47ae35
cmp eax, 0xa3
jg 0x47adea
je 0x47adfb
add eax, 0xffffffa5
sub eax, 4
jb 0x47ae1a
dec eax
je 0x47ae1a
add eax, 0xffffffe5
sub eax, 4
jb 0x47ae1a
jmp 0x47ae35
sub eax, 0xa7
je 0x47adfb
sub eax, 9
je 0x47adfb
sub eax, 5
jne 0x47ae35
mov dl, 1
mov al, 0x10
call fcn.0047ad3c
push ebx
call sub.user32.dll_VkKeyScanA
call fcn.0047ad70
xor edx, edx
mov al, 0x10
call fcn.0047ad3c
pop ebx
ret
mov al, 1
call fcn.0047ad58
push ebx
call sub.user32.dll_VkKeyScanA
call fcn.0047ad70
xor eax, eax
call fcn.0047ad58
pop ebx
ret
push ebx
call sub.user32.dll_VkKeyScanA
call fcn.0047ad70
pop ebx
ret

Function at 0x47b448
Capabilities:
Hide graphical window

Disassembly:
push 5
push 0
push 0x47b460
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x47b470
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0
push 0x47b488
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
ret