joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45616b
Capabilities:
Encode data using base64
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x1120], 2
jl 0x4561ab
mov eax, dword [esp + 0xc]
cmp dword [esi + 0x1118], eax
jne 0x4561ab
mov dword [esi + 0xe20], 0
xorps xmm0, xmm0
movups xmmword [esi + 0xe2c], xmm0
push esi
call fcn.0044d6d0
add esp, 4
cmp dword [esi + 0xe20], 2
jne 0x4561ad
pop esi
ret
mov ecx, esi
pop esi
jmp fcn.004529ae

Function at 0x45b0f7
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [0x4c1074]
xor edx, esp
mov dword [esp + 0x10], edx
xor edx, edx
xor esi, esi
dec esi
movsx ebx, byte [ecx + edx]
mov eax, ebx
add al, 0xbf
cmp al, 0x19
ja 0x45b128
add ebx, 0xffffffbf
jmp 0x45b165
mov eax, ebx
add al, 0x9f
cmp al, 0x19
ja 0x45b135
add ebx, 0xffffffb9
jmp 0x45b165
mov eax, ebx
add al, 0xd0
cmp al, 9
ja 0x45b142
add ebx, 4
jmp 0x45b165
cmp bl, 0x2b
je 0x45b15c
cmp bl, 0x3d
je 0x45b163
cmp bl, 0x2f
jne 0x45b1da
mov ebx, 0x3f
jmp 0x45b165
mov ebx, 0x3e
jmp 0x45b165
mov ebx, esi
mov dword [esp + edx*4], ebx
inc edx
cmp edx, 4
jne 0x45b117
mov ebx, dword [esp]
xor esi, esi
cmp ebx, 0xffffffff
je 0x45b1dc
mov edi, dword [esp + 4]
cmp edi, 0xffffffff
je 0x45b1dc
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
cmp ecx, 0xffffffff
je 0x45b1cd
mov esi, 2
mov eax, edx
and eax, ecx
shl ebx, 0x12
shl edi, 0xc
or ebx, edi
shl ecx, 6
shr ebx, 0x10
mov byte [ebp], bl
cmp eax, 0xffffffff
je 0x45b1b9
mov eax, ecx
and eax, 0xf00
or eax, edi
mov byte [ebp + 1], ah
cmp edx, 0xffffffff
je 0x45b1dc
and edx, 0x3f
or edx, ecx
mov byte [ebp + 2], dl
mov esi, 3
jmp 0x45b1dc
cmp edx, 0xffffffff
jne 0x45b1dc
xor esi, esi
inc esi
xor edx, edx
dec edx
jmp 0x45b193
xor esi, esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00475526
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x45b479
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x45b4b1
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
xor edi, edi
xor edx, edx
mov bl, byte [ecx + edi]
xor bl, byte [esi + edi]
movzx ebx, bl
or edx, ebx
inc edi
cmp eax, edi
jne 0x45b490
mov eax, 0x100
sub eax, edx
cmp eax, 0xff
seta al
jmp 0x45b4b3
mov al, 1
pop esi
pop edi
pop ebx
ret
Function at 0x460ed9
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4c1cfc]
test eax, eax
jne 0x460f0e
push 0
push 0x460f16
push dword [esp + 0xc]
push 0x6e
push dword [0x4c2224]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x4c1cfc], eax
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4c1cfc]
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
ret

Function at 0x461b78
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
sub esp, 0x98
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x94], eax
cmp dword [0x4c2214], 0
je 0x461ba8
xor ebx, ebx
cmp dword [0x4c2208], 0
setne bl
jmp 0x461ccb
lea esi, [esp + 4]
push 0x90
push 0
push esi
call fcn.00478b20
add esp, 0xc
mov dword [esi - 4], 0x94
mov esi, esp
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [esi + 0x10], 2
sete al
mov dword [0x4c2218], eax
push str.USER32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x461c95
mov esi, eax
push 0x4a999f
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c21f8], eax
test eax, eax
je 0x461c95
push str.MonitorFromWindow
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c21fc], eax
test eax, eax
je 0x461c95
push str.MonitorFromRect
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c2200], eax
test eax, eax
je 0x461c95
push str.MonitorFromPoint
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c2204], eax
test eax, eax
je 0x461c95
push str.EnumDisplayMonitors
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c220c], eax
test eax, eax
je 0x461c95
push str.GetMonitorInfoA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c2208], eax
test eax, eax
je 0x461c95
push str.EnumDisplayDevicesA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c2210], eax
test eax, eax
je 0x461c95
mov dword [0x4c2214], 1
xor ebx, ebx
inc ebx
jmp 0x461ccb
xor ebx, ebx
mov dword [0x4c21f8], ebx
mov dword [0x4c21fc], ebx
mov dword [0x4c2200], ebx
mov dword [0x4c2204], ebx
mov dword [0x4c2208], ebx
mov dword [0x4c220c], ebx
mov dword [0x4c2210], ebx
mov dword [0x4c2214], 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00475526
mov eax, ebx
add esp, 0x98
pop esi
pop ebx
ret
Function at 0x466456
Capabilities:
Get geographical location

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 4], eax
push 2
push dword [0x4c2228]
call fcn.004031fd
add esp, 8
push eax
call fcn.0041b25f
add esp, 4
test eax, eax
je 0x4665a1
mov esi, eax
mov eax, dword [0x4c105c]
xor edi, edi
inc edi
mov ebp, 0x4c105c
push edi
push ebp
call dword [eax + 0x44]
add esp, 8
push 8
push dword [0x4c2228]
call fcn.0040315d
add esp, 8
mov ebx, eax
push 7
push dword [0x4c2228]
call fcn.0040315d
add esp, 8
mov bh, al
push edi
push dword [0x4c2228]
call fcn.004031fd
add esp, 8
mov edi, eax
push 0
push dword [0x4c2228]
call fcn.00403342
add esp, 8
movzx ecx, bl
movzx edx, bh
mov ebx, esp
push ecx
push edx
push ebx
push edi
push eax
push dword [0x4c2228]
push dword [0x4c2d6c]
push 0x4c2dc4
push ebp
push esi
call dword [esi]
add esp, 0x28
test eax, eax
jne 0x4665d6
push dword [esp]
push dword [0x4c2d68]
call fcn.0044f916
add esp, 8
push dword [esp]
call fcn.00411645
add esp, 4
push dword [0x4c2dc4]
push dword [0x4c2d68]
call fcn.00450695
add esp, 8
push 0x4c105c
push dword [0x4c2dc4]
push dword [0x4c2d68]
push dword [0x4c2228]
call fcn.0040ef88
add esp, 0x10
mov dword [0x4c2dc8], eax
xor esi, esi
mov edi, 0x40
mov ebx, dword [sym.imp.USER32.dll_DeleteMenu]
push esi
push edi
push dword [0x4c2d88]
call ebx
push esi
push edi
push dword [0x4c2d8c]
call ebx
mov byte [0x4c2dc0], 0
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00475526
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [0x497058]
push str._s_Internal_Error
call fcn.0045abe5
add esp, 8
mov esi, eax
push 0x30
push eax
push str.Unsupported_protocol_number_found
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.00411645
add esp, 4
push 1
call fcn.004629df
mov edi, eax
push dword [0x497058]
push str._s_Error
call fcn.0045abe5
add esp, 8
mov esi, eax
push dword [0x4c2228]
call fcn.00413677
add esp, 4
push edi
push eax
push str.Unable_to_open_connection_to_n_s_n_s
call fcn.0045abe5
add esp, 0xc
mov ebx, eax
push edi
call fcn.00411645
add esp, 4
xor edi, edi
push 0x10
push esi
push ebx
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.00411645
add esp, 4
push ebx
call fcn.00411645
add esp, 4
push edi
call fcn.0048098d

Function at 0x46663a
Capabilities:
Get geographical location

Disassembly:
push esi
sub esp, 0x18
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x14], eax
movzx eax, cx
mov esi, esp
push 0x14
push esi
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push esi
call fcn.00482f24
add esp, 4
mov dword [0x4c3408], eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00475526
add esp, 0x18
pop esi
ret
Function at 0x466712
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
cmp dword [esp + 0x14], 2
jne 0x4667c8
mov ebp, dword [esp + 0x1c]
lea eax, [ebp + 1]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x4667c8
mov esi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4667c8
mov edi, eax
mov bl, byte [esp + 0x20]
push ebp
push dword [esp + 0x1c]
push eax
call fcn.00478020
add esp, 0xc
mov byte [edi + ebp], 0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test bl, bl
jne 0x466781
push 0
push 1
push 0x8002
push dword [0x4c1058]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x4c1058]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4667a8
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4667af
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test bl, bl
jne 0x4667c8
xor eax, eax
push eax
push eax
push 0x8002
push dword [0x4c1058]
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46a369
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
sub esp, 0x104
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x100], eax
mov eax, esp
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46a39e
cmp byte [esp + 0x12], 0
js 0x46a3a2
mov bl, byte [esp + 0xa5]
shr bl, 7
jmp 0x46a3a4
xor ebx, ebx
jmp 0x46a3a4
mov bl, 1
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00475526
mov eax, ebx
add esp, 0x104
pop ebx
ret
Function at 0x46b0d8
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [esp + 0x1c]
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 4], eax
xor edi, edi
push edi
push 0x1028
push 1
call fcn.004115d0
add esp, 0xc
mov esi, eax
mov dword [eax], edi
lea ebx, [eax + 4]
mov dword [eax + 4], ebp
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
call ebp
mov dword [esi + 8], eax
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
call ebp
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x1024], eax
mov byte [esi + 0x12], 0
mov word [esi + 0x10], 0
mov eax, dword [esp + 0x24]
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x18], eax
mov eax, dword [0x4c348c]
test eax, eax
jne 0x46b16b
push 0x421110
call fcn.004597d4
add esp, 4
mov dword [0x4c348c], eax
push esi
push eax
call fcn.0045986c
add esp, 8
mov eax, esp
push eax
push edi
push ebx
push 0x46b1a0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [esi + 0x13], 1
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00475526
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x46b2dc
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [esp + 0x1c]
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 4], eax
xor edi, edi
xor ebx, ebx
inc ebx
push edi
push 0x1028
push ebx
call fcn.004115d0
add esp, 0xc
mov esi, eax
mov dword [eax], ebx
lea ebx, [eax + 4]
mov dword [eax + 4], ebp
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
call ebp
mov dword [esi + 8], eax
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
call ebp
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
mov eax, dword [esp + 0x24]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x2c]
push eax
call fcn.0045b1f1
add esp, 4
mov dword [esi + 0x40], edi
mov eax, dword [esp + 0x20]
mov dword [esi + 0x44], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x18], eax
mov eax, dword [0x4c348c]
test eax, eax
jne 0x46b376
push 0x421110
call fcn.004597d4
add esp, 4
mov dword [0x4c348c], eax
push esi
push eax
call fcn.0045986c
add esp, 8
mov eax, esp
push eax
push edi
push ebx
push 0x46b3a7
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00475526
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46b961
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
cmp byte [0x4c3498], 0
jne 0x46ba41
mov byte [0x4c3498], 1
push str.hhctrl.ocx
call fcn.0046caa4
add esp, 4
mov esi, eax
test eax, eax
je 0x46b9ef
push str.HtmlHelpA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c349c], eax
test eax, eax
je 0x46b9f9
cmp byte [0x4c34ad], 0
jne 0x46ba02
mov byte [0x4c34ad], 1
call fcn.0046b92c
test eax, eax
je 0x46ba02
push dword [0x4c3494]
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x4c34b0], eax
test eax, eax
je 0x46ba02
push dword [0x4c3494]
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x46ba02
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x4c34a8], eax
jmp 0x46ba07
mov dword [0x4c349c], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x46ba41
mov eax, dword [0x4c34a8]
test eax, eax
jne 0x46ba41
mov bl, 1
mov eax, 0x4a19e8
push 0
push dword [eax]
push 0x80000002
call fcn.0046d011
add esp, 0xc
test eax, eax
jne 0x46ba35
test bl, 1
je 0x46ba41
mov eax, 0x4a19ec
xor ebx, ebx
jmp 0x46ba12
mov dword [0x4c34a0], eax
mov byte [0x4c34a4], 0
pop esi
pop ebx
ret

Function at 0x46ba44
Capabilities:
Delete file

Disassembly:
sub esp, 0x10
mov eax, dword [0x4c34a0]
test eax, eax
je 0x46ba85
cmp byte [0x4c34a4], 1
jne 0x46ba87
movaps xmm0, xmmword [0x4a19f0]
movups xmmword [esp], xmm0
call dword [0x4c349c]
sub esp, 0x10
mov eax, dword [0x4c34a0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 4
mov eax, dword [0x4c34a0]
jmp 0x46ba87
xor eax, eax
mov dword [esp], eax
call fcn.00411645
mov dword [0x4c34a0], 0
mov byte [0x4c34a4], 0
add esp, 0x10
ret
Function at 0x46bab3
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x114
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [0x4c34a0]
test eax, eax
jne 0x46bc27
cmp dword [0x4c34a8], 0
je 0x46bc27
xor esi, esi
cmp byte [0x4c34b4], 0
jne 0x46bc19
mov byte [0x4c34b4], 1
lea edi, [esp + 0xa]
push edi
push 0x106
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x46bc19
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
xor ebp, ebp
push ebp
push ebp
push eax
push edi
push str._sputty__lu__llu.chm
call fcn.0045abe5
add esp, 0x14
mov esi, eax
sub esp, 0x1c
mov dword [esp + 0x18], ebp
movaps xmm0, xmmword [0x4a1a00]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x46bbc3
mov dword [esp], ebx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x46bc19
push esi
call fcn.00411645
add esp, 4
add ebx, 1
adc ebp, 0
push ebp
push ebx
push dword [esp + 8]
lea eax, [esp + 0x16]
push eax
push str._sputty__lu__llu.chm
call fcn.0045abe5
add esp, 0x14
mov esi, eax
sub esp, 0x1c
movaps xmm0, xmmword [0x4a1a00]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x46bb5e
mov edi, eax
mov eax, dword [0x4c34b0]
test eax, eax
je 0x46bc08
mov ebx, dword [0x4c34a8]
xor ebp, ebp
sub eax, ebp
xor edx, edx
mov dword [esp + 4], edx
lea ecx, [ebx + ebp]
push edx
lea edx, [esp + 8]
push edx
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46bc91
mov eax, dword [esp + 4]
add ebp, eax
inc ebp
mov eax, dword [0x4c34b0]
cmp eax, ebp
ja 0x46bbd6
mov dword [0x4c34a0], esi
mov byte [0x4c34a4], 1
xor esi, esi
jmp 0x46bc98
push esi
call fcn.00411645
add esp, 4
mov eax, dword [0x4c34a0]
test eax, eax
je 0x46bc78
mov ecx, dword [esp + 0x12c]
mov edi, dword [esp + 0x128]
test ecx, ecx
je 0x46bc65
push ecx
push eax
push str._s::__s.html_main
call fcn.0045abe5
add esp, 0xc
mov esi, eax
xor eax, eax
push eax
push eax
push esi
push edi
call dword [0x4c349c]
push esi
call fcn.00411645
add esp, 4
jmp 0x46bc71
xor ecx, ecx
push ecx
push ecx
push eax
push edi
call dword [0x4c349c]
mov byte [0x4c34ac], 1
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00475526
add esp, 0x114
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.00411645
add esp, 4
cmp edi, 0xffffffff
je 0x46bc22
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46bc22

Function at 0x46bcb6
Capabilities:
Delete file

Disassembly:
sub esp, 0x10
cmp byte [0x4c34ac], 1
jne 0x46bcd6
movaps xmm0, xmmword [0x4a19f0]
movups xmmword [esp], xmm0
call dword [0x4c349c]
sub esp, 0x10
mov eax, dword [0x4c34a0]
test eax, eax
je 0x46bcf5
cmp byte [0x4c34a4], 1
jne 0x46bcf5
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
ret
add esp, 0x10
ret
Function at 0x46c999
Capabilities:
Get session user name

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 4], eax
cmp byte [0x4c3ccc], 0
je 0x46c9bb
mov ecx, dword [0x4c3cc8]
jmp 0x46c9fa
push str.secur32.dll
call fcn.0046caa4
add esp, 4
mov esi, eax
push str.sspicli.dll
call fcn.0046caa4
add esp, 4
test esi, esi
je 0x46c9eb
push str.GetUserNameExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x46c9ed
xor ecx, ecx
mov dword [0x4c3cc8], ecx
mov byte [0x4c3ccc], 1
test ecx, ecx
je 0x46ca47
xor esi, esi
mov edi, esp
mov dword [edi], esi
mov ebx, 8
push edi
push esi
push ebx
call ecx
push esi
push 1
push dword [edi]
call fcn.004115d0
add esp, 0xc
mov esi, eax
push edi
push eax
push ebx
call dword [0x4c3cc8]
test al, al
je 0x46ca3e
push 0x40
push esi
call fcn.00478c80
add esp, 8
test eax, eax
je 0x46ca90
mov byte [eax], 0
jmp 0x46ca90
push esi
call fcn.00411645
add esp, 4
xor eax, eax
mov edi, esp
mov dword [edi], eax
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x46ca5e
mov eax, dword [esp]
jmp 0x46ca6a
mov dword [esp], 0x100
mov eax, 0x100
push 0
push 1
push eax
call fcn.004115d0
add esp, 0xc
mov esi, eax
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x46ca90
push esi
call fcn.00411645
add esp, 4
xor esi, esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00475526
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x46caa4
Capabilities:
Get common file path

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
cmp dword [0x4c3cec], 0
jne 0x46cb01
push dword [0x4c3cf0]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, dword [0x4c3cf0]
jb 0x46cb01
xor edi, edi
inc edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
push edi
push eax
push edi
push 0x4c3cf0
push dword [0x4c3cec]
call fcn.00411651
add esp, 0x18
mov dword [0x4c3cec], eax
push dword [0x4c3cf0]
push eax
call ebx
cmp eax, dword [0x4c3cf0]
jae 0x46cad3
push 0
push esi
push 0x4b0026
push dword [0x4c3cec]
call fcn.0045ac65
add esp, 0x10
mov esi, eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push esi
call fcn.00411645
add esp, 4
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x46d011
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [0x4c1074]
xor ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
test ebx, ebx
je 0x46d054
lea ecx, [esp + 0xc]
push ecx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
xor edi, edi
mov esi, 0
test eax, eax
jne 0x46d0d6
mov eax, dword [esp + 0xc]
lea ecx, [esp + 4]
xor esi, esi
lea ebp, [esp + 8]
push ecx
push esi
push ebp
push esi
push dword [esp + 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46d0c6
cmp dword [esp + 8], 1
mov edi, 0
jne 0x46d0c8
mov eax, dword [esp + 4]
inc eax
xor esi, esi
push esi
push 1
push eax
call fcn.004115d0
add esp, 0xc
mov edi, eax
mov eax, dword [esp + 4]
mov ecx, esp
mov dword [ecx], eax
push ecx
push edi
push ebp
push esi
push dword [esp + 0x40]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46d0c8
cmp dword [esp + 8], 1
jne 0x46d0c8
mov eax, dword [esp]
cmp eax, dword [esp + 4]
ja 0x46d0c8
mov byte [edi + eax], 0
mov esi, edi
xor edi, edi
test ebx, ebx
je 0x46d0d6
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.00411645
add esp, 4
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00475526
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46f3cf
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x270
mov edi, dword [esp + 0x284]
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x26c], eax
lea esi, [esp + 0x25]
push 0x107
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call fcn.004855c0
add esp, 4
mov word [esp + eax + 0x25], 0x2a5c
mov byte [esp + eax + 0x27], 0
lea ebx, [esp + 0x12c]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x46f449
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x140
push ebx
call edi
add esp, 8
push ebx
push esi
call ebp
test eax, eax
jne 0x46f42f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, esp
mov dword [ecx], eax
push 4
push ecx
call edi
add esp, 8
lea esi, [esp + 5]
push 0x20
push esi
call fcn.0046f2c0
add esp, 8
test al, al
je 0x46f484
mov ebx, 0x20
push ebx
push esi
call edi
add esp, 8
push ebx
push esi
call fcn.0046d0f4
add esp, 8
push edi
call fcn.0047207e
add esp, 4
mov ecx, dword [esp + 0x26c]
xor ecx, esp
call fcn.00475526
add esp, 0x270
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x46f4a6
Capabilities:
Get memory capacity

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x50], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea edi, [esp + 0x2c]
mov dword [edi], eax
mov esi, 4
push esi
push edi
push 9
call fcn.00442e74
add esp, 0xc
call dword [sym.imp.USER32.dll_GetCapture]
mov dword [edi], eax
push esi
push edi
push 0xa
call fcn.00442e74
add esp, 0xc
call dword [sym.imp.USER32.dll_GetClipboardOwner]
mov dword [edi], eax
push esi
push edi
push 0xb
call fcn.00442e74
add esp, 0xc
push 0x1cbf
call dword [sym.imp.USER32.dll_GetQueueStatus]
lea ecx, [esp + 0x28]
mov dword [ecx], eax
push esi
push ecx
push 0xc
call fcn.00442e74
add esp, 0xc
lea esi, [esp + 0x20]
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
push esi
push 0xd
call fcn.00442e74
add esp, 0xc
mov edi, esp
push edi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, 0x20
push eax
push edi
push 6
call fcn.00442e74
add esp, 0xc
lea ebx, [esp + 0x48]
lea ebp, [esp + 0x40]
lea esi, [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea edi, [esp + 0x30]
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov eax, 0x20
push eax
push edi
push 0xe
call fcn.00442e74
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov eax, 0x20
push eax
push edi
push 0xf
call fcn.00442e74
add esp, 0xc
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00475526
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret