joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409c40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push ebx
push 0
push 0
push eax
push 0x400
push dword [ebp + 8]
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ebx, eax
test ebx, ebx
je 0x409d02
cmp byte [0x53ff77], 0
push esi
je 0x409cbb
push edi
push 1
call fcn.004c9b1f
mov edi, eax
push edi
push 0x3c
call fcn.004c9e26
add esp, 0xc
mov esi, 0x4fc46c
mov ecx, 0x65
push edi
push ecx
call fcn.004c9e26
movzx eax, word [esi + 2]
lea esi, [esi + 2]
add esp, 8
mov ecx, eax
test ax, ax
jne 0x409c97
push edi
push 0x3e
call fcn.004c9e26
add esp, 8
pop edi
mov esi, dword [ebp - 4]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
lea ecx, [ebp - 8]
push ecx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp byte [0x53ff77], 0
pop esi
je 0x409cf9
push 0
push 0x4fc46c
push 1
call fcn.004c9b1f
add esp, 4
push eax
call fcn.00413c20
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415050
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x4150c3
mov eax, dword [ebp - 4]
push ebx
inc eax
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
lea ebx, [eax*2 + 2]
push ebx
push dword [edi]
call fcn.004c8ca5
add esp, 8
mov dword [edi], eax
test eax, eax
je 0x4150b0
push ebx
push 0
push eax
call fcn.004c52c0
add esp, 0xc
push dword [ebp - 4]
push dword [edi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4151a0
Capabilities:
Enumerate pe sections

Disassembly:
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4151d5
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4151bc
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4151cd
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4151d7
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4151b2
xor eax, eax
pop edi
pop esi
ret

Function at 0x415390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ax, word [edi + 6]
cmp ax, bx
jbe 0x4153b4
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x4153ae
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x41539f
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0041515a
invalid
Function at 0x425330
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f37f7
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x21c], ebx
call fcn.004c52c0
mov ecx, dword [0x53ffd8]
add esp, 0xc
test ecx, ecx
jne 0x42539b
lea eax, [ebp - 0x218]
push eax
push ecx
push ecx
push 0x1c
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x4253ea
add ecx, 0x418
lea edx, [ebp - 0x218]
sub edx, ecx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4253b0
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4253d0
mov ecx, 7
mov esi, 0x501e18
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4253f3
mov ecx, 0x14
mov esi, 0x501e38
rep movsd dword es:[edi], dword [esi]
push 0xc
call fcn.004c3423
mov esi, eax
add esp, 4
mov dword [ebp - 0x21c], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x42544b
lea eax, [ebp - 0x218]
mov dword [esi + 4], 0
push eax
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x425478
jmp 0x42544d
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], esi
test esi, esi
je 0x425482
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push 0x8007000e
call fcn.004c2e60
push 0x8007000e
call fcn.004c2e60
int3
Function at 0x4467c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f59d5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x53ba20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.004464d0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x446853
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x15555555
je 0x4469a1
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.004c3423
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x504470]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x504470]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x446943
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call fcn.004d7e00
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.004c3b50
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x446925
cmp ebx, 0x200
jae 0x446923
shl ebx, 3
cmp ebx, ecx
jae 0x446925
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.0044c0b0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004464d0
mov edx, dword [eax]
jmp 0x446946
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x446971
mov dword [ecx + eax*8], esi
jmp 0x446980
cmp edi, edx
jne 0x44697a
mov dword [ecx + eax*8], esi
jmp 0x446984
cmp dword [ecx + eax*8 + 4], ebx
jne 0x446984
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x504420
call fcn.004c17da
int3
Function at 0x454d70
Capabilities:
Create thread

Disassembly:
push 0x5509a4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0x405c30
call fcn.004d5fba
add esp, 0xc
ret

Function at 0x456820
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
push eax
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
push eax
push 0x456650
push 0
push 0
call fcn.004d6048
add esp, 0x18
mov esi, eax
push 0x3a98
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x45687c
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x5b4
pop esi
mov esp, ebp
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x457680
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x434], eax
push edi
mov byte [ebp - 0x42d], 0
mov dword [eax], esi
nop dword [eax]
push ebx
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0x18
je 0x4576b0
cmp edi, 0xffffffff
je 0x45784a
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x42c], 0x428
push eax
push edi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x457711
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x45784c
pop edi
movzx eax, ax
pop esi
or eax, 0x80070000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x40c]
push 0x50ce00
push eax
call fcn.004c5729
add esp, 8
test eax, eax
je 0x457736
mov bl, 1
mov byte [ebp - 0x42d], bl
jmp 0x45781e
lea eax, [ebp - 0x40c]
push 0x50ce14
push eax
call fcn.004c9380
add esp, 8
test eax, eax
je 0x457782
lea eax, [ebp - 0x40c]
push 0x50ce24
push eax
call fcn.004c9380
add esp, 8
test eax, eax
je 0x457782
lea eax, [ebp - 0x40c]
push 0x50ce40
push eax
call fcn.004c9380
add esp, 8
test eax, eax
jne 0x457818
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004c5688
add esp, 8
test eax, eax
je 0x457818
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004c5688
add esp, 8
test eax, eax
je 0x457818
lea edx, [eax + 2]
mov ecx, edx
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4577c0
sub ecx, ebx
sar ecx, 1
cmp ecx, 4
jb 0x457818
movzx ecx, word [edx + 2]
cmp ecx, 0x31
jne 0x4577f7
movzx eax, word [edx + 6]
mov edx, eax
cmp eax, 0x30
jne 0x4577ed
or esi, 1
jmp 0x457818
cmp edx, 0x31
jne 0x4577f7
or esi, 2
jmp 0x457818
cmp ecx, 0x32
jne 0x457801
or esi, 4
jmp 0x457818
cmp ecx, 0x34
je 0x457815
cmp ecx, 0x35
je 0x457815
cmp ecx, 0x36
je 0x457815
cmp ecx, 0x37
jne 0x457818
or esi, 8
mov bl, byte [ebp - 0x42d]
lea eax, [ebp - 0x42c]
push eax
push edi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x457711
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x45784a
test esi, esi
je 0x45784a
mov eax, dword [ebp - 0x434]
mov dword [eax], esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c3287
mov esp, ebp
pop ebp
ret
Function at 0x45b0b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
test eax, eax
jne 0x45b0e2
mov esi, 0x50d130
mov ebx, 0x50d148
jmp 0x45b0f5
cmp eax, 1
jne 0x45b238
mov esi, 0x50d164
mov ebx, 0x50d17c
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0x20019
push 0
push 0x50d190
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45b238
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push ebx
push dword [ebp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call ebx
push dword [ebp + 8]
test eax, eax
je 0x45b153
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocStringLen
call ebx
test eax, eax
jne 0x45b238
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c393e
add esp, 4
mov dword [edi + 8], eax
lea ecx, [ebp - 4]
push ecx
push eax
push 0
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocStringLen
call ebx
test eax, eax
jne 0x45b1cc
mov eax, dword [edi]
xor ecx, ecx
inc eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c393e
mov ecx, eax
add esp, 4
mov dword [edi + 4], ecx
test ecx, ecx
jne 0x45b1e2
push dword [edi + 8]
call fcn.004c3453
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
lea eax, [eax*4 + 4]
push eax
push 0
push ecx
call fcn.004c52c0
mov esi, dword [edi + 8]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
test ebx, ebx
je 0x45b238
push esi
call fcn.004d5d1b
add esp, 4
cmp eax, dword [edi]
ja 0x45b238
mov ecx, dword [edi + 4]
lea esi, [esi + ebx*2]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esi, 2
push esi
mov dword [ecx + eax*4], esi
call ebx
lea esi, [esi + eax*2]
add esi, 2
push esi
call ebx
mov ebx, eax
test ebx, ebx
jne 0x45b207
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x45b4a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x50d214
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x45b512
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x50d224
push dword [ebp + 0xc]
mov esi, eax
lea eax, [ebp - 4]
push eax
call fcn.004c9dab
add esp, 0xc
test eax, eax
jne 0x45b512
push dword [ebp - 4]
push edi
push 1
push esi
call fcn.004d8f47
push dword [ebp - 4]
call fcn.004d8c52
add esp, 0x14
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x470c90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
xorps xmm0, xmm0
push esi
mov esi, dword [ebp + 8]
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
push edi
cmp esi, 0x65
jne 0x470cc9
mov edi, dword [0x555ecc]
jmp 0x470ce5
cmp esi, 0x66
jne 0x470cd6
mov edi, dword [0x555ed0]
jmp 0x470ce5
cmp esi, 0x68
jne 0x470de1
mov edi, dword [0x555ed4]
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x470de1
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0x104b
push edi
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x3c], 4
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x470de1
cmp esi, 0x65
jne 0x470d52
mov esi, dword [ebp - 0x1c]
mov ecx, dword [0x550f38]
push esi
push dword [esi + 0x24]
call fcn.00475c10
push esi
call fcn.004a81f0
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 0x66
jne 0x470d6b
push dword [ebp - 0x1c]
push edi
call fcn.004a7f10
add esp, 8
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 0x68
jne 0x470de1
mov ecx, dword [ebp - 0x1c]
test byte [ecx + 0xd4], 8
je 0x470d9c
push 0x10
push 0x502f28
push 0x50e930
push dword [0x555ecc]
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ecx + 0xe0], 0
jne 0x470dc5
push 0x10
push 0x4fc6f4
push 0x50e99c
push dword [0x555ec8]
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
lock inc dword [ecx + 0x20]
mov eax, dword [0x538dd8]
push ecx
push 0
push 0x4a8210
mov dword [ecx + 0x24], eax
call fcn.004d5fba
add esp, 0xc
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x475690
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x538444], 0
jne 0x4756bc
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push ebx
xor bl, bl
cmp dword [0x5559ec], 0
je 0x47573d
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004c52c0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x5559ec]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x47573d
mov eax, 0x50f160
lea ecx, [ebp - 0x20c]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x47572b
test dx, dx
je 0x475727
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x47572b
add ecx, 4
add eax, 4
test dx, dx
jne 0x475705
xor eax, eax
jmp 0x475730
sbb eax, eax
or eax, 1
test eax, eax
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004c3287
mov esp, ebp
pop ebp
ret
Function at 0x477dd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x477e28
cmp esi, 1
je 0x477e28
cmp esi, 0xffffffff
je 0x477df2
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
mov ecx, dword [edi + 0x50]
lea ebx, [edi + 0x50]
cmp ecx, 0xffffffff
je 0x477e64
xor eax, eax
test ecx, ecx
push 5
sete al
lea eax, [eax*4 + 4]
push dword [eax + edi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, edi
mov dword [ebx], esi
call fcn.00465f40
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4
push dword [edi + esi*4 + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x477e44
push 5
push dword [edi + esi*4 + 4]
call ebx
xor eax, eax
test esi, esi
push 0
sete al
lea eax, [eax*4 + 4]
push dword [eax + edi]
call ebx
cmp dword [edi + 0x28], esi
je 0x477e61
mov dword [edi + 0x28], esi
lea ebx, [edi + 0x50]
mov ecx, edi
mov dword [ebx], esi
call fcn.00465f40
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4

Function at 0x477fa0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x35c
pop ebp
jmp fcn.00465400
Function at 0x478c70
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push esi
push eax
xor esi, esi
push esi
push esi
push esi
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x478ce6
push edi
push dword [ebp - 4]
call fcn.004c8c9a
add esp, 4
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
push esi
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x478cdc
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
push eax
push edi
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x478cdc
add eax, eax
push eax
call fcn.004c8c9a
add esp, 4
mov esi, eax
push dword [ebp - 4]
push esi
push edi
call ebx
push edi
call fcn.004c8c7f
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4797b0
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x410
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004c52c0
lea eax, [ebp - 0x414]
push 0x208
push eax
call fcn.00478bb0
add esp, 0x14
cmp dword [0x5509ec], 1
jl 0x47980d
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
call fcn.00478040
add esp, 8
mov esi, eax
jmp 0x4798be
lea eax, [ebp - 0x418]
push eax
push 2
push 0
push 0x50f818
push reloc.ACLUI.dll_CreateSecurityPage
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4798c2
cmp byte [ebp + 8], al
je 0x479897
push 0x50f8d0
lea eax, [ebp - 0x414]
push 0x208
push eax
call fcn.004d6277
lea ecx, [ebp - 0x414]
add esp, 0xc
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x479860
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push 0x4fc6f4
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x4798b2
push 0x4fc6f4
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
xor eax, eax
cmp esi, 2
cmove esi, eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4798de
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [0x555ec8]
push 0x50f8d8
call fcn.004aad00
add esp, 8
test esi, esi
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop esi
call fcn.004c3287
mov esp, ebp
pop ebp
ret

Function at 0x4799e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x479a09
push ebx
push 0x104
push dword [ebp + 0x14]
call fcn.004c905a
add esp, 0xc
mov al, 1
pop ebx
pop ebp
ret
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x479a10
mov ebx, dword [ebp + 0x10]
sub ecx, edx
sar ecx, 1
add ebx, 2
add ebx, ecx
push esi
push edi
lea eax, [ebx + ebx]
push eax
call fcn.004c8c9a
mov edi, dword [ebp + 0xc]
add esp, 4
mov esi, eax
test edi, edi
je 0x479a9d
nop
cmp word [edi], 0
je 0x479a9d
push edi
push ebx
push esi
call fcn.004c905a
push 0x3b
push esi
call fcn.004c55d8
add esp, 0x14
test eax, eax
je 0x479a62
xor ecx, ecx
mov word [eax], cx
push 0x4fbdfc
push ebx
push esi
call fcn.004d6277
push dword [ebp + 8]
push ebx
push esi
call fcn.004d6277
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x479ab1
push 0x3b
push edi
call fcn.004c55d8
mov edi, eax
add esp, 8
test edi, edi
je 0x479a9d
add edi, 2
jne 0x479a40
push 2
push esi
xor bl, bl
call fcn.004c3279
add esp, 8
mov al, bl
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
push 0x104
push dword [ebp + 0x14]
call fcn.004c905a
add esp, 0xc
mov bl, 1
push 2
push esi
call fcn.004c3279
add esp, 8
mov al, bl
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x479ae0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004c38f0
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
je 0x479bd1
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetParent]
lea eax, [ebp - 0x1004]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x1004], eax
jne 0x479ba7
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x479b45
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x479ba7
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x479b6f
lea eax, [ebp - 0x1000]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [ebp - 0xfdc]
sub eax, dword [ebp - 0xfe4]
cmp eax, 1
jle 0x479ba7
push 0x7e8
lea eax, [ebp - 0xfd4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x479ba7
push esi
mov edi, esi
call ebx
test eax, eax
je 0x479bbe
push esi
call ebx
push eax
call ebx
test eax, eax
jne 0x479ba7
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x479bbe
push 0
push 0
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
jne 0x479b16
pop ebx
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004c3287
mov esp, ebp
pop ebp
ret