joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cef54
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, eax
xor ebx, ebx
call fcn.004ee4c8
test al, al
je 0x4cf05b
mov eax, dword [esi + 4]
mov edx, dword [0x4cb734]
call fcn.004038cc
test al, al
je 0x4cf05b
mov ebx, dword [esi + 4]
cmp byte [ebx + 0x2f9], 0
je 0x4cefc4
cmp byte [esi + 0x540], 0
jne 0x4cefc4
push 0xffffffffffffffec
mov eax, esi
call fcn.00447064
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, esi
call fcn.00447064
push eax
call sub.user32.dll_SetWindowLongA
jmp 0x4ceffa
cmp byte [ebx + 0x2f9], 0
jne 0x4ceffa
cmp byte [esi + 0x540], 0
je 0x4ceffa
push 0xffffffffffffffec
mov eax, esi
call fcn.00447064
push eax
call sub.user32.dll_GetWindowLongA
and eax, 0xfff7ffff
push eax
push 0xffffffffffffffec
mov eax, esi
call fcn.00447064
push eax
call sub.user32.dll_SetWindowLongA
mov al, byte [ebx + 0x2f9]
mov byte [esi + 0x540], al
mov al, byte [esi + 0x541]
cmp al, byte [ebx + 0x2fb]
je 0x4cf05b
cmp byte [ebx + 0x2f9], 0
je 0x4cf05b
cmp byte [ebx + 0x2fa], 0
je 0x4cf03d
mov eax, esi
call fcn.00447064
xor edx, edx
call fcn.004ee504
mov byte [esi + 0x541], 0
jmp 0x4cf05b
mov eax, esi
call fcn.00447064
mov dl, byte [ebx + 0x2fb]
call fcn.004ee504
mov al, byte [ebx + 0x2fb]
mov byte [esi + 0x541], al
push 0x51
push 0
push 0
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push 0
mov eax, esi
call fcn.00447064
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, esi
call fcn.0044079c
call fcn.004ee4c8
test al, al
je 0x4cf148
test ebx, ebx
je 0x4cf148
cmp byte [ebx + 0x2fa], 0
je 0x4cf148
cmp byte [ebx + 0x2f9], 0
je 0x4cf148
mov eax, dword [0x502264]
mov eax, dword [eax]
call fcn.004601ec
xor edi, edi
xor ebp, ebp
xor eax, eax
mov al, byte [ebx + 0x2fb]
mov ecx, 0xf
xor edx, edx
div ecx
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
jne 0x4cf0e6
mov dword [esp + 8], 1
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, ebp
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4cf107
cmp eax, 5
jbe 0x4cf130
jmp 0x4cf109
jle 0x4cf130
call sub.kernel32.dll_GetTickCount
mov ebp, eax
add edi, dword [esp + 8]
xor eax, eax
mov al, byte [ebx + 0x2fb]
cmp edi, eax
jle 0x4cf122
mov edi, eax
mov eax, esi
call fcn.00447064
mov edx, edi
call fcn.004ee504
mov eax, dword [0x502264]
mov eax, dword [eax]
call fcn.004601ec
xor eax, eax
mov al, byte [ebx + 0x2fb]
cmp edi, eax
jl 0x4cf0e6
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d42c8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d4515
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x3d4], 0
jne 0x4d4356
mov eax, dword [ebx + 0x3d8]
mov edx, dword [eax + 0x3e8]
mov dword [ebx + 0x3e8], edx
mov edx, dword [eax + 0x3ec]
mov dword [ebx + 0x3ec], edx
mov eax, dword [ebx + 0x3d8]
fld qword [eax + 0x3e8]
fcomp dword [0x4d4524]
fnstsw ax
sahf
jne 0x4d4356
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0049e2a8
mov edx, dword [ebp - 0x10]
mov eax, 0x4d4530
call fcn.00404ae4
test eax, eax
je 0x4d4356
call fcn.0040a784
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebx + 0x3d8]
call fcn.004a08d4
lea ecx, [ebp - 0x18]
mov edx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x40]
call fcn.00413bc0
lea edx, [ebp - 0x18]
lea ecx, [ebp - 8]
mov eax, dword [ebx + 0x30]
call fcn.00440394
mov edi, dword [ebp - 4]
mov esi, edi
add esi, dword [ebx + 0x4c]
mov eax, dword [0x5023fc]
mov eax, dword [eax]
call fcn.0045dea4
mov edx, dword [ebx + 0x3d8]
mov edx, dword [edx + 0x4c]
add edx, esi
cmp eax, edx
jge 0x4d43a0
mov eax, dword [ebx + 0x3d8]
mov esi, edi
sub esi, dword [eax + 0x4c]
call fcn.004ee4c8
test al, al
je 0x4d43ec
cmp byte [ebx + 0x3d1], 0
je 0x4d43ec
push 0xffffffffffffffec
mov eax, ebx
call fcn.00447064
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x3d8]
call fcn.00447064
push eax
call sub.user32.dll_SetWindowLongA
mov eax, dword [ebx + 0x3d8]
call fcn.00447064
xor edx, edx
call fcn.004ee504
mov edx, dword [ebx + 0x2d8]
mov eax, dword [ebx + 0x3d8]
mov ecx, dword [eax]
call dword [ecx + 0xd4]
push 0x51
push 0
push 0
push esi
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, dword [ebx + 0x3d8]
call fcn.00447064
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, dword [ebx + 0x3d8]
call fcn.0044079c
cmp byte [ebx + 0x3d1], 0
je 0x4d446d
cmp byte [ebx + 0x3d3], 0
jne 0x4d446d
call fcn.004ee4c8
test al, al
je 0x4d446d
mov eax, dword [0x502264]
mov eax, dword [eax]
call fcn.004601ec
mov eax, dword [ebx + 0x3d8]
call fcn.00447064
mov dl, byte [ebx + 0x3d2]
call fcn.004ee504
jmp 0x4d44ff
cmp byte [ebx + 0x3d3], 0
je 0x4d44ff
cmp byte [ebx + 0x3d1], 0
je 0x4d44ff
call fcn.004ee4c8
test al, al
je 0x4d44ff
mov eax, dword [0x502264]
mov eax, dword [eax]
call fcn.004601ec
xor esi, esi
xor edi, edi
xor eax, eax
mov al, byte [ebx + 0x3d2]
mov ecx, 0xf
xor edx, edx
div ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4d44bd
mov dword [ebp - 0xc], 1
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp eax, 5
jbe 0x4d44f3
call sub.kernel32.dll_GetTickCount
mov edi, eax
add esi, dword [ebp - 0xc]
xor eax, eax
mov al, byte [ebx + 0x3d2]
cmp esi, eax
jle 0x4d44e1
mov esi, eax
mov eax, dword [ebx + 0x3d8]
call fcn.00447064
mov edx, esi
call fcn.004ee504
xor eax, eax
mov al, byte [ebx + 0x3d2]
cmp esi, eax
jl 0x4d44bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d451c
lea eax, [ebp - 0x10]
call fcn.004044e0
ret
Function at 0x4db994
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4dbae4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x350]
test eax, eax
je 0x4dbabc
cmp dword [eax + 0x3f8], 0
je 0x4dbabc
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x2f0]
cmp eax, 0xc8
jbe 0x4dbabc
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x2f0], eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0044087c
mov eax, dword [ebp - 0xc]
call fcn.004047a0
dec eax
jne 0x4dba3c
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0044087c
mov eax, dword [ebp - 0x10]
call fcn.004049a0
push eax
mov eax, ebx
call fcn.004dc5e4
push eax
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.00447064
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
jmp 0x4dba6f
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0044087c
mov eax, dword [ebp - 0x14]
call fcn.004049a0
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.00447064
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
test esi, esi
jl 0x4dbabc
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0044087c
mov edx, esi
mov eax, ebx
call fcn.004dc5f0
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0044087c
mov eax, dword [ebp - 4]
call fcn.004047a0
mov edx, eax
mov eax, ebx
call fcn.004dbc74
mov eax, dword [ebp - 8]
call fcn.004047a0
push eax
mov eax, dword [ebp - 4]
call fcn.004047a0
pop edx
sub edx, eax
mov eax, ebx
call fcn.004dbc90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbaeb
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404504
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404504
ret
Function at 0x4dbaf4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404990
xor eax, eax
push ebp
push 0x4dbc11
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x350]
test eax, eax
je 0x4dbbfb
cmp dword [eax + 0x3f8], 0
je 0x4dbbfb
cmp byte [ebx + 0x2f8], 0
je 0x4dbb7c
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x2f0]
cmp eax, 0x1f4
jb 0x4dbb55
lea eax, [ebx + 0x2f4]
call fcn.004044e0
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x2f0], eax
lea eax, [ebx + 0x2f4]
mov edx, dword [ebp - 4]
call fcn.004047a8
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x2f4]
call fcn.00404578
mov eax, dword [ebp - 4]
call fcn.004047a0
test eax, eax
jle 0x4dbbeb
mov eax, dword [ebp - 4]
call fcn.004047a0
dec eax
jne 0x4dbbc2
mov eax, dword [ebp - 4]
call fcn.004049a0
push eax
mov eax, ebx
call fcn.004dc5e4
push eax
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.00447064
push eax
call sub.user32.dll_SendMessageA
jmp 0x4dbbee
mov eax, dword [ebp - 4]
call fcn.004049a0
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.00447064
push eax
call sub.user32.dll_SendMessageA
jmp 0x4dbbee
or eax, 0xffffffff
test eax, eax
jl 0x4dbbfb
mov edx, eax
mov eax, ebx
call fcn.004dc5f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dbc18
lea eax, [ebp - 4]
call fcn.004044e0
ret
Function at 0x4e8a88
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov eax, dword [edi]
call fcn.004e9764
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
push ebp
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.004e89a8
pop ecx
call fcn.004ee4c8
test al, al
je 0x4e8b30
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
cmp byte [eax + 0x60], 0
je 0x4e8b30
push 0xffffffffffffffec
mov eax, dword [edi]
call fcn.00447064
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, dword [edi]
call fcn.00447064
push eax
call sub.user32.dll_SetWindowLongA
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
cmp byte [eax + 0x61], 0
je 0x4e8b19
mov eax, dword [edi]
call fcn.00447064
xor edx, edx
call fcn.004ee504
jmp 0x4e8b30
mov eax, dword [edi]
call fcn.00447064
mov edx, dword [edi]
mov edx, dword [edx + 0x220]
mov dl, byte [edx + 0x62]
call fcn.004ee504
push 0x51
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [edi]
call fcn.00447064
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, dword [edi]
call fcn.0044079c
mov eax, dword [edi]
mov ebx, dword [eax + 0x220]
cmp byte [ebx + 0x61], 0
je 0x4e8bc9
cmp byte [ebx + 0x60], 0
je 0x4e8bc9
call fcn.004ee4c8
test al, al
je 0x4e8bc9
mov eax, dword [0x502264]
mov eax, dword [eax]
call fcn.004601ec
xor ebx, ebx
xor esi, esi
call sub.kernel32.dll_GetTickCount
sub eax, esi
cmp eax, 5
jbe 0x4e8bb9
call sub.kernel32.dll_GetTickCount
mov esi, eax
add ebx, 0xa
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jle 0x4e8bab
mov ebx, eax
mov eax, dword [edi]
call fcn.00447064
mov edx, ebx
call fcn.004ee504
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jl 0x4e8b83
mov eax, dword [edi]
call fcn.004e9c9c
mov eax, dword [edi]
call fcn.00447064
push eax
call sub.user32.dll_SetCapture
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fbc88
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4fbd32
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
call fcn.004fbbfc
mov eax, dword [ebp - 0x1c]
mov edx, 0x4fbd48
call fcn.004048ec
jne 0x4fbd13
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x14]
push eax
push 0x4fbd5c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x4fbd02
mov dword [ebp - 0xc], 2
mov dword [ebp - 0x18], 1
lea eax, [ebp - 4]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
call sub.advapi32.dll_InitiateSystemShutdownA
jmp 0x4fbd1c
push 0
push 0x1d
call sub.user32.dll_ExitWindowsEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fbd39
lea eax, [ebp - 0x1c]
call fcn.004044e0
ret

Function at 0x4fbd70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404990
xor eax, eax
push ebp
push 0x4fbeeb
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.00463cd8
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00463cf8
mov ebx, eax
jmp 0x4fbebd
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404750
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040928c
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004085f8
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004085f8
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004048ec
je 0x4fbe94
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404750
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004085f8
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004085f8
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004048ec
jne 0x4fbeae
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00463d18
mov ebx, eax
test ebx, ebx
jne 0x4fbdef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fbef2
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404504
lea eax, [ebp - 4]
call fcn.004044e0
ret
Function at 0x4fcd70
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004072c8
ret

Function at 0x4fce98
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404990
xor eax, eax
push ebp
push 0x4fcfe6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.004fcd70
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004049a0
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4fcfc5
xor eax, eax
push ebp
push 0x4fcfbe
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4fcfa7
xor eax, eax
push ebp
push 0x4fcfa0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4fcf89
xor eax, eax
push ebp
push 0x4fcf82
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.004fcda4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fcf89
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fcfa7
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fcfc5
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.004fce24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fcfed
lea eax, [ebp - 4]
call fcn.004044e0
ret
Function at 0x4fd288
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
test dl, dl
je 0x4fd2a2
add esp, 0xfffffff0
call fcn.00403a6c
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00404990
xor eax, eax
push ebp
push 0x4fd374
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 4]
mov edx, dword [ebp - 8]
call fcn.00404534
lea eax, [ebx + 4]
call fcn.004049f0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx + 4]
call fcn.004049a0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
mov dword [ebx + 0x10], esi
test esi, esi
je 0x4fd335
mov eax, esi
call fcn.00402a40
mov edi, eax
mov dword [ebx + 0xc], edi
push edi
mov eax, dword [ebx + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 4]
call fcn.004049a0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4fd335
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4fd39c
mov eax, dword [ebx + 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4fd335
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x14], eax
lea edx, [ebp - 0x28]
mov eax, dword [ebx + 4]
call fcn.004fce98
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x18]
call fcn.004fcff4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 8]
call fcn.00404534
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd37b
lea eax, [ebp - 0x18]
call fcn.004044e0
lea eax, [ebp - 8]
call fcn.004044e0
ret

Function at 0x4fdb7c
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
push esp
push 0xf00ff
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4fdba3
mov eax, dword [0x502264]
mov eax, dword [eax]
call fcn.00460494
lea eax, [esp + 0xc]
push eax
push 0x4fdc18
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4fdbf9
mov eax, dword [0x502264]
mov eax, dword [eax]
call fcn.00460494
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x4fdc11
mov eax, dword [0x502264]
mov eax, dword [eax]
call fcn.00460494
add esp, 0x18
pop ebx
ret
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x4038fa
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fa], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404658], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045ec], eax
mov dword [0x4040f2], eax
mov dword [0x4045d8], 0x30
mov dword [0x4045dc], 2
jmp 0x40393f
mov dword [0x4045e0], 0x403153
mov dword [0x4045e4], 0
mov dword [0x4045e8], 0
mov dword [0x404600], 0x40454e
mov dword [0x4045f8], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045f0], eax
mov dword [0x404604], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045f4], eax
push 0x4045d8
fadd dword [ebp + 0x40]
add bh, bh
adc eax, sym.imp.user32.dll_RegisterClassExA
push 0
push dword [0x4040f2]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push 0x40454e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404650], eax
push 5
push dword [0x404650]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404650]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404608]
jmp 0x403a13
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a05
mov eax, dword [0x404610]
jmp 0x403a2e
call 0x402bd5
ret