joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1028eb95
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.1008de31
mov eax, dword [ebp + 8]
call fcn.1008abc9
xor eax, eax
push ebp
push 0x60b669
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
call fcn.1028d229
test al, al
je 0x1028ecc4
xor eax, eax
push ebp
push 0x60b635
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.1008ddbd
push eax
push 0x60b680
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax]
cmp dword [ebp - 8], 0
je 0x1028ecac
xor eax, eax
push ebp
push 0x60b624
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x45d898]
call fcn.100ea9d5
mov ebx, eax
mov edx, dword [ebp + 0xc]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, edi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x30]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.100bb9ed
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, ebx
call fcn.100eb2f5
call fcn.100e56bd
push eax
push esi
push 0
push 0
push 1
push 1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov edx, dword [ebp + 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60b62b
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 8]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1028ecc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60b670
lea eax, [ebp - 8]
call fcn.1008ddbd
lea eax, [ebp - 4]
call fcn.1008ddbd
lea eax, [ebp + 8]
call fcn.1008abd1
ret
Function at 0x7ffe5330
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
add al, 4
sub al, 4
and al, 0xff
add al, 4
sub al, 4
push eax
pop eax
pushf
popf
inc esi
dec esi
xor eax, ecx
xor eax, ecx
inc esi
dec esi
push bx
inc esp
inc esp
and al, 0xff
pushf
popf
push es
pop ds
add al, 4
sub al, 4
add al, 0
xor eax, ecx
xor eax, ecx
push eax
pop eax
xor eax, ecx
xor eax, ecx
push es
pop ds
push bx
inc esp
inc esp
inc esi
dec esi
not eax
not eax
inc esi
dec esi
xor eax, ecx
xor eax, ecx
push es
pop ds
xor eax, ecx
xor eax, ecx
push es
pop ds
pushf
popf
add al, 0
add al, 4
sub al, 4
inc esi
dec esi
pushf
popf
add al, 0
add al, 4
sub al, 4
inc esi
dec esi
not eax
not eax
push es
pop ds
push bx
inc esp
inc esp
and al, 0xff
add al, 4
sub al, 4
add al, 0
xor eax, ecx
xor eax, ecx
add al, 0
xor eax, ecx
xor eax, ecx
and al, 0xff
push bx
inc esp
inc esp
push es
pop ds
not eax
not eax
push eax
pop eax
push bx
inc esp
inc esp
push eax
pop eax
add al, 4
sub al, 4
push es
pop ds
push bx
inc esp
inc esp
inc esi
dec esi
add al, 4
sub al, 4
push eax
pop eax
clc
inc esi
dec esi
call 0x7ffe53e6
pop edx
xor dx, dx
push bx
inc esp
inc esp
push eax
pop eax
clc
add edx, 0xd5e0
push es
pop ds
add al, 4
sub al, 4
xor ecx, ecx
inc esi
dec esi
cld
push es
pop ds
mov cl, 0x1e
xor eax, ecx
xor eax, ecx
push es
pop ds
pushf
popf
xor byte [ecx + edx], 0x53
loop 0x7ffe5410
stc
push eax
pop eax
push dword fs:[0x24]
push es
pop ds
pop dword [edx + 0xa]
nop
mov cl, 0xff
add al, 0
xor eax, ecx
xor eax, ecx
push eax
pop eax
push edx
loop 0x7ffe5430
not eax
not eax
and al, 0xff
cld
inc esi
dec esi
mov dword [edx + 0x11], 0xffffacbb
add al, 4
sub al, 4
and al, 0xff
push es
pop ds
mov ecx, dword [eax + 0x2c]
add al, 0
push bx
inc esp
inc esp
stc
mov dword [edx + 0x1b], ecx
add al, 4
sub al, 4
inc esi
dec esi
not eax
not eax
add al, 0
mov dword [edx + 0x100], ecx
add al, 4
sub al, 4
push eax
pop eax
add al, 4
sub al, 4
cld
mov dword [eax + 0x2c], esp
add al, 4
sub al, 4
inc esi
dec esi
push 0
add al, 4
sub al, 4
nop
push 0
pushf
popf
push 0
clc
push 0
push 0x30
push bx
inc esp
inc esp
nop
inc esi
dec esi
push 0x20
inc esi
dec esi
push bx
inc esp
inc esp
and al, 0xff
pushf
popf
push 0
push eax
pop eax
add al, 4
sub al, 4
inc esi
dec esi
cld
push es
pop ds
push 0
add edx, 0xffff7f2b
add eax, 0
push edx
and al, 0xff
and al, 0xff
push edx
add al, 0
not eax
not eax
cld
push 0
call dword [edx + 0x8218]
add al, 4
sub al, 4
clc
push es
pop ds
add esp, 0x3f8
add al, 0
pushf
popf
and al, 0xff
xor eax, eax
add al, 4
sub al, 4
clc
push es
pop ds
inc eax
add al, 0
add al, 4
sub al, 4
and al, 0xff
push es
pop ds
ret 0xc
Function at 0x7ffe8354
Capabilities:
Encode data using xor

Disassembly:
and al, 0xff
cld
inc esi
dec esi
pop eax
xor eax, ecx
xor eax, ecx
add eax, 0x1d
push es
pop ds
pushf
popf
clc
mov byte [eax], 5
add al, 4
sub al, 4
inc esi
dec esi
call 0x7ffe8354
stc
add eax, 5
mov ecx, eax
and bh, 0xff
call 0x7ffe8319
and al, 0xff
pop eax
and al, 0xff
inc esi
dec esi
stc
add eax, 0x19
push bx
inc esp
inc esp
mov byte [eax], 5
add al, 0
pushf
popf
clc
call fcn.7ffe84d6
xor eax, ecx
xor eax, ecx
push eax
pop eax
add eax, 5
cld
xchg ecx, eax
sub ecx, eax
and al, 0xff
stc
xor byte [eax + ecx], 0x67
push eax
pop eax
loop 0x7ffe8347
push bx
inc esp
inc esp
cld
pop ecx
invalid
Function at 0x407adb
Capabilities:
Get common file path

Disassembly:
jmp 0x4a92d0
push 0xffffffffffffffff
push 0x783738
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x158]
mov dword fs:[0], eax
mov ebp, ecx
xor ebx, ebx
mov ecx, 7
mov esi, str.KeepMyFamilySecureProxy.log
lea edi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
lea eax, [esp + 0x50]
push eax
push 0x104
mov dword [esp + 0x168], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x50]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4a9350
sub eax, edx
push eax
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.00405920
lea eax, [esp + 0x34]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4a9370
sub eax, edx
push eax
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x20]
call fcn.004021c6
push 0x38
call fcn.005645f4
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x160], 1
cmp eax, ebx
je 0x4a93ab
mov ecx, eax
call fcn.0054c3f0
jmp 0x4a93ad
xor eax, eax
push 1
mov ecx, eax
mov byte [esp + 0x164], bl
mov dword [ebp + 0x10], eax
call fcn.00549860
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x18]
push eax
call fcn.0054c540
cmp dword [esp + 0x30], 0x10
jb 0x4a93e1
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00564155
add esp, 4
mov ecx, dword [esp + 0x158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.00564b24
add esp, 0x150
ret

Function at 0x407d0b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x417410
adc eax, sym.imp.KERNEL32.dll_GetProcessHeap

Function at 0x407d6a
Capabilities:
Set registry value

Disassembly:
jmp 0x4cdf30
push ecx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 4], ecx
test ebp, ebp
jne 0x4cdf46
lea eax, [ebp + 0xd]
pop ebp
pop ecx
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x4cdf53
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8
Function at 0x407d83
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x4cb620
push edi
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x4cb633
push 0x80004005
call fcn.004025ae
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
lea eax, [esp + 0x1c]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test esi, esi
je 0x4cb69a
mov ecx, dword [edi]
test ecx, ecx
jbe 0x4cb697
mov edx, dword [esp + 0x14]
test edx, edx
jbe 0x4cb692
cmp edx, 2
jbe 0x4cb68b
cmp edx, 7
jne 0x4cb692
cmp ecx, 1
jb 0x4cb692
cmp byte [ecx + esi - 1], 0
jne 0x4cb692
cmp ecx, 1
jbe 0x4cb69a
cmp byte [ecx + esi - 2], 0
jmp 0x4cb690
cmp byte [ecx + esi - 1], 0
je 0x4cb69a
mov eax, 0xd
mov byte [esi], 0
pop esi
pop edi
ret 0xc
Function at 0x417319
Capabilities:
Access peb ldr_data
Get process heap flags
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push ebx
push ebp
sub esp, 0x18
mov ecx, dword fs:[0x30]
mov eax, dword [ecx + 0xc]
add eax, 0xc
mov edx, dword [eax]
cmp edx, eax
je 0x41763d
mov eax, dword [edx + 0x30]
mov edx, dword [edx + 0x18]
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [0x852604]
mov ebp, dword [ecx + 0xc]
add ebp, 0xc
mov edx, dword [ebp]
cmp edx, ebp
je 0x4173a4
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
jmp 0x417344

Function at 0x424ea0
Capabilities:
Get common file path

Disassembly:
jmp 0x424ea0
push 0xffffffffffffffff
push 0x7780f8
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x13c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x14c]
push 0x104
lea eax, [esp + 0x38]
xor ebx, ebx
push eax
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x34]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x424f00
mov cx, word [0x7ad5a0]
mov word [edi], cx
lea edi, [esp + 0x34]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x424f17
mov ecx, 7
mov esi, str.KeepMyFamilySecureProxy.ini
lea eax, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x424f42
sub eax, edx
push eax
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x1c]
call fcn.00405920
lea eax, [esp + 0x14]
push eax
push ebp
mov dword [esp + 0x14c], ebx
call fcn.00406bef
add esp, 8
cmp dword [esp + 0x2c], 0x10
jb 0x424f83
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00564155
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x13c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.00564b24
add esp, 0x134
ret 4
Function at 0x478870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x478870
push 0xffffffffffffffff
push 0x77f5a4
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esi + 4]
mov dword [esi], vtable.CLocalClientParentalControl.4.0
mov dword [esi + 0x30], vtable.CLocalClientParentalControl.3.0
mov dword [esi + method.CLocalClientParentalControl.2.virtual_0], vtable.CLocalClientParentalControl.2.0
mov dword [esi + 0x4f8], 0x7b1828
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 4], vtable.CLocalClientParentalControl.0
cmp dword [esi + 0x1760], 0x10
mov dword [esp + 0x18], 2
jb 0x4788e8
mov eax, dword [esi + 0x174c]
push eax
call fcn.00564155
add esp, 4
xor ebx, ebx
mov dword [esi + 0x1760], 0xf
mov dword [esi + 0x175c], ebx
mov byte [esi + 0x174c], bl
mov eax, dword [esi + 0x1734]
cmp eax, ebx
je 0x478913
push eax
call fcn.00564155
add esp, 4
mov eax, dword [esi + 0x1728]
push eax
mov dword [esi + 0x1734], ebx
mov dword [esi + 0x1738], ebx
mov dword [esi + 0x173c], ebx
call fcn.00564155
add esp, 4
lea ecx, [esi + 0x11d4]
call fcn.004081bb
lea ecx, [esi + 0x1050]
mov byte [esp + 0x18], 1
call fcn.0040498f
lea ecx, [esi + 0xecc]
mov byte [esp + 0x18], bl
call fcn.0040498f
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.00403080
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4a7cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x783400
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x856918]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
xor esi, esi
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], esi
call fcn.00556aa0
mov byte [ebp - 4], 1
mov edi, edi
cmp esi, 9
jae 0x4a7d4b
lea eax, [esi + esi*8]
mov edx, dword [ebx + eax*4 + 4]
mov edx, dword [edx]
lea ecx, [ebx + eax*4 + 4]
lea eax, [ebp - 0x54]
push eax
call edx
inc esi
jmp 0x4a7d30
push 0x18
mov edi, 0xf
push 0x7b38b8
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.00405920
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.00556910
lea ecx, [ebp - 0x54]
mov esi, eax
call fcn.005568f0
lea ecx, [ebp - 0x14]
push ecx
push esi
push eax
lea edx, [ebp - 0x30]
push edx
mov ecx, ebx
call fcn.00406613
cmp dword [ebp - 0x18], 0x10
mov ebx, eax
jb 0x4a7da8
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00564155
add esp, 4
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
jb 0x4a7dc4
mov eax, dword [eax + 4]
jmp 0x4a7dc7
add eax, 4
push 0x7b38d4
push eax
call fcn.00564ed0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4a7dfc
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], al
call fcn.00556a10
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x14]
push esi
push edi
push 1
push ebx
call fcn.00564d88
cmp eax, edi
push ebx
sete byte [ebp + 0xb]
call fcn.00565caa
push esi
call fcn.00564baa
add esp, 0x18
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0
call fcn.00556a10
mov al, byte [ebp + 0xb]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a7e50
Capabilities:
Get common file path

Disassembly:
jmp 0x4a7e50
sub esp, 0x210
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x20c], eax
xor eax, eax
push ebp
mov ebp, dword [esp + 0x218]
mov dword [esp + 4], 0
mov word [esp + 8], ax
push 0x104
cmp byte [esp + 0x220], al
jne 0x4a7e96
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x4a7ee8
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 8]
add eax, 0xfffffffe
jmp 0x4a7eb0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4a7eb0
mov ecx, dword [str.SysWOW64]
mov edx, dword [0x7b3904]
mov dword [eax], ecx
mov ecx, dword [0x7b3908]
mov dword [eax + 4], edx
mov edx, dword [0x7b390c]
mov dword [eax + 8], ecx
mov ecx, dword [0x7b3910]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
push esi
push edi
lea edi, [esp + 0x10]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4a7ef1
mov edx, dword [0x7b3914]
mov dword [edi], edx
lea edi, [esp + 0x10]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4a7f10
mov ecx, 0xf
mov esi, 0x7b3918
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
mov dword [ebp + 0x18], 7
mov dword [ebp + 0x14], 0
mov word [ebp + 4], ax
lea eax, [esp + 0x10]
pop edi
lea edx, [eax + 2]
pop esi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a7f47
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, ebp
call fcn.00405ef2
mov ecx, dword [esp + 0x210]
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.00564b24
add esp, 0x210
ret 8
Function at 0x4bad90
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x4bad90
push 0xffffffffffffffff
push 0x785208
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
call fcn.004074d7
xor ecx, ecx
mov esi, 0xf
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], ecx
mov byte [esp + 0xc], cl
mov dword [esp + 0x30], ecx
cmp eax, 0xe
ja case.default.0x4bade4
jmp dword [eax*4 + 0x4baeb4]
push str.Windows_95
jmp 0x4bae52
push str.Windows_98
jmp 0x4bae52
push str.Windows_ME
jmp 0x4bae52
push str.Windows_NT
jmp 0x4bae52
push str.Windows_2000
jmp 0x4bae52
push str.Windows_XP
jmp 0x4bae52
push str.Windows_2003
jmp 0x4bae52
push str.Windows_Vista
jmp 0x4bae52
push str.Windows_2008
jmp 0x4bae52
push str.Windows_2008R2
jmp 0x4bae52
push str.Windows_7
jmp 0x4bae52
push str.Windows_8
jmp 0x4bae52
push str.Windows_2012
jmp 0x4bae52
push str.Other
jmp 0x4bae52
push str.Error_getting_OS_type
lea ecx, [esp + 0xc]
call fcn.00401b1d
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
cmp esi, 0x10
jae 0x4bae6c
lea eax, [esp + 0xc]
mov ecx, dword [esp + 0x1c]
inc ecx
push ecx
push eax
push 0x868a30
call fcn.00564f70
add esp, 0xc
cmp esi, 0x10
jb 0x4bae92
mov edx, dword [esp + 0xc]
push edx
call fcn.00564155
add esp, 4
mov eax, 0x868a30
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00564b24
add esp, 0x2c
ret

Function at 0x4c38d0
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x4c38d0
push 0xffffffffffffffff
push 0x78573e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov ecx, 0xf
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov byte [esi + 4], al
mov dword [esi + 0x34], ecx
mov dword [esi + 0x30], eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x20], al
mov dword [esi + 0x38], 5
mov dword [esi + 0x54], 7
mov dword [esi + 0x50], eax
mov word [esi + 0x40], ax
lea ecx, [esi + 0x58]
mov byte [esp + 0x14], 2
call fcn.0040771b
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x56e636
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0056bc3b
and dword [ebp - 4], 0
cmp dword [0x86a23c], 0
mov ebx, eax
jne 0x56e6e7
push 0x7c42e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x56e798
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
test eax, eax
je 0x56e798
push eax
call fcn.0056bbc9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x86a23c], eax
call esi
push eax
call fcn.0056bbc9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x86a240], eax
call esi
push eax
call fcn.0056bbc9
mov dword [esp], str.GetUserObjectInformationW
push edi
mov dword [0x86a244], eax
call esi
push eax
call fcn.0056bbc9
pop ecx
mov dword [0x86a24c], eax
test eax, eax
je 0x56e6e7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0056bbc9
pop ecx
mov dword [0x86a248], eax
mov eax, dword [0x86a248]
cmp eax, ebx
je 0x56e73f
cmp dword [0x86a24c], ebx
je 0x56e73f
push eax
call fcn.0056bc44
push dword [0x86a24c]
mov esi, eax
call fcn.0056bc44
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x56e73f
test edi, edi
je 0x56e73f
call esi
test eax, eax
je 0x56e736
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x56e736
test byte [ebp - 0xc], 1
jne 0x56e73f
or dword [ebp + 0x10], 0x200000
jmp 0x56e778
mov eax, dword [0x86a240]
cmp eax, ebx
je 0x56e778
push eax
call fcn.0056bc44
pop ecx
test eax, eax
je 0x56e778
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x56e778
mov eax, dword [0x86a244]
cmp eax, ebx
je 0x56e778
push eax
call fcn.0056bc44
pop ecx
test eax, eax
je 0x56e778
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x86a23c]
call fcn.0056bc44
pop ecx
test eax, eax
je 0x56e798
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x56e79a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x584001
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0056bc3b
and dword [ebp - 4], 0
cmp dword [0x86a8a8], 0
mov ebx, eax
jne 0x5840b2
push 0x7c561c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x584163
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x584163
push eax
call fcn.0056bbc9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x86a8a8], eax
call esi
push eax
call fcn.0056bbc9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x86a8ac], eax
call esi
push eax
call fcn.0056bbc9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x86a8b0], eax
call esi
push eax
call fcn.0056bbc9
pop ecx
mov dword [0x86a8b8], eax
test eax, eax
je 0x5840b2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0056bbc9
pop ecx
mov dword [0x86a8b4], eax
mov eax, dword [0x86a8b4]
cmp eax, ebx
je 0x58410a
cmp dword [0x86a8b8], ebx
je 0x58410a
push eax
call fcn.0056bc44
push dword [0x86a8b8]
mov esi, eax
call fcn.0056bc44
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x58410a
test edi, edi
je 0x58410a
call esi
test eax, eax
je 0x584101
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x584101
test byte [ebp - 0xc], 1
jne 0x58410a
or dword [ebp + 0x10], 0x200000
jmp 0x584143
mov eax, dword [0x86a8ac]
cmp eax, ebx
je 0x584143
push eax
call fcn.0056bc44
pop ecx
test eax, eax
je 0x584143
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x584143
mov eax, dword [0x86a8b0]
cmp eax, ebx
je 0x584143
push eax
call fcn.0056bc44
pop ecx
test eax, eax
je 0x584143
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x86a8a8]
call fcn.0056bc44
pop ecx
test eax, eax
je 0x584163
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x584165
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret