joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44aca0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44acd8]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44acb9
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44acc8
or bl, 4
test esi, 0x20000000
je 0x44acd3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4513b4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4513c6
add esp, 0xfffffff0
call fcn.004044d8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041fe14
mov eax, dword [0x48adec]
mov dword [eax + 4], ebx
mov dword [eax], 0x451758
mov eax, dword [0x48adf8]
mov dword [eax + 4], ebx
mov dword [eax], 0x451764
mov eax, ebx
call fcn.00451770
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4176ac]
call fcn.00404170
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4176ac]
call fcn.00404170
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4176ac]
call fcn.00404170
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4176ac]
call fcn.00404170
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4176ac]
call fcn.00404170
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44db88
push eax
push 0
push 0
mov eax, dword [0x48af6c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4218cc]
call fcn.00422f8c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4218cc]
call fcn.00422f8c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4218cc]
call fcn.00422f8c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00451be4
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x451aac
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x451aac
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x451aac
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x451503
call fcn.00404530
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45186c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd9c
push ebx
xor edx, edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451a3c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x451a1d
mov dl, 1
mov eax, dword [0x417ac8]
call fcn.00404170
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404fd0
lea eax, [ebp - 0x118]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
mov ebx, eax
call sub.kernel32.dll_GetSystemDefaultLangID
movzx eax, ax
mov dword [ebp - 0x10], eax
dec ebx
test ebx, ebx
jl 0x451a0c
inc ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x118]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.0043f794
test al, al
jne 0x451909
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4519ff
xor edx, edx
push ebp
push 0x4519f8
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x451929
mov ebx, dword [ebp - 0x10]
jmp 0x45192b
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov dword [ebp - 0x260], ebx
mov byte [ebp - 0x25c], 0
lea ecx, [ebp - 0x260]
mov edx, 0x451a4c
lea eax, [ebp - 0x258]
call fcn.0040a948
push eax
push reloc.shell32.dll_SHChangeNotifyRegister
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4519e1
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x451a84
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4519e1
lea eax, [ebp - 0x264]
lea edx, [ebp - 0x218]
mov ecx, 0x100
call fcn.00405240
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4519e1
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x218]
mov ecx, 0x100
call fcn.00405240
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4519ff
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x18], 4
dec dword [ebp - 0x14]
jne 0x4518ea
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041b934
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451a43
lea eax, [ebp - 0x264]
call fcn.00404fd0
ret
Function at 0x452384
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x48cb4c]
cmp byte [eax + 0xa5], 0
jne 0x4523f5
cmp dword [0x48cb64], 0
jne 0x4523b6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x452340
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x48cb64], eax
cmp dword [0x48cb60], 0
jne 0x4523d1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x48cb60], eax
cmp dword [0x48cb68], 0
jne 0x4523f5
push esp
push 0
push 0
push 0x4522e4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x48cb68], eax
pop edx
ret

Function at 0x452a88
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x48cb4c]
cmp dword [eax + 0x30], 0
je 0x452b32
cmp dword [ebx + 0x94], 0
jne 0x452b2c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x452a18
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x452b2c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x452af2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x452b2c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419a84
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x452b01
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x453690
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4536c5
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004050c0
jmp 0x4536d2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405024
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45488c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4548cd
mov eax, esi
call fcn.0043af4c
test al, al
je 0x4548cd
mov eax, dword [ebx + 0x84]
call fcn.0043acec
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4548cd
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043acec
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x457604
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov ebx, edx
mov dword [esp], eax
mov eax, ebp
mov edx, dword [esp]
call fcn.00405024
mov esi, ebx
mov eax, dword [ebp]
call fcn.00405290
test ax, ax
jbe 0x45766f
mov word [esp + 4], ax
mov bx, 1
mov eax, ebp
call fcn.004054e8
movzx edi, bx
mov edx, dword [ebp]
mov dl, byte [edx + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
mov eax, dword [esp]
movzx eax, byte [eax + edi - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec word [esp + 4]
jne 0x457634
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4579b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, esi
mov edx, ebx
call fcn.00405024
mov eax, dword [esi]
call fcn.00405290
test ax, ax
jbe 0x457a18
mov word [esp], ax
mov bx, 1
mov eax, esi
call fcn.004054e8
movzx ebp, bx
mov edx, dword [esi]
mov dl, byte [edx + ebp - 1]
movzx ecx, di
shr ecx, 8
xor dl, cl
mov byte [eax + ebp - 1], dl
mov eax, dword [esi]
movzx eax, byte [eax + ebp - 1]
add di, ax
imul ax, di, 0xce6d
add ax, 0x58bf
mov edi, eax
inc ebx
dec word [esp]
jne 0x4579e0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x45a10c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], 0x100
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45a13d
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x100
call fcn.00405240
jmp 0x45a144
mov eax, ebx
call fcn.00404fd0
add esp, 0x104
pop ebx
ret

Function at 0x45a14c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45a1c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040561c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405490
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x45a1a4
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004054f0
jmp 0x45a1b0
mov eax, ebx
mov edx, 0x45a1dc
call fcn.00405024
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a1cd
lea eax, [ebp - 4]
call fcn.00404fd0
ret
Function at 0x45a6a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov ebx, edx
xor ecx, ecx
push ebp
push 0x45a8ef
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov ecx, eax
cmp ecx, 6
ja case.0x45a6ed.0
jmp dword [ecx*4 + 0x45a6f4]
mov edx, 0x1a
jmp case.0x45a6ed.0
mov edx, 0x1c
jmp case.0x45a6ed.0
mov edx, 0x23
jmp case.0x45a6ed.0
mov edx, 0x2e
jmp case.0x45a6ed.0
mov edx, 5
jmp case.0x45a6ed.0
xor edx, edx
cmp eax, 7
jne 0x45a898
xor eax, eax
push ebp
push 0x45a88c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x118]
call fcn.0045a1e4
mov eax, dword [ebp - 0x118]
mov edx, 0x45a908
call fcn.004053dc
je 0x45a7e2
lea edx, [ebp - 0x11c]
mov eax, 0x45a914
call fcn.00457a78
mov eax, dword [ebp - 0x11c]
call fcn.00405490
push eax
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
lea edx, [ebp - 0x120]
mov eax, 0x45a92c
call fcn.00457a78
mov eax, dword [ebp - 0x120]
call fcn.00405490
push eax
push esi
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea edx, [ebp - 0x130]
mov eax, 0x45a950
call fcn.0045932c
lea eax, [ebp - 0x130]
push eax
call dword [ebp - 0xc]
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004051f8
jmp 0x45a882
lea eax, [ebp - 4]
push eax
push 5
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x111]
call fcn.0040a4c8
mov eax, dword [ebp - 0x134]
mov edx, ebx
call fcn.0040a008
mov edx, dword [ebx]
lea eax, [ebp - 0x138]
mov ecx, 0x45a980
call fcn.004052dc
mov eax, dword [ebp - 0x138]
call fcn.00409c38
test al, al
je 0x45a84c
mov eax, ebx
mov edx, 0x45a980
call fcn.00405298
jmp 0x45a882
mov edx, dword [ebx]
lea eax, [ebp - 0x13c]
mov ecx, 0x45a994
call fcn.004052dc
mov eax, dword [ebp - 0x13c]
call fcn.00409c38
test al, al
je 0x45a87b
mov eax, ebx
mov edx, 0x45a994
call fcn.00405298
jmp 0x45a882
mov eax, ebx
call fcn.00404fd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a8c1
lea eax, [ebp - 4]
push eax
push edx
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x111]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [ebp - 0x111]
call fcn.0040a4c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a8f6
lea eax, [ebp - 0x13c]
mov edx, 3
call fcn.00404ff4
lea eax, [ebp - 0x120]
mov edx, 3
call fcn.00404ff4
ret
Function at 0x45aa70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405480
mov eax, dword [ebp - 8]
call fcn.00405480
lea edi, [ebp - 0x44]
xor eax, eax
push ebp
push 0x45ab6d
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov eax, edi
mov edx, 0x3c
call fcn.00407f2c
mov eax, edi
xor ecx, ecx
mov edx, 0x3c
call fcn.0040372c
mov dword [edi], 0x3c
mov dword [edi + 8], ebx
mov eax, dword [ebp + 8]
mov dword [edi + 0x1c], eax
mov dword [edi + 4], 0x440
mov eax, dword [ebp - 4]
call fcn.00405490
mov dword [edi + 0x10], eax
mov dword [edi + 0x20], ebx
cmp byte [ebp + 0x10], 0
je 0x45ab05
lea edx, [ebp - 0x48]
mov eax, 0x45ab88
call fcn.00457a78
mov eax, dword [ebp - 0x48]
call fcn.00405490
mov dword [edi + 0xc], eax
cmp dword [ebp - 8], 0
je 0x45ab16
mov eax, dword [ebp - 8]
call fcn.00405490
mov dword [edi + 0x14], eax
push edi
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x45ab4a
cmp byte [ebp + 0xc], 0
je 0x45ab47
cmp dword [edi + 0x38], 0
je 0x45ab47
jmp 0x45ab35
push 0xa
call sub.kernel32.dll_Sleep_1
push 0x32
mov eax, dword [edi + 0x38]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x45ab2e
mov esi, dword [edi + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ab74
lea eax, [ebp - 0x48]
call fcn.00404fd0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ff4
ret

Function at 0x45ab90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x45ac0f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x109]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.0040a4c8
push 0x104
mov eax, dword [ebp - 4]
call fcn.00405490
mov ebx, eax
push ebx
push ebx
call sub.kernel32.dll_GetLongPathNameA
mov edx, eax
lea eax, [ebp - 4]
call fcn.0040561c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405024
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ac16
lea eax, [ebp - 4]
call fcn.00404fd0
ret

Function at 0x45ac1c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.0040a4c8
add esp, 0x108
pop ebx
ret

Function at 0x45ac48
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.0040a4c8
add esp, 0x108
pop ebx
ret
Function at 0x45ac74
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405480
mov eax, dword [ebp - 8]
call fcn.00405480
xor eax, eax
push ebp
push 0x45ad1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00409c28
test al, al
je 0x45acd5
mov eax, dword [ebp - 8]
call fcn.00405490
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.004051c8
mov eax, dword [ebp - 0xc]
mov edx, pe_nt_image_headers32
call fcn.00409d58
push 0
mov eax, dword [ebp - 8]
call fcn.00405490
mov ebx, eax
push ebx
mov eax, dword [ebp - 4]
call fcn.00405490
push eax
call sub.kernel32.dll_CopyFileA
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.004051c8
mov eax, dword [ebp - 0x10]
mov edx, esi
call fcn.00409d58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ad26
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404ff4
ret

Function at 0x45ae08
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405480
mov esi, 0x48cc80
xor eax, eax
push ebp
push 0x45aeee
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x45aed3
mov dword [esi], 0x128
xor edx, edx
mov eax, 0xf
call fcn.004557b8
mov dword [0x48cda8], eax
mov edx, esi
mov eax, dword [0x48cda8]
call fcn.004557d8
mov dword [0x48cdac], eax
jmp 0x45aebf
lea eax, [ebp - 0xc]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00405240
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040a0f0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004053dc
jne 0x45aeae
push 0
mov eax, dword [esi + 8]
push eax
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x45aeac
mov bl, 1
jmp 0x45aeae
xor ebx, ebx
mov edx, esi
mov eax, dword [0x48cda8]
call fcn.004557f8
mov dword [0x48cdac], eax
cmp dword [0x48cdac], 0
jne 0x45ae67
mov eax, dword [0x48cda8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45aef5
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ff4
ret

Function at 0x45b46c
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
xor eax, eax
mov dword [esp], eax
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
pop edx
ret
Function at 0x45bbcc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405480
mov eax, dword [ebp - 8]
call fcn.00405480
mov eax, dword [ebp + 8]
call fcn.00405480
xor eax, eax
push ebp
push 0x45bc71
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405490
push eax
push esi
call sub.advapi32.dll_RegCreateKeyA
mov eax, dword [ebp + 8]
call fcn.00405290
push eax
mov eax, dword [ebp + 8]
call fcn.00405490
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00405490
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x45bc45
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bc78
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ff4
lea eax, [ebp + 8]
call fcn.00404fd0
ret

Function at 0x45bc84
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405480
mov eax, dword [ebp - 8]
call fcn.00405480
xor eax, eax
push ebp
push 0x45bd59
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404fd0
lea eax, [ebp - 0x10]
push eax
push 0x20119
push 0
mov eax, dword [ebp - 4]
call fcn.00405490
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405490
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.0040561c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
call fcn.004054e8
push eax
push 0
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45bd2d
mov eax, esi
mov edx, dword [ebp - 0x14]
call fcn.00405024
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bd60
lea eax, [ebp - 0x14]
call fcn.00404fd0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ff4
ret
Function at 0x45bd68
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00405480
mov eax, dword [ebp - 8]
call fcn.00405480
xor eax, eax
push ebp
push 0x45bdf1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
push 0x20106
push 0
mov eax, dword [ebp - 4]
call fcn.00405490
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45bdd6
mov eax, dword [ebp - 8]
call fcn.00405490
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bdf8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ff4
ret