joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462634
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x4626d3
cmp dword [ebx + 0x94], 0
jne 0x4626cd
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4625bc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4626cd
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x462693
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4626cd
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419eb4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4626a2
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4628ec
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4cdcd4]
cmp dword [eax + 0x30], 0
je 0x462a49
test bl, bl
jne 0x46299a
cmp dword [esi + 0x9c], 0
jne 0x46298f
mov eax, esi
call fcn.00465100
push eax
push 0x462818
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x462960
mov eax, dword [0x4cdcd4]
call fcn.004657e0
test al, al
je 0x462960
mov eax, dword [0x4cdcf8]
call fcn.004063c4
mov edi, eax
cmp edi, 0
jl 0x462960
push 0
mov eax, dword [0x4cdcf8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x46294a
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x46298f
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00419eb4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x46296f
inc dword [esi + 0x9c]
jmp 0x462a49
cmp dword [esi + 0x9c], 0
jle 0x462a49
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x462a49
cmp dword [esi + 0x44], 0
je 0x4629f5
mov eax, dword [0x4cdcd4]
call fcn.004657e0
test al, al
je 0x4629f5
mov eax, dword [0x4cdcf8]
call fcn.004063c4
mov edi, eax
cmp edi, 0
jl 0x4629f5
push 5
mov eax, dword [0x4cdcf8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4629df
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x462a24
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00419eb4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x462a04
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x4cdcf8
mov ecx, 1
mov edx, dword [0x4627f8]
call fcn.00406578
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4634dc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x463546
mov eax, ebx
call fcn.004657e0
test al, al
jne 0x463546
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004051f8
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x463533
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x463553
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040515c
jmp 0x463553
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040515c
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x464904
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x464972
mov eax, esi
call fcn.0044df48
test al, al
je 0x464972
mov eax, dword [ebx + 0x84]
call fcn.0044db98
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x464972
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x464966
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044db98
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00445b20
jmp 0x464972
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00464740
pop esi
pop ebx
ret

Function at 0x4748b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x474966
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.00405598
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x474950
lea eax, [ebp - 4]
mov edx, edi
call fcn.00405828
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.00405598
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x474950
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x474978
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x474950
cmp dword [ebp - 0xc], 0x34
jne 0x474950
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47496d
lea eax, [ebp - 4]
call fcn.00405108
ret
Function at 0x477f68
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x477fcc
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00405378
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.00409b14
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477fd3
lea eax, [ebp - 0xc]
call fcn.00405108
ret

Function at 0x4788ac
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4788c1
add esp, 0xfffffff0
call fcn.00404510
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.004041bc
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.0040515c
mov eax, esi
call fcn.00405598
push eax
movzx eax, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateMutexA
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x478915
mov ecx, dword [0x4c808c]
mov dl, 1
mov eax, dword [0x478694]
call fcn.0047113c
call fcn.00404a60
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x47893c
call fcn.00404568
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4794d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4795a4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004051a0
lea eax, [ebp - 4]
call fcn.004055f0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405598
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x47958e
mov eax, ebx
call fcn.00402efc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x479587
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405598
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x479571
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4795b4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x479571
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47958e
mov eax, dword [ebp - 0x10]
call fcn.00402f18
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4795ab
lea eax, [ebp - 4]
call fcn.00405108
ret
Function at 0x47d444
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x47d472
mov eax, ebx
call fcn.0047def8
cmp dword [ebx + 0x40], 0
je 0x47d46b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x47d4e3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x47d4d5
cmp dword [ebx + 8], 0
je 0x47d494
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x47d4a6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47d4d5
cmp dword [ebx + 8], 0
je 0x47d487
cmp eax, 3
je 0x47d4b9
dec eax
jne 0x47d487
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47d487
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x47d487
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x47d501
cmp dword [ebx + 0x14], 0xcc
je 0x47d501
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047d50c
pop ebx
ret

Function at 0x494534
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x4945a7
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
test al, al
je 0x494591
lea ecx, [ebp - 4]
lea edx, [ebp - 0xc]
call fcn.00494394
cmp dword [ebp - 0xc], 0
je 0x494586
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00408298
test al, al
je 0x494591
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x494591
mov eax, dword [ebp - 4]
call fcn.0049448c
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4945ae
lea eax, [ebp - 4]
call fcn.00405108
ret

Function at 0x494648
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x494702
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
jne 0x494671
mov eax, ebx
call fcn.00405108
jmp 0x4946ec
mov ecx, ebx
lea edx, [ebp - 8]
call fcn.00494394
cmp dword [ebp - 8], 0
je 0x4946ec
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.0040828c
test al, al
je 0x4946e5
xor eax, eax
push ebp
push 0x4946de
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004945b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4946ec
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
call fcn.0040828c
test al, al
je 0x4946dd
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
mov eax, ebx
call fcn.00405108
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494709
lea eax, [ebp - 4]
call fcn.00406c68
ret
Function at 0x4b3248
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4b32a2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004b3238
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004b0e90
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004b09a8
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b32a9
lea eax, [ebp - 4]
call fcn.00405108
ret
Function at 0x4bb680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov esi, eax
lea edi, [ebp - 6]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xc], edx
xor eax, eax
push ebp
push 0x4bb77d
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00403354
mov eax, pe_nt_image_headers32
call fcn.0040337c
mov byte [ebp - 0x1c], al
mov eax, pe_nt_image_headers32
call fcn.0040337c
add al, 0x57
mov byte [ebp - 0x1b], al
xor ebx, ebx
lea eax, [ebp - 6]
movzx edx, byte [eax]
mov ecx, edx
xor cl, byte [ebp - 0x1c]
lea esi, [ebx + 2]
mov byte [ebp + esi - 0x1c], cl
xor dl, byte [ebp - 0x1b]
lea ecx, [ebx + 8]
mov byte [ebp + ecx - 0x1c], dl
inc ebx
inc eax
cmp ebx, 6
jne 0x4bb6d0
mov eax, pe_nt_image_headers32
call fcn.0040337c
add al, 0x11
mov byte [ebp - 0xe], al
mov eax, pe_nt_image_headers32
call fcn.0040337c
sub al, 0xc3
mov byte [ebp - 0xd], al
mov ebx, 0x10
mov eax, 0x4c77f0
lea edx, [ebp - 0x1c]
movzx ecx, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4bb71b
mov eax, dword [ebp - 0xc]
call fcn.00405108
mov ebx, 0x10
lea esi, [ebp - 0x1c]
lea ecx, [ebp - 0x24]
movzx eax, byte [esi]
mov edx, 2
call fcn.00409ab0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004093a0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.004053d4
mov eax, dword [ebp - 0xc]
inc esi
dec ebx
jne 0x4bb735
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb784
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040512c
ret

Function at 0x4bb78c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405588
xor eax, eax
push ebp
push 0x4bb82c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xe]
call fcn.004bb3f8
lea edx, [ebp - 8]
lea eax, [ebp - 0xe]
call fcn.004bb680
push 5
push 0
push 0
push 0x4bb840
push dword [ebp - 4]
push 0x4bb870
push dword [ebp - 8]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.0040549c
mov eax, dword [ebp - 0x18]
call fcn.00405598
push eax
push 0x4bb878
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb833
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0040512c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040512c
ret
Function at 0x4bbef8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405588
xor eax, eax
push ebp
push 0x4bc079
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.00465d04
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00465d24
mov ebx, eax
jmp 0x4bc045
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00405378
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a0ec
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409318
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409318
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405530
je 0x4bc01c
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00405378
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409318
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409318
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00405530
jne 0x4bc036
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00465d44
mov ebx, eax
test ebx, ebx
jne 0x4bbf77
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc080
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040512c
lea eax, [ebp - 4]
call fcn.00405108
ret

Function at 0x4bc23c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
push esp
push 0x3ff
call sub.kernel32.dll_GetTempPathA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004051f8
add esp, 0x400
pop ebx
ret
Function at 0x4bce38
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
mov dword [ebp - 0x94], 0x94
mov bl, 1
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4bce68
cmp dword [ebp - 0x90], 6
setae bl
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bce70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405588
xor eax, eax
push ebp
push 0x4bcf9b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004bce38
test al, al
je 0x4bcf2f
lea eax, [ebp - 0x10]
push eax
push 2
push 0
push 0x4bcfa8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4bcec8
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, dword [ebp - 4]
call fcn.00405598
push eax
push 1
push 0
push 0x4bcfc0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
push 2
push 0x4bcfcc
push 1
push 0
push 0x4bcfd0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
push 2
push 0x4bcfe0
push 1
push 0
push 0x4bcfe4
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
push 2
push 0
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
jmp 0x4bcf75
lea eax, [ebp - 8]
call fcn.00406c68
push eax
push 0x4c7814
push 1
push 0
push 0x4c7804
call sub.ole32.dll_CoCreateInstance
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405a38
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405a48
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
push 0xf
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcfa2
lea eax, [ebp - 0xc]
call fcn.004058e8
lea eax, [ebp - 8]
call fcn.00406c68
lea eax, [ebp - 4]
call fcn.00405108
ret
Function at 0x4bcff4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4bd25c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4bd227
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x400
lea eax, [ebp - 0x414]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x418]
lea edx, [ebp - 0x414]
mov ecx, 0x400
call fcn.00405378
mov edx, dword [ebp - 0x418]
lea eax, [ebp - 4]
mov ecx, 0x4bd274
call fcn.00405420
lea eax, [ebp - 0x41c]
push eax
mov dword [ebp - 0x434], ebx
mov byte [ebp - 0x430], 0
mov dword [ebp - 0x42c], edi
mov byte [ebp - 0x428], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov byte [ebp - 0x420], 0
lea edx, [ebp - 0x434]
mov ecx, 2
mov eax, 0x4bd28c
call fcn.0040acf0
mov edx, dword [ebp - 0x41c]
lea ecx, [ebp - 8]
mov eax, dword [esi + 0x380]
call fcn.004b86e0
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4bd0d6
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x4bd2c0
call fcn.004056e4
sub ebx, eax
sub ebx, 0x22
push ebx
mov eax, 0x4bd2c0
mov edx, dword [ebp - 8]
call fcn.004056e4
mov edx, eax
add edx, 0x22
mov eax, dword [ebp - 8]
pop ecx
call fcn.00405600
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x4bd2ec
call fcn.004056e4
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405600
mov dl, 1
mov eax, dword [0x418154]
call fcn.004041bc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4bd20e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x380]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004b8688
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0041c930
mov dl, 1
mov eax, dword [0x47a688]
call fcn.0047a93c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4bd1f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov dl, 1
mov eax, dword [0x425da4]
call fcn.0042c104
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4bd1d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x50]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd1db
mov eax, dword [ebp - 0x14]
call fcn.004041ec
ret
Function at 0x4bd5d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405588
xor eax, eax
push ebp
push 0x4bd64e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403984
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00403984
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405598
push eax
push 0
call sub.kernel32.dll_CreateProcessA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd655
lea eax, [ebp - 4]
call fcn.00405108
ret

Function at 0x4bdea8
Capabilities:
Query environment variable

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
push 0x400
lea eax, [esp + 4]
push eax
push 0x4bdedc
call sub.kernel32.dll_GetEnvironmentVariableA
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00405378
add esp, 0x400
pop ebx
ret

Function at 0x4bdee4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405588
xor eax, eax
push ebp
push 0x4bdf6f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403984
mov dword [ebp - 0x48], 0x44
mov word [ebp - 0x18], 0
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00403984
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405598
push eax
push 0
call sub.kernel32.dll_CreateProcessA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bdf76
lea eax, [ebp - 4]
call fcn.00405108
ret

Function at 0x4be9d4
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
mov dword [esp], 7
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
pop edx
ret