joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a4160
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x130], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x128], 0x114
push 0x110
push 0
lea eax, [ebp - 0x124]
push eax
call fcn.005533a0
add esp, 0xc
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x4a41d1
cmp dword [ebp - 0x124], 6
jb 0x4a41d1
mov dword [ebp - 0x134], 1
jmp 0x4a41db
mov dword [ebp - 0x134], 0
mov edx, dword [ebp - 0x134]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x4a4222
lea eax, [ebp - 4]
push eax
call dword [sym.imp.dwmapi.dll_DwmIsCompositionEnabled]
test eax, eax
jl 0x4a420a
cmp dword [ebp - 4], 0
je 0x4a420a
mov dword [ebp - 0x138], 1
jmp 0x4a4214
mov dword [ebp - 0x138], 0
mov ecx, dword [ebp - 0x138]
mov dword [ebp - 0x13c], ecx
jmp 0x4a422c
mov dword [ebp - 0x13c], 0
mov al, byte [ebp - 0x13c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret

Function at 0x4a4f50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587bbf
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x10], 0
push 0x596d4a
lea ecx, [ebp - 0x14]
call fcn.0041da30
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push 0x596e10
push SHChangeNotifyDeregister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5015
mov dword [ebp - 0x124], 0x100
mov dword [ebp - 0x128], 0x100
lea ecx, [ebp - 0x128]
push ecx
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x120]
push eax
push 0
push 0x596e40
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a5015
lea edx, [ebp - 0x11c]
push edx
push 0x596e58
lea eax, [ebp - 0x14]
push eax
call fcn.00423c30
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x596e60
push 1
lea edx, [ebp - 0x130]
push edx
lea ecx, [ebp - 0x14]
call fcn.0041dde0
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x13c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x13c]
call fcn.0041dbd0
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x129], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x130]
call fcn.0041dab0
movzx ecx, byte [ebp - 0x129]
test ecx, ecx
je 0x4a5089
push 0x596e64
lea ecx, [ebp - 0x14]
call fcn.0041db30
push 0x596e68
lea ecx, [ebp - 0x14]
call fcn.0041db30
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041d990
mov eax, dword [ebp - 0x134]
or eax, 1
mov dword [ebp - 0x134], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0041dab0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret
Function at 0x4adb30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], ecx
movzx eax, word [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x218], ecx
mov edx, dword [ebp - 0x218]
sub edx, 0x423
mov dword [ebp - 0x218], edx
cmp dword [ebp - 0x218], 4
ja case.default.0x4adb0e
mov eax, dword [ebp - 0x218]
jmp dword [eax*4 + 0x4adbe8]
push 0
push 0
push 0x7ee
mov ecx, dword [0x5e24a4]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x4adb0e
push 0
push 0
push 0
push 0x5983b8
push 0
mov edx, dword [ebp - 0x214]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.default.0x4adb0e
mov ecx, dword [0x5983b4]
mov dword [ebp - 0x210], ecx
push 0x204
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.005533a0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call fcn.004011a0
add esp, 4
push 1
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0x598404
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.default.0x4adb0e
push 0
push 0
push 0
push 0x598408
push 0
mov edx, dword [ebp - 0x214]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.default.0x4adb0e
push 0
push 0
push 0x7eb
mov ecx, dword [0x5e24a4]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4adb52
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], ecx
movzx eax, word [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x218], ecx
mov edx, dword [ebp - 0x218]
sub edx, 0x423
mov dword [ebp - 0x218], edx
cmp dword [ebp - 0x218], 4
ja case.default.0x4adb0e
mov eax, dword [ebp - 0x218]
jmp dword [eax*4 + 0x4adbe8]
push 0
push 0
push 0x7ee
mov ecx, dword [0x5e24a4]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x4adb0e
push 0
push 0
push 0
push 0x5983b8
push 0
mov edx, dword [ebp - 0x214]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.default.0x4adb0e
mov ecx, dword [0x5983b4]
mov dword [ebp - 0x210], ecx
push 0x204
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.005533a0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call fcn.004011a0
add esp, 4
push 1
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0x598404
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.default.0x4adb0e
push 0
push 0
push 0
push 0x598408
push 0
mov edx, dword [ebp - 0x214]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.default.0x4adb0e
push 0
push 0
push 0x7eb
mov ecx, dword [0x5e24a4]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4adb9f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], ecx
movzx eax, word [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x218], ecx
mov edx, dword [ebp - 0x218]
sub edx, 0x423
mov dword [ebp - 0x218], edx
cmp dword [ebp - 0x218], 4
ja case.default.0x4adb0e
mov eax, dword [ebp - 0x218]
jmp dword [eax*4 + 0x4adbe8]
push 0
push 0
push 0x7ee
mov ecx, dword [0x5e24a4]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x4adb0e
push 0
push 0
push 0
push 0x5983b8
push 0
mov edx, dword [ebp - 0x214]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.default.0x4adb0e
mov ecx, dword [0x5983b4]
mov dword [ebp - 0x210], ecx
push 0x204
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.005533a0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call fcn.004011a0
add esp, 4
push 1
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0x598404
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.default.0x4adb0e
push 0
push 0
push 0
push 0x598408
push 0
mov edx, dword [ebp - 0x214]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.default.0x4adb0e
push 0
push 0
push 0x7eb
mov ecx, dword [0x5e24a4]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4af240
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0x598554
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4afbb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5882f2
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5deba8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4afbf3
xor eax, eax
jmp 0x4afcd0
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp - 0x18]
call fcn.0041d9b0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x16dc]
call fcn.0041f280
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0
jmp 0x4afc29
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x14]
jge 0x4afcb7
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx + 0x16dc]
call fcn.0041f170
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4afcb2
mov ecx, dword [ebp - 0x20]
call fcn.00428c40
push eax
lea ecx, [ebp - 0x18]
call fcn.0041dbd0
test eax, eax
jne 0x4afc82
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0041dab0
mov eax, dword [ebp - 0x24]
jmp 0x4afcd0
mov ecx, dword [ebp - 0x20]
call fcn.00428c60
push eax
lea ecx, [ebp - 0x18]
call fcn.0041dbd0
test eax, eax
jne 0x4afcb2
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0041dab0
mov eax, dword [ebp - 0x28]
jmp 0x4afcd0
jmp 0x4afc20
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0041dab0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b6b30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jne 0x4b6b42
jmp 0x4b6c84
push str.but_shutdown
mov ecx, dword [ebp + 8]
call fcn.00480ea0
push eax
call fcn.00554863
add esp, 8
test eax, eax
jne 0x4b6b7e
push 0
push 0
push str._s__t_0
push 0x5998a4
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4b6c84
push str.but_restart
mov ecx, dword [ebp + 8]
call fcn.00480ea0
push eax
call fcn.00554863
add esp, 8
test eax, eax
jne 0x4b6bba
push 0
push 0
push 0x5998d8
push 0x5998e0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4b6c84
push str.but_logout
mov ecx, dword [ebp + 8]
call fcn.00480ea0
push eax
call fcn.00554863
add esp, 8
test eax, eax
jne 0x4b6bf6
push 0
push 0
push 0x599914
push str.shutdown.exe
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4b6c84
push str.but_sleep
mov ecx, dword [ebp + 8]
call fcn.00480ea0
push eax
call fcn.00554863
add esp, 8
test eax, eax
jne 0x4b6c17
call fcn.004809d0
jmp 0x4b6c84
push str.but_hibernate
mov ecx, dword [ebp + 8]
call fcn.00480ea0
push eax
call fcn.00554863
add esp, 8
test eax, eax
jne 0x4b6c5d
call fcn.00480a60
movzx eax, al
test eax, eax
je 0x4b6c44
call fcn.00480940
jmp 0x4b6c5b
push 0x40
push 0x599968
push 0x599970
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0046e660
jmp 0x4b6c84
push str.but_close
mov ecx, dword [ebp + 8]
call fcn.00480ea0
push eax
call fcn.00554863
add esp, 8
test eax, eax
jne 0x4b6c84
push 0
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0042c4f0
mov esp, ebp
pop ebp
ret 4
Function at 0x4b6c90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5888eb
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5deba8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
jne 0x4b6cc3
jmp 0x4b6e65
mov ecx, dword [ebp + 8]
call fcn.00480ea0
push eax
lea ecx, [ebp - 0x10]
call fcn.0041d9b0
mov dword [ebp - 4], 0
push str.check_autostart
lea ecx, [ebp - 0x10]
call fcn.0041dbd0
test eax, eax
jne 0x4b6d1b
movzx eax, byte [0x5e1950]
neg eax
sbb eax, eax
add eax, 1
mov byte [0x5e1950], al
movzx ecx, byte [0x5e1950]
test ecx, ecx
je 0x4b6d11
call fcn.004b6e80
jmp 0x4b6d16
call fcn.004b6f60
jmp 0x4b6e56
push str.check_hideicon
lea ecx, [ebp - 0x10]
call fcn.0041dbd0
test eax, eax
jne 0x4b6d59
push 0
call fcn.00416bc0
add esp, 4
push 0
call fcn.00416bc0
add esp, 4
movzx edx, byte [0x5e02b0]
neg edx
sbb edx, edx
add edx, 1
mov byte [0x5e02b0], dl
jmp 0x4b6e56
push str.check_hideTaskBar
lea ecx, [ebp - 0x10]
call fcn.0041dbd0
test eax, eax
jne 0x4b6d93
movzx eax, byte [0x5e1951]
neg eax
sbb eax, eax
add eax, 1
mov byte [0x5e1951], al
push 0
push 0
push 0x4b73a0
call fcn.00554077
add esp, 0xc
jmp 0x4b6e56
push str.check_showAni
lea ecx, [ebp - 0x10]
call fcn.0041dbd0
test eax, eax
jne 0x4b6dd1
push 0
call fcn.00416bc0
add esp, 4
push 0
call fcn.00416bc0
add esp, 4
movzx ecx, byte [0x5e02b1]
neg ecx
sbb ecx, ecx
add ecx, 1
mov byte [0x5e02b1], cl
jmp 0x4b6e56
push str.check_hideToTray
lea ecx, [ebp - 0x10]
call fcn.0041dbd0
test eax, eax
jne 0x4b6e56
movzx edx, byte [0x5e1958]
test edx, edx
je 0x4b6e2c
mov ecx, dword [ebp - 0x14]
call fcn.004b7440
movzx eax, al
test eax, eax
jne 0x4b6e2c
mov ecx, dword [ebp - 0x14]
call fcn.004b5260
push 0x40
push 0x599a38
push 0x599a40
mov ecx, dword [ebp - 0x14]
add ecx, 4
call fcn.0046e660
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0041dab0
jmp 0x4b6e65
movzx ecx, byte [0x5e1958]
neg ecx
sbb ecx, ecx
add ecx, 1
mov byte [0x5e1958], cl
push 0
push 0
push 0x81b
mov edx, dword [0x5e24a4]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0041dab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b6e80
Capabilities:
Check if file exists
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58890e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5deba8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14]
call fcn.0041d970
mov dword [ebp - 4], 0
push 0x104
push 0x105
lea ecx, [ebp - 0x14]
call fcn.004b74e0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.0041e330
lea ecx, [ebp - 0x14]
call fcn.0041e1e0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b6f38
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x599500
push SHChangeNotifyDeregister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea ecx, [ebp - 0x14]
call fcn.0041e2f0
shl eax, 1
push eax
lea ecx, [ebp - 0x14]
call fcn.0041e1e0
push eax
push 1
push 0
push 0x59955c
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0041dab0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4b6f60
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x599570
push SHChangeNotifyDeregister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b6fa3
push 0x5995cc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x4b73c0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 1
jne 0x4b73df
mov dword [ebp - 0x2c], 1
jmp 0x4b73e6
mov dword [ebp - 0x2c], 2
push 0x24
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.005533a0
add esp, 0xc
mov dword [ebp - 0x28], 0x24
push 0
push 0x599680
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4b7425
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 8], ecx
lea edx, [ebp - 0x28]
push edx
push 0xa
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret
Function at 0x4be150
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x588e01
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x224], ecx
push 0x599cb8
lea ecx, [ebp - 0x10]
call fcn.0041d9b0
mov dword [ebp - 4], 0
push 2
push 0x599cbc
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x224]
mov edx, dword [ecx + 4]
push edx
call fcn.004be310
add esp, 0x18
test eax, eax
je 0x4be2e7
mov eax, dword [0x599cf0]
mov dword [ebp - 0x21c], eax
push 0x204
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.005533a0
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.0041e290
push eax
lea edx, [ebp - 0x21c]
push edx
call fcn.00554842
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0041e330
lea ecx, [ebp - 0x10]
call fcn.0041e1e0
test eax, eax
je 0x4be2e7
lea ecx, [ebp - 0x10]
call fcn.0041e1e0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4be2e7
lea eax, [ebp - 0x21c]
push eax
push 2
call fcn.00416bc0
add esp, 4
add eax, 0xd88
push eax
call fcn.00554842
add esp, 8
push 2
call fcn.00416bc0
add esp, 4
mov byte [eax + 0xfe0], 1
mov ecx, dword [ebp - 0x224]
add ecx, 0x6e8
call fcn.0048a650
movzx ecx, al
test ecx, ecx
je 0x4be286
push 2
call fcn.00416bc0
add esp, 4
mov dword [eax + 0xfe4], 0
jmp 0x4be29a
push 2
call fcn.00416bc0
add esp, 4
mov dword [eax + 0xfe4], 1
lea edx, [ebp - 0x21c]
push edx
push 0
push 0x1554
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0x224]
add ecx, 4
call fcn.0042c560
mov ecx, eax
call fcn.00401050
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 2
call fcn.00416bc0
add esp, 4
mov ecx, dword [ebp - 0x224]
mov dl, byte [eax + 0xfe0]
mov byte [ecx + 0x13fc], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0041dab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret
Function at 0x4c3fd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
movzx eax, byte [0x5e1950]
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x58]
cmp eax, edx
je 0x4c400b
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x58]
test ecx, ecx
je 0x4c3ffb
call fcn.004c4150
jmp 0x4c4000
call fcn.004c4230
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x58]
mov byte [0x5e1950], al
movzx ecx, byte [0x5e1951]
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x59]
cmp ecx, eax
je 0x4c403c
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + 0x59]
mov byte [0x5e1951], dl
mov eax, dword [ebp - 4]
push eax
push 0
push 0x4c4c10
call fcn.00554077
add esp, 0xc
mov ecx, dword [ebp - 4]
add ecx, 0x62
push ecx
push 0x5e195a
call fcn.00554863
add esp, 8
test eax, eax
je 0x4c408b
call fcn.004e15c0
test eax, eax
je 0x4c4077
push 0
mov edx, dword [ebp - 4]
add edx, 0x62
push edx
push 0x7f6
call fcn.004e15c0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 4]
add eax, 0x62
push eax
push 0x5e195a
call fcn.00554842
add esp, 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x278]
cmp eax, dword [edx + 0x54]
je 0x4c40b8
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x54]
push edx
push 0x7f5
mov eax, dword [0x5e24a8]
push eax
call fcn.004c56b0
add esp, 0x10
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x5c]
mov dword [0x5e1954], edx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x60]
movzx edx, byte [0x5e1958]
cmp ecx, edx
je 0x4c40fa
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x60]
mov byte [0x5e1958], cl
push 0
push 0
push 0x81b
mov edx, dword [0x5e24a4]
push edx
call fcn.004c56b0
add esp, 0x10
push 0
call fcn.00416bc0
add esp, 4
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x27e]
mov byte [0x5e8fe9], cl
push 0
call fcn.00416bc0
add esp, 4
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x27d]
mov byte [0x5e02b1], al
push 0
call fcn.00416bc0
add esp, 4
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + 0x27f]
mov byte [0x5e02b0], dl
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4c4150
Capabilities:
Check if file exists
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58936b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5deba8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14]
call fcn.0041d970
mov dword [ebp - 4], 0
push 0x104
push 0x105
lea ecx, [ebp - 0x14]
call fcn.004b74e0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.0041e330
lea ecx, [ebp - 0x14]
call fcn.0041e1e0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c4208
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x59a238
push SHChangeNotifyDeregister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea ecx, [ebp - 0x14]
call fcn.0041e2f0
shl eax, 1
push eax
lea ecx, [ebp - 0x14]
call fcn.0041e1e0
push eax
push 1
push 0
push 0x59a294
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0041dab0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4c4230
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x59a2a8
push SHChangeNotifyDeregister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c4273
push 0x59a304
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret