joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b148
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x418910]
call fcn.00405a8c
xor eax, eax
push ebp
push 0x47b28c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c0164], 0
jne 0x47b19b
mov ecx, dword [0x4c2ea8]
mov dl, 1
mov eax, dword [0x4087f4]
call fcn.0040e724
call fcn.00404690
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004035c0
mov eax, ebx
call fcn.004056ac
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x47b29c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406acc
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004056bc
test eax, eax
jle 0x47b233
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x47b22c
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404fb4
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404f9c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004096d8
test eax, eax
jne 0x47b22c
mov ebx, 0x15
jmp 0x47b238
mov ebx, 0x10
jmp 0x47b238
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4c0164]
call fcn.0047b0a0
mov eax, dword [ebp - 8]
call fcn.0047b0a0
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406ae4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b293
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404d40
lea eax, [ebp - 0x10]
mov edx, dword [0x418910]
call fcn.00405b5c
ret

Function at 0x47c1ec
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x47c246
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c2f4c]
cmp byte [eax], 0
je 0x47c216
push ebx
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
jmp 0x47c230
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404f54
mov eax, dword [ebp - 4]
call fcn.004051ec
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c24d
lea eax, [ebp - 4]
call fcn.00404d1c
ret
Function at 0x47c46c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47c541
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c2f4c]
cmp byte [eax], 0
je 0x47c4c4
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
lea eax, [ebp - 4]
mov edx, esi
call fcn.004055cc
mov eax, dword [ebp - 4]
call fcn.0047bf38
push eax
push ebx
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
jmp 0x47c51e
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 8]
mov edx, dword [ebp + 0xc]
call fcn.00404f54
mov eax, dword [ebp - 8]
call fcn.0047bf18
push eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 0x10]
call fcn.00404f54
mov eax, dword [ebp - 0xc]
call fcn.0047bf18
push eax
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404f54
mov eax, dword [ebp - 0x10]
call fcn.0047bf18
push eax
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.00404f54
mov eax, dword [ebp - 0x14]
call fcn.0047bf18
push eax
push ebx
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c548
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404d40
lea eax, [ebp - 4]
call fcn.00405474
ret

Function at 0x47c764
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.0040814c
cmp ax, 0xffff
jne 0x47c785
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
push 6
push eax
push edi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x47c811
push eax
push edi
call sub.kernel32.dll_LoadResource
mov edi, eax
test edi, edi
je 0x47c811
push edi
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
mov eax, ebx
dec eax
test eax, eax
jl 0x47c7d2
inc eax
mov edx, dword [ebp - 8]
movzx edx, word [edx]
add edx, edx
add edx, dword [ebp - 8]
add edx, 2
mov dword [ebp - 8], edx
dec eax
jne 0x47c7be
mov eax, dword [ebp - 8]
movzx esi, word [eax]
add dword [ebp - 8], 2
cmp dword [ebp - 4], 0
je 0x47c811
cmp dword [ebp + 8], 0
jle 0x47c811
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.0042f7b4
mov esi, eax
test esi, esi
jle 0x47c808
mov ecx, esi
add ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00408160
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x47d6d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x47d738
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404f9c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409f04
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d73f
lea eax, [ebp - 0xc]
call fcn.00404d1c
ret

Function at 0x47d7b4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x47d810
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x47d7df
call fcn.0040fc64
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402d1c
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x47d810
call fcn.0040fc64
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x48912c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4892b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x276]
sub al, 2
jb 0x489295
cmp byte [ebx + 0x268], 0
je 0x489295
mov eax, dword [ebp - 4]
call fcn.0048d0b4
mov word [ebp - 6], ax
xor eax, eax
push ebp
push 0x48928e
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp - 6]
sub ax, 8
je 0x4891d2
dec ax
je 0x4891a8
sub ax, 0x12
jne 0x4891ec
call fcn.0040473c
jmp 0x489295
cmp byte [ebx + 0x269], 0
je 0x489274
mov eax, ebx
call fcn.0045031c
test al, al
je 0x489274
xor edx, edx
mov eax, ebx
call fcn.00450340
jmp 0x489274
mov eax, dword [esi]
call fcn.004056bc
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.004058a8
jmp 0x489274
cmp byte [ebx + 0x269], 0
je 0x489209
mov eax, ebx
call fcn.0045031c
test al, al
jne 0x489209
mov dl, 1
mov eax, ebx
call fcn.00450340
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 8]
sub eax, dword [edx]
cmp eax, 0x4e2
jb 0x489221
mov eax, esi
call fcn.00405474
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0
push 1
lea eax, [ebp - 0x10]
mov dx, word [ebp - 6]
call fcn.0040558c
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi]
lea eax, [ebp - 0xc]
call fcn.00405728
mov ecx, dword [ebp - 0xc]
mov edx, edi
mov eax, ebx
call fcn.00488fac
test al, al
je 0x489274
lea eax, [ebp - 0x14]
mov dx, word [ebp - 6]
call fcn.0040558c
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.004056c8
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489295
mov eax, dword [ebp - 4]
mov dx, word [ebp - 6]
call fcn.0048d0e8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4892b7
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040548c
ret

Function at 0x48c590
Capabilities:
Set global application hook

Disassembly:
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x48c530
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x4c4ef4], eax
cmp dword [0x4c4ef4], 0
jne 0x48c5b7
call fcn.0040fc64
ret

Function at 0x48e73c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00405474
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x48e78b
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405614
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48e790
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, eax
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
pop ebx
ret
Function at 0x498194
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x4981be
cmp dword [ebx + 0x64], 0
jne 0x4981be
cmp dword [ebx + 0x6c], 0
jne 0x4981be
mov edi, esi
jmp 0x498245
cmp edi, 0xffffffff
jne 0x4981c6
dec edi
jmp 0x498245
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x498245
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00497590
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x498213
mov cx, word [esp]
sub cx, si
jmp 0x498215
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4981fc
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x49823b
mov cx, word [esp]
sub cx, si
jmp 0x49823d
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x498224
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4982a2
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.00497f30
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x49828d
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x4982a2
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x49819e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x49e568
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4c4f74
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x49e58a
shr eax, 1
xor eax, 0xedb88320
jmp 0x49e58c
shr eax, 1
dec edx
jne 0x49e578
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x49e571
mov byte [0x4c5374], 1
pop esi
pop ebx
ret

Function at 0x49e5a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4c5374], 0
jne 0x49e5bf
call fcn.0049e568
mov eax, edi
dec eax
test eax, eax
jl 0x49e5e8
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4c4f74]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x49e5c9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4a0bdc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4a0c0d
dec al
je 0x4a0c49
dec al
je 0x4a0c8d
dec al
je 0x4a0cf8
jmp 0x4a0d82
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4a0d82
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a0c1d
jmp 0x4a0d82
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a0d82
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a0c59
jmp 0x4a0d82
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a0d82
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4a0cbb
xor ebp, ebp
jmp 0x4a0ccc
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4a0cd5
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a0c9d
jmp 0x4a0d82
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a0d82
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4a0d50
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0049e5f0
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a0d0c
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a46b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a480d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c2f4c]
cmp byte [eax], 0
jne 0x4a470b
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404fb4
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov eax, ebx
call fcn.0043a74c
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00405630
jmp 0x4a47e5
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.004056ac
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x4a473d
mov eax, esi
call fcn.00405474
jmp 0x4a47e5
mov eax, dword [ebp - 4]
dec eax
sub eax, 2
jb 0x4a4774
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 0xf
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x1c]
mov eax, dword [0x4c30c4]
call fcn.00406f90
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x43a314]
call fcn.0040e6a4
call fcn.00404690
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, esi
call fcn.00405a24
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
call fcn.004056ac
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.004056ac
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x4a47d5
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 0xf
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x4c34b8]
call fcn.00406f90
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x43a314]
call fcn.0040e6a4
call fcn.00404690
mov eax, dword [esi]
call fcn.004056ac
mov edx, eax
mov eax, esi
call fcn.004055cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4814
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00404d40
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404d40
ret
Function at 0x4a481c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4a4926
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c2f4c]
cmp byte [eax], 0
jne 0x4a48a7
cmp dword [ebp - 4], 1
jne 0x4a4882
lea eax, [ebp - 8]
mov edx, esi
call fcn.00404fb4
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.00404fb4
mov edx, dword [ebp - 0xc]
mov eax, ebx
pop ecx
call fcn.0043a6f4
jmp 0x4a4903
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.00404fb4
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00404fb4
mov edx, dword [ebp - 0x14]
mov eax, ebx
pop ecx
call fcn.0043a720
jmp 0x4a4903
mov eax, esi
call fcn.004056bc
inc eax
add eax, eax
push eax
mov eax, esi
call fcn.004056ac
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.004056ac
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x4a4903
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], 0xf
lea eax, [ebp - 0x1c]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x4c31dc]
call fcn.00406f90
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x43a314]
call fcn.0040e6a4
call fcn.00404690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a492d
lea eax, [ebp - 0x20]
call fcn.00404d1c
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404d40
ret
Function at 0x4aa030
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x4aa2ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4c2fb4]
cmp byte [eax], 0
jne 0x4aa28f
cmp byte [0x4c2894], 0
je 0x4aa1d1
mov eax, dword [0x4c314c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3e8]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4aa1b1
mov eax, 0x4aa2e0
call fcn.004b0280
lea ecx, [ebp - 8]
mov eax, dword [0x4c2fa4]
mov eax, dword [eax]
mov edx, 0x4aa300
call fcn.0047f1a4
mov edx, dword [ebp - 8]
mov eax, dword [0x4c314c]
mov eax, dword [eax]
mov eax, dword [eax + 0x370]
call fcn.00489af8
lea eax, [ebp - 0xc]
call fcn.004a9874
mov edx, dword [ebp - 0xc]
mov eax, 0x4c539c
call fcn.00404d70
cmp dword [0x4c539c], 0
je 0x4aa191
lea ecx, [ebp - 0x10]
mov eax, dword [0x4c2fa4]
mov eax, dword [eax]
mov edx, 0x4aa328
call fcn.0047f1a4
mov edx, dword [ebp - 0x10]
mov eax, dword [0x4c314c]
mov eax, dword [eax]
mov eax, dword [eax + 0x374]
call fcn.00489af8
mov eax, dword [0x4c314c]
mov eax, dword [eax]
mov ebx, dword [eax + 0x37c]
mov eax, ebx
call fcn.00441f64
mov edx, eax
sar edx, 1
jns 0x4aa11d
adc edx, 0
mov eax, dword [0x4c314c]
mov eax, ebx
call fcn.0044214c
mov eax, 0x4c539c
mov edx, 0x4aa34c
call fcn.00404ff4
push 0
mov eax, dword [0x4c539c]
call fcn.004051ec
push eax
call sub.kernel32.dll_WinExec
call fcn.004a9e90
mov eax, dword [0x4c314c]
mov eax, dword [eax]
mov ebx, dword [eax + 0x37c]
mov eax, ebx
call fcn.00441f64
mov edx, eax
mov eax, dword [0x4c314c]
mov eax, ebx
call fcn.0044214c
push 0x80000001
push 0
mov ecx, 0x4aa364
mov edx, 0x4aa380
mov eax, 0x4aa3c8
call fcn.004a5770
jmp 0x4aa28f
push 0x80000001
push 0
mov ecx, 0x4aa364
mov edx, 0x4aa3e4
mov eax, 0x4aa3c8
call fcn.004a5770
jmp 0x4aa28f
push 0x80000001
push 0
mov ecx, 0x4aa364
mov edx, 0x4aa3e4
mov eax, 0x4aa3c8
call fcn.004a5770
jmp 0x4aa28f
lea eax, [ebp - 4]
mov edx, 0x4aa434
call fcn.00404db4
test dword [0x4c2890], 1
jle 0x4aa1f7
lea eax, [ebp - 4]
mov edx, 0x4aa448
call fcn.00404ff4
test dword [0x4c2890], 2
jle 0x4aa210
lea eax, [ebp - 4]
mov edx, 0x4aa460
call fcn.00404ff4
test dword [0x4c2890], 4
jle 0x4aa229
lea eax, [ebp - 4]
mov edx, 0x4aa478
call fcn.00404ff4
test dword [0x4c2890], 8
jle 0x4aa242
lea eax, [ebp - 4]
mov edx, 0x4aa498
call fcn.00404ff4
test dword [0x4c2890], 0x10
jle 0x4aa25b
lea eax, [ebp - 4]
mov edx, 0x4aa4b0
call fcn.00404ff4
push 0x80000001
push 0
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x4aa4cc
call fcn.00405038
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.00405630
mov edx, dword [ebp - 0x14]
mov ecx, 0x4aa364
mov eax, 0x4aa3c8
call fcn.004a5770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa2d1
lea eax, [ebp - 0x18]
call fcn.00404d1c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040548c
lea eax, [ebp - 0xc]
call fcn.00404d1c
lea eax, [ebp - 8]
call fcn.00405474
lea eax, [ebp - 4]
call fcn.00404d1c
ret