joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452d90
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x452f3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x452f1c
mov dl, 1
mov eax, dword [0x414200]
call fcn.00403d30
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404acc
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x452f0b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00440950
test al, al
je 0x452efe
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x452f4c
lea eax, [ebp - 0x254]
call fcn.0040a10c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x452efe
xor eax, eax
push ebp
push 0x452ef7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x452f84
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x452ee0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404d34
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x452ee0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404d34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452efe
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x452e01
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00418648
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452f42
lea eax, [ebp - 0x260]
call fcn.00404acc
ret

Function at 0x453870
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4bac00]
cmp byte [eax + 0xa5], 0
jne 0x4538e1
cmp dword [0x4bac18], 0
jne 0x4538a2
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x45382c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4bac18], eax
cmp dword [0x4bac14], 0
jne 0x4538bd
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x4bac14], eax
cmp dword [0x4bac1c], 0
jne 0x4538e1
push esp
push 0
push 0
push 0x4537d0
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x4bac1c], eax
pop edx
ret
Function at 0x4539d8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4539ef
add esp, 0xfffffff0
call fcn.004040c4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041e130
mov eax, dword [0x4b9114]
cmp word [eax + 2], 0
jne 0x453a17
mov eax, dword [0x4b9114]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004550b4
mov eax, dword [0x4b91d0]
cmp word [eax + 2], 0
jne 0x453a31
mov eax, dword [0x4b91d0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004552ac
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x413d10]
call fcn.00403d30
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x413d10]
call fcn.00403d30
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], reloc.KERNEL32.DLL_AssignProcessToJobObject
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4205c8]
call fcn.00427dbc
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x453bb8
mov eax, dword [0x4b9018]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042818c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45581c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4b9018]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ce98
test eax, eax
je 0x453b26
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409a54
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cec0
test eax, eax
je 0x453b3a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404d34
mov eax, dword [0x4b8ec8]
cmp byte [eax], 0
jne 0x453b6e
mov eax, ebx
call fcn.00453ce0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.004559f8
mov eax, ebx
call fcn.00456338
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x453bae
call fcn.0040411c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453f54
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4bac00]
cmp dword [eax + 0x30], 0
je 0x453ffe
cmp dword [ebx + 0x94], 0
jne 0x453ff8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x453ee4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x453ff8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x453fbe
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x453ff8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00416438
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x453fcd
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x454adc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x454b11
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404bbc
jmp 0x454b1e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404b20
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x455bd4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x455c15
mov eax, esi
call fcn.0043c088
test al, al
je 0x455c15
mov eax, dword [ebx + 0x84]
call fcn.0043bd84
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x455c15
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043bd84
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45682c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x456904
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4bac80], 0
jne 0x4568e8
lea eax, [ebp - 4]
mov edx, 0x45691c
call fcn.00404b64
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404f7c
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4568e8
mov eax, ebx
call fcn.00402760
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4568e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4568cb
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x45692c
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4568cb
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4bac80], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4568e8
mov eax, dword [ebp - 0xc]
call fcn.00402780
ret
mov ebx, dword [0x4bac80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45690b
lea eax, [ebp - 4]
call fcn.00404acc
ret

Function at 0x45ad9c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [0x431b54]
call fcn.00403eec
test al, al
je 0x45adde
mov eax, dword [0x4b91b8]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x45adde
mov edx, dword [0x4b91b8]
xor edx, edx
call fcn.0044e724
push 0
mov eax, dword [0x4b91b8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x45b65c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45b746
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00404f7c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], ebx
test ebx, ebx
jbe 0x45b730
xor eax, eax
push ebp
push 0x45b71a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00402760
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00404f7c
push eax
call sub.version.dll_GetFileVersionInfoA
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 4]
mov byte [eax + 8], bl
test bl, bl
je 0x45b710
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0045b7ac
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add eax, 0x18
call fcn.00404b20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45b730
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b74d
lea eax, [ebp - 8]
call fcn.00404acc
ret

Function at 0x45d730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45d7e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404acc
lea eax, [ebp - 8]
mov edx, 0x401
call fcn.00405108
or edi, 0xffffffff
inc edi
mov dword [ebp - 0xc], 0x400
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404f7c
push eax
push edi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
test ebx, ebx
jne 0x45d7c5
cmp dword [esi], 0
je 0x45d7a9
mov eax, esi
mov edx, 0x45d800
call fcn.00404d8c
mov eax, dword [ebp - 8]
call fcn.00404f7c
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00404cbc
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.00404d8c
test ebx, ebx
je 0x45d76b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d7ee
lea eax, [ebp - 0x10]
call fcn.00404acc
lea eax, [ebp - 8]
call fcn.00404acc
ret
Function at 0x45d804
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45d8a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404acc
lea eax, [ebp - 8]
mov edx, 0x401
call fcn.00405108
or edi, 0xffffffff
inc edi
push 0x400
mov eax, dword [ebp - 8]
call fcn.00404f7c
push eax
push edi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyA
mov ebx, eax
test ebx, ebx
jne 0x45d886
cmp dword [esi], 0
je 0x45d86a
mov eax, esi
mov edx, 0x45d8bc
call fcn.00404d8c
mov eax, dword [ebp - 8]
call fcn.00404f7c
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.00404cbc
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00404d8c
test ebx, ebx
je 0x45d83a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d8ac
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404af0
ret

Function at 0x45d8c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x45da2e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, esi
call fcn.00404f7c
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xea
je 0x45d924
cmp dword [ebp - 0x14], 0
jne 0x45da03
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00405108
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00404fd4
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, esi
call fcn.00404f7c
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
cmp dword [ebp - 8], 2
je 0x45d95c
cmp dword [ebp - 8], 1
jne 0x45d973
push edi
mov ecx, dword [ebp - 0xc]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00404fdc
jmp 0x45da0d
cmp dword [ebp - 8], 3
jne 0x45d97f
cmp dword [ebp - 0xc], 4
je 0x45d985
cmp dword [ebp - 8], 4
jne 0x45d9ba
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
call fcn.00404fd4
lea edx, [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
call fcn.004029c4
lea edx, [ebp - 0x114]
mov eax, dword [ebp - 0x14]
call fcn.0040361c
lea edx, [ebp - 0x114]
mov eax, edi
call fcn.00404d28
jmp 0x45da0d
cmp dword [ebp - 8], 3
jne 0x45da0d
mov eax, edi
mov edx, 0x45da48
call fcn.00404b20
mov ebx, dword [ebp - 0xc]
test ebx, ebx
jle 0x45da0d
mov esi, 1
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + esi - 1]
lea ecx, [ebp - 0x118]
mov edx, 2
call fcn.0045af60
mov edx, dword [ebp - 0x118]
mov eax, edi
call fcn.00404d8c
inc esi
dec ebx
jne 0x45d9d8
jmp 0x45da0d
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404b20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45da35
lea eax, [ebp - 0x118]
call fcn.00404acc
lea eax, [ebp - 0x10]
call fcn.00404acc
ret
Function at 0x45da4c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 0
lea eax, [esp + 8]
push eax
push 0
mov eax, edi
call fcn.00404f7c
push eax
push esi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x45da85
test eax, eax
jne 0x45dab4
mov eax, ebx
mov edx, dword [esp + 4]
call fcn.00405108
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.00404fd4
push eax
lea eax, [esp + 8]
push eax
push 0
mov eax, edi
call fcn.00404f7c
push eax
push esi
call sub.advapi32.dll_RegQueryValueExA
jmp 0x45dabb
mov eax, ebx
call fcn.00404acc
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x45dac4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45db83
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, esi
call fcn.00404f7c
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x45db10
test eax, eax
jne 0x45db6d
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00405108
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00404fd4
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, esi
call fcn.00404f7c
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
cmp dword [ebp - 8], 3
je 0x45db48
cmp dword [ebp - 8], 4
jne 0x45db6d
cmp dword [ebp - 0xc], 4
jle 0x45db55
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
call fcn.00404fd4
lea edx, [ebp - 4]
mov ecx, dword [ebp - 0xc]
call fcn.004029c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45db8a
lea eax, [ebp - 0x10]
call fcn.00404acc
ret
Function at 0x45dbf8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45dcf1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404acc
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00404f7c
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
push eax
call sub.KERNEL32.DLL_SetLastError
call sub.KERNEL32.DLL_GetLastError
test eax, eax
jne 0x45dcdb
cmp dword [ebp - 4], 7
jne 0x45dcdb
mov eax, dword [ebp - 8]
call fcn.00402760
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45dcd4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, edi
call fcn.00404f7c
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
mov ebx, dword [ebp - 0xc]
jmp 0x45dcb9
push dword [esi]
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404cbc
push dword [ebp - 0x10]
push 0x45dd08
mov eax, esi
mov edx, 3
call fcn.00404e44
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x45dc90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45dcdb
mov eax, dword [ebp - 0xc]
call fcn.00402780
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45dcf8
lea eax, [ebp - 0x10]
call fcn.00404acc
ret

Function at 0x45e050
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
xor eax, eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x110], eax
xor eax, eax
push ebp
push 0x45e0db
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x105]
call fcn.00404cbc
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.0045b3e0
mov edx, dword [ebp - 0x10c]
mov eax, 0x4b5d84
mov ecx, 0x45e0f0
call fcn.00404dd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e0e2
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.00404af0
ret

Function at 0x45f1e0
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push 5
lea eax, [esp + 4]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale_1
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
mov eax, ebx
mov edx, esp
call fcn.00404cbc
pop ecx
pop edx
pop ebx
ret
Function at 0x45f770
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x45f824
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov eax, dword [0x4b9254]
cmp byte [eax], 0
je 0x45f7a6
call fcn.0045f4dc
test al, al
je 0x45f7a6
call fcn.0045f670
mov edi, eax
jmp 0x45f809
mov eax, dword [0x4b9368]
cmp dword [eax], 2
jne 0x45f809
call sub.KERNEL32.DLL_GetLogicalDrives
mov esi, eax
mov ebx, 2
mov ecx, ebx
mov eax, 1
shl eax, cl
test eax, esi
je 0x45f803
push 0x45f83c
lea eax, [ebp - 8]
mov edx, ebx
add dl, 0x61
call fcn.00404cac
push dword [ebp - 8]
push 0x45f84c
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404e44
mov eax, dword [ebp - 4]
call fcn.0045f454
test eax, eax
jle 0x45f803
mov edi, eax
cmp eax, 2
je 0x45f809
inc ebx
cmp ebx, 0x1a
jne 0x45f7bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f82b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404af0
ret

Function at 0x45f850
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45f8b5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov ecx, 3
mov edx, 1
mov eax, ebx
call fcn.00404fdc
mov eax, dword [ebp + 8]
push eax
push edi
lea eax, [ebp - 8]
push eax
push esi
mov eax, dword [ebp - 4]
call fcn.00404f7c
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f8bc
lea eax, [ebp - 4]
call fcn.00404acc
ret

Function at 0x45faa0
Capabilities:
Get memory capacity

Disassembly:
push ebx
add esp, 0xffffffe0
mov ebx, eax
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 8]
shr eax, 0x14
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0040932c
add esp, 0x20
pop ebx
ret
Function at 0x46020c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
push ebp
push 0x4602bb
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_GetPriorityClass
mov ebx, eax
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.KERNEL32.DLL_GetThreadPriority
mov esi, eax
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_SetPriorityClass
push 0xf
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.KERNEL32.DLL_SetThreadPriority
push 0xa
call sub.KERNEL32.DLL_Sleep
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x1f4
call sub.KERNEL32.DLL_Sleep
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push esi
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.KERNEL32.DLL_SetThreadPriority
push ebx
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_SetPriorityClass
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fdiv dword [0x4602e4]
fstp qword [ebp - 0x10]
wait
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4602d9
fld qword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret