joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47236c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4723d6
mov eax, ebx
call fcn.00474680
test al, al
jne 0x4723d6
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004054d8
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x4723c3
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4723e3
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040543c
jmp 0x4723e3
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040543c
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x4737a4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x473812
mov eax, esi
call fcn.0045d2c8
test al, al
je 0x473812
mov eax, dword [ebx + 0x84]
call fcn.0045cf18
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x473812
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x473806
push 0
mov eax, dword [ebx + 0x84]
call fcn.0045cf18
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00454db8
jmp 0x473812
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004735e0
pop esi
pop ebx
ret

Function at 0x475054
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403afc
ret
Function at 0x47784c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4779bd
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x477998
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.004055d0
lea eax, [ebp - 0x118]
mov edx, 0x4779d4
call fcn.004056b4
mov eax, dword [ebp - 0x118]
call fcn.00405878
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x47790a
lea eax, [ebp - 0x111]
call fcn.0040af9c
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004054d8
jmp 0x477911
mov eax, esi
call fcn.004053e8
cmp bl, 0x61
jae 0x477932
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040f7b4
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.0040543c
jmp 0x47794c
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040f720
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.0040543c
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4779e0
call fcn.0040ba68
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.0040543c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47799f
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x47d008
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405868
xor eax, eax
push ebp
push 0x47d066
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.0047d0e4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x47d04e
lea eax, [ebp - 4]
call fcn.0047d0e4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x47d050
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d06d
lea eax, [ebp - 4]
call fcn.004053e8
ret

Function at 0x47d074
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405868
xor eax, eax
push ebp
push 0x47d0d8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.0047d0e4
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040b1dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d0df
lea eax, [ebp - 4]
call fcn.004053e8
ret
Function at 0x47d698
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405868
xor eax, eax
push ebp
push 0x47d791
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.0047cd98
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040ad68
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0047e068
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040ac28
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0047e0e0
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d798
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040540c
ret
Function at 0x47d7a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405868
xor eax, eax
push ebp
push 0x47d8a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.0047cd98
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x47d86f
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040ad68
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0047e068
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040ac28
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0047e0e0
jmp 0x47d881
xor edx, edx
mov eax, ebx
call fcn.0047e068
xor edx, edx
mov eax, ebx
call fcn.0047e0e0
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d8b0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040540c
ret

Function at 0x484198
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004843d4
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004843d4
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x48420c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x484232
inc esi
mov eax, edi
call fcn.004841f0
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, edi
call fcn.00484198
inc ebx
dec esi
jne 0x48421b
pop edi
pop esi
pop ebx
ret
Function at 0x4842c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405868
xor eax, eax
push ebp
push 0x48433e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00484238
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.004841f0
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.00484198
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x484308
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484345
lea eax, [ebp - 4]
call fcn.004053e8
ret
Function at 0x484fd8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4851be
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x48517a
mov eax, dword [ebp - 4]
call fcn.00486980
cmp ebx, eax
jge 0x48517a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.0047b77c
mov edx, dword [0x47d138]
call fcn.004046b8
mov esi, eax
mov eax, esi
call fcn.0047dffc
test al, al
je 0x485170
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x485164
xor eax, eax
push ebp
push 0x48515d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00485590
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041de88
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405b08
mov eax, dword [ebp - 8]
call fcn.004058d8
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00485354
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4851a8
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x48515c
mov eax, dword [ebp - 4]
call fcn.00485614
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040b1dc
jmp 0x4851a8
mov eax, dword [ebp - 8]
call fcn.004053e8
jmp 0x4851a8
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040a5b0
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x418b4c]
call fcn.0040e8f0
call fcn.00404d7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4851c5
lea eax, [ebp - 0x54]
call fcn.004053e8
ret
Function at 0x48a26c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x408494]
call fcn.00405ea0
xor eax, eax
push ebp
push 0x48a40d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c6fc0], 0
jne 0x48a2c7
mov ecx, dword [0x64af30]
mov dl, 1
mov eax, dword [0x408ad4]
call fcn.0040e970
call fcn.00404d7c
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403afc
mov eax, ebx
call fcn.00405d50
mov dword [ebp - 0x24], eax
mov esi, 0x48a41c
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406fa4
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405d60
test eax, eax
jle 0x48a3b0
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48a39c
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405658
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x48a342
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00405670
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x48a358
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00405670
mov eax, dword [ebp - 0x54]
call fcn.00405878
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405658
mov eax, dword [ebp - 0x58]
call fcn.00405878
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x48a39e
xor eax, eax
test al, al
je 0x48a3a9
mov ebx, 0x15
jmp 0x48a3b5
mov ebx, 0x10
jmp 0x48a3b5
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4c6fc0]
call fcn.0048a0ec
mov eax, dword [ebp - 4]
call fcn.0048a0ec
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406fbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a414
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.0040540c
lea eax, [ebp - 0xc]
mov edx, dword [0x408494]
call fcn.00405f70
ret

Function at 0x4af988
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4af9e2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004af978
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004ad5d0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004ad0e8
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af9e9
lea eax, [ebp - 4]
call fcn.004053e8
ret
Function at 0x4b7c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
xor edx, edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x4b7db5
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x4b7dc8
call fcn.004b7ad8
lea eax, [ebp - 0x3f0]
call fcn.004053e8
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.00405878
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4b7d7b
xor edx, edx
push ebp
push 0x4b7d74
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x3e9
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x4b7e08
call fcn.004b7ad8
mov eax, dword [ebp - 0x408]
call fcn.00405878
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4b7d5a
push ebp
mov eax, 0x4b7e34
call fcn.004b7bc8
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7d7b
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.0040543c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7dbc
lea eax, [ebp - 0x408]
call fcn.004053e8
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.0040540c
ret
Function at 0x4b7fd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
xor edx, edx
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x4b8194
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x4b81a8
call fcn.004b7e38
lea eax, [ebp - 0x3f0]
call fcn.004053e8
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.00405878
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4b8155
xor eax, eax
push ebp
push 0x4b814e
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x3e9
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
push 0x4b81e0
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4b80aa
push ebp
mov eax, 0x4b81fc
call fcn.004b7f28
pop ecx
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x4b8208
call fcn.004b7e38
mov eax, dword [ebp - 0x408]
call fcn.00405878
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4b8134
push dword [ebp - 0x3f0]
push 0x4b822c
lea eax, [ebp - 0x40c]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.00405658
push dword [ebp - 0x40c]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.0040577c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8155
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.0040543c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b819b
lea eax, [ebp - 0x40c]
mov edx, 2
call fcn.0040540c
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.0040540c
ret
Function at 0x4b88b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], edx
mov ebx, eax
xor eax, eax
mov dword [esp + 4], eax
test ebx, ebx
je 0x4b895c
mov eax, ebx
mov edx, dword [eax + 0x3c]
add edx, eax
mov eax, edx
mov esi, eax
mov edx, dword [esi + 0x78]
mov eax, ebx
call fcn.004b861c
mov esi, eax
mov ebp, dword [esi + 0x18]
dec ebp
test ebp, ebp
jb 0x4b895c
inc ebp
xor edi, edi
mov edx, dword [esi + 0x20]
mov eax, ebx
call fcn.004b861c
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
mov edx, dword [esp + 8]
mov eax, ebx
call fcn.004b861c
mov dword [esp + 0xc], eax
mov eax, dword [esp]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x4b8958
mov edx, dword [esi + 0x24]
mov eax, ebx
call fcn.004b861c
movzx eax, word [eax + edi*2]
mov word [esp + 0x10], ax
mov edx, dword [esi + 0x1c]
mov eax, ebx
call fcn.004b861c
movzx edx, word [esp + 0x10]
mov eax, dword [eax + edx*4]
mov edx, eax
mov eax, ebx
call fcn.004b861c
mov dword [esp + 4], eax
inc edi
dec ebp
jne 0x4b88f4
mov eax, dword [esp + 4]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4ba3dc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405868
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4ba544
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004920b4
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004920d4
mov ebx, eax
jmp 0x4ba516
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405658
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040ad68
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004098e4
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004098e4
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405810
je 0x4ba4f6
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405658
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004098e4
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004098e4
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00405810
jne 0x4ba50b
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.004920f4
mov ebx, eax
test ebx, ebx
jne 0x4ba457
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba54b
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040540c
lea eax, [ebp - 4]
call fcn.004053e8
ret
Function at 0x4baf94
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405868
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4bb106
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004920b4
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004920d4
mov ebx, eax
jmp 0x4bb0d8
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405658
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040ad68
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004098e4
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004098e4
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405810
je 0x4bb0ae
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405658
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004098e4
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004098e4
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00405810
jne 0x4bb0cd
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [edi + 8]
je 0x4bb0cd
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.004920f4
mov ebx, eax
test ebx, ebx
jne 0x4bb00f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb10d
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040540c
lea eax, [ebp - 4]
call fcn.004053e8
ret