joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472780
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x472855
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dabb8]
cmp byte [eax], 0
je 0x4727d8
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00405ae0
mov eax, dword [ebp - 4]
call fcn.00471f0c
push eax
push ebx
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
jmp 0x472832
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 8]
mov edx, dword [ebp + 0xc]
call fcn.004053a4
mov eax, dword [ebp - 8]
call fcn.00471ef8
push eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 0x10]
call fcn.004053a4
mov eax, dword [ebp - 0xc]
call fcn.00471ef8
push eax
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.004053a4
mov eax, dword [ebp - 0x10]
call fcn.00471ef8
push eax
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.004053a4
mov eax, dword [ebp - 0x14]
call fcn.00471ef8
push eax
push ebx
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47285c
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004051a0
lea eax, [ebp - 4]
call fcn.00405984
ret

Function at 0x473700
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x473764
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004053ec
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.0040a414
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47376b
lea eax, [ebp - 0xc]
call fcn.0040517c
ret

Function at 0x473804
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x473860
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x47382f
call fcn.0040f884
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.004030f0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x473860
call fcn.0040f884
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x495c04
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x495d89
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, byte [ebx + 0x2be]
sub al, 2
jb 0x495d6e
cmp byte [ebx + 0x2b0], 0
je 0x495d6e
mov eax, dword [ebp - 4]
call fcn.0049c73c
mov word [ebp - 6], ax
xor eax, eax
push ebp
push 0x495d67
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp - 6]
sub ax, 8
je 0x495cab
dec ax
je 0x495c81
sub ax, 0x12
jne 0x495cc5
call fcn.00404b74
jmp 0x495d6e
cmp byte [ebx + 0x2b1], 0
je 0x495d4d
mov eax, ebx
call fcn.004394f4
test al, al
je 0x495d4d
xor edx, edx
mov eax, ebx
call fcn.00439518
jmp 0x495d4d
mov eax, dword [esi]
call fcn.00405b7c
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00405d70
jmp 0x495d4d
cmp byte [ebx + 0x2b1], 0
je 0x495ce2
mov eax, ebx
call fcn.004394f4
test al, al
jne 0x495ce2
mov dl, 1
mov eax, ebx
call fcn.00439518
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 8]
sub eax, dword [edx]
cmp eax, 0x4e2
jb 0x495cfa
mov eax, esi
call fcn.00405984
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0
push 1
lea eax, [ebp - 0x10]
movzx edx, word [ebp - 6]
call fcn.00405aa0
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi]
lea eax, [ebp - 0xc]
call fcn.00405be8
mov ecx, dword [ebp - 0xc]
mov edx, edi
mov eax, ebx
call fcn.00495a18
test al, al
je 0x495d4d
lea eax, [ebp - 0x14]
movzx edx, word [ebp - 6]
call fcn.00405aa0
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00405b88
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495d6e
mov eax, dword [ebp - 4]
movzx edx, word [ebp - 6]
call fcn.0049c770
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495d90
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040599c
ret

Function at 0x4998d0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00405984
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x49991e
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405b40
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x499924
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x49995c
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x49995c
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x49995c
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x49a444
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49a5d6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 8]
mov dword [edx + 0xbc], eax
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
test esi, esi
jne 0x49a485
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x49a4a2
mov edi, dword [esi + 0x6c]
test edi, edi
je 0x49a498
mov eax, edi
call fcn.004437b8
mov dword [ebp - 4], eax
jmp 0x49a4a2
mov eax, esi
call fcn.004437b8
mov dword [ebp - 4], eax
mov eax, dword [0x4dabb8]
cmp byte [eax], 0
je 0x49a5bb
mov eax, dword [ebp - 8]
cmp dword [eax + 0x64], 0
je 0x49a5bb
test ebx, ebx
je 0x49a5bb
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x1c]
and ax, word [0x49a5e4]
movzx edx, word [0x49a5e8]
cmp dx, ax
jne 0x49a5bb
mov eax, dword [ebp - 8]
cmp byte [eax + 0x3e], 0
je 0x49a5bb
push ebp
call fcn.0049a2e4
pop ecx
test al, al
je 0x49a5bb
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0049a0f8
mov eax, dword [ebp - 8]
call fcn.00446304
test eax, eax
jne 0x49a569
mov eax, dword [ebp - 8]
cmp word [eax + 0x60], 0
je 0x49a569
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
test esi, esi
je 0x49a542
cmp dword [esi + 0x64], 0
jne 0x49a542
mov eax, dword [esi + 4]
mov edx, dword [0x4420d0]
call fcn.00404378
test al, al
jne 0x49a569
push dword [ebp - 0xc]
push 0x49a5f0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x60]
call fcn.00499964
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405c58
push ebp
lea eax, [ebp - 0x14]
call fcn.0049a340
pop ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00405ca0
je 0x49a5bb
push ebp
mov eax, dword [ebp - 0xc]
call fcn.0049a3b4
pop ecx
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
cmp esi, dword [ebx + 0x34]
je 0x49a59b
cmp dword [esi + 0x6c], 0
je 0x49a5bb
mov eax, ebx
mov edx, dword [0x4420d0]
call fcn.00404378
test al, al
je 0x49a5bb
cmp dword [ebx + 0x38], 0
je 0x49a5bb
mov eax, dword [ebx + 0x38]
push eax
call sub.user32.dll_DrawMenuBar
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a5dd
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040599c
ret

Function at 0x4a70cc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4e10fc
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4a70ee
shr eax, 1
xor eax, 0xedb88320
jmp 0x4a70f0
shr eax, 1
dec edx
jne 0x4a70dc
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4a70d5
mov byte [0x4e14fc], 1
pop esi
pop ebx
ret

Function at 0x4a710c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4e14fc], 0
jne 0x4a7123
call fcn.004a70cc
mov eax, edi
dec eax
test eax, eax
jl 0x4a714b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4e10fc]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4a712d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4a9574
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x45d]
movzx ecx, dl
cmp ecx, 6
ja case.0x4a960e.0
jmp dword [ecx*4 + 0x4a95a7]
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x4a95d9
sub dl, 8
je 0x4a95e8
jmp case.0x4a960e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a9304
jmp case.0x4a960e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a9350
jmp case.0x4a960e.0
movzx ecx, byte [eax + 0x45c]
cmp ecx, 0x10
ja case.0x4a960e.0
movzx ecx, byte [ecx + 0x4a9615]
jmp dword [ecx*4 + 0x4a9626]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a93a0
jmp case.0x4a960e.0
cmp dl, 3
jne 0x4a9653
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a93f4
jmp case.0x4a960e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a93b0
jmp case.0x4a960e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a9438
jmp case.0x4a960e.0
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x4a967e
sub dl, 8
je 0x4a968a
jmp case.0x4a960e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a9454
jmp case.0x4a960e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a94b8
jmp case.0x4a960e.0
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x4a96a9
sub dl, 8
je 0x4a96b5
jmp case.0x4a960e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a9520
jmp case.0x4a960e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a9548
mov esi, dword [eax + 0x448]
mov edx, dword [ebx + 0x1c]
dec edx
imul esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0xc], esi
mov eax, dword [eax + 0x450]
mov dword [ebp - 8], eax
mov esi, edx
test esi, esi
jb 0x4a9745
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004a8920
test eax, eax
je 0x4a9745
mov eax, ebx
call fcn.004a9750
mov eax, dword [ebp - 8]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x448]
sub dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x4a96e5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a9750
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4a9781
dec al
je 0x4a97bc
dec al
je 0x4a9801
dec al
je 0x4a986a
jmp 0x4a98f4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4a98f4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a9791
jmp 0x4a98f4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a98f4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a97cc
jmp 0x4a98f4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a98f4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4a9830
xor ebp, ebp
jmp 0x4a9840
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4a9849
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a9811
jmp 0x4a98f4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a98f4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4a98c3
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004a7154
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a987e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ad168
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ad2d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dabb8]
cmp byte [eax], 0
jne 0x4ad1c3
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00405404
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov eax, ebx
call fcn.00429ae8
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00405b5c
jmp 0x4ad2aa
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00405b6c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x4ad1f5
mov eax, esi
call fcn.00405984
jmp 0x4ad2aa
mov eax, dword [ebp - 4]
dec eax
sub eax, 2
jb 0x4ad22c
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 0xf
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x1c]
mov eax, dword [0x4dad58]
call fcn.004073e4
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x429470]
call fcn.0040e0f8
call fcn.00404ac8
cmp dword [ebp - 8], 1
jne 0x4ad239
mov dword [ebp - 8], 2
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, esi
call fcn.00405eec
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
call fcn.00405b6c
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00405b6c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x4ad29a
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 0xf
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x4db1cc]
call fcn.004073e4
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x429470]
call fcn.0040e0f8
call fcn.00404ac8
mov eax, dword [esi]
call fcn.00405b6c
mov edx, eax
mov eax, esi
call fcn.00405ae0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad2d9
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004051a0
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004051a0
ret
Function at 0x4ad2e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4ad3ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dabb8]
cmp byte [eax], 0
jne 0x4ad36b
cmp dword [ebp - 4], 1
jne 0x4ad346
lea eax, [ebp - 8]
mov edx, esi
call fcn.00405404
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.00405404
mov edx, dword [ebp - 0xc]
mov eax, ebx
pop ecx
call fcn.00429a88
jmp 0x4ad3c7
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.00405404
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00405404
mov edx, dword [ebp - 0x14]
mov eax, ebx
pop ecx
call fcn.00429ab8
jmp 0x4ad3c7
mov eax, esi
call fcn.00405b7c
inc eax
add eax, eax
push eax
mov eax, esi
call fcn.00405b6c
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00405b6c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x4ad3c7
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], 0xf
lea eax, [ebp - 0x1c]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x4dae8c]
call fcn.004073e4
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x429470]
call fcn.0040e0f8
call fcn.00404ac8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad3f1
lea eax, [ebp - 0x20]
call fcn.0040517c
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004051a0
ret
Function at 0x4ae6d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.00405f30
lea eax, [ebp - 8]
call fcn.00405f30
lea eax, [ebp - 0xc]
call fcn.00405f30
xor eax, eax
push ebp
push 0x4ae8df
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004059c0
xor eax, eax
push ebp
push 0x4ae84c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405b6c
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x4ae842
xor eax, eax
push ebp
push 0x4ae83b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405b6c
mov esi, eax
push esi
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4ae824
cmp dword [ebp - 0x10], 7
jne 0x4ae824
mov eax, dword [ebp - 0x14]
call fcn.00402f00
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4ae81d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
push esi
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4ae807
mov esi, dword [ebp - 0x18]
jmp 0x4ae801
push dword [ebx]
lea eax, [ebp - 0x20]
mov edx, esi
call fcn.00405ae0
push dword [ebp - 0x20]
push 0x4ae8f4
mov eax, ebx
mov edx, 3
call fcn.00405c58
push esi
call sub.kernel32.dll_lstrlenW
inc eax
add eax, eax
add esi, eax
cmp word [esi], 0
jne 0x4ae7d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae824
mov eax, dword [ebp - 0x18]
call fcn.00402f1c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae842
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ae8a7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae8e6
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.0040599c
lea eax, [ebp - 0x24]
call fcn.0040517c
lea eax, [ebp - 0x20]
call fcn.00405984
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040599c
ret
Function at 0x4c44d4
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c45c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dace8]
cmp dword [eax], 5
jl 0x4c4539
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405eec
push 0
push 0x26
mov eax, dword [ebp - 4]
call fcn.00405b6c
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x4c4530
mov eax, dword [ebp - 4]
call fcn.00405b6c
mov edx, eax
mov eax, ebx
call fcn.00405ae0
jmp 0x4c454b
mov eax, ebx
call fcn.00405984
jmp 0x4c454b
lea eax, [ebp - 8]
call fcn.004c4410
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405b5c
mov eax, dword [ebx]
xor edx, edx
call fcn.00405ca0
jbe 0x4c4573
mov eax, dword [ebx]
call fcn.00405b7c
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4c4573
mov eax, ebx
mov edx, 0x4c45d0
call fcn.00405b88
mov ecx, dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 0x4c45d8
call fcn.00405be8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405404
mov eax, dword [ebp - 0xc]
call fcn.004c4130
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c45c7
lea eax, [ebp - 0x10]
call fcn.00405984
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004051a0
lea eax, [ebp - 4]
call fcn.00405984
ret

Function at 0x4c47e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c48d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dace8]
cmp dword [eax], 5
jl 0x4c4849
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405eec
push 0
push 0x1c
mov eax, dword [ebp - 4]
call fcn.00405b6c
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x4c4840
mov eax, dword [ebp - 4]
call fcn.00405b6c
mov edx, eax
mov eax, ebx
call fcn.00405ae0
jmp 0x4c485b
mov eax, ebx
call fcn.00405984
jmp 0x4c485b
lea eax, [ebp - 8]
call fcn.004c470c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405b5c
mov eax, dword [ebx]
xor edx, edx
call fcn.00405ca0
jbe 0x4c4883
mov eax, dword [ebx]
call fcn.00405b7c
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4c4883
mov eax, ebx
mov edx, 0x4c48e0
call fcn.00405b88
mov ecx, dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 0x4c48e8
call fcn.00405be8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405404
mov eax, dword [ebp - 0xc]
call fcn.004c4130
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c48d7
lea eax, [ebp - 0x10]
call fcn.00405984
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004051a0
lea eax, [ebp - 4]
call fcn.00405984
ret