joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f430
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4b1be0]
cmp dword [eax + 0x30], 0
je 0x45f4da
cmp dword [ebx + 0x94], 0
jne 0x45f4d4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45f3c0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45f4d4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45f49a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45f4d4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041c0b4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45f4a9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46003c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x460071
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404688
jmp 0x46007e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004045ec
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4610e8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x461129
mov eax, esi
call fcn.00447518
test al, al
je 0x461129
mov eax, dword [ebx + 0x84]
call fcn.00447214
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x461129
push 0
mov eax, dword [ebx + 0x84]
call fcn.00447214
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x462160
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb0
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebp, dword [esp + 0x14]
call sub.kernel32.dll_GetCurrentProcessId
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
xor edi, edi
mov ebx, dword [esp + 0xc]
shr ebx, 0x10
mov eax, ebx
shl eax, 0x10
mov ebx, eax
mov eax, edi
shl eax, 0x10
sub ebx, eax
mov eax, ebx
xor edx, edx
div ebp
imul ebp
mov ebx, eax
push 4
push 0x3000
push ebp
push ebx
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
test esi, esi
je 0x4621de
cmp esi, ebx
je 0x4621de
push 0x8000
push 0
push esi
call sub.kernel32.dll_VirtualFree_1
inc edi
jmp 0x462257
test esi, esi
jne 0x462260
push 0x1c
lea eax, [esp + 0x38]
push eax
push ebx
call sub.kernel32.dll_VirtualQuery_1
cmp dword [esp + 0x40], 0x118
jb 0x462254
mov eax, dword [esp + 0x48]
and eax, 4
cmp eax, 4
jne 0x462254
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
cmp edx, dword [ebx + 4]
jne 0x462254
cmp eax, dword [ebx]
jne 0x462254
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
cmp edx, dword [ebx + 0x114]
jne 0x462254
cmp eax, dword [ebx + 0x110]
jne 0x462254
lea eax, [ebx + 8]
mov edx, dword [esp]
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402f88
je 0x462260
inc edi
xor ebx, ebx
cmp edi, 0x14
jle 0x462197
xor eax, eax
test esi, esi
je 0x4622c6
cmp esi, ebx
jne 0x4622e2
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x23456789
xor edx, 0xabcdef01
mov dword [ebx], eax
mov dword [ebx + 4], edx
lea eax, [ebx + 8]
mov edx, dword [esp]
call fcn.00402edc
mov eax, dword [esp + 8]
xor edx, edx
xor eax, 0x10fedcba
xor edx, 0x98765432
mov dword [ebx + 0x110], eax
mov dword [ebx + 0x114], edx
mov dword [ebx + 0x108], 1
lea eax, [ebx + 0x118]
mov edx, dword [esp + 4]
mov dword [edx], 1
jmp 0x4622e2
test ebx, ebx
je 0x4622e2
inc dword [ebx + 0x108]
lea eax, [ebx + 0x118]
mov edx, dword [esp + 4]
mov ecx, dword [ebx + 0x108]
mov dword [edx], ecx
add esp, 0x50
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x464220
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x464298
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
push eax
mov eax, esi
call fcn.00404a58
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x464282
lea eax, [ebp - 8]
mov edx, edi
call fcn.00404be4
mov eax, dword [ebp - 8]
call fcn.00404a58
push eax
push edi
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.00404a58
push eax
call sub.version.dll_GetFileVersionInfoA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46429f
lea eax, [ebp - 8]
call fcn.00404598
ret
Function at 0x4642a8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x46434f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404a58
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x464339
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404be4
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404a58
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x464339
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x464360
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x464339
cmp dword [ebp - 8], 0x34
jne 0x464339
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464356
lea eax, [ebp - 0x10]
call fcn.00404598
ret

Function at 0x464364
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x464379
add esp, 0xfffffff0
call fcn.00403b50
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, edi
call fcn.00404a58
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x4643ae
mov ecx, dword [0x4b00e4]
mov dl, 1
mov eax, dword [0x463d98]
call fcn.0040cb3c
call fcn.00403fb8
lea eax, [ebx + 4]
mov edx, esi
call fcn.00404be4
mov eax, dword [ebx + 4]
call fcn.00404a58
push eax
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, edi
call fcn.00404a58
push eax
call sub.version.dll_GetFileVersionInfoA
call fcn.0040e15c
mov eax, ebx
call fcn.004649a8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4643f6
call fcn.00403ba8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x465da8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x465e24
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4b051c]
cmp dword [eax], 2
jne 0x465df8
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404dc4
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov eax, dword [ebp - 4]
call fcn.00404e40
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
jmp 0x465e0e
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465e2b
lea eax, [ebp - 4]
call fcn.00404ca4
ret
Function at 0x465f6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x465f86
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 1], 1
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
call fcn.00404598
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, esi
call fcn.00404a58
mov edx, eax
mov eax, ebx
call fcn.00465c40
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4660ce
xor eax, eax
push ebp
push 0x4660c7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, edi
call fcn.00404a58
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x466099
mov ax, word [0x4660f0]
mov word [ebp - 0x12], ax
cmp byte [ebp + 0x10], 0
je 0x466017
mov ax, word [0x4660f4]
or ax, word [ebp - 0x12]
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0xc]
cmp eax, 0xf
ja 0x466023
bt dword [ebp - 0x12], eax
jb 0x466030
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.00465b98
mov edx, dword [ebp - 0x10]
shr edx, 0
inc edx
mov eax, dword [ebp + 0xc]
call fcn.00404be4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
push 0
push 0
mov eax, edi
call fcn.00404a58
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x466088
mov eax, dword [ebp + 0xc]
call fcn.00404598
cmp byte [ebp + 8], 0
je 0x46607d
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.00465b10
jmp 0x466088
mov byte [ebp - 1], 0
mov dword [ebp - 0x10], 1
mov edx, dword [ebp - 0x10]
dec edx
shr edx, 0
mov eax, dword [ebp + 0xc]
call fcn.00404be4
jmp 0x4660b0
cmp byte [ebp + 8], 0
je 0x4660ac
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.00465b10
jmp 0x4660b0
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4660e3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
cmp byte [ebp + 8], 0
je 0x4660df
mov edx, esi
mov eax, ebx
call fcn.00465a18
jmp 0x4660e3
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4660f8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov edx, esi
mov eax, ebx
call fcn.004665bc
test al, al
jne 0x46611b
mov edx, esi
mov eax, ebx
call fcn.004661ac
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
mov eax, esi
call fcn.00404a58
mov edx, eax
mov eax, ebx
call fcn.00465c40
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46619b
xor eax, eax
push ebp
push 0x466194
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
xor eax, eax
mov al, byte [ebp + 0x10]
push eax
push 0
mov eax, edi
call fcn.00404a58
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x46617d
mov edx, esi
mov eax, ebx
call fcn.00465a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4661a4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov edx, esi
mov eax, ebx
call fcn.00465a94
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x4661e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call fcn.00404a58
mov edx, eax
mov eax, ebx
call fcn.00465c40
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
sete al
mov ebx, eax
test bl, bl
je 0x46624b
push 0
push 0
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.00404a58
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x466ec4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x466fac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404598
lea eax, [ebp - 0x194]
push eax
mov dl, 1
mov al, 1
call fcn.004075a8
push eax
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x466f96
xor edx, edx
push ebp
push 0x466f8f
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404630
cmp dword [ebp - 4], 0
jne 0x466f49
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00404be4
push 0x104
mov eax, dword [ebp - 4]
call fcn.00404a58
push eax
call sub.wsock32.dll_gethostname
mov eax, dword [ebp - 4]
call fcn.00404a58
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x466f7c
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1a0], eax
push dword [ebp - 0x1a0]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.00404790
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466f96
call sub.wsock32.dll_WSACleanup
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466fb3
lea eax, [ebp - 4]
call fcn.00404598
ret

Function at 0x467114
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.00404a58
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404a58
mov edi, eax
push edi
push 0
call sub.advapi32.dll_LookupAccountNameA
mov edx, dword [ebp - 8]
inc edx
mov eax, ebx
call fcn.00404be4
mov eax, dword [ebp - 4]
call fcn.00408924
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4671d6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.00404a58
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
push edi
push 0
call sub.advapi32.dll_LookupAccountNameA
test eax, eax
je 0x4671b1
mov eax, ebx
call fcn.00463a34
jmp 0x4671c0
mov eax, ebx
mov edx, dword [0x4b0380]
mov edx, dword [edx]
call fcn.004045ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4671dd
mov eax, dword [ebp - 0xc]
call fcn.004027d8
ret
Function at 0x4676f8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff3c
push ebx
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x467920
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xa0]
xor ecx, ecx
mov edx, 0x9c
call fcn.00403030
lea eax, [ebp - 0xc4]
xor ecx, ecx
mov edx, 0x24
call fcn.00403030
mov dword [ebp - 0xa0], 0x9c
lea eax, [ebp - 0xc4]
call fcn.0046800c
cmp byte [0x4ae360], 0
je 0x4677a0
call fcn.004679b4
cmp eax, 6
jl 0x4677a0
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA_1
test eax, eax
je 0x4678ab
cmp byte [ebp - 6], 1
jne 0x467784
mov bl, 1
jmp 0x4678ab
mov ax, word [ebp - 8]
and ax, 2
cmp ax, 2
jne 0x467799
mov bl, 7
jmp 0x4678ab
mov bl, 2
jmp 0x4678ab
cmp byte [0x4ae364], 0
je 0x4677ee
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA_1
test eax, eax
je 0x4678ab
mov al, byte [ebp - 6]
add al, 0xfe
sub al, 2
jae 0x4677e7
mov ax, word [ebp - 8]
test al, 0x80
je 0x4677d5
mov bl, 6
jmp 0x4678ab
test al, 2
je 0x4677e0
mov bl, 3
jmp 0x4678ab
mov bl, 2
jmp 0x4678ab
mov bl, 5
jmp 0x4678ab
cmp byte [0x4ae370], 0
jne 0x467809
cmp byte [0x4ae36c], 0
jne 0x467809
cmp byte [0x4ae374], 0
je 0x467866
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA_1
test eax, eax
je 0x4678ab
mov al, byte [ebp - 6]
mov edx, eax
add dl, 0xfe
sub dl, 2
jae 0x46785e
mov ax, word [ebp - 8]
mov edx, eax
and dx, 0x80
cmp dx, 0x80
jne 0x467840
mov bl, 6
jmp 0x4678ab
mov edx, eax
and dx, 2
cmp dx, 2
jne 0x467850
mov bl, 7
jmp 0x4678ab
cmp ax, 0x400
jne 0x46785a
mov bl, 8
jmp 0x4678ab
mov bl, 2
jmp 0x4678ab
cmp al, 1
jne 0x4678ab
mov bl, 5
jmp 0x4678ab
cmp byte [0x4ae368], 0
jne 0x467881
cmp byte [0x4ae378], 0
jne 0x467881
cmp byte [0x4ae37c], 0
je 0x4678ab
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA_1
test eax, eax
je 0x4678ab
cmp byte [ebp - 6], 1
jne 0x4678ab
mov ax, word [ebp - 8]
and ax, 0x200
cmp ax, 0x200
jne 0x4678a9
mov bl, 4
jmp 0x4678ab
mov bl, 5
test bl, bl
jne 0x46790a
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x467938
mov edx, 0x46794c
mov eax, 0x80000002
call fcn.004663cc
mov edx, 0x467984
mov eax, dword [ebp - 4]
call fcn.00408a70
test eax, eax
jne 0x4678de
mov bl, 1
jmp 0x46790a
mov edx, 0x467994
mov eax, dword [ebp - 4]
call fcn.00408a70
test eax, eax
jne 0x4678f3
mov bl, 3
jmp 0x46790a
mov edx, 0x4679a8
mov eax, dword [ebp - 4]
call fcn.00408a70
test eax, eax
jne 0x467908
mov bl, 2
jmp 0x46790a
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467927
lea eax, [ebp - 4]
call fcn.00404598
ret
Function at 0x46a828
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
mov eax, esp
xor ecx, ecx
mov edx, 0x24
call fcn.00403030
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0xc]
add esp, 0x24
ret

Function at 0x46a848
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
mov eax, esp
xor ecx, ecx
mov edx, 0x24
call fcn.00403030
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 8]
add esp, 0x24
ret

Function at 0x46a868
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov ebx, edx
mov esi, eax
push esp
call sub.user32.dll_GetKeyboardState
test eax, eax
je 0x46a883
test byte [esp + esi], bl
jne 0x46a887
xor eax, eax
jmp 0x46a889
mov al, 1
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46a8e8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46aaa8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.00403030
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x4ae858], eax
mov eax, dword [ebp - 0xc]
mov dword [0x4ae85c], eax
mov eax, dword [ebp - 0x24]
mov dword [0x4ae860], eax
mov eax, dword [0x4b051c]
cmp dword [eax], 2
sete byte [0x4ae34c]
push 0x46aab4
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.004641f0
cmp byte [0x4ae34c], 0
jne 0x46a974
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.004642a8
test al, al
je 0x46a974
mov eax, dword [ebp - 0x4c]
mov dword [0x4b21c0], eax
jmp 0x46a97b
xor eax, eax
mov dword [0x4b21c0], eax
call fcn.004674fc
and eax, 0x7f
cmp eax, 0x10
ja case.0x46a98c.0
jmp dword [eax*4 + 0x46a993]
mov byte [0x4ae338], 1
jmp case.0x46a98c.0
mov byte [0x4ae33c], 1
jmp case.0x46a98c.0
mov byte [0x4ae340], 1
jmp case.0x46a98c.0
mov byte [0x4ae344], 1
jmp case.0x46a98c.0
mov byte [0x4ae348], 1
jmp case.0x46a98c.0
mov byte [0x4ae350], 1
mov byte [0x4ae354], 1
jmp case.0x46a98c.0
mov byte [0x4ae350], 1
mov byte [0x4ae358], 1
jmp case.0x46a98c.0
mov byte [0x4ae350], 1
mov byte [0x4ae358], 1
mov byte [0x4ae35c], 1
jmp case.0x46a98c.0
mov byte [0x4ae360], 1
jmp case.0x46a98c.0
mov byte [0x4ae364], 1
jmp case.0x46a98c.0
mov byte [0x4ae368], 1
jmp case.0x46a98c.0
mov byte [0x4ae36c], 1
jmp case.0x46a98c.0
mov byte [0x4ae370], 1
jmp case.0x46a98c.0
mov byte [0x4ae374], 1
jmp case.0x46a98c.0
mov byte [0x4ae378], 1
jmp case.0x46a98c.0
mov byte [0x4ae37c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46aaaf
lea eax, [ebp - 4]
call fcn.00404598
ret
Function at 0x470a08
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x470a36
mov eax, ebx
call fcn.004714bc
cmp dword [ebx + 0x40], 0
je 0x470a2f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x470aa7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x470a99
cmp dword [ebx + 8], 0
je 0x470a58
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x470a6a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x470a99
cmp dword [ebx + 8], 0
je 0x470a4b
cmp eax, 3
je 0x470a7d
dec eax
jne 0x470a4b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x470a4b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x470a4b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x470ac5
cmp dword [ebx + 0x14], 0xcc
je 0x470ac5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00470ad0
pop ebx
ret

Function at 0x48afcc
Capabilities:
Change the wallpaper

Disassembly:
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [0x4af83c], 0
jne 0x48b003
cmp byte [eax + 4], 0
jne 0x48b003
mov dword [esp], 0x14
push 3
lea eax, [esp + 4]
push eax
push 0x14
push 0x2c
call sub.user32.dll_SystemParametersInfoA
jmp 0x48b00a
xor eax, eax
call fcn.00487edc
add esp, 0x14
pop edi
pop esi
ret

Function at 0x48dd14
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x10]
call fcn.00404a58
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x48df30
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
push 0x103
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.00404a58
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, esi
mov edx, esp
mov ecx, 0x105
call fcn.00404808
add esp, 0x108
pop esi
pop ebx
ret