joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475208
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x5046f4]
cmp byte [eax + 0xc], 0
je 0x475375
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47536e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x505bcc], 0
jne 0x47525c
push 0x47537c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x475384
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x505bcc], eax
cmp dword [0x5031c0], 0
jne 0x475357
push 0x475394
call sub.kernel32.dll_LoadLibraryA
mov dword [0x5031c0], eax
cmp dword [0x5031c0], 0
je 0x475357
push 0x4753a0
mov eax, dword [0x5031c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x505bd0], eax
push 0x4753b0
mov eax, dword [0x5031c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x505bd4], eax
push 0x4753c4
mov eax, dword [0x5031c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x505bd8], eax
push 0x4753dc
mov eax, dword [0x5031c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x505bdc], eax
push 0x4753f4
mov eax, dword [0x5031c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x505be0], eax
push 0x475408
mov eax, dword [0x5031c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x505be4], eax
push 0x475420
mov eax, dword [0x5031c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x505be8], eax
push 0x475438
mov eax, dword [0x5031c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x505bec], eax
push 0x475454
mov eax, dword [0x5031c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x505bf0], eax
push 0x475460
mov eax, dword [0x5031c0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x505bf4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475375
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x479f04
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404960
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x479f53
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404be0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x481748
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x481798]
test si, 4
je 0x48175c
or bl, 1
test si, 8
je 0x481766
or bl, 4
test si, 1
je 0x481770
or bl, 8
test si, 2
je 0x48177a
or bl, 0x10
test si, 0x10
je 0x481784
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x481793
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x48179c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4817d4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4817b5
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4817c4
or bl, 4
test esi, 0x20000000
je 0x4817cf
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x486794
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x486822
mov ax, word [esi + 4]
sub ax, 9
je 0x4867bb
add eax, 0xffffffe4
sub ax, 4
jb 0x4867ed
jmp 0x486822
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x486822
push 1
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
setge cl
mov edx, dword [ebx + 0x220]
mov eax, ebx
call fcn.00470d1c
mov dword [esi + 0xc], 1
pop esi
pop ebx
ret
mov eax, dword [ebx + 0x220]
test eax, eax
je 0x48682b
push 0
mov dx, word [esi + 4]
cmp dx, 0x27
je 0x48680d
cmp dx, 0x28
je 0x48680d
xor ecx, ecx
jmp 0x48680f
mov cl, 1
mov edx, dword [eax + 0x30]
xchg edx, eax
call fcn.00470d1c
mov dword [esi + 0xc], 1
pop esi
pop ebx
ret
mov edx, esi
mov eax, ebx
call fcn.0046fc64
pop esi
pop ebx
ret

Function at 0x4881dc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4881ee
add esp, 0xfffffff0
call fcn.00403e88
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004279d0
mov eax, dword [0x5040dc]
mov dword [eax + 4], ebx
mov dword [eax], 0x488580
mov eax, dword [0x5040f4]
mov dword [eax + 4], ebx
mov dword [eax], 0x48858c
mov eax, ebx
call fcn.00488598
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41c050]
call fcn.00403ae0
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41c050]
call fcn.00403ae0
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41c050]
call fcn.00403ae0
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41c050]
call fcn.00403ae0
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41c050]
call fcn.00403ae0
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x48466c
push eax
push 0
push 0
mov eax, dword [0x504350]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4294b4]
call fcn.0042ac4c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4294b4]
call fcn.0042ac4c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4294b4]
call fcn.0042ac4c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00488a30
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4888f8
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4888f8
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4888f8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x48832b
call fcn.00403ee0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4886dc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x488887
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x488868
mov dl, 1
mov eax, dword [0x41c6b4]
call fcn.00403ae0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404960
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x488857
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00475568
test al, al
je 0x48884a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x488898
lea eax, [ebp - 0x254]
call fcn.0040ac9c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x48884a
xor eax, eax
push ebp
push 0x488843
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4888d0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x48882c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404be0
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x48882c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404be0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48884a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x48874d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00421304
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48888e
lea eax, [ebp - 0x260]
call fcn.00404960
ret

Function at 0x4891d0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x505c18]
cmp byte [eax + 0xa5], 0
jne 0x489241
cmp dword [0x505c30], 0
jne 0x489202
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x48918c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x505c30], eax
cmp dword [0x505c2c], 0
jne 0x48921d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x505c2c], eax
cmp dword [0x505c34], 0
jne 0x489241
push esp
push 0
push 0
push 0x489130
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x505c34], eax
pop edx
ret
Function at 0x48997c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x505c18]
cmp dword [eax + 0x30], 0
je 0x489a26
cmp dword [ebx + 0x94], 0
jne 0x489a20
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x48990c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x489a20
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4899e6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x489a20
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041e978
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4899f5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x48a584
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x48a5b9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404a50
jmp 0x48a5c6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004049b4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x48b6f0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x48b731
mov eax, esi
call fcn.00470aec
test al, al
je 0x48b731
mov eax, dword [ebx + 0x84]
call fcn.004707e8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x48b731
push 0
mov eax, dword [ebx + 0x84]
call fcn.004707e8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4a26f4
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
test dl, dl
je 0x4a270d
add esp, 0xfffffff0
call fcn.00403e88
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a2782
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.0041f2e4
xor edx, edx
mov eax, esi
call fcn.004a2818
xor edx, edx
mov eax, esi
call fcn.004a283c
xor eax, eax
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 0x28], eax
xor eax, eax
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x10]
call fcn.00419c50
lea edx, [ebp - 0x10]
lea eax, [esi + 0x18]
call fcn.00411d08
mov byte [esi + 0x39], 0
mov byte [esi + 0x30], 1
lea eax, [esi + 0x10]
call fcn.00404960
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2789
lea eax, [ebp - 0x10]
call fcn.004119e0
ret
Function at 0x4a771c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00404960
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call fcn.00404e30
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4a77b9
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0x400
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.00404fbc
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.00404e88
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404e30
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4a7798
xor eax, eax
mov dword [ebp - 0xc], eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jge 0x4a77a6
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.00404fbc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4a77c4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a7887
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41c6b4]
call fcn.00403ae0
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov eax, esi
call fcn.00404e30
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4a7871
xor esi, esi
mov dword [ebp - 8], 0x400
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404fbc
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
call fcn.00404e88
push eax
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x4a7863
cmp dword [ebp - 8], 0
jbe 0x4a7863
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404fbc
mov edx, dword [ebp - 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
test ebx, ebx
je 0x4a7811
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a788e
lea eax, [ebp - 0xc]
call fcn.00404960
ret
Function at 0x4ac3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e20
xor eax, eax
push ebp
push 0x4ac478
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x3e8
call fcn.0040332c
add eax, 0x7d0
mov dword [ebp - 0xc], eax
mov eax, esi
call fcn.00404960
mov eax, dword [ebp - 4]
call fcn.00404c30
mov edi, eax
test edi, edi
jle 0x4ac43e
mov ebx, 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
shl eax, 4
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
add eax, eax
lea eax, [eax + eax*4]
add eax, dword [ebp - 0xc]
xor eax, dword [ebp - 8]
add eax, 0x3e8
call fcn.00409afc
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.00404c38
inc ebx
dec edi
jne 0x4ac408
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00409afc
mov edx, dword [ebp - 0x14]
mov ecx, dword [esi]
mov eax, esi
call fcn.00404c7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac47f
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404984
lea eax, [ebp - 4]
call fcn.00404960
ret
Function at 0x4ac6c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404e20
xor eax, eax
push ebp
push 0x4ac842
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
cmp dword [ebp - 4], 0
je 0x4ac814
cmp dword [ebp - 4], 0
je 0x4ac72f
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x4ac72f
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00404ed0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00404e30
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4ac814
mov dword [ebp - 0x14], 1
xor ebx, ebx
lea eax, [ebp - 0x18]
call fcn.00404960
mov dword [ebp - 0x10], 0x101
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x119]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
lea edx, [ebp - 0x124]
mov eax, ebx
call fcn.00409afc
mov ecx, dword [ebp - 0x124]
lea eax, [ebp - 0x120]
mov edx, 0x4ac85c
call fcn.00404c7c
mov eax, dword [ebp - 0x120]
call fcn.00404e30
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4ac800
lea eax, [ebp - 0x128]
lea edx, [ebp - 0x119]
mov ecx, 0x101
call fcn.00404be0
mov eax, dword [ebp - 0x128]
lea edx, [ebp - 0x18]
call fcn.004ac488
mov eax, dword [esi + 0x18]
test eax, eax
je 0x4ac7e9
cmp eax, ebx
jle 0x4ac800
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [0x505f18]
call fcn.004ac188
inc ebx
cmp dword [ebp - 0x18], 0
jne 0x4ac75e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac849
lea eax, [ebp - 0x128]
mov edx, 3
call fcn.00404984
lea eax, [ebp - 0x18]
call fcn.00404960
lea eax, [ebp - 4]
call fcn.00404960
ret
Function at 0x4aca04
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4aca0c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404e20
xor eax, eax
push ebp
push 0x4acbc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
cmp dword [ebp - 8], 0
je 0x4acb9e
call fcn.00403000
cmp dword [ebp - 8], 0
je 0x4aca66
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x4aca66
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.00404ed0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404e30
push eax
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x4acb9e
xor esi, esi
jmp 0x4aca9b
inc esi
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.00409afc
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x4acbdc
call fcn.00404c7c
mov eax, dword [ebp - 0x1c]
call fcn.00404e30
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
je 0x4aca9a
mov eax, dword [ebp - 4]
call fcn.004ac154
mov edi, eax
dec edi
test edi, edi
jl 0x4acb95
inc edi
xor esi, esi
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004acc0c
mov ebx, eax
push dword [ebx + 0xc]
push 0x4acbec
push dword [ebx + 0x10]
push 0x4acbf8
push dword [ebx + 0x14]
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00404cf0
cmp dword [ebx + 0x18], 0
je 0x4acb2b
push dword [ebp - 0x18]
push 0x4acc04
push dword [ebx + 0x18]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404cf0
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
call fcn.004ac3b0
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x18]
call fcn.004049f8
mov eax, dword [ebp - 0x18]
call fcn.00404c30
push eax
lea eax, [ebp - 0x18]
call fcn.00404e88
push eax
push 1
push 0
lea edx, [ebp - 0x2c]
mov eax, esi
call fcn.00409afc
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x4acbdc
call fcn.00404c7c
mov eax, dword [ebp - 0x28]
call fcn.00404e30
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
not eax
test eax, eax
jne 0x4acb8d
mov byte [ebp - 9], 0
inc esi
dec edi
jne 0x4acae1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acbc8
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.00404984
lea eax, [ebp - 8]
call fcn.00404960
ret
Function at 0x4eaac4
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.004e9c80
test al, al
je 0x4eaae6
mov eax, edi
call fcn.00404960
jmp 0x4eabf4
mov eax, ebx
call fcn.004eaa7c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4eabed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004ea864
mov eax, dword [ebx + 0x68]
mov ecx, 0x6c
mov edx, 0x4eac04
call fcn.004e1304
mov eax, dword [ebx + 0x68]
mov ecx, ebx
mov edx, 0x4eac04
call fcn.004e2200
mov eax, dword [ebx + 0x68]
mov ecx, 0x70
mov edx, 0x4eac18
call fcn.004e1304
mov eax, dword [ebx + 0x68]
mov ecx, dword [ebp - 4]
mov edx, 0x4eac18
call fcn.004e2200
mov eax, dword [ebx + 0x68]
mov esi, dword [eax + 0x9c]
mov edx, 0x4eac28
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4eac38
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4eac5c
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4eac74
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4eac84
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4eacac
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4eacdc
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ead08
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ead3c
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x68]
mov edx, dword [eax]
call dword [edx + 0x30]
mov eax, dword [ebx + 0x68]
call fcn.004e0c40
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004e7c34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eabf4
mov eax, dword [ebp - 4]
call fcn.00403b10
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4f146c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x10c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e20
xor eax, eax
push ebp
push 0x4f153d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
mov edx, dword [ebp - 4]
mov ecx, 0xff
call fcn.00404c0c
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x104]
call fcn.00404bd4
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
call fcn.00409504
cmp dword [ebp - 0x108], 0
je 0x4f150a
xor ecx, ecx
mov cl, byte [ebp - 0x104]
test ecx, ecx
jle 0x4f150a
mov edx, 1
lea eax, [ebp - 0x103]
lea ebx, [edx + 0x14]
lea edi, [edx + edx*2]
add ebx, edi
movzx edi, byte [eax]
xor ebx, edi
mov byte [eax], bl
inc edx
inc eax
dec ecx
jne 0x4f14f6
mov eax, esi
lea edx, [ebp - 0x104]
call fcn.00404bd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1544
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.00404984
lea eax, [ebp - 4]
call fcn.00404960
ret