joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d228
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
cmp byte [0x49fe4c], 0
jne 0x45d24c
mov byte [0x49fe4c], 1
call fcn.0045d1f4
mov eax, ebx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.0041eea0
mov eax, dword [ebp - 4]
call fcn.0041eeb4
push edx
push eax
mov eax, dword [ebp - 8]
add eax, ebx
cdq
cmp edx, dword [esp + 4]
jne 0x45d278
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x45d289
jmp 0x45d27c
pop edx
pop eax
jle 0x45d289
mov eax, dword [ebp - 4]
call fcn.0041eeb4
sub eax, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0x80000
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x14]
jge 0x45d29e
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.00402a58
mov dword [ebp - 0x10], eax
xor ecx, ecx
push ebp
push 0x45d33a
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov dword [ebp - 0xc], 0xffffffff
cmp dword [ebp - 8], 0
jle 0x45d31d
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
test eax, eax
jle 0x45d303
mov ecx, dword [ebp - 0xc]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ebx
mov bl, byte [edx]
xor ebx, dword [ebp - 0xc]
and ebx, 0xff
xor ecx, dword [ebx*4 + 0x49fe50]
mov dword [ebp - 0xc], ecx
inc edx
dec eax
jne 0x45d2dc
mov eax, dword [ebp - 0x14]
sub dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jle 0x45d317
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0
jg 0x45d2c4
and dword [ebp - 0xc], 0x7fffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d341
mov eax, dword [ebp - 0x10]
call fcn.00402a78
ret

Function at 0x45d34c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
cmp byte [0x49fe4c], 0
jne 0x45d365
mov byte [0x49fe4c], 1
call fcn.0045d1f4
or ebx, 0xffffffff
mov eax, esi
call fcn.00405294
test eax, eax
jle 0x45d39e
mov edx, 1
xor ecx, ecx
mov cl, byte [esi + edx - 1]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x49fe50]
shr ebx, 8
and ebx, 0xffffff
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x45d378
and ebx, 0x7fffffff
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x45ee34
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45eef8
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0xf
mov eax, ebx
call fcn.00402a58
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x45eedb
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x45eeb3
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.kernel32.dll_GetUserDefaultLCID_1
push ebx
mov edx, dword [ebp - 8]
push edx
push 0x1001
push eax
call sub.kernel32.dll_GetLocaleInfoA_2
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004051cc
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0045bee8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45eec5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45eee2
mov eax, dword [ebp - 8]
call fcn.00402a78
ret

Function at 0x45ef08
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x45ef11
mov eax, dword [ebp - 4]
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45ef9f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x2000
lea eax, [ebp - 0x2004]
push eax
mov eax, ebx
call fcn.004058c0
push eax
call sub.kernel32.dll_GetEnvironmentVariableW
lea edx, [ebp - 0x2004]
lea ecx, [ebp - 4]
xchg ecx, eax
call fcn.004057c0
push 0x2000
lea eax, [ebp - 0x2004]
push eax
mov eax, dword [ebp - 4]
call fcn.004058c0
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ecx, eax
dec ecx
lea edx, [ebp - 0x2004]
mov eax, esi
call fcn.004057c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45efa6
lea eax, [ebp - 4]
call fcn.004056cc
ret
Function at 0x460790
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040547c
xor eax, eax
push ebp
push 0x460888
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404fdc
push ebx
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0045c4c0
mov eax, dword [ebp - 0xc]
call fcn.0040548c
push eax
push esi
call sub.kernel32.dll_FindResourceA_1
mov ebx, eax
test ebx, ebx
je 0x46086a
push ebx
push esi
call sub.kernel32.dll_LoadResource_1
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x460863
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x46080d
call fcn.00404a64
jmp 0x46086a
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_LockResource_1
mov edi, eax
test edi, edi
je 0x460844
push ebx
push esi
call sub.kernel32.dll_SizeofResource_1
mov ebx, eax
test ebx, ebx
jle 0x460844
mov eax, dword [ebp + 8]
mov edx, ebx
call fcn.00405618
mov eax, dword [ebp + 8]
call fcn.004054e4
mov ecx, ebx
mov edx, edi
call fcn.0045d604
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46086a
mov eax, dword [ebp - 8]
call fcn.0045ec98
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeResource_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46088f
lea eax, [ebp - 0xc]
call fcn.00404fdc
lea eax, [ebp - 4]
call fcn.00404fdc
ret
Function at 0x463fa4
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040547c
mov eax, dword [ebp - 8]
call fcn.0040547c
xor eax, eax
push ebp
push 0x464048
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x49bf50]
mov byte [eax], 1
mov byte [ebx + 8], 0
mov al, byte [ebp + 8]
mov byte [ebx + 0x34], al
inc dword [0x4a0364]
xor eax, eax
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x20]
mov edx, dword [ebp - 4]
call fcn.00405030
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 8]
call fcn.00405030
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
lea eax, [ebp - 0xc]
push eax
push 4
push ebx
push 0x463f60
push 0
push 0
call sub.kernel32.dll_CreateThread_2
mov dword [ebx + 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46404f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405000
ret

Function at 0x464a1c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040547c
xor eax, eax
push ebp
push 0x464afc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.004646c4
mov esi, eax
test esi, esi
jle 0x464ae6
test ebx, ebx
jle 0x464a84
push esi
push 0x4649e8
mov eax, dword [0x49bf00]
mov eax, dword [eax]
call eax
jmp 0x464a74
push 0x64
call sub.kernel32.dll_Sleep_3
sub ebx, 0x64
test ebx, ebx
jle 0x464a84
mov eax, dword [ebp - 4]
call fcn.00464674
test al, al
jne 0x464a6a
mov eax, dword [ebp - 4]
call fcn.00464674
test al, al
je 0x464ae6
push esi
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x464adf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464ae6
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464b03
lea eax, [ebp - 4]
call fcn.00404fdc
ret
Function at 0x4655ac
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040547c
xor eax, eax
push ebp
push 0x46566d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040548c
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA_1
mov esi, eax
test esi, esi
je 0x46564f
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.00405618
lea eax, [ebp - 0x1c]
call fcn.004054e4
push eax
push esi
push 0
push edi
call sub.version.dll_GetFileVersionInfoA_1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x465680
lea eax, [ebp - 0x1c]
call fcn.004054e4
push eax
call sub.version.dll_VerQueryValueA_1
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x46564f
mov eax, dword [ecx + 8]
xor edx, edx
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [ecx + 0xc]
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465674
lea eax, [ebp - 0x1c]
call fcn.00404fdc
lea eax, [ebp - 4]
call fcn.00404fdc
ret
Function at 0x466fe4
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
call sub.user32.dll_GetForegroundWindow_1
push 0
push eax
mov eax, dword [0x49bf38]
mov eax, dword [eax]
call eax
mov dword [ebp - 4], eax
push 0xffffffffffffffff
call sub.kernel32.dll_GetCurrentThreadId_2
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_AttachThreadInput
xor eax, eax
push ebp
push 0x46705d
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
call sub.user32.dll_IsIconic_1
test eax, eax
je 0x467030
push 9
push ebx
call sub.user32.dll_ShowWindow_1
push ebx
call sub.user32.dll_BringWindowToTop
push 5
push ebx
call sub.user32.dll_ShowWindow_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467064
push 0
call sub.kernel32.dll_GetCurrentThreadId_2
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_AttachThreadInput
ret

Function at 0x468ef8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x468f0b
add esp, 0xfffffff0
call fcn.00404550
mov esi, ecx
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.004041bc
mov eax, dword [0x49bf50]
mov byte [eax], 1
mov eax, dword [ebp + 8]
mov dword [edi + 0x20], eax
mov byte [edi + 0x24], 0
mov byte [edi + 0x1c], 0
mov dword [edi + 4], esi
mov eax, dword [ebp + 0x14]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x10], eax
mov byte [edi + 0x14], 0
lea eax, [ebp - 4]
push eax
push 4
push edi
push 0x468eb4
push 0
push 0
call sub.kernel32.dll_CreateThread_2
mov dword [edi + 0x18], eax
mov eax, edi
test bl, bl
je 0x468f76
call fcn.004045a8
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x10
Function at 0x469810
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x419738]
call fcn.00405b6c
xor eax, eax
push ebp
push 0x469954
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49b534], 0
jne 0x469863
mov ecx, dword [0x49be60]
mov dl, 1
mov eax, dword [0x4098f4]
call fcn.0040dcdc
call fcn.004049b8
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004035a4
mov eax, ebx
call fcn.004058c0
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x469964
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.0040702c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004058d0
test eax, eax
jle 0x4698fb
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4698f4
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.0040525c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00405244
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0040a790
test eax, eax
jne 0x4698f4
mov ebx, 0x15
jmp 0x469900
mov ebx, 0x10
jmp 0x469900
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x49b534]
call fcn.00469768
mov eax, dword [ebp - 8]
call fcn.00469768
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00407044
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46995b
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00405000
lea eax, [ebp - 0x10]
mov edx, dword [0x419738]
call fcn.00405c3c
ret

Function at 0x46d138
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.0046cbd8
test byte [ebx + 0x23d], 4
jne 0x46d1cd
mov edx, esp
mov eax, ebx
call fcn.004397fc
push esp
mov eax, ebx
call fcn.00440254
push eax
push 0
mov eax, ebx
test eax, eax
je 0x46d16d
sub eax, 0xfffffd9c
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x218]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x22c], 0
jne 0x46d19e
mov ecx, dword [0x49c094]
mov dl, 1
mov eax, dword [0x469428]
call fcn.0040dcdc
call fcn.004049b8
mov eax, ebx
call fcn.0046d6e0
cmp byte [ebx + 0x57], 0
jne 0x46d1d4
mov eax, ebx
call fcn.00440418
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46d1d4
push 0
mov eax, ebx
call fcn.00440418
push eax
call sub.user32.dll_ShowWindow
jmp 0x46d1d4
mov eax, ebx
call fcn.0043d4fc
add esp, 0x10
pop ebx
ret
Function at 0x471dd8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x471e3f
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthA
mov ebx, eax
lea edi, [ebx + 1]
mov edx, edi
lea eax, [ebp - 8]
call fcn.00405618
push edi
mov eax, dword [ebp - 8]
call fcn.0040548c
push eax
push esi
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405030
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471e46
lea eax, [ebp - 8]
call fcn.00404fdc
ret

Function at 0x472314
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47247d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00405074
mov eax, dword [ebp - 0x10]
call fcn.0047207c
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x472366
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.0040552c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004726ec
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x47243b
xor eax, eax
push ebp
push 0x472434
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004721ec
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0047248c
test al, al
je 0x472412
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004050cc
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x472412
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040548c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x47240c
mov eax, dword [ebp - 0x14]
call fcn.0040548c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004051cc
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.00472314
dec ebx
cmp ebx, 0xffffffff
jne 0x4723c5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47243b
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004721ec
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.0040548c
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.004721d8
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472484
lea eax, [ebp - 0x3c]
call fcn.00404fdc
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405000
ret
Function at 0x47243b
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47247d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00405074
mov eax, dword [ebp - 0x10]
call fcn.0047207c
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x472366
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.0040552c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004726ec
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x47243b
xor eax, eax
push ebp
push 0x472434
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004721ec
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0047248c
test al, al
je 0x472412
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004050cc
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x472412
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040548c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x47240c
mov eax, dword [ebp - 0x14]
call fcn.0040548c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004051cc
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.00472314
dec ebx
cmp ebx, 0xffffffff
jne 0x4723c5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47243b
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004721ec
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.0040548c
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.004721d8
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472484
lea eax, [ebp - 0x3c]
call fcn.00404fdc
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405000
ret

Function at 0x47248c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.004035a4
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x49c3c4]
cmp byte [edx + 0xc], 0
je 0x4724f0
mov edx, dword [0x49c3b0]
cmp dword [edx], 2
jne 0x4724f0
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x472610
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00472090
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040548c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x47266e
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x49c114]
mov dl, 1
mov eax, dword [0x471f88]
call fcn.0040dd18
call fcn.004049b8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x472678
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040548c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4726d0
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x49c3d0]
mov dl, 1
mov eax, dword [0x471f88]
call fcn.0040dd18
call fcn.004049b8
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004720c0
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x477c8c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.004035a4
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
je 0x477cc6
cmp byte [ebp - 0xa], 0x31
jne 0x477cc4
mov bl, 1
jmp 0x477cc6
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x479538
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0044071c
test al, al
je 0x4795f1
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 8], eax
jmp 0x4795cf
cmp word [esi + 0x5da], 0
je 0x479589
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x5dc]
call dword [esi + 0x5d8]
cmp byte [ebp - 9], 0
jne 0x4795a6
cmp dword [ebp - 4], 0
jbe 0x4795a2
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x4795a6
xor ebx, ebx
jmp 0x4795a8
mov bl, 1
test bl, bl
jne 0x4795f1
mov eax, dword [0x49c1b4]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x4795f1
mov eax, dword [0x49c1b4]
mov eax, dword [eax]
call fcn.00459678
push 1
call sub.kernel32.dll_Sleep_2
test esi, esi
je 0x4795f1
cmp byte [esi + 0x584], 0
jne 0x4795f1
mov edx, 0xfffffdf3
mov eax, esi
call fcn.0046d518
cmp eax, 4
jne 0x479566
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret