joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434900
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4349f6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x434a0c
call fcn.00405318
push 5
lea eax, [ebp - 0xe]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp eax, 3
sete bl
test bl, bl
je 0x434966
push 5
lea eax, [ebp - 9]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp eax, 3
je 0x43496a
xor eax, eax
jmp 0x43496c
mov al, 1
mov ebx, eax
test bl, bl
je 0x434987
lea eax, [ebp - 4]
lea edx, [ebp - 0xe]
call fcn.00405478
mov eax, esi
lea edx, [ebp - 9]
call fcn.00405478
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00409438
mov eax, dword [ebp - 0x14]
mov edx, 0x434a18
call fcn.004056a8
jne 0x4349c9
lea edx, [ebp - 0x18]
mov eax, dword [esi]
call fcn.00409438
mov eax, dword [ebp - 0x18]
mov edx, 0x434a24
call fcn.004056a8
jne 0x4349c9
mov eax, edi
mov edx, dword [0x4ca118]
call fcn.004052d4
jmp 0x4349d3
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004052d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4349fd
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004052a4
lea eax, [ebp - 4]
call fcn.00405280
ret

Function at 0x4398c8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
call fcn.00405478
cmp dword [ebx], 0
je 0x439918
mov eax, dword [ebx]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x108]
test eax, eax
je 0x439903
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x439918
mov eax, ebx
mov edx, 0x439928
call fcn.0040554c
add esp, 0x10c
pop ebx
ret
Function at 0x43da3c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x43dc1c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x407]
push eax
call sub.user32.dll_GetClientRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
jne 0x43da99
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x407]
push eax
call sub.user32.dll_BeginPaint
mov ebx, eax
jmp 0x43daac
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WindowFromDC
test eax, eax
jne 0x43daac
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x43dafc
mov eax, dword [ebp - 4]
cmp dword [eax + 0xf9], 0
jne 0x43dafc
push 0
call sub.user32.dll_GetDC
mov esi, eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push esi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x14], eax
jmp 0x43db0c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf9]
test eax, eax
je 0x43db0c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x43dc0b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xf9], edx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x14
mov eax, dword [ebp - 4]
push eax
call fcn.00441224
cmp dword [0x4d2220], 0
je 0x43db4e
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call dword [0x4d2220]
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xf
mov eax, dword [ebp - 4]
push eax
call fcn.00441224
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x43f]
test eax, eax
je 0x43db73
xor edx, edx
call fcn.00438e34
push 0
push ebx
call sub.gdi32.dll_SelectClipRgn
cmp ebx, dword [ebp - 0xc]
je 0x43db9f
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 0
push 0
push ebx
call sub.gdi32.dll_BitBlt
cmp dword [ebp - 8], 0
jne 0x43dbb8
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x407]
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43dc12
cmp dword [ebp - 0x10], 0
je 0x43dbf7
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf9], edx
jmp 0x43dc0a
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x43dc0a
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf9], edx
ret
Function at 0x43e8b4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x808], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43e967
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x5c3], 0
jne 0x43e8fe
lea edx, [ebp - 0x808]
mov eax, ebx
call fcn.0043eaa0
mov edx, dword [ebp - 0x808]
mov eax, esi
call fcn.00405bb4
jmp 0x43e94e
mov eax, dword [ebx + 0x407]
test eax, eax
je 0x43e94e
cmp byte [ebx + 0x431], 0
jne 0x43e94e
push eax
call sub.user32.dll_GetWindowTextLengthW
cmp eax, 0x400
jle 0x43e923
mov eax, 0x400
test eax, eax
jle 0x43e94e
inc eax
push eax
lea eax, [ebp - 0x802]
push eax
mov eax, dword [ebx + 0x407]
push eax
call sub.user32.dll_GetWindowTextW
mov eax, esi
lea edx, [ebp - 0x802]
mov ecx, 0x401
call fcn.00405b98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e96e
lea eax, [ebp - 0x808]
call fcn.00405280
ret

Function at 0x43eaa0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43eb5b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x5c3], 0
je 0x43eadf
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0043e8b4
mov eax, dword [ebp - 8]
mov edx, edi
call fcn.0043ea38
jmp 0x43eb45
mov eax, dword [ebx + 0x407]
test eax, eax
je 0x43eb38
cmp byte [ebx + 0x431], 0
jne 0x43eb38
push eax
call sub.user32.dll_GetWindowTextLengthA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43eb05
xor esi, esi
jmp 0x43eb22
mov eax, dword [ebp - 4]
inc eax
call fcn.00402f00
mov esi, eax
mov eax, dword [ebp - 4]
inc eax
push eax
push esi
mov eax, dword [ebx + 0x407]
push eax
call sub.user32.dll_GetWindowTextA
mov eax, edi
mov edx, esi
call fcn.00405478
test esi, esi
je 0x43eb45
mov eax, esi
call fcn.00402f1c
jmp 0x43eb45
mov eax, edi
mov edx, dword [ebx + 0x425]
call fcn.00405478
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43eb62
lea eax, [ebp - 8]
call fcn.00405a34
ret
Function at 0x448ffc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
call fcn.00405478
cmp dword [ebx], 0
je 0x44904c
mov eax, dword [ebx]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x108]
test eax, eax
je 0x449037
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x44904c
mov eax, ebx
mov edx, 0x44905c
call fcn.0040554c
add esp, 0x10c
pop ebx
ret

Function at 0x449060
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040a8c4
add esp, 0x208
pop ebx
ret

Function at 0x44ac3c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
add eax, 0x11
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 9], ebx
test ebx, ebx
jbe 0x44acd0
xor eax, eax
push ebp
push 0x44acba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0044ab90
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xd], esi
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 9]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x11]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.version.dll_GetFileVersionInfoA
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44acd0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44b62c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 7
push 0
push 0
dec ecx
jne 0x44b635
push ecx
xchg dword [ebp - 4], ecx
push ebx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x11], dl
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x44b82a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x19], 1
mov dl, 1
mov eax, dword [0x41d250]
call fcn.00404258
mov dword [ebp - 0x20], eax
xor edx, edx
push ebp
push 0x44b79f
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
mov ecx, dword [ebp - 0x20]
mov edx, 0x3f
mov eax, dword [ebp - 0x10]
call fcn.0044b39c
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x44b789
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x2c]
push eax
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0x10]
call fcn.0040a3a0
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 8]
pop ecx
call fcn.00405598
mov bl, 1
mov eax, dword [ebp - 8]
call fcn.00405710
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x44b716
test al, 0x10
je 0x44b716
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040e69c
lea eax, [ebp - 0x34]
mov ecx, 0x44b844
mov edx, dword [ebp - 0xc]
call fcn.00405598
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov dl, 1
call fcn.0044b62c
mov ebx, eax
jmp 0x44b775
test bl, bl
je 0x44b775
cmp dword [ebp - 0x18], 0
je 0x44b744
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 8]
call fcn.0040a59c
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 4]
call fcn.004094c0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
jne 0x44b77d
mov eax, dword [ebp - 8]
call fcn.00437d0c
push 0x80
mov eax, dword [ebp - 8]
call fcn.00405710
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x44b775
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0044b0dc
mov ebx, eax
test bl, bl
jne 0x44b77d
mov byte [ebp - 0x19], 0
inc dword [ebp - 0x24]
dec dword [ebp - 0x28]
jne 0x44b6a9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b7a6
lea eax, [ebp - 0x20]
call fcn.0040f774
ret
Function at 0x44c504
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x40c], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x44c681
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp + 0xc]
call fcn.004052d4
xor edx, edx
push ebp
push 0x44c65e
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x40c]
mov eax, edi
call fcn.0044c378
mov edx, dword [ebp - 0x40c]
lea eax, [ebp - 0x110]
mov ecx, 0xff
call fcn.0040a7d0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyA
xor edx, edx
push ebp
push 0x44c64d
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
je 0x44c5a0
call fcn.00404c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44c668
lea eax, [ebp - 0x210]
mov ecx, 0xff
mov edx, dword [ebp - 4]
call fcn.0040a7d0
lea ebx, [ebp - 0x405]
mov dword [ebp - 8], 0x1f4
mov byte [ebx], 0
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44c5ed
mov edx, esi
mov eax, ebx
call fcn.0040a8c4
jmp 0x44c630
cmp eax, 0xea
jne 0x44c630
mov eax, dword [ebp - 8]
call fcn.00402ee8
mov ebx, eax
mov byte [ebx], 0
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44c629
mov edx, esi
mov eax, ebx
call fcn.0040a8c4
mov eax, ebx
call fcn.00402f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c654
cmp dword [ebp - 0xc], 0
je 0x44c64c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c688
lea eax, [ebp - 0x40c]
call fcn.00405280
ret
Function at 0x44cf50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc08
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x3f8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44d056
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor edx, edx
push ebp
push 0x44d033
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x3f8]
mov eax, esi
call fcn.0044c378
mov edx, dword [ebp - 0x3f8]
lea eax, [ebp - 0x1fd]
call fcn.0040a7a8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1fd]
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyA
xor edx, edx
push ebp
push 0x44d022
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
je 0x44cfda
call fcn.00404c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44d03d
lea eax, [ebp - 0x3f2]
mov edx, edi
call fcn.0040a7a8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x3f2]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d029
cmp dword [ebp - 8], 0
je 0x44d021
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d05d
lea eax, [ebp - 0x3f8]
call fcn.00405280
ret
Function at 0x44d06c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa00
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x600], ebx
mov dword [ebp - 0x5fc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x44d216
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], ebx
xor edx, edx
push ebp
push 0x44d1ee
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x5fc]
mov eax, edi
call fcn.0044c378
mov edx, dword [ebp - 0x5fc]
lea eax, [ebp - 0x20d]
call fcn.0040a7a8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20d]
push eax
push esi
call sub.advapi32.dll_RegOpenKeyA
xor edx, edx
push ebp
push 0x44d1dd
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
je 0x44d102
call fcn.00404c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44d1f8
lea eax, [ebp - 0x402]
mov edx, dword [ebp - 4]
call fcn.0040a7a8
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x402]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 4
je 0x44d1b9
cmp dword [ebp - 0x18], 3
je 0x44d1b9
cmp dword [ebp - 0x18], 4
je 0x44d1b9
cmp dword [ebp - 0x18], 5
je 0x44d1b9
mov dword [ebp - 0xc], 0x1f4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x5f7]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x402]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44d1b9
lea eax, [ebp - 0x600]
lea edx, [ebp - 0x5f7]
mov ecx, 0x1f5
call fcn.004054f0
mov eax, dword [ebp - 0x600]
mov edx, ebx
call fcn.00409b20
mov dword [ebp - 8], eax
call fcn.00404c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44d1f8
test eax, eax
je 0x44d1c0
mov dword [ebp - 8], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d1e4
cmp dword [ebp - 0x10], 0
je 0x44d1dc
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d21d
lea eax, [ebp - 0x600]
mov edx, 2
call fcn.004052a4
ret
Function at 0x44d9cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x44d9d5
mov eax, dword [ebp - 4]
add esp, 0xfffffc00
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x8404], ecx
mov dword [ebp - 0x8400], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x44dbb4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405280
lea eax, [ebp - 0x205]
mov edx, 0x44dbcc
call fcn.0040a7a8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x205]
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
mov ebx, eax
push ebp
push 0x44db8f
push dword fs:[0]
mov dword fs:[0], esp
test ebx, ebx
je 0x44da5d
call fcn.00404c38
jmp 0x44db96
xor esi, esi
lea eax, [ebp - 0x3fa]
xor ecx, ecx
mov edx, 0x1f5
call fcn.00403a38
mov dword [ebp - 0xc], 0x7fff
lea eax, [ebp - 0x83fa]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00403a38
mov dword [ebp - 8], 0x1f5
xor eax, eax
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x83fa]
push edx
push edi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x3fa]
push eax
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
inc esi
test ebx, ebx
jne 0x44dadd
lea edx, [ebp - 0x8400]
lea eax, [ebp - 0x3fa]
call fcn.0040a8c4
mov eax, dword [ebp - 0x8400]
mov edx, 0x44dc08
call fcn.004056a8
jne 0x44da5f
test ebx, ebx
jne 0x44db72
mov edx, dword [ebp - 0xc]
dec edx
test edx, edx
jle 0x44db28
lea eax, [ebp - 0x83fa]
cmp byte [eax], 0
jne 0x44db07
cmp byte [eax + 1], 0
jne 0x44db07
mov byte [eax], 0x3d
mov byte [eax + 1], 9
jmp 0x44db24
movzx ecx, byte [eax]
test cl, cl
jne 0x44db1d
cmp byte [eax + 1], 0x21
jne 0x44db1d
mov byte [eax], 0x3d
mov byte [eax + 1], 0x21
jmp 0x44db24
test cl, cl
jne 0x44db24
mov byte [eax], 9
inc eax
dec edx
jne 0x44daf3
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0x83fa], 0
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x83fa]
call fcn.0040a8c4
movzx eax, byte [0x44dc24]
push eax
lea eax, [ebp - 0x8404]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, 0x44dc30
mov edx, 0x44dc3c
call fcn.0040ed1c
mov edx, dword [ebp - 0x8404]
mov eax, dword [ebp - 4]
call fcn.004052d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44db96
cmp dword [ebp - 0x10], 0
je 0x44db8e
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44dbbb
lea eax, [ebp - 0x8404]
mov edx, 2
call fcn.004052a4
ret
Function at 0x456938
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor eax, eax
push ebp
push 0x456987
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test bl, bl
jne 0x456979
push 0
lea eax, [ebp - 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x456979
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.004568dc
test eax, eax
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45698e
ret
Function at 0x45b28c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405700
mov eax, dword [ebp - 8]
call fcn.00405700
xor eax, eax
push ebp
push 0x45b40a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
call fcn.00456938
test al, al
je 0x45b3ef
mov ecx, dword [ebp + 0xc]
mov dl, 1
mov eax, dword [0x454c34]
call fcn.004561dc
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x45b3e5
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x45b3d4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x4cc480]
cmp dword [eax], 0
je 0x45b318
mov eax, dword [ebp - 0x10]
add eax, 8
mov edx, dword [0x4cc480]
mov edx, dword [edx]
call fcn.004052d4
mov eax, dword [ebp - 0x10]
add eax, 0xd
mov edx, dword [ebp - 4]
call fcn.004052d4
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x26], 1
mov eax, dword [ebp - 0x10]
add eax, 0x12
mov edx, dword [ebp - 8]
call fcn.004052d4
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov dword [eax + 0xb0], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x46], edx
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x4a], edx
mov eax, dword [ebp - 0x10]
mov byte [eax + 0xc], 1
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x7b], 0xa
mov eax, dword [ebp - 0x10]
movzx edx, byte [ebp + 0x18]
mov byte [eax + 0x27], dl
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x11], 0
mov eax, dword [ebp - 0x10]
call fcn.004562f4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa8]
cmp eax, 0xc8
jl 0x45b3a4
cmp eax, 0x12c
jge 0x45b3a4
mov eax, dword [ebp - 8]
call fcn.00409fd0
mov byte [ebp - 9], al
jmp 0x45b3be
mov eax, dword [ebp - 8]
call fcn.00409fd0
test al, al
je 0x45b3be
mov eax, dword [ebp - 8]
call fcn.00405710
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b3db
mov eax, dword [ebp - 0x10]
call fcn.00404288
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b411
lea eax, [ebp - 8]
mov edx, 2
call fcn.004052a4
ret

Function at 0x45b4a4
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403a38
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret