joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44542c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00406900
push eax
mov eax, dword [ebx + 4]
push eax
call fcn.0040b1a8
mov edx, eax
mov eax, ebx
call fcn.00444cf0
test al, al
jne 0x44548d
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4eea40]
mov dl, 1
mov eax, dword [0x443a08]
call fcn.004166f4
call fcn.00405870
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00444c58
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44aff4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x44affa
ret
Function at 0x455bc4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x455d81
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
jne 0x455d5d
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x455d5d
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x28
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x28]
add ebx, ebx
add ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
imul ebx
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x455b90]
call fcn.00408234
add esp, 4
lea eax, [ebp - 4]
call fcn.00409780
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [0x4ee644]
push eax
call fcn.00440a68
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.0040806c
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x2c
call fcn.0040476c
mov dword [ebp - 0x38], 0x2c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
neg eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], 1
mov word [ebp - 0x2a], 0x20
mov dl, 1
mov eax, dword [0x449934]
call fcn.004527ac
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], ebx
xor ecx, ecx
push ebp
push 0x455d3b
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, ebx
mov dl, 7
call fcn.004542cc
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x6c]
push 0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x70]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
call fcn.004530cc
call fcn.0044df58
push eax
call fcn.0040b804
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov dl, 1
call fcn.004533bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x455d5d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455d88
lea eax, [ebp - 8]
mov edx, dword [0x455b90]
call fcn.00408354
lea eax, [ebp - 4]
call fcn.00409780
ret
Function at 0x488da8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040685c
xor eax, eax
push ebp
push 0x488f3d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call fcn.0040bc7c
test eax, eax
je 0x488f0b
xor edx, edx
push ebp
push 0x488f04
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004068c8
mov eax, dword [ebp - 8]
test eax, eax
je 0x488e17
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x488e17
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.004061e8
test eax, eax
je 0x488e20
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call fcn.0040b444
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x488ed9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040b464
mov ebx, eax
xor edx, edx
push ebp
push 0x488ec8
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004068c8
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x488e82
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x488e82
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004061e8
test eax, eax
je 0x488e8b
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call fcn.00406900
lea ecx, [esi + 2]
mov edx, ebx
call fcn.0040438c
call fcn.0040b98c
mov eax, dword [ebp - 0x10]
push eax
push 0xd
call fcn.0040bd40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488ecf
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040b46c
ret
mov ecx, dword [0x4ee550]
mov dl, 1
mov eax, dword [0x40d408]
call fcn.004166b8
call fcn.00405870
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488f44
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040686c
ret

Function at 0x48c84c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406874
push 0
mov eax, esi
movzx eax, al
push eax
call fcn.0040bc44
shl eax, 0x10
test eax, eax
je 0x48c893
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call fcn.0040ba74
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00406a84
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x491d18
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x491e51
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call fcn.0040ba94
mov dl, 1
mov eax, dword [0x443bfc]
call fcn.00444c80
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x491e27
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00444d2c
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.00406a84
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x491e6c
call fcn.00406d58
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00444ec4
test al, al
je 0x491e11
lea ecx, [ebp - 4]
mov edx, 0x491ee0
mov eax, dword [ebp - 0xc]
call fcn.004452d4
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00418fb4
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x491e0a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x491ef8
mov eax, dword [ebp - 8]
push eax
call fcn.0040b358
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x4edf64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491e11
mov eax, dword [ebp - 8]
push eax
call fcn.0040b270
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491e2e
mov eax, dword [ebp - 0xc]
call fcn.00404da0
ret

Function at 0x491f5c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x491fa3
push 0x10
call fcn.0040ba7c
test ax, ax
jge 0x491f86
add bx, 0x2000
push 0x11
call fcn.0040ba7c
test ax, ax
jge 0x491f97
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x491fa3
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x49fd3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x4f4264], 0
je 0x49fe7d
push 0x11
call fcn.0040ba7c
test ax, 0x8000
setne al
mov edx, dword [0x4ee848]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x49fe7d
mov eax, dword [0x4f4268]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4f4264]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x49fe4c
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x4f4264]
call fcn.0042fd64
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x49fe44
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1ea], 0
je 0x49fe44
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
je 0x49fe44
mov eax, dword [ebp - 0x14]
call fcn.004ab300
push eax
call fcn.0040bc04
test eax, eax
je 0x49fe44
push ebp
call fcn.0049fcf8
pop ecx
test al, al
jne 0x49fe44
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00405024
test al, al
je 0x49fe44
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00405024
cmp byte [ebp - 1], 0
je 0x49fe44
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.0040a6d0
test al, al
je 0x49fe44
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4f4268]
call fcn.0049f454
inc edi
dec ebx
jne 0x49fda1
mov eax, dword [0x4f4268]
cmp dword [eax + 8], 0
jle 0x49fe64
mov eax, dword [0x4f4268]
call fcn.0049f50c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x49fe7d
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0049fb5c
pop ecx
test al, al
jne 0x49fe7d
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a7fbc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call fcn.0040bae4
call fcn.0040a6b8
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.004a2304
test ebx, ebx
jne 0x4a800f
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.004a7e38
mov ebx, eax
test ebx, ebx
je 0x4a8105
cmp esi, ebx
je 0x4a8038
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x4a804d
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x4a8085
add eax, 0xffffff5f
sub eax, 2
jb 0x4a809d
dec eax
sub eax, 2
jb 0x4a80b1
dec eax
sub eax, 2
jb 0x4a80a7
jmp 0x4a80bb
add eax, 0xfffffdff
sub eax, 2
jb 0x4a809d
dec eax
sub eax, 2
jb 0x4a80b1
dec eax
sub eax, 2
jb 0x4a80a7
jmp 0x4a80bb
mov byte [esp + 0x120], 0
jmp 0x4a80c3
mov byte [esp + 0x120], 2
jmp 0x4a80c3
mov byte [esp + 0x120], 1
jmp 0x4a80c3
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call fcn.0040ba9c
lea eax, [esp + 0x14]
call fcn.004c4574
mov esi, eax
call fcn.0049eb40
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.004a3b44
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x4a8107
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x4c407c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call fcn.0040bb5c
mov edi, eax
test bl, bl
je 0x4c409d
test edi, 0x40000
je 0x4c40b7
test bl, bl
jne 0x4c4138
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x4c4138
push esi
call fcn.0040bbe4
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call fcn.0040bc04
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x4c40ea
push 0
push esi
call fcn.0040bdf0
test bl, bl
je 0x4c40ff
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call fcn.0040bdb0
jmp 0x4c410e
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call fcn.0040bdb0
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x4c411f
cmp byte [esp + 2], 0
je 0x4c4138
cmp byte [esp + 2], 0
je 0x4c4130
push 6
push esi
call fcn.0040bdf0
jmp 0x4c4138
push 5
push esi
call fcn.0040bdf0
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4c43e4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call fcn.0040b9f4
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x4c440a
mov eax, esp
push eax
push 0x4c43ac
call fcn.0040b9c4
jmp 0x4c441d
mov eax, esp
push eax
push 0x4c438c
call fcn.0040b2d8
push eax
call fcn.0040b9bc
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret
Function at 0x4c44e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x4c4530]
test bl, 4
je 0x4c44f4
or si, 1
test bl, 8
je 0x4c44fd
or si, 4
test bl, 1
je 0x4c4506
or si, 8
test bl, 2
je 0x4c450f
or si, 0x10
test bl, 0x10
je 0x4c4518
or si, 0x20
push 0x12
call fcn.0040ba7c
test ax, ax
jge 0x4c4528
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4c4534
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x4c4570]
push 0x10
call fcn.0040ba7c
test ax, ax
jge 0x4c454f
or bx, 1
push 0x11
call fcn.0040ba7c
test ax, ax
jge 0x4c455f
or bx, 4
test esi, 0x20000000
je 0x4c456b
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4ccbe8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4ccbfa
add esp, 0xfffffff0
call fcn.004052cc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0043a628
mov eax, dword [0x4ee5e0]
mov dword [eax + 4], ebx
mov dword [eax], 0x4cd044
mov eax, dword [0x4ee5f0]
mov dword [eax + 4], ebx
mov dword [eax], 0x4cd050
mov eax, ebx
call fcn.004cd05c
push 0
call fcn.0040ba84
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x4250fc]
call fcn.00404d70
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4250fc]
call fcn.00404d70
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4250fc]
call fcn.00404d70
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4250fc]
call fcn.00404d70
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x4250fc]
call fcn.00404d70
mov dword [ebx + 0x78], eax
push 0
call fcn.0040ba3c
mov esi, eax
push 0x5a
push esi
call fcn.0040b6c4
mov dword [ebx + 0x44], eax
push esi
push 0
call fcn.0040bcd4
mov eax, dword [ebx + 0x5c]
push eax
mov eax, 0x4c7e9c
push eax
push 0
push 0
mov eax, dword [0x4ee7a8]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x445eb0]
call fcn.0044c070
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x445eb0]
call fcn.0044c070
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x445eb0]
call fcn.0044c070
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x445eb0]
call fcn.0044c070
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x445eb0]
call fcn.0044c070
mov dword [ebx + 0x8c], eax
mov eax, ebx
call fcn.004cd5b4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4cd424
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4cd424
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4cd424
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4cd424
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4cd424
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4ccd75
call fcn.00405324
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4cd1c4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cd371
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
jne 0x4cd352
mov dl, 1
mov eax, dword [0x4277e4]
call fcn.00433160
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
xor edx, edx
call fcn.00406874
lea eax, [ebp - 0x114]
push eax
push 0x40
call fcn.0040ba8c
dec eax
test eax, eax
jl 0x4cd341
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004b1740
test al, al
je 0x4cd334
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x4cd380
lea eax, [ebp - 0x394]
call fcn.00412d74
push eax
push 0x80000002
call fcn.0040b1a0
test eax, eax
jne 0x4cd334
xor eax, eax
push ebp
push 0x4cd32d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x4cd3f0
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040b1a8
test eax, eax
jne 0x4cd316
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406a84
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x40]
jne 0x4cd316
mov eax, dword [ebp - 4]
add eax, 0x3c
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406a84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd334
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040b180
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4cd237
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.0043309c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd378
lea eax, [ebp - 0x3a0]
call fcn.00406864
ret

Function at 0x4cded0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4f42bc]
cmp byte [eax + 0xad], 0
jne 0x4cdf42
cmp dword [0x4f42d4], 0
jne 0x4cdf02
call fcn.0040b2d8
push eax
push 0
mov eax, dword [0x4ee2d8]
push eax
push 3
call fcn.0040bdd8
mov dword [0x4f42d4], eax
cmp dword [0x4f42d0], 0
jne 0x4cdf1d
push 0
push 0
push 0
push 0
call fcn.0040b1e0
mov dword [0x4f42d0], eax
cmp dword [0x4f42d8], 0
jne 0x4cdf42
push esp
push 0
push 0
mov eax, dword [0x4ee2d4]
push eax
push 0x3e8
push 0
call fcn.0040b1f8
mov dword [0x4f42d8], eax
pop edx
ret
Function at 0x4ce210
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4ce227
add esp, 0xfffffff0
call fcn.004052cc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0043a628
mov eax, dword [0x4ee4ec]
cmp byte [eax], 0
jne 0x4ce254
push 0
call fcn.0040c604
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4ee780]
cmp word [eax + 2], 0
jne 0x4ce26e
mov eax, dword [0x4ee780]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004d02d4
mov eax, dword [0x4ee874]
cmp word [eax + 2], 0
jne 0x4ce288
mov eax, dword [0x4ee874]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004d04e4
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x445eb0]
call fcn.0044c070
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4d0998
mov dl, 1
mov eax, dword [0x4250fc]
call fcn.00404d70
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4250fc]
call fcn.00404d70
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x44a260]
call fcn.00454bfc
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4ce468
mov eax, dword [0x4ee660]
mov eax, dword [eax]
push eax
call fcn.0040bc2c
mov edx, eax
mov eax, esi
call fcn.00454ffc
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4d0c58
mov dl, 1
mov eax, dword [0x4250fc]
call fcn.00404d70
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4ee660]
mov eax, dword [eax]
push eax
call fcn.0040b338
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00412bac
test eax, eax
je 0x4ce399
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00412990
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00412b90
test eax, eax
je 0x4ce3b1
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call fcn.0040b8a4
push eax
call fcn.0040b894
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00406a84
push ebx
push 0x4cfca4
call fcn.004c44c4
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x4ee4ec]
cmp byte [eax], 0
jne 0x4ce402
mov eax, ebx
call fcn.004ce5dc
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004d0e84
mov eax, ebx
call fcn.004d1ab8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4ce45f
call fcn.00405324
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret