joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ab6c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.00405fd4
lea eax, [ebp - 8]
call fcn.00405fd4
lea eax, [ebp - 0xc]
call fcn.00405fd4
xor eax, eax
push ebp
push 0x4ab8cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00405a64
xor eax, eax
push ebp
push 0x4ab838
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405c10
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x4ab82e
xor eax, eax
push ebp
push 0x4ab827
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405c10
mov esi, eax
push esi
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4ab810
cmp dword [ebp - 0x10], 7
jne 0x4ab810
mov eax, dword [ebp - 0x14]
call fcn.00402f30
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4ab809
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
push esi
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4ab7f3
mov esi, dword [ebp - 0x18]
jmp 0x4ab7ed
push dword [ebx]
lea eax, [ebp - 0x20]
mov edx, esi
call fcn.00405b84
push dword [ebp - 0x20]
push 0x4ab8e0
mov eax, ebx
mov edx, 3
call fcn.00405cfc
push esi
call sub.kernel32.dll_lstrlenW
inc eax
add eax, eax
add esi, eax
cmp word [esi], 0
jne 0x4ab7c2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab810
mov eax, dword [ebp - 0x18]
call fcn.00402f4c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab82e
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ab893
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab8d2
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00405a40
lea eax, [ebp - 0x24]
call fcn.004051ac
lea eax, [ebp - 0x20]
call fcn.00405a28
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405a40
ret
Function at 0x4b4d1c
Capabilities:
Get file attributes
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x4b4efd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4b4f14
call fcn.004c28a8
mov bl, 1
mov eax, dword [0x4d8c18]
mov eax, dword [eax]
call fcn.00405c10
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
test esi, 0x4000
jbe 0x4b4db0
mov eax, 0x4b4f34
call fcn.004c28a8
push 0
mov eax, dword [0x4d8c18]
mov eax, dword [eax]
call fcn.00405c10
push eax
call sub.advapi32.dll_DecryptFileW
test eax, eax
jne 0x4b4db0
call sub.kernel32.dll_GetLastError_1
mov esi, eax
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.0040a338
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x4b4f64
call fcn.004054c4
mov eax, dword [ebp - 8]
call fcn.004c28a8
lea ecx, [ebp - 4]
mov eax, dword [0x4d8c18]
mov eax, dword [eax]
mov edx, 0x4b4f84
call fcn.004b485c
mov eax, dword [ebp - 4]
mov edx, dword [0x4d8e40]
mov edx, dword [edx]
call fcn.00405d44
je 0x4b4dd8
xor ebx, ebx
lea ecx, [ebp - 4]
mov eax, dword [0x4d8c18]
mov eax, dword [eax]
mov edx, 0x4b5004
call fcn.004b485c
mov eax, dword [ebp - 4]
mov edx, 0x4b5084
call fcn.00405d44
je 0x4b4e34
push 0x4b509c
push dword [ebp - 4]
push 0x4b5110
push 0x4b5084
push 0x4b5120
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405cfc
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00405434
mov eax, dword [ebp - 0x10]
call fcn.004c28a8
xor ebx, ebx
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00405434
mov eax, dword [ebp - 0x18]
call fcn.004c4200
push edx
push eax
xor eax, eax
call fcn.004b7df8
cmp eax, 0x642
jne 0x4b4e59
xor ebx, ebx
mov eax, dword [0x4d8c18]
mov eax, dword [eax]
call fcn.00405c10
push eax
mov eax, dword [0x4d8d80]
mov eax, dword [eax]
call eax
mov esi, eax
test esi, esi
je 0x4b4e77
xor ebx, ebx
mov edx, dword [0x4d8fdc]
mov edx, dword [edx]
mov eax, dword [0x4d8c18]
mov eax, dword [eax]
call fcn.004c47e0
test al, al
jne 0x4b4e9b
mov eax, 0x4b512c
call fcn.004c28a8
xor ebx, ebx
test bl, bl
jne 0x4b4ec5
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0040a338
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x4b5160
call fcn.004054c4
mov eax, dword [ebp - 0x1c]
call fcn.004c28a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4f04
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004051d0
lea eax, [ebp - 0x14]
call fcn.00405a28
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004051d0
lea eax, [ebp - 4]
call fcn.00405a28
ret
Function at 0x4c2c4c
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c2d38
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4d8c30]
cmp dword [eax], 5
jl 0x4c2cb1
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405f90
push 0
push 0x26
mov eax, dword [ebp - 4]
call fcn.00405c10
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x4c2ca8
mov eax, dword [ebp - 4]
call fcn.00405c10
mov edx, eax
mov eax, ebx
call fcn.00405b84
jmp 0x4c2cc3
mov eax, ebx
call fcn.00405a28
jmp 0x4c2cc3
lea eax, [ebp - 8]
call fcn.004c2b88
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405c00
mov eax, dword [ebx]
xor edx, edx
call fcn.00405d44
jbe 0x4c2ceb
mov eax, dword [ebx]
call fcn.00405c20
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4c2ceb
mov eax, ebx
mov edx, 0x4c2d48
call fcn.00405c2c
mov ecx, dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 0x4c2d50
call fcn.00405c8c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405434
mov eax, dword [ebp - 0xc]
call fcn.004c28a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2d3f
lea eax, [ebp - 0x10]
call fcn.00405a28
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004051d0
lea eax, [ebp - 4]
call fcn.00405a28
ret

Function at 0x4c2f5c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c3048
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4d8c30]
cmp dword [eax], 5
jl 0x4c2fc1
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405f90
push 0
push 0x1c
mov eax, dword [ebp - 4]
call fcn.00405c10
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x4c2fb8
mov eax, dword [ebp - 4]
call fcn.00405c10
mov edx, eax
mov eax, ebx
call fcn.00405b84
jmp 0x4c2fd3
mov eax, ebx
call fcn.00405a28
jmp 0x4c2fd3
lea eax, [ebp - 8]
call fcn.004c2e84
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405c00
mov eax, dword [ebx]
xor edx, edx
call fcn.00405d44
jbe 0x4c2ffb
mov eax, dword [ebx]
call fcn.00405c20
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4c2ffb
mov eax, ebx
mov edx, 0x4c3058
call fcn.00405c2c
mov ecx, dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 0x4c3060
call fcn.00405c8c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405434
mov eax, dword [ebp - 0xc]
call fcn.004c28a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c304f
lea eax, [ebp - 0x10]
call fcn.00405a28
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004051d0
lea eax, [ebp - 4]
call fcn.00405a28
ret
Function at 0x4c3168
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c3254
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4d8c30]
cmp dword [eax], 5
jl 0x4c31cd
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405f90
push 0
push 0x23
mov eax, dword [ebp - 4]
call fcn.00405c10
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x4c31c4
mov eax, dword [ebp - 4]
call fcn.00405c10
mov edx, eax
mov eax, ebx
call fcn.00405b84
jmp 0x4c31df
mov eax, ebx
call fcn.00405a28
jmp 0x4c31df
lea eax, [ebp - 8]
call fcn.004c308c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405c00
mov eax, dword [ebx]
xor edx, edx
call fcn.00405d44
jbe 0x4c3207
mov eax, dword [ebx]
call fcn.00405c20
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4c3207
mov eax, ebx
mov edx, 0x4c3264
call fcn.00405c2c
mov ecx, dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 0x4c326c
call fcn.00405c8c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405434
mov eax, dword [ebp - 0xc]
call fcn.004c28a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c325b
lea eax, [ebp - 0x10]
call fcn.00405a28
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004051d0
lea eax, [ebp - 4]
call fcn.00405a28
ret

Function at 0x4c3410
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c34e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4d8af8]
cmp byte [eax], 0
je 0x4c3467
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00405f90
mov eax, dword [ebp - 4]
call fcn.00405c10
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebp - 4]
call fcn.00405c10
mov edx, eax
mov eax, ebx
call fcn.00405b84
jmp 0x4c3479
lea eax, [ebp - 8]
call fcn.004c33a8
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405c00
mov eax, dword [ebx]
call fcn.00405c20
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4c3496
mov eax, ebx
mov edx, 0x4c34f4
call fcn.00405c2c
mov ecx, dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 0x4c34fc
call fcn.00405c8c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405434
mov eax, dword [ebp - 0xc]
call fcn.004c28a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c34ea
lea eax, [ebp - 0x10]
call fcn.00405a28
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004051d0
lea eax, [ebp - 4]
call fcn.00405a28
ret
Function at 0x4c3734
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
mov eax, dword [0x4d90f8]
cmp dword [eax], 2
je 0x4c3751
mov byte [ebp - 1], 1
jmp 0x4c391f
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x4d8a00
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x4c391f
xor eax, eax
push ebp
push 0x4c3918
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp ax, 5
jb 0x4c37b3
push 0x4c392c
push 0x4c3944
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
test ebx, ebx
je 0x4c37da
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x4c3901
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x4c3901
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x4c382b
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
je 0x4c380c
call fcn.00404ba4
jmp 0x4c391f
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4c382b
call fcn.00404ba4
jmp 0x4c391f
xor eax, eax
push ebp
push 0x4c38fa
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x4c386e
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
je 0x4c386e
call fcn.00404ba4
call fcn.00404ba4
jmp 0x4c391f
mov eax, dword [ebp - 0x14]
call fcn.00402f30
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x4c38a0
call fcn.00404ba4
call fcn.00404ba4
jmp 0x4c391f
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x4c38db
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4c38d7
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x4c38d7
mov byte [ebp - 1], 1
jmp 0x4c38db
inc ebx
dec esi
jne 0x4c38ad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c3901
mov eax, dword [ebp - 0x18]
call fcn.00402f4c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c391f
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c3ed4
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4c405d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4c4070
call fcn.004c28a8
mov eax, dword [0x4d90f8]
cmp dword [eax], 2
jne 0x4c3fef
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4c3f5c
mov eax, 0x4c4090
call fcn.004c28a8
push 1
push 1
lea ecx, [ebp - 0x1c]
mov eax, dword [0x4d8b54]
mov eax, dword [eax]
mov edx, 0x4c40b0
call fcn.004731f0
mov eax, dword [ebp - 0x1c]
mov ecx, 0x7d5
xor edx, edx
call fcn.004c0100
jmp 0x4c402d
lea eax, [ebp - 0x14]
push eax
push 0x4c40e0
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4c3fef
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.0040a338
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x4c40fc
call fcn.004054c4
mov eax, dword [ebp - 0x20]
call fcn.004c28a8
push 1
push 1
lea ecx, [ebp - 0x28]
mov eax, dword [0x4d8b54]
mov eax, dword [eax]
mov edx, 0x4c40b0
call fcn.004731f0
mov eax, dword [ebp - 0x28]
mov ecx, 0x7d5
xor edx, edx
call fcn.004c0100
jmp 0x4c402d
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x4c402d
mov eax, 0x4c4130
call fcn.004c28a8
push 1
push 1
lea ecx, [ebp - 0x2c]
mov eax, dword [0x4d8b54]
mov eax, dword [eax]
mov edx, 0x4c40b0
call fcn.004731f0
mov eax, dword [ebp - 0x2c]
mov ecx, 0x7d5
xor edx, edx
call fcn.004c0100
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4064
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00405a40
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004051d0
lea eax, [ebp - 0x1c]
call fcn.00405a28
ret
Function at 0x4c4454
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040562c
xor eax, eax
push ebp
push 0x4c44f9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040563c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
mov eax, edi
call fcn.004051ac
test ebx, ebx
je 0x4c44e3
mov eax, ebx
call fcn.00402f30
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.0040563c
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4c4508
push esi
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4c44d5
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.004053a4
jmp 0x4c44dc
mov eax, edi
call fcn.004051ac
mov eax, esi
call fcn.00402f4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4500
lea eax, [ebp - 4]
call fcn.004051ac
ret

Function at 0x4c4530
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov edi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405fd4
xor eax, eax
push ebp
push 0x4c45fa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405c10
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x4c4592
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x78
jne 0x4c4592
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00405434
mov eax, dword [ebp - 0x14]
mov edx, edi
call fcn.004c4454
jmp 0x4c45dc
mov eax, edi
call fcn.004051ac
test ebx, ebx
je 0x4c45dc
mov eax, ebx
call fcn.00402f30
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00405c10
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4c4608
push esi
call sub.version.dll_VerQueryValueW
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.004053d4
mov eax, esi
call fcn.00402f4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4601
lea eax, [ebp - 0x14]
call fcn.004051ac
lea eax, [ebp - 4]
call fcn.00405a28
ret
Function at 0x4c4884
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
push esi
call sub.user32.dll_IsIconic
test eax, eax
je 0x4c489d
push 9
push esi
call sub.user32.dll_ShowWindow
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
jne 0x4c48ad
mov bl, 1
jmp 0x4c499a
mov eax, dword [0x4d90f8]
cmp dword [eax], 2
jne 0x4c48c1
mov eax, dword [0x4d8c30]
cmp dword [eax], 4
jg 0x4c48f5
mov eax, dword [0x4d90f8]
cmp dword [eax], 1
jne 0x4c4984
mov eax, dword [0x4d8c30]
cmp dword [eax], 4
jg 0x4c48f5
mov eax, dword [0x4d8c30]
cmp dword [eax], 4
jne 0x4c4984
mov eax, dword [0x4d8f38]
cmp dword [eax], 0
jle 0x4c4984
xor ebx, ebx
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov edi, eax
push 0
push esi
call sub.user32.dll_GetWindowThreadProcessId
mov ebp, eax
push 0xffffffffffffffff
push edi
push ebp
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x4c493c
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
push 0
push edi
push ebp
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
sete bl
test bl, bl
jne 0x4c4990
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoA
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [esp + 4]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
jmp 0x4c4990
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
sete bl
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41cc70
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x49221b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0048496b
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x41ccf2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00481fdd
mov eax, dword [eax]
push 0x4cb200
push eax
call fcn.00474564
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00484bf6
test bl, bl
je 0x41ccf2
push 0x4cb200
lea ecx, [esp + 0xc]
call fcn.00484fd2
push 0x4ced7c
lea ecx, [esp + 0xc]
call fcn.00484fd2
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41cd2e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00484bf6
jmp 0x41cdf9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x41cdb2
lea edx, [esp + 0x7c]
push 0x4ced78
push edx
call fcn.00474564
add esp, 8
test eax, eax
je 0x41cdb2
lea eax, [esp + 0x7c]
push 0x4ced74
push eax
call fcn.00474564
add esp, 8
test eax, eax
je 0x41cdb2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41cd42
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00484bf6
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x41d5f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41d652
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc