joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d0d8
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405e6c
push eax
call sub.kernel32.dll_GetFileAttributesW
pop ebx
ret

Function at 0x40d0ec
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00405e6c
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x40d10e
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4130b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4130e9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00405f1c
jmp 0x4130f2
mov eax, ebx
mov edx, esi
call fcn.00405de0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4130fc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41311e
movzx eax, word [esp]
jmp 0x413120
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4139f4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x413b19
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00413808
mov esi, eax
mov eax, dword [0x540ec8]
cmp byte [eax], 0
je 0x413ac1
mov eax, dword [0x5408e8]
call fcn.00403570
call fcn.004031cc
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4139d0]
call fcn.004078d4
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x413b34
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x413afd
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x54081c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x544b50]
call fcn.004079c8
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413b20
lea eax, [ebp - 4]
mov edx, dword [0x4139d0]
call fcn.004078e0
ret
Function at 0x41476c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x414842
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405e34
lea eax, [ebp - 4]
call fcn.00406838
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405e6c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x41482c
mov eax, ebx
call fcn.00403064
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x414825
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405e6c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x41480f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x414854
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x41480f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41482c
mov eax, dword [ebp - 0x10]
call fcn.00403080
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414849
lea eax, [ebp - 4]
call fcn.00405dd0
ret

Function at 0x415e48
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00405430
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x415df2
mov eax, edi
add eax, eax
call fcn.00403064
mov esi, eax
jmp 0x415df4
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x415e2d
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x415e17
mov eax, esp
cmp esi, eax
je 0x415e3a
mov eax, esi
call fcn.00403080
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x415e74
cmp bl, 0
je 0x415e70
cmp bl, 0x41
jl 0x415e6b
cmp bl, 0x5a
jg 0x415e6b
or bl, 0x20
xor al, bl
inc esi
jmp 0x415e4f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x415db4

Function at 0x42cca8
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0042c9ac
dec esi
jne 0x42ccca
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x42de74
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x546e98
cmp dword [edi], 0
jne 0x42def0
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x546e94]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x52fda0
mov ecx, 2
call fcn.0040324c
mov edx, 0x42de4c
lea eax, [esi + 5]
call fcn.0042de6c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0042de6c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x42dec5
mov dword [0x546e94], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42e9c0
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.0040369c
ret
Function at 0x436f84
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov eax, 0xedb88320
xor esi, esi
mov ebx, dword [esp]
mov edx, esi
mov ecx, 0xfffffff8
mov edi, edx
and edi, 1
dec edi
jne 0x436faa
shr edx, 1
xor edx, eax
jmp 0x436fac
shr edx, 1
inc ecx
jne 0x436f9c
mov dword [ebx], edx
inc esi
add ebx, 4
cmp esi, 0x100
jne 0x436f95
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x436fc4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x436fcd
mov eax, dword [ebp - 4]
add esp, 0xfffff7f0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00427e28
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
sub eax, dword [ebp + 8]
sub eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x43707a
cmp dword [ebp - 0xc], 0x2800
jl 0x437028
mov dword [ebp - 8], 0x2800
jmp 0x43702e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x2814]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp ebx, dword [ebp - 0x10]
jge 0x437072
mov eax, esi
shr eax, 8
and eax, 0xffffff
movzx edx, byte [ebp + ebx - 0x2814]
xor esi, edx
and esi, 0xff
xor eax, dword [esi*4 + 0x546e9c]
mov esi, eax
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x437049
mov eax, dword [ebp - 8]
sub dword [ebp - 0xc], eax
jmp 0x437010
mov ebx, esi
xor ebx, 0xffffffff
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x441e40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jb 0x441e94
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x5357d8]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x535bd8]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x535fd8]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x5363d8]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x441e4e
pop edi
pop esi
pop ebx
ret
Function at 0x442fd4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00405e6c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
je 0x44302c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x541218]
mov dl, 1
mov eax, dword [0x442820]
call fcn.00413c58
call fcn.004047b8
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004429a8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x482e68
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa8], 0
je 0x482ed3
cmp byte [ebx + 0xcf], 0
jne 0x482ed3
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405f1c
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x482ec0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x482ee0
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00405de0
jmp 0x482ee0
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.00405de0
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x484204
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x80]
test esi, esi
je 0x484272
mov eax, esi
call fcn.0046b2dc
test al, al
je 0x484272
mov eax, dword [ebx + 0x80]
call fcn.0046afd4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x484272
mov eax, dword [ebx + 0x80]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x484266
push 0
mov eax, dword [ebx + 0x80]
call fcn.0046afd4
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x80]
call fcn.00462754
jmp 0x484272
mov cl, 1
mov edx, dword [ebx + 0x70]
mov eax, ebx
call fcn.00484050
pop esi
pop ebx
ret

Function at 0x48781c
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004883d4
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x4882d0
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff20
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x40
jle 0x488315
lea eax, [ebp - 0x60]
call fcn.0048781c
mov edx, ebx
lea eax, [ebp - 0x60]
mov ecx, dword [ebp + 0xc]
call fcn.00487844
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.00487918
mov dword [ebp + 0xc], 0x10
mov esi, dword [ebp + 8]
jmp 0x488317
mov esi, ebx
xor ecx, ecx
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0xe0]
lea ebx, [ecx + 1]
cmp ebx, dword [ebp + 0xc]
jg 0x488340
movzx ebx, byte [esi]
xor bl, 0x36
mov byte [eax], bl
movzx ebx, byte [esi]
xor bl, 0x5c
mov byte [edx], bl
inc esi
jmp 0x488346
mov byte [eax], 0x36
mov byte [edx], 0x5c
inc ecx
inc edx
inc eax
cmp ecx, 0x40
jne 0x488325
lea eax, [ebp - 0x60]
call fcn.0048781c
lea edx, [ebp - 0xa0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.00487844
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 8]
call fcn.004881b8
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.00487918
lea eax, [ebp - 0x60]
call fcn.0048781c
lea edx, [ebp - 0xe0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.00487844
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x60]
mov ecx, 0x10
call fcn.00487844
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.00487918
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d70a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405dc8
xor eax, eax
push ebp
push 0x4d72f3
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0040bc9c
mov edx, dword [ebp - 0x5c]
mov eax, 0x4d7314
call fcn.0040688c
dec eax
jne 0x4d712c
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4c8fa8]
call fcn.004c94d8
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x49dd78]
call fcn.004b01bc
mov edx, eax
mov ebx, dword [ebp - 0x18]
mov eax, ebx
call fcn.004d2350
mov eax, ebx
call fcn.004d2344
call fcn.004b45ac
jmp 0x4d713d
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4c8118]
call fcn.004c94d8
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4d72c4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x40
call fcn.0040369c
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 8]
lea edx, [ebp - 0x58]
mov ecx, 0x20
call fcn.00405fc8
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x40
call fcn.0040369c
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
push dword [ebp - 8]
push 0x4d7334
lea eax, [ebp - 0x60]
lea edx, [ebp - 0x58]
mov ecx, 0x20
call fcn.00405fc8
push dword [ebp - 0x60]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00406380
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x374], edx
mov eax, dword [ebp - 0x18]
add eax, 0x118
mov edx, dword [ebp - 8]
call fcn.00405de0
mov eax, dword [ebp - 0x18]
add eax, 0xec
mov edx, dword [ebp - 4]
call fcn.00405de0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x188], edx
xor eax, eax
push ebp
push 0x4d7220
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
call fcn.004d1a44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d72a2
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x12c]
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d72cb
mov eax, dword [ebp - 0x18]
call fcn.00403ddc
ret
Function at 0x4da1cc
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4da42f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405e34
lea eax, [ebp - 0x120]
xor ecx, ecx
mov edx, 0x11c
call fcn.0040369c
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
lea eax, [ebp - 0x144]
xor ecx, ecx
mov edx, 0x24
call fcn.0040369c
push 0x4da43c
push 0x4da464
call sub.kernel32.dll_GetModuleHandleW_1
push eax
call fcn.00408f28
test eax, eax
je 0x4da256
lea edx, [ebp - 0x144]
push edx
call eax
jmp 0x4da262
lea eax, [ebp - 0x144]
push eax
call sub.kernel32.dll_GetSystemInfo_1
cmp dword [ebp - 0x110], 2
jne 0x4da40f
test bl, bl
je 0x4da292
call fcn.004da5dc
mov edx, dword [eax]
mov dword [ebp - 0x11c], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x118], edx
mov eax, dword [eax + 8]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffffd
sub eax, 2
jae 0x4da2ad
lea eax, [ebp - 4]
mov edx, 0x4da48c
call fcn.00405e34
cmp dword [ebp - 0x11c], 5
jne 0x4da2d1
cmp dword [ebp - 0x118], 0
jne 0x4da2d1
lea eax, [ebp - 4]
mov edx, 0x4da4b0
call fcn.00405e34
jmp 0x4da40f
cmp dword [ebp - 0x11c], 5
jne 0x4da2f5
cmp dword [ebp - 0x118], 1
jne 0x4da2f5
lea eax, [ebp - 4]
mov edx, 0x4da4d8
call fcn.00405e34
jmp 0x4da40f
cmp dword [ebp - 0x11c], 5
jne 0x4da33b
cmp dword [ebp - 0x118], 2
jne 0x4da33b
cmp byte [ebp - 6], 1
jne 0x4da329
cmp word [ebp - 0x144], 9
jne 0x4da329
lea eax, [ebp - 4]
mov edx, 0x4da4d8
call fcn.00405e34
jmp 0x4da40f
lea eax, [ebp - 4]
mov edx, 0x4da4fc
call fcn.00405e34
jmp 0x4da40f
cmp dword [ebp - 0x11c], 6
jne 0x4da35f
cmp dword [ebp - 0x118], 0
jne 0x4da35f
lea eax, [ebp - 4]
mov edx, 0x4da530
call fcn.00405e34
jmp 0x4da40f
cmp dword [ebp - 0x11c], 6
jne 0x4da383
cmp dword [ebp - 0x118], 1
jne 0x4da383
lea eax, [ebp - 4]
mov edx, 0x4da558
call fcn.00405e34
jmp 0x4da40f
cmp dword [ebp - 0x11c], 6
jne 0x4da3a9
mov eax, dword [ebp - 0x118]
add eax, 0xfffffffe
sub eax, 2
jae 0x4da3a9
lea eax, [ebp - 4]
mov edx, 0x4da578
call fcn.00405e34
jmp 0x4da40f
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jne 0x4da3ce
mov edx, dword [ebp - 0x118]
sub edx, 4
jne 0x4da3ce
lea eax, [ebp - 4]
mov edx, 0x4da598
call fcn.00405e34
jmp 0x4da40f
cmp eax, 0xa
jne 0x4da3fd
cmp dword [ebp - 0x114], 0x55f0
jae 0x4da3ee
lea eax, [ebp - 4]
mov edx, 0x4da598
call fcn.00405e34
jmp 0x4da40f
lea eax, [ebp - 4]
mov edx, 0x4da5bc
call fcn.00405e34
jmp 0x4da40f
cmp eax, 0xb
jb 0x4da40f
lea eax, [ebp - 4]
mov edx, 0x4da5bc
call fcn.00405e34
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405de0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da436
lea eax, [ebp - 4]
call fcn.00405dd0
ret
Function at 0x4dab44
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
test dl, dl
je 0x4dab63
add esp, 0xfffffff0
call fcn.00404214
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4dac07
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, esi
call fcn.004dacbc
mov dword [esi + 0x18], 0xf003f
mov byte [esi + 0xc], 1
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x110], 5
jne 0x4dabb9
call fcn.004da7d4
test al, al
jne 0x4dabe7
cmp dword [ebp - 0x110], 5
ja 0x4dabe7
lea edx, [ebp - 0x118]
xor eax, eax
call fcn.004da1cc
mov eax, dword [ebp - 0x118]
mov edx, 0x4dac38
call fcn.0040bf78
test al, al
jne 0x4dabe7
xor eax, eax
jmp 0x4dabe9
mov al, 1
mov byte [0x547ad0], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dac0e
lea eax, [ebp - 0x118]
call fcn.00405dd0
ret

Function at 0x4db188
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.004daaec
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00405e6c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x4db1e7
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x540c30]
mov dl, 1
mov eax, dword [0x4da998]
call fcn.00413c58
call fcn.004047b8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4db224
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4db37f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
call fcn.004daaec
mov dword [ebp - 0xc], eax
mov eax, esi
xor edx, edx
call fcn.00405de0
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x4db279
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
jmp 0x4db27c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
dec eax
sub al, 2
jae 0x4db28b
add dword [ebp - 0x10], 2
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4db1f0]
call fcn.004078d4
add esp, 4
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.0040369c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, edi
call fcn.00405e6c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov ebx, eax
test ebx, ebx
jne 0x4db2e1
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405f8c
mov edx, dword [esi]
mov eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4db2f4
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x802
jle 0x4db349
mov eax, edx
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x4db30c
sub esi, 4
mov esi, dword [esi]
push 0x4db39c
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040c820
push dword [ebp - 0x1c]
push 0x4db3dc
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0040c820
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00406380
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dl, 1
call fcn.004daa80
mov eax, dword [ebp - 0xc]
call fcn.004dab1c
mov edx, dword [ebp + 0xc]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db386
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00405dd8
lea eax, [ebp - 4]
mov edx, dword [0x4db1f0]
call fcn.004078e0
ret

Function at 0x4db4dc
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
mov ebx, eax
mov eax, ebx
xor edx, edx
call fcn.00405de0
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x4db519
mov eax, ebx
lea edx, [ebp - 0x20c]
call fcn.00405f8c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4db520
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4db59c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
jbe 0x4db583
push ebx
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.00405fc8
mov eax, dword [ebp - 0x20c]
mov ecx, 2
mov edx, 1
call fcn.00406574
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db5a3
lea eax, [ebp - 0x20c]
call fcn.00405dd0
ret