joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444440
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4445eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x4445cc
mov dl, 1
mov eax, dword [0x46c3bc]
call fcn.00481c1c
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.004828e8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.USER32.DLL_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4445bb
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0045a468
test al, al
je 0x4445ae
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4445fc
lea eax, [ebp - 0x254]
call fcn.0047b0cc
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4445ae
xor eax, eax
push ebp
push 0x4445a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x444634
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x444590
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00482b18
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x444590
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00482b18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4445ae
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4444b1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0046fd5c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4445f2
lea eax, [ebp - 0x260]
call fcn.004828e8
ret

Function at 0x444e38
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4da5d8]
cmp byte [eax + 0x95], 0
jne 0x444ea9
cmp dword [0x4da5f4], 0
jne 0x444e6a
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x444df4
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x4da5f4], eax
cmp dword [0x4da5f0], 0
jne 0x444e85
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x4da5f0], eax
cmp dword [0x4da5f8], 0
jne 0x444ea9
push esp
push 0
push 0
push 0x444d98
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x4da5f8], eax
pop edx
ret
Function at 0x444fa0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x444fb7
add esp, 0xfffffff0
call fcn.00481f8c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00474a6c
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x46bf08]
call fcn.00481c1c
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x46bf08]
call fcn.00481c1c
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x432660]
call fcn.00439d54
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x44512c
mov eax, dword [0x4da45c]
mov eax, dword [eax]
push eax
call sub.USER32.DLL_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0043a124
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x446b90
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4da45c]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.USER32.DLL_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0047e160
test eax, eax
je 0x4450aa
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0047aa6c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0047e188
test eax, eax
je 0x4450be
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.USER32.DLL_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00482b18
mov eax, dword [0x4da464]
cmp byte [eax], 0
jne 0x4450ef
mov eax, ebx
call fcn.00445218
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x445121
call fcn.00481fe4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x445488
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4da5d8]
cmp dword [eax + 0x24], 0
je 0x44552b
cmp dword [ebx + 0x84], 0
jne 0x445525
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x445418
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x445525
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.DLL_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x4454ee
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x445525
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.0046da68
push eax
call sub.USER32.DLL_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4454fd
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x445f38
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x445f6d
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004829d0
jmp 0x445f77
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.0048293c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x446f04
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x446f3c
mov eax, esi
call fcn.00456188
test al, al
je 0x446f3c
mov eax, dword [ebx + 0x74]
call fcn.00455e8c
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x446f3c
push 0
mov eax, dword [ebx + 0x74]
call fcn.00455e8c
push eax
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
ret

Function at 0x44db28
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x4da674], 0
sete dl
or al, dl
jne 0x44dc68
mov eax, dword [0x4da678]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4da674]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x44dc37
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x4da674]
call fcn.0046da68
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x44dc2f
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x168], 0
je 0x44dc2f
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x44dc2f
mov eax, dword [ebp - 0x14]
call fcn.00455e8c
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x44dc2f
push ebp
call fcn.0044dae4
pop ecx
test al, al
jne 0x44dc2f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x90]
cmp eax, dword [ebp - 0x14]
jne 0x44dbeb
mov eax, dword [ebp - 0x14]
call fcn.00454818
dec eax
jle 0x44dc2f
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov bx, 0xffc1
call fcn.00481e28
cmp byte [ebp - 1], 0
je 0x44dc2f
push dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call sub.USER32.DLL_PtInRect
test eax, eax
je 0x44dc2f
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4da678]
call fcn.0044d330
inc edi
dec esi
jne 0x44db7e
mov eax, dword [0x4da678]
cmp dword [eax + 8], 0
jle 0x44dc4f
mov eax, dword [0x4da678]
call fcn.0044d3c0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x44dc68
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0044d94c
pop ecx
test al, al
jne 0x44dc68
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453824
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x453855
je 0x4538af
sub eax, 7
je 0x453876
dec eax
je 0x4538a0
sub eax, 0x17
je 0x453954
jmp 0x453992
add eax, 0xffffff00
sub eax, 9
jb 0x453940
add eax, 0xffffff09
sub eax, 0xb
jb 0x453908
jmp 0x453992
mov eax, ebx
call fcn.0043db84
mov edi, eax
test edi, edi
je 0x4539f2
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x4539fb
jmp 0x4539f2
test byte [ebx + 0x44], 0x20
jne 0x4539fb
jmp 0x4539f2
mov edx, esi
mov eax, ebx
call fcn.00450e24
cmp dword [esi + 0xc], 0xffffffff
jne 0x4539fb
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.004766c0
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.0044f930
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.004536fc
test eax, eax
je 0x4539fb
mov dword [esi + 0xc], 1
jmp 0x4539fb
mov edx, esi
mov eax, ebx
call fcn.00453790
test al, al
je 0x4539f2
cmp dword [esi + 0xc], 0
jne 0x4539fb
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.00455e8c
push eax
call sub.USER32.DLL_DefWindowProcA
jmp 0x4539fb
mov eax, ebx
call fcn.004504c0
test al, al
jne 0x4539fb
jmp 0x4539f2
mov eax, ebx
call fcn.00455e8c
mov edi, eax
call sub.USER32.DLL_GetCapture
cmp edi, eax
jne 0x4539f2
cmp dword [0x4c72f0], 0
je 0x4539f2
mov eax, dword [0x4c72f0]
cmp ebx, dword [eax + 0x24]
jne 0x4539f2
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x4c72f0]
call fcn.00450d58
jmp 0x4539f2
mov eax, dword [0x4da63c]
cmp byte [eax + 0x20], 0
je 0x4539f2
mov eax, dword [0x4da63c]
cmp dword [eax + 0x1c], 0
je 0x4539f2
mov eax, dword [esi]
mov edx, dword [0x4da63c]
cmp eax, dword [edx + 0x1c]
jne 0x4539f2
lea eax, [ebp - 0x110]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.0043dac8
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.00481e28
jmp 0x4539fb
mov edx, esi
mov eax, ebx
call fcn.00450e24
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453ebc
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x453ed8
cmp dword [esi + 4], 0
je 0x453f05
test byte [ebx + 0x45], 1
jne 0x453ef7
mov eax, ebx
call fcn.00452df4
test eax, eax
jne 0x453ef7
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x454015
mov edx, esi
mov eax, ebx
call fcn.00453b34
jmp 0x454015
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45400e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00455e8c
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00450d58
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00453ebc
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00455e8c
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454015
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ee9c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45ef74
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4da6c0], 0
jne 0x45ef58
lea eax, [ebp - 4]
mov edx, 0x45ef8c
call fcn.00482980
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00482d2c
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x45ef58
mov eax, ebx
call fcn.004814a8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45ef51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x45ef3b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x45ef9c
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x45ef3b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4da6c0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ef58
mov eax, dword [ebp - 0xc]
call fcn.004814c0
ret
mov ebx, dword [0x4da6c0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ef7b
lea eax, [ebp - 4]
call fcn.004828e8
ret

Function at 0x4749d8
Capabilities:
Suspend thread

Disassembly:
mov byte [eax + 0xd], 1
mov eax, dword [eax + 4]
push eax
call sub.KERNEL32.DLL_SuspendThread
ret

Function at 0x4749e8
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 1
jne 0x4749fd
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x47cc94
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x47cccd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004829d0
jmp 0x47ccd6
mov eax, ebx
mov edx, esi
call fcn.0048293c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x47cce0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x47cd01
mov al, byte [esp]
jmp 0x47cd03
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x48174c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x48177b
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004829d0
jmp 0x481799
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00481674
mov edi, eax
test ebx, ebx
je 0x481799
cmp dword [esi], 0
je 0x481799
dec ebx
jmp 0x481782
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x481ac4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4c782c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x481b5c
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x481b3c
xor eax, eax
push ebp
push 0x481b35
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x481b78
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481b3c
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x4c782c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4c782c], ax
mov esp, ebp
pop ebp
ret

Function at 0x48289c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004814a8
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4da95d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x482864
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4844a0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x48465c
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x484501
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x484678
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x484573
xor eax, eax
push ebp
push 0x48456c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.004842f8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x484555
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x484698
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484573
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x484654
cmp byte [ebp - 0xd], 0
jne 0x4845b5
cmp byte [ebp - 0x12], 0
je 0x484654
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4845ce
dec ebx
cmp byte [ebx], 0x2e
je 0x4845dd
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4845cd
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x484654
inc ebx
cmp byte [ebp - 0x12], 0
je 0x48460a
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x484654
cmp byte [ebp - 0xd], 0
je 0x484654
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x484654
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484a48
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x484b30
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x4dad40], 1
jae 0x484b22
xor eax, eax
mov dword [0x4da94c], eax
xor eax, eax
mov dword [0x4da954], eax
xor eax, eax
mov dword [0x4da958], eax
mov byte [0x4da95e], 2
mov byte [0x4da95f], 2
mov byte [0x4da960], 3
mov word [0x4dad08], 0
mov word [0x4dad18], 1
mov word [0x4dad28], 0xa
mov dword [0x4dad30], 0x80020004
mov dword [0x4dacfc], 0x48360c
mov dword [0x4dad00], 0x483604
mov dword [0x4dad04], 0x48360c
call fcn.00481a94
test al, al
je 0x484ae1
call fcn.00481ac4
call fcn.00481b88
mov eax, 0x4da964
mov edx, 0x484b3c
call fcn.0047f1a6
mov eax, 0x4dab30
mov edx, 0x484b3c
call fcn.0047f1a6
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x4da944], eax
call fcn.00480164
mov dword [0x4da940], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x4da938], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484b37
ret