joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ab7a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x4ab7ec
mov eax, esi
call fcn.004921ec
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4ab7ec
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x4ab7ec
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x4ab92b
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x4ab82c
cmp eax, 0x108
ja 0x4ab82c
mov eax, esi
call fcn.004921ec
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4ab922
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x4ab92b
jmp 0x4ab922
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x4ab90b
cmp eax, 0x20a
ja 0x4ab90b
test byte [esi + 0x50], 0x80
jne 0x4ab85e
sub eax, 0x203
je 0x4ab85b
sub eax, 3
je 0x4ab85b
sub eax, 3
jne 0x4ab85e
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x4ab872
dec eax
je 0x4ab887
dec eax
je 0x4ab8a4
dec eax
je 0x4ab887
jmp 0x4ab8ab
mov ecx, ebx
mov eax, dword [0x558fe8]
mov eax, dword [eax]
mov edx, esi
call fcn.0049b9c8
jmp 0x4ab922
cmp byte [esi + 0x5d], 1
jne 0x4ab89d
mov eax, esi
mov si, 0xffed
call fcn.00403fa8
jmp 0x4ab92b
or word [esi + 0x54], 1
jmp 0x4ab922
and word [esi + 0x54], 0xfffe
jmp 0x4ab922
mov eax, dword [0x55e780]
cmp byte [eax + 0x20], 0
je 0x4ab922
mov eax, dword [0x55e780]
cmp dword [eax + 0x1c], 0
je 0x4ab922
mov eax, dword [ebx]
mov edx, dword [0x55e780]
cmp eax, dword [edx + 0x1c]
jne 0x4ab922
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00492130
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403fa8
jmp 0x4ab92b
cmp eax, 0xb00b
jne 0x4ab922
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.004aa0fc
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aedac
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x4aedc8
cmp dword [esi + 4], 0
je 0x4aedf5
test byte [ebx + 0x55], 1
jne 0x4aede7
mov eax, ebx
call fcn.004ad9b8
test eax, eax
jne 0x4aede7
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4aef05
mov edx, esi
mov eax, ebx
call fcn.004ae8d0
jmp 0x4aef05
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4aeefe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004b0c1c
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.004ab6d4
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004aedac
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004b0c1c
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aef05
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b5314
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x5591fc]
cmp byte [eax + 0xc], 0
je 0x4b5481
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b547a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x55e7d4], 0
jne 0x4b5368
push 0x4b5488
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x4b5490
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x55e7d4], eax
cmp dword [0x557b00], 0
jne 0x4b5463
push 0x4b54a0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x557b00], eax
cmp dword [0x557b00], 0
je 0x4b5463
push 0x4b54ac
mov eax, dword [0x557b00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x55e7d8], eax
push 0x4b54bc
mov eax, dword [0x557b00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x55e7dc], eax
push 0x4b54d0
mov eax, dword [0x557b00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x55e7e0], eax
push 0x4b54e8
mov eax, dword [0x557b00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x55e7e4], eax
push 0x4b5500
mov eax, dword [0x557b00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x55e7e8], eax
push 0x4b5514
mov eax, dword [0x557b00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x55e7ec], eax
push 0x4b552c
mov eax, dword [0x557b00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x55e7f0], eax
push 0x4b5544
mov eax, dword [0x557b00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x55e7f4], eax
push 0x4b5560
mov eax, dword [0x557b00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x55e7f8], eax
push 0x4b556c
mov eax, dword [0x557b00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x55e7fc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5481
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x4b59fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe2c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b5af2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x90
call fcn.0040285c
mov ebx, eax
push ebx
push 0x90
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404e78
mov eax, ebx
call fcn.0040287c
lea eax, [ebp - 0x1d4]
mov ecx, 0x4b5b08
mov edx, dword [ebp - 4]
call fcn.00404fa8
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.004030fc
xor eax, eax
push ebp
push 0x4b5a95
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d0]
call fcn.00402e8c
call fcn.00402a14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5a9f
xor eax, eax
push ebp
push 0x4b5ac7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d0]
call fcn.004031c4
call fcn.00402a14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b5ad1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5af9
lea eax, [ebp - 0x1d4]
call fcn.00404c80
lea eax, [ebp - 4]
call fcn.00404c80
ret
Function at 0x4b6440
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4b6565
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.0040515c
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4b654f
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040515c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x4b6546
cmp dword [ebp - 0xc], 7
jne 0x4b6546
mov eax, dword [ebp - 0x10]
call fcn.0040285c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4b653d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040515c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, dword [ebp - 0x14]
jmp 0x4b6522
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00404e78
mov edx, dword [ebp - 0x1c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
push ebx
call sub.kernel32.dll_lstrlenA_1
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x4b6505
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6544
mov eax, dword [ebp - 0x14]
call fcn.0040287c
ret
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b656c
lea eax, [ebp - 0x1c]
call fcn.00404c80
ret

Function at 0x4b680c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b68cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x4b68dc
lea edi, [ebp - 0x109]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 4]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404ef0
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 4]
call fcn.0040c478
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 4]
call fcn.00404d18
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.00404f5c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004051bc
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404cd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b68d4
lea eax, [ebp - 0x110]
call fcn.00404c80
lea eax, [ebp - 4]
call fcn.00404c80
ret
Function at 0x4b69e4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
mov ebx, 1
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
mov edx, dword [ebp - 0x90]
mov esi, dword [ebp - 0x8c]
cmp eax, 2
jne 0x4b6af9
mov ebx, 2
cmp edx, 5
jne 0x4b6a72
call fcn.004b6cd4
cmp eax, 2
jle 0x4b6a5a
test esi, esi
jne 0x4b6a47
mov ebx, 3
jmp 0x4b6af9
cmp esi, 2
jl 0x4b6af9
mov ebx, 9
jmp 0x4b6af9
cmp esi, 1
je 0x4b6a68
cmp esi, 2
jne 0x4b6af9
mov ebx, 4
jmp 0x4b6af9
cmp edx, 6
jne 0x4b6aeb
call fcn.004b6cd4
cmp eax, 2
jle 0x4b6ab0
test esi, esi
jne 0x4b6a8c
mov ebx, 7
jmp 0x4b6af9
cmp esi, 1
jne 0x4b6a98
mov ebx, 0xb
jmp 0x4b6af9
cmp esi, 2
jne 0x4b6aa4
mov ebx, 0xa
jmp 0x4b6af9
cmp esi, 3
jne 0x4b6af9
mov ebx, 0xc
jmp 0x4b6af9
test esi, esi
jne 0x4b6abb
mov ebx, 5
jmp 0x4b6af9
cmp esi, 1
jne 0x4b6ac7
mov ebx, 6
jmp 0x4b6af9
cmp esi, 2
jne 0x4b6ad3
mov ebx, 8
jmp 0x4b6af9
cmp esi, 3
jne 0x4b6adf
mov ebx, 0xd
jmp 0x4b6af9
cmp esi, 4
jl 0x4b6af9
mov ebx, 0xe
jmp 0x4b6af9
cmp edx, 0xa
jl 0x4b6af9
test esi, esi
jl 0x4b6af9
mov ebx, 0xe
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b6c2c
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040514c
mov eax, dword [ebp - 8]
call fcn.0040514c
xor eax, eax
push ebp
push 0x4b6cc4
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.0040515c
push eax
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jbe 0x4b6ca7
push 4
mov eax, dword [ebp - 8]
call fcn.0040515c
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
jbe 0x4b6ca1
lea eax, [ebp - 0x24]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4b6c9b
mov esi, dword [ebp - 0x20]
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6ccb
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ca4
ret
Function at 0x4b7618
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4b7621
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4b77c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004b7960
xor eax, eax
push ebp
push 0x4b77a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x4b7670
call fcn.004046a8
jmp 0x4b77aa
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x4b7732
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x4b76c0
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x4b76c0
lea eax, [ebp - 0x10]
call fcn.004b73d4
push dword [ebp - 0x10]
push 0x4b77e0
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040501c
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
mov cl, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x4b76f5
lea eax, [ebp - 0x18]
call fcn.004b73d4
push dword [ebp - 0x18]
push 0x4b77e0
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040501c
mov eax, dword [ebp - 0x14]
call fcn.0040515c
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x4b778d
lea eax, [ebp - 0x20]
call fcn.004b73d4
push dword [ebp - 0x20]
push 0x4b77e0
push ebx
push 0x4b77ec
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.0040501c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004b75e4
jmp 0x4b778d
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x4b7754
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x4b7754
push ebx
mov edi, dword [ebp - 4]
mov cl, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x4b776a
mov eax, ebx
call fcn.0040515c
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x4b778d
lea eax, [ebp - 0x24]
mov ecx, 0x4b77ec
mov edx, ebx
call fcn.00404fa8
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004b75e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b77aa
mov eax, dword [ebp - 4]
call fcn.004b7970
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b77cc
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00404ca4
ret

Function at 0x4c3d04
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 8
call fcn.004033a0
lea eax, [ebx + 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, edi
call fcn.0040515c
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 1]
mov eax, dword [ebp - 8]
call fcn.004c3aa8
mov byte [ebx], al
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4c3e04
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040515c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4c3e5b
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, 0x4c3e80
mov dl, 1
mov eax, dword [0x4c3950]
call fcn.00410310
call fcn.004045fc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004c3aa8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4c6da4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4c6dd2
mov eax, ebx
call fcn.004c7858
cmp dword [ebx + 0x40], 0
je 0x4c6dcb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4c6e43
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4c6e35
cmp dword [ebx + 8], 0
je 0x4c6df4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4c6e06
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4c6e35
cmp dword [ebx + 8], 0
je 0x4c6de7
cmp eax, 3
je 0x4c6e19
dec eax
jne 0x4c6de7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4c6de7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4c6de7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4c6e61
cmp dword [ebx + 0x14], 0xcc
je 0x4c6e61
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004c6e6c
pop ebx
ret

Function at 0x4d8b98
Capabilities:
Check os version

Disassembly:
push ebx
push esi
add esp, 0xffffff6c
mov ebx, 1
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 4]
mov esi, dword [esp + 8]
cmp eax, 2
jne 0x4d8c9b
mov ebx, 2
cmp edx, 5
jne 0x4d8c14
call fcn.004b6cd4
cmp eax, 2
jle 0x4d8bfc
test esi, esi
jne 0x4d8be9
mov ebx, 3
jmp 0x4d8c9b
cmp esi, 2
jne 0x4d8c9b
mov ebx, 0xa
jmp 0x4d8c9b
cmp esi, 1
je 0x4d8c0a
cmp esi, 2
jne 0x4d8c9b
mov ebx, 4
jmp 0x4d8c9b
cmp edx, 6
jne 0x4d8c8d
call fcn.004b6cd4
cmp eax, 2
jle 0x4d8c52
test esi, esi
jne 0x4d8c2e
mov ebx, 7
jmp 0x4d8c9b
cmp esi, 1
jne 0x4d8c3a
mov ebx, 0xb
jmp 0x4d8c9b
cmp esi, 2
jne 0x4d8c46
mov ebx, 9
jmp 0x4d8c9b
cmp esi, 3
jne 0x4d8c9b
mov ebx, 0xc
jmp 0x4d8c9b
test esi, esi
jne 0x4d8c5d
mov ebx, 5
jmp 0x4d8c9b
cmp esi, 1
jne 0x4d8c69
mov ebx, 6
jmp 0x4d8c9b
cmp esi, 2
jne 0x4d8c75
mov ebx, 8
jmp 0x4d8c9b
cmp esi, 3
jne 0x4d8c81
mov ebx, 0xd
jmp 0x4d8c9b
cmp esi, 4
jl 0x4d8c9b
mov ebx, 0xe
jmp 0x4d8c9b
cmp edx, 0xa
jl 0x4d8c9b
test esi, esi
jl 0x4d8c9b
mov ebx, 0xe
mov eax, ebx
add esp, 0x94
pop esi
pop ebx
ret
Function at 0x4d8fb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d91d2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4d91a2
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push 0x4d91f0
push edi
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040501c
mov dword [ebp - 0x1c], 0xc
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0xc
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor ebx, ebx
mov dword [ebp - 0x6c], 0x44
xor eax, eax
mov dword [ebp - 0x68], eax
xor eax, eax
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x40], 1
mov word [ebp - 0x3a], 0
xor eax, eax
mov dword [ebp - 0x38], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
mov eax, esi
call fcn.0040515c
push eax
push ebx
push 0x20
push 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
call fcn.0040515c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x4d90eb
lea edx, [ebp - 0x84]
mov eax, dword [0x558fe8]
mov eax, dword [eax]
call fcn.0049b4c0
push dword [ebp - 0x84]
push 0x4d91fc
push dword [ebp - 8]
push 0x4d91fc
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x88]
call fcn.0040f95c
push dword [ebp - 0x88]
lea eax, [ebp - 0x80]
mov edx, 5
call fcn.0040501c
mov eax, dword [ebp - 0x80]
mov edx, 1
call fcn.004d9204
mov dword [ebp - 0x10], 0x103
xor eax, eax
push ebp
push 0x4d9166
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4d9147
mov eax, dword [0x558fe8]
mov eax, dword [eax]
call fcn.0049ad04
xor eax, eax
push ebp
push 0x4d9130
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x3e8
call sub.kernel32.dll_Sleep_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d913a
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x7c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp byte [ebp - 9], 1
jne 0x4d915c
cmp dword [ebp - 0x10], 0x103
jne 0x4d915c
cmp byte [ebp + 8], 1
je 0x4d9102
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d9170
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
cmp byte [ebp - 9], 1
jne 0x4d9198
mov eax, dword [ebp - 0x7c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x78]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d91ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d91ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d91d9
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.00404ca4
lea eax, [ebp - 8]
call fcn.00404c80
ret