joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5f04
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4b5f16
add esp, 0xfffffff0
call fcn.00405374
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00442dac
mov eax, dword [0x50f1e4]
mov dword [eax + 4], ebx
mov dword [eax], 0x4b6360
mov eax, dword [0x50f1f0]
mov dword [eax + 4], ebx
mov dword [eax], 0x4b636c
mov eax, ebx
call fcn.004b6378
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x42b844]
call fcn.00404e10
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x42b844]
call fcn.00404e10
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x42b844]
call fcn.00404e10
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x42b844]
call fcn.00404e10
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x42b844]
call fcn.00404e10
mov dword [ebx + 0x78], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x44], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x5c]
push eax
mov eax, 0x4b0cac
push eax
push 0
push 0
mov eax, dword [0x50f3ec]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x44e260]
call fcn.00454534
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x44e260]
call fcn.00454534
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x44e260]
call fcn.00454534
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x44e260]
call fcn.00454534
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x44e260]
call fcn.00454534
mov dword [ebx + 0x8c], eax
mov eax, ebx
call fcn.004b68d0
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4b6740
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4b6740
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4b6740
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4b6740
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4b6740
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4b6091
call fcn.004053cc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4b64e0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b668d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
jne 0x4b666e
mov dl, 1
mov eax, dword [0x42df44]
call fcn.0043a364
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
xor edx, edx
call fcn.00406b44
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4b665d
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00498c08
test al, al
je 0x4b6650
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x4b669c
lea eax, [ebp - 0x394]
call fcn.00414b14
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4b6650
xor eax, eax
push ebp
push 0x4b6649
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x4b670c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4b6632
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406d44
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x40]
jne 0x4b6632
mov eax, dword [ebp - 4]
add eax, 0x3c
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406d44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6650
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4b6553
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.0043a2a0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6694
lea eax, [ebp - 0x3a0]
call fcn.00406b34
ret

Function at 0x4b71ec
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5152bc]
cmp byte [eax + 0xad], 0
jne 0x4b725e
cmp dword [0x5152d4], 0
jne 0x4b721e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x508058]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5152d4], eax
cmp dword [0x5152d0], 0
jne 0x4b7239
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x5152d0], eax
cmp dword [0x5152d8], 0
jne 0x4b725e
push esp
push 0
push 0
mov eax, dword [0x508054]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x5152d8], eax
pop edx
ret
Function at 0x4b7584
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4b759b
add esp, 0xfffffff0
call fcn.00405374
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00442dac
mov eax, dword [0x50f0d0]
cmp byte [eax], 0
jne 0x4b75c8
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x50f3c4]
cmp word [eax + 2], 0
jne 0x4b75e2
mov eax, dword [0x50f3c4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004b967c
mov eax, dword [0x50f4c8]
cmp word [eax + 2], 0
jne 0x4b75fc
mov eax, dword [0x50f4c8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004b988c
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x44e260]
call fcn.00454534
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4b9e3c
mov dl, 1
mov eax, dword [0x42b844]
call fcn.00404e10
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x42b844]
call fcn.00404e10
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x4526f8]
call fcn.0045d9a4
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4b77dc
mov eax, dword [0x50f278]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0045de38
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4ba124
mov dl, 1
mov eax, dword [0x42b844]
call fcn.00404e10
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x50f278]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00414920
test eax, eax
je 0x4b770d
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00414624
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00414904
test eax, eax
je 0x4b7725
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00406d44
push ebx
push 0x4b904c
call fcn.004ad294
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x50f0d0]
cmp byte [eax], 0
jne 0x4b7776
mov eax, ebx
call fcn.004b7950
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004ba350
mov eax, ebx
call fcn.004baf84
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4b77d3
call fcn.004053cc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b7c24
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4b7cc6
cmp dword [ebx + 0x94], 0
jne 0x4b7cc0
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4b7b70
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4b7cc0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4b7c86
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4b7cc0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00436c40
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4b7c95
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4b7ee4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5152bc]
cmp dword [eax + 0x170], 0
je 0x4b8049
test bl, bl
jne 0x4b7f97
cmp dword [esi + 0x9c], 0
jne 0x4b7f8c
mov eax, esi
call fcn.004badd4
push eax
push 0x4b7df0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4b7f5d
mov eax, dword [0x5152bc]
cmp byte [eax + 0xd3], 0
je 0x4b7f5d
mov eax, dword [esi + 0xd8]
call fcn.004082f0
mov edi, eax
cmp edi, 0
jl 0x4b7f5d
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b7f46
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b7f8c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00436c40
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b7f6c
inc dword [esi + 0x9c]
jmp 0x4b8049
cmp dword [esi + 0x9c], 0
jle 0x4b8049
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4b8049
cmp dword [esi + 0x44], 0
je 0x4b7ff4
mov eax, dword [0x5152bc]
cmp byte [eax + 0xd3], 0
je 0x4b7ff4
mov eax, dword [esi + 0xd8]
call fcn.004082f0
mov edi, eax
cmp edi, 0
jl 0x4b7ff4
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b7fdd
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b8023
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00436c40
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b8003
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4ab16c]
call fcn.004084b0
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4b8c98
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4b8d03
cmp byte [ebx + 0xd3], 0
jne 0x4b8d03
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406c80
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4b8cf0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4b8d10
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406b44
jmp 0x4b8d10
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406b44
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4ba538
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4ba5a6
mov eax, esi
call fcn.00492b5c
test al, al
je 0x4ba5a6
mov eax, dword [ebx + 0x84]
call fcn.004927b0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4ba5a6
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4ba59a
push 0
mov eax, dword [ebx + 0x84]
call fcn.004927b0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00489784
jmp 0x4ba5a6
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004ba370
pop esi
pop ebx
ret

Function at 0x4bc86c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bc8e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00406ec0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00406bd0
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x4bc8c4
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00407284
jmp 0x4bc8d3
mov eax, ebx
mov edx, dword [0x50f1a4]
mov edx, dword [edx]
call fcn.00406b44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc8f0
lea eax, [ebp - 4]
call fcn.00406b34
ret

Function at 0x4bc8f8
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
mov edx, dword [0x50f1a4]
mov edx, dword [edx]
call fcn.00406b44
mov dword [esp], 0x20
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4bc933
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.00406d44
add esp, 0x24
pop ebx
ret
Function at 0x4bc938
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xd], ecx
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4bca9e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov eax, dword [ebp - 0xd]
xor edx, edx
call fcn.00406b44
lea eax, [ebp - 0x222]
push eax
push 0x202
call sub.kernel32.dll_GetLogicalDriveStringsW
mov ebx, eax
test ebx, ebx
je 0x4bca78
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406b98
mov esi, ebx
dec esi
test esi, esi
jl 0x4bca54
inc esi
lea ebx, [ebp - 0x222]
movzx edi, word [ebx]
test di, di
je 0x4bc9df
lea eax, [ebp - 0x428]
mov edx, edi
call fcn.00406cb0
mov edx, dword [ebp - 0x428]
lea eax, [ebp - 4]
call fcn.00406f58
jmp 0x4bca4a
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x202
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp - 4]
call fcn.00406bd0
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x4bca40
lea eax, [ebp - 0x42c]
lea edx, [ebp - 0x424]
mov ecx, 0x101
call fcn.00406d44
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 8]
call fcn.0040721c
jne 0x4bca40
mov eax, dword [ebp - 0xd]
mov edx, dword [ebp - 4]
call fcn.00406b44
jmp 0x4bca54
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406b98
add ebx, 2
dec esi
jne 0x4bc9ba
cmp byte [ebp - 9], 0
je 0x4bca78
lea edx, [ebp - 0x430]
mov eax, dword [ebp - 0xd]
mov eax, dword [eax]
call fcn.004bc520
mov edx, dword [ebp - 0x430]
mov eax, dword [ebp - 0xd]
call fcn.00406b44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcaa5
lea eax, [ebp - 0x430]
mov edx, 3
call fcn.00406b3c
lea eax, [ebp - 4]
call fcn.00406b34
ret
Function at 0x4bcb24
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4bcc7e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
mov ecx, 0xf003f
mov dl, 1
mov eax, dword [0x44ab34]
call fcn.0044bd7c
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4bcc59
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
push ebp
push 0x4bcc30
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x4bcb94
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.0044be20
jmp 0x4bcba1
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.0044be20
lea eax, [ebp - 4]
mov edx, edi
call fcn.00406b98
mov eax, dword [0x50f560]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.0040759c
test eax, eax
jle 0x4bcbd4
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004bc3c8
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.00406b98
mov eax, esi
mov edx, dword [0x50f1a4]
mov edx, dword [edx]
call fcn.0040721c
je 0x4bcbfd
push dword [ebp - 4]
mov eax, dword [0x50f560]
push dword [eax]
push esi
lea eax, [ebp - 4]
mov edx, 3
call fcn.004070fc
mov cl, 1
mov edx, 0x4bcca0
mov eax, dword [ebp - 0x10]
call fcn.0044bf68
test al, al
je 0x4bcc26
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.0044c880
mov eax, dword [ebp - 0x10]
call fcn.0044bdf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bcc3e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcc60
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x10], edx
call fcn.00404e40
ret

Function at 0x4bcd00
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov byte [ebp - 1], 1
mov ecx, 0xf003f
mov dl, 1
mov eax, dword [0x44ab34]
call fcn.0044bd7c
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4bcdbc
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
push ebp
push 0x4bcd93
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x4bcd54
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0044be20
jmp 0x4bcd61
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0044be20
mov cl, 1
mov edx, 0x4bcddc
mov eax, dword [ebp - 8]
call fcn.0044bf68
test al, al
je 0x4bcd89
mov edx, esi
mov eax, dword [ebp - 8]
call fcn.0044c410
mov byte [ebp - 1], al
mov eax, dword [ebp - 8]
call fcn.0044bdf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bcda1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcdc3
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 8], edx
call fcn.00404e40
ret
Function at 0x4bcf4c
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.00406bd0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebx], eax
mov eax, dword [ebx]
and eax, 1
cmp eax, 1
je 0x4bcf84
mov eax, dword [ebx]
and eax, 2
cmp eax, 2
je 0x4bcf84
mov eax, dword [ebx]
and eax, 4
cmp eax, 4
je 0x4bcf84
xor eax, eax
pop esi
pop ebx
ret
mov al, 1
pop esi
pop ebx
ret

Function at 0x4bcf8c
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov ebx, edx
cmp ebx, 0xffffffff
je 0x4bcfb7
and ebx, 0xfffffffe
and ebx, 0xfffffffd
and ebx, 0xfffffffb
push ebx
mov eax, esi
call fcn.00406bd0
push eax
call sub.kernel32.dll_SetFileAttributesW
cmp eax, 1
sbb eax, eax
inc eax
pop esi
pop ebx
ret
xor eax, eax
pop esi
pop ebx
ret
Function at 0x4bd08c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 9], cl
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bd278
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00404804
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x10
call fcn.00404804
mov dword [ebp - 0x50], 0x44
cmp byte [ebp - 9], 0
je 0x4bd0f0
mov word [ebp - 0x20], 0
jmp 0x4bd0f6
mov word [ebp - 0x20], 1
mov dword [ebp - 0x24], 1
mov eax, ebx
call fcn.004bcfbc
test al, al
je 0x4bd1be
lea edx, [ebp - 0x68]
mov al, 1
call fcn.004bd8bc
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.004bc3ec
lea eax, [ebp - 0x64]
mov edx, 0x4bd298
call fcn.00406f58
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 4]
call fcn.004bc3c8
push dword [ebp - 4]
mov eax, dword [0x50f560]
push dword [eax]
push 0x4bd2b4
mov eax, dword [0x50f560]
push dword [eax]
lea eax, [ebp - 4]
mov edx, 4
call fcn.004070fc
mov eax, esi
mov edx, dword [0x50f1a4]
mov edx, dword [edx]
call fcn.0040721c
jne 0x4bd179
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004bc3c8
jmp 0x4bd1b1
lea edx, [ebp - 0x6c]
mov eax, ebx
call fcn.004bc3c8
push dword [ebp - 0x6c]
mov eax, dword [0x50f560]
push dword [eax]
push esi
lea eax, [ebp - 8]
mov edx, 3
call fcn.004070fc
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 8]
call fcn.004bc3c8
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 8]
call fcn.00406b98
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00406f58
jmp 0x4bd1f1
mov eax, esi
mov edx, dword [0x50f1a4]
mov edx, dword [edx]
call fcn.0040721c
jne 0x4bd1db
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406b98
jmp 0x4bd1f1
push ebx
mov eax, dword [0x50f560]
push dword [eax]
push esi
lea eax, [ebp - 4]
mov edx, 3
call fcn.004070fc
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406bd0
push eax
push 0
call sub.kernel32.dll_CreateProcessW
mov ebx, eax
test ebx, ebx
je 0x4bd222
xor esi, esi
jmp 0x4bd229
call sub.kernel32.dll_GetLastError_1
mov esi, eax
test ebx, ebx
je 0x4bd23e
cmp byte [ebp + 8], 0
je 0x4bd23e
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd27f
lea eax, [ebp - 0x70]
mov edx, 4
call fcn.00406b3c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b3c
ret
Function at 0x4bd2bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f8
push ebx
xor edx, edx
mov dword [ebp - 0x808], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bd33d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x802]
xor ecx, ecx
mov edx, 0x802
call fcn.00404804
push 0x400
lea eax, [ebp - 0x802]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
lea eax, [ebp - 0x808]
lea edx, [ebp - 0x802]
mov ecx, 0x401
call fcn.00406d44
mov eax, dword [ebp - 0x808]
mov edx, ebx
call fcn.004bc3ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd344
lea eax, [ebp - 0x808]
call fcn.00406b34
ret

Function at 0x4bd34c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f8
push ebx
xor edx, edx
mov dword [ebp - 0x808], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bd3cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x802]
xor ecx, ecx
mov edx, 0x802
call fcn.00404804
push 0x400
lea eax, [ebp - 0x802]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea eax, [ebp - 0x808]
lea edx, [ebp - 0x802]
mov ecx, 0x401
call fcn.00406d44
mov eax, dword [ebp - 0x808]
mov edx, ebx
call fcn.004bc3ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd3d4
lea eax, [ebp - 0x808]
call fcn.00406b34
ret

Function at 0x4bd494
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bd4fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004bc594
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004bcf4c
test al, al
je 0x4bd4d4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004bcf8c
mov eax, dword [ebp - 4]
call fcn.00406bd0
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd505
lea eax, [ebp - 4]
call fcn.00406b34
ret