joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455e10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x455e6a
inc esi
xor edi, edi
cmp edi, 1
jne 0x455e36
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x455e44
cmp edi, 1
jle 0x455e44
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0045304c
test eax, eax
jne 0x455e6a
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x455e6a
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x455e6a
inc edi
dec esi
jne 0x455e26
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x456538
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
push 0
push 2
lea eax, [esp + 8]
push eax
call fcn.0042e044
and eax, 0x7f
mov ecx, dword [eax*4 + 0x49ba5c]
mov edx, 0x80000002
xor eax, eax
call fcn.0042e26c
test eax, eax
jne 0x456582
mov eax, esi
call fcn.00403738
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
call fcn.00403738
push eax
call sub.gdi32.dll_RemoveFontResourceA
test eax, eax
je 0x4565a3
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageA
pop edx
pop esi
pop ebx
ret
Function at 0x4565a8
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4566e7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4566fc
push 0x456710
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
lea edx, [ebp - 0xc]
mov al, byte [ebp - 1]
call fcn.00452e68
test al, al
jne 0x4565fd
mov byte [ebp - 2], 0
jmp 0x4566cc
xor eax, eax
push ebp
push 0x4566c5
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x456641
push 0
mov eax, dword [ebp + 8]
push eax
push edi
lea edx, [ebp - 0x24]
mov eax, esi
call fcn.0042cc54
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0042c84c
mov eax, dword [ebp - 0x20]
call fcn.00403738
push eax
call ebx
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
jmp 0x4566af
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0042cc54
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x24]
call fcn.0042cd1c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0042c84c
mov eax, dword [ebp - 0x20]
call fcn.00403738
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
je 0x4566af
mov ecx, edi
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.0043107c
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0043107c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4566cc
lea eax, [ebp - 0xc]
call fcn.00452ea4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4566ee
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00403420
ret
Function at 0x456890
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x4568dd
xor ebx, ebx
jmp 0x4568d2
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00406f14
test eax, eax
jne 0x4568d1
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x45698d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4568b3
mov al, byte [ebp - 1]
sub al, 1
jb 0x4568e8
je 0x4568f1
jmp 0x4568fa
call fcn.0042e868
mov edi, eax
jmp 0x4568fc
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x4568fc
xor edi, edi
test di, di
je 0x45698d
xor ebx, ebx
jmp 0x456938
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x456937
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x45692c
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x456937
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x45698d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x456909
xor ebx, ebx
jmp 0x456982
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x456981
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x456976
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x456981
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x45698d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x456947
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x459240
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x45931a
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x459328
call fcn.00458718
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x459298
mov eax, 0x45935c
call fcn.0045850c
push 1
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x2710
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x459283
push esp
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x4592eb
cmp dword [esp], 0
jne 0x4592cd
mov eax, 0x45938c
call fcn.0045850c
jmp 0x4592f5
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x4593ac
call fcn.00458718
jmp 0x4592f5
mov eax, 0x4593e4
call fcn.0045850c
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x45931a
push 0xfa
call sub.kernel32.dll_Sleep
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x459418
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45965a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x4595f7
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 1
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x45948d
mov eax, 0x459674
call fcn.00453c04
xor edx, edx
push ebp
push 0x45958c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.00402934
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x4034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TransactNamedPipe
test eax, eax
jne 0x459575
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x4594f5
mov eax, 0x459688
call fcn.00453c04
xor edx, edx
push ebp
push 0x45955e
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x459533
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x459533
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
call dword [edx + 0x18]
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x459513
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459565
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetOverlappedResult
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459593
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x45cf44
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffe14
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x11e8], ebx
mov dword [ebp - 0x11ec], ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x11cc], edx
mov dword [ebp - 0x11d0], eax
lea esi, [ebp - 0x11e0]
lea edi, [ebp - 0x11d0]
xor eax, eax
push ebp
push 0x45d12d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x11d4], eax
xor eax, eax
mov dword [ebp - 0x11c8], eax
mov eax, dword [edi]
add eax, 0x10
push eax
lea ecx, [ebp - 0x11c4]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x11cc]
call fcn.0045a3a4
cmp dword [ebp - 0x1084], 0x30
jle 0x45cfe8
lea ecx, [ebp - 0x11e8]
mov edx, dword [ebp - 4]
mov al, 0xc3
call fcn.00451b9c
mov ecx, dword [ebp - 0x11e8]
mov dl, 1
mov eax, 0x406850
call fcn.0040905c
call fcn.0040311c
lea eax, [ebp - 0x11ec]
lea edx, [ebp - 0x1184]
mov ecx, 0x80
call fcn.0040355c
mov edx, dword [ebp - 0x11ec]
lea ecx, [ebp - 0x11e8]
mov eax, dword [edi]
mov eax, dword [eax]
call fcn.0045c950
mov edx, dword [ebp - 0x11e8]
mov eax, dword [edi]
add eax, 0x14
call fcn.00403450
lea eax, [ebp - 0x11ec]
lea edx, [ebp - 0x1104]
mov ecx, 0x80
call fcn.0040355c
mov edx, dword [ebp - 0x11ec]
lea ecx, [ebp - 0x11e8]
mov eax, dword [edi]
mov eax, dword [eax]
call fcn.0045c950
mov edx, dword [ebp - 0x11e8]
mov eax, dword [edi]
add eax, 0x18
call fcn.00403450
lea eax, [ebp - 0x1078]
mov al, byte [eax]
mov edx, dword [edi]
mov byte [edx + 0x1d], al
mov ebx, dword [ebp - 0x1080]
test ebx, ebx
jle 0x45d10f
push ebp
mov eax, esi
mov edx, 0xa
call fcn.0045cecc
pop ecx
mov eax, dword [esi + 6]
push eax
mov eax, dword [edi]
mov eax, dword [eax]
mov ecx, dword [esi + 2]
mov dx, word [esi]
call fcn.0045a9a4
mov dword [ebp - 0x11e4], eax
cmp dword [ebp - 0x11e4], 0
jne 0x45d0b0
push ebp
call fcn.0045cd20
pop ecx
xor eax, eax
push ebp
push 0x45d0e1
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x11e4]
add eax, 0x12
mov edx, dword [ebp - 0x11e4]
mov edx, dword [edx + 0xc]
call fcn.0045cecc
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45d0fb
mov edx, dword [ebp - 0x11e4]
mov eax, dword [edi]
call fcn.0045a9e0
dec ebx
jne 0x45d079
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d134
lea eax, [ebp - 0x11ec]
mov edx, 2
call fcn.00403420
ret
Function at 0x474770
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x474844
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
je 0x47482e
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.00453d18
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x47485c
call fcn.00458718
mov edx, ebx
mov eax, dword [0x49e370]
call fcn.0040b69c
mov ebx, eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebx]
call fcn.00403574
mov ecx, 0x14
cdq
idiv ecx
push eax
mov ecx, edi
mov edx, esi
mov al, byte [ebp - 1]
call fcn.0045d848
test al, al
jne 0x47482e
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
jne 0x474813
mov eax, 0x474890
call fcn.0045850c
jmp 0x47482e
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x4748ec
call fcn.00458718
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47484b
lea eax, [ebp - 0x18]
call fcn.00403400
ret
Function at 0x47dea0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x47dea8
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x47dff6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0045418c
mov edx, dword [ebp - 0x10]
mov eax, 0x49e190
call fcn.00403450
mov edx, 0x47e00c
lea eax, [ebp - 0x10]
call fcn.00403494
lea eax, [ebp - 0x10]
mov edx, dword [0x49e190]
call fcn.0040357c
mov eax, dword [ebp - 0x10]
call fcn.0045850c
cmp byte [0x49e010], 0
je 0x47df0b
mov eax, dword [0x49e190]
call fcn.00457d04
lea edx, [ebp - 0x10]
mov eax, dword [0x49e190]
call fcn.0042c84c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x47e034
call fcn.004035c0
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x47df9d
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.00451b9c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.004071b8
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.0042ed18
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov ecx, 2
mov al, 0x68
call fcn.00451b6c
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, 0x406850
call fcn.0040905c
call fcn.0040311c
lea eax, [ebp - 8]
call fcn.00458c0c
cmp dword [ebp - 8], 0
je 0x47dfce
lea eax, [ebp - 0xc]
mov ecx, 0x47e044
mov edx, dword [ebp - 4]
call fcn.004035c0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0047de48
mov eax, dword [ebp - 0xc]
call fcn.00458c4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47dffd
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00403420
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403420
ret

Function at 0x4803c8
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x49e48d], 1
call fcn.00455d80
test al, al
jne 0x48040a
push 5
mov eax, dword [0x49d62c]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x49d62c]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov cl, 2
xor edx, edx
mov eax, dword [0x49dd78]
call fcn.004802d4
ret

Function at 0x48483c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x484868
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x484871
call fcn.00483894
mov eax, 0xa
call fcn.0042f0c4
call fcn.00483894
call fcn.00484808
test al, al
jne 0x484846
pop ebx
ret
Function at 0x484d28
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp dword [0x49e0ac], 0
je 0x484dbf
mov eax, dword [0x49e0ac]
call fcn.004187c8
test al, al
je 0x484dbf
mov eax, dword [0x49e0ac]
cmp byte [eax + 0xc7], 0
je 0x484d6f
cmp byte [ebx + 0x1b9], 0
jne 0x484d6f
mov eax, dword [0x49d62c]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x484d73
xor eax, eax
jmp 0x484d75
mov al, 1
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [0x49e0ac]
call fcn.00418630
push eax
call sub.user32.dll_GetWindowLongA
test eax, 0x10000000
setne al
cmp bl, al
je 0x484dbf
test bl, bl
je 0x484dad
push 5
mov eax, dword [0x49e0ac]
call fcn.00418630
push eax
call sub.user32.dll_ShowWindow
jmp 0x484dbf
push 0
mov eax, dword [0x49e0ac]
call fcn.00418630
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x484e68
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov byte [0x49e446], 0
push 0x484f40
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x484f50
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x484ef4
lea edx, [esp + 4]
push edx
call eax
push 0x484f64
push ebx
call sub.kernel32.dll_GetProcAddress
mov esi, eax
test esi, esi
je 0x484efe
push esp
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x484efe
cmp dword [esp], 0
je 0x484efe
call fcn.00452e60
test al, al
je 0x484efe
push 0x484f74
push ebx
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x484efe
push 0x484f90
push 0x484fa0
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x484efe
mov byte [0x49e446], 1
jmp 0x484efe
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ax, word [esp + 4]
sub ax, 1
jb 0x484f17
sub ax, 5
je 0x484f20
sub ax, 3
je 0x484f29
jmp 0x484f32
mov byte [0x49bc94], 1
jmp 0x484f39
mov byte [0x49bc94], 3
jmp 0x484f39
mov byte [0x49bc94], 2
jmp 0x484f39
mov byte [0x49bc94], 0
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x484fb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x485020
mov edx, 0x80000002
xor eax, eax
call fcn.0042e26c
test eax, eax
jne 0x485019
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x48504c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x485010
cmp dword [ebp - 0xc], 4
jne 0x485010
cmp dword [ebp - 8], 4
jne 0x485010
mov ax, word [ebp - 0x10]
mov word [0x49e45c], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret
Function at 0x485194
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffed0
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x485246
xor eax, eax
mov al, byte [esp + 4]
shl eax, 0x18
xor edx, edx
mov dl, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x49e458], eax
cmp byte [0x49e445], 0
je 0x485246
mov eax, dword [esp + 4]
cmp eax, 5
jl 0x485237
mov dword [esp + 0x94], 0x9c
lea eax, [esp + 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x485246
xor eax, eax
mov al, byte [esp + 0x128]
shl eax, 8
xor edx, edx
mov dl, byte [esp + 0x12a]
or ax, dx
mov word [0x49e45c], ax
mov al, byte [esp + 0x12e]
mov byte [0x49e45e], al
mov ax, word [esp + 0x12c]
mov word [0x49e460], ax
jmp 0x485246
cmp eax, 4
jne 0x485246
call fcn.00484fb0
call fcn.00485058
add esp, 0x130
ret
Function at 0x498538
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x498709
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0042de68
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00454024
test al, al
jne 0x49859f
xor eax, eax
push ebp
push 0x498595
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.00454498
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49859f
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
mov eax, dword [0x49e540]
call fcn.00403738
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x4985c8
mov eax, dword [0x49ddf8]
call fcn.00497be0
push 0x80
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0
mov eax, dword [0x49d014]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x498718
push 0x49871c
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 8], eax
push 0x497d90
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongA
mov dword [0x49e56c], eax
xor eax, eax
push ebp
push 0x4986dc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x49d62c]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.0042d89c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x49872c
call fcn.00407d44
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
call fcn.0042d77c
mov edx, dword [ebp - 0x24]
pop eax
call fcn.0040357c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00497c88
mov dword [ebp - 0xc], eax
call fcn.00497d54
test al, al
jne 0x4986bc
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x49869c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4986e3
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x499644
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4998a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4998c0
mov eax, dword [0x49d62c]
call fcn.00424714
push 5
mov eax, dword [0x49d62c]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x499875
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.00480610
lea eax, [ebp - 0x10]
call fcn.0042dd14
mov eax, dword [ebp - 0x10]
call fcn.004076f8
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0042d89c
mov edx, dword [ebp - 0x10]
mov eax, 0x49e540
call fcn.00403450
call fcn.00497f30
lea ecx, [ebp - 0x10]
mov edx, 0x4998d4
mov eax, dword [0x49e540]
call fcn.0042c948
mov edx, dword [ebp - 0x10]
mov eax, 0x49e544
call fcn.00403450
lea ecx, [ebp - 0x10]
mov edx, 0x4998e4
mov eax, dword [0x49e540]
call fcn.0042c948
mov edx, dword [ebp - 0x10]
mov eax, 0x49e548
call fcn.00403450
push 2
push 0
push 1
mov ecx, dword [0x49e540]
mov dl, 1
mov eax, 0x450c14
call fcn.00450e70
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49978c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x18]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.00450e34
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.00450e0c
cmp dword [ebp - 0xc], 0x67734d49
je 0x499767
mov cl, 1
xor edx, edx
mov eax, dword [0x49e548]
call fcn.00451cf4
jmp 0x499776
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x49e540]
call fcn.00451cf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499793
mov eax, dword [ebp - 4]
call fcn.00402b58
ret