joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469244
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffff800
mov ebx, eax
mov eax, ebx
call fcn.00469730
cmp dword [0x4c4de0], 0
je 0x46930f
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov eax, esp
call fcn.0040bf3c
mov esi, eax
cmp esi, 0xffffffff
je 0x4692be
call fcn.0046ed00
mov ecx, esi
mov edx, 1
shl edx, cl
and eax, edx
jne 0x4692be
lea edx, [esp + 0x400]
mov eax, 0x4c319c
xor ecx, ecx
call fcn.00462710
lea eax, [esp + 0x400]
call fcn.0040c004
lea edx, [esp + 0x400]
push edx
call fcn.004968ec
pop ecx
xor eax, eax
jmp 0x469311
mov eax, dword [0x4c2444]
test eax, eax
je 0x4692cd
push eax
call sub.USER32.DLL_DestroyWindow
mov eax, ebx
call fcn.004691b0
xor edx, edx
mov eax, ebx
mov dword [0x4c4de0], edx
call fcn.00468bc4
mov eax, ebx
call fcn.0046939c
mov byte [0x4c29f0], 0
mov eax, 0x4c29c4
call fcn.00449644
mov eax, 0x4c297c
call fcn.004698c8
mov eax, 0x4c297c
call fcn.00469a50
mov al, 1
add esp, 0x800
pop esi
pop ebx
ret

Function at 0x469f18
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffaa0
mov esi, eax
mov dword [esi], edx
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x4a8320
call sub.SHELL32.DLL_SHGetFileInfoA
mov ebx, eax
test ebx, ebx
jne 0x469f77
lea eax, [esp + 0x160]
push eax
push 0x400
call sub.KERNEL32.DLL_GetLogicalDriveStringsA
push 0x4001
push 0x160
lea edx, [esp + 8]
push edx
push 0
lea ecx, [esp + 0x170]
push ecx
call sub.SHELL32.DLL_SHGetFileInfoA
mov ebx, eax
push ebx
push 0
push 0x1109
push dword [esi]
call sub.USER32.DLL_SendMessageA
add esp, 0x560
pop esi
pop ebx
ret
Function at 0x46b19c
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffea0
push ecx
push 0x160
lea eax, [esp + 8]
push eax
push 0
push edx
call sub.SHELL32.DLL_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
ret
Function at 0x46b858
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x28], eax
mov eax, 0x4a8470
call fcn.00495388
mov word [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov edx, 1
add eax, 0xf8
call fcn.0046b990
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
imul edx, dword [eax + 0x104], 0x38
mov esi, dword [ecx + 0xf8]
add esi, edx
cmp word [ebx + 0x400], 0
je 0x46b8af
lea ecx, [ebx + 0x400]
jmp 0x46b8b1
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.0040f784
mov word [ebp - 0x14], 0
jmp 0x46b901
mov edx, dword [ebx + 0xc2c]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0xc00]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebx + 0xc04]
mov dword [esi + 0x10], ecx
mov eax, dword [ebx + 0xc08]
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0xc0c]
mov dword [esi + 0x18], eax
mov edx, dword [ebx + 0xc10]
mov dword [esi + 0x1c], edx
mov ecx, dword [ebx + 0xc14]
mov dword [esi + 0x20], ecx
mov ecx, dword [ebx + 0xc18]
mov dword [esi + 0x24], ecx
mov eax, dword [ebx + 0xc1c]
mov dword [esi + 0x28], eax
mov edx, dword [ebx + 0xc20]
mov dword [esi + 0x2c], edx
mov ecx, dword [ebx + 0xc24]
mov dword [esi + 0x30], ecx
mov eax, dword [ebx + 0xc28]
mov dword [esi + 0x34], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x104]
inc dword [edx + 0x104]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46bc08
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff664
mov esi, edx
mov edi, eax
mov ebp, 0x4a8488
push esp
push 0x20019
push 0
push edi
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x46bc39
xor eax, eax
jmp 0x46bda2
mov edx, esi
mov eax, 0x80000001
call fcn.0046bdad
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push esi
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
je 0x46bc7a
mov eax, dword [esp]
call fcn.0046bf34
xor eax, eax
jmp 0x46bda2
xor ebx, ebx
mov dword [esp + 0x10], 0xc8
mov dword [esp + 0x14], 0x3e8
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0xf0]
push edx
lea ecx, [esp + 0x14]
push ecx
push 0
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x38]
push edx
push ebx
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegEnumValueA
test eax, eax
jne 0x46bcdb
push dword [esp + 0x14]
lea ecx, [esp + 0xf0]
push ecx
push dword [esp + 0x14]
push 0
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_RegSetValueExA
inc ebx
jmp 0x46bc7c
xor ebx, ebx
mov dword [esp + 0x18], 0xc8
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x4e8]
push ecx
push ebx
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x46bd8f
lea eax, [esp + 0x4d4]
lea edx, [ebp + 0x17]
push eax
push edi
push edx
lea ecx, [esp + 0x5a8]
push ecx
call fcn.00497eb8
add esp, 0x10
lea edx, [ebp + 0x17]
lea eax, [esp + 0x4d4]
push eax
push esi
push edx
lea ecx, [esp + 0x7a8]
push ecx
call fcn.00497eb8
add esp, 0x10
lea eax, [esp + 8]
push eax
lea edx, [esp + 8]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea ecx, [esp + 0x7b8]
push ecx
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x46bd8f
lea edx, [esp + 0x79c]
lea eax, [esp + 0x59c]
call fcn.0046bc08
inc ebx
jmp 0x46bcdd
mov eax, dword [esp]
call fcn.0046bf34
mov eax, dword [esp + 4]
call fcn.0046bf34
mov al, 1
add esp, 0x99c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46bde3
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov esi, edx
push edi
add esp, 0xfffffd28
mov edi, eax
cmp byte [esi], 0
je 0x46be7e
push esp
push 0x20019
push 0
push esi
push edi
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x46be7e
xor ebx, ebx
mov dword [esp + 4], 0xc8
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x24]
push ecx
push ebx
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x46be65
lea eax, [esp + 0x10]
push eax
push esi
push str._s_s
lea edx, [esp + 0xe4]
push edx
call fcn.00497eb8
add esp, 0x10
mov eax, edi
lea edx, [esp + 0xd8]
call fcn.0046bde3
inc ebx
jmp 0x46be0e
mov eax, dword [esp]
call fcn.0046bf34
push esi
push edi
call sub.ADVAPI32.DLL_RegDeleteKeyA
test eax, eax
jne 0x46be7e
inc dword [0x4caa08]
add esp, 0x2d8
pop edi
pop esi
pop ebx
ret
Function at 0x46c024
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
call fcn.0040ffc8
test eax, eax
je 0x46c08f
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0046be88
mov ebx, eax
test ebx, ebx
je 0x46c0c7
lea edx, [ebp - 0xa8]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.00410040
mov eax, esi
call fcn.00410228
add eax, eax
lea edx, [ebp - 0xa8]
add eax, 2
push eax
push esi
push 1
push 0
push edx
push ebx
call sub.ADVAPI32.DLL_RegSetValueExW
mov eax, ebx
call fcn.0046bf34
jmp 0x46c0c7
mov eax, esi
call fcn.00410228
add eax, eax
add eax, 2
push eax
call fcn.00493734
pop ecx
mov ebx, eax
mov ecx, 0x10000000
mov edx, ebx
mov eax, esi
call fcn.0041001c
push ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0046bfd8
push ebx
call fcn.0049355c
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x46c1c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
call fcn.0046beea
mov ebx, eax
mov esi, 1
test ebx, ebx
je 0x46c202
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.0046bf34
test esi, esi
jne 0x46c20c
cmp dword [ebp + 8], 0
jne 0x46c21c
push dword [ebp + 0xc]
push edi
call fcn.00494f58
add esp, 8
xor eax, eax
jmp 0x46c21e
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46c244
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
call fcn.0040ffc8
test eax, eax
je 0x46c2c2
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0046beea
mov ebx, eax
lea edx, [ebp - 0xac]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.00410040
mov esi, 1
test ebx, ebx
je 0x46c2ad
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
lea ecx, [ebp - 0xac]
push 0
push ecx
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov esi, eax
mov eax, ebx
call fcn.0046bf34
test esi, esi
jne 0x46c2b7
cmp dword [ebp + 8], 0
ja 0x46c2bb
xor ebx, ebx
jmp 0x46c2fa
mov ebx, 1
jmp 0x46c2fa
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.00493734
pop ecx
mov esi, eax
push esi
push 0x4a8488
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0046c1c0
mov ebx, eax
mov ecx, dword [ebp + 8]
mov edx, edi
mov eax, esi
call fcn.00410040
push esi
call fcn.0049355c
pop ecx
test bl, bl
jne 0x46c308
mov edx, dword [ebp + 0xc]
mov eax, edi
call fcn.0041023c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46c314
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
call fcn.0046beea
mov ebx, eax
mov esi, 1
mov dword [ebp - 0x10], 4
test ebx, ebx
je 0x46c35d
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.0046bf34
test esi, esi
jne 0x46c367
cmp dword [ebp - 0x10], 0
jne 0x46c370
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [edi], edx
jmp 0x46c372
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46c3c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
call fcn.0046beea
mov ebx, eax
mov dword [ebp - 0xc], esi
mov edi, 1
test ebx, ebx
je 0x46c405
lea eax, [ebp - 0xc]
lea edx, [ebp - 8]
push eax
push dword [ebp + 0x10]
push edx
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov edi, eax
mov eax, ebx
call fcn.0046bf34
test edi, edi
jne 0x46c40f
cmp dword [ebp - 0xc], 0
jne 0x46c438
cmp dword [ebp + 0xc], 0
je 0x46c426
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.00494d68
add esp, 0xc
jmp 0x46c434
push esi
push 0
push dword [ebp + 0x10]
call fcn.00494dd8
add esp, 0xc
xor eax, eax
jmp 0x46c43b
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46c454
Capabilities:
Delete registry key

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
mov eax, ebx
push 0x100
lea ecx, [esp + 4]
call fcn.0046bf50
test al, al
je 0x46c478
push esp
push ebx
call sub.ADVAPI32.DLL_RegDeleteKeyA
add esp, 0x100
pop ebx
ret

Function at 0x46c490
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, ecx
mov ebx, eax
mov eax, ebx
push 0x100
lea ecx, [esp + 8]
call fcn.0046bf50
test al, al
je 0x46c4d9
push esp
push 0x20006
push 0
lea edx, [esp + 0x10]
push edx
push ebx
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x46c4d9
push esi
push dword [esp + 4]
call sub.ADVAPI32.DLL_RegDeleteValueA
mov eax, dword [esp]
call fcn.0046bf34
add esp, 0x104
pop esi
pop ebx
ret
Function at 0x46e12c
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x4ab724
push 1
push 0
push 0x4ab754
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x46e1f7
push edi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
test esi, esi
je 0x46e178
push esi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x46e18c
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x46e19e
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xc]
push eax
push 0x4ab784
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x46e1ee
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jl 0x46e1e5
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46e204
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop ebx
ret

Function at 0x46e23c
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebx
add esp, 0xffffffe0
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x46e251
xor eax, eax
jmp 0x46e28f
push ebx
call fcn.00494f88
pop ecx
mov byte [ebx + eax + 1], 0
push 0x1e
push 0
lea edx, [esp + 8]
push edx
call fcn.00494dd8
add esp, 0xc
mov dword [esp + 4], 3
mov word [esp + 0x10], 0x14
mov dword [esp + 8], ebx
push esp
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete al
and eax, 1
add esp, 0x20
pop ebx
ret

Function at 0x46e83c
Capabilities:
Create directory

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, esp
mov edx, 0x400
call fcn.0046ec68
mov eax, esp
call fcn.0040bf64
push ebx
lea edx, [esp + 4]
push edx
call fcn.00494e7c
add esp, 8
mov eax, esp
call fcn.0040aa88
test eax, eax
je 0x46e884
push 0
lea edx, [esp + 4]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x46e8a6
push esp
mov eax, 0x1f7
call fcn.0041202c
push eax
call fcn.0044e46c
add esp, 8
mov eax, 0x4af120
call fcn.0042d020
xor eax, eax
jmp 0x46e8b2
push esp
push esi
call fcn.00494f58
add esp, 8
mov al, 1
add esp, 0x400
pop esi
pop ebx
ret
Function at 0x46e974
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0x44
push 0
lea eax, [esp + 8]
push eax
call fcn.00494dd8
add esp, 0xc
mov dword [esp], 0x44
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 4]
push ecx
push esi
push 0
push 0
push 0
push 0
push 0
push ebx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x46e9dd
test edi, edi
je 0x46e9c7
push edi
push dword [esp + 0x48]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + 0x48]
call sub.KERNEL32.DLL_CloseHandle
push dword [esp + 0x44]
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
jmp 0x46e9df
xor eax, eax
add esp, 0x54
pop edi
pop esi
pop ebx
ret

Function at 0x46ea9c
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd8
mov dword [esp], eax
call sub.USER32.DLL_GetDesktopWindow
mov ebp, eax
push ebp
call sub.USER32.DLL_GetDC
mov edi, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov ebx, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0x18
push dword [esp + 8]
call sub.GDI32.DLL_GetObjectA
push dword [esp + 0x18]
push dword [esp + 0x18]
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [esp + 4], eax
push dword [esp]
push ebx
call sub.GDI32.DLL_SelectObject
mov dword [esp + 8], eax
push dword [esp + 4]
push esi
call sub.GDI32.DLL_SelectObject
mov dword [esp + 0xc], eax
push 0xcc0020
mov edx, dword [esp + 0x1c]
push edx
mov eax, dword [esp + 0x1c]
mov ecx, eax
neg ecx
push ecx
mov ecx, eax
dec ecx
push 0
push ecx
push ebx
push edx
push eax
push 0
push 0
push esi
call sub.GDI32.DLL_StretchBlt
push 0xcc0020
push 0
push 0
push esi
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push 0
push ebx
call sub.GDI32.DLL_BitBlt
push dword [esp + 8]
push ebx
call sub.GDI32.DLL_SelectObject
push dword [esp + 0xc]
push esi
call sub.GDI32.DLL_SelectObject
push dword [esp + 4]
call sub.GDI32.DLL_DeleteObject
push ebx
call sub.GDI32.DLL_DeleteDC
push esi
call sub.GDI32.DLL_DeleteDC
push edi
push ebp
call sub.USER32.DLL_ReleaseDC
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46ec68
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, 0x4a8d99
push 0x4a8d87
push esi
mov ecx, ebx
mov edx, 0x4a8d9f
call fcn.0046c1a4
mov byte [esp], 0
cmp byte [ebx], 0
je 0x46ecbf
push 0x400
lea eax, [esp + 4]
push eax
push ebx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x46ecbf
lea edx, [esi - 1]
push edx
lea ecx, [esp + 4]
push ecx
push ebx
call fcn.00495138
add esp, 0xc
mov byte [ebx + esi - 1], 0
cmp byte [ebx], 0
je 0x46eccf
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x46eced
push ebx
push esi
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x46ecdf
cmp byte [ebx], 0
jne 0x46eced
push str._rartemp
push ebx
call fcn.00494f58
add esp, 8
mov eax, ebx
call fcn.0040bf64
add esp, 0x400
pop esi
pop ebx
ret
Function at 0x46ee30
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x46ee5f
cmp dword [esp + 4], 5
ja 0x46ee63
cmp dword [esp + 4], 5
jne 0x46ee5f
cmp dword [esp + 8], 0
ja 0x46ee63
xor eax, eax
jmp 0x46ee68
mov eax, 1
add esp, 0x94
ret

Function at 0x46f464
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x46f46d
mov eax, dword [ebp - 4]
add esp, 0xfffffaf4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x2454], edx
mov edi, eax
mov eax, 0x4a8e94
call fcn.00495388
call fcn.0049d37c
mov dword [ebp - 0x2458], eax
xor ebx, ebx
mov word [ebp - 0x2440], 8
push 0
push 0
lea eax, [ebp - 0x242c]
mov ecx, dword [ebp - 0x2454]
mov edx, edi
call fcn.00412cdc
inc dword [ebp - 0x2434]
mov word [ebp - 0x2440], 0x14
lea eax, [ebp - 0x28fc]
call fcn.004137a4
lea eax, [ebp - 0x28d0]
call fcn.004137a4
lea eax, [ebp - 0x28a4]
call fcn.004137a4
inc dword [0x4c4de8]
jmp 0x46f591
test bl, bl
jne 0x46f527
call fcn.0049d37c
sub eax, dword [ebp - 0x2458]
cmp eax, 0x3e8
jle 0x46f527
push 0
xor ecx, ecx
xor edx, edx
mov eax, 5
call fcn.0047cd94
mov bl, 1
test bl, bl
je 0x46f53b
lea eax, [ebp - 0x3510]
call fcn.0047e994
call fcn.0047de20
call fcn.0044844c
cmp byte [ebp + 0x14], 0
je 0x46f55b
lea eax, [ebp - 0x3510]
call fcn.0040ba60
lea edx, [ebp - 0x3510]
cmp eax, edx
jne 0x46f55f
xor eax, eax
jmp 0x46f564
mov eax, 1
mov word [ebp - 0x2440], 0x14
push esi
push eax
mov dl, byte [ebp + 0x10]
lea eax, [ebp - 0x3510]
push edx
lea edx, [ebp - 0x3110]
mov cl, byte [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x3510]
push dword [ebp + 8]
call fcn.0046f634
lea edx, [ebp - 0x3510]
lea eax, [ebp - 0x242c]
call fcn.00412e10
test eax, eax
jne 0x46f5b3
cmp dword [0x4c4df0], 0
je 0x46f4ff
dec dword [0x4c4de8]
mov eax, dword [0x4c4df0]
test eax, eax
sete dl
and edx, 1
mov byte [ebp - 0x2459], dl
mov word [ebp - 0x2440], 0x14
test eax, eax
je 0x46f5ea
mov eax, esi
call fcn.0046b7f8
xor edx, edx
mov dword [0x4c4df0], edx
jmp 0x46f5f1
mov eax, esi
call fcn.0046bb0c
test bl, bl
je 0x46f600
push dword [0x4c244c]
call sub.USER32.DLL_DestroyWindow
mov al, byte [ebp - 0x2459]
mov edx, 2
push eax
lea eax, [ebp - 0x242c]
dec dword [ebp - 0x2434]
call fcn.00412db4
pop eax
mov edx, dword [ebp - 0x2450]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4703b9
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
push 0x1000000
call fcn.00493734
pop ecx
mov edi, eax
test edi, edi
jne 0x4703dc
mov eax, 1
xor edx, edx
jmp 0x47046f
mov dword [esp], 0
mov dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
xor ebx, ebx
mov esi, 0x800000
jmp 0x470433
mov eax, 0x10000
and esi, 0xffffff
and ebx, 0xffffff
mov dl, byte [edi + esi]
mov byte [edi + ebx], dl
sub ebx, 0x100
xor byte [edi + esi], dl
sub esi, 0x100
dec eax
test eax, eax
jg 0x470402
dec ebx
dec esi
add dword [esp], 1
adc dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 8]
cmp eax, 0xc8
jb 0x4703fd
push edi
call fcn.0049355c
pop ecx
push 0
push 0x64
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00499460
add eax, 1
adc edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop edi
pop esi
pop ebx
ret