joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478955
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4963dc]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x30], 0
xor eax, eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, edx
push edi
push 2
inc eax
mov dword [ebp - 0x34], ecx
pop edi
test ebx, 0x1008
je 0x4789d2
push 0x28
lea eax, [ebp - 0x2c]
push eax
push 0x120009
push dword [0x49b110]
call dword [sym.imp.Mso30Win32Client.dll_Ordinal_1115]
xor ecx, ecx
inc ecx
call fcn.00478dc3
test eax, eax
je 0x478a80
push dword [0x499fb0]
call esi
test eax, eax
jne 0x4789ca
push dword [0x499fb8]
call esi
and dword [0x49a000], 0xffffdfff
call fcn.00478e01
xor eax, eax
inc eax
mov ecx, eax
call fcn.00478dc3
test eax, eax
je 0x478a80
mov edx, dword [ebp - 0x34]
mov ecx, 0x49a12c
push ebx
call fcn.00478bd6
test eax, eax
je 0x478a7b
test bl, 4
je 0x478a04
mov esi, dword [0x49a1b8]
jmp 0x478a24
test bl, 8
je 0x478a1e
mov esi, dword [0x49a1c8]
cmp esi, dword [0x499fb4]
cmovne esi, dword [0x499fb8]
jmp 0x478a24
mov esi, dword [0x49a244]
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
jne 0x478a3b
mov ecx, 0x80006
call fcn.0040be1c
jmp 0x478a7b
lea ecx, [ebp - 0x30]
xor ebx, ebx
push ecx
push eax
push esi
push 0x49a12c
inc ebx
call dword [0x49a138]
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x478a69
xor ebx, ebx
cmp eax, 0x507
jne 0x478a69
xor ecx, ecx
call fcn.00478e11
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, 0x404
push 1
cmove edi, ecx
test ebx, ebx
pop eax
cmovne edi, eax
call fcn.00478e01
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048dc69
mov esp, ebp
pop ebp
ret
Function at 0x4791ab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4963dc]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x4999d8]
push ebx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x68], edx
push esi
xor esi, esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
push edi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x4c]
push esi
push eax
mov dword [0x4999d8], eax
call sub.VCRUNTIME140.dll__setjmp3
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x4792a5
push 2
push dword [ebp - 0x68]
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4792ef
push eax
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], esi
je 0x4792ef
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], esi
je 0x4792ef
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x50]
mov edi, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x50]
add edi, 0x28
add edx, dword [eax]
call fcn.0047936e
add edi, eax
mov eax, 0xff00
jmp 0x47925f
cmp edx, edi
jae 0x479263
add edx, 4
cmp dword [edx], eax
jne 0x479258
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
jne 0x479279
xor ecx, ecx
call fcn.00483127
jmp 0x479280
mov ecx, esi
call fcn.0048301f
mov dword [ebp - 0x58], esi
xor esi, esi
cmp dword [ebp - 0x58], esi
je 0x4792ef
push esi
push dword [ebp - 0x50]
push edi
push 4
push dword [ebp - 0x50]
push dword [ebp - 0x58]
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], esi
je 0x4792ef
mov eax, dword [ebp - 0x64]
mov dword [0x4999d8], eax
cmp dword [ebp - 0x50], esi
je 0x4792b5
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x54], esi
je 0x4792c3
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp - 0x58], esi
je 0x4792d4
mov edx, dword [ebp - 0x58]
xor ecx, ecx
push 2
call fcn.00482deb
cmp dword [ebp - 0x5c], esi
je 0x4792f4
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048dc69
mov esp, ebp
pop ebp
ret 4
call fcn.0040bf4b
mov ecx, ebx
call fcn.0041165e
int3
Function at 0x47aa26
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4999c0]
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 8], eax
push eax
mov dword [ebp - 0x10], ebx
mov esi, ecx
xor edi, edi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x49b164]
mov eax, dword [eax + 0x36]
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x47ab94
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
mov ebx, dword [ebp + 0xc]
and dword [esi + 4], edi
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_SetCapture]
movzx edx, word [esi + 0xc]
movzx eax, word [esi + 8]
shl edx, 0x10
or edx, eax
mov dword [ebp - 0x30], ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x2c], 0x200
mov dword [ebp - 0x24], edx
movsx ecx, dx
shr edx, 0x10
movsx eax, dx
lea edx, [esi + 8]
push edx
push dword [ebp - 0x30]
mov dword [edx], ecx
mov dword [edx + 4], eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.0047abbd
mov ecx, eax
mov eax, dword [ebp - 0xc]
test ecx, ecx
mov dword [ebp - 4], ecx
cmovne eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [ebp - 4], 0
jne 0x47aad5
and dword [esi + 4], 0
cmp edi, dword [esi + 4]
je 0x47aafd
test edi, edi
je 0x47aaea
push 0
push 0
push 0xb6f
push edi
call ebx
mov edi, dword [esi + 4]
test edi, edi
je 0x47aafd
push 0
push 0
push 0xb6e
push edi
call ebx
mov edx, 0x202
cmp dword [ebp - 0x2c], edx
je 0x47ab57
push 3
push 0x20e
push 0x100
push dword [ebp + 0xc]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
mov eax, dword [ebp - 0x2c]
jne 0x47ab42
mov ecx, 0x202
cmp eax, ecx
cmovne eax, ecx
mov dword [ebp - 0x2c], eax
sub eax, 0x200
je 0x47ab4f
dec eax
sub eax, 1
jne 0x47ab07
mov edx, dword [ebp - 0x24]
jmp 0x47aa91
movzx ecx, word [esi + 0xc]
movzx eax, word [esi + 8]
shl ecx, 0x10
or ecx, eax
push ecx
push 0
push edx
push dword [ebp + 0xc]
call ebx
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor edi, edi
cmp dword [ebp - 4], edi
je 0x47ab89
push esi
push edi
push 0xb6c
push dword [esi + 4]
call ebx
movzx edi, ax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x47abb2
movzx edx, word [esi + 0xc]
movzx ecx, word [esi + 8]
shl edx, 0x10
or edx, ecx
push edx
push 0
push 0x202
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47d757
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x49ae84]
push ebx
push esi
push edi
or dword [eax + 0x48], 0xffffffff
mov edi, edx
mov eax, dword [eax]
lea edx, [esp + 0x18]
push dword [ebp + 0xc]
mov dword [esp + 0x28], eax
mov bx, cx
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x10]
push eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x1c], eax
call fcn.0047d966
mov edx, dword [esp + 0xc]
mov esi, edx
mov dword [esp + 0x10], esi
test edi, edi
je 0x47d7b6
lea edx, [esp + 0x10]
lea ecx, [esp + 0xc]
call fcn.00480191
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
test bl, 4
jne 0x47d7d3
mov eax, dword [0x49b164]
cmp dword [eax + 0xee], 0
jne 0x47d7d3
mov eax, edx
mov edi, esi
mov dword [esp + 0x20], eax
jmp 0x47d7ec
call fcn.00480d77
mov ecx, dword [0x49ae84]
mov edi, dword [ecx + 0x5c]
add edi, dword [ecx + 0x58]
sub edi, eax
mov eax, edi
mov dword [esp + 0x20], edi
push dword [esp + 0x18]
mov ecx, eax
mov dword [esp + 0x20], edi
push esi
push edx
mov edx, edi
call fcn.0047dd35
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.00488704
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
jne 0x47d885
push esi
call dword [sym.imp.USER32.dll_SetCapture]
mov ebx, dword [ebp + 0xc]
push 3
push 0x20e
push 0x100
push esi
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x47d855
mov eax, dword [esp + 0x14]
movzx ecx, bx
shl ecx, 0x10
movzx eax, ax
or ecx, eax
mov dword [esp + 0x30], 0x200
mov dword [esp + 0x38], ecx
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
mov eax, dword [esp + 0x30]
jne 0x47d872
cmp eax, 0x202
jne 0x47d87f
sub eax, 0x200
je 0x47d88e
dec eax
sub eax, 1
jne 0x47d81e
call dword [sym.imp.USER32.dll_ReleaseCapture]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [esp + 0x38]
movzx eax, bx
mov dword [esp + 0x14], eax
mov eax, dword [0x49ae84]
shr ebx, 0x10
mov esi, dword [eax + 0xac]
sub esi, ebx
test esi, esi
jle 0x47d8b2
or ecx, 0xffffffff
jmp 0x47d8bf
mov esi, ebx
sub esi, dword [eax + 0xb4]
js 0x47d914
xor ecx, ecx
inc ecx
call fcn.0047e62d
mov ecx, dword [0x49ae84]
mov eax, dword [ecx + 8]
shr eax, 2
and eax, 1
jne 0x47d8e8
push 1
push eax
push 2
xor edx, edx
pop ecx
call fcn.0047db8d
mov ecx, dword [0x49ae84]
cmp esi, dword [ecx + 0x10]
jg 0x47d914
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, esi
jl 0x47d914
lea edi, [esi + 0x64]
cmp eax, edi
jg 0x47d910
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, esi
jge 0x47d902
mov edi, dword [esp + 0x1c]
push ebx
push dword [esp + 0x18]
lea edx, [esp + 0x20]
lea ecx, [esp + 0x14]
call fcn.0047d966
cmp dword [esp + 0x28], 0
mov eax, dword [esp + 0xc]
mov ecx, eax
mov dword [esp + 0x10], ecx
je 0x47d94c
lea edx, [esp + 0x10]
lea ecx, [esp + 0xc]
call fcn.00480191
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push dword [esp + 0x18]
mov edx, edi
push ecx
mov ecx, dword [esp + 0x28]
push eax
call fcn.0047dd35
mov esi, dword [esp + 0x24]
jmp 0x47d81e
Function at 0x483864
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x49ae0c], 0
push ebx
push edi
je 0x483a95
cmp byte [0x49ae4a], 0
jne 0x483a95
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [0x49ae14]
jne 0x483a89
xor ebx, ebx
inc ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x483a89
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00483c3c
cmp byte [0x49ae39], 0
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], edx
jne 0x48390b
test byte [0x49ae10], 4
je 0x4839df
sub eax, dword [0x49ae4b]
sub edx, dword [0x49ae4f]
mov ecx, dword [0x49ae00]
cmp eax, ecx
jg 0x483905
neg ecx
cmp eax, ecx
jl 0x483905
mov eax, dword [0x49ae04]
cmp edx, eax
jg 0x483905
neg eax
cmp edx, eax
jge 0x4839f7
mov byte [0x49ae39], bl
mov ecx, ebx
call fcn.00483cb3
mov ch, byte [0x49ae10]
mov edi, 0x200
mov edx, dword [ebp + 8]
test ch, 0x20
je 0x483961
test dword [0x49ae10], edi
je 0x483a23
cmp byte [0x49ae7c], 0
je 0x483a03
cmp edx, dword [0x49ae28]
jl 0x483a31
mov eax, dword [0x49ae53]
mov byte [0x49ae7c], 0
mov dword [0x49ae20], eax
mov dword [0x49ae28], edx
test ch, 0x40
mov ecx, dword [ebp + 0xc]
je 0x4839a5
test dword [0x49ae10], edi
je 0x483a5a
cmp byte [0x49ae7d], 0
je 0x483a3c
cmp ecx, dword [0x49ae2c]
jl 0x483a68
mov eax, dword [0x49ae57]
mov byte [0x49ae7d], 0
mov dword [0x49ae24], eax
mov dword [0x49ae2c], ecx
mov eax, dword [0x49ae08]
mov eax, dword [eax + 4]
test eax, eax
je 0x4839bf
push 0
lea ecx, [ebp + 8]
push ecx
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
cmp dword [0x49ae0c], 0
je 0x483a73
push ecx
push edx
call fcn.00483b45
xor ecx, ecx
call fcn.00483cb3
jmp 0x483a95
cmp eax, dword [0x49ae4b]
jne 0x483905
cmp edx, dword [0x49ae4f]
jne 0x483905
mov byte [0x49ae39], 0
jmp 0x483a95
cmp edx, dword [0x49ae20]
jg 0x48395b
mov eax, dword [0x49ae5b]
mov cl, bl
mov byte [0x49ae7c], cl
mov dword [0x49ae28], eax
jmp 0x483a29
mov cl, byte [0x49ae7c]
test cl, cl
je 0x48395b
mov dword [0x49ae20], edx
jmp 0x483961
cmp ecx, dword [0x49ae24]
jg 0x48399f
mov eax, dword [0x49ae5f]
mov byte [0x49ae7d], bl
mov dword [0x49ae2c], eax
jmp 0x483a60
mov bl, byte [0x49ae7d]
test bl, bl
je 0x48399f
mov dword [0x49ae24], ecx
jmp 0x4839a5
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0
push dword [0x49ae14]
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x483a95
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
call fcn.00483a9d
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48435d
Capabilities:
Link many functions at runtime
Log keystrokes via polling

Disassembly:
cmp byte [0x49ab40], 0
push ebx
push esi
push edi
jne 0x48446a
push 4
push 0x2a
xor eax, eax
mov edx, 0x47ad9c
push eax
push dword [0x49b2e4]
push eax
push eax
push 0xa
pop ecx
call fcn.004138ee
mov esi, dword [sym.imp.USER32.dll_VkKeyScanA]
push 0x3a
call esi
mov ecx, dword [0x49b164]
mov ebx, 0x180
movsx edx, ax
mov edi, 0x400
movzx eax, dl
push 0x3b
mov dword [ecx + 0xce], eax
mov eax, edx
shr eax, 1
and edx, edi
and eax, ebx
or eax, edx
shr eax, 5
mov dword [ecx + 0xd2], eax
call esi
mov ecx, dword [0x49b164]
movsx edx, ax
movzx eax, dl
mov dword [ecx + 0xd6], eax
mov eax, edx
shr eax, 1
and edx, edi
and eax, ebx
or eax, edx
shr eax, 5
cmp dword [0x49b160], 0
mov dword [ecx + 0xda], eax
je 0x484463
push str.IMM32.DLL
call dword [sym.imp.Mso30Win32Client.dll_Ordinal_330]
mov dword [0x49ab58], eax
test eax, eax
je 0x484463
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImmGetContext
push eax
call esi
push str.ImmReleaseContext
push dword [0x49ab58]
mov dword [0x49ab50], eax
call esi
push str.ImmGetDefaultIMEWnd
push dword [0x49ab58]
mov dword [0x49ab44], eax
call esi
push str.ImmGetCompositionStringA
push dword [0x49ab58]
mov dword [0x49ab54], eax
call esi
push str.ImmSetCompositionFontA
push dword [0x49ab58]
mov dword [0x49ab4c], eax
call esi
mov dword [0x49ab48], eax
mov byte [0x49ab40], 1
pop edi
pop esi
pop ebx
ret
Function at 0x485f81
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp edx, dword [ebp + 8]
push ebx
cmovg edx, dword [ebp + 8]
mov bl, 0x55
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
test edx, edx
jle 0x485fa9
sub esi, ecx
mov al, byte [esi + ecx]
dec edx
xor al, bl
mov byte [ecx], al
mov bl, al
inc ecx
test edx, edx
jg 0x485f9a
pop esi
mov byte [ecx], 0
pop ebx
pop ebp
ret 8

Function at 0x48810e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
test dword [ebp + 8], 0x80000000
push esi
push edi
mov esi, edx
mov edi, ecx
je 0x488137
push 0
call fcn.004880be
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp + 8]
push edi
push esi
call dword [sym.imp.VCRUNTIME140.dll_memmove]
add esp, 0xc
add eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 4

Function at 0x48c3c9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x48eab8
call fcn.0048e9a0
mov ebx, ecx
lea eax, [ebp - 0x14]
xor ecx, ecx
push eax
push 0x20019
push ecx
push 0x4921ac
mov dword [ebp - 4], ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push Ordinal_1
mov dword [ebp - 0x14], ecx
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x48c471
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
and dword [ebp - 0x10], 0
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 0x14]
call edi
push 4
pop ebx
test eax, eax
jne 0x48c463
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push str.InsecureQI
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48c463
cmp dword [ebp - 0x18], ebx
jne 0x48c463
mov edi, dword [ebp - 0x1c]
cmp edi, 3
ja 0x48c463
mov byte [ebp - 4], 2
cmp dword [ebp - 0x10], eax
je 0x48c473
push dword [ebp - 0x10]
call esi
jmp 0x48c473
mov byte [ebp - 4], bl
cmp dword [ebp - 0x10], 0
je 0x48c471
push dword [ebp - 0x10]
call esi
xor edi, edi
mov dword [ebp - 4], 5
cmp dword [ebp - 0x14], 0
je 0x48c485
push dword [ebp - 0x14]
call esi
mov eax, edi
call fcn.0048e980
ret
Function at 0x48c793
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x48eb24
call fcn.0048e9a0
cmp byte [0x49ab90], 0
je 0x48c7b2
mov eax, dword [0x49ab94]
jmp 0x48c888
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesMicrosoftSecurity
mov dword [ebp - 4], esi
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48c802
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
push 0x49ab94
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48c802
cmp dword [ebp - 0x14], 4
je 0x48c85b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], esi
test eax, eax
je 0x48c813
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSecurity
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48c863
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
push 0x49ab94
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48c863
cmp dword [ebp - 0x14], 4
jne 0x48c863
mov esi, dword [0x49ab94]
jmp 0x48c869
mov dword [0x49ab94], esi
mov byte [0x49ab90], 1
mov dword [ebp - 4], 3
cmp dword [ebp - 0x10], 0
je 0x48c886
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.0048e980
ret

Function at 0x48caa4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4963dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea eax, [ebp - 0x20c]
push edi
push 0xffffffffffffffff
push ecx
push 0x104
push eax
mov edi, edx
call esi
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add eax, 2
lea ecx, [ebp - 4]
push 0xffffffffffffffff
sub ecx, eax
push edi
sar ecx, 1
push ecx
push eax
call esi
add esp, 0x24
lea ecx, [ebp - 0x20c]
call fcn.0048ca19
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x48cb15
and dword [0x49abb8], 0
jmp 0x48cb1c
call edi
mov dword [0x49abb8], eax
test esi, esi
je 0x48cb29
and dword [0x49abb4], 0
jmp 0x48cb40
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [0x49abb4], eax
cmp eax, 0xffffffff
je 0x48cb49
and dword [0x49abb0], 0
jmp 0x48cb50
call edi
mov dword [0x49abb0], eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0048dc69
mov esp, ebp
pop ebp
ret
Function at 0x48cb62
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4963dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
push 2
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x48cbf4
mov ecx, dword [ebp - 0x210]
cmp ecx, 4
jb 0x48cbf4
shr ecx, 1
push 0xffffffffffffffff
cmp word [ebp + ecx*2 - 0x210], 0x5c
sete al
lea eax, [eax*2 + str.Microsoft_SharedOffice16_]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
lea ecx, [ebp - 0x20c]
mov edx, esi
call fcn.0048caa4
jmp 0x48cbf6
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0048dc69
mov esp, ebp
pop ebp
ret

Function at 0x48cc25
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4963dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
push 2
push esi
push str.SoftwareMicrosoftOffice16.0CommonFilesPaths
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x48cc84
cmp dword [ebp - 0x210], 4
jb 0x48cc84
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.0048caa4
jmp 0x48cc86
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0048dc69
mov esp, ebp
pop ebp
ret
Function at 0x48df2d
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4932e8
call fcn.0048e6a1
push 1
call fcn.0048e1e9
pop ecx
test al, al
jne 0x48dde4
push 7
call fcn.0048e463
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0048e1b4
mov byte [ebp - 0x24], al
mov eax, dword [0x49993c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x48dddd
test eax, eax
jne 0x48de4e
mov dword [0x49993c], ecx
push 0x48f4b8
push 0x48f4a4
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x48de31
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x48df27
push 0x48f4a0
push 0x48f498
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x49993c], 2
jmp 0x48de53
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0048e356
pop ecx
call fcn.0048e457
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x48de83
push esi
call fcn.0048e2cc
pop ecx
test al, al
je 0x48de83
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0048e69b
call esi
call fcn.0048e45d
mov esi, eax
cmp dword [esi], edi
je 0x48dea1
push esi
call fcn.0048e2cc
pop ecx
test al, al
je 0x48dea1
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.0048e579
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0048e5ac
test al, al
jne 0x48decc
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x48ded5
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0048e373
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x48df27
call fcn.0048e6e6
ret
call fcn.0048dc76
jmp 0x48ddc5
Function at 0x403050
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x451094]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x403099
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403099
push 0xc00
call eax
test eax, eax
jne 0x40312e
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x40312e
cmp ecx, 0x104
ja 0x40312e
cmp word [ebp + ecx*2 - 0x2d6], 0x5c
je 0x4030d2
mov eax, 0x5c
mov word [ebp + ecx*2 - 0x2d4], ax
inc ecx
mov al, byte [str.userenv]
push esi
mov esi, str.userenv
test al, al
je 0x40312d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + ecx*2]
mov ecx, edi
inc esi
movzx eax, al
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
mov al, byte [esi]
inc esi
test al, al
jne 0x4030f5
xor eax, eax
mov dword [ecx], 0x64002e
push 8
push eax
mov word [ecx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov dword [ecx + 4], 0x6c006c
call ebx
mov al, byte [esi]
test al, al
jne 0x4030f2
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00436d36
mov esp, ebp
pop ebp
ret