joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458210
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406c24
mov eax, dword [ebp + 0xc]
call fcn.00406c24
xor eax, eax
push ebp
push 0x45838d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
call fcn.00406b40
xor ebx, ebx
mov eax, dword [0x4b7044]
cmp byte [eax], 0
je 0x458284
call fcn.0040ab50
cmp byte [eax + 0x15], 0
je 0x458271
mov ebx, pe_nt_image_headers32
jmp 0x458284
call fcn.0040ab50
cmp byte [eax + 0x14], 0
je 0x458284
mov ebx, 0x200
lea eax, [ebp - 0x14]
push eax
or ebx, 0x20019
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00407984
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x45836a
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x18], 0x800
mov eax, dword [ebp - 0x18]
call fcn.004044f0
mov edi, eax
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x18], 0x800
cmp byte [ebp + 0x10], 0
je 0x4582e9
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push edi
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov ebx, eax
jmp 0x458302
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push edi
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueW
mov ebx, eax
test ebx, ebx
jne 0x458352
cmp dword [ebp - 0x18], 0
jbe 0x458351
cmp dword [ebp + 8], 0
je 0x458317
mov eax, dword [ebp + 8]
inc dword [eax]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov edx, edi
call fcn.00406cc8
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x458339
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00406f20
jmp 0x458351
mov eax, dword [ebp - 0xc]
push dword [eax]
push dword [ebp + 0xc]
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00407c50
inc esi
test ebx, ebx
je 0x4582c1
mov eax, edi
call fcn.0040450c
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458394
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
lea eax, [ebp + 0xc]
call fcn.00406b40
ret
Function at 0x458e3c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov byte [ebp - 1], 7
xor edx, edx
push ebp
push 0x458f44
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
mov eax, dword [ebp - 0x110]
cmp eax, 2
jne 0x458eff
mov byte [ebp - 1], 5
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jb 0x458edb
mov byte [ebp - 1], 0xa
cmp byte [ebp - 6], 1
jne 0x458ebb
mov eax, dword [ebp - 0x118]
cmp eax, 2
jb 0x458eac
mov byte [ebp - 1], 0xe
jmp 0x458f3a
cmp eax, 1
jb 0x458f3a
mov byte [ebp - 1], 0xd
jmp 0x458f3a
mov byte [ebp - 1], 0xb
mov eax, dword [ebp - 0x118]
cmp eax, 2
jb 0x458ed0
mov byte [ebp - 1], 0xf
jmp 0x458f3a
cmp eax, 1
jb 0x458f3a
mov byte [ebp - 1], 0xc
jmp 0x458f3a
cmp eax, 5
jb 0x458f3a
mov byte [ebp - 1], 6
cmp dword [ebp - 0x118], 1
jb 0x458f3a
cmp byte [ebp - 6], 1
jne 0x458ef9
mov byte [ebp - 1], 7
jmp 0x458f3a
mov byte [ebp - 1], 9
jmp 0x458f3a
cmp eax, 1
jne 0x458f36
mov byte [ebp - 1], 1
cmp dword [ebp - 0x11c], 4
jne 0x458f1e
cmp dword [ebp - 0x118], 0xa
jne 0x458f1e
mov byte [ebp - 1], 2
cmp dword [ebp - 0x11c], 4
jne 0x458f3a
cmp dword [ebp - 0x118], 0x5a
jne 0x458f3a
mov byte [ebp - 1], 3
jmp 0x458f3a
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x458f4e
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4598d4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406c24
xor eax, eax
push ebp
push 0x459a33
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406b40
mov edx, dword [ebp - 4]
mov eax, 0x459a50
call fcn.00407e24
test eax, eax
jne 0x4599a3
lea eax, [ebp - 8]
mov edx, 1
call fcn.00407af0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407984
mov edi, eax
push edi
push 0
call sub.kernel32.dll_SearchPathW
mov ebx, eax
inc ebx
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00407af0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
push ebx
push 0
push edi
push 0
call sub.kernel32.dll_SearchPathW
test eax, eax
je 0x459997
mov eax, dword [ebp - 8]
call fcn.00407984
call fcn.00407058
lea edx, [ebp - 8]
xchg edx, eax
call fcn.00407af0
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00406f20
jmp 0x459a18
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406f20
jmp 0x459a18
lea eax, [ebp - 8]
mov edx, 1
call fcn.00407af0
push 0
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
mov eax, dword [ebp - 4]
call fcn.00407984
mov edi, eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
inc ebx
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00407af0
push ebx
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x459a0e
mov eax, dword [ebp - 8]
call fcn.00407984
call fcn.00407058
lea edx, [ebp - 8]
xchg edx, eax
call fcn.00407af0
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00406f20
jmp 0x459a18
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406f20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459a3a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret

Function at 0x459eec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x459fbb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406b40
xor edx, edx
push ebp
push 0x459f98
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x459f8e
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.004079dc
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x459f5e
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x459f74
mov eax, ebx
mov edx, 0x459fd8
call fcn.00407b70
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.00459e9c
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00406f20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x459fa2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459fc2
lea eax, [ebp - 0x208]
call fcn.00406b40
ret
Function at 0x459fdc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45a0d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406b40
xor edx, edx
push ebp
push 0x45a0a8
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x45a09e
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.004079dc
lea edx, [ebp - 0x204]
mov eax, dword [ebx]
call fcn.0045afdc
mov edx, dword [ebp - 0x204]
mov eax, ebx
call fcn.00406f20
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.00459e9c
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00406f20
mov eax, dword [ebx]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x45a088
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x45a09e
mov eax, ebx
mov edx, 0x45a0ec
call fcn.00407b70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a0b2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a0d7
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x45a0f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45a284
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x45a257
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.00458f5c
cmp al, 0xa
jb 0x45a1cf
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00407af0
xor edx, edx
push ebp
push 0x45a1c8
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00407984
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x45a1b0
mov eax, dword [ebp - 4]
call fcn.00407984
mov edx, dword [ebp - 8]
call fcn.0041d77c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45a182
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x45a19e
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00422f78
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00406f20
call fcn.004062ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a261
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a1cf
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407af0
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x4b71a4]
mov eax, dword [eax]
mov ecx, 0x45a2a0
mov edx, 0x45a2bc
call fcn.00457b54
test al, al
je 0x45a24d
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00459e9c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00406f20
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45a21b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x45a24d
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45a230
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x45a24d
mov eax, dword [ebp - 8]
mov edx, 0x45a34c
call fcn.00407b70
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a261
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a28b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406ba0
lea eax, [ebp - 4]
call fcn.00406b40
ret
Function at 0x45a9c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], dl
mov esi, eax
xor eax, eax
push ebp
push 0x45ab59
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp byte [ebp - 0x11], 0
je 0x45aa00
call fcn.004597e4
mov dword [ebp - 0x18], eax
mov eax, esi
test eax, eax
je 0x45aa0b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x45aa16
xor ebx, ebx
jmp 0x45ab31
cmp byte [ebp - 0x12], 0
je 0x45ab1a
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00406f68
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00422fc8
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00406f68
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0041d110
mov eax, dword [ebp - 8]
test eax, eax
je 0x45aa57
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jne 0x45aa84
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00407d38
mov eax, dword [ebp - 0x1c]
mov edx, 0x45ab74
call fcn.00407d00
sete al
jmp 0x45aa86
xor eax, eax
test al, al
je 0x45aa8e
mov al, 1
jmp 0x45aa98
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0041cc1c
test al, al
je 0x45aaa0
mov al, 1
jmp 0x45aaae
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00407d00
sete al
test al, al
jne 0x45ab31
cmp dword [ebp - 4], 0
jne 0x45aad2
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x45ab31
mov eax, dword [ebp - 4]
call fcn.00407984
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.004079dc
mov eax, dword [ebp - 0x20]
movzx ecx, byte [ebp - 0x12]
movzx edx, byte [ebp - 0x11]
call fcn.0045a9c0
mov ebx, eax
test bl, bl
je 0x45ab10
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x45ab14
xor eax, eax
jmp 0x45ab16
mov al, 1
mov ebx, eax
jmp 0x45ab31
lea eax, [ebp - 0x18]
push eax
mov eax, esi
call fcn.00407984
push eax
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ab60
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00406ba0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00406ba0
ret

Function at 0x45ab78
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00407984
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x45ab91
test al, 0x10
jne 0x45ab95
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x45af70
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0045afb8
test al, al
je 0x45afb0
mov eax, esi
call fcn.0041cf00
mov ebx, eax
test bl, bl
jne 0x45afb0
mov eax, esi
call fcn.0045ae54
push 0x80
mov eax, esi
call fcn.00407984
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, esi
call fcn.0041cf00
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x45afb8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00407984
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x45afd1
test al, 0x10
je 0x45afd5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x45bc4c
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406c24
xor eax, eax
push ebp
push 0x45bd76
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x45bd41
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x4bd1e1], 2
jne 0x45bd29
cmp dword [ebp - 4], 0
je 0x45bd29
lea eax, [ebp - 4]
mov edx, 0x45bd90
call fcn.00407b70
cmp dword [0x4b5f68], 0
je 0x45bd37
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040763c
lea eax, [ebp - 8]
call fcn.004070fc
mov edx, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x45bcd7
sub eax, 4
mov eax, dword [eax]
push 0
lea ecx, [ebp - 0xc]
push ecx
push eax
push edx
mov eax, dword [0x4b5f68]
push eax
call sub.kernel32.dll_WriteFile_1
cmp dword [ebp - 0xc], 0
jne 0x45bd37
call sub.kernel32.dll_GetCurrentThreadId_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.0041c250
push dword [ebp - 0x14]
push 0x45bda4
push dword [ebp - 4]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00407c50
mov eax, dword [ebp - 0x10]
call fcn.00407984
push eax
call sub.kernel32.dll_OutputDebugStringW
jmp 0x45bd37
mov eax, dword [ebp - 4]
call fcn.00407984
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45bd4b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bd7d
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406ba0
lea eax, [ebp - 8]
call fcn.00406b64
lea eax, [ebp - 4]
call fcn.00406b40
ret
Function at 0x464670
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x464850
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_GetClientRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
jne 0x4646cd
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_BeginPaint
mov ebx, eax
jmp 0x4646e0
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WindowFromDC
test eax, eax
jne 0x4646e0
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x464730
mov eax, dword [ebp - 4]
cmp dword [eax + 0xf5], 0
jne 0x464730
push 0
call sub.user32.dll_GetDC
mov esi, eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push esi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x14], eax
jmp 0x464740
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf5]
test eax, eax
je 0x464740
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x46483f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xf5], edx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x14
mov eax, dword [ebp - 4]
push eax
call fcn.00467254
cmp dword [0x4bd224], 0
je 0x464782
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call dword [0x4bd224]
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xf
mov eax, dword [ebp - 4]
push eax
call fcn.00467254
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x45b]
test eax, eax
je 0x4647a7
xor edx, edx
call fcn.00460554
push 0
push ebx
call sub.gdi32.dll_SelectClipRgn
cmp ebx, dword [ebp - 0xc]
je 0x4647d3
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 0
push 0
push ebx
call sub.gdi32.dll_BitBlt
cmp dword [ebp - 8], 0
jne 0x4647ec
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464846
cmp dword [ebp - 0x10], 0
je 0x46482b
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf5], edx
jmp 0x46483e
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x46483e
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf5], edx
ret
Function at 0x46548c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x423]
test eax, eax
je 0x4654e7
cmp byte [ebx + 0x44d], 0
jne 0x4654e7
push eax
call sub.user32.dll_GetWindowTextLengthW
test eax, eax
jne 0x4654b5
xor esi, esi
jmp 0x4654d1
inc eax
mov ebp, eax
add ebp, ebp
mov eax, ebp
call fcn.004044f0
mov esi, eax
push ebp
push esi
mov eax, dword [ebx + 0x423]
push eax
call sub.user32.dll_GetWindowTextW
mov eax, edi
mov edx, esi
call fcn.004079dc
test esi, esi
je 0x4654f4
mov eax, esi
call fcn.0040450c
jmp 0x4654f4
mov eax, edi
mov edx, dword [ebx + 0x441]
call fcn.004079dc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46a2d4
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffee4
mov dword [esp], 0x11c
push esp
call sub.kernel32.dll_GetVersionExW
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x46a311
mov al, 4
mov edx, dword [esp + 4]
cmp edx, 6
jne 0x46a2ff
mov al, 7
jmp 0x46a34a
cmp edx, 5
jb 0x46a34a
mov al, 5
cmp dword [esp + 8], 1
jb 0x46a34a
mov al, 6
jmp 0x46a34a
cmp eax, 1
jne 0x46a348
mov al, 1
cmp dword [esp + 4], 4
ja 0x46a32d
cmp dword [esp + 4], 4
jne 0x46a32f
cmp dword [esp + 8], 0xa
jb 0x46a32f
mov al, 2
cmp dword [esp + 4], 4
ja 0x46a344
cmp dword [esp + 4], 4
jne 0x46a34a
cmp dword [esp + 8], 0x5a
jb 0x46a34a
mov al, 3
jmp 0x46a34a
xor eax, eax
add esp, 0x11c
ret

Function at 0x47014c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00407984
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], ebx
test ebx, ebx
jbe 0x4701fa
xor eax, eax
push ebp
push 0x4701e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004044f0
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, esi
xor ecx, ecx
call fcn.00404a64
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00407984
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4701fa
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x474d4c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x474e59
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor ecx, ecx
push ebp
push 0x474e31
push dword fs:[ecx]
mov dword fs:[ecx], esp
test dl, dl
je 0x474da9
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0041b6c4
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.0040763c
jmp 0x474db8
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.0040763c
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x474dd2
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x474e1b
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.004086d0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x4b6454]
mov eax, dword [eax*8 + 0x4b6450]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x474ddd
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x474e3b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474e60
lea eax, [ebp - 0x1c]
call fcn.00406b40
lea eax, [ebp - 4]
call fcn.00406b64
ret

Function at 0x474f0c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00406c24
xor eax, eax
push ebp
push 0x474f70
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp + 8]
call fcn.00407984
push eax
mov eax, esi
call fcn.00407984
push eax
mov eax, ebx
call fcn.00407984
push eax
push 0x474f80
push edi
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474f77
lea eax, [ebp + 8]
call fcn.00406b40
ret

Function at 0x4750c8
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406c24
xor eax, eax
push ebp
push 0x475162
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404a64
lea eax, [ebp - 0x44]
call fcn.00475fc8
xor eax, eax
push ebp
push 0x475145
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x44], 0x3c
lea eax, [ebp - 0x44]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407984
push eax
call sub.wininet.dll_InternetCrackUrlW
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47514c
lea eax, [ebp - 0x44]
call fcn.004760d8
ret