joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473384
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47352f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x473510
mov dl, 1
mov eax, dword [0x417334]
call fcn.00403770
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404530
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4734ff
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00461064
test al, al
je 0x4734f2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x473540
lea eax, [ebp - 0x254]
call fcn.00409c78
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4734f2
xor eax, eax
push ebp
push 0x4734eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x473578
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4734d4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004047a0
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4734d4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004047a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4734f2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4733f5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041b8f8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473536
lea eax, [ebp - 0x260]
call fcn.00404530
ret

Function at 0x473f2c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x56abc4]
cmp byte [eax + 0xa5], 0
jne 0x473f9d
cmp dword [0x56abdc], 0
jne 0x473f5e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x473ee8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x56abdc], eax
cmp dword [0x56abd8], 0
jne 0x473f79
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x56abd8], eax
cmp dword [0x56abe0], 0
jne 0x473f9d
push esp
push 0
push 0
push 0x473e8c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x56abe0], eax
pop edx
ret
Function at 0x474094
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4740ab
add esp, 0xfffffff0
call fcn.00403b04
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042198c
mov eax, dword [0x56981c]
cmp word [eax + 2], 0
jne 0x4740d3
mov eax, dword [0x56981c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00475814
mov eax, dword [0x569908]
cmp word [eax + 2], 0
jne 0x4740ed
mov eax, dword [0x569908]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00475a0c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x416cd0]
call fcn.00403770
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x416cd0]
call fcn.00403770
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x423f38]
call fcn.0042b7fc
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x474274
mov eax, dword [0x569710]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042bbcc
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x475fac
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x569710]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d53c
test eax, eax
je 0x4741e2
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409658
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d564
test eax, eax
je 0x4741f6
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004047a0
mov eax, dword [0x5695a8]
cmp byte [eax], 0
jne 0x47422a
mov eax, ebx
call fcn.0047439c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00476188
mov eax, ebx
call fcn.00476b4c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x47426a
call fcn.00403b5c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47461c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x56abc4]
cmp dword [eax + 0x30], 0
je 0x4746c6
cmp dword [ebx + 0x94], 0
jne 0x4746c0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4745ac
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4746c0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x474686
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4746c0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419520
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x474695
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x475228
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x47525d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404620
jmp 0x47526a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404584
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x476364
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4763a5
mov eax, esi
call fcn.0045c62c
test al, al
je 0x4763a5
mov eax, dword [ebx + 0x84]
call fcn.0045c328
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4763a5
push 0
mov eax, dword [ebx + 0x84]
call fcn.0045c328
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x47dc20
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x56abf4
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x47dc42
shr eax, 1
xor eax, 0xedb88320
jmp 0x47dc44
shr eax, 1
dec edx
jne 0x47dc30
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x47dc29
mov byte [0x56aff4], 1
pop esi
pop ebx
ret

Function at 0x47dc60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x56aff4], 0
jne 0x47dc77
call fcn.0047dc20
mov eax, edi
dec eax
test eax, eax
jl 0x47dca0
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x56abf4]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x47dc81
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x48023c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x48026d
dec al
je 0x4802a9
dec al
je 0x4802ed
dec al
je 0x480358
jmp 0x4803e2
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4803e2
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x48027d
jmp 0x4803e2
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4803e2
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4802b9
jmp 0x4803e2
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4803e2
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x48031b
xor ebp, ebp
jmp 0x48032c
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x480335
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4802fd
jmp 0x4803e2
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4803e2
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4803b0
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0047dca8
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x48036c
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48d28c
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48d395
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404530
mov dl, 1
mov eax, dword [0x417334]
call fcn.00403770
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x48d3ac
call fcn.00409cf8
mov ecx, dword [ebp - 0x14]
mov edx, 0x48d3e4
xor eax, eax
call fcn.004aa238
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x48d362
inc ebx
xor esi, esi
lea ecx, [ebp - 0x20]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 8]
call fcn.00408b38
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040891c
mov edx, dword [ebp - 0xc]
mov eax, 0x48d3f8
call fcn.00404b34
dec eax
jne 0x48d35e
lea eax, [ebp - 8]
mov ecx, 8
mov edx, 1
call fcn.00404a90
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404584
jmp 0x48d362
inc esi
dec ebx
jne 0x48d30c
mov eax, dword [ebp - 0x10]
call fcn.004037a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d39c
lea eax, [ebp - 0x20]
call fcn.00404530
lea eax, [ebp - 0x14]
call fcn.00404530
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404554
ret
Function at 0x48d404
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48d5c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404530
call fcn.004aa4dc
test al, al
je 0x48d5a0
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 0xc
call fcn.00402f04
lea eax, [ebp - 0x214]
xor ecx, ecx
mov edx, 0x200
call fcn.00402f04
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea edx, [ebp - 0x21c]
mov eax, ebx
call fcn.00408da0
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
mov edx, 0x48d5dc
call fcn.0040483c
mov eax, dword [ebp - 0x218]
call fcn.004049f0
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x48d5a0
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 4]
push eax
push 0x200
lea eax, [ebp - 0x214]
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0x2d1400
push esi
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x48d59a
cmp dword [ebp - 0x204], 0
je 0x48d59a
lea eax, [ebp - 8]
call fcn.00404530
mov ebx, dword [ebp - 0x208]
sub ebx, 0x24
test ebx, ebx
jle 0x48d54e
cmp byte [ebp + ebx - 0x1f0], 0
je 0x48d543
lea eax, [ebp - 0x220]
mov dl, byte [ebp + ebx - 0x1f0]
call fcn.00404718
mov edx, dword [ebp - 0x220]
lea eax, [ebp - 8]
call fcn.004047f8
inc ebx
cmp byte [ebp + ebx - 0x1f0], 0
jne 0x48d519
mov ebx, dword [ebp - 0x204]
sub ebx, 0x24
test ebx, ebx
jle 0x48d590
cmp byte [ebp + ebx - 0x1f0], 0
je 0x48d585
lea eax, [ebp - 0x224]
mov dl, byte [ebp + ebx - 0x1f0]
call fcn.00404718
mov edx, dword [ebp - 0x224]
lea eax, [ebp - 8]
call fcn.004047f8
inc ebx
cmp byte [ebp + ebx - 0x1f0], 0
jne 0x48d55b
mov edx, edi
mov eax, dword [ebp - 8]
call fcn.00408b38
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d5cd
lea eax, [ebp - 0x224]
mov edx, 4
call fcn.00404554
lea eax, [ebp - 8]
call fcn.00404530
ret
Function at 0x4aa59c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x4aa70c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x540044], 0
je 0x4aa5cc
mov ebx, dword [0x540044]
jmp 0x4aa6f1
call sub.kernel32.dll_GetVersion_1
mov ebx, eax
and bl, 0xff
shr eax, 8
and al, 0xff
mov byte [ebp - 1], al
cmp bl, 6
jne 0x4aa65c
cmp byte [ebp - 1], 2
jne 0x4aa65c
lea ecx, [ebp - 0x10]
mov edx, 0x4aa724
mov eax, 0x4aa73c
call fcn.004be9e4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00408b38
mov edx, dword [ebp - 0xc]
mov eax, 0x4aa774
call fcn.00404b34
mov esi, eax
test esi, esi
je 0x4aa65c
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404a50
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 8]
call fcn.00402f40
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
lea edx, [esi + 1]
mov ecx, 0x3e8
mov eax, dword [ebp - 0xc]
call fcn.00404a50
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 8]
call fcn.00402f40
mov byte [ebp - 1], al
cmp bl, 6
jne 0x4aa695
cmp byte [ebp - 1], 3
jne 0x4aa695
mov eax, 0x4aa73c
mov edx, 0x4aa780
call fcn.004bead0
mov esi, eax
mov eax, 0x4aa73c
mov edx, 0x4aa7a4
call fcn.004bead0
test esi, esi
je 0x4aa695
mov ebx, esi
and bl, 0xff
and al, 0xff
mov byte [ebp - 1], al
cmp bl, 6
jne 0x4aa6d8
cmp byte [ebp - 1], 3
jne 0x4aa6d8
lea ecx, [ebp - 0x1c]
mov eax, 0x4aa73c
mov edx, 0x4aa7c8
call fcn.004be9e4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0xc]
call fcn.00408b38
lea edx, [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00402f40
mov esi, eax
cmp esi, 0x2671
jl 0x4aa6d8
mov bl, 0xa
mov byte [ebp - 1], 0
xor eax, eax
mov al, bl
shl eax, 8
xor edx, edx
mov dl, byte [ebp - 1]
or eax, edx
mov dword [0x540044], eax
mov ebx, dword [0x540044]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa713
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00404554
ret

Function at 0x4aa7d8
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffbf8
mov ebx, eax
mov dword [esp], 0x400
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4aa804
mov edx, ebx
lea eax, [esp + 4]
call fcn.00409808
jmp 0x4aa82c
call fcn.004aa4dc
test al, al
je 0x4aa81b
mov edx, ebx
mov eax, 0x4aa83c
call fcn.004bf2e0
jmp 0x4aa82c
mov ecx, ebx
mov edx, 0x4aa854
mov eax, 0x4aa868
call fcn.004be910
add esp, 0x408
pop ebx
ret

Function at 0x4aa894
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
jbe 0x4aa8bb
mov edx, ebx
mov eax, esp
call fcn.00409808
jmp 0x4aa8c2
mov eax, ebx
call fcn.00404530
add esp, 0x108
pop ebx
ret
Function at 0x4b05dc
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd8
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x24
call fcn.00402f04
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x18]
mov dword [esp], eax
push 0x4b06c4
push 0x4b06d8
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
mov ebp, ebx
test ebx, ebx
je 0x4b06b9
call fcn.004bd188
cmp ax, 1
jbe 0x4b068f
xor edx, edx
mov dword [esp], edx
mov esi, eax
dec esi
test si, si
jb 0x4b06b9
inc esi
xor edi, edi
mov ebx, 0x540c80
xor edx, edx
mov eax, edi
call fcn.004bc818
test al, al
je 0x4b0684
push 0
call sub.kernel32.dll_Sleep_1
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x24
call fcn.00402f04
lea eax, [esp + 4]
push eax
call ebp
mov byte [0x540c7c], 1
mov eax, dword [esp + 0x18]
mov dword [ebx], eax
mov eax, dword [esp + 0x18]
add dword [esp], eax
inc edi
add ebx, 4
dec si
jne 0x4b0645
jmp 0x4b06b9
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x24
call fcn.00402f04
lea eax, [esp + 4]
push eax
call ebp
mov byte [0x540c7c], 1
mov eax, dword [esp + 0x18]
mov dword [0x540c80], eax
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b0a44
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xffffffe4
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], 0xbff00000
cmp byte [0x58bf84], 0
jne 0x4b0ab9
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push 0x4b0b28
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4b0b21
mov dword [esp + 8], 4
lea eax, [esp + 8]
push eax
push 0x58bf7c
lea eax, [esp + 0x14]
push eax
push 0
push 0x4b0b3c
mov eax, dword [esp + 0x24]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov byte [0x58bf84], 1
mov dword [esp + 8], 4
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push 0x4b0b4c
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4b0b21
lea eax, [esp + 8]
push eax
push 0x58bf7c
lea eax, [esp + 0x14]
push eax
push 0
push 0x4b0b3c
mov eax, dword [esp + 0x24]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [0x58bf7c]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x18], eax
fild qword [esp + 0x14]
fstp qword [esp]
wait
fld qword [esp]
add esp, 0x1c
ret
Function at 0x4bc6d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, eax
mov byte [ebp - 1], 0
call fcn.004bd188
mov ebx, eax
cmp bx, 1
jbe 0x4bc703
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
mov eax, esi
call fcn.004bc690
jmp 0x4bc706
mov dword [ebp - 8], esi
cmp dword [ebp - 8], 0x1f
setg al
test al, al
je 0x4bc7b6
cmp byte [0x540c5c], 0
jne 0x4bc786
mov byte [0x540c5c], 1
call fcn.004bd260
mov byte [0x540c60], al
cmp byte [0x540c60], 0
je 0x4bc786
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x4bc76f
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4bc768
lea eax, [ebp - 0x24]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x24]
push eax
call sub.user32.dll_DispatchMessageA
push 0x64
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x3e8
jae 0x4bc786
cmp dword [0x540c54], 0
je 0x4bc741
cmp byte [0x540c60], 0
je 0x4bc7e6
cmp dword [0x540c54], 0
je 0x4bc7e6
push esi
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
mov eax, dword [0x540c50]
push eax
mov eax, dword [0x540c54]
push eax
call sub.user32.dll_SendMessageA
mov byte [ebp - 1], 1
jmp 0x4bc7e6
cmp bx, 1
jbe 0x4bc7ca
mov edx, dword [ebp - 8]
mov ax, word [ebp - 4]
call fcn.004bc818
jmp 0x4bc7df
mov ecx, esi
mov eax, 1
shl eax, cl
push eax
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadAffinityMask
push 0
call sub.kernel32.dll_Sleep_1
xor eax, eax
push ebp
push 0x4bc804
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x540d00], esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bc80e
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret