joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462498
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x4624be
mov eax, esp
push eax
push 0x462460
call sub.user32.dll_EnumWindows
jmp 0x4624d1
mov eax, esp
push eax
push 0x462440
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x462594
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x4625e8]
test si, 4
je 0x4625a9
or bl, 1
test si, 8
je 0x4625b3
or bl, 4
test si, 1
je 0x4625bd
or bl, 8
test si, 2
je 0x4625c7
or bl, 0x10
test si, 0x10
je 0x4625d1
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4625e0
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4625ec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x462628]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x462606
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x462615
or bl, 4
test esi, 0x20000000
je 0x462620
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x46a960
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x46a972
add esp, 0xfffffff0
call fcn.004040dc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00421cc4
mov eax, dword [0x479db0]
mov dword [eax + 4], ebx
mov dword [eax], 0x46ad74
mov eax, dword [0x479dbc]
mov dword [eax + 4], ebx
mov dword [eax], 0x46ad80
mov eax, ebx
call fcn.0046ad8c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x417874]
call fcn.00403c5c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x417874]
call fcn.00403c5c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x417874]
call fcn.00403c5c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x417874]
call fcn.00403c5c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x417874]
call fcn.00403c5c
mov dword [ebx + 0x74], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x465db0
push eax
push 0
push 0
mov eax, dword [0x479f5c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4284f4]
call fcn.0042a2d0
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x4284f4]
call fcn.0042a2d0
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x4284f4]
call fcn.0042a2d0
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x4284f4]
call fcn.0042a2d0
mov dword [ebx + 0x84], eax
mov eax, ebx
call fcn.0046b284
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46b15c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46b15c
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46b15c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x46b15c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46aac5
call fcn.00404134
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x46aefc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46b0a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x46b08a
mov dl, 1
mov eax, dword [0x417f58]
call fcn.0041ce04
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
xor edx, edx
call fcn.0040562c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x46b079
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0045ac1c
test al, al
je 0x46b06c
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x46b0b8
lea eax, [ebp - 0x394]
call fcn.0040bdb8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x46b06c
xor eax, eax
push ebp
push 0x46b065
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x46b128
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x46b04e
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.004057e4
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x46b04e
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.004057e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b06c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x46af6f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.0041cbf0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b0b0
lea eax, [ebp - 0x3a0]
call fcn.0040561c
ret

Function at 0x46ba98
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4801b8]
cmp byte [eax + 0xa9], 0
jne 0x46bb0a
cmp dword [0x4801d0], 0
jne 0x46baca
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x479b84]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x4801d0], eax
cmp dword [0x4801cc], 0
jne 0x46bae5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x4801cc], eax
cmp dword [0x4801d4], 0
jne 0x46bb0a
push esp
push 0
push 0
mov eax, dword [0x479b80]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4801d4], eax
pop edx
ret
Function at 0x46bd20
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x46bd37
add esp, 0xfffffff0
call fcn.004040dc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00421cc4
mov eax, dword [0x479cec]
cmp byte [eax], 0
jne 0x46bd64
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x479f38]
cmp word [eax + 2], 0
jne 0x46bd7e
mov eax, dword [0x479f38]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046dc10
mov eax, dword [0x47a014]
cmp word [eax + 2], 0
jne 0x46bd98
mov eax, dword [0x47a014]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046de20
mov byte [ebx + 0x31], 0
mov dl, 1
mov eax, dword [0x4284f4]
call fcn.0042a2d0
mov esi, eax
mov dword [ebx + 0x38], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x46e2a4
mov dl, 1
mov eax, dword [0x417874]
call fcn.00403c5c
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x417874]
call fcn.00403c5c
mov dword [ebx + 0xac], eax
xor eax, eax
mov dword [ebx + 0x5c], eax
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x58], 0xff000018
mov dword [ebx + 0x74], 0x1f4
mov byte [ebx + 0x78], 1
xor eax, eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x70], 0x9c4
mov byte [ebx + 0x84], 0
mov byte [ebx + 0xa1], 1
mov byte [ebx + 0xb8], 1
mov dl, 1
mov eax, dword [0x4290a8]
call fcn.004315d0
mov esi, eax
mov dword [ebx + 0x9c], esi
push 0x46bf74
mov eax, dword [0x479e24]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.004319d4
mov eax, dword [ebx + 0x9c]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x46e554
mov dl, 1
mov eax, dword [0x417874]
call fcn.00403c5c
mov dword [ebx + 0x94], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x479e24]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0040bc04
test eax, eax
je 0x46bea6
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0040ba04
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0040bbec
test eax, eax
je 0x46bebe
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x88]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.004057e4
push ebx
push 0x46d624
call fcn.00462578
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xcc], 0
mov eax, dword [0x479cec]
cmp byte [eax], 0
jne 0x46bf0f
mov eax, ebx
call fcn.0046c0e8
mov byte [ebx + 0x55], 1
mov byte [ebx + 0x56], 1
mov byte [ebx + 0x57], 1
mov byte [ebx + 0xa2], 1
mov byte [ebx + 0xcd], 0
mov byte [ebx + 0xd8], 0
xor eax, eax
mov dword [ebx + 0xd0], eax
mov byte [ebx + 0xcf], 0
xor eax, eax
mov dword [ebx + 0xa4], eax
mov eax, ebx
call fcn.0046e77c
mov eax, ebx
call fcn.0046f340
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46bf6c
call fcn.00404134
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46c390
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x46c432
cmp dword [ebx + 0x90], 0
jne 0x46c42c
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46c308
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x8c]
cmp dword [eax + 8], 0
je 0x46c42c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x46c3f2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x8c]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46c42c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x8c]
call fcn.0041a220
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46c401
inc dword [ebx + 0x90]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46c650
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4801b8]
cmp dword [eax + 0x170], 0
je 0x46c7b5
test bl, bl
jne 0x46c703
cmp dword [esi + 0x98], 0
jne 0x46c6f8
mov eax, esi
call fcn.0046f190
push eax
push 0x46c55c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x40], 0
je 0x46c6c9
mov eax, dword [0x4801b8]
cmp byte [eax + 0xcf], 0
je 0x46c6c9
mov eax, dword [esi + 0xd4]
call fcn.004064a0
mov edi, eax
cmp edi, 0
jl 0x46c6c9
push 0
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x46c6b2
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x46c6f8
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.0041a220
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x46c6d8
inc dword [esi + 0x98]
jmp 0x46c7b5
cmp dword [esi + 0x98], 0
jle 0x46c7b5
dec dword [esi + 0x98]
cmp dword [esi + 0x98], 0
jne 0x46c7b5
cmp dword [esi + 0x40], 0
je 0x46c760
mov eax, dword [0x4801b8]
cmp byte [eax + 0xcf], 0
je 0x46c760
mov eax, dword [esi + 0xd4]
call fcn.004064a0
mov edi, eax
cmp edi, 0
jl 0x46c760
push 5
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x46c749
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x46c78f
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.0041a220
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x46c76f
mov eax, dword [esi + 0x94]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd4]
mov ecx, 1
mov edx, dword [0x461f84]
call fcn.00406660
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x46d370
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa8], 0
je 0x46d3db
cmp byte [ebx + 0xcf], 0
jne 0x46d3db
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405768
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x46d3c8
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x46d3e8
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.0040562c
jmp 0x46d3e8
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.0040562c
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x46e950
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x80]
test esi, esi
je 0x46e9be
mov eax, esi
call fcn.0045558c
test al, al
je 0x46e9be
mov eax, dword [ebx + 0x80]
call fcn.0045520c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46e9be
mov eax, dword [ebx + 0x80]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x46e9b2
push 0
mov eax, dword [ebx + 0x80]
call fcn.0045520c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x80]
call fcn.0044c874
jmp 0x46e9be
mov cl, 1
mov edx, dword [ebx + 0x70]
mov eax, ebx
call fcn.0046e79c
pop esi
pop ebx
ret
Function at 0x46fea8
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x470071
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405680
lea eax, [ebp - 0x120]
xor ecx, ecx
mov edx, 0x11c
call fcn.004035c0
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
lea eax, [ebp - 0x144]
xor ecx, ecx
mov edx, 0x24
call fcn.004035c0
push 0x470080
push 0x4700a8
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00407ba4
test eax, eax
je 0x46ff2f
lea edx, [ebp - 0x144]
push edx
call eax
jmp 0x46ff3b
lea eax, [ebp - 0x144]
push eax
call sub.kernel32.dll_GetSystemInfo_1
cmp dword [ebp - 0x110], 2
jne 0x470051
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffffd
sub eax, 2
jae 0x46ff63
lea eax, [ebp - 4]
mov edx, 0x4700d0
call fcn.00405680
cmp dword [ebp - 0x11c], 5
jne 0x46ff87
cmp dword [ebp - 0x118], 0
jne 0x46ff87
lea eax, [ebp - 4]
mov edx, 0x4700f4
call fcn.00405680
jmp 0x470051
cmp dword [ebp - 0x11c], 5
jne 0x46ffab
cmp dword [ebp - 0x118], 1
jne 0x46ffab
lea eax, [ebp - 4]
mov edx, 0x47011c
call fcn.00405680
jmp 0x470051
cmp dword [ebp - 0x11c], 5
jne 0x46ffeb
cmp dword [ebp - 0x118], 2
jne 0x46ffeb
cmp byte [ebp - 6], 1
jne 0x46ffdc
cmp word [ebp - 0x144], 9
jne 0x46ffdc
lea eax, [ebp - 4]
mov edx, 0x47011c
call fcn.00405680
jmp 0x470051
lea eax, [ebp - 4]
mov edx, 0x470140
call fcn.00405680
jmp 0x470051
cmp dword [ebp - 0x11c], 6
jne 0x47000c
cmp dword [ebp - 0x118], 0
jne 0x47000c
lea eax, [ebp - 4]
mov edx, 0x470174
call fcn.00405680
jmp 0x470051
cmp dword [ebp - 0x11c], 6
jne 0x47002d
cmp dword [ebp - 0x118], 1
jne 0x47002d
lea eax, [ebp - 4]
mov edx, 0x47019c
call fcn.00405680
jmp 0x470051
cmp dword [ebp - 0x11c], 6
jne 0x470051
mov eax, dword [ebp - 0x118]
add eax, 0xfffffffe
sub eax, 2
jae 0x470051
lea eax, [ebp - 4]
mov edx, 0x4701bc
call fcn.00405680
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040562c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470078
lea eax, [ebp - 4]
call fcn.0040561c
ret

Function at 0x4701d0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.004057e4
add esp, 0x200
pop ebx
ret

Function at 0x470200
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
push esp
push 0xff
call sub.kernel32.dll_GetTempPathW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.004057e4
add esp, 0x200
pop ebx
ret
Function at 0x470d20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
xor ebx, ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 0xd], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405614
mov eax, dword [ebp - 8]
call fcn.00405614
xor eax, eax
push ebp
push 0x470e57
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.0040b334
test al, al
je 0x470e2c
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.004035c0
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
cmp byte [ebp - 0xd], 0
jne 0x470d96
mov word [ebp - 0x24], 0
jmp 0x470d9c
mov word [ebp - 0x24], 1
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x74], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x6c], 0x11
lea edx, [ebp - 0x78]
mov ecx, 1
mov eax, 0x470e74
call fcn.0040be40
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0xc]
call fcn.0040a968
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 4]
call fcn.0040b6cc
mov eax, dword [ebp - 0x7c]
call fcn.004056b8
push eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004056b8
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp byte [ebp + 8], 0
je 0x470e18
push 0xffffffffffffffff
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470e5e
lea eax, [ebp - 0x7c]
call fcn.0040561c
lea eax, [ebp - 0x68]
call fcn.0040561c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405624
ret

Function at 0x470f1c
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
push ecx
push esp
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov cl, 1
mov edx, 0x470f58
mov eax, dword [esp]
call fcn.00470e84
mov ebx, eax
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
pop edx
pop ebx
ret
Function at 0x4713bc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405614
xor eax, eax
push ebp
push 0x47141e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004056b8
push eax
push 0xffffffffffffffff
push 0
call fcn.00407a44
test eax, eax
je 0x4713fb
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x471408
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471425
lea eax, [ebp - 4]
call fcn.0040561c
ret

Function at 0x4716f4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
xor ebx, ebx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x471720
push 0
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
test esi, esi
je 0x471720
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x471a88
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd7c
xor eax, eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x280], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x278]
mov edx, dword [0x408ef0]
call fcn.00405f94
xor eax, eax
push ebp
push 0x471bd2
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
mov eax, 0x471bec
call fcn.0040b560
test eax, eax
jne 0x471b90
mov eax, dword [ebp - 0x264]
mov edx, 0x471c0c
call fcn.00405c30
je 0x471b7d
mov eax, dword [ebp - 0x264]
mov edx, 0x471c1c
call fcn.00405c30
je 0x471b7d
lea edx, [ebp - 0x280]
xor eax, eax
call fcn.00403380
mov eax, dword [ebp - 0x280]
lea edx, [ebp - 0x27c]
call fcn.0040b6cc
mov edx, dword [ebp - 0x27c]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 0x264]
call fcn.004059b8
lea edx, [ebp - 0x284]
mov eax, dword [ebp - 0x264]
call fcn.0040a47c
mov edx, dword [ebp - 0x284]
mov eax, 0x471c30
call fcn.00405f48
test eax, eax
jg 0x471b7d
mov eax, dword [ebp - 4]
call fcn.0040b334
test al, al
je 0x471b7d
mov eax, dword [ebp - 4]
call fcn.004056b8
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x278]
call fcn.0040b5b0
test eax, eax
je 0x471ae4
lea eax, [ebp - 0x278]
call fcn.0040b5d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471bd9
lea eax, [ebp - 0x284]
mov edx, 3
call fcn.00405624
lea eax, [ebp - 0x278]
mov edx, dword [0x408ef0]
call fcn.0040606c
lea eax, [ebp - 4]
call fcn.0040561c
ret

Function at 0x471ccc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
xor edx, edx
call fcn.0040562c
push 0
push edi
lea eax, [ebp - 0x20a]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.004057e4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x471d14
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.004057e4
add esp, 0x200
pop ebx
ret

Function at 0x471d44
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push esp
push 0xff
call sub.kernel32.dll_GetTempPathW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.004057e4
add esp, 0x200
pop ebx
ret

Function at 0x471d70
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.004057e4
add esp, 0x200
pop ebx
ret

Function at 0x471da0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
mov ebx, eax
mov eax, ebx
xor edx, edx
call fcn.0040562c
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x471ddd
mov eax, ebx
lea edx, [ebp - 0x20c]
call fcn.004057a8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x471de4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x471e60
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
jbe 0x471e47
push ebx
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.004057e4
mov eax, dword [ebp - 0x20c]
mov ecx, 2
mov edx, 1
call fcn.00405c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471e67
lea eax, [ebp - 0x20c]
call fcn.0040561c
ret