joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d8d4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49d9bd
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x49d99f
inc esi
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, 0x49d9d8
call fcn.00404b50
mov edi, eax
test edi, edi
jle 0x49d94c
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00404a6c
mov bl, 1
jmp 0x49d959
lea eax, [ebp - 0x10]
mov edx, 0x49d9e4
call fcn.0040481c
cmp dword [ebp - 0x10], 0
je 0x49d995
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404814
push eax
lea eax, [ebp - 0x10]
call fcn.00404a64
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x49d995
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xe8
je 0x49d995
call fcn.0040da94
inc dword [ebp - 0xc]
dec esi
jne 0x49d913
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d9c4
lea eax, [ebp - 0x10]
call fcn.0040455c
ret

Function at 0x49db8c
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov esi, 0x532f10
xor eax, eax
push ebp
push 0x49dcbf
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
mov eax, esi
mov ecx, 1
mov edx, dword [0x4896c4]
call fcn.00405ea4
add esp, 4
mov eax, dword [esi]
mov edx, 0x49dcd8
call fcn.004045b0
mov eax, dword [esi]
mov dword [eax + 4], 0x532ee8
mov eax, dword [esi]
add eax, 8
mov edx, 0x49dcf4
call fcn.004045b0
mov eax, dword [esi]
mov dword [eax + 0xc], 0x532eec
mov eax, dword [esi]
add eax, 0x10
mov edx, 0x49dd10
call fcn.004045b0
mov eax, dword [esi]
mov dword [eax + 0x14], 0x532ef0
mov eax, dword [esi]
add eax, 0x18
mov edx, 0x49dd28
call fcn.004045b0
mov eax, dword [esi]
mov dword [eax + 0x1c], 0x532ef4
mov eax, dword [esi]
add eax, 0x20
mov edx, 0x49dd40
call fcn.004045b0
mov eax, dword [esi]
mov dword [eax + 0x24], 0x532ef8
mov eax, dword [esi]
add eax, 0x28
mov edx, 0x49dd54
call fcn.004045b0
mov eax, dword [esi]
mov dword [eax + 0x2c], 0x532efc
mov eax, dword [esi]
add eax, 0x30
mov edx, 0x49dd68
call fcn.004045b0
mov eax, dword [esi]
mov dword [eax + 0x34], 0x532f00
mov eax, dword [esi]
add eax, 0x38
mov edx, 0x49dd78
call fcn.004045b0
mov eax, dword [esi]
mov dword [eax + 0x3c], 0x532f04
lea ecx, [ebp - 0xc]
mov eax, dword [0x532f0c]
mov eax, dword [eax + 4]
mov edx, dword [esi]
call fcn.00489de4
lea edx, [ebp - 0xc]
mov eax, 0x532f14
mov ecx, dword [0x4896a4]
call fcn.004054ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49dcc6
lea eax, [ebp - 0xc]
mov edx, dword [0x4896a4]
call fcn.004052d0
ret
Function at 0x49fb00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x49fb64
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004047c4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040940c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fb6b
lea eax, [ebp - 0xc]
call fcn.0040455c
ret

Function at 0x4a87ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a889f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4a8889
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, 0x4a88b4
call fcn.00404b50
test eax, eax
jle 0x4a8852
lea edx, [ebp - 0xc]
mov ecx, 0x400
xchg edx, eax
call fcn.00404aac
mov eax, dword [ebp - 0xc]
call fcn.00404814
mov edx, eax
test edx, edx
jle 0x4a8871
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor byte [ecx + eax - 1], 0x80
inc eax
dec edx
jne 0x4a8865
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x4a8823
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a88a6
lea eax, [ebp - 0xc]
call fcn.0040455c
ret
Function at 0x4ad2c4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push esp
push 0x208
call sub.kernel32.dll_GetCurrentDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.00404dfc
add esp, 0x208
pop ebx
ret

Function at 0x4ae228
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x78], ebx
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
call fcn.004051e0
xor eax, eax
push ebp
push 0x4ae3c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x52e528]
cmp eax, 1
sete byte [ebp - 0xb]
test eax, eax
jne 0x4ae3a4
mov dword [0x52e528], 0xffffffff
mov byte [0x52e52c], 0
call sub.winmm.dll_waveInGetNumDevs
mov ebx, eax
test ebx, ebx
jle 0x4ae3a4
mov ax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1d]
mov ecx, dword [ebp + 0xc]
mov dx, word [ebp - 0xa]
call fcn.004ae1e0
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00404f50
je 0x4ae305
mov edi, 2
dec ebx
test ebx, ebx
jl 0x4ae323
inc ebx
xor esi, esi
push 0x54
lea eax, [ebp - 0x74]
push eax
push esi
call sub.winmm.dll_waveInGetDevCapsW
lea eax, [ebp - 0x78]
lea edx, [ebp - 0x6c]
mov ecx, 0x20
call fcn.00404dfc
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp - 8]
call fcn.00404f50
jne 0x4ae2ff
push 0x30000
push 0
push 0x4ae198
lea eax, [ebp - 0x1d]
push eax
push esi
push 0x5343b4
call sub.winmm.dll_waveInOpen
mov edi, eax
jmp 0x4ae323
inc esi
dec ebx
jne 0x4ae2b7
jmp 0x4ae323
push 0x30000
push 0
push 0x4ae198
lea eax, [ebp - 0x1d]
push eax
push 0xffffffffffffffff
push 0x5343b4
call sub.winmm.dll_waveInOpen
mov edi, eax
test edi, edi
jne 0x4ae3a4
mov eax, dword [ebp - 4]
mov dword [0x52e538], eax
mov esi, 5
mov ebx, 0x5343bc
mov edi, 0x534458
movzx eax, word [ebp - 0xa]
imul eax, eax, 0x780
imul dword [ebp + 0xc]
mov ecx, 0x15888
xor edx, edx
div ecx
mov dword [ebx], eax
mov eax, edi
mov dword [ebx - 4], eax
xor eax, eax
mov dword [ebx + 0xc], eax
push 0x20
lea eax, [ebx - 4]
push eax
mov eax, dword [0x5343b4]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x4ae3a4
push 0x20
lea eax, [ebx - 4]
push eax
mov eax, dword [0x5343b4]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
jne 0x4ae3a4
add edi, 0x780
add ebx, 0x20
dec esi
jne 0x4ae33e
mov dword [0x52e528], 1
mov byte [ebp - 0xb], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae3c9
lea eax, [ebp - 0x78]
call fcn.00404c78
lea eax, [ebp - 8]
call fcn.00404c78
ret

Function at 0x4af980
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x531208]
mov dword [eax], 0x3ef
mov eax, dword [ebx + 0x31c]
test eax, eax
je 0x4af9a3
cmp byte [eax + 0x57], 0
jne 0x4af9a3
call fcn.00443ab8
mov eax, dword [0x5316f4]
mov eax, dword [eax]
call fcn.004469f0
push 0
mov eax, dword [0x5316f4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
call fcn.004afe30
mov eax, dword [0x531208]
xor edx, edx
mov dword [eax], edx
pop ebx
ret
Function at 0x4b0408
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x531208]
mov dword [eax], 0x3f6
cmp dword [0x52e558], 0
jne 0x4b043c
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4ae4d4]
call fcn.0043f87c
mov dword [0x52e558], eax
mov eax, dword [0x52e558]
call fcn.004ae714
mov eax, dword [0x52e558]
call fcn.00443ab8
mov eax, dword [0x52e558]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xc0]
mov eax, dword [0x5316f4]
mov eax, dword [eax]
call fcn.004469f0
push 0
mov eax, dword [0x5316f4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
call fcn.004afe30
mov eax, dword [0x531208]
xor edx, edx
mov dword [eax], edx
pop ebx
ret
Function at 0x4b9768
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4b9770
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b9962
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4b9978
mov eax, esi
call fcn.004b74f8
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004045b0
lea ecx, [ebp - 0x10]
mov edx, 0x4b998c
mov eax, esi
call fcn.004b74f8
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004045b0
lea ecx, [ebp - 0x14]
mov edx, 0x4b99a4
mov eax, esi
call fcn.004b74f8
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004045b0
lea ecx, [ebp - 0x18]
mov edx, 0x4b99c0
mov eax, esi
call fcn.004b74f8
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004045b0
lea ecx, [ebp - 0x1c]
mov edx, 0x4b99dc
mov eax, esi
call fcn.004b74f8
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004045b0
lea ecx, [ebp - 0x24]
mov edx, 0x4b99f4
mov eax, esi
call fcn.004b74f8
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408fac
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0040940c
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4b9a0c
mov eax, esi
call fcn.004b74f8
mov eax, dword [ebp - 0x28]
call fcn.004b6610
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4b9a1c
mov eax, esi
call fcn.004b74f8
mov eax, dword [ebp - 0x2c]
call fcn.004b6610
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4b9a34
mov eax, esi
call fcn.004b74f8
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0040940c
inc eax
je 0x4b9905
lea ecx, [ebp - 0x34]
mov edx, 0x4b9a34
mov eax, esi
call fcn.004b74f8
mov eax, dword [ebp - 0x34]
call fcn.004093d0
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040ac60
fstp qword [ebp - 0x3c]
wait
call fcn.0040b024
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4b9920
lea ecx, [ebp - 0x40]
mov edx, 0x4b9a34
mov eax, esi
call fcn.004b74f8
mov eax, dword [ebp - 0x40]
call fcn.004b6610
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4b9a44
mov eax, esi
call fcn.004b74f8
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004045b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9969
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404580
ret
Function at 0x4c5b2c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4c5b86
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004c5b1c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004b527c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004b4e7c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5b8d
lea eax, [ebp - 4]
call fcn.0040455c
ret

Function at 0x4c903c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049fc
xor eax, eax
push ebp
push 0x4c9105
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov dl, 1
mov eax, dword [0x4c8ed0]
call fcn.0041f1c4
mov ebx, eax
mov byte [ebx + 0xf], 1
lea eax, [ebx + 0x38]
mov edx, dword [ebp - 4]
call fcn.004045b0
xor eax, eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x40], esi
call sub.kernel32.dll_GetTickCount
mov edi, eax
mov byte [ebx + 0x3c], 1
mov byte [ebx + 0x3d], 0
mov eax, ebx
call fcn.0041f510
jmp 0x4c90cc
call sub.kernel32.dll_GetTickCount
sub eax, edi
lea edx, [esi + 0x7d0]
cmp eax, edx
ja 0x4c90d2
cmp byte [ebp + 8], 0
jne 0x4c90c5
mov eax, dword [0x5316f4]
mov eax, dword [eax]
call fcn.00446d58
push 1
call sub.kernel32.dll_Sleep
cmp byte [ebx + 0x3c], 1
je 0x4c90a2
cmp byte [ebx + 0x3c], 2
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x4c90eb
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x34]
call fcn.004045b0
mov byte [ebx + 0x3d], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c910c
lea eax, [ebp - 4]
call fcn.0040455c
ret
Function at 0x4cb324
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb8
mov ebx, ecx
mov ebp, edx
mov esi, eax
xor edi, edi
push edi
lea eax, [esp + 8]
push eax
mov ecx, 0x4cb548
mov edx, 0x4cb54c
mov eax, esi
call fcn.004cb01c
test al, al
jne 0x4cb358
xor eax, eax
jmp 0x4cb53c
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x9c
call fcn.00407b3c
mov word [esp + 0xd0], 0x9c
mov word [esp + 0xd2], 0
lea eax, [esp + 0xac]
push eax
mov eax, dword [0x52edcc]
push eax
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [esp + 0xd4], 0x1c0000
test ebx, ebx
je 0x4cb3dc
or dword [esp + 0xd4], 0x20
mov eax, dword [ebx]
lea edx, [esp + 0xd8]
mov dword [edx], eax
mov eax, dword [ebx + 4]
lea edx, [esp + 0xd8]
mov dword [edx + 4], eax
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
mov dword [esp + 0x118], eax
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
mov dword [esp + 0x11c], eax
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x20
call fcn.0040303c
mov edx, 0x4cb55c
mov eax, esi
call fcn.004cb238
mov ebx, eax
test ebx, ebx
jne 0x4cb408
xor eax, eax
jmp 0x4cb53c
push 0x4cb568
push ebx
call sub.advapi32.dll_RegDeleteValueA
push 0x4cb57c
push ebx
call sub.advapi32.dll_RegDeleteValueA
test ebp, ebp
je 0x4cb42b
mov dword [esp], 3
jmp 0x4cb430
xor eax, eax
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cb58c
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4cb451
xor eax, eax
jmp 0x4cb53c
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cb5a0
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4cb479
xor eax, eax
jmp 0x4cb53c
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cb5bc
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4cb4a1
xor eax, eax
jmp 0x4cb53c
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov ebp, eax
xor edi, edi
test ebp, ebp
je 0x4cb4ce
push 0x2000000
push 0
push 0
call sub.user32.dll_OpenInputDesktop
mov edi, eax
test edi, edi
je 0x4cb4ce
push edi
call sub.user32.dll_SetThreadDesktop
cmp dword [esp + 0x114], 0x18
jne 0x4cb4e3
mov dword [esp + 0x114], 0x20
push 0
push 1
push 0
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
push esi
push edi
lea edi, [esi + 4]
lea esi, [esp + 0xb4]
mov ecx, 0x27
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [esi + 0xa0]
lea edx, [esp + 8]
mov ecx, 0x20
call fcn.004047c4
push ebp
call sub.user32.dll_SetThreadDesktop
test edi, edi
je 0x4cb534
push edi
call sub.user32.dll_CloseDesktop
push ebx
call sub.advapi32.dll_RegCloseKey_1
mov al, 1
add esp, 0x148
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cb5d0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffeb8
mov ebx, eax
lea eax, [ebx + 0xa0]
call fcn.0040455c
xor esi, esi
push esi
lea eax, [esp + 8]
push eax
mov ecx, 0x4cb718
mov edx, 0x4cb71c
mov eax, ebx
call fcn.004cb01c
test al, al
je 0x4cb70d
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x9c
call fcn.00407b3c
mov word [esp + 0xd0], 0x9c
mov word [esp + 0xd2], 0
lea eax, [esp + 0xac]
push eax
mov eax, dword [0x52edcc]
push eax
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [esp + 0xd4], 0x1c0000
mov byte [esp + 0xac], 0
mov edx, 0x4cb72c
mov eax, ebx
call fcn.004cb238
mov ebx, eax
test ebx, ebx
je 0x4cb70d
xor eax, eax
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cb738
push ebx
call sub.advapi32.dll_RegSetValueExA
push 0x4cb74c
push ebx
call sub.advapi32.dll_RegDeleteValueA
push 0x4cb760
push ebx
call sub.advapi32.dll_RegDeleteValueA
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov edi, eax
xor esi, esi
test edi, edi
je 0x4cb6ca
push 0x2000000
push 0
push 0
call sub.user32.dll_OpenInputDesktop
mov esi, eax
test esi, esi
je 0x4cb6ca
push esi
call sub.user32.dll_SetThreadDesktop
cmp dword [esp + 0x114], 0x18
jne 0x4cb6df
mov dword [esp + 0x114], 0x20
push 0
push 1
push 0
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
push edi
call sub.user32.dll_SetThreadDesktop
test esi, esi
je 0x4cb707
push esi
call sub.user32.dll_CloseDesktop
push ebx
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x148
pop edi
pop esi
pop ebx
ret
Function at 0x4cb9c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x4cbbe7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x52edec], eax
xor eax, eax
mov dword [0x5370b0], eax
xor eax, eax
mov dword [0x5370b4], eax
xor eax, eax
mov dword [0x5370b8], eax
xor eax, eax
mov dword [0x5370bc], eax
xor eax, eax
mov dword [0x5370ac], eax
xor eax, eax
mov dword [0x5370c0], eax
xor eax, eax
mov dword [0x5370c4], eax
xor eax, eax
mov dword [0x5370c8], eax
xor eax, eax
mov dword [0x5370cc], eax
cmp dword [0x52edf0], 0
je 0x4cbbc9
push 0x4cbbf4
mov eax, dword [0x52edf0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370b0], eax
push 0x4cbbfc
mov eax, dword [0x52edf0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370b4], eax
push 0x4cbc04
mov eax, dword [0x52edf0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370b8], eax
push 0x4cbc0c
mov eax, dword [0x52edf0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370bc], eax
push 0x4cbc14
mov eax, dword [0x52edf0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370ac], eax
push 0x4cbc1c
mov eax, dword [0x52edf0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370c0], eax
push 0x4cbc2c
mov eax, dword [0x52edf0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370c4], eax
push 0x4cbc38
mov eax, dword [0x52edf0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370c8], eax
push 0x4cbc48
mov eax, dword [0x52edf0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5370cc], eax
cmp dword [0x5370b0], 0
je 0x4cbbc9
cmp dword [0x5370b4], 0
je 0x4cbbc9
cmp dword [0x5370b8], 0
je 0x4cbbc9
cmp dword [0x5370bc], 0
je 0x4cbbc9
cmp dword [0x5370ac], 0
je 0x4cbbc9
cmp dword [0x52edf4], 0xffffffff
jne 0x4cbb65
push 0
push 1
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x4cbc64
call fcn.00404860
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404e18
mov eax, dword [ebp - 4]
mov edx, 0x4cbc78
call fcn.0046be70
mov dword [0x52edf4], eax
cmp dword [0x52edf4], 2
jge 0x4cbb7d
push 0x58
push 0x6f401
call dword [0x5370bc]
jmp 0x4cbb91
cmp dword [0x52edf4], 2
jne 0x4cbb91
push 0x51a7b0e
call dword [0x5370b4]
mov dword [0x52edec], 1
cmp dword [0x5370c0], 0
je 0x4cbbc9
cmp dword [0x5370c4], 0
je 0x4cbbc9
cmp dword [0x5370c8], 0
je 0x4cbbc9
cmp dword [0x5370cc], 0
je 0x4cbbc9
mov dword [0x52edec], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbbee
lea eax, [ebp - 8]
call fcn.0040455c
lea eax, [ebp - 4]
call fcn.00404c78
ret
Function at 0x4d0ea8
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d100c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x52fed4], 0x7d9
cmp si, 2
jne 0x4d0f02
lea eax, [ebp - 0x20]
mov edx, dword [0x5314f0]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xc]
mov edx, 0x4d1024
call fcn.0046c1a4
jmp 0x4d0f2e
cmp si, 8
je 0x4d0f0e
cmp si, 1
jne 0x4d0f2e
lea eax, [ebp - 0x24]
mov edx, dword [0x5314f0]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xc]
mov edx, 0x4d1034
call fcn.0046c1a4
cmp dword [ebp - 0xc], 0
je 0x4d0f49
push 1
lea eax, [ebp - 0xc]
call fcn.00404a64
push eax
call sub.kernel32.dll_WinExec
jmp 0x4d0fe1
test si, 2
jne 0x4d0f5e
test si, 1
jne 0x4d0f5e
test si, 8
je 0x4d0fc7
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4d0fc7
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x29
call fcn.004a829c
mov eax, dword [ebp - 0x28]
call fcn.00404a0c
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x4d0fcf
or si, 4
push 0
movzx eax, si
push eax
call sub.user32.dll_ExitWindowsEx
xor eax, eax
mov dword [0x52fed4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1013
lea eax, [ebp - 0x28]
call fcn.0040455c
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0xc]
call fcn.0040455c
ret

Function at 0x4d1b04
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [0x52fed4], 0x7e9
push 0
push 0x10
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4d1b3b
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004047c4
jmp 0x4d1b42
mov eax, ebx
call fcn.0040455c
xor eax, eax
mov dword [0x52fed4], eax
add esp, 0x108
pop ebx
ret

Function at 0x4d1b54
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [0x52fed4], 0x7ea
push 0
push 0x18
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4d1b8b
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004047c4
jmp 0x4d1b92
mov eax, ebx
call fcn.0040455c
xor eax, eax
mov dword [0x52fed4], eax
add esp, 0x108
pop ebx
ret