joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a54c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405354
xor eax, eax
push ebp
push 0x46a6af
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov edx, dword [ebp - 8]
mov al, 0x5c
call fcn.0046a390
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x46a691
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004053cc
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x14]
call fcn.00405364
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0040746c
test eax, eax
jne 0x46a691
mov eax, dword [ebp - 8]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x46a5e3
mov eax, dword [ebp - 0x30]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
inc edx
mov eax, dword [ebp - 8]
call fcn.004053cc
cmp dword [ebp - 0x14], 0
jne 0x46a606
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x46a611
mov eax, dword [ebp - 0x14]
call fcn.00405364
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040747c
test eax, eax
jne 0x46a688
mov eax, dword [ebp - 0x28]
call fcn.0040317c
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040747c
test eax, eax
jne 0x46a680
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jne 0x46a676
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x24]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x28]
mov dword [eax], edx
mov byte [ebp - 0xd], 1
jmp 0x46a688
mov eax, dword [ebp - 0x24]
call fcn.00403198
jmp 0x46a688
mov eax, dword [ebp - 0x24]
call fcn.00403198
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040743c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a6b6
lea eax, [ebp - 0x14]
call fcn.00404ed4
lea eax, [ebp - 8]
call fcn.00404ed4
ret
Function at 0x46a824
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405354
xor eax, eax
push ebp
push 0x46a908
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov edx, dword [ebp - 8]
mov al, 0x5c
call fcn.0046a390
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x46a8ea
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004053cc
lea eax, [ebp - 0x18]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 0x10]
call fcn.00405364
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0040746c
test eax, eax
jne 0x46a8ea
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x46a8b3
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
inc edx
mov eax, dword [ebp - 8]
call fcn.004053cc
mov eax, dword [ebp - 0x10]
call fcn.00405364
push eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.0040744c
test eax, eax
sete byte [ebp - 9]
mov eax, dword [ebp - 0x18]
push eax
call fcn.0040743c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a90f
lea eax, [ebp - 0x10]
call fcn.00404ed4
lea eax, [ebp - 8]
call fcn.00404ed4
ret
Function at 0x46a918
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405354
xor eax, eax
push ebp
push 0x46aa75
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 8]
call fcn.00405364
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0040746c
test eax, eax
jne 0x46aa57
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x28], 0x400
mov eax, dword [ebp - 0x28]
call fcn.0040317c
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x46aa46
mov dword [ebp - 0x28], 0x400
cmp byte [ebp + 8], 0
je 0x46a9c5
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
call fcn.00407454
mov dword [ebp - 0x18], eax
jmp 0x46a9e5
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040745c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x46aa3c
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
call fcn.004055f4
mov eax, dword [ebp - 0x14]
inc eax
push eax
mov eax, dword [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x4072c4]
call fcn.004064e8
add esp, 4
lea eax, [ebp - 0x1c]
call fcn.004053c4
mov edx, eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
call fcn.004033dc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
lea eax, [eax + edx*4]
mov edx, dword [ebp - 0x1c]
call fcn.00404f28
inc dword [ebp - 0x14]
cmp dword [ebp - 0x18], 0
je 0x46a996
mov eax, dword [ebp - 0x24]
call fcn.00403198
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040743c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46aa7c
lea eax, [ebp - 0x1c]
call fcn.00404ed4
lea eax, [ebp - 8]
call fcn.00404ed4
ret
Function at 0x48c7b0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x414260]
call fcn.004059a4
xor eax, eax
push ebp
push 0x48c951
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d3aa0], 0
jne 0x48c80b
mov ecx, dword [0x4d4cf8]
mov dl, 1
mov eax, dword [0x40aa8c]
call fcn.00411404
call fcn.00404868
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.004038f0
mov eax, ebx
call fcn.004057f4
mov dword [ebp - 0x24], eax
mov esi, 0x48c960
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406bd8
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405804
test eax, eax
jle 0x48c8f4
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00407584
test eax, eax
je 0x48c8e0
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405144
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x48c886
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.0040515c
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x48c89c
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.0040515c
mov eax, dword [ebp - 0x54]
call fcn.00405364
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405144
mov eax, dword [ebp - 0x58]
call fcn.00405364
push eax
push 1
push 0x400
call fcn.00407494
sub eax, 2
test eax, eax
sete al
jmp 0x48c8e2
xor eax, eax
test al, al
je 0x48c8ed
mov ebx, 0x15
jmp 0x48c8f9
mov ebx, 0x10
jmp 0x48c8f9
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4d3aa0]
call fcn.0048c630
mov eax, dword [ebp - 4]
call fcn.0048c630
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406bf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c958
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404ef8
lea eax, [ebp - 0xc]
mov edx, dword [0x414260]
call fcn.00405a74
ret
Function at 0x490108
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.0048fb68
test byte [ebx + 0x285], 4
jne 0x49019d
mov edx, esp
mov eax, ebx
call fcn.00449090
push esp
mov eax, ebx
call fcn.004515c8
push eax
push 0
mov eax, ebx
test eax, eax
je 0x49013d
sub eax, 0xfffffd34
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x260]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x274], 0
jne 0x49016e
mov ecx, dword [0x4d4f20]
mov dl, 1
mov eax, dword [0x48c2ec]
call fcn.00411404
call fcn.00404868
mov eax, ebx
call fcn.004906e0
cmp byte [ebx + 0x57], 0
jne 0x4901a4
mov eax, ebx
call fcn.004517d8
push eax
call fcn.00407dd4
test eax, eax
je 0x4901a4
push 0
mov eax, ebx
call fcn.004517d8
push eax
call fcn.00407fc4
jmp 0x4901a4
mov eax, ebx
call fcn.0044d9c4
add esp, 0x10
pop ebx
ret

Function at 0x494704
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x494773
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call fcn.00407d44
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
inc edx
lea eax, [ebp - 0xc]
call fcn.004055f4
mov eax, dword [ebp - 0x10]
inc eax
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405364
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00407d3c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00404f28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49477a
lea eax, [ebp - 0xc]
call fcn.00404ed4
ret

Function at 0x498ed4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call fcn.0040776c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x498f5e
xor edx, edx
push ebp
push 0x498f3f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x498f5e
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x49cd30
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x49cd5e
mov eax, ebx
call fcn.0049d7e4
cmp dword [ebx + 0x40], 0
je 0x49cd57
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x49cdcf
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x49cdc1
cmp dword [ebx + 8], 0
je 0x49cd80
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x49cd92
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x49cdc1
cmp dword [ebx + 8], 0
je 0x49cd73
cmp eax, 3
je 0x49cda5
dec eax
jne 0x49cd73
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x49cd73
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x49cd73
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x49cded
cmp dword [ebx + 0x14], 0xcc
je 0x49cded
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0049cdf8
pop ebx
ret

Function at 0x4ad4f0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405354
mov eax, dword [ebp - 8]
call fcn.00405354
xor eax, eax
push ebp
push 0x4ad611
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov dword [ebp - 0x10], 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.00405364
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 3
mov eax, 0x4ad620
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00405364
push eax
call fcn.00414830
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4ad5f6
xor eax, eax
push ebp
push 0x4ad5ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call fcn.00414838
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4ad5cf
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call fcn.00414838
test eax, eax
jne 0x4ad5d3
xor eax, eax
jmp 0x4ad5d5
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad5f6
mov eax, dword [ebp - 0x14]
push eax
call fcn.00414820
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad618
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ef8
ret
Function at 0x4ad628
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405354
mov eax, dword [ebp - 8]
call fcn.00405354
mov eax, dword [ebp - 0xc]
call fcn.00405354
mov eax, dword [ebp + 0xc]
call fcn.00405354
xor eax, eax
push ebp
push 0x4ad7a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x14], 0x14
mov dword [ebp - 0x30], 0x14
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x50], 3
mov dword [ebp - 0x48], 2
mov eax, dword [ebp - 8]
call fcn.00405364
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], 3
mov eax, 0x4ad7b0
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00405364
push eax
call fcn.00414830
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4ad77d
xor eax, eax
push ebp
push 0x4ad776
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.00405364
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405364
push eax
mov ax, word [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00405364
push eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.00414828
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4ad75f
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x4b
mov eax, dword [ebp - 0x18]
push eax
call fcn.00414838
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4ad756
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x18]
push eax
call fcn.00414838
test eax, eax
jne 0x4ad75a
xor eax, eax
jmp 0x4ad75c
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad77d
mov eax, dword [ebp - 0x18]
push eax
call fcn.00414820
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad7a7
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ef8
lea eax, [ebp + 0xc]
call fcn.00404ed4
ret
Function at 0x4ad7b8
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov byte [ebp - 1], 0
mov dword [ebp - 8], 0x14
mov dword [ebp - 0x20], 0x14
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x38], 2
mov eax, 0x4ad884
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 3
mov eax, 0x4ad888
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 1
push 0x4ad884
call fcn.00414830
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4ad87b
xor eax, eax
push ebp
push 0x4ad874
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x4b
mov eax, dword [ebp - 0xc]
push eax
call fcn.00414838
push 0
push 0
push 0x25
mov eax, dword [ebp - 0xc]
push eax
call fcn.00414838
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad87b
mov eax, dword [ebp - 0xc]
push eax
call fcn.00414820
ret
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x4ada9c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4adcb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x105
mov eax, dword [ebp - 0x18]
call fcn.0040317c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4adb19
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.0040760c
test eax, eax
je 0x4adb03
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.004050cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adb20
mov eax, dword [ebp - 8]
call fcn.00403198
ret

Function at 0x4aefd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.004038f0
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call fcn.004075dc
test eax, eax
je 0x4af00a
cmp byte [ebp - 0xa], 0x31
jne 0x4af008
mov bl, 1
jmp 0x4af00a
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b064c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00451b78
test al, al
je 0x4b0705
mov byte [ebp - 9], 0
xor ebx, ebx
call fcn.0040761c
mov dword [ebp - 8], eax
jmp 0x4b06e3
cmp word [esi + 0x642], 0
je 0x4b069d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x644]
call dword [esi + 0x640]
cmp byte [ebp - 9], 0
jne 0x4b06ba
cmp dword [ebp - 4], 0
jbe 0x4b06b6
call fcn.0040761c
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x4b06ba
xor ebx, ebx
jmp 0x4b06bc
mov bl, 1
test bl, bl
jne 0x4b0705
mov eax, dword [0x4d5070]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
jne 0x4b0705
mov eax, dword [0x4d5070]
mov eax, dword [eax]
call fcn.00468310
push 1
call fcn.00412f08
test esi, esi
je 0x4b0705
cmp byte [esi + 0x5ec], 0
jne 0x4b0705
mov edx, 0xfffffdf3
mov eax, esi
call fcn.00490518
cmp eax, 4
jne 0x4b067a
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b70ac
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x4b7104
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 1
mov al, byte [ebp - 0x14]
and al, 0xff
mov edx, dword [ebp - 0x1c]
xor al, byte [edx]
and eax, 0xff
mov eax, dword [eax*4 + 0x4d4694]
mov edx, dword [ebp - 0x14]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x1c]
inc dword [ebp - 0x18]
dec dword [ebp - 0x20]
jne 0x4b70d8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x405e4a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x429044]
jne 0x405e54
repz ret
jmp fcn.00409856

Function at 0x411824
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a3d6
and dword [ebp - 4], 0
cmp dword [0x42afa8], 0
mov ebx, eax
jne 0x4118d5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x411986
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x411986
push eax
call fcn.0040a364
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42afa8], eax
call esi
push eax
call fcn.0040a364
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42afac], eax
call esi
push eax
call fcn.0040a364
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42afb0], eax
call esi
push eax
call fcn.0040a364
pop ecx
mov dword [0x42afb8], eax
test eax, eax
je 0x4118d5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040a364
pop ecx
mov dword [0x42afb4], eax
mov eax, dword [0x42afb4]
cmp eax, ebx
je 0x41192d
cmp dword [0x42afb8], ebx
je 0x41192d
push eax
call fcn.0040a3df
push dword [0x42afb8]
mov esi, eax
call fcn.0040a3df
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41192d
test edi, edi
je 0x41192d
call esi
test eax, eax
je 0x411924
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x411924
test byte [ebp - 0xc], 1
jne 0x41192d
or dword [ebp + 0x10], 0x200000
jmp 0x411966
mov eax, dword [0x42afac]
cmp eax, ebx
je 0x411966
push eax
call fcn.0040a3df
pop ecx
test eax, eax
je 0x411966
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x411966
mov eax, dword [0x42afb0]
cmp eax, ebx
je 0x411966
push eax
call fcn.0040a3df
pop ecx
test eax, eax
je 0x411966
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42afa8]
call fcn.0040a3df
pop ecx
test eax, eax
je 0x411986
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x411988
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret