joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481ee8
Capabilities:
Delete file
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x481f33
lea eax, [esp + 0x105]
push eax
push 0
push 0x481f64
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
je 0x481f33
lea eax, [esp + 0x105]
call fcn.00407f68
cmp ebx, eax
setg al
jmp 0x481f35
xor eax, eax
mov ebx, eax
test bl, bl
je 0x481f4f
lea edx, [esp + 0x105]
mov eax, esi
call fcn.0041ecc8
push esi
call sub.kernel32.dll_DeleteFileA
movzx eax, bl
mov edx, dword [0x4e9708]
mov eax, dword [edx + eax*4]
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x482930
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x482939
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x482ab6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
inc dword [ebx + 0x18]
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x18]
mov eax, esi
call fcn.004827b0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.004085ac
lea eax, [ebx + 0x22]
mov edx, dword [ebp - 4]
call fcn.0041eda8
lea ecx, [ebp - 0x14]
mov edx, dword [ebx + 0x14]
mov eax, esi
call fcn.00482610
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.004085ac
lea eax, [ebx + 0x122]
mov edx, dword [ebp - 4]
call fcn.0041eda8
lea ecx, [ebp - 0x18]
mov edx, dword [ebx + 0x18]
mov eax, esi
call fcn.004826f4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.004085ac
lea eax, [ebx + 0x222]
mov edx, dword [ebp - 4]
call fcn.0041eda8
cmp word [esi + 0x4a], 0
je 0x4829f6
push edi
lea eax, [ebp - 9]
push eax
mov ecx, ebx
mov edx, esi
mov eax, dword [esi + 0x4c]
call dword [esi + 0x48]
cmp byte [ebp - 9], 0
jne 0x482a67
lea eax, [ebp - 8]
lea edx, [ebx + 0x222]
mov ecx, pe_nt_image_headers32
call fcn.00408988
mov eax, dword [ebp - 8]
call fcn.0041e208
lea eax, [ebp - 0x24]
lea edx, [ebx + 0x222]
mov ecx, pe_nt_image_headers32
call fcn.00408988
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
lea edx, [ebx + 0x122]
mov ecx, pe_nt_image_headers32
call fcn.00408988
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
lea ecx, [ebp - 8]
mov edx, 1
call fcn.004817d0
mov eax, dword [ebp - 8]
call fcn.004088f4
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
mov dword [esi + 0x3ac], eax
xor eax, eax
mov dword [esi + 0x3b0], eax
movzx ebx, byte [ebp - 9]
xor bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482abd
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00407ac0
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00407ac0
lea eax, [ebp - 8]
call fcn.00407a60
lea eax, [ebp - 4]
call fcn.00407a84
ret
Function at 0x484c34
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00407b44
xor eax, eax
push ebp
push 0x484e7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.00407e40
mov byte [ebp - 0xd], 0
test ebx, ebx
je 0x484e53
cmp dword [0x4e91fc], 0
jne 0x484c99
call fcn.00485ce0
cmp dword [0x4e91fc], 0
je 0x484e53
xor eax, eax
push ebp
push 0x484e49
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x484e38
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x484e9c
call fcn.00407e88
mov edx, dword [ebp - 4]
mov eax, 0x484eb4
call fcn.00408e6c
mov esi, eax
test esi, esi
jle 0x484cf8
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00408cc0
lea eax, [ebp - 4]
mov ecx, esi
mov edx, 1
call fcn.00408d08
cmp dword [ebp - 4], 0
jne 0x484d18
mov dl, 1
mov eax, ebx
call fcn.00463ab4
xor edx, edx
push edx
push eax
lea edx, [ebp - 4]
mov eax, 8
call fcn.0041daf0
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x4e91fc]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0047e04c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00407e40
mov eax, dword [0x4e91fc]
cmp byte [eax + 0x13], 0
je 0x484d85
push 0x484ec4
push dword [ebp - 4]
push 0x484ee8
push ebx
push 0x484ee8
mov eax, dword [ebp - 0xc]
push dword [eax]
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00408bd8
mov eax, dword [ebp - 0x1c]
call fcn.004088f4
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x484dd2
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.00407e40
mov eax, dword [0x4e91fc]
cmp byte [eax + 0x11], 0
je 0x484dbc
push dword [ebp - 4]
push 0x484efc
mov eax, dword [ebp - 0xc]
push dword [eax]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00408bd8
mov byte [ebp - 0xd], 0
call fcn.0040724c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x484e53
mov byte [ebp - 0xd], 1
mov eax, dword [0x4e91fc]
cmp byte [eax + 0x11], 0
je 0x484dfb
push dword [ebp - 4]
push 0x484f0c
mov eax, dword [ebp - 0xc]
push dword [eax]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00408bd8
lea eax, [ebp - 8]
call fcn.00407a60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484e3f
mov eax, dword [0x4e91fc]
cmp dword [eax + 0x18], 0
je 0x484e37
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ebx, dword [0x4e91fc]
call dword [ebx + 0x18]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.00407e40
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484e82
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00407ac0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407ac0
ret
Function at 0x485b28
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x485c28
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x485c44
call fcn.00407e88
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
cmp eax, 3
sete bl
test bl, bl
je 0x485b8e
push 0xa
lea eax, [ebp - 0xe]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
cmp eax, 3
je 0x485b92
xor eax, eax
jmp 0x485b94
mov al, 1
mov ebx, eax
test bl, bl
je 0x485baf
lea eax, [ebp - 4]
lea edx, [ebp - 0x18]
call fcn.0040894c
mov eax, esi
lea edx, [ebp - 0xe]
call fcn.0040894c
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0041ccc8
mov eax, dword [ebp - 0x1c]
mov edx, 0x485c58
call fcn.00408c88
jne 0x485bf6
lea edx, [ebp - 0x20]
mov eax, dword [esi]
call fcn.0041ccc8
mov eax, dword [ebp - 0x20]
mov edx, 0x485c6c
call fcn.00408c88
jne 0x485bf6
mov eax, edi
mov edx, dword [0x4e9200]
mov ecx, 0
call fcn.004085ac
jmp 0x485c05
mov eax, edi
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.004085ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485c2f
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407ac0
lea eax, [ebp - 4]
call fcn.00407a60
ret
Function at 0x489bdc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x489d1f
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x489c33
push 0x20a
lea eax, [ebp - 0x20e]
push eax
mov eax, dword [0x4ecc50]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20e]
mov eax, dword [ebp - 4]
call fcn.00407be8
jmp 0x489d06
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
mov eax, ebx
call fcn.00489b78
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00489ba0
mov ebx, eax
test esi, esi
je 0x489c5b
dec esi
test esi, esi
jl 0x489c5b
cmp edi, ebx
jne 0x489c3a
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x214]
mov edx, edi
call fcn.0040894c
mov eax, dword [ebp - 0x214]
mov ecx, ebx
sub ecx, edi
sar ecx, 1
jns 0x489c7d
adc ecx, 0
mov edx, 1
call fcn.00408cc0
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x489ca3
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jl 0x489d06
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp word [eax], 0x22
jne 0x489d06
mov eax, edx
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x489cca
sub eax, 4
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp word [ecx + eax*2 - 2], 0x22
jne 0x489d06
mov eax, edx
mov dword [ebp - 0x218], eax
mov ebx, dword [ebp - 0x218]
test ebx, ebx
je 0x489cee
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
push eax
mov ecx, ebx
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00408cc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489d26
lea eax, [ebp - 0x214]
call fcn.00407a60
ret

Function at 0x490d00
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffee4
mov dword [esp], 0x11c
push esp
call sub.kernel32.dll_GetVersionExW
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x490d3d
mov al, 4
mov edx, dword [esp + 4]
cmp edx, 6
jne 0x490d2b
mov al, 7
jmp 0x490d76
cmp edx, 5
jb 0x490d76
mov al, 5
cmp dword [esp + 8], 1
jb 0x490d76
mov al, 6
jmp 0x490d76
cmp eax, 1
jne 0x490d74
mov al, 1
cmp dword [esp + 4], 4
ja 0x490d59
cmp dword [esp + 4], 4
jne 0x490d5b
cmp dword [esp + 8], 0xa
jb 0x490d5b
mov al, 2
cmp dword [esp + 4], 4
ja 0x490d70
cmp dword [esp + 4], 4
jne 0x490d76
cmp dword [esp + 8], 0x5a
jb 0x490d76
mov al, 3
jmp 0x490d76
xor eax, eax
add esp, 0x11c
ret
Function at 0x499c94
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x499d2c
call sub.user32.dll_RegisterWindowMessageW
mov edi, eax
mov dl, 1
mov eax, dword [0x43644c]
call fcn.00405e44
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x499d1b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
push 0x499b30
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x499d05
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.004414dc
mov edx, dword [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push edx
push edi
push eax
call sub.user32.dll_PostMessageW
inc esi
dec ebx
jne 0x499ce8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499d22
mov eax, dword [ebp - 0xc]
call fcn.00405e74
ret
Function at 0x4b35ac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b37a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x4c]
cmp dword [eax + 8], 0
jne 0x4b35e6
mov eax, dword [ebx + 0xc]
mov dword [eax + 0x5db], 7
jmp 0x4b3789
mov eax, dword [ebx + 0x4c]
call fcn.004b5138
mov esi, eax
mov dword [ebx + 0x50], esi
mov edx, esi
mov eax, dword [ebx + 0x4c]
call fcn.004b510c
xor edx, edx
push ebp
push 0x4b3782
push dword fs:[edx]
mov dword fs:[edx], esp
movzx eax, byte [0x4b37b4]
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
mov edx, 0x4b37c4
mov eax, 0x4b380c
call fcn.0047cd3c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x50]
mov ecx, dword [edx + 8]
mov edx, 0x4b3830
call fcn.00424ccc
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0xc]
call fcn.0048d438
lea ecx, [ebp - 0x10]
mov edx, 0x4b3850
mov eax, 0x4b386c
call fcn.0047cd3c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x14]
call fcn.0048d438
mov eax, dword [ebx + 0x14]
call fcn.0048dc6c
lea ecx, [ebp - 0x14]
mov edx, 0x4b3898
mov eax, 0x4b38b4
call fcn.0047cd3c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x18]
call fcn.0048d438
mov eax, dword [ebx + 0x18]
mov dl, 1
call fcn.0048c544
mov eax, dword [ebx + 0x18]
call fcn.0048dc6c
mov eax, dword [ebx + 0x1c]
call fcn.0048dcb4
mov eax, dword [ebx + 0x20]
call fcn.0048dcb4
mov eax, dword [ebx + 0x14]
call fcn.0048dc6c
lea ecx, [ebp - 0x18]
mov edx, 0x4b38e0
mov eax, 0x4b3920
call fcn.0047cd3c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x24]
call fcn.0048d438
mov eax, dword [ebx + 0x24]
call fcn.0048dc6c
mov eax, dword [ebx + 0x50]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x28]
call fcn.0048d438
mov eax, dword [ebx + 0x28]
mov edx, dword [eax + 0x2e]
call fcn.0048e0f8
mov eax, dword [ebx + 0x28]
call fcn.0048dc6c
lea ecx, [ebp - 4]
mov edx, 0x4b3950
mov eax, 0x4b39e0
call fcn.0047cd3c
movzx eax, byte [0x4b39fc]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x50]
mov ecx, dword [eax + 8]
mov edx, 0x4b3830
mov eax, dword [ebp - 4]
call fcn.00424ccc
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00407e88
mov eax, dword [ebx + 0x2c]
mov edx, dword [ebp - 4]
call fcn.0048d438
mov eax, dword [ebx + 0x2c]
call fcn.0048dc6c
lea ecx, [ebp - 0x20]
mov edx, 0x4b3a0c
mov eax, 0x4b3b34
call fcn.0047cd3c
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx]
mov eax, dword [ebx + 0x30]
call fcn.0048dc6c
mov eax, dword [ebx + 0xc]
call fcn.0048dc98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3789
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b37ab
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00407ac0
ret
Function at 0x4cf61c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov byte [ebx], 0
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
je 0x4cf646
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x4cf704
call fcn.004c5cb8
mov dword [ebp - 8], eax
jmp 0x4cf659
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x4cf774
call fcn.004c5cb8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4cf6e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004c6bd0
test al, al
je 0x4cf699
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
jne 0x4cf699
mov eax, dword [ebp - 8]
call fcn.00405e74
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x4cf7e4
call fcn.004c5cb8
mov dword [ebp - 8], eax
jmp 0x4cf69c
mov byte [ebx], 1
mov eax, dword [ebp - 8]
call fcn.004c6bd0
test al, al
je 0x4cf6c3
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
je 0x4cf6ba
mov dword [ebp - 4], 0xffffffff
jmp 0x4cf6d0
mov dword [ebp - 4], 1
jmp 0x4cf6d0
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004c7080
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf6ed
mov eax, dword [ebp - 8]
call fcn.00405e74
ret

Function at 0x4cf824
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4cf8dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0x4cf8f8
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0041d914
push dword [ebp - 0x10]
push 0x4cf948
push 0x4cf978
push 0x4cf990
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00408bd8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004c5cb8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4cf8bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004c6bd0
test al, al
jne 0x4cf8a5
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf8c2
mov eax, dword [ebp - 8]
call fcn.00405e74
ret
Function at 0x4d140c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4d15d8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4d15ab
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov ecx, 0x4d15f4
mov edx, 0x4d160c
mov eax, 0x80000001
call fcn.00462990
mov eax, dword [ebp - 4]
mov edx, 0x4d1648
call fcn.00408c88
sete bl
lea eax, [ebp - 4]
push eax
mov ecx, 0x4d1658
mov edx, 0x4d160c
mov eax, 0x80000001
call fcn.00462990
mov eax, dword [ebp - 4]
mov edx, 0x4d1648
call fcn.00408c88
sete byte [ebp - 9]
lea eax, [ebp - 8]
mov edx, 0x4d1670
call fcn.00407e88
mov eax, ebx
or al, byte [ebp - 9]
je 0x4d1567
xor eax, eax
call fcn.0047b8e4
push 0x4d16a8
mov eax, dword [0x4e9b04]
push dword [eax]
push 0x4d16b8
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00408bd8
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
mov edx, 0x4d16d8
mov eax, 0x80000001
call fcn.004628c4
xor eax, eax
push ebp
push 0x4d1560
push dword fs:[eax]
mov dword fs:[eax], esp
or edx, 0xffffffff
mov eax, 0x4d1744
call fcn.0045fb98
mov esi, eax
test esi, esi
jle 0x4d1509
mov eax, 0x4d1744
call fcn.004a2af4
test al, al
je 0x4d1509
xor esi, esi
test esi, esi
jg 0x4d1552
movzx edx, byte [ebp - 9]
mov eax, ebx
call fcn.004d1950
mov ecx, dword [ebp - 8]
mov edx, 0x4d16d8
mov eax, 0x80000001
call fcn.00462d70
mov ecx, 0x4d15f4
mov edx, 0x4d160c
mov eax, 0x80000001
call fcn.00462d70
mov ecx, 0x4d1658
mov edx, 0x4d160c
mov eax, 0x80000001
call fcn.00462d70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d15a1
ret
mov ecx, dword [ebp - 8]
mov edx, 0x4d16d8
mov eax, 0x80000001
call fcn.00462d70
mov ecx, 0x4d15f4
mov edx, 0x4d160c
mov eax, 0x80000001
call fcn.00462d70
mov ecx, 0x4d1658
mov edx, 0x4d160c
mov eax, 0x80000001
call fcn.00462d70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d15b5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d15df
lea eax, [ebp - 0x10]
call fcn.00407a60
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407ac0
ret
Function at 0x4d4900
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x4d4915
add esp, 0xfffffff0
call fcn.004063e4
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d4b08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], cl
mov dl, 1
mov eax, dword [0x49b158]
call fcn.0049b674
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dl, 1
mov eax, dword [0x4d3fc0]
call fcn.004d41e0
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x38], ebx
mov eax, ebx
call fcn.004d42cc
mov eax, dword [ebp - 4]
fstp qword [eax + 0x40]
wait
push 0
mov ecx, 0x4d4b40
mov dl, 1
mov eax, dword [0x4a3e5c]
call fcn.004a4100
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
push 0x4d4b5c
call sub.user32.dll_RegisterWindowMessageW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], ebx
mov eax, ebx
call fcn.00460268
push 0x4d4b7c
call sub.user32.dll_RegisterWindowMessageW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], ebx
mov eax, ebx
call fcn.00460268
mov eax, 0x4d4bb0
call fcn.0048afdc
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 8], ebx
mov eax, ebx
xor edx, edx
call fcn.0048d2e4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, 0x4d4bd8
call fcn.0048df00
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0048c590
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov dword [ebx + 0x46c], eax
mov dword [ebx + 0x468], 0x4d5b10
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
push 0x4d58f8
push 0
push 1
push 0
lea ecx, [ebp - 8]
mov eax, ebx
mov edx, 1
call fcn.0048a08c
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
push 0
push 0
push 0
push 0
mov edx, 0x4d4c08
mov eax, esi
movzx ecx, word [0x4d4c08]
call fcn.0048a7c8
push 0
push 0
push 0
push 0
mov edx, 0x4d4c08
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
movzx ecx, word [0x4d4c08]
call fcn.0048a7c8
push 0
push 0
push 0
push 0
mov edx, 0x4d4c08
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
movzx ecx, word [0x4d4c0c]
call fcn.0048a7c8
push 0
push 0
push 0
push 0
mov edx, 0x4d4c08
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
movzx ecx, word [0x4d4c08]
call fcn.0048a7c8
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d], 0
push 0x4d4c10
mov eax, dword [0x4ecc50]
push eax
call sub.user32.dll_LoadIconW
push eax
push 0x414
push 0x4d4bb0
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x2d]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0048c590
mov ecx, eax
mov dl, 1
mov eax, dword [0x49a3f8]
call fcn.0049a4a0
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x20], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x34], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d4b12
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x4d4b2a
call fcn.0040643c
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4011e2
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x414044]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push esi
push 0x118
xor esi, esi
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.0040ab80
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x401266
cmp dword [ebp - 0x7c], 5
mov eax, dword [ebp - 0x78]
jne 0x401250
test eax, eax
jne 0x40123f
cmp word [ebp + 0x94], 4
jb 0x401266
inc esi
cmp eax, 2
jne 0x401246
push eax
pop esi
jae 0x40124d
cmp eax, 1
jne 0x401266
push 3
pop esi
cmp dword [ebp - 0x7c], 6
jne 0x401266
test eax, eax
jne 0x40125e
push 4
jmp 0x401265
cmp eax, 1
jne 0x401266
push 5
pop esi
mov ecx, dword [ebp + 0x9c]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040430c
add ebp, 0xa0
leave
ret