joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482a44
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x482aaa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x589190]
cmp byte [eax], 0
je 0x482a78
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 8], eax
jmp 0x482a94
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404cf4
mov eax, dword [ebp - 0xc]
call fcn.00404fac
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482ab1
lea eax, [ebp - 0xc]
call fcn.00404acc
ret

Function at 0x482ab8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x482b29
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x589190]
cmp byte [eax], 0
je 0x482af3
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateDirectoryW
mov dword [ebp - 0xc], eax
jmp 0x482b13
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404cf4
mov eax, dword [ebp - 0x10]
call fcn.00404fac
push eax
call sub.kernel32.dll_CreateDirectoryA
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482b30
lea eax, [ebp - 0x10]
call fcn.00404acc
ret

Function at 0x482b38
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x482bcd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x589190]
cmp byte [eax], 0
je 0x482b7e
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CopyFileW
mov dword [ebp - 0x10], eax
jmp 0x482bb2
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00404cf4
mov eax, dword [ebp - 0x14]
call fcn.00404fac
push eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00404cf4
mov eax, dword [ebp - 0x18]
call fcn.00404fac
push eax
call sub.kernel32.dll_CopyFileA
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482bd4
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404af0
ret
Function at 0x482bdc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x482c42
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x589190]
cmp byte [eax], 0
je 0x482c10
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 8], eax
jmp 0x482c2c
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404cf4
mov eax, dword [ebp - 0xc]
call fcn.00404fac
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482c49
lea eax, [ebp - 0xc]
call fcn.00404acc
ret

Function at 0x482de4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x482e9e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x589190]
cmp byte [eax], 0
je 0x482e1f
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov dword [ebp - 0xc], eax
jmp 0x482e88
lea eax, [ebp - 0x10]
mov edx, 0x104
call fcn.00405234
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x482e43
mov eax, dword [ebp - 0x14]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jns 0x482e4f
call fcn.00403a58
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404fac
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00405234
mov al, byte [0x482eac]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004825b4
test eax, eax
jns 0x482e85
call fcn.00403a58
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482ea5
lea eax, [ebp - 0x10]
call fcn.00404acc
ret
Function at 0x482eb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x482f6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x589190]
cmp byte [eax], 0
je 0x482eeb
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov dword [ebp - 0xc], eax
jmp 0x482f54
lea eax, [ebp - 0x10]
mov edx, 0x104
call fcn.00405234
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x482f0f
mov eax, dword [ebp - 0x14]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jns 0x482f1b
call fcn.00403a58
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404fac
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00405234
mov al, byte [0x482f78]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004825b4
test eax, eax
jns 0x482f51
call fcn.00403a58
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482f71
lea eax, [ebp - 0x10]
call fcn.00404acc
ret

Function at 0x482f7c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x483036
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x589190]
cmp byte [eax], 0
je 0x482fb7
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0xc], eax
jmp 0x483020
lea eax, [ebp - 0x10]
mov edx, 0x104
call fcn.00405234
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x482fdb
mov eax, dword [ebp - 0x14]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
call fcn.00404fac
push eax
mov eax, dword [ebp - 0x14]
test eax, eax
jns 0x482ff0
call fcn.00403a58
push eax
call sub.kernel32.dll_GetCurrentDirectoryA
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00405234
mov al, byte [0x483044]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004825b4
test eax, eax
jns 0x48301d
call fcn.00403a58
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48303d
lea eax, [ebp - 0x10]
call fcn.00404acc
ret
Function at 0x483048
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4830ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x589190]
cmp byte [eax], 0
je 0x48307c
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov dword [ebp - 8], eax
jmp 0x483098
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404cf4
mov eax, dword [ebp - 0xc]
call fcn.00404fac
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4830b5
lea eax, [ebp - 0xc]
call fcn.00404acc
ret

Function at 0x4833dc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x483447
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCommandLineW
lea edx, [ebp - 0xc]
call fcn.00483214
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00483214
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00405614
je 0x483431
add dword [ebp - 4], 1
jno 0x48342f
call fcn.00403a60
jmp 0x48340a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48344e
lea eax, [ebp - 0xc]
call fcn.004052f4
ret

Function at 0x483458
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x483476
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.00482028
jmp 0x4834ad
call sub.kernel32.dll_GetCommandLineW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00483214
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x4834ad
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00405614
je 0x4834ad
sub dword [ebp - 4], 1
jno 0x4834ab
call fcn.00403a60
jmp 0x48347e
mov esp, ebp
pop ebp
ret

Function at 0x484234
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4842ae
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
lea eax, [ebp - 0xf]
push eax
push 0x1004
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
call sub.kernel32.dll_GetACP_1
test eax, eax
jns 0x484272
call fcn.00403a58
push eax
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xf]
mov ecx, 7
call fcn.00404d3c
mov eax, dword [ebp - 0x14]
pop edx
call fcn.0040a594
test eax, eax
jns 0x484295
call fcn.00403a58
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4842b5
lea eax, [ebp - 0x14]
call fcn.00404acc
ret
Function at 0x48438c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x18], 0
je 0x4843eb
lea eax, [ebp - 4]
push eax
push 0x40
push 6
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4843bf
call fcn.0040fe34
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, 6
call fcn.00402fc8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 6
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4843eb
call fcn.0040fe34
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a52e0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a53ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 0xd
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a5367
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x4a533a
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00405460
jmp 0x4a5342
mov eax, dword [ebp - 8]
call fcn.004052f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a536e
cmp dword [ebp - 0xc], 0
je 0x4a535e
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x4a82e0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
mov dword [ebp - 8], edx
mov word [ebp - 2], ax
mov eax, dword [ebp - 8]
call fcn.004052f4
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
jns 0x4a8311
call fcn.00403a58
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4a8342
push 0x200
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x20c]
mov ecx, pe_nt_image_headers32
call fcn.004054b4
mov esp, ebp
pop ebp
ret

Function at 0x4a8348
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov word [ebp - 2], ax
push 2
movzx eax, word [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
mov word [ebp - 4], ax
mov ax, word [ebp - 2]
add eax, 0xffffffd0
sub ax, 0xa
jae 0x4a83af
movzx eax, word [ebp - 2]
sub eax, 0x30
jno 0x4a837d
call fcn.00403a60
add eax, 0x30
jno 0x4a8387
call fcn.00403a60
mov word [ebp - 6], ax
mov ax, word [ebp - 4]
cmp ax, word [ebp - 6]
je 0x4a83af
mov ax, word [ebp - 6]
push eax
call sub.user32.dll_VkKeyScanW
mov dx, word [ebp - 2]
cmp al, dl
jne 0x4a83af
mov ax, word [ebp - 6]
mov word [ebp - 4], ax
mov ax, word [ebp - 4]
pop ecx
pop ecx
pop ebp
ret
Function at 0x4a920c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a93cf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 8]
mov dword [edx + 0xbc], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x64], 0
jne 0x4a9251
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4a927e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x64]
cmp dword [eax + 0x6c], 0
je 0x4a9270
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 0x6c]
call fcn.0044b474
mov dword [ebp - 4], eax
jmp 0x4a927e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x64]
call fcn.0044b474
mov dword [ebp - 4], eax
mov eax, dword [0x589190]
cmp byte [eax], 0
je 0x4a93b4
mov eax, dword [ebp - 8]
cmp dword [eax + 0x64], 0
je 0x4a93b4
cmp dword [ebp - 0xc], 0
je 0x4a93b4
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1c]
and ax, word [0x4a93dc]
mov dx, word [0x4a93e0]
cmp dx, ax
jne 0x4a93b4
mov eax, dword [ebp - 8]
cmp byte [eax + 0x3e], 0
je 0x4a93b4
push ebp
call fcn.004a9078
pop ecx
test al, al
je 0x4a93b4
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004a8e04
mov eax, dword [ebp - 8]
call fcn.0044cfc0
test eax, eax
jne 0x4a9352
mov eax, dword [ebp - 8]
cmp word [eax + 0x60], 0
je 0x4a9352
mov eax, dword [ebp - 8]
cmp dword [eax + 0x64], 0
je 0x4a932b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x64]
cmp dword [eax + 0x64], 0
jne 0x4a932b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 4]
mov edx, dword [0x449dec]
call fcn.00403d1c
test al, al
jne 0x4a9352
push dword [ebp - 0x10]
push 0x4a93e8
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x60]
call fcn.004a83b8
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004055cc
push ebp
lea eax, [ebp - 0x18]
call fcn.004a90dc
pop ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00405614
je 0x4a93b4
push ebp
mov eax, dword [ebp - 0x10]
call fcn.004a9170
pop ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x64]
mov edx, dword [ebp - 0xc]
cmp eax, dword [edx + 0x34]
je 0x4a938d
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x64]
cmp dword [eax + 0x6c], 0
je 0x4a93b4
mov eax, dword [ebp - 0xc]
mov edx, dword [0x449dec]
call fcn.00403d1c
test al, al
je 0x4a93b4
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x4a93b4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_DrawMenuBar
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a93d6
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040530c
ret
Function at 0x4aa8b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4aaa48
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x589190]
cmp byte [eax], 0
je 0x4aa90b
mov eax, dword [ebp - 4]
mov edx, dword [0x451dd8]
call fcn.00403d1c
test al, al
je 0x4aa926
mov eax, dword [ebp - 4]
call fcn.0045e490
test al, al
je 0x4aa926
mov eax, dword [ebp - 4]
call fcn.0045e0f0
push eax
call sub.user32.dll_IsWindowUnicode
test eax, eax
jne 0x4aa926
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0045657c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004054d0
jmp 0x4aaa1d
mov eax, dword [ebp - 4]
mov edx, dword [0x451dd8]
call fcn.00403d1c
test al, al
jne 0x4aa987
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004aa788
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4aa966
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0045657c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004054d0
jmp 0x4aaa1d
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0045657c
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, 0x38
call fcn.00487128
jmp 0x4aaa1d
mov eax, dword [ebp - 4]
call fcn.0045e490
test al, al
jne 0x4aa9b9
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0045657c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.004054d0
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004aa800
jmp 0x4aaa1d
mov eax, dword [ebp - 4]
call fcn.0045e0f0
push eax
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
add edx, 1
jno 0x4aa9d3
call fcn.00403a60
mov eax, dword [ebp - 8]
call fcn.00405860
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004054f0
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004054e0
push eax
mov eax, dword [ebp - 4]
call fcn.0045e0f0
push eax
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004054f0
mov edx, eax
sub edx, 1
jno 0x4aaa15
call fcn.00403a60
mov eax, dword [ebp - 8]
call fcn.00405860
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aaa4f
lea eax, [ebp - 0x20]
call fcn.00404acc
lea eax, [ebp - 0x1c]
call fcn.004052f4
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404af0
ret

Function at 0x4b2c3c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x208]
xor ecx, ecx
mov edx, 0x200
call fcn.0040346c
push pe_nt_image_headers32
lea eax, [ebp - 0x208]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x208]
mov ecx, pe_nt_image_headers32
call fcn.004054b4
mov esp, ebp
pop ebp
ret
Function at 0x4b3264
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7fc
mov dword [ebp - 4], eax
lea eax, [ebp - 0x804]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathW
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x804]
mov ecx, 0x400
call fcn.004054b4
mov esp, ebp
pop ebp
ret

Function at 0x4b3298
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f8
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
push 0
push 0x1a
lea eax, [ebp - 0x808]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x808]
mov ecx, 0x400
call fcn.004054b4
cmp byte [ebp - 1], 0
je 0x4b32e2
mov eax, dword [ebp - 8]
mov edx, 0x4b32ec
call fcn.004054fc
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4b4de4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
movzx eax, byte ds:[eax + 2]
ret

Function at 0x4b4df4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
lea eax, ds:[eax + 2]
mov bl, byte [eax]
mov byte [ebp - 1], bl
mov byte [eax], 0x90
call sub.kernel32.dll_IsDebuggerPresent
push eax
mov eax, dword fs:[0x30]
lea eax, ds:[eax + 2]
mov bl, byte [ebp - 1]
mov byte [eax], bl
pop eax
cmp eax, 0x90
mov eax, 0
je 0x4b4e33
mov eax, 1
pop ecx
pop ebp
ret

Function at 0x4b4e40
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, dword fs:[0x30]
add eax, 0x68
mov eax, dword ds:[eax]
cmp eax, 0x70
mov eax, 0
jne 0x4b4e5c
mov eax, 1
ret

Function at 0x4b7164
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
movzx eax, byte ds:[eax + 2]
ret

Function at 0x4b7174
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
lea eax, ds:[eax + 2]
mov bl, byte [eax]
mov byte [ebp - 1], bl
mov byte [eax], 0x90
call sub.kernel32.dll_IsDebuggerPresent
push eax
mov eax, dword fs:[0x30]
lea eax, ds:[eax + 2]
mov bl, byte [ebp - 1]
mov byte [eax], bl
pop eax
cmp eax, 0x90
mov eax, 0
je 0x4b71b3
mov eax, 1
pop ecx
pop ebp
ret

Function at 0x4b71c0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, dword fs:[0x30]
add eax, 0x68
mov eax, dword ds:[eax]
cmp eax, 0x70
mov eax, 0
jne 0x4b71dc
mov eax, 1
ret
Function at 0x4bae4c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4baf7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x589190]
cmp byte [eax], 0
jne 0x4bae8b
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp - 4]
call fcn.0042ab68
jmp 0x4baf5f
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x48]
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.0042ab00
test al, al
je 0x4baf5f
mov eax, dword [ebp - 0x30]
add eax, 1
jno 0x4baeb3
call fcn.00403a60
imul edx, eax, 2
jno 0x4baebd
call fcn.00403a60
lea eax, [ebp - 0x14]
call fcn.00405860
mov eax, dword [ebp - 0x34]
sub eax, 1
jno 0x4baed2
call fcn.00403a60
test eax, eax
jl 0x4baf5f
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x30]
add eax, 1
jno 0x4baef2
call fcn.00403a60
imul eax, eax, 2
jno 0x4baefc
call fcn.00403a60
test eax, eax
jns 0x4baf05
call fcn.00403a58
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004054e0
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jns 0x4baf29
call fcn.00403a58
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x4baf57
mov eax, dword [ebp - 0x14]
call fcn.004054e0
mov edx, eax
lea eax, [ebp - 0x38]
call fcn.00405460
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x4baee5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4baf84
lea eax, [ebp - 0x38]
call fcn.004052f4
lea eax, [ebp - 0x14]
call fcn.004052f4
ret