joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4afb00
Capabilities:
Encrypt or decrypt via wincrypt
Set registry value

Disassembly:
sub esp, 0x118
push ebx
xor ebx, ebx
push ebx
push ebx
push 0x104
lea eax, [esp + 0x24]
push eax
push 0xffffffffffffffff
push ecx
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [esp + 0x18]
mov byte [esp + 0x11b], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4afb32
sub eax, edx
lea edx, [esp + 8]
push edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x124]
mov ecx, dword [eax + 4]
push ebx
push ebx
push ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
jne 0x4afb6d
xor al, al
pop ebx
add esp, 0x118
ret 0xc
mov eax, dword [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push eax
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
push 1
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
push ebx
push eax
call edi
test eax, eax
jne 0x4afbaa
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
pop edi
xor al, al
pop ebx
add esp, 0x118
ret 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
cmp eax, ecx
ja 0x4afbbc
mov eax, ecx
mov dword [esp + 0x10], eax
push esi
push eax
call fcn.0069c0de
mov edx, dword [esp + 0x10]
mov esi, eax
push edx
lea eax, [esp + 0x28]
push eax
push esi
call fcn.006a4bd0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
add esp, 0x10
push ecx
lea edx, [esp + 0x10]
push edx
push esi
push ebx
push 1
push ebx
push eax
call edi
test eax, eax
je 0x4afc42
mov eax, dword [esp + 0x12c]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push 2
push ebx
push ebx
push ebx
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4afc42
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x130]
mov eax, dword [esp + 0x18]
push ecx
push esi
push 3
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
push esi
call fcn.0069c8fa
mov edx, dword [esp + 0x14]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
pop esi
pop edi
mov al, bl
pop ebx
add esp, 0x118
ret 0xc
Function at 0x4afc70
Capabilities:
Encrypt or decrypt via wincrypt
Set registry value

Disassembly:
sub esp, 0x1c
mov eax, dword [eax]
push ebx
push ebp
push esi
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov edx, eax
jne 0x4afc92
mov edx, 0x6bc0cc
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4afc97
sub eax, esi
sar eax, 1
push eax
push edx
lea eax, [esp + 0x28]
call fcn.004bb8f0
mov ebp, dword [esp + 0x20]
cmp ebp, edi
mov ebx, ebp
jne 0x4afcc0
mov ebx, 0x6bc0ce
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x14]
push edx
push edi
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 4]
push edi
push ecx
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x4afd14
mov eax, dword [esp + 0x10]
push eax
lea edx, [esp + 0x1c]
push edx
push edi
push edi
push 1
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push eax
call edi
test eax, eax
jne 0x4afd29
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push ebp
call fcn.0069c8fa
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1c
ret 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
ja 0x4afd3b
mov eax, ecx
mov dword [esp + 0x18], eax
push eax
call fcn.0069c0de
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
push ebx
push esi
call fcn.006a4bd0
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
add esp, 0x10
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
push 0
push 1
push 0
push edx
xor bl, bl
call edi
test eax, eax
je 0x4afdbf
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x34]
push ecx
push 0
push 2
push 0
push 0
push 0
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4afdbf
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
push eax
push esi
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
push esi
call fcn.0069c8fa
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push ebp
call fcn.0069c8fa
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x1c
ret 0xc
Function at 0x4afdf0
Capabilities:
Encrypt or decrypt via wincrypt
Query or enumerate registry value

Disassembly:
sub esp, 0x114
push ebx
lea eax, [esp + 8]
push eax
push 1
xor ebx, ebx
push ebx
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4afe3b
mov eax, dword [esp + 0x11c]
mov ecx, dword [eax + 4]
lea edx, [esp + 0xc]
push edx
push ebx
push ebx
push ecx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
jne 0x4afe47
mov edx, dword [esp + 0x124]
mov word [edx], bx
xor al, al
pop ebx
add esp, 0x114
ret 0xc
mov edx, dword [esp + 0x120]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
push ebx
lea ecx, [esp + 0x20]
push ecx
push ebx
push edx
push eax
xor esi, esi
mov dword [esp + 0x30], 3
mov dword [esp + 0x24], ebx
call edi
test eax, eax
jne 0x4aff18
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0069c0de
mov ecx, dword [esp + 0x12c]
add esp, 4
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x14]
mov esi, eax
push esi
lea eax, [esp + 0x20]
push eax
push ebx
push ecx
push edx
call edi
test eax, eax
jne 0x4aff18
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
push esi
push ebx
push 1
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x4aff18
mov edi, dword [esp + 0xc]
cmp edi, 0x104
jb 0x4afedc
mov edi, 0x103
mov dword [esp + 0xc], edi
push edi
lea edx, [esp + 0x20]
push esi
push edx
call fcn.006a4bd0
add esp, 0xc
push 0x104
mov byte [esp + edi + 0x20], bl
mov edi, dword [esp + 0x130]
push edi
push 0xffffffffffffffff
lea eax, [esp + 0x28]
push eax
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [edi + 0x206], bx
mov bl, 1
push esi
call fcn.0069c8fa
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x114
ret 0xc
Function at 0x4aff50
Capabilities:
Encrypt or decrypt via wincrypt
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push 1
xor ebx, ebx
push ebx
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4aff7d
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 4]
lea edx, [esp + 8]
push edx
push ebx
push ebx
push ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x4aff73
mov ecx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x20]
push edx
push ebx
lea eax, [esp + 0x24]
push eax
push ebx
push ebp
push ecx
xor esi, esi
mov dword [esp + 0x34], 3
mov dword [esp + 0x38], ebx
call edi
test eax, eax
jne 0x4b0021
mov edx, dword [esp + 0x20]
add edx, 1
push edx
call fcn.0069c0de
mov edx, dword [esp + 0x18]
add esp, 4
mov esi, eax
lea eax, [esp + 0x20]
push eax
push esi
lea ecx, [esp + 0x24]
push ecx
push 0
push ebp
push edx
call edi
test eax, eax
jne 0x4b0021
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push esi
push 0
push 1
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x4b0021
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
push esi
mov byte [edx + esi], bl
call fcn.004bb860
mov bl, 1
push esi
call fcn.0069c8fa
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret 0xc

Function at 0x4b0280
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x1c
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 0xc]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 4]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x1c
ret

Function at 0x4b0420
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x208
push ebx
push esi
push edi
push str.UsageStats
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x14]
call fcn.004af0d0
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
add esp, 8
cmp word [esp + 0xc], 0
je 0x4b045c
mov eax, edi
push eax
push SysReAllocStringLen
call ebx
push str.UsageStatsChoice
push str.SoftwareNCH_SoftwareDebut_s
lea edi, [esp + 0x14]
call fcn.004af0d0
add esp, 8
cmp word [esp + 0xc], 0
je 0x4b0484
mov ecx, edi
push ecx
push SysReAllocStringLen
call ebx
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x4b0a80
Capabilities:
Check os version

Disassembly:
sub esp, 0xa50
push ebx
push ebp
push esi
push edi
push str.Software
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x40]
call fcn.004af0d0
add esp, 8
lea eax, [esp + 0x448]
push eax
push 0x6bc0cc
push 0x6ec280
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.004af5a0
test al, al
jne 0x4b0aea
lea ecx, [esp + 0x2c]
push ecx
call fcn.004bf410
mov ebp, dword [esp + 0x2c]
lea edi, [esp + 0x13]
lea esi, [esp + 0x12]
mov dword [esp + 0x14], 0x6bc0cc
call fcn.0049c1f0
test al, al
je 0x4b0b21
cmp byte [esp + 0x12], bl
je 0x4b0b19
cmp byte [esp + 0x13], bl
je 0x4b0b21
mov dword [esp + 0x14], str.antivirusexpired
jmp 0x4b0b21
mov dword [esp + 0x14], str.antivirusnone
push str.Software
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x40]
call fcn.004af0d0
add esp, 8
lea edx, [esp + 0x858]
push edx
push 0x6ec288
push str.InstalledBy
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
lea eax, [esp + 0x240]
push eax
mov word [esp + 0x244], bx
call fcn.004c2310
push ebx
push str.HelpOpens
mov eax, str.Software
call fcn.004811b0
mov dword [esp + 0x28], eax
call fcn.004af2c0
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x3c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
push edx
push eax
push str._d._d
lea edi, [esp + 0x65c]
call fcn.004af0d0
add esp, 0xc
cmp ebp, ebx
je 0x4b0bc7
cmp word [ebp], bx
jne 0x4b0bd2
mov esi, 0x6bc0cc
mov dword [esp + 0x1c], esi
jmp 0x4b0bdf
mov dword [esp + 0x1c], str.svar
mov esi, 0x6bc0cc
cmp word [esp + 0x448], bx
mov dword [esp + 0x18], 0x6ec2b8
jne 0x4b0bf5
mov dword [esp + 0x18], esi
call fcn.004af4b0
test al, al
mov dword [esp + 0x20], 0x6ec2c4
jne 0x4b0c0a
mov dword [esp + 0x20], esi
call fcn.004af5a0
test al, al
mov edi, 0x6ec2d0
jne 0x4b0c1a
mov edi, esi
cmp ebp, ebx
je 0x4b0c20
mov esi, ebp
cmp dword [0x731ffc], 0xa
jne 0x4b0c2e
call fcn.004b23e0
cmp dword [0x731ffc], 9
setb bl
test bl, bl
jne 0x4b0c47
call fcn.004b4d20
test al, al
mov al, 1
jne 0x4b0c49
mov al, bl
mov ecx, dword [esp + 0x1c]
push esi
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x658]
push edx
mov edx, dword [esp + 0x34]
push ecx
push edx
lea ecx, [esp + 0x254]
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x870]
push edx
push ecx
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x468]
push edx
xor edx, edx
test al, al
mov eax, dword [esp + 0x44]
setne dl
push ecx
mov ecx, dword [esp + 0xa8c]
push edx
push eax
push edi
push 0x6bc140
push str._softwareDebutappname_sversion10.25_s_sappbits32basecapturedomainnchsoftwarebuyofferdebutpclassplusrgst_d_s_s_sinstby_siid_shelp_dostype_uosver_s_s_s
call fcn.00555940
add esp, 0x3c
push ebp
call fcn.0069c8fa
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa50
ret 4
Function at 0x4b0ec0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x198
cmp byte [0x736519], 0
jne 0x4b0ee6
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov byte [0x736519], 1
lea ecx, [esp + 4]
push ecx
call fcn.00542730
mov al, byte [esp + 4]
test al, al
je 0x4b0f19
cmp al, 0x7f
je 0x4b0f19
ja 0x4b0f05
mov eax, 0x701388
jmp 0x4b0f1e
cmp al, 0xbf
ja 0x4b0f10
mov eax, 0x6e9d54
jmp 0x4b0f1e
cmp al, 0xdf
mov eax, 0x706a28
jbe 0x4b0f1e
mov eax, 0x6bc0cc
push eax
call fcn.004b69f0
mov ecx, dword [esp + 0x1a0]
push eax
push str.osclass_dipprivclass_s
call fcn.00555940
add esp, 0x1a4
ret 4

Function at 0x4b0fc0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x208
cmp dword [esi + 0x208], 0
push ebx
mov ebx, dword [esp + 0x210]
je 0x4b0fe3
mov al, 1
pop ebx
add esp, 0x208
ret 4
movzx eax, word [esi]
xor ecx, ecx
test ax, ax
lea edx, [esi + 2]
je 0x4b100b
cmp ecx, 0x103
jae 0x4b100b
mov word [esp + ecx*2 + 4], ax
movzx eax, word [edx]
add ecx, 1
add edx, 2
test ax, ax
jne 0x4b0ff0
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea eax, [esp + 0xc]
push eax
push 0
push 0
mov word [esp + ecx*2 + 0x18], 0
call edi
test eax, eax
mov dword [esi + 0x208], eax
jne 0x4b1061
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4b108d
push 0x32
call ebp
cmp ebx, 0x32
jbe 0x4b108d
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
sub ebx, 0x32
call edi
test eax, eax
mov dword [esi + 0x208], eax
je 0x4b1035
mov edx, dword [esi + 0x208]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4b109b
mov eax, dword [esi + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x208], 0
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret 4
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret 4

Function at 0x4b1430
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b1440
sub eax, edx
sar eax, 1
mov esi, eax
cmp esi, 0x10000
jbe 0x4b145e
mov esi, 0xffff
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x18]
push ecx
movzx eax, si
push 1
lea edx, [esp + 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
push edx
push eax
mov dword [esp + 0x28], 0
call edi
mov eax, dword [ebx + 4]
push 0
lea ecx, [esp + 0x18]
push ecx
push 2
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x28], 0
call edi
mov eax, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [ebx + 4]
lea edx, [esi + esi]
push edx
push eax
push ecx
mov dword [esp + 0x28], 0
call edi
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
Function at 0x4b14d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
sub eax, dword [esi + 0xc]
cmp eax, 0x3e8
jb 0x4b1511
mov eax, dword [esi + 4]
push 0
lea ecx, [esp + 0x14]
push ecx
push 1
lea edx, [esp + 0x14]
push edx
push eax
mov byte [esp + 0x1c], 0x13
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esi + 0xc], edi
mov edx, dword [esi + 8]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor eax, eax
cmp eax, dword [esp + 0xc]
pop edi
sbb eax, eax
neg eax
pop esi
add esp, 0xc
ret
Function at 0x4b3190
Capabilities:
Get hostname

Disassembly:
sub esp, 0x210
push ebx
mov ebx, dword [esp + 0x218]
push edi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov word [esp + 0x18], 0
mov dword [esp + 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dx, word [esp + 0x10]
test dx, dx
mov dword [esi], 0x1234
movzx eax, dx
lea ecx, [esp + 0x12]
je 0x4b31f2
mov edx, 0x1234
lea ebx, [ebx]
movzx eax, ax
add edx, eax
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b31e0
mov dword [esi], edx
and dword [esi], 0x7fffffff
lea edi, [esp + 8]
mov dword [ebx], 0x5678
call fcn.005424e0
movzx edx, byte [esp + 0xc]
movzx ecx, byte [esp + 0xd]
movzx eax, byte [esp + 0xb]
add ecx, edx
movzx edx, byte [esp + 0xa]
add ecx, eax
movzx eax, byte [esp + 9]
add ecx, edx
movzx edx, byte [esp + 8]
add ecx, eax
add ecx, edx
add dword [ebx], ecx
pop edi
pop ebx
add esp, 0x210
ret 4
Function at 0x4b7020
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
mov dword [esi], 0x145
call fcn.004af5a0
test al, al
jne 0x4b7053
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [esp + 4], 6
setae al
test al, al
jne 0x4b7056
add dword [esi], 0x16
call fcn.004b6fc0
mov edx, dword [esp + 0x118]
xor ecx, ecx
cmp eax, 4
setge cl
sub ecx, 1
and ecx, 0xffffffdd
add ecx, 0xca
mov dword [edx], ecx
add esp, 0x114
ret 4
Function at 0x4b9420
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x24
push ebx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
mov eax, 0x80000840
mov dword [esp + 0x1c], 0
call fcn.004f6260
mov ebx, dword [esp + 4]
mov ecx, dword [0x734df4]
push edi
push fcn.0051d010
push 0
push ebx
push ecx
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
test eax, eax
je 0x4b9504
mov edx, dword [edi + 4]
push esi
push edx
mov ecx, str.NCHSoftware_InstanceChain
lea esi, [esp + 0x10]
call fcn.004977a0
mov eax, dword [edi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_IsWindow]
push ecx
call esi
test eax, eax
je 0x4b94f8
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
push ebp
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 1
jne 0x4b94e9
mov eax, dword [edi + 0xd0]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4b94f3
lea ecx, [esp + 0x14]
push ecx
call ebx
lea edx, [esp + 0x14]
push edx
call ebp
mov eax, dword [edi + 4]
push eax
call esi
test eax, eax
jne 0x4b94a3
jmp 0x4b94f3
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ebx, dword [esp + 0xc]
pop ebp
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop esi
test ebx, ebx
je 0x4b950f
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
add esp, 0x24
ret

Function at 0x4b95d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x654
mov eax, dword [0x735bac]
push eax
push str._installrelated__x
lea edx, [esp + 0x454]
call fcn.00401000
add esp, 8
lea ecx, [esp + 0x3c]
push ecx
call fcn.004c4840
push 0x6bc0cc
push str.debut.exe
lea edx, [esp + 0x24c]
push edx
lea eax, [esp + 0x48]
call fcn.004ad3a0
push 0x3c
lea eax, [esp + 4]
push 0
push eax
call fcn.006a1300
add esp, 0xc
lea eax, [esp]
lea ecx, [esp + 0x244]
lea edx, [esp + 0x44c]
push eax
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x40
mov dword [esp + 0x10], 0x6bc0b0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [esp + 0x38]
add esp, 0x654
ret
Function at 0x4bac00
Capabilities:
Check os version

Disassembly:
sub esp, 0x324
call fcn.004af5a0
test al, al
jne 0x4bac3d
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [esp + 4], 6
setae al
test al, al
je 0x4bac3d
push esi
push str.NCH_SoftwareDebut_s
lea ecx, [esp + 0x120]
push ecx
jmp 0x4bac4b
push esi
push str.Debut_s
lea edx, [esp + 0x120]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x118]
push eax
call fcn.004bac70
add esp, 0x324
ret
Function at 0x4baf50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push edi
lea eax, [esp + 0xc]
push eax
push str.SoftwareNCH_SoftwareDebutScheduler
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x4baf93
lea ecx, [esp + 0xc]
push ecx
push str.SoftwareNCH_SoftwareDebutScheduler
push SysReAllocStringLen
call esi
test eax, eax
jne 0x4bb02a
mov eax, dword [esp + 0xc]
push 0
push 0
push 0
push 0
lea edx, [esp + 0x24]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x4bafcd
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0x14]
test edi, edi
jbe 0x4bb01f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push 0
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
push eax
lea ecx, [edi - 1]
push ecx
push edx
mov dword [esp + 0x30], 0x104
call ebx
test eax, eax
jne 0x4bb01f
cmp word [esp + 0x18], ax
je 0x4bb01a
cmp dword [esp + 0x10], eax
jbe 0x4bb01a
lea esi, [esp + 0x18]
call fcn.004bac00
sub edi, 1
jne 0x4bafdb
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bb040
Capabilities:
Get hostname
Impersonate user

Disassembly:
sub esp, 0x210
push ebp
mov ebp, dword [esp + 0x218]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
push 2
mov dword [esp + 0x14], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea edx, [esp + 4]
push edx
push 0
push 2
push ebp
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
jne 0x4bb099
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop ebp
add esp, 0x210
ret 4
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 7], 1
movzx eax, word [edi]
xor ecx, ecx
test ax, ax
lea edx, [edi + 2]
je 0x4bb0d0
cmp ecx, 0x103
jae 0x4bb0d0
mov word [esi + ecx*2 + 8], ax
movzx eax, word [edx]
add ecx, 1
add edx, 2
test ax, ax
jne 0x4bb0b5
mov word [esi + ecx*2 + 8], 0
movzx eax, word [ebp]
xor ecx, ecx
test ax, ax
lea edx, [ebp + 2]
je 0x4bb103
cmp ecx, 0x103
jae 0x4bb103
mov word [esi + ecx*2 + 0x210], ax
movzx eax, word [edx]
add ecx, 1
add edx, 2
test ax, ax
jne 0x4bb0e5
mov eax, edi
mov word [esi + ecx*2 + 0x210], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bb112
sub eax, edx
sar eax, 1
add eax, eax
push eax
push 0
push edi
call fcn.006a1300
mov eax, ebp
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bb134
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
push ecx
push 0
push ebp
call fcn.006a1300
add esp, 0xc
mov al, 1
pop ebp
add esp, 0x210
ret 4