joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447180
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x2c
mov eax, dword [0x4d9540]
lea ecx, [esp + 4]
push 8
push ecx
mov dword [esp + 8], eax
call fcn.00447360
add esp, 8
lea edx, [esp + 4]
push 0xf0000000
push 0x18
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x447212
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4471e1
lea edx, [esp + 4]
push edx
call fcn.00447380
add esp, 4
jmp 0x447212
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push eax
lea edx, [esp + 8]
push ecx
push edx
call fcn.004473c0
add esp, 0xc
test al, al
je 0x447212
lea eax, [esp + 0xc]
lea ecx, [esp + 4]
push eax
push ecx
call fcn.00447420
add esp, 8
test al, al
jne 0x447249
mov eax, dword [esp]
mov ecx, dword [0x4d9544]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x447241
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x447241
mov eax, dword [esp]
add eax, 0xfffffff4
push eax
call fcn.004c5432
add esp, 4
xor al, al
add esp, 0x2c
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push edi
xor edi, edi
mov ecx, dword [0x4d9540]
mov edx, str._02x
test edx, edx
mov dword [esp + 0x40], ecx
je 0x4472b8
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
je 0x4472b8
push esi
lea ecx, [esp + 0x44]
call fcn.004012f0
test eax, eax
je 0x4472b8
mov ecx, dword [esp + 0x40]
lea eax, [esi + 1]
test eax, eax
mov esi, ecx
jne 0x447293
test ecx, ecx
jne 0x4472ad
push eax
push ecx
push 0xffffffffffffffff
push str._02x
push 0
push 0
call ebx
test eax, eax
jle 0x4472ad
mov word [esi + eax*2 - 2], 0
push 0xffffffffffffffff
lea ecx, [esp + 0x44]
call fcn.00401970
mov ecx, dword [esp + 0x40]
xor eax, eax
mov al, byte [esp + edi + 0x18]
lea edx, [esp + 0xc]
push eax
push ecx
push edx
call fcn.00401a70
mov eax, dword [esp + 0x4c]
mov edx, dword [0x4d9544]
add esp, 0xc
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x447300
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x447300
mov edx, dword [esp + 0x40]
add edx, 0xfffffff4
push edx
call fcn.004c5432
add esp, 4
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x44]
push eax
mov eax, dword [eax - 8]
push eax
call fcn.00401850
inc edi
cmp edi, 0x20
jl 0x447254
mov eax, dword [esp + 0xc]
mov edx, dword [0x4d9544]
pop edi
pop esi
lea ecx, [eax - 0xc]
pop ebx
cmp ecx, edx
je 0x44734e
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44734e
mov edx, dword [esp]
add edx, 0xfffffff4
push edx
call fcn.004c5432
add esp, 4
mov al, 1
add esp, 0x2c
ret 0xc
Function at 0x4473c0
Capabilities:
Hash data via wincrypt

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 4]
test eax, eax
jne 0x4473d0
xor al, al
pop esi
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x447415
mov eax, dword [esi]
test eax, eax
je 0x4473fc
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x447411
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [esi + 4], 0
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
Function at 0x4493f0
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x449457
mov eax, dword [esp + 0x14]
test eax, eax
je 0x44942e
push 0
push str.Create_Error_
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [0x4d9544]
lea eax, [edi - 0xc]
cmp eax, ecx
je 0x449452
lea esi, [edi - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x449452
push esi
call fcn.004c5432
add esp, 4
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push 0
push ecx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 4]
push edx
push eax
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4d9544]
lea ecx, [edi - 0xc]
cmp ecx, eax
je 0x4494a3
lea esi, [edi - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4494a3
push esi
call fcn.004c5432
add esp, 4
pop edi
mov eax, 1
pop esi
ret
Function at 0x4494b0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
push edi
push 0
push 0x80
push 3
push 0
push 1
push SHChangeNotifyDeregister
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 8], edi
jne 0x449519
push 0
push str.Error1_
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [0x4d9544]
lea eax, [esi - 0xc]
cmp eax, ecx
je 0x449511
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x449511
push esi
call fcn.004c5432
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
push ebx
push ebp
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x14], eax
lea esi, [eax + 1]
mov dword [esp + 0x18], 0
mov eax, dword [ebx + 4]
mov ecx, dword [eax - 0xc]
lea ebp, [eax - 0xc]
cmp ecx, 1
jg 0x44954a
cmp esi, dword [eax - 4]
jle 0x4495ab
mov eax, dword [eax - 8]
cmp esi, eax
mov dword [esp + 0x24], eax
jge 0x449557
mov esi, eax
test esi, esi
jne 0x449603
mov ecx, dword [0x4d9540]
mov dword [ebx + 4], ecx
mov edi, dword [ebx + 4]
lea ecx, [eax + eax + 2]
mov eax, ecx
lea esi, [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x24]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 4]
mov dword [ecx - 8], edx
mov eax, dword [0x4d9544]
cmp ebp, eax
je 0x4495a7
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4495a7
push ebp
call fcn.004c5432
add esp, 4
mov edi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push 0
push edx
push ecx
push eax
push edi
mov dword [ebx], eax
mov dword [ebx + 8], ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
mov edx, dword [0x4d9544]
pop ebp
pop ebx
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4495f8
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4495f8
push esi
call fcn.004c5432
add esp, 4
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret
lea edx, [esi + esi + 0xe]
push edx
call fcn.004c58a5
add esp, 4
test eax, eax
je 0x449636
mov dword [eax], 1
mov word [eax + esi*2 + 0xc], 0
mov dword [eax + 4], esi
mov dword [eax + 8], esi
add eax, 0xc
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x24]
jmp 0x449568
xor eax, eax
jmp 0x4495ae
Function at 0x44b4b0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 8
lea eax, [esp]
push ebx
xor ebx, ebx
test eax, eax
je 0x44b4cd
lea eax, [esp + 4]
mov ecx, 8
mov byte [eax], bl
inc eax
dec ecx
jne 0x44b4c7
push 0xf0000000
push 0x18
push ebx
lea ecx, [esp + 0x10]
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x44b54b
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push ebx
push ebx
push 0x800c
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x44b50a
mov eax, dword [esp + 4]
cmp eax, ebx
je 0x44b53c
jmp 0x44b530
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x44b54b
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ebx
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x44b554
mov eax, dword [esp + 4]
cmp eax, ebx
je 0x44b53c
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 4], ebx
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x44b54b
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor al, al
pop ebx
add esp, 8
ret 0xc
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x44b54b
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ebx
push ecx
push edx
push 2
push eax
mov dword [esp + 0x28], 0x20
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
mov eax, dword [esp + 4]
jne 0x44b5a8
cmp eax, ebx
je 0x44b590
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 4], ebx
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x44b54b
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor al, al
pop ebx
add esp, 8
ret 0xc
cmp eax, ebx
je 0x44b5b8
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 4], ebx
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x44b5c7
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov al, 1
pop ebx
add esp, 8
ret 0xc
Function at 0x44b9b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
lea esi, [ecx + 8]
push edi
mov dword [esi], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4ee014
mov dword [esi + 4], eax
call ebx
mov eax, dword [0x4ee048]
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esi + 8], eax
push 0x4ee014
mov dword [0x4ee048], esi
call edi
mov esi, dword [0x4edfe8]
push 0x4ee014
call ebx
mov ebx, dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.WM_ATLGETHOST
call ebx
push str.WM_ATLGETCONTROL
mov dword [0x4e3a20], eax
call ebx
lea ecx, [esp + 0x20]
mov dword [0x4e3a1c], eax
mov eax, dword [0x4edfe4]
push ecx
mov ebx, 0x30
push str.AtlAxWin
push eax
mov dword [esp + 0x2c], ebx
call dword [sym.imp.USER32.dll_GetClassInfoExW]
test eax, eax
jne 0x44ba98
mov edx, dword [0x4edfe4]
xor ebp, ebp
push 0x7f00
push ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], 0x440940
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebp
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x44], 6
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], str.AtlAxWin
mov dword [esp + 0x50], ebp
call dword [sym.imp.USER32.dll_RegisterClassExW]
jmp 0x44ba9a
xor ebp, ebp
push 0x4ee014
call edi
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 5
push 0x84
push esi
call edi
push 0xf0
push 0x84
push esi
mov ebx, eax
call edi
mov edi, eax
mov dword [esp + 0x14], ebp
test edi, edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], 0
je 0x44baeb
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebx, ebx
je 0x44bb4c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebp
push ebx
call fcn.00412020
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
add esp, 8
mov edi, eax
push ecx
push 0x410630
push edx
push edi
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
cmp edi, ebx
mov dword [esp + 0x10], eax
je 0x44bb3d
push edi
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edi, dword [esp + 0x1c]
test ebp, ebp
je 0x44bb5f
test edi, edi
je 0x44bb5f
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 8
Function at 0x44db60
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, ecx
push 0x11
mov dword [edi], 0
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [esp + 0x10]
xor ecx, ecx
test ax, ax
setl cl
mov eax, ecx
lea ecx, [edx - 0x23]
cmp ecx, 0x4e
ja case.0x44db98.42
xor edx, edx
mov dl, byte [ecx + 0x44dca8]
jmp dword [edx*4 + 0x44dc88]
push 1
mov ecx, esi
mov dword [edi], 1
call fcn.0044e510
pop edi
xor eax, eax
pop esi
ret 0x10
push 0
mov ecx, esi
mov dword [edi], 1
call fcn.0044e510
pop edi
xor eax, eax
pop esi
ret 0x10
test eax, eax
je case.0x44db98.42
push 1
mov ecx, esi
mov dword [edi], 1
call fcn.0044e560
pop edi
xor eax, eax
pop esi
ret 0x10
test eax, eax
je case.0x44db98.42
push 0
mov ecx, esi
mov dword [edi], 1
call fcn.0044e560
pop edi
xor eax, eax
pop esi
ret 0x10
test eax, eax
je case.0x44db98.42
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x38]
push eax
call fcn.0044c4f0
push esi
mov dword [edi], 1
mov ecx, dword [esi + 0x38]
push eax
push 0
call fcn.0044ced0
pop edi
xor eax, eax
pop esi
ret 0x10
mov ecx, dword [esi + 4]
push ecx
call fcn.00497fc0
add esp, 4
xor eax, eax
pop edi
pop esi
ret 0x10
test eax, eax
je case.0x44db98.42
mov dword [edi], 1
mov eax, dword [esi + 0x38]
add eax, 4
push 0
push 0
push 0x1004
mov edx, dword [eax]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x38]
mov edi, eax
mov eax, dword [esi + 0x24]
push eax
call fcn.0044c4f0
mov ecx, dword [esi + 0x38]
push esi
dec edi
push eax
push edi
call fcn.0044ced0
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x44e370
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x3c
mov eax, dword [0x4d9540]
push ebx
push ebp
mov dword [esp + 8], eax
mov edx, dword [eax - 0xc]
lea ebp, [eax - 0xc]
mov ebx, ecx
push esi
cmp edx, 1
push edi
mov ecx, 0x800
jg 0x44e397
cmp dword [eax - 4], ecx
jge 0x44e3f7
mov esi, dword [eax - 8]
cmp esi, ecx
mov dword [esp + 0x14], esi
jle 0x44e3a4
mov ecx, esi
push ecx
lea ecx, [esp + 0x14]
call fcn.004012f0
test eax, eax
je 0x44e3f7
mov edi, dword [esp + 0x10]
lea ecx, [esi + esi + 2]
mov eax, ecx
lea esi, [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x14]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov dword [ecx - 8], edx
mov eax, dword [0x4d9544]
cmp ebp, eax
je 0x44e3f3
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44e3f3
push ebp
call fcn.004c5432
add esp, 4
mov eax, dword [esp + 0x10]
push 0x800
push eax
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [esp + 0x10]
call fcn.00401380
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.USER32.dll_GetParent]
mov dword [edx - 8], eax
mov ecx, dword [esp + 0x10]
mov word [ecx + eax*2], 0
mov edx, dword [ebx + 4]
push edx
call esi
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x38]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
add eax, 4
mov eax, dword [eax]
push eax
call edi
mov ecx, dword [ebx + 0x20]
mov edx, dword [ebx + 0x24]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x2c]
push ecx
push eax
mov dword [esp + 0x28], 0xffffff50
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], edx
call fcn.004c5509
add esp, 8
test eax, eax
jne 0x44e48c
mov dword [esp + 0x2c], 0xffffffff
mov edx, dword [ebx + 0x30]
mov eax, dword [esp + 0x10]
neg edx
sbb edx, edx
not edx
and edx, eax
mov dword [esp + 0x38], edx
mov eax, dword [eax - 8]
mov dword [esp + 0x3c], eax
mov eax, dword [ebx + 0x38]
add eax, 4
mov ecx, dword [eax]
push ecx
call edi
mov edx, dword [ebx + 4]
mov edi, eax
push edx
call esi
lea ecx, [esp + 0x18]
push ecx
push edi
push 0x4e
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x10]
mov ecx, dword [0x4d9544]
pop edi
pop esi
lea edx, [eax - 0xc]
pop ebp
cmp edx, ecx
pop ebx
je 0x44e4fe
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44e4fe
mov eax, dword [esp]
add eax, 0xfffffff4
push eax
call fcn.004c5432
add esp, 4
add esp, 0x3c
ret
Function at 0x454b10
Capabilities:
Check os version

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
push edi
mov ecx, 0x45
xor eax, eax
mov edi, 0x4e9ed0
push 0x4e9ed0
rep stosd dword es:[edi], eax
mov dword [0x4e9ed0], 0x114
call ebx
mov eax, dword [0x4e9ed4]
mov edx, dword [0x4e9ed8]
mov ecx, eax
mov esi, dword [0x4d9540]
and ecx, 0xffff
and edx, 0xffff
shl ecx, 0x10
or ecx, edx
cmp eax, 5
mov dword [0x4ea830], ecx
jb 0x454c1d
mov ecx, 0x47
xor eax, eax
mov edi, 0x4e9db0
push str.ntdll.dll
rep stosd dword es:[edi], eax
mov dword [0x4e9db0], 0x11c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x454bf4
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x454bf4
push 0x4e9db0
call eax
mov eax, dword [0x4e9db4]
test eax, eax
je 0x454bf4
mov ecx, dword [0x4e9dbc]
mov dword [0x4e9ed4], eax
mov eax, dword [0x4e9db8]
lea edx, [esi - 0xc]
mov dword [0x4e9ed8], eax
mov eax, dword [0x4d9544]
cmp edx, eax
mov dword [0x4e9edc], ecx
je 0x454c41
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x454c41
push esi
call fcn.004c5432
add esp, 4
pop edi
pop esi
pop ebx
ret
push 0x4e9db0
call ebx
mov eax, dword [0x4e9db4]
mov ecx, dword [0x4e9db8]
mov edx, dword [0x4e9dbc]
mov dword [0x4e9ed4], eax
mov dword [0x4e9ed8], ecx
mov dword [0x4e9edc], edx
mov ecx, dword [0x4d9544]
lea eax, [esi - 0xc]
cmp eax, ecx
je 0x454c41
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x454c41
push esi
call fcn.004c5432
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4568e0
Capabilities:
Delete registry key

Disassembly:
mov eax, dword [0x4dcacc]
sub esp, 8
cmp eax, 0xffffffff
jne 0x45698e
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
lea ecx, [esp + 0x10]
xor edi, edi
push eax
push ecx
push edi
push 2
push edi
push edi
push edi
push str.Q_Dir_Admin_Test
push SHChangeNotifyDeregister
mov dword [0x4dcacc], edi
xor esi, esi
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
jne 0x45697b
mov esi, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push 0xf003f
push edi
push edi
push SHChangeNotifyDeregister
mov dword [0x4dcacc], 1
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x456965
cmp esi, edi
je 0x456961
push esi
call ebp
mov esi, dword [esp + 0x10]
push str.Q_Dir_Admin_Test
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x45697b
mov dword [0x4dcacc], edi
mov ebx, dword [0x4dcacc]
cmp esi, edi
je 0x456988
push esi
call ebp
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 8
ret
Function at 0x45b250
Capabilities:
Identify system language via api

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [0x4dcab0], 1
call edi
mov si, ax
and esi, 0x3ff
call edi
shr ax, 0xa
cmp si, 7
jne 0x45b286
pop edi
mov dword [0x4dcab0], 0
pop esi
ret
cmp si, 9
jne 0x45b299
pop edi
mov dword [0x4dcab0], 1
pop esi
ret
cmp si, 0xc
jne 0x45b2ac
pop edi
mov dword [0x4dcab0], 2
pop esi
ret
cmp si, 0x10
jne 0x45b2bf
pop edi
mov dword [0x4dcab0], 3
pop esi
ret
cmp si, 0xa
jne 0x45b2e6
cmp ax, 0xb
mov dword [0x4dcab0], 4
jne 0x45b486
pop edi
mov dword [0x4dcab0], 0xe
pop esi
ret
cmp si, 4
jne 0x45b30d
cmp ax, 1
mov dword [0x4dcab0], 9
jne 0x45b486
pop edi
mov dword [0x4dcab0], 5
pop esi
ret
cmp si, 0x11
jne 0x45b320
pop edi
mov dword [0x4dcab0], 6
pop esi
ret
cmp si, 0x12
jne 0x45b333
pop edi
mov dword [0x4dcab0], 7
pop esi
ret
cmp si, 0x15
jne 0x45b346
pop edi
mov dword [0x4dcab0], 8
pop esi
ret
cmp si, 0x19
jne 0x45b359
pop edi
mov dword [0x4dcab0], 0xa
pop esi
ret
cmp si, 0x13
jne 0x45b36c
pop edi
mov dword [0x4dcab0], 0xb
pop esi
ret
cmp si, 0x1f
jne 0x45b37f
pop edi
mov dword [0x4dcab0], 0xc
pop esi
ret
cmp si, 8
jne 0x45b392
pop edi
mov dword [0x4dcab0], 0xd
pop esi
ret
cmp si, 0x1b
jne 0x45b3a5
pop edi
mov dword [0x4dcab0], 0xf
pop esi
ret
cmp si, 5
jne 0x45b3b8
pop edi
mov dword [0x4dcab0], 0x10
pop esi
ret
cmp si, 6
jne 0x45b3cb
pop edi
mov dword [0x4dcab0], 0x11
pop esi
ret
cmp si, 0x16
jne 0x45b3de
pop edi
mov dword [0x4dcab0], 0x12
pop esi
ret
cmp si, 0x18
jne 0x45b3f1
pop edi
mov dword [0x4dcab0], 0x13
pop esi
ret
cmp si, 0x1a
jne 0x45b404
pop edi
mov dword [0x4dcab0], 0x17
pop esi
ret
cmp si, 0x24
jne 0x45b417
pop edi
mov dword [0x4dcab0], 0x18
pop esi
ret
cmp si, 0xb
jne 0x45b42a
pop edi
mov dword [0x4dcab0], 0x15
pop esi
ret
cmp si, 1
jne 0x45b43d
pop edi
mov dword [0x4dcab0], 0x19
pop esi
ret
cmp si, 0xe
jne 0x45b450
pop edi
mov dword [0x4dcab0], 0x16
pop esi
ret
cmp si, 0x22
jne 0x45b463
pop edi
mov dword [0x4dcab0], 0x1a
pop esi
ret
cmp si, 0x25
jne 0x45b476
pop edi
mov dword [0x4dcab0], 0x1b
pop esi
ret
cmp si, 0x14
jne 0x45b486
mov dword [0x4dcab0], 0x1d
pop edi
pop esi
ret
Function at 0x460ac0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [0x4dd1cc]
test eax, eax
je 0x460afe
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, 0x4dd1cc
push 0
push eax
push 0x419
push edi
call ebx
push 0
push eax
push 0x416
push edi
call ebx
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jne 0x460adb
pop edi
pop esi
pop ebx
ret