joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e854
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x47ebb4]
cmp dword [eax + 0x30], 0
je 0x44e8fe
cmp dword [ebx + 0x94], 0
jne 0x44e8f8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44e7e4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44e8f8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44e8be
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44e8f8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414b90
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44e8cd
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44f45c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44f491
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004046c8
jmp 0x44f49e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040462c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4505c8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x450609
mov eax, esi
call fcn.00436c84
test al, al
je 0x450609
mov eax, dword [ebx + 0x84]
call fcn.00436a24
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x450609
push 0
mov eax, dword [ebx + 0x84]
call fcn.00436a24
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x454450
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, eax
mov eax, dword [ebp]
call fcn.00404898
mov edi, eax
test di, di
jbe 0x454493
mov si, 1
mov ebx, 0x46ed1c
mov eax, ebp
call fcn.00404af0
movzx edx, si
lea eax, [eax + edx - 1]
push eax
movzx eax, si
mov edx, dword [ebp]
mov al, byte [edx + eax - 1]
xor al, byte [ebx]
pop edx
mov byte [edx], al
inc esi
inc ebx
dec di
jne 0x45446e
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x45aaf0
Capabilities:
Get socket status

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], edx
lea eax, [esp + 8]
call fcn.00450eb4
lea edx, [esp + 8]
mov eax, ebx
call fcn.00450ea4
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.wsock32.dll_select
dec eax
jge 0x45ab2e
xor eax, eax
jmp 0x45ab30
mov al, 1
add esp, 0x10c
pop ebx
ret
Function at 0x45b294
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x45b29d
mov eax, dword [ebp - 4]
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10004], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45b3ad
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x40], 0xffffffff
je 0x45b394
mov eax, dword [ebx + 0x4c]
call fcn.0045b050
lea edx, [ebp - 0xffff]
mov eax, dword [ebx + 0x4c]
call fcn.0045b160
mov esi, eax
mov eax, dword [ebx + 0x4c]
call fcn.0045b080
cmp esi, 1
jge 0x45b310
cmp byte [ebx + 0x50], 0
jne 0x45b307
push ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0x1c]
push eax
mov eax, ebx
call fcn.0041a9c8
mov byte [ebx + 0x50], 1
jmp 0x45b394
push 0
push esi
lea eax, [ebp - 0xffff]
push eax
mov eax, dword [ebx + 0x40]
push eax
call sub.wsock32.dll_send
inc eax
jne 0x45b369
call sub.wsock32.dll_WSAGetLastError
mov word [ebx + 0x66], ax
xor eax, eax
mov al, byte [ebx + 0x51]
mov edx, dword [0x47d31c]
mov esi, dword [edx + eax*8 + 4]
lea edx, [ebp - 0x10004]
mov eax, 0xa
call esi
mov edx, dword [ebp - 0x10004]
lea eax, [ebx + 0x68]
call fcn.0040462c
push ebx
mov eax, dword [ebx]
mov eax, dword [eax + 8]
push eax
mov eax, ebx
call fcn.0041a9c8
jmp 0x45b394
mov eax, dword [ebx + 0x4c]
call fcn.0045b050
mov edx, esi
mov eax, dword [ebx + 0x4c]
call fcn.0045b1c0
test al, al
je 0x45b387
mov eax, dword [ebx + 0x4c]
call fcn.0045b130
mov eax, dword [ebx + 0x4c]
call fcn.0045b080
jmp 0x45b2ce
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b3b4
lea eax, [ebp - 0x10004]
call fcn.004045d8
ret

Function at 0x45b3bc
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov eax, esi
call fcn.00404a98
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x45b3e8
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x45b3e8
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x45b74c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x45b7e2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x49], 0
jne 0x45b7cc
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x48], 1
mov byte [ebx + 0x4a], 0
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x40], esi
inc esi
jne 0x45b7c5
call sub.wsock32.dll_WSAGetLastError
mov word [ebx + 0x66], ax
xor eax, eax
mov al, byte [ebx + 0x51]
mov edx, dword [0x47d31c]
mov esi, dword [edx + eax*8 + 4]
lea edx, [ebp - 4]
mov eax, 0xe
call esi
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x68]
call fcn.0040462c
push ebx
mov eax, dword [ebx]
mov eax, dword [eax + 8]
push eax
mov eax, ebx
call fcn.0041a9c8
jmp 0x45b7cc
mov eax, ebx
call fcn.0041aa5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b7e9
lea eax, [ebp - 4]
call fcn.004045d8
ret

Function at 0x45c988
Capabilities:
Get socket status

Disassembly:
push ebx
add esp, 0xfffffcf4
mov ebx, eax
mov eax, esp
call fcn.00450eb4
mov edx, esp
mov eax, dword [ebx + 0x40]
call fcn.00450ea4
lea eax, [esp + 0x104]
call fcn.00450eb4
lea edx, [esp + 0x104]
mov eax, dword [ebx + 0x40]
call fcn.00450ea4
lea eax, [esp + 0x208]
call fcn.00450eb4
lea edx, [esp + 0x208]
mov eax, dword [ebx + 0x40]
call fcn.00450ea4
push 0
lea eax, [esp + 0x20c]
push eax
lea eax, [esp + 0x10c]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [ebx + 0x40]
inc eax
push eax
call sub.wsock32.dll_select
add esp, 0x30c
pop ebx
ret
Function at 0x45cab4
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov esi, eax
xor eax, eax
push ebp
push 0x45cbbc
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [esi + 0x40], eax
mov word [ebp - 0x10], 2
mov ax, word [esi + 0x44]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0xe], ax
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
mov eax, dword [esi + 0x40]
push eax
call sub.wsock32.dll_bind
inc eax
jne 0x45cb4d
call sub.wsock32.dll_WSAGetLastError
mov word [esi + 0x4c], ax
xor eax, eax
mov al, byte [esi + 0x54]
mov edx, dword [0x47d31c]
mov edi, dword [edx + eax*8 + 4]
lea edx, [ebp - 0x14]
mov eax, 0x16
call edi
mov edx, dword [ebp - 0x14]
lea eax, [esi + 0x50]
call fcn.0040462c
push esi
mov eax, dword [esi]
mov eax, dword [eax + 8]
push eax
mov eax, esi
call fcn.0041a9c8
jmp 0x45cba1
push 5
mov eax, dword [esi + 0x40]
push eax
call sub.wsock32.dll_listen
inc eax
jne 0x45cb98
call sub.wsock32.dll_WSAGetLastError
mov word [esi + 0x4c], ax
xor eax, eax
mov al, byte [esi + 0x54]
mov edx, dword [0x47d31c]
mov edi, dword [edx + eax*8 + 4]
lea edx, [ebp - 0x18]
mov eax, 0x17
call edi
mov edx, dword [ebp - 0x18]
lea eax, [esi + 0x50]
call fcn.0040462c
push esi
mov eax, dword [esi]
mov eax, dword [eax + 8]
push eax
mov eax, esi
call fcn.0041a9c8
jmp 0x45cba1
mov bl, 1
mov eax, esi
call fcn.0041aa5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cbc3
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004045fc
ret

Function at 0x45cc08
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
xor ebp, ebp
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
je 0x45cc73
mov word [esp], 2
xor eax, eax
mov dword [esp + 4], eax
mov ebx, dword [0x47d03c]
mov bx, word [ebx]
mov esi, dword [0x47d03c]
mov si, word [esi + 2]
sub si, bx
jb 0x45cc73
inc esi
push ebx
call sub.wsock32.dll_htons
mov word [esp + 2], ax
push 0x10
lea eax, [esp + 4]
push eax
push edi
call sub.wsock32.dll_bind
inc eax
je 0x45cc6d
push edi
call sub.wsock32.dll_closesocket
mov ebp, ebx
jmp 0x45cc73
inc ebx
dec si
jne 0x45cc48
mov eax, ebp
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x45cc80
Capabilities:
Get hostname
Resolve dns

Disassembly:
push esi
add esp, 0xfffffc00
or esi, 0xffffffff
push 0x400
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x45ccb4
mov edx, dword [eax + 0xc]
xor eax, eax
jmp 0x45ccad
mov esi, dword [ecx]
inc eax
mov ecx, dword [edx + eax*4]
test ecx, ecx
jne 0x45ccaa
mov eax, esi
add esp, 0x400
pop esi
ret
Function at 0x45eb9c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004075f0
ret

Function at 0x468634
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4686d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x47d2c0]
mov eax, dword [eax]
call fcn.0044f70c
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
push 2
push 0
push 0xfffffeee
push esi
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 0xc]
push eax
push 5
lea eax, [ebp - 5]
push eax
push esi
call sub.KERNEL32.DLL_ReadFile
lea eax, [ebp - 0x10]
lea edx, [ebp - 5]
mov ecx, 5
call fcn.00404848
mov eax, dword [ebp - 0x10]
mov edx, 0x4686ec
call fcn.004049e4
setne bl
push esi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4686db
lea eax, [ebp - 0x10]
call fcn.004045d8
ret

Function at 0x4686f4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a88
xor eax, eax
push ebp
push 0x4687bb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404a98
push eax
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
push 0
push edi
call sub.KERNEL32.DLL_GetFileSize
mov esi, eax
cmp esi, 0x3c
jle 0x46879f
push 0
push 0
push 0x3c
push edi
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 0xa]
push eax
push edi
call sub.KERNEL32.DLL_ReadFile
movzx eax, word [ebp - 0xa]
cmp esi, eax
jle 0x46879f
push 0
push 0
push eax
push edi
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x102]
push eax
push edi
call sub.KERNEL32.DLL_ReadFile
cmp dword [ebp - 0x102], 0x4550
sete bl
push edi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4687c2
lea eax, [ebp - 4]
call fcn.004045d8
ret
Function at 0x4687cc
Capabilities:
Create process on windows
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a88
mov edi, 0x47ede8
xor eax, eax
push ebp
push 0x4689ca
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404a98
push eax
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
mov edx, dword [edi + 0x10a]
mov eax, dword [edi + 0x106]
cmp edx, eax
jae 0x46886e
push 0
push 0
push eax
push esi
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [edi + 0x10a]
push eax
push 0x57ef1c
push esi
call sub.KERNEL32.DLL_ReadFile
mov ebx, dword [edi + 0x10a]
dec ebx
test ebx, ebx
jl 0x4688e2
inc ebx
mov eax, 0x57ef1c
xor edx, edx
mov dl, byte [eax]
mov dl, byte [edi + edx + 6]
mov byte [eax], dl
inc eax
dec ebx
jne 0x46885e
jmp 0x4688e2
push 0
push 0
push edx
push esi
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [edi + 0x106]
push eax
push 0x57ef1c
push esi
call sub.KERNEL32.DLL_ReadFile
mov ebx, dword [edi + 0x106]
dec ebx
test ebx, ebx
jl 0x4688b0
inc ebx
mov eax, 0x57ef1c
xor edx, edx
mov dl, byte [eax]
mov dl, byte [edi + edx + 6]
mov byte [eax], dl
inc eax
dec ebx
jne 0x4688a2
push 0
push 0
mov eax, dword [edi + 0x106]
push eax
push esi
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edx, [ebp - 8]
push edx
mov edx, dword [edi + 0x10a]
mov eax, dword [edi + 0x106]
sub edx, eax
push edx
add eax, 0x57ef1c
push eax
push esi
call sub.KERNEL32.DLL_ReadFile
push esi
call sub.KERNEL32.DLL_CloseHandle
push 0
push 0
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.00404a98
push eax
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [edi + 0x10a]
push eax
push 0x57ef1c
push esi
call sub.KERNEL32.DLL_WriteFile
push esi
call sub.KERNEL32.DLL_CloseHandle
lea eax, [ebp - 0xc]
call fcn.004045d8
call fcn.00402e64
cmp eax, 2
jle 0x46896f
call fcn.00402e64
mov ebx, eax
sub ebx, 3
jl 0x46896f
inc ebx
mov esi, 3
push dword [ebp - 0xc]
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.00402ecc
push dword [ebp - 0x10]
push 0x4689e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404958
inc esi
dec ebx
jne 0x468949
push 1
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00409254
mov eax, dword [ebp - 0x14]
call fcn.00404a98
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404a98
push eax
mov eax, dword [ebp - 4]
call fcn.00404a98
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.KERNEL32.DLL_ExitProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4689d1
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004045fc
lea eax, [ebp - 4]
call fcn.004045d8
ret
Function at 0x469a74
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff98
lea eax, [esp + 8]
push eax
push 0x60
call sub.KERNEL32.DLL_GetLogicalDriveStringsA
xor eax, eax
lea edx, [esp + 0xa]
cmp byte [edx], 0x5c
jne 0x469a9a
inc eax
add edx, 4
cmp eax, 0x1a
jne 0x469a8c
cmp byte [esp + 8], 0x41
jne 0x469aa8
mov edx, 1
jmp 0x469aaa
xor edx, edx
mov edi, edx
mov esi, eax
dec esi
sub esi, edi
jl 0x469b2e
inc esi
lea ebx, [esp + edi*4 + 8]
xor eax, eax
mov dword [esp], eax
push 0
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push ebx
call sub.KERNEL32.DLL_GetVolumeInformationA
cmp dword [esp], 0xff
jne 0x469b27
push ebx
call sub.KERNEL32.DLL_GetDriveTypeA
test eax, eax
je 0x469b1c
cmp eax, 1
je 0x469b1c
cmp eax, 5
je 0x469b1c
xor eax, eax
mov al, byte [ebx]
mov dl, byte [eax + 0x57eebb]
sub dl, 2
jae 0x469b0a
mov byte [eax + 0x57eebb], 1
cmp byte [eax + 0x57eebb], 2
jne 0x469b27
mov byte [eax + 0x57eebb], 2
jmp 0x469b27
xor eax, eax
mov al, byte [ebx]
mov byte [eax + 0x57eebb], 0
inc edi
add ebx, 4
dec esi
jne 0x469ab8
dec edi
mov eax, edi
shl eax, 2
movzx eax, byte [esp + eax + 8]
sub eax, 0x3f
cmp eax, 0x1a
jg 0x469b51
lea edx, [eax + 0x57eefb]
mov byte [edx], 0
inc eax
inc edx
cmp eax, 0x1b
jne 0x469b47
add esp, 0x68
pop edi
pop esi
pop ebx
ret

Function at 0x469e58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a88
xor eax, eax
push ebp
push 0x469ede
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404670
mov eax, dword [ebp - 4]
call fcn.00404898
mov esi, eax
test esi, esi
jle 0x469eb9
mov ebx, 1
lea eax, [ebp - 8]
call fcn.00404af0
mov edx, dword [ebp - 8]
mov dl, byte [edx + ebx - 1]
xor dl, 0x80
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x469e9f
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.0040462c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469ee5
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045fc
ret
Function at 0x46a070
Capabilities:
Check os version
Delete registry key
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x19
push 0
push 0
dec ecx
jne 0x46a078
push ebx
xor eax, eax
push ebp
push 0x46a285
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xa4]
mov eax, 0x46a29c
call fcn.00469e58
mov eax, dword [ebp - 0xa4]
call fcn.00404a98
push eax
push 0x80000001
call sub.shlwapi.dll_SHDeleteKeyA
lea edx, [ebp - 0xa8]
mov eax, 0x46a2bc
call fcn.00469e58
mov eax, dword [ebp - 0xa8]
call fcn.00404a98
push eax
push 0x80000001
call sub.shlwapi.dll_SHDeleteKeyA
lea edx, [ebp - 0xac]
mov eax, 0x46a2e4
call fcn.00469e58
mov eax, dword [ebp - 0xac]
call fcn.00404a98
push eax
push 0x80000001
call sub.shlwapi.dll_SHDeleteKeyA
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x9c], 5
jne 0x46a1f7
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0xb0]
mov eax, 0x46a310
call fcn.00469e58
mov eax, dword [ebp - 0xb0]
call fcn.00404a98
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x46a19f
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueA
cmp eax, 0xea
jne 0x46a19a
mov eax, dword [ebp - 4]
call fcn.00402a68
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueA
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.004047d0
mov eax, ebx
call fcn.00402a98
jmp 0x46a19f
call fcn.0040d8ec
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404898
mov ecx, eax
sub ecx, 3
mov edx, 2
mov eax, dword [ebp - 0xc]
call fcn.00404af8
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xb4]
call fcn.00409220
mov eax, dword [ebp - 0xb4]
push eax
lea edx, [ebp - 0xbc]
mov eax, 0x46a330
call fcn.00469e58
mov ecx, dword [ebp - 0xbc]
lea eax, [ebp - 0xc]
pop edx
call fcn.004048e4
cmp dword [ebp - 0x9c], 6
jne 0x46a247
lea edx, [ebp - 0xc0]
mov eax, 0x46a344
call fcn.00469e58
mov eax, dword [ebp - 0xc0]
push eax
lea edx, [ebp - 0xc8]
mov eax, 0x46a364
call fcn.00469e58
mov eax, dword [ebp - 0xc8]
lea edx, [ebp - 0xc4]
call fcn.0040e014
mov edx, dword [ebp - 0xc4]
lea eax, [ebp - 0xc]
pop ecx
call fcn.004048e4
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404a98
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebp - 0xc]
call fcn.00409180
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a28c
lea eax, [ebp - 0xc8]
mov edx, 0xa
call fcn.004045fc
lea eax, [ebp - 0xc]
call fcn.004045d8
ret
Function at 0x46a374
Capabilities:
Check os version
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1a
push 0
push 0
dec ecx
jne 0x46a37c
push ebx
push esi
xor eax, eax
push ebp
push 0x46a58b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x94], 5
jne 0x46a422
lea edx, [ebp - 0xa4]
mov eax, 0x46a5a0
call fcn.00469e58
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa0]
call fcn.0040e014
push dword [ebp - 0xa0]
lea edx, [ebp - 0xa8]
mov eax, 0x46a5b8
call fcn.00469e58
push dword [ebp - 0xa8]
lea edx, [ebp - 0xac]
mov eax, 0x46a5d4
call fcn.00469e58
push dword [ebp - 0xac]
lea eax, [ebp - 0x9c]
mov edx, 3
call fcn.00404958
mov eax, dword [ebp - 0x9c]
call fcn.00404a98
mov ebx, eax
cmp dword [ebp - 0x94], 6
jne 0x46a49d
lea edx, [ebp - 0xb8]
mov eax, 0x46a5e8
call fcn.00469e58
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xb4]
call fcn.0040e014
push dword [ebp - 0xb4]
lea edx, [ebp - 0xbc]
mov eax, 0x46a5b8
call fcn.00469e58
push dword [ebp - 0xbc]
lea eax, [ebp - 0xc0]
push eax
mov eax, 0x46a5d4
pop edx
call fcn.00469e58
push dword [ebp - 0xc0]
lea eax, [ebp - 0xb0]
mov edx, 3
call fcn.00404958
mov eax, dword [ebp - 0xb0]
call fcn.00404a98
mov ebx, eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc4]
mov eax, 0x46a5f8
call fcn.00469e58
mov eax, dword [ebp - 0xc4]
call fcn.00404a98
push eax
push 0x80000001
call sub.advapi32.dll_RegCreateKeyA
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
mov esi, ebx
push esi
push 1
push 0
lea eax, [ebp - 0xc8]
push eax
mov eax, 0x46a5d4
pop edx
call fcn.00469e58
mov eax, dword [ebp - 0xc8]
call fcn.00404a98
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
lea eax, [ebp - 4]
push eax
mov eax, 0x46a5f8
lea edx, [ebp - 0xcc]
call fcn.00469e58
mov eax, dword [ebp - 0xcc]
call fcn.00404a98
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyA
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push esi
push 1
push 0
lea eax, [ebp - 0xd0]
push eax
mov eax, 0x46a5d4
pop edx
call fcn.00469e58
mov eax, dword [ebp - 0xd0]
call fcn.00404a98
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a592
lea eax, [ebp - 0xd0]
mov edx, 0xe
call fcn.004045fc
ret
Function at 0x46abe4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a88
xor eax, eax
push ebp
push 0x46ace2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x47d330]
mov byte [eax], 0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404a98
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
push 2
push 0
push 0xfffffeee
push ebx
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 8]
push eax
push 0x112
mov eax, dword [0x47d21c]
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
lea eax, [ebp - 0xc]
mov edx, dword [0x47d21c]
mov ecx, 6
call fcn.00404848
mov eax, dword [ebp - 0xc]
mov edx, 0x46acf8
call fcn.004049e4
je 0x46ac94
mov eax, dword [0x47d330]
mov byte [eax], 1
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov edx, dword [0x47d21c]
mov dword [edx + 0x106], eax
push 0
push 0
push 0
push ebx
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [0x47d21c]
mov eax, dword [eax + 0x106]
push eax
mov eax, dword [0x47d0b4]
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ace9
lea eax, [ebp - 0xc]
call fcn.004045d8
lea eax, [ebp - 4]
call fcn.004045d8
ret

Function at 0x46ae70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, eax
mov byte [ebp - 1], 0
xor edx, edx
push ebp
push 0x46aed2
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.KERNEL32.DLL_GetCurrentProcessId
mov ebx, eax
mov eax, esi
call fcn.0046ad00
cmp eax, 0xffffffff
je 0x46aec8
cmp eax, ebx
je 0x46aec8
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
push 0xffffffffffffffff
push ebx
call sub.KERNEL32.DLL_WaitForSingleObject
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46aedc
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret