joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ca8d0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4ca93b
cmp byte [ebx + 0xd3], 0
jne 0x4ca93b
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004070cc
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4ca928
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4ca948
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406f90
jmp 0x4ca948
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406f90
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4cc04c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4cc0ba
mov eax, esi
call fcn.004a6654
test al, al
je 0x4cc0ba
mov eax, dword [ebx + 0x84]
call fcn.004a62a8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4cc0ba
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4cc0ae
push 0
mov eax, dword [ebx + 0x84]
call fcn.004a62a8
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0049d66c
jmp 0x4cc0ba
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004cbe84
pop esi
pop ebx
ret
Function at 0x4cd6e4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x41b168]
call fcn.00407c30
xor eax, eax
push ebp
push 0x4cd82e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x55bb60], 0
jne 0x4cd738
mov ecx, dword [0x55fbe0]
mov dl, 1
mov eax, dword [0x40d700]
call fcn.00417134
call fcn.004059b4
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.004048a0
mov eax, ebx
call fcn.00406df4
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x4cd83c
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00409f08
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x4cd77f
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x4cd7d4
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4cd7cd
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.00407208
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.004071a0
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.004110e8
test eax, eax
jne 0x4cd7cd
mov ebx, 0x15
jmp 0x4cd7d9
mov ebx, 0x10
jmp 0x4cd7d9
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x55bb60]
call fcn.004cd550
mov eax, dword [ebp - 4]
call fcn.004cd550
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00409f20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd835
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00406f88
lea eax, [ebp - 0xc]
mov edx, dword [0x41b168]
call fcn.00407d08
ret

Function at 0x4cf014
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.004048a0
ret
Function at 0x4cf1e4
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406f78
xor eax, eax
push ebp
push 0x4cf332
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.004cf014
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040701c
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4cf311
xor eax, eax
push ebp
push 0x4cf30a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4cf2f3
xor eax, eax
push ebp
push 0x4cf2ec
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4cf2d5
xor eax, eax
push ebp
push 0x4cf2ce
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.004cf04c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf2d5
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf2f3
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf311
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.004cf0d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf339
lea eax, [ebp - 4]
call fcn.00406f80
ret
Function at 0x4e6934
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5663a8
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4e6956
shr eax, 1
xor eax, 0xedb88320
jmp 0x4e6958
shr eax, 1
dec edx
jne 0x4e6944
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4e693d
mov byte [0x5667a8], 1
pop esi
pop ebx
ret

Function at 0x4e6974
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5667a8], 0
jne 0x4e698b
call fcn.004e6934
mov eax, edi
dec eax
test eax, eax
jl 0x4e69b3
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5663a8]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4e6995
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4e9700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x4e979a.0
jmp dword [ecx*4 + 0x4e9733]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4e9765
sub dl, 8
je 0x4e9774
jmp case.0x4e979a.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e93a8
jmp case.0x4e979a.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e9400
jmp case.0x4e979a.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x4e979a.0
movzx ecx, byte [ecx + 0x4e97a1]
jmp dword [ecx*4 + 0x4e97b2]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e94ac
jmp case.0x4e979a.0
cmp dl, 3
jne 0x4e97df
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e9504
jmp case.0x4e979a.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e94c0
jmp case.0x4e979a.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e9548
jmp case.0x4e979a.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4e980a
sub dl, 8
je 0x4e9816
jmp case.0x4e979a.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e9574
jmp case.0x4e979a.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e95e0
jmp case.0x4e979a.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4e9835
sub dl, 8
je 0x4e9841
jmp case.0x4e979a.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e969c
jmp case.0x4e979a.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e96c4
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x4e98e3
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004e88ac
test eax, eax
je 0x4e98e3
mov eax, ebx
call fcn.004e98ec
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x4e987c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4e98ec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4e991d
dec al
je 0x4e9958
dec al
je 0x4e999d
dec al
je 0x4e9a06
jmp 0x4e9a90
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4e9a90
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4e992d
jmp 0x4e9a90
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4e9a90
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4e9968
jmp 0x4e9a90
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4e9a90
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4e99cc
xor ebp, ebp
jmp 0x4e99dc
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4e99e5
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4e99ad
jmp 0x4e9a90
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4e9a90
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4e9a5f
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004e69bc
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4e9a1a
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f0dd4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4f0e02
mov eax, ebx
call fcn.004f1888
cmp dword [ebx + 0x40], 0
je 0x4f0dfb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4f0e73
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4f0e65
cmp dword [ebx + 8], 0
je 0x4f0e24
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4f0e36
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4f0e65
cmp dword [ebx + 8], 0
je 0x4f0e17
cmp eax, 3
je 0x4f0e49
dec eax
jne 0x4f0e17
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4f0e17
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4f0e17
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4f0e91
cmp dword [ebx + 0x14], 0xcc
je 0x4f0e91
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004f0e9c
pop ebx
ret

Function at 0x507c1c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
dec ecx
js 0x507c6d
lea eax, [ebp - 0x30]
cmp word [eax + 0x20], 3
je 0x507c54
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x507c44
jmp 0x507c6d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x507c55
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x518ee4
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor edx, edx
push ebp
push 0x51905e
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x51902e
mov eax, 0x519078
call fcn.00411ed8
test al, al
jne 0x51902e
lea eax, [ebp - 0x10]
call fcn.00517c10
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, 0
call fcn.004071e4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00518404
mov eax, dword [ebp - 8]
mov edx, 0x519098
call fcn.00406868
je 0x51902e
lea edx, [ebp - 4]
mov eax, 3
call fcn.0052187c
mov eax, dword [ebp - 4]
test eax, eax
je 0x518f79
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x518f79
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406368
test eax, eax
je 0x518f82
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x518fc5
mov esi, 1
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
movzx edx, word [edx + esi*2 - 2]
call fcn.0040710c
lea eax, [ebp - 0x14]
mov edx, 0x5190b8
call fcn.004073b4
mov eax, dword [ebp - 0x14]
call fcn.0040701c
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov dl, 1
xor eax, eax
call fcn.00521874
inc esi
dec ebx
jne 0x518f8d
mov eax, dword [ebp - 4]
test eax, eax
je 0x518fe2
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x518fe2
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406368
test eax, eax
je 0x518feb
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x51902e
mov esi, 1
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
movzx edx, word [edx + esi*2 - 2]
call fcn.0040710c
lea eax, [ebp - 0x18]
mov edx, 0x5190b8
call fcn.004073b4
mov eax, dword [ebp - 0x18]
call fcn.0040701c
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
xor edx, edx
xor eax, eax
call fcn.00521874
inc esi
dec ebx
jne 0x518ff6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519065
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00406f88
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004061a0
lea eax, [ebp - 4]
call fcn.00406f80
ret

Function at 0x519bb8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406f78
xor eax, eax
push ebp
push 0x519bfe
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80
mov eax, dword [ebp - 4]
call fcn.0040701c
push eax
call sub.kernel32.dll_SetFileAttributesW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519c05
lea eax, [ebp - 4]
call fcn.00406f80
ret
Function at 0x51a52c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406f78
mov eax, dword [ebp - 8]
call fcn.00406f78
xor eax, eax
push ebp
push 0x51a5df
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 0x10
call fcn.004048a0
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x44
call fcn.004048a0
mov dword [ebp - 0x5c], 0x44
mov eax, dword [ebp - 8]
call fcn.00411f20
test al, al
jne 0x51a590
lea eax, [ebp - 8]
call fcn.0051e384
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 8]
call fcn.0040701c
push eax
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040701c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51a5e6
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406f88
ret

Function at 0x51b2d8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406f78
mov eax, dword [ebp - 8]
call fcn.00406f78
xor eax, eax
push ebp
push 0x51b3c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x51b326
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x51b326
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.00406368
test eax, eax
je 0x51b32f
sub eax, 4
mov eax, dword [eax]
dec eax
jl 0x51b3a8
mov eax, dword [ebp - 8]
call fcn.0040701c
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 4]
call fcn.0051b250
test al, al
je 0x51b3a8
xor eax, eax
push ebp
push 0x51b38c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push 0xa
mov ecx, dword [0x563c40]
mov dl, 1
mov eax, dword [0x42a35c]
call fcn.00435264
mov ebx, eax
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00435018
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51b39d
test ebx, ebx
je 0x51b3a8
mov eax, ebx
call fcn.00404ee4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b3ca
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406f88
ret
Function at 0x51b3d8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406f78
xor eax, eax
push ebp
push 0x51b4bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x51b421
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x51b421
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406368
test eax, eax
je 0x51b42a
sub eax, 4
mov eax, dword [eax]
dec eax
jge 0x51b435
lea eax, [ebp - 4]
call fcn.0051e384
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004188b0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00406fe4
xor ebx, ebx
push dword [ebp - 4]
push 0x51b4d8
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0041183c
push dword [ebp - 0xc]
push 0x51b4ec
mov eax, esi
mov edx, 4
call fcn.00407558
mov edi, dword [esi]
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x10]
call fcn.0040701c
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [esi]
call fcn.00411ed8
test al, al
je 0x51b4a0
inc ebx
cmp ebx, 0x2711
jne 0x51b44d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b4c2
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406f88
ret

Function at 0x51b56c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00406f78
xor eax, eax
push ebp
push 0x51b688
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00406f90
mov eax, dword [ebp - 4]
test eax, eax
je 0x51b5bd
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x51b5bd
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406368
test eax, eax
je 0x51b5c6
sub eax, 4
mov eax, dword [eax]
dec eax
jl 0x51b66a
push 0xa
mov eax, dword [ebp - 4]
call fcn.0040701c
push eax
push edi
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
je 0x51b66a
push ebx
push edi
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x51b66a
push ebx
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
cmp ebx, 1
jl 0x51b66a
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, ebx
call fcn.00406b60
xor eax, eax
push ebp
push 0x51b663
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LockResource
mov edi, eax
mov eax, dword [ebp - 8]
call fcn.004068ec
mov edx, eax
mov ecx, ebx
mov eax, edi
call fcn.00404410
mov ecx, esi
mov dx, 0xfde9
mov eax, dword [ebp - 8]
call fcn.005211e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b66a
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FreeResource
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b68f
lea eax, [ebp - 8]
call fcn.0040617c
lea eax, [ebp - 4]
call fcn.00406f80
ret
Function at 0x51d27c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00406f78
mov eax, dword [ebp - 8]
call fcn.00406f78
xor eax, eax
push ebp
push 0x51d38d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor edx, edx
call fcn.00406f90
cmp dword [ebp - 4], 0
je 0x51d2f1
mov eax, dword [ebp - 4]
test eax, eax
je 0x51d2d9
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x51d2d9
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406368
cmp word [eax], 0x5c
jne 0x51d2f1
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.004077b0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.0040701c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x51d372
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040701c
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x51d369
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.0040731c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.0040701c
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov eax, dword [ebx]
call fcn.0040701c
mov edx, eax
mov eax, ebx
call fcn.0040714c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51d394
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406f88
ret