joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a9f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x46aa11
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x46aa0a
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x46aa25
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0046a3c4
test bl, bl
jne 0x46aaff
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x494f68
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x46aa5d
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x46aa72
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0046a8cc
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
movzx ebx, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x46aaa5
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x46aa52
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x46aac9
mov eax, 4
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x46aadb
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x46aaf0
jmp 0x46abc0
cmp bl, 1
jne 0x46abc0
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x494fc2
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x46ab1f
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x46ab34
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0046a8cc
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x46ab67
sub ebx, 6
inc dword [ebp - 8]
jne 0x46ab14
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x46ab8f
mov eax, 4
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x46aba1
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x46abb6
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0046a444
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x46f6c8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004051a4
xor eax, eax
push ebp
push 0x46f7da
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0046f610
test al, al
je 0x46f707
lea eax, [ebp - 0x18]
push eax
call dword [0x494fcc]
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.0046f660
mov esi, eax
test esi, esi
jle 0x46f7ac
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040521c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [0x494fd4]
or eax, 0x20006
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004051b4
push eax
push edi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x46f7ac
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x46f76b
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.0040521c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004051b4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
call fcn.0046f610
test al, al
je 0x46f7bf
lea eax, [ebp - 0x18]
push eax
call dword [0x494fd0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f7e1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d48
ret
Function at 0x46f7ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004051a4
xor eax, eax
push ebp
push 0x46f943
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0046f610
test al, al
je 0x46f82b
lea eax, [ebp - 0x1c]
push eax
call dword [0x494fcc]
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.0046f660
mov esi, eax
test esi, esi
jle 0x46f915
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040521c
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x494fd4]
or eax, 0x20019
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004051b4
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46f915
mov edi, dword [ebp - 4]
test edi, edi
je 0x46f889
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 8]
push eax
mov ecx, edi
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.0040521c
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004051b4
mov edi, eax
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46f90c
mov eax, dword [ebp - 0x18]
call fcn.004030c0
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46f905
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jne 0x46f8fc
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov bl, 1
jmp 0x46f90c
mov eax, esi
call fcn.004030dc
jmp 0x46f90c
mov eax, esi
call fcn.004030dc
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
call fcn.0046f610
test al, al
je 0x46f928
lea eax, [ebp - 0x1c]
push eax
call dword [0x494fd0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f94a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d48
ret
Function at 0x46fc5c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004051a4
xor eax, eax
push ebp
push 0x46fd4f
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0046f610
test al, al
je 0x46fc98
lea eax, [ebp - 0x10]
push eax
call dword [0x494fcc]
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.0046f660
mov esi, eax
test esi, esi
jle 0x46fd21
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040521c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x494fd4]
or eax, 0x20006
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004051b4
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x46fd21
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x46fcee
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.0040521c
mov eax, dword [ebp - 8]
call fcn.004051b4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
call fcn.0046f610
test al, al
je 0x46fd34
lea eax, [ebp - 0x10]
push eax
call dword [0x494fd0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46fd56
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d48
ret

Function at 0x4717bc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x47180d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4717f4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4717e4
jmp 0x47180d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4717f5
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4831d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x483291
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, 0x4832a8
call fcn.00487250
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x398]
call fcn.004474bc
lea edx, [ebp - 0xc]
mov eax, 0x4832c0
call fcn.00487250
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x39c]
call fcn.004474bc
xor edx, edx
mov eax, dword [ebx + 0x39c]
call fcn.004473ac
xor edx, edx
mov eax, dword [ebx + 0x368]
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor edx, edx
mov eax, dword [ebx + 0x36c]
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor edx, edx
mov eax, dword [ebx + 0x370]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [0x48d948]
mov eax, dword [eax]
call fcn.00465c58
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x482478
push 0
push 0
call sub.kernel32.dll_CreateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483298
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404d48
ret
Function at 0x485b00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051a4
xor eax, eax
push ebp
push 0x485be9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x485c00
call fcn.00405300
test eax, eax
jle 0x485b56
push dword [ebp - 4]
push 0x485c0c
lea eax, [ebp - 8]
call fcn.004879d4
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.004050b8
jmp 0x485b76
push dword [ebp - 4]
push 0x485c1c
lea eax, [ebp - 0xc]
call fcn.004879d4
push dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 3
call fcn.004050b8
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004051b4
push eax
push 0x485c24
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x485bce
push 5
push 0
push 0x485c34
push dword [ebp - 4]
push 0x485c34
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004050b8
mov eax, dword [ebp - 0x10]
call fcn.004051b4
push eax
push 0x485c38
push 0x485c44
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485bf0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404d48
ret

Function at 0x4860fc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
add esp, 0xffffffe8
mov esi, edx
mov ebx, eax
push 0x13
lea eax, [esp + 4]
push eax
push ebx
push 0x800
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jg 0x48611f
mov byte [esp], 0
mov eax, esi
mov edx, esp
mov ecx, 0x15
call fcn.00404f94
add esp, 0x18
pop esi
pop ebx
ret
Function at 0x486134
Capabilities:
Check http status code
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051a4
xor eax, eax
push ebp
push 0x486296
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
push 0x4862ac
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x486279
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0xc], 0
je 0x486262
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004051b4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x486262
xor edx, edx
push ebp
push 0x48625b
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x14], ebx
xor edx, edx
push ebp
push 0x486222
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x1c], 4
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x20000013
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_HttpQueryInfoA
mov eax, dword [ebp + 8]
cmp dword [eax], 0xc8
jne 0x486218
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetReadFile
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x486244
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486262
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486280
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
Function at 0x4869ac
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4869b4
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x486af0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404d24
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0040351c
mov eax, dword [ebp - 0x14]
call fcn.004051b4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x486ad5
mov eax, esi
call fcn.004030c0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.0040351c
mov eax, dword [ebp - 0x18]
call fcn.004051b4
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x486b00
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0040b658
push dword [ebx]
push 0x486b0c
mov eax, dword [edi + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b658
push dword [ebp - 0x1c]
mov eax, ebx
mov edx, 3
call fcn.004050b8
push dword [ebx]
push 0x486b0c
mov eax, dword [edi + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0040b658
push dword [ebp - 0x20]
mov eax, ebx
mov edx, 3
call fcn.004050b8
push dword [ebx]
push 0x486b0c
mov eax, dword [edi + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.0040b658
push dword [ebp - 0x24]
mov eax, ebx
mov edx, 3
call fcn.004050b8
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004030dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486af7
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00404d48
ret
Function at 0x4877a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051a4
mov eax, dword [ebp - 8]
call fcn.004051a4
xor eax, eax
push ebp
push 0x487964
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0040b2f8
cmp dword [ebp - 0x1c], 0
je 0x48793c
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.0040b2f8
cmp dword [ebp - 0x20], 0
je 0x48793c
lea eax, [ebp - 0xc]
call fcn.0048760c
xor esi, esi
push ebp
push 0x487935
push dword fs:[esi]
mov dword fs:[esi], esp
mov edx, dword [ebp - 0xc]
mov eax, 0x80000002
call fcn.0046fb8c
test al, al
je 0x487927
cmp byte [0x4950d0], 0
je 0x487846
call dword [0x4950e0]
lea eax, [ebp - 0x24]
mov ecx, 0x487980
mov edx, dword [ebp - 0xc]
call fcn.0040503c
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
mov eax, 0x80000002
call fcn.0046f958
mov eax, dword [ebp - 8]
test eax, eax
je 0x487872
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x18]
add ebx, ebx
mov eax, ebx
call fcn.004030c0
mov dword [ebp - 0x14], eax
xor esi, esi
push ebp
push 0x487911
push dword fs:[esi]
mov dword fs:[esi], esp
mov ecx, ebx
mov edx, 0x48d594
mov eax, dword [ebp - 0x14]
call fcn.0040bcbc
mov ecx, dword [ebp - 0x18]
dec ecx
test ecx, ecx
jl 0x4878cb
inc ecx
xor edx, edx
mov eax, 0x48d594
mov ebx, dword [ebp - 8]
movzx ebx, byte [ebx + edx]
xor bl, byte [eax]
mov esi, edx
add esi, esi
mov edi, dword [ebp - 0x14]
mov byte [edi + esi], bl
inc edx
add eax, 2
dec ecx
jne 0x4878b1
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
add eax, eax
push eax
lea eax, [ebp - 0x28]
mov ecx, 0x487994
mov edx, dword [ebp - 0xc]
call fcn.0040503c
mov edx, dword [ebp - 0x28]
mov ecx, 3
mov eax, 0x80000002
call fcn.0046f6c8
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487918
mov eax, dword [ebp - 0x14]
call fcn.004030dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48793c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48796b
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00404d48
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404d48
ret

Function at 0x4879a0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040bee0
add esp, 0x104
pop ebx
ret
Function at 0x487a44
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051a4
xor eax, eax
push ebp
push 0x487afd
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, 0x19
call fcn.004879a0
push dword [ebp - 8]
push 0x487b10
push dword [ebp - 4]
push 0x487b1c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004050b8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405658
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00404fac
mov eax, dword [ebp - 0x14]
call fcn.0040ba68
test al, al
je 0x487acd
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.00404fac
mov eax, dword [ebp - 0x18]
call fcn.004051b4
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487b04
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404d48
lea eax, [ebp - 0xc]
call fcn.004054d8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d48
ret
Function at 0x4064f0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46206b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00456ec8
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x406572
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00454e17
mov eax, dword [eax]
push 0x4791c0
push eax
call fcn.00447d14
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00457153
test bl, bl
je 0x406572
push 0x4791c0
lea ecx, [esp + 0xc]
call fcn.004574e3
push 0x47cd20
lea ecx, [esp + 0xc]
call fcn.004574e3
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4065ae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00457153
jmp 0x406679
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x406632
lea edx, [esp + 0x7c]
push 0x47cd1c
push edx
call fcn.00447d14
add esp, 8
test eax, eax
je 0x406632
lea eax, [esp + 0x7c]
push 0x47cd18
push eax
call fcn.00447d14
add esp, 8
test eax, eax
je 0x406632
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4065c2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00457153
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x406e70
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x406ed2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc