joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cc90
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0xa0
lea eax, [ebp - 0xa8]
mov ebx, ecx
push 0
push eax
call fcn.004ad600
add esp, 0xc
push str.KB4TestSvc
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40cd44
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str._s_failed_with_0x_X
lea eax, [ebp - 0xa8]
push 0x50
push eax
call fcn.0040c8a0
add esp, 0x14
mov dword [ebp - 0xb0], str.KB4TestSvc
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0xb0]
push 0
push eax
push 0
push 2
push 0
push 0xc0020001
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test eax, eax
jne 0x40cd44
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_deregister_event_source:0x_X
push 1
call fcn.00408d60
add esp, 0xc
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004ac4d4
mov esp, ebp
pop ebp
ret
Function at 0x424850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov al, byte [esi + 0x44]
test al, al
js 0x42494a
xor ebx, ebx
test al, al
jle 0x4248e7
lea ecx, [esi + 0x78]
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x4248ce
mov eax, dword [ecx + 0x14]
dec dword [eax + 0x78]
mov edx, dword [eax + 0x88]
mov dword [ecx + 0x10], edx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.004c2a20
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [esp + 0x24]
add esp, 0x10
jmp 0x4248d3
call fcn.0041a3d0
mov ecx, dword [esp + 0x10]
inc ebx
movsx eax, byte [esi + 0x44]
add ecx, 4
mov dword [esp + 0x10], ecx
cmp ebx, eax
jl 0x424880
mov eax, dword [esi + 0x74]
mov edx, dword [eax + 0x48]
test byte [edx + 0x1c], 0x20
je 0x42493f
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.004c2a20
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [esp + 0x24]
add esp, 0x10
mov byte [esi + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.0041a3d0
mov byte [esi + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4294c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov esi, ecx
mov eax, edx
mov ecx, dword [ebp + 8]
push edi
mov dword [esp + 0x18], ecx
xor edi, edi
cmp byte [esi + 0x11], 0
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], ecx
je 0x4295aa
mov edi, dword [esp + 0x10]
lea esi, [eax + 1]
lea ebx, [esi - 2]
cmp esi, 2
jae 0x429510
xor edx, edx
jmp 0x42953f
mov eax, 0xcccccccd
mul dword [edi + 0x24]
mov eax, ebx
mov ecx, edx
xor edx, edx
shr ecx, 2
inc ecx
div ecx
mov eax, dword [0x4da850]
mov ecx, ebx
sub ecx, edx
xor edx, edx
div dword [edi + 0x20]
xor edx, edx
dec eax
cmp ecx, eax
sete dl
add edx, 2
add edx, ecx
cmp edx, esi
je 0x429552
mov eax, dword [0x4da850]
xor edx, edx
div dword [edi + 0x20]
inc eax
cmp esi, eax
jne 0x429556
inc esi
inc ebx
jmp 0x429507
cmp esi, dword [edi + 0x2c]
mov edi, 0
ja 0x4295a0
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x13]
mov edx, esi
push eax
call fcn.00424fc0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x42960c
cmp byte [esp + 0xf], 4
mov edx, dword [esp + 0x14]
jne 0x42959a
cmp dword [esp + 0x20], edx
jne 0x42959a
mov eax, esi
lea ebx, [edi + 0x65]
jmp 0x42960e
mov esi, dword [esp + 0x10]
jmp 0x4295ac
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
jmp 0x4295ac
mov edx, eax
mov ecx, dword [esi]
xor eax, eax
cmp dword [esp + 0x18], eax
mov ebx, 2
cmove eax, ebx
push eax
lea eax, [esp + 0x24]
push eax
mov eax, dword [ecx + 0xc8]
push edx
push ecx
call eax
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x42960c
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov edi, dword [edx + 8]
cmp ecx, dword [edi + 4]
je 0x429601
mov eax, dword [edx + 4]
cmp ecx, 1
mov dword [edi + 0x38], eax
setne al
mov dword [edi + 0x48], edx
dec al
mov dword [edi + 0x34], esi
and al, 0x64
mov dword [edi + 4], ecx
mov byte [edi + 9], al
mov eax, dword [edi + 0x38]
xor ebx, ebx
mov eax, dword [eax]
bswap eax
jmp 0x42960e
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x429620
mov dword [eax], edi
jmp 0x429673
test edi, edi
je 0x429673
mov edx, dword [edi + 0x48]
test byte [edx + 0x1c], 0x20
je 0x42966c
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.004c2a20
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
jmp 0x429673
mov ecx, edx
call fcn.0041a3d0
mov ecx, dword [esp + 0x24]
xor eax, eax
cmp ebx, 0x65
pop edi
cmove ebx, eax
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004ac4d4
mov esp, ebp
pop ebp
ret
Function at 0x42bba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ebx, edx
push edi
push ebx
mov eax, dword [esi + 0x50]
push esi
call eax
movzx eax, word [edi + 0x10]
add esp, 0xc
mov edx, dword [edi + 0xc]
mov dword [esp + 0x14], eax
cmp eax, edx
je 0x42bd7f
movzx edi, word [edi + 0x12]
movzx ecx, word [esi + 0x18]
add ecx, dword [esi + 0x38]
lea eax, [edi - 1]
add eax, ebx
cmp eax, ecx
jbe 0x42bc0f
push 0x4d6ad4
push 0x10135
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.00412760
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esi + 0x34]
sub edx, dword [esp + 0x14]
mov edi, dword [edi + ebx - 4]
bswap edi
mov ecx, dword [esi + 0x24]
sub ecx, 4
mov dword [esp + 0xc], esi
lea eax, [edx - 1]
xor edx, edx
add eax, ecx
div ecx
mov ebx, eax
test ebx, ebx
je 0x42bd7f
nop dword [eax]
dec ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
cmp edi, 2
jb 0x42bd55
cmp edi, dword [esi + 0x2c]
ja 0x42bd55
test ebx, ebx
je 0x42bc91
lea eax, [esp + 0x14]
mov edx, edi
push eax
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.004294c0
add esp, 8
test eax, eax
jne 0x42bd81
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x42bca0
mov esi, dword [esp + 0xc]
mov edx, edi
mov ecx, esi
call fcn.004261c0
mov esi, eax
test esi, esi
je 0x42bcd2
mov ecx, dword [esi + 0x48]
cmp word [ecx + 0x1e], 1
je 0x42bcd2
push 0x4d6ad4
push 0x1015a
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.00412760
add esp, 0x14
mov dword [esp + 0x10], 0xb
jmp 0x42bce5
mov ecx, dword [esp + 0xc]
mov edx, esi
push edi
call fcn.0042b600
add esp, 4
mov dword [esp + 0x10], eax
test esi, esi
je 0x42bd3c
mov edx, dword [esi + 0x48]
test edx, edx
je 0x42bd3c
test byte [edx + 0x1c], 0x20
je 0x42bd35
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.004c2a20
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
jmp 0x42bd3c
mov ecx, edx
call fcn.0041a3d0
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x42bd81
mov edi, dword [esp + 0x14]
test ebx, ebx
je 0x42bd7f
mov esi, dword [esp + 0xc]
jmp 0x42bc40
push 0x4d6ad4
push 0x10146
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.00412760
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x445db0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov eax, ecx
mov ebx, edx
push edi
push 0
push 0x14
mov dword [ebp - 4], ebx
mov dword [ebp - 8], eax
mov dword [eax], 0
call fcn.0040fd60
mov esi, eax
add esp, 8
test esi, esi
jne 0x445de5
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x4d9a9c], 0
je 0x445e30
mov eax, dword [0x4d9b9c]
test eax, eax
je 0x445e05
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x445e30
mov eax, dword [ebp + 8]
lea edi, [esi + 8]
mov dword [edi], ebx
lea ebx, [esi + 4]
push ebx
push 0
push esi
push 0x412b30
push 0
push 0
mov dword [esi + 0xc], eax
call fcn.004b41ba
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x445e43
jmp 0x445e36
lea edi, [esi + 8]
lea ebx, [esi + 4]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [edi], 0
jne 0x445e5c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push dword [ebp + 8]
mov dword [ebx], eax
call dword [ebp - 4]
add esp, 4
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 8]
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ae00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ecx + 0x10]
mov dword [ebp - 4], edx
push edi
mov ebx, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], eax
mov esi, eax
nop dword [eax]
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ecx + 0x14], eax
jle 0x45aea9
nop word [eax + eax]
mov edi, eax
xor edi, 1
cmp eax, 2
cmovge edi, eax
mov eax, dword [ebp + 8]
add edi, edi
test eax, eax
je 0x45aef7
mov ecx, dword [esi]
mov ebx, eax
mov edx, dword [ecx + edi*8]
mov bl, byte [ebx]
movzx ecx, bl
movzx esi, byte [ecx + 0x4cf348]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x4cf348]
sub esi, ecx
jne 0x45ae94
sub edx, eax
mov dword [ebp - 0x10], edx
nop
test bl, bl
je 0x45aeea
movzx ecx, byte [edx + eax + 1]
inc eax
movzx edx, byte [ecx + 0x4cf348]
mov bl, byte [eax]
movzx ecx, bl
movzx esi, byte [ecx + 0x4cf348]
sub esi, edx
mov edx, dword [ebp - 0x10]
je 0x45ae70
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
inc eax
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp eax, dword [ecx + 0x14]
jl 0x45ae30
mov dl, byte [ebx]
movzx eax, dl
cmp byte [eax + 0x4cf348], 0x73
jne 0x45aee1
mov esi, str.sqlite_master
sub esi, ebx
nop
test dl, dl
je 0x45af15
movzx eax, byte [esi + ebx + 1]
inc ebx
movzx ecx, byte [eax + 0x4cf348]
mov dl, byte [ebx]
movzx eax, dl
movzx eax, byte [eax + 0x4cf348]
sub eax, ecx
je 0x45aec0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x45ae94
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
add esi, 0x10
mov eax, dword [esi]
mov edx, ebx
push 0
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
call fcn.00414a50
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x45aee3
jmp 0x45ae97
mov esi, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add esi, 0x10
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
test ecx, ecx
jne 0x45af2d
neg eax
sbb eax, eax
jmp 0x45af38
test eax, eax
je 0x45aee1
mov edx, eax
call fcn.004135a0
test eax, eax
jne 0x45aee1
mov ecx, dword [ebp - 8]
mov ebx, str.sqlite_temp_master
mov dword [ebp - 4], ebx
jmp 0x45ae20
Function at 0x45b0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 0x10], edx
xor edx, edx
mov dword [ebp - 0x14], eax
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [eax + 0x14], edx
jle 0x45b195
push ebx
push esi
mov eax, dword [eax + 0x10]
mov ecx, edi
xor ecx, 1
cmp edi, 2
cmovge ecx, edi
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
test edx, edx
je 0x45b176
mov ebx, dword [eax + ecx*8]
mov esi, edx
mov al, byte [edx]
movzx ecx, byte [ebx]
movzx edx, byte [ecx + 0x4cf348]
movzx ecx, al
movzx ecx, byte [ecx + 0x4cf348]
sub ecx, edx
jne 0x45b161
sub ebx, esi
test al, al
je 0x45b176
movzx ecx, byte [ebx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x4cf348]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x4cf348]
sub ecx, edx
je 0x45b140
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
inc edi
cmp edi, dword [eax + 0x14]
jl 0x45b101
pop esi
pop ebx
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
add ecx, 0x18
push 0
call fcn.00414a50
add esp, 4
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x45b16d
jmp 0x45b164
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4acdab
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4acdea
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4acdea
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4acdea
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4acdea
cmp dword [ecx + 0x74], 0xe
jbe 0x4acdea
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4b7b58
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4c6534
push 0x4c652c
push str.FlsAlloc
push 0x1f
call fcn.004b79d7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b7b8c
push dword [ebp + 8]
mov ecx, esi
call dword [0x4c42d4]
call esi
jmp 0x4b7b92
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4b7bd6
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4c6544
push 0x4c653c
push str.FlsGetValue
push 0x21
call fcn.004b79d7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b7c0d
push dword [ebp + 8]
mov ecx, esi
call dword [0x4c42d4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4b7c15
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4c654c
push 0x4c6544
push str.FlsSetValue
push 0x22
call fcn.004b79d7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b7c4f
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4c42d4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4ba494
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4ba531
push ebx
push esi
call fcn.004ba45d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004ba3f1
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4ba4de
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4ba530
push edi
push eax
call fcn.004b5bf2
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4ba4fe
call fcn.004b5bb8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4ba52f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004ba3f1
add esp, 0x20
test eax, eax
jne 0x4ba51d
push edi
call fcn.004b5bb8
jmp 0x4ba525
push ebx
call fcn.004b5bb8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4ba534
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4ba545
pop esi
ret
push ebx
push edi
push esi
call fcn.004ba45d
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004b5bf2
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4ba56d
push ebx
push esi
push edi
call fcn.004ae080
add esp, 0xc
push 0
call fcn.004b5bb8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4bacc7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ba7e2
Function at 0x4c2830
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4c285d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4c285d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401491
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x42a610]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x401526
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x4014e3
cmp dword [ebp + 0x10], ebx
jne 0x40151a
push ebx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call fcn.00401491
test eax, eax
jne 0x4014f5
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014ca
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405eee
cmp eax, ebx
je 0x40152d
push ebx
push dword [0x42a610]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x401526
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a610], ebx
jne 0x401523
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x401523
jmp 0x401526
Function at 0x402ecd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
push esi
je 0x402f92
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x402f92
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x402ef6
xor eax, eax
inc eax
jmp 0x402f94
cmp dword [0x41c9a8], 0
jne 0x402f5b
push 0xa
push str.MMAABBCCZZ
push ebx
call fcn.00402e74
add esp, 0xc
test eax, eax
jne 0x402f5b
push dword [0x41c998]
mov byte [0x41c99c], 1
call fcn.00402e55
pop ecx
mov dword [0x41c9a0], eax
test eax, eax
je 0x402f92
push edi
lea edi, [esi - 0xa]
push edi
add ebx, 0xa
push ebx
push eax
mov dword [0x41c9a4], eax
call fcn.00405be9
add dword [0x41c9a4], edi
pop edi
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x402f53
mov dword [eax], esi
inc dword [0x41c9a8]
jmp 0x402eee
cmp byte [0x41c99c], 0
je 0x402f79
push esi
push ebx
push dword [0x41c9a4]
call fcn.00405be9
add dword [0x41c9a4], esi
jmp 0x402f4a
push dword [ebp + 0x18]
inc dword [0x41c9a8]
push dword [ebp + 0x14]
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x402f94
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x402f98
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push edi
xor edi, edi
mov dword [ebp - 4], ebx
cmp byte [0x41c99c], bl
je 0x40301b
cmp dword [0x41c9a0], ebx
je 0x40301b
cmp dword [ebp + 0xc], ebx
je 0x402ff3
push esi
call fcn.00407556
mov esi, dword [0x41c998]
add esi, 0xfffffff6
push esi
push dword [0x41c9a0]
call fcn.00407565
cmp eax, esi
pop ecx
pop ecx
jge 0x402ff2
push ebx
lea eax, [ebp - 4]
push eax
push esi
push dword [0x41c9a0]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
pop esi
mov eax, dword [0x41c9a0]
cmp eax, ebx
je 0x40301b
push eax
call fcn.00402e62
pop ecx
mov dword [0x41c9a0], ebx
mov dword [0x41c9a4], ebx
mov byte [0x41c99c], bl
mov dword [0x41c998], ebx
mov eax, edi
pop edi
pop ebx
leave
ret
Function at 0x40310c
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x4209b0]
sub esi, dword [0x4209bc]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x1f4
xor ebx, ebx
cmp esi, ebx
mov dword [0x42a580], eax
jle 0x40326a
push dword [0x4209b8]
call fcn.004030f5
push ebx
push ebx
push dword [0x4209bc]
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41c9ac], esi
mov dword [0x40c90c], ebx
mov ebp, 0x414998
mov eax, dword [0x4209b4]
sub eax, dword [0x4209b8]
mov edi, 0x4000
cmp eax, edi
jg 0x403181
mov edi, eax
push edi
mov esi, 0x41c9b0
push esi
call fcn.004030c3
test eax, eax
je 0x40327c
add dword [0x4209b8], edi
mov dword [0x414928], esi
mov dword [0x41492c], edi
cmp dword [0x42a52c], ebx
je 0x4031d8
cmp dword [0x42a600], ebx
jne 0x4031d8
mov eax, dword [0x41c9ac]
sub eax, dword [0x4209b0]
push ebx
sub eax, dword [esp + 0x1c]
add eax, dword [0x4209bc]
mov dword [0x40c90c], eax
call fcn.00403021
pop ecx
mov ecx, 0x414910
mov dword [0x414930], ebp
mov dword [0x414934], 0x8000
call fcn.00406af6
test eax, eax
jl 0x403281
mov esi, dword [0x414930]
sub esi, ebp
je 0x403236
push ebx
lea eax, [esp + 0x14]
push eax
push esi
push ebp
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403286
cmp esi, dword [esp + 0x10]
jne 0x403286
add dword [0x4209bc], esi
cmp dword [0x41492c], ebx
jne 0x4031a7
jmp 0x403242
cmp dword [0x41492c], ebx
jne 0x403281
cmp edi, ebx
je 0x403281
mov eax, dword [0x4209b0]
mov ecx, eax
sub ecx, dword [0x4209bc]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x40316b
push ebx
push ebx
push eax
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
call fcn.00403021
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
or eax, 0xffffffff
jmp 0x403274
push 0xfffffffffffffffd
pop eax
jmp 0x403274
push 0xfffffffffffffffe
jmp 0x403283
Function at 0x40328a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x4032b6
mov ecx, dword [0x42a578]
push edi
add eax, ecx
push edi
push eax
push dword [0x40a014]
mov dword [0x4209b0], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.0040310c
cmp eax, edi
jl 0x4033dc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 8]
push eax
push dword [0x40a014]
call ebx
test eax, eax
je 0x4033d8
cmp dword [ebp - 4], esi
jne 0x4033d8
push dword [ebp + 8]
add dword [0x4209b0], esi
call fcn.0040310c
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x4033db
cmp dword [ebp + 0x10], edi
jne 0x4033a7
push dword [ebp + 8]
call fcn.00402eac
add esp, 4
cmp dword [ebp + 8], edi
jle 0x403389
mov esi, 0x41c9b0
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x403335
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [0x40a014]
call ebx
test eax, eax
je 0x4033d8
cmp edi, dword [ebp - 4]
jne 0x4033d8
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ecd
add esp, 0x14
test eax, eax
je 0x403397
cmp dword [ebp + 0x14], edi
jne 0x403397
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x4209b0], eax
cmp dword [ebp + 8], 0
jg 0x403328
push 1
push dword [ebp + 0xc]
call fcn.00402f98
pop ecx
pop ecx
jmp 0x4033d3
push 0
push dword [ebp + 0xc]
call fcn.00402f98
pop ecx
pop ecx
push 0xfffffffffffffffe
jmp 0x4033da
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x4033b2
mov eax, dword [ebp + 0x14]
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a014]
call ebx
test eax, eax
je 0x4033d8
mov eax, dword [ebp - 4]
add dword [0x4209b0], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4033db
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop esi
leave
ret 0x10