joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4542a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c1a11
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4f5038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 0
call fcn.00403630
mov ebx, eax
cmp dword [eax + 0x14], 8
jb 0x4542ec
mov ebx, dword [eax]
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x14], 0x25
test edx, edx
je 0x454400
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00404090
add esp, 4
test eax, eax
je 0x454400
sub eax, ebx
sar eax, 1
cmp eax, 0xffffffff
je 0x454400
push edi
lea ecx, [ebp - 0x2c]
call fcn.00403500
mov dword [ebp - 4], 1
mov ecx, edi
push 0
push 0
call fcn.00403360
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x45436a
push edi
mov ecx, esi
call fcn.00403500
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00403400
jmp 0x454416
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00494c99
mov edx, dword [ebp - 0x14]
add esp, 4
inc edx
mov ebx, eax
mov ecx, edi
push edx
push ebx
call fcn.00403360
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4543be
cmp eax, dword [ebp - 0x14]
ja 0x4543be
xor ecx, ecx
push ebx
mov word [ebx + eax*2], cx
call fcn.00403830
add esp, 4
lea ecx, [ebp - 0x2c]
push eax
push ebx
call fcn.004036d0
push ebx
call fcn.00494a99
add esp, 4
lea ecx, [ebp - 0x2c]
call fcn.00403630
push eax
call fcn.00403cd0
add esp, 4
mov ecx, esi
push eax
call fcn.00403ce0
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x2c]
push dword [ebp - 0x14]
push eax
call fcn.00403cd0
add esp, 4
mov ecx, esi
push eax
call fcn.00403980
jmp 0x454352
push edi
mov ecx, esi
call fcn.00403500
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004947ff
mov esp, ebp
pop ebp
ret 8
Function at 0x455010
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c1bdc
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x4f5038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x264]
push 0x208
push 0
push eax
mov dword [ebp - 0x5c], 0x61004d
mov ebx, 0x6c
mov dword [ebp - 0x58], 0x720063
mov dword [ebp - 0x54], 0x6d006f
mov dword [ebp - 0x50], 0x640065
mov dword [ebp - 0x4c], 0x46005c
mov dword [ebp - 0x48], 0x61006c
mov dword [ebp - 0x44], 0x680073
mov dword [ebp - 0x40], 0x46005c
mov dword [ebp - 0x3c], 0x61006c
mov dword [ebp - 0x38], 0x680073
mov dword [ebp - 0x34], 0x650048
mov dword [ebp - 0x30], 0x70006c
mov dword [ebp - 0x2c], 0x720065
mov dword [ebp - 0x28], 0x650053
mov dword [ebp - 0x24], 0x760072
mov dword [ebp - 0x20], 0x630069
mov dword [ebp - 0x1c], 0x2e0065
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.00496fd0
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x2c4]
call fcn.004034a0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x2ac]
call fcn.004034a0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x294]
push eax
call fcn.00408b50
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2ac]
call fcn.00403400
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c4]
call fcn.00403400
lea eax, [ebp - 0x294]
push eax
call fcn.004058a0
add esp, 4
test al, al
jne 0x455174
xor bl, bl
jmp 0x4551d6
lea edx, [ebp - 0x294]
lea ecx, [ebp - 0x27c]
call fcn.00474a60
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x27c]
call fcn.00403350
test al, al
je 0x45519c
xor bl, bl
jmp 0x4551c7
lea ecx, [ebp - 0x27c]
call fcn.00403630
cmp esi, eax
je 0x4551c5
call fcn.00403630
mov edx, eax
cmp dword [eax + 0x14], 8
jb 0x4551ba
mov edx, dword [eax]
push dword [eax + 0x10]
mov ecx, esi
push edx
call fcn.004036d0
mov bl, 1
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x27c]
call fcn.00403400
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x294]
call fcn.00403400
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004947ff
mov esp, ebp
pop ebp
ret 4
Function at 0x455210
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c1c4e
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x4f5038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x264]
push 0x208
push 0
push eax
mov dword [ebp - 0x5c], 0x61004d
mov ebx, 0x6c
mov dword [ebp - 0x58], 0x720063
mov dword [ebp - 0x54], 0x6d006f
mov dword [ebp - 0x50], 0x640065
mov dword [ebp - 0x4c], 0x46005c
mov dword [ebp - 0x48], 0x61006c
mov dword [ebp - 0x44], 0x680073
mov dword [ebp - 0x40], 0x46005c
mov dword [ebp - 0x3c], 0x61006c
mov dword [ebp - 0x38], 0x680073
mov dword [ebp - 0x34], 0x650048
mov dword [ebp - 0x30], 0x70006c
mov dword [ebp - 0x2c], 0x720065
mov dword [ebp - 0x28], 0x650053
mov dword [ebp - 0x24], 0x760072
mov dword [ebp - 0x20], 0x630069
mov dword [ebp - 0x1c], 0x2e0065
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.00496fd0
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.004034a0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x29c]
call fcn.004034a0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.00408b50
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x29c]
call fcn.00403400
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2b4]
call fcn.00403400
lea eax, [ebp - 0x27c]
push eax
call fcn.004058a0
add esp, 4
test al, al
je 0x455418
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 0x280], 0
call fcn.00494810
add esp, 4
mov dword [ebp - 0x284], eax
mov byte [ebp - 4], 5
mov dword [eax], 0
mov dword [eax], 0xffffffff
mov byte [ebp - 4], 4
mov dword [ebp - 0x280], eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x27c]
push 0x80
push 4
push 1
push 0x80000000
push eax
lea ecx, [ebp - 0x280]
call fcn.0040f690
test al, al
jne 0x45541c
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x280]
test esi, esi
je 0x455418
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x455403
test eax, eax
je 0x455403
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push 4
push esi
call fcn.00494840
add esp, 8
mov dword [ebp - 0x280], 0
xor bl, bl
jmp 0x455465
push esi
lea ecx, [ebp - 0x280]
call fcn.0040f840
mov bl, al
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x280]
test esi, esi
je 0x455465
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x455450
test eax, eax
je 0x455450
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push 4
push esi
call fcn.00494840
add esp, 8
mov dword [ebp - 0x280], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x27c]
call fcn.00403400
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004947ff
mov esp, ebp
pop ebp
ret 4
Function at 0x45bbb0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c257c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4f5038]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x10]
mov dword [ebp + 8], edi
mov dword [ebp - 4], 0
lea esi, [edi + 0x18]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 4
lea ecx, [esi + 0x48]
call fcn.00403400
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
call fcn.00403400
mov byte [ebp - 4], 2
lea ecx, [esi + 0x18]
call fcn.00403400
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00403400
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.00403400
push 0x88
push ebx
call fcn.00494840
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45f0b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2e59
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4f5038]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
call fcn.00403630
lea ecx, [ebp - 0xd]
mov byte [ebp - 0xd], 0
push ecx
push eax
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
call fcn.00401e50
add esp, 8
mov dword [ebp - 4], 0
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 1
test eax, eax
je 0x45f292
nop word [eax + eax]
dec eax
mov dword [ebp + 8], eax
mov al, byte [edi]
inc edi
mov byte [ebp + esi - 0x14], al
inc esi
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x20], edi
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp esi, 3
jne 0x45f1d4
mov al, cl
xor edi, edi
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, dl
shl cl, 4
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
mov byte [ebp - 0x16], cl
and al, 0x3f
mov ecx, 0x4f74f0
mov byte [ebp - 0x15], al
call fcn.00403630
mov esi, eax
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x45f1af
mov ecx, dword [esi]
movzx eax, byte [ebp + edi - 0x18]
movzx eax, byte [eax + ecx]
mov ecx, ebx
push eax
call fcn.00407f40
inc edi
cmp edi, 4
jl 0x45f1a5
mov edi, dword [ebp - 0x20]
xor esi, esi
mov dl, byte [ebp - 0xd]
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x45f140
mov dword [ebp + 8], esi
test esi, esi
je 0x45f292
mov eax, esi
cmp esi, 3
jge 0x45f20e
cmp eax, 3
jae 0x45f2a6
mov byte [ebp + eax - 0x14], 0
inc eax
cmp eax, 3
jl 0x45f1f4
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
xor edi, edi
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [esi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x45f278
mov ecx, 0x4f74f0
call fcn.00403630
mov esi, eax
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x45f25e
mov ecx, dword [esi]
movzx eax, byte [ebp + edi - 0x18]
movzx eax, byte [eax + ecx]
mov ecx, ebx
push eax
call fcn.00407f40
inc edi
cmp edi, dword [ebp - 0x20]
jl 0x45f254
mov esi, dword [ebp + 8]
cmp esi, 3
jge 0x45f292
mov edi, 3
sub edi, esi
push 0x3d
mov ecx, ebx
call fcn.00407f40
sub edi, 1
jne 0x45f284
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00494bbf
int3
Function at 0x461eb0
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x240]
sub esp, 0x240
push 0xffffffffffffffff
push 0x4c38f9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4f5038]
xor eax, ebp
mov dword [ebp + 0x23c], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp]
push str.Qingniao_Chrome
mov dword [ebp - 0x10], 0
call fcn.004034a0
mov dword [ebp - 4], 1
lea edx, [ebp]
lea ecx, [ebp + 0x18]
call fcn.00462700
mov byte [ebp - 4], 3
lea ecx, [ebp]
call fcn.00403400
lea ecx, [ebp + 0x18]
call fcn.00403350
test al, al
je 0x461f3e
push 0x4d6954
mov ecx, esi
call fcn.004034a0
jmp 0x461fd1
lea eax, [ebp + 0x18]
push eax
call fcn.004058a0
add esp, 4
test al, al
jne 0x461f55
push 0x4d6954
jmp 0x461fca
push 0x20a
lea eax, [ebp + 0x30]
push 0
push eax
call fcn.00496fd0
add esp, 0xc
lea ecx, [ebp + 0x18]
call fcn.00403360
push eax
push 0x104
lea eax, [ebp + 0x30]
push eax
push 0x4d6954
push str.Version
push str.AppLoadInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 0x4d6954
lea ecx, [ebp + 0x30]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x461fbd
test dx, dx
je 0x461fb9
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x461fbd
add ecx, 4
add eax, 4
test dx, dx
jne 0x461f97
xor eax, eax
jmp 0x461fc2
sbb eax, eax
or eax, 1
test eax, eax
je 0x461f4e
lea eax, [ebp + 0x30]
push eax
mov ecx, esi
call fcn.004034a0
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x18]
call fcn.00403400
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x23c]
xor ecx, ebp
call fcn.004947ff
lea esp, [ebp + 0x240]
pop ebp
ret

Function at 0x4624c0
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x228]
sub esp, 0x228
push 0xffffffffffffffff
push 0x4c39e1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4f5038]
xor eax, ebp
mov dword [ebp + 0x224], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp]
mov dword [ebp - 0x10], 0
call fcn.004625b0
mov dword [ebp - 4], 1
lea eax, [ebp]
push eax
call fcn.004058a0
add esp, 4
test al, al
jne 0x462533
push 0x4d6954
mov ecx, esi
call fcn.004034a0
jmp 0x462578
push 0x20a
lea eax, [ebp + 0x18]
push 0
push eax
call fcn.00496fd0
add esp, 0xc
lea ecx, [ebp]
call fcn.00403360
push eax
push 0x104
lea eax, [ebp + 0x18]
push eax
push 0x4d6954
push str.Version
push str.Upgrade
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp + 0x18]
mov ecx, esi
push eax
call fcn.004034a0
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.00403400
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.004947ff
lea esp, [ebp + 0x228]
pop ebp
ret
Function at 0x462860
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x258]
sub esp, 0x258
push 0xffffffffffffffff
push 0x4c3b08
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4f5038]
xor eax, ebp
mov dword [ebp + 0x254], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0x4d6954
call fcn.00403830
add esp, 4
mov ecx, esi
push eax
push 0x4d6954
call fcn.004036d0
mov edx, edi
lea ecx, [ebp]
call fcn.00462700
mov dword [ebp - 4], 0
lea ecx, [ebp]
call fcn.00403350
test al, al
jne 0x462a8b
lea eax, [ebp]
push eax
call fcn.004058a0
add esp, 4
test al, al
je 0x462a8b
push 0x20a
lea eax, [ebp + 0x48]
push 0
push eax
call fcn.00496fd0
add esp, 0xc
lea ecx, [ebp]
call fcn.00403360
push eax
push 0x104
lea eax, [ebp + 0x48]
push eax
push 0x4d6954
push str.Version
push str.AppLoadInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 0x4d6954
lea ecx, [ebp + 0x48]
nop
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x462956
test dx, dx
je 0x462952
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x462956
add ecx, 4
add eax, 4
test dx, dx
jne 0x462930
xor eax, eax
jmp 0x46295b
sbb eax, eax
or eax, 1
test eax, eax
je 0x462a8b
lea ecx, [ebp + 0x30]
call fcn.004034e0
mov byte [ebp - 4], 1
lea edx, [ebp + 0x30]
mov ecx, 0x1c
call fcn.00475160
test al, al
je 0x462a7c
lea ecx, [ebp + 0x30]
call fcn.00403350
test al, al
jne 0x462a7c
push edi
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x18]
push eax
call fcn.00408b50
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x30]
push eax
call fcn.00403460
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x18]
call fcn.00403400
push str.Application
lea ecx, [ebp + 0x18]
call fcn.004034a0
mov byte [ebp - 4], 3
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00408b50
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x30]
push eax
call fcn.00403460
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.00403400
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x18]
call fcn.00403400
lea eax, [ebp + 0x48]
push eax
lea ecx, [ebp + 0x18]
call fcn.004034a0
mov byte [ebp - 4], 5
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00408b50
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp + 0x30]
push eax
call fcn.00403460
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x24]
call fcn.00403400
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x18]
call fcn.00403400
lea eax, [ebp + 0x30]
push eax
call fcn.00405a40
add esp, 4
test al, al
je 0x462a7c
lea eax, [ebp + 0x30]
mov ecx, esi
push eax
call fcn.004033d0
mov bl, 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x30]
call fcn.00403400
jmp 0x462a8d
xor bl, bl
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x30]
call fcn.00403400
jmp 0x462a8d
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.00403400
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x254]
xor ecx, ebp
call fcn.004947ff
lea esp, [ebp + 0x258]
pop ebp
ret
Function at 0x470f50
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x470f5b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00470f70
Function at 0x474010
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x20
mov eax, dword [0x4f5038]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x10], eax
push edi
mov dword [esp + 0x18], ebx
mov byte [esp + 0x13], 0
mov eax, dword [esi]
mov eax, dword [eax + 4]
test eax, eax
je 0x4741e1
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegQueryValueExW
push eax
call ebp
mov dword [esp + 0x28], eax
test eax, eax
je 0x4741e1
mov ecx, dword [esi]
mov dword [esp + 0x1c], 0
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x4741e1
push str.RegOpenKeyExW
push ecx
call ebp
mov edi, eax
test edi, edi
je 0x4741e1
mov ecx, dword [esi]
lea eax, [esp + 0x1c]
push eax
mov ecx, dword [ecx]
or ecx, 0x20019
push ecx
mov ecx, dword [esp + 0x1c]
push 0
call fcn.00403360
push eax
push 0x80000001
call edi
test eax, eax
jne 0x4741e1
mov dword [esp + 0x20], eax
mov ecx, ebx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push 0
call fcn.00403360
push eax
push dword [esp + 0x30]
call dword [esp + 0x40]
movzx ebx, byte [esp + 0x13]
test eax, eax
mov eax, dword [esi]
mov ecx, 1
cmove ebx, ecx
mov eax, dword [eax + 4]
test eax, eax
je 0x474107
push str.RegCloseKey
push eax
call ebp
test eax, eax
je 0x474107
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x474107
push ecx
call eax
test bl, bl
je 0x4741e1
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.00473d90
test al, al
je 0x4741e1
mov edi, dword [esp + 0x20]
test edi, edi
je 0x4741ac
mov eax, dword [esi]
mov eax, dword [eax + 4]
test eax, eax
je 0x4741ac
push str.RegQueryValueExW
push eax
call ebp
mov ecx, dword [esi]
push str.RegDeleteValueW
mov dword [esp + 0x24], eax
push dword [ecx + 4]
call ebp
cmp dword [esp + 0x20], 0
mov ebx, eax
je 0x4741ac
test ebx, ebx
je 0x4741ac
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
push 0
lea eax, [esp + 0x2c]
mov dword [esp + 0x30], 0
push eax
push 0
mov dword [esp + 0x34], 0
call fcn.00403360
push eax
push edi
call dword [esp + 0x38]
cmp eax, 2
je 0x4741ac
mov ecx, dword [esp + 0x18]
call fcn.00403360
push eax
push edi
call ebx
test eax, eax
sete bl
jmp 0x4741ae
xor bl, bl
mov eax, dword [esi]
mov eax, dword [eax + 4]
test eax, eax
je 0x4741ca
push str.RegCloseKey
push eax
call ebp
test eax, eax
je 0x4741ca
test edi, edi
je 0x4741ca
push edi
call eax
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004947ff
add esp, 0x20
ret 0xc
mov ecx, dword [esp + 0x2c]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004947ff
add esp, 0x20
ret 0xc
Function at 0x475160
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xfffffffffffffffe
push 0x4efef8
push 0x495f30
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4f5038]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00403630
mov dword [ebp - 0x24], 0
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x4751d2
mov eax, dword [eax]
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.00403a50
add esp, 8
mov edx, esi
mov ecx, edi
call fcn.004752c0
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x475211
test bl, bl
jne 0x475294
cmp edi, 0x1a
jne 0x475294
mov ecx, esi
call fcn.00403630
mov dword [ebp - 0x20], 0
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x475237
mov eax, dword [eax]
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.00403a50
push 0x410
push 0
lea eax, [ebp]
push eax
call fcn.00496fd0
add esp, 0x14
push 0x207
lea eax, [ebp]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp]
push eax
call fcn.00403830
add esp, 4
push eax
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004036d0
mov ecx, esi
call fcn.00403350
movzx ebx, bl
mov ecx, 1
test al, al
cmove ebx, ecx
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.004947ff
lea esp, [ebp + 0x414]
pop ebp
ret

Function at 0x475460
Capabilities:
Query environment variable

Disassembly:
mov edx, dword [esp + 4]
mov ecx, 0x1a
jmp fcn.00475160