joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414e6d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040cd6a
and dword [ebp - 4], 0
cmp dword [0x424430], 0
mov ebx, eax
jne 0x414f1e
push 0x41cbc4
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x414fcf
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x41cbb8
push edi
call esi
test eax, eax
je 0x414fcf
push eax
call fcn.0040ccf8
mov dword [esp], 0x41cba8
push edi
mov dword [0x424430], eax
call esi
push eax
call fcn.0040ccf8
mov dword [esp], 0x41cb94
push edi
mov dword [0x424434], eax
call esi
push eax
call fcn.0040ccf8
mov dword [esp], 0x41cb78
push edi
mov dword [0x424438], eax
call esi
push eax
call fcn.0040ccf8
pop ecx
mov dword [0x424440], eax
test eax, eax
je 0x414f1e
push 0x41cb60
push edi
call esi
push eax
call fcn.0040ccf8
pop ecx
mov dword [0x42443c], eax
mov eax, dword [0x42443c]
cmp eax, ebx
je 0x414f76
cmp dword [0x424440], ebx
je 0x414f76
push eax
call fcn.0040cd73
push dword [0x424440]
mov esi, eax
call fcn.0040cd73
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x414f76
test edi, edi
je 0x414f76
call esi
test eax, eax
je 0x414f6d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x414f6d
test byte [ebp - 0xc], 1
jne 0x414f76
or dword [ebp + 0x10], 0x200000
jmp 0x414faf
mov eax, dword [0x424434]
cmp eax, ebx
je 0x414faf
push eax
call fcn.0040cd73
pop ecx
test eax, eax
je 0x414faf
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x414faf
mov eax, dword [0x424438]
cmp eax, ebx
je 0x414faf
push eax
call fcn.0040cd73
pop ecx
test eax, eax
je 0x414faf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x424430]
call fcn.0040cd73
pop ecx
test eax, eax
je 0x414fcf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x414fd1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x438c96
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x438a14
mov edx, 0x68d2d18d
add ecx, ecx
call fcn.00438cce
and edx, ecx
xor dword [eax], ebx
or edx, edx
and edx, ecx
add ecx, 0x2254e9ea
inc eax
and ecx, edx
dec ecx
cmp eax, edi
jne fcn.00438c96
sub edx, edx
add edx, edx
push 0x66b9daa1
pop edx
ret
Function at 0x4629c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
lea eax, [esp + 4]
push edi
xor esi, esi
push eax
push 0x20019
push esi
push ecx
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x462a3b
mov ecx, dword [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
push eax
push esi
push esi
push esi
push esi
push ecx
call edi
test eax, eax
jne 0x462a3b
mov edx, dword [esp + 0x14]
mov ecx, 0x4ba850
push edx
call fcn.00417490
mov ecx, dword [esp + 8]
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
push 0
push 0
push 0
push ecx
call edi
test eax, eax
je 0x462a3b
push esi
mov ecx, 0x4ba850
call fcn.00417540
xor esi, esi
mov eax, dword [esp + 8]
test eax, eax
je 0x462a4a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ecx
ret

Function at 0x462b24
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x54
push ebx
push ebp
push esi
push edi
push str._shellopencommand
push eax
xor ebp, ebp
xor esi, esi
xor edi, edi
call fcn.004152e0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x462b8f
push ebx
push 0x80000000
call fcn.004629c0
mov esi, eax
add esp, 8
test esi, esi
je 0x462b8f
mov ecx, dword [esp + 0x6c]
push ecx
push esi
call fcn.00462a50
mov edi, eax
add esp, 8
test edi, edi
je 0x462b8f
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x462b8f
mov edx, dword [esp + 0x10]
mov ebp, 1
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
mov ecx, 0x4ba850
call fcn.00417540
push esi
mov ecx, 0x4ba850
call fcn.00417540
push edi
mov ecx, 0x4ba850
call fcn.00417540
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x54
ret

Function at 0x4637d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
push esi
push eax
mov esi, str.Windows
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x14]
dec eax
je 0x463841
dec eax
jne 0x46385f
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x46382d
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x46381a
mov esi, str.Windows_XP
mov eax, esi
pop esi
add esp, 0x94
ret
test eax, eax
jne 0x46385f
mov esi, str.Windows_2000
mov eax, esi
pop esi
add esp, 0x94
ret
cmp eax, 4
jne 0x46385f
mov esi, str.Windows_NT
mov eax, esi
pop esi
add esp, 0x94
ret
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x463858
mov esi, str.Windows_98_ME
mov eax, esi
pop esi
add esp, 0x94
ret
jne 0x46385f
mov esi, str.Windows_95
mov eax, esi
pop esi
add esp, 0x94
ret

Function at 0x463870
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push eax
call fcn.00463880
add esp, 4
ret
Function at 0x463ac0
Capabilities:
Identify system language via api

Disassembly:
push esi
call fcn.004637d0
mov esi, eax
call fcn.00463870
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push str.point
push 0x4b2d04
push 0x4af53c
push 0x48
push 1
call esi
push eax
push 0
call esi
push eax
call fcn.004639d0
push eax
mov eax, dword [esp + 0x2c]
push str.M_sR_dx_dDP_dCOL_sAR_sI_sOS_sL_s
push eax
call fcn.004154c0
add esp, 0x2c
pop esi
ret

Function at 0x463f60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
ret

Function at 0x463fe0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x463ffe
shr eax, 4
and al, 1
pop ebx
add esp, 0xc
ret
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], eax
mov edi, ecx
mov dword [esp + 0x10], eax
test edi, edi
mov dword [esp + 0x14], eax
jle 0x46404b
cmp byte [esi + ebx], 0x5c
jne 0x464037
test esi, esi
je 0x464037
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov cl, byte [esi + ebx]
push ecx
lea ecx, [esp + 0x10]
call fcn.00414c50
inc esi
cmp esi, edi
jl 0x464020
test edi, edi
je 0x46405d
cmp byte [edi + ebx - 1], 0x5c
je 0x46405d
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edx, dword [esp + 0xc]
mov ebx, eax
shr ebx, 4
push edx
mov ecx, 0x4ba850
and bl, 1
call fcn.00417540
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x4640e0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp]
push 0
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret

Function at 0x464110
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp]
push 0
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp]
pop ecx
ret

Function at 0x464160
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push ebx
push 0
lea ecx, [esp + 0xc]
push eax
push ecx
xor bl, bl
call fcn.00464090
add esp, 0xc
test al, al
je 0x46419d
mov edx, dword [esp + 8]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push edx
mov bl, 1
mov dword [ecx], eax
call fcn.00464140
add esp, 4
mov al, bl
pop ebx
ret
Function at 0x4641b0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
lea eax, [esp]
push esi
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x400
mov dword [esp + 0x20], 2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x464230
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push esi
push 0x4b2d28
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x464225
mov ecx, dword [esp + 0x414]
lea edx, [esp + 0x10]
push edx
call fcn.00414e80
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
add esp, 0x40c
ret

Function at 0x466600
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push 2
mov esi, ecx
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ebx, eax
test ebx, ebx
jl 0x466687
cmp ebx, 0xff
jg 0x466687
cmp ebx, 0x7f
jle 0x46662b
mov al, bl
pop esi
pop ebx
ret 4
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
mov al, byte [esi + 9]
je 0x46665c
test al, al
je 0x466680
push ebx
call fcn.00415660
add esp, 4
test al, al
je 0x466660
xor ecx, ecx
pop esi
mov cl, byte [ebx + 0x4a4328]
xor ebx, ecx
mov al, bl
pop ebx
ret 4
test al, al
je 0x466676
push ebx
mov ecx, esi
call fcn.004664d0
and eax, 0xff
pop esi
mov ebx, eax
mov al, bl
pop ebx
ret 4
xor edx, edx
mov dl, byte [ebx + 0x4a4328]
xor ebx, edx
mov al, bl
pop esi
pop ebx
ret 4
mov al, byte [esp + 0xc]
pop esi
pop ebx
ret 4
Function at 0x469400
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [ecx + 0x10cc]
xor bl, bl
call dword [sym.imp.USER32.dll_GetFocus]
cmp esi, eax
jne 0x46942a
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
pop esi
pop ebx
setl al
ret 4
mov al, bl
pop esi
pop ebx
ret 4

Function at 0x469470
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x4bb3d4]
sub esp, 0x190
cmp eax, 1
push esi
jne 0x469489
pop esi
add esp, 0x190
ret
cmp eax, 2
je 0x4695d8
push str.WSOCK32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4695ce
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WSACleanup
push esi
call edi
push str.WSAStartup
push esi
mov dword [0x4bb390], eax
call edi
push str.listen
push esi
mov dword [0x4bb394], eax
call edi
push str.closesocket
push esi
mov dword [0x4bb398], eax
call edi
push str.bind
push esi
mov dword [0x4bb39c], eax
call edi
push str.htons
push esi
mov dword [0x4bb3a0], eax
call edi
push str.htonl
push esi
mov dword [0x4bb3a4], eax
call edi
push str.socket
push esi
mov dword [0x4bb3a8], eax
call edi
push str.WSAAsyncSelect
push esi
mov dword [0x4bb3ac], eax
call edi
push str.accept
push esi
mov dword [0x4bb3b0], eax
call edi
push str.WSAGetLastError
push esi
mov dword [0x4bb3b4], eax
call edi
push str.WSAAsyncGetHostByName
push esi
mov dword [0x4bb3b8], eax
call edi
push str.inet_addr
push esi
mov dword [0x4bb3bc], eax
call edi
push str.connect
push esi
mov dword [0x4bb3c0], eax
call edi
push str.send
push esi
mov dword [0x4bb3c4], eax
call edi
push str.recv
push esi
mov dword [0x4bb3c8], eax
call edi
push str.WSACancelAsyncRequest
push esi
mov dword [0x4bb3cc], eax
call edi
mov dword [0x4bb3d0], eax
lea eax, [esp + 8]
push eax
push 0x101
call dword [0x4bb394]
test eax, eax
pop edi
jne 0x4695ce
mov ax, word [esp + 4]
cmp al, 1
jne 0x4695c8
xor ecx, ecx
mov cl, ah
cmp cl, al
jne 0x4695c8
mov dword [0x4bb3d4], 1
mov eax, 1
pop esi
add esp, 0x190
ret
call dword [0x4bb390]
mov dword [0x4bb3d4], 2
xor eax, eax
pop esi
add esp, 0x190
ret
Function at 0x469640
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x10
xor eax, eax
push ebp
mov dword [esp + 4], eax
mov ebp, ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], eax
push esi
push edi
mov dword [esp + 0x14], eax
push ecx
mov dword [esp + 0x1c], eax
mov word [esp + 0x10], 2
call sub.WSOCK32.dll_htons
mov edi, dword [esp + 0x20]
mov word [esp + 0xe], ax
cmp byte [edi], 0
je 0x469701
push ebx
mov esi, 0x4af910
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4696ad
test cl, cl
je 0x4696a9
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4696ad
add eax, 2
add esi, 2
test cl, cl
jne 0x469685
xor eax, eax
jmp 0x4696b2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
je 0x469701
push edi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x46970f
push edi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x4696db
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x10
ret 0x10
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
lea edi, [esp + 0x10]
mov esi, dword [edx]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ax, word [eax + 8]
mov word [esp + 0xc], ax
jmp 0x46970f
push 0x7f000001
call sub.WSOCK32.dll_htonl
mov dword [esp + 0x10], eax
mov edx, dword [ebp]
lea ecx, [esp + 0xc]
push 0x10
push ecx
push edx
call dword [0x4bb3c4]
test eax, eax
je 0x46972f
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x10
ret 0x10
mov al, byte [esp + 0x28]
test al, al
jne 0x469753
mov ecx, dword [ebp]
lea eax, [esp + 0x28]
push 4
push eax
push 1
push 6
push ecx
mov dword [esp + 0x3c], 1
call sub.WSOCK32.dll_setsockopt
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x10
ret 0x10
Function at 0x46b010
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x46b189
mov eax, dword [ebp]
push esi
push eax
mov ecx, 0x4ba850
call fcn.00417540
mov eax, dword [esp + 0xc]
mov dword [ebp], 0
cmp eax, 5
jle 0x46b0ff
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x46b074
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x46b0a0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
push eax
call fcn.00457660
add esp, 8
jmp 0x46b096
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x46b0a0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
push 6
push eax
call fcn.004577a0
add esp, 0xc
push esi
mov dword [ebp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [ebp]
test esi, esi
je 0x46b17b
cmp byte [esi], 0
je 0x46b17b
lea ecx, [esp + 0xc]
push ecx
push esi
call fcn.00457190
add esp, 8
cmp word [esp + 0xc], 0xd
jne 0x46b0ea
mov cl, byte [esi]
mov eax, esi
test cl, cl
je 0x46b0e5
mov cl, byte [eax + 1]
test cl, cl
je 0x46b0e5
mov dl, cl
mov byte [eax], dl
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x46b0d2
mov byte [eax], 0
jmp 0x46b0ec
add esi, eax
cmp byte [esi], 0
jne 0x46b0b4
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp]
pop esi
pop ebp
ret 4
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x46b149
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, 0x4ba850
call fcn.00417490
mov edx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [ebp]
test eax, eax
je 0x46b17b
mov ecx, eax
mov al, byte [ecx]
test al, al
je 0x46b17b
cmp al, 0xd
jne 0x46b174
mov eax, ecx
mov dl, byte [eax + 1]
test dl, dl
je 0x46b16f
mov byte [eax], dl
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x46b15e
mov byte [eax], 0
jmp 0x46b175
inc ecx
mov al, byte [ecx]
test al, al
jne 0x46b158
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp]
pop esi
pop ebp
ret 4
mov eax, dword [ebp]
pop ebp
ret 4
Function at 0x46b3b0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x46b3e5
push edi
mov edi, dword [sym.imp.USER32.dll_GetClipboardData]
push 1
call edi
test eax, eax
jne 0x46b3d5
push 0xd
call edi
test eax, eax
je 0x46b3da
mov esi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop edi
pop esi
ret
mov eax, esi
pop esi
ret

Function at 0x46b9f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x120
push ebx
push esi
push edi
mov edi, dword [esp + 0x13c]
test edi, edi
jne 0x46baba
mov eax, dword [esp + 0x138]
mov edi, dword [esp + 0x130]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esp + 0xc], 0x114
test eax, eax
mov byte [esp + 0x18], 0
je 0x46ba8d
lea eax, [esp + 0x14]
push eax
push 1
push 0
push edi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46ba8d
lea ecx, [esp + 0xc]
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push 0
push edi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x18]
push ecx
call ebx
test eax, eax
je 0x46ba79
cmp dword [esp + 0x10], 1
jne 0x46ba79
xor esi, esi
jmp 0x46ba7e
mov esi, 1
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x46baab
mov esi, dword [esp + 0x134]
push esi
call ebx
push eax
push esi
push 1
push edi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
jne 0x46bb1b
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x120
ret
mov ecx, dword [esp + 0x130]
lea eax, [esp + 0xc]
push eax
push ecx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x46bb1b
mov esi, dword [esp + 0x134]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0xc]
inc eax
push eax
push esi
push 1
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x46bb1b
test esi, esi
jne 0x46bb1b
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x120
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x120
ret
Function at 0x46c670
Capabilities:
Copy file
Delete file
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x114
push esi
push edi
lea eax, [esp + 0x18]
push 0x104
push eax
mov edi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [esp + 0x120]
push 0
lea ecx, [esp + 0x1c]
push esi
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x46c7b1
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x46c7b1
push ebx
push ebp
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
push 0
push 0
lea edx, [ebx - 8]
push edx
push esi
call ebp
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 8
push ecx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x10], 8
jne 0x46c792
cmp dword [esp + 0x18], 0xfa123456
jne 0x46c72e
mov ecx, dword [esp + 0x1c]
mov edx, 0xfffffff8
sub edx, ecx
add ebx, edx
push 0
push 0
push ebx
push esi
call ebp
mov ecx, dword [edi + 0x298]
mov edx, dword [edi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x10]
push 0
push eax
push ecx
push edx
push esi
call ebx
mov eax, dword [edi + 0x298]
mov ecx, dword [esp + 0x10]
cmp ecx, eax
jne 0x46c792
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x20]
push 8
push ecx
push esi
mov dword [esp + 0x2c], 0xfa123456
call ebx
cmp dword [esp + 0x10], 8
jne 0x46c792
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [esp + 0x14], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
pop ebp
test eax, eax
pop ebx
jne 0x46c7b1
mov edx, dword [esp + 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
add esp, 0x114
ret 4
Function at 0x471350
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, ecx
push esi
xor ebx, ebx
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], ebx
call fcn.004156d0
mov ecx, dword [ebp]
lea eax, [esp + 0x18]
push eax
push str.defaultcamera
mov ecx, dword [ecx + 0x1060]
call fcn.00478450
mov dword [esp + 0x10], ebx
push 0xa
push ebx
call fcn.00443640
mov edx, dword [ebp]
mov esi, eax
add esp, 8
mov eax, dword [edx + 0x105c]
push esi
mov ecx, dword [eax + 0x834]
call fcn.00486080
mov ecx, dword [ebp]
push esi
mov edx, dword [ecx + 0x105c]
mov ecx, dword [edx + 0x834]
call fcn.00486250
push esi
mov ecx, 0x4ba850
mov edi, eax
call fcn.00417540
xor eax, eax
cmp edi, eax
je 0x4714db
mov ecx, dword [edi + 0x9c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], 6
call fcn.00485690
lea ecx, [esp + 0x18]
call fcn.00415e50
test eax, eax
je 0x471417
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x2c]
call fcn.00415c20
test al, al
jne 0x4714ac
jmp 0x471490
lea ecx, [esp + 0x20]
call fcn.0043fa10
mov esi, eax
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
test edi, edi
jle 0x471448
movsx edx, byte [eax + esi]
mov cl, byte [edx + 0x4a4328]
xor cl, dl
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jl 0x471434
mov eax, dword [0x4a7324]
xor ebx, ebx
test eax, eax
je 0x47147d
mov eax, 0x4a7324
mov edi, eax
mov edx, dword [eax]
push edx
push esi
call fcn.00415440
add esp, 8
test eax, eax
jne 0x471478
mov ecx, dword [edi + 4]
add edi, 4
test ecx, ecx
mov eax, edi
jne 0x47145a
jmp 0x47147d
mov ebx, 1
push esi
mov ecx, 0x4ba850
call fcn.00417540
test ebx, ebx
je 0x4714b2
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
call fcn.0043f720
inc ebx
cmp ebx, 0x270f
mov dword [esp + 0x10], ebx
jl 0x471384
jmp 0x4714db
mov dword [esp + 0x14], ebx
jmp 0x4714d2
mov ecx, dword [ebp]
lea eax, [esp + 0x20]
push eax
push str.defaultcamera
mov ecx, dword [ecx + 0x1060]
call fcn.004784c0
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], edx
lea ecx, [esp + 0x20]
call fcn.0043f720
mov eax, dword [esp + 0x14]
push 0xa
push eax
call fcn.00443640
add esp, 8
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.00415940
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x47b150
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor ebx, ebx
xor edx, edx
xor esi, esi
mov al, byte [edi]
mov dword [esp + 0x10], edx
cmp al, bl
mov dword [esp + 0x14], esi
je 0x47b1a9
and eax, 0xff
xor ecx, ecx
mov cl, byte [eax + 0x4a4328]
xor ecx, eax
mov eax, edx
shr eax, 0x1b
shl edx, 5
or eax, edx
add eax, ecx
mov edx, eax
mov eax, esi
shr eax, 0x1a
shl esi, 6
or eax, esi
add eax, ecx
inc edi
mov esi, eax
mov al, byte [edi]
cmp al, bl
jne 0x47b16f
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
mov edi, dword [esp + 0x20]
mov ecx, dword [edi]
push ecx
mov ecx, 0x4ba850
call fcn.00417540
push 0x4b98f8
mov ecx, edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.00414fc0
lea ebp, [esp + 0x10]
mov dword [esp + 0x1c], 2
mov esi, dword [ebp]
mov ebx, 8
mov edx, esi
shr edx, 0x1c
push edx
call fcn.00414ad0
add esp, 4
mov ecx, edi
push eax
call fcn.00414c50
shl esi, 4
dec ebx
jne 0x47b1e2
mov eax, dword [esp + 0x1c]
add ebp, 4
dec eax
mov dword [esp + 0x1c], eax
jne 0x47b1da
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret