joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468190
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x607b90
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x15], 0
mov dword [ebp - 4], 0
push str.SELECT_filepath_FROM_pcdb_WHERE_filepath____COLLATE_NOCASE_
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [0x72a7c4]
call fcn.004cf4b0
mov ebx, 1
mov byte [ebp - 4], bl
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push eax
push ebx
lea eax, [ebp - 0x20]
call fcn.004cf350
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.004cf140
mov byte [ebp - 4], 2
cmp byte [ebp - 0x2c], 0
jne 0x46820b
mov byte [ebp - 0x15], bl
mov byte [ebp - 4], bl
lea esi, [ebp - 0x34]
call fcn.004cebd0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.004cef10
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x15]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4685b0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x607b16
mov eax, dword fs:[0]
push eax
sub esp, 0x4a0
mov eax, dword [0x711ab8]
xor eax, esp
mov dword [esp + 0x498], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x4b4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x4c4]
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 4]
push ecx
mov ecx, ebp
call fcn.00468d50
mov eax, dword [ebp + 0x18]
mov dword [eax + 4], eax
mov eax, dword [ebp + 0x18]
xor esi, esi
mov dword [ebp + 0x1c], esi
mov dword [eax], eax
mov eax, dword [ebp + 0x18]
lea edx, [esp + 0x44]
push edx
mov dword [eax + 8], eax
call fcn.004683c0
mov dword [esp + 0x4bc], esi
mov bl, 1
mov eax, dword [esp + 0x278]
mov byte [esp + 0x274], 0
cmp eax, 0xffffffff
je 0x46866b
cmp byte [esp + 0x44], 0
jne 0x468655
lea ecx, [esp + 0x48]
push ecx
push eax
mov byte [esp + 0x4c], bl
call sub.KERNEL32.dll_Process32FirstW
jmp 0x468660
lea edx, [esp + 0x48]
push edx
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x46866b
mov byte [esp + 0x274], bl
cmp byte [esp + 0x274], 0
mov ecx, 0x8c
lea esi, [esp + 0x48]
lea edi, [esp + 0x27c]
rep movsd dword es:[edi], dword [esi]
je 0x468737
mov eax, dword [esp + 0x50]
cmp eax, 4
jbe 0x468629
push eax
call fcn.00439930
mov edi, edx
add esp, 4
mov esi, eax
or eax, edi
je 0x468629
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x280]
call fcn.00434000
mov byte [esp + 0x4bc], bl
mov eax, dword [eax]
mov edx, dword [esp + 0x284]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edi
call fcn.0040b990
mov byte [esp + 0x4bc], 3
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x3c]
push eax
push ebp
call fcn.00468bb0
mov byte [esp + 0x4bc], bl
lea ecx, [esp + 0x2c]
call fcn.0040ba40
mov byte [esp + 0x4bc], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x468629
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x468629
mov dword [esp + 0x4bc], 0xffffffff
lea ecx, [esp + 0x44]
push ecx
call fcn.00468460
mov ecx, dword [esp + 0x4b4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x498]
xor ecx, esp
call fcn.005c397a
add esp, 0x4ac
ret 4
Function at 0x46a250
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ecx
push ebx
xor ebx, ebx
push ebx
lea eax, [esp + 8]
push eax
push edi
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46a270
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop ecx
ret
cmp dword [esp + 4], edi
je 0x46a27e
mov eax, 0x1e
pop ebx
pop ecx
ret
xor eax, eax
test edi, edi
jbe 0x46a28d
xor byte [eax + esi], 0x67
inc eax
cmp eax, edi
jb 0x46a284
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x46a2a0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push ebp
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x46a2c7
pop esi
pop ebp
lea eax, [ebx + 0xe]
pop ebx
pop ecx
ret
test ebp, ebp
jbe 0x46a2e3
mov ecx, dword [esp + 0x18]
push edi
sub ecx, esi
mov edi, ebp
mov dl, byte [ecx + eax]
xor dl, 0x67
mov byte [eax], dl
inc eax
sub edi, 1
jne 0x46a2d4
pop edi
mov ecx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x10]
push eax
push ebp
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x46a305
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x46a310
cmp dword [esp + 0xc], ebp
je 0x46a310
mov ebx, 0x1d
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x46a480
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
lea eax, [edx + 0x14]
lea edi, [edx + 4]
mov ecx, 0x108
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
test eax, eax
je 0x46a4bb
mov ecx, 0x104
nop
cmp word [eax], 0
je 0x46a4b7
add eax, 2
sub ecx, 1
jne 0x46a4a0
pop edi
pop esi
lea eax, [ecx + 0x57]
pop ebp
ret 4
test ecx, ecx
jne 0x46a4c6
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 4
push ebx
lea ebx, [edx + 0x21c]
test ebx, ebx
je 0x46a4f4
mov ecx, 0x104
mov eax, ebx
cmp word [eax], 0
je 0x46a4f0
add eax, 2
sub ecx, 1
jne 0x46a4d8
pop ebx
pop edi
pop esi
lea eax, [ecx + 0x57]
pop ebp
ret 4
test ecx, ecx
jne 0x46a500
pop ebx
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 4
test byte [ebp + 4], 1
je 0x46a524
call fcn.0046c110
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46a524
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop edi
pop esi
pop ebp
ret 4
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
ret 4
Function at 0x46ab60
Capabilities:
Delete file

Disassembly:
add ecx, 0x21c
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
ret

Function at 0x46aeb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
push 0x10000
xor edi, edi
push 8
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
jne 0x46aee9
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 8
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_BackupRead]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
push ebp
push 0
lea ecx, [esp + 0x30]
push ecx
push 0x10000
push esi
push edx
call ebx
mov ecx, dword [esp + 0x24]
mov edi, eax
test ecx, ecx
je 0x46af48
xor eax, eax
test ecx, ecx
jbe 0x46af2d
lea ebx, [ebx]
xor byte [eax + esi], 0x67
inc eax
cmp eax, ecx
jb 0x46af20
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push ecx
push esi
push eax
call fcn.00515cc0
add esp, 0xc
cmp dword [esp + 0x24], eax
jne 0x46af58
test edi, edi
jne 0x46aef0
jmp 0x46af60
test edi, edi
jne 0x46af60
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
jmp 0x46af60
mov dword [esp + 0x10], 0x1e
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
add esp, 8
ret 0xc

Function at 0x46af80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push 0x10000
xor edi, edi
push 8
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
jne 0x46afb6
lea eax, [edi + 0xe]
pop edi
pop esi
pop ebp
add esp, 8
ret 8
mov dword [esp + 0xc], edi
mov edi, dword [sym.imp.KERNEL32.dll_BackupWrite]
mov eax, dword [esp + 0x1c]
push 0x10000
push esi
push eax
call fcn.005158d0
add esp, 0xc
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x46b011
xor ecx, ecx
test eax, eax
jbe 0x46afef
xor byte [ecx + esi], 0x67
inc ecx
cmp ecx, eax
jb 0x46afe2
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
push 0
lea edx, [esp + 0x24]
push edx
push eax
push esi
push ebp
call edi
test eax, eax
je 0x46b01b
cmp dword [esp + 0x18], 0x10000
jae 0x46afc0
jmp 0x46b025
mov dword [esp + 0xc], 0x1e
jmp 0x46b025
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 8
ret 8
Function at 0x46b130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
lea eax, [edx + 0x10]
lea edi, [edx + 4]
mov ecx, 0x108
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
test eax, eax
je 0x46b16b
mov ecx, 0x104
nop
cmp word [eax], 0
je 0x46b167
add eax, 2
sub ecx, 1
jne 0x46b150
pop edi
pop esi
lea eax, [ecx + 0x57]
pop ebp
ret 4
test ecx, ecx
jne 0x46b176
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 4
push ebx
lea ebx, [edx + 0x218]
test ebx, ebx
je 0x46b1a4
mov ecx, 0x104
mov eax, ebx
cmp word [eax], 0
je 0x46b1a0
add eax, 2
sub ecx, 1
jne 0x46b188
pop ebx
pop edi
pop esi
lea eax, [ecx + 0x57]
pop ebp
ret 4
test ecx, ecx
jne 0x46b1b0
pop ebx
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 4
test byte [ebp + 4], 1
je 0x46b1d4
call fcn.0046c110
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46b1d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop edi
pop esi
pop ebp
ret 4
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
ret 4

Function at 0x46b230
Capabilities:
Delete file
Delete registry key

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov ebp, eax
and eax, 0x100
push edi
xor edi, edi
and ebp, 0xfffffcff
neg eax
sbb eax, eax
and eax, 0xffffff00
add eax, 0xf023f
test byte [esi + 8], 1
mov ebx, eax
jne 0x46b2b4
lea eax, [esp + 0x10]
push eax
push ebx
push edi
lea ecx, [esi + 0x10]
push ecx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x46b298
push 2
push eax
mov eax, dword [esp + 0x18]
lea edx, [esi + 0x218]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSaveKeyExW]
mov edi, eax
test edi, edi
jne 0x46b298
or dword [esi + 8], 1
jmp 0x46b2a5
lea ecx, [esi + 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x46b2b4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [esi + 8], 2
jne 0x46b326
test edi, edi
jne 0x46b326
lea edx, [esp + 0x10]
push edx
push ebx
push edi
lea eax, [esi + 0x10]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46b319
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jne 0x46b2ff
mov edx, dword [esp + 0x10]
or dword [esi + 8], 2
push edx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov edx, dword [esp + 0x10]
push edx
mov esi, 0x15e
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
pop edi
pop esi
pop ebp
mov eax, 0x15e
pop ebx
pop ecx
ret 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x46b400
Capabilities:
Delete file

Disassembly:
add ecx, 0x218
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
ret
Function at 0x46b590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
lea edi, [ebp + 0x18]
mov ecx, 0x108
mov esi, edx
lea eax, [ebp + 0x24]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp + 0x434], 0
test eax, eax
je 0x46b5db
mov ecx, 0x104
lea ecx, [ecx]
cmp word [eax], 0
je 0x46b5d7
add eax, 2
sub ecx, 1
jne 0x46b5c0
pop edi
pop esi
lea eax, [ecx + 0x57]
pop ebp
ret 8
test ecx, ecx
jne 0x46b5e6
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 8
push ebx
lea ebx, [ebp + 0x22c]
test ebx, ebx
je 0x46b722
mov ecx, 0x104
mov eax, ebx
lea esp, [esp]
cmp word [eax], 0
je 0x46b618
add eax, 2
sub ecx, 1
jne 0x46b600
pop ebx
pop edi
pop esi
lea eax, [ecx + 0x57]
pop ebp
ret 8
test ecx, ecx
je 0x46b722
test byte [edx + 4], 1
je 0x46b659
call fcn.0046c110
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46b644
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop edi
pop esi
pop ebp
ret 8
push ebp
call fcn.0046baf0
test eax, eax
jne 0x46b749
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [edx + 0x41c]
test eax, eax
je 0x46b69e
mov ecx, 0x100
xor edx, edx
lea ebx, [ebx]
cmp word [eax], dx
je 0x46b67f
add eax, 2
sub ecx, 1
jne 0x46b670
jmp 0x46b683
test ecx, ecx
jne 0x46b695
mov edx, 0x80070057
xor eax, eax
mov esi, edx
test edx, edx
jl 0x46b6a3
lea ebp, [eax + eax]
jmp 0x46b6a5
mov eax, 0x100
sub eax, ecx
jmp 0x46b68a
mov esi, 0x80070057
xor ebp, ebp
test esi, esi
jl 0x46b722
add ebp, 2
push ebp
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [esp + 0x14]
mov dword [ecx + 4], eax
test eax, eax
je 0x46b747
mov edx, dword [esp + 0x18]
mov esi, dword [edx + 0x41c]
mov ecx, ebp
shr ecx, 1
je 0x46b722
cmp ecx, 0x7fffffff
ja 0x46b722
mov edi, SysReAllocString
xor ebx, ebx
sub edi, ecx
mov edx, ecx
sub esi, eax
lea ecx, [edi + edx]
test ecx, ecx
je 0x46b70d
movzx ecx, word [esi + eax]
test cx, cx
je 0x46b70d
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46b6f0
jmp 0x46b711
test edx, edx
jne 0x46b719
sub eax, 2
mov ebx, 0x8007007a
xor edx, edx
mov word [eax], dx
test ebx, ebx
jge 0x46b72e
pop ebx
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 8
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 4]
pop ebx
pop edi
mov dword [eax + 8], ebp
pop esi
mov dword [eax + 0x434], ecx
xor eax, eax
pop ebp
ret 8
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x46b7a0
Capabilities:
Delete file
Delete registry value

Disassembly:
sub esp, 8
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
mov ebp, eax
and eax, 0x100
push edi
xor edi, edi
and ebp, 0xfffffcff
neg eax
sbb eax, eax
and eax, 0xffffff00
add eax, 0xf023f
test byte [esi + 0x1c], 1
mov dword [esp + 0x10], eax
jne 0x46b86c
lea ecx, [esp + 0xc]
push ecx
push eax
push edi
lea edx, [esi + 0x24]
push edx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x46b850
mov eax, dword [esp + 0xc]
call fcn.0046ba00
mov edi, eax
test edi, edi
jne 0x46b850
push ebx
push eax
push 0x80
push 2
push eax
push 1
push 0x40000000
lea eax, [esi + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46b84b
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 8]
lea eax, [ecx + edx + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
push ebx
call fcn.0046a2a0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x46b844
or dword [esi + 0x1c], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
test edi, edi
je 0x46b85d
lea edx, [esi + 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x46b86c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [esi + 0x1c], 2
jne 0x46b8e8
test edi, edi
jne 0x46b8e8
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push ecx
push edi
lea edx, [esi + 0x24]
push edx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46b8da
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x46b8bf
mov edx, dword [esp + 0xc]
or dword [esi + 0x1c], 2
push edx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 8
ret 4
mov edx, dword [esp + 0xc]
push edx
mov esi, 0x15e
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 8
ret 4
pop edi
pop esi
mov eax, 0x15e
pop ebp
add esp, 8
ret 4
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret 4
Function at 0x46b900
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
test al, 1
je 0x46b9c3
test al, 2
je 0x46b9c3
mov eax, dword [esi + 0x20]
mov ecx, eax
and eax, 0x100
and ecx, 0xfffffcff
neg eax
push edi
sbb eax, eax
and eax, 0xffffff00
lea edx, [esp + 8]
push edx
add eax, 0xf023f
push eax
push 0
lea eax, [esi + 0x24]
push eax
push ecx
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x46b9aa
cmp byte [esp + 0x14], al
je 0x46b987
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
push eax
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x24], eax
mov eax, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46b987
lea edi, [eax + 0x50]
jmp 0x46b9aa
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esi + 4]
push eax
mov eax, dword [esp + 0x10]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
jne 0x46b9aa
mov eax, dword [esp + 8]
test eax, eax
je 0x46b9b9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 8
ret 0xc
xor eax, eax
pop esi
add esp, 8
ret 0xc

Function at 0x46b9d0
Capabilities:
Delete file

Disassembly:
add ecx, 0x22c
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
ret

Function at 0x46ba00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esi + 4]
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
lea eax, [esp + 8]
push eax
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push edx
push ebx
mov dword [esp + 0x20], 0
call ebp
test eax, eax
jne 0x46ba6a
mov eax, dword [esi + 8]
mov ecx, dword [esp + 8]
push edi
lea edx, [ecx + eax + 4]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x46ba70
lea ebx, [eax + 0xe]
test edi, edi
je 0x46ba67
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
pop edi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esi + 8]
lea eax, [esp + 0xc]
push eax
lea edx, [edi + ecx + 4]
mov ecx, dword [esi + 4]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push ecx
push ebx
call ebp
mov ebx, eax
test ebx, ebx
jne 0x46ba53
mov eax, dword [esp + 0x10]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], eax
mov dword [edi + edx], eax
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push eax
push ecx
push edi
call fcn.005c9060
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x18]
lea ecx, [edi + eax + 4]
mov eax, dword [esi + 4]
add esp, 0xc
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], ecx
test eax, eax
je 0x46bad6
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 4], edi
mov dword [esi + 0x434], edi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x46baf0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
lea eax, [ebp + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
jne 0x46bb2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebp
pop ecx
ret 4
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x46bb5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 4
test edi, edi
jne 0x46bb78
push esi
mov dword [esp + 0x10], 0x54f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 4
push ebx
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [esp + 0x18]
xor ebx, ebx
push ebx
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
push edi
push esi
push edx
mov dword [ebp + 4], esi
mov dword [ebp + 0x434], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46bbb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x46bbd9
cmp dword [esp + 0x10], edi
je 0x46bbc4
mov ebx, 0x1e
jmp 0x46bbd9
xor eax, eax
test edi, edi
jbe 0x46bbd9
lea ebx, [ebx]
xor byte [eax + esi], 0x67
inc eax
cmp eax, edi
jb 0x46bbd0
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x46bc53
mov esi, dword [ebp + 4]
mov eax, edi
shr eax, 1
test esi, esi
je 0x46bc29
cmp eax, 0x7fffffff
ja 0x46bc29
mov edx, eax
mov ecx, esi
test eax, eax
je 0x46bc14
jmp 0x46bc00
cmp word [ecx], 0
je 0x46bc10
add ecx, 2
sub edx, 1
jne 0x46bc00
jmp 0x46bc14
test edx, edx
jne 0x46bc25
mov ebx, 0x80070057
xor eax, eax
mov ecx, ebx
test ebx, ebx
jl 0x46bc2e
add eax, eax
jmp 0x46bc30
sub eax, edx
jmp 0x46bc1b
mov ecx, 0x80070057
xor eax, eax
test ecx, ecx
jl 0x46bc53
add eax, 2
lea ecx, [eax + 4]
cmp ecx, edi
ja 0x46bc53
mov edx, dword [esi + eax]
sub edi, eax
lea ecx, [esi + eax + 4]
sub edi, 4
mov dword [ebp + 0x14], edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edi
mov esi, dword [esp + 0x18]
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 4