joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469e50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov eax, dword [0x4c5ad0]
test eax, eax
je 0x469eb0
mov esi, dword [eax + 0x2c]
test esi, esi
js 0x469ed0
mov ebx, dword [eax + 0x2c]
test ebx, ebx
jne 0x469ef0
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x469f40
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4c5ad0]
mov esi, dword [eax + 0x2c]
test esi, esi
jns 0x469e72
jmp 0x469ed0
call sym._fc_key_init_once
mov eax, dword [0x4c5ad0]
mov ebx, dword [eax + 0x2c]
test ebx, ebx
je 0x469e79
jmp 0x469ef0
mov ebx, dword [eax + 0x30]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
sub esp, 4
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x469ea1
lea esi, [esi]
mov eax, dword [0x4c5ad0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x469f8d
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x469f99
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x469f6e
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
mov eax, dword [eax + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x469f5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x469f5d
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4c5ad0]
jmp 0x469f4c
call sym._fc_key_init_once
mov eax, dword [0x4c5ad0]
jmp 0x469f53
Function at 0x469fb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x4c5ad0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x46a044
mov esi, dword [eax + 0x2c]
test esi, esi
js 0x46a060
mov ebx, dword [eax + 0x2c]
test ebx, ebx
jne 0x46a080
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x46a038
lea edx, [ebp - 0x14]
mov eax, edi
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x46a0ff
mov eax, dword [0x4c5ad0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x46a0d6
mov edx, dword [eax + 0x2c]
test edx, edx
js 0x46a0f0
mov edi, dword [eax + 0x2c]
test edi, edi
jne 0x46a0b0
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
jmp 0x469ff5
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4c5ad0]
mov esi, dword [eax + 0x2c]
test esi, esi
jns 0x469fd0
lea esi, [esi]
call sym._fc_key_init_once
mov eax, dword [0x4c5ad0]
mov ebx, dword [eax + 0x2c]
test ebx, ebx
je 0x469fdb
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x30]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x469fde
mov eax, dword [eax + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x46a027
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46a027
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4c5ad0]
mov edx, dword [eax + 0x2c]
test edx, edx
jns 0x46a019
nop
lea esi, [esi]
call sym._fc_key_init_once
mov eax, dword [0x4c5ad0]
jmp 0x46a019
call sym._abort
lea esi, [esi]
lea edi, [edi]
Function at 0x46a110
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x46a1a2
mov eax, dword [0x4c5ad0]
test eax, eax
je 0x46a196
mov ebx, dword [eax + 0x2c]
test ebx, ebx
js 0x46a211
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jne 0x46a1b7
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x46a22f
mov eax, dword [0x4c5ad0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x46a202
mov edx, dword [eax + 0x2c]
test edx, edx
js 0x46a220
mov edi, dword [eax + 0x2c]
test edi, edi
jne 0x46a1e3
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4c5ad0]
jmp 0x46a132
mov dword [esp], edi
call sym.__Unwind_SjLj_RaiseException
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x30]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x46a147
mov eax, dword [eax + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x46a185
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46a185
call sym.___w32_sharedptr_initialize
mov eax, dword [0x4c5ad0]
jmp 0x46a170
call sym._fc_key_init_once
mov eax, dword [0x4c5ad0]
jmp 0x46a13d
call sym._fc_key_init_once
mov eax, dword [0x4c5ad0]
jmp 0x46a17b
call sym._abort
lea esi, [esi]
lea edi, [edi]

Function at 0x46a3e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov edx, eax
je 0x46a410
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [esp + 4], eax
call sym.___mingwthr_key_dtor
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret
Function at 0x471b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x473850
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], esi
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sym._fread
test eax, eax
mov edx, eax
jle 0x4738a0
movzx eax, byte [esi + eax - 1]
mov dword [ebx + 0x24], eax
mov ebx, dword [ebp - 8]
mov eax, edx
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [ebx + 0x24], 0xffffffff
mov eax, edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1df9370
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1df94c0
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1df9396
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1df9382
add dl, dl
jne 0x1df93a1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1df93f4
xor eax, eax
add dl, dl
jne 0x1df93ae
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1df9495
add dl, dl
jne 0x1df93bd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1df93c8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1df93d3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1df93de
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1df93ea
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1df938d
mov eax, 1
add dl, dl
jne 0x1df9402
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1df940d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1df93f9
sub eax, ebx
mov ebx, 1
jne 0x1df9440
mov ecx, 1
add dl, dl
jne 0x1df9426
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1df9431
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1df941d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1df938d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1df9457
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1df9462
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1df944e
cmp eax, 0x7d00
jae 0x1df9485
cmp eax, 0x500
jb 0x1df9480
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1df938d
cmp eax, 0x7f
ja 0x1df9488
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1df938d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1df94b6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1df938d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10018f3e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100410f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, edx
mov dword [ebp - 0x214], eax
test ebx, ebx
jne 0x10018f6c
mov eax, 0x80004005
jmp 0x10019053
xor ecx, ecx
xor edx, edx
push esi
mov dword [eax], ecx
inc edx
push edi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], ecx
push eax
mov ecx, ebx
call fcn.1003d2ce
mov edi, dword [ebp - 0x210]
mov esi, eax
test esi, esi
js 0x10019048
test edi, edi
je 0x10019048
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
jne 0x10019024
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], esi
push eax
xor edx, edx
mov ecx, ebx
call fcn.1003d2ce
mov ebx, dword [ebp - 0x210]
test eax, eax
js 0x1001901b
test ebx, ebx
je 0x1001901b
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x104
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x1001901b
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10018ff6
push dword [ebp - 0x214]
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push ecx
push eax
call fcn.10018db0
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10019048
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10019029
push dword [ebp - 0x214]
sub ecx, edx
sar ecx, 1
push ecx
push ecx
push edi
call fcn.10018db0
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1000e130
leave
ret

Function at 0x1001b081
Capabilities:
Print debug messages

Disassembly:
push 0xc
mov eax, 0x1000f6f4
call fcn.1000f189
and dword [ebp - 4], 0
mov eax, dword [0x10041044]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
push dword [ebp + 8]
mov byte [ebp - 4], 1
mov esi, dword [0x10041d00]
inc esi
mov dword [0x10041d00], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push esi
lea eax, [ebp - 0x18]
push 0x10009978
push eax
call fcn.100130df
mov eax, dword [0x10041d08]
add esp, 0x14
mov esi, dword [ebp - 0x18]
test eax, eax
je 0x1001b0e0
push eax
push esi
call dword [sym.imp.msvcrt.dll_fputws]
pop ecx
pop ecx
cmp dword [0x10041d04], 0
je 0x1001b0f0
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x18]
call fcn.1000daa0
jmp 0x1001b100
call fcn.1000f0ee
ret 4
Function at 0x10033ff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor ebx, ebx
cmp eax, ebx
je 0x100345f7
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.10033dfe
les eax, [ebx - 0x2d]
lodsd eax, dword [esi]
movzx eax, word [edi + 6]
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.10033dfe
sub al, 0xd1
jmp 0x100340a4
pop ss
mov esp, 0x50a8458d
call fcn.10033e0e
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.10033dc3
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x100340ec
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10033dfe
in eax, dx
pop ebp
test dword [ebp + ecx*4 + 0x45], ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10035fbc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb al, 0x18
je 0x10035fc2
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.10033dfe
and eax, 0x8b72afbc
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.10033dfe
push esp
stc
jge 0x10036035
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x10035feb
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x10035feb
call fcn.10033dfe
add edx, dword [edx + 0x36]
test eax, 0x3245a8b
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.10033dfe
out 0x3a, al
invalid
in eax, 0xff
push dword [ebp + eax - 0x75]
inc ecx
or al, 0x89
add cl, byte [ebx - 0x2d7ae7ab]
je 0x1003604b
mov eax, dword [ecx + 0x10]
mov dword [edx], eax
mov edx, dword [ebp + 0x1c]
test edx, edx
je 0x10036057
mov eax, dword [ecx + 0x14]
mov dword [edx], eax
mov edx, dword [ebp + 0x20]
test edx, edx
je 0x10036063
mov eax, dword [ecx + 0x18]
mov dword [edx], eax
mov edx, dword [ebp + 0x24]
test edx, edx
je 0x10036075
mov eax, dword [ecx + 0x1c]
mov dword [edx], eax
mov eax, dword [ecx + 0x20]
mov dword [edx + 4], eax
pop ebp
ret 0x20
Function at 0x1003d82f
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x100410f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x424], edx
push edi
mov dword [ebp - 0x41c], esi
mov edi, 0x80004005
mov dword [ebp - 0x42c], 0x1000ccd8
xor ebx, ebx
mov dword [ebp - 0x428], 0x1000ccf4
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
and dword [ebp - 0x418], 0
lea eax, [ebp - 0x418]
add esp, 0xc
push eax
mov eax, dword [esi + 4]
or eax, 1
push eax
push 0
push dword [ebp + ebx*4 - 0x42c]
push dword [esi]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003d94a
lea eax, [ebp - 0x420]
mov dword [ebp - 0x420], 0x208
push eax
lea eax, [ebp - 0x20c]
xor edi, edi
push eax
push edi
push 0x10000002
push 0x1000cd0c
push edi
push dword [ebp - 0x418]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegGetValueW]
mov esi, eax
test esi, esi
jne 0x1003d8f5
cmp word [ebp - 0x20c], di
jne 0x1003d920
lea eax, [ebp - 0x420]
mov dword [ebp - 0x420], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push 2
push edi
push edi
push dword [ebp - 0x418]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegGetValueW]
mov esi, eax
push dword [ebp - 0x418]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegCloseKey]
mov eax, dword [ebp - 0x20c]
test esi, esi
jne 0x1003d943
test ax, ax
je 0x1003d943
mov esi, dword [ebp - 0x41c]
jmp 0x1003d950
mov edi, 0x80004005
jmp 0x1003d93b
mov eax, dword [ebp - 0x20c]
test edi, edi
jns 0x1003d960
inc ebx
cmp ebx, 2
jb 0x1003d870
jmp 0x1003d9df
and dword [ebp - 0x41c], 0
lea esi, [ebp - 0x20c]
cmp ax, 0x22
jne 0x1003d991
lea eax, [ebp - 0x41c]
push eax
lea esi, [ebp - 0x20a]
mov eax, esi
push 0x10005c78
push eax
call dword [sym.imp.msvcrt.dll_wcstok_s]
add esp, 0xc
mov ebx, 0x104
lea eax, [ebp - 0x414]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
push ebx
mov ebx, dword [ebp - 0x424]
push ebx
cmp eax, 0x102
ja 0x1003d9be
lea eax, [ebp - 0x414]
push eax
jmp 0x1003d9bf
push esi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov edx, 0x104
cmp eax, edx
jbe 0x1003d9d3
push 8
pop edi
jmp 0x1003d9df
test eax, eax
jne 0x1003d9df
push esi
mov ecx, ebx
call fcn.1003b442
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e130
leave
ret

Function at 0x40891f
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
call fcn.00408941
sub ecx, 1
xor dword [esi], edx
sub eax, eax
inc esi
and eax, eax
cmp esi, edi
jne fcn.0040891f
mov ecx, eax
and eax, eax
ret
Function at 0x46b260
Capabilities:
Packed with generic packer

Disassembly:
pushal
cmp dword [0x4011fc], 0
je 0x46b340
cmp dword [0x401448], 0
je 0x46b2b4
cmp dword [0x40147c], 5
jle 0x46b2b4
push 0x401602
push 0
push dword [0x4011fc]
call dword [0x401450]
add word [0x4015b4], 1
add word [0x4015b6], 1
push 0x4015a2
push dword [0x4011fc]
call dword [0x401458]
movzx eax, word [0x401594]
push eax
push dword [0x4011fc]
call dword [sym.imp.kernel32.dll_SetConsoleTextAttribute]
mov dword [0x401656], 0x19
push 0x401656
push dword [0x4011fc]
call dword [sym.imp.kernel32.dll_SetConsoleCursorInfo]
movzx eax, word [0x40159a]
movzx ecx, word [0x401596]
sub eax, ecx
add eax, 1
movzx edx, word [0x40159c]
movzx ecx, word [0x401598]
sub edx, ecx
add edx, 1
movzx esi, word [0x40158c]
movzx edi, word [0x40158e]
push edi
push esi
push edx
push eax
call fcn.0046bc92
push 5
push 0
push 0
push dword [0x401460]
push dword [0x40145c]
push 0
push dword [0x401208]
call dword [sym.imp.user32.dll_SetWindowPos]
cmp dword [0x401220], 0
je 0x46b361
push dword [0x401220]
call dword [sym.imp.kernel32.dll_SetConsoleCP]
push dword [0x401224]
call dword [sym.imp.kernel32.dll_SetConsoleOutputCP]
push dword [0x4011f8]
call dword [sym.imp.kernel32.dll_FlushConsoleInputBuffer]
push dword [0x401214]
push dword [0x4011f8]
call dword [sym.imp.kernel32.dll_SetConsoleMode]
cmp dword [0x401228], 0
je 0x46b39c
push dword [0x401228]
push 0
push dword [0x401204]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [0x40123c], 0
je 0x46b3b1
push dword [0x40123c]
call dword [sym.imp.kernel32.dll_CancelWaitableTimer]
push dword [0x401218]
push 0xfffffffffffffff0
push dword [0x401208]
call dword [sym.imp.user32.dll_SetWindowLongW]
popal
ret

Function at 0x46b889
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
lea edx, [ebp - 0x18]
push edx
push dword [0x4011fc]
call dword [sym.imp.kernel32.dll_GetConsoleScreenBufferInfo]
xor ecx, ecx
mov cx, word [ebp - 0x14]
mov dword [0x4011b8], ecx
xor ebx, ebx
mov bx, word [ebp - 0x12]
mov dword [0x4011bc], ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cmp esi, 0xffffffff
jg 0x46b8c8
cmp edi, 0xffffffff
jle 0x46b900
cmp esi, 0xffffffff
jle 0x46b8db
mov eax, esi
mov ecx, dword [0x4011d4]
xor edx, edx
div ecx
mov ecx, edx
cmp edi, 0xffffffff
jle 0x46b8ee
mov eax, edi
mov ebx, dword [0x4011dc]
xor edx, edx
div ebx
mov ebx, edx
shl ebx, 0x10
or ebx, ecx
push ebx
push dword [0x4011fc]
call dword [sym.imp.kernel32.dll_SetConsoleCursorPosition]
popal
leave
ret 8
Function at 0x46b99f
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push ecx
push edx
push esi
push edi
push 0x2104
push 8
push dword [0x401204]
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x28], eax
lea edx, [ebp + 0x14]
push edx
push dword [ebp + 0x10]
push 0x1000
push eax
call dword [sym.imp.msvcrt.dll__vsnwprintf]
add esp, 0x10
and eax, 0xfff
je 0x46babc
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
jle 0x46baa4
cmp edx, 0xffffffff
jle 0x46baa4
mov cx, dx
shl ecx, 0x10
or cx, bx
mov dword [ebp - 0x20], ecx
lea edx, [ebp - 0x18]
push edx
push dword [0x4011fc]
call dword [sym.imp.kernel32.dll_GetConsoleScreenBufferInfo]
lea edx, [ebp - 0x1c]
push edx
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [0x4011fc]
call dword [sym.imp.kernel32.dll_WriteConsoleOutputCharacterW]
cmp dword [0x401230], 0
jne 0x46ba49
mov ax, word [ebp - 0x10]
mov edi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
rep stosw word es:[edi], ax
jmp 0x46ba89
lea edx, [ebp - 0x1c]
push edx
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [0x4011fc]
call dword [sym.imp.kernel32.dll_ReadConsoleOutputAttribute]
mov dword [0x401230], 0
mov edi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov ax, word [ebp - 0x10]
and ax, 0xf
and word [edi], 0xfff0
or word [edi], ax
add edi, 2
sub ecx, 1
jne 0x46ba7a
lea edx, [ebp - 0x1c]
push edx
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [0x4011fc]
call dword [sym.imp.kernel32.dll_WriteConsoleOutputAttribute]
jmp 0x46babc
push 0
lea edx, [ebp - 0x1c]
push edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [0x4011fc]
call dword [sym.imp.kernel32.dll_WriteConsoleW]
push dword [ebp - 0x28]
push 0
push dword [0x401204]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret

Function at 0x46bad7
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp edi, 0
jle 0x46bb1f
mov ecx, edi
add ecx, 1
add ecx, ecx
push ecx
push 8
push dword [0x401204]
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
mov cx, word [ebp + 0xc]
shl ecx, 0x10
or cx, word [ebp + 8]
push 0x40120c
push ecx
push edi
push ebx
push dword [0x4011fc]
call dword [sym.imp.kernel32.dll_ReadConsoleOutputCharacterW]
mov eax, ebx
pop edi
pop edx
pop ecx
pop ebx
leave
ret 0xc