joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414c93
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x414cbb
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0x2588
push 0
push dword [ebp - 4]
call fcn.0042d892
add esp, 0xc
jmp 0x414cfe
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x414cf4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x414cf2
push 0xf0e
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x414cfe
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret

Function at 0x4172cd
Capabilities:
Clear file content
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae0af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x417322
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
push 0x3f00
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x31f3
push 0
call fcn.004194e6
add esp, 0x14
jmp 0x41744d
lea eax, [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x41733d
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x41744d
mov dword [ebp - 0x28], 0x6c55
mov dword [ebp - 0x38], str.ofus_pjnr_jwecwe_gvuwjh_tejvppb_toqa_souqepyv
cmp dword [ebp - 0x28], 0x6cb8
jle 0x4173fd
and dword [ebp - 0x18], 0
jmp 0x417365
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x30ed
jge 0x4173fd
and dword [ebp - 0x1c], 0
jmp 0x41737f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6052
jge 0x4173f8
and dword [ebp - 0x20], 0
jmp 0x417395
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7eea
jge 0x4173f6
and dword [ebp - 0x24], 0
jmp 0x4173ab
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x377c
jge 0x4173f4
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
sub edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
shl edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.004018f3
pop ecx
pop ecx
mov ecx, eax
call fcn.0042fa1f
push eax
call fcn.00498447
pop ecx
lea ecx, [ebp - 0x58]
call fcn.0042fa15
jmp 0x4173a4
jmp 0x41738e
jmp 0x417378
jmp 0x41735e
mov byte [ebp - 0x11], 0
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x6b16
jge 0x417417
push dword [ebp - 0x38]
call fcn.00498447
pop ecx
jmp 0x417433
or dword [ebp - 4], 0xffffffff
jmp 0x41743d
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x41744d
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417552
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x41757e
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.004175f3
add esp, 0xc
jmp 0x4175ef
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4175e4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4175c8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x4175e2
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.0042fc2d
or dword [eax], 0xffffffff
jmp 0x4175bd
jmp 0x4175ef
push 0x247a
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x417610
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae0b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0x3c75
mov dword [ebp - 0x44], str.ozrb_vssdw_qnwbhg_pywggjjl_hqf_sflvaod_ked
cmp dword [ebp - 0x20], 0x3d49
jle 0x41769c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
and dword [ebp - 0x18], 0
jmp 0x41765c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4f8c
jge 0x41769c
and dword [ebp - 0x1c], 0
jmp 0x417672
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1485
jge 0x41769a
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, 0xabbe58
call fcn.0042fa2a
jmp 0x41766b
jmp 0x417655
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x41770e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4176ec
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
movzx eax, word [eax]
and eax, 0xfff
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
jmp 0x41770c
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x41770c
push 0x121c
push 0
push 0
push 0x149e
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x41772b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
push 0x1ac6
push 0x40fe
push 0
call fcn.0040266a
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3926
jge 0x417745
mov edx, dword [ebp - 0x44]
mov ecx, 0xabbe58
call fcn.004313d0
jmp 0x417761
or dword [ebp - 4], 0xffffffff
jmp 0x41776b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d037
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x41d0c9
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41d0b2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x41d093
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x41d0b0
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.0042fc2d
mov dword [eax], 0x9f9b3198
jmp 0x41d088
jmp 0x41d0c7
push 0
push 0x1fb9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x41d0e6
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push 0x78d2
push 0x1ed8
push 1
call fcn.00402687
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x41dbcf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x41dc00
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push 0x347b
push 1
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.0041dc7f
add esp, 0x10
jmp 0x41dc7b
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x41dc66
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x41dc4a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x41dc64
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.0042fc2d
or dword [eax], 0xffffffff
jmp 0x41dc3f
jmp 0x41dc7b
push 0
push 0x1fb9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esp, ebp
pop ebp
ret
Function at 0x41e892
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae195
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x41e9ea
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x41e903
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x41e9e8
mov dword [ebp - 0x24], 0xf49
mov dword [ebp - 0x44], str.jod_drpw_yoyh_ubyuju
cmp dword [ebp - 0x24], 0x11cb
jle 0x41e98c
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
and dword [ebp - 0x20], 0
jmp 0x41e92f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7cb0
jge 0x41e98c
and dword [ebp - 0x18], 0
jmp 0x41e945
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x23fa
jge 0x41e98a
and dword [ebp - 0x1c], 0
jmp 0x41e95b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6f8d
jge 0x41e988
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
shl eax, cl
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov ecx, 0xabbe58
call fcn.0042fa2a
jmp 0x41e954
jmp 0x41e93e
jmp 0x41e928
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x41e9a8
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0xd92
jge 0x41e9c2
mov edx, dword [ebp - 0x44]
mov ecx, 0xabbe58
call fcn.004313d0
jmp 0x41e9de
or dword [ebp - 4], 0xffffffff
jmp 0x41e9e8
jmp 0x41ea15
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
push 0x23fb
push 0x6a55
push 0
push 0x6d50
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
call fcn.00413d7d
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42bee1
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x42bf40
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x42bf38
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x42bf36
push 0x180a
push 0
push 0x1f4f
push 0
push 0x1c86
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
jmp 0x42bf3e
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x42bf77
push 0x6669
push 0xaf8
push 0x5972
push 0x6fb0
push 0x22c2
push 0x71ae
push 0x2e92
push 0x4d4f
push 1
push 0x421d
call fcn.00420748
add esp, 0x28
mov esp, ebp
pop ebp
ret

Function at 0x42bf7b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x42bfb4
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0x60e1
push 1
push dword [ebp - 8]
push 0x6476
push dword [ebp - 0xc]
call fcn.0042c04a
add esp, 0x14
jmp 0x42c046
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x42c023
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x42c004
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x42c021
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.0042fc2d
mov dword [eax], 0xae505b0b
jmp 0x42bff9
jmp 0x42c046
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x42c046
push 0
push 0x115e
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esp, ebp
pop ebp
ret
Function at 0x44db91
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x44dbcf
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
call fcn.0044dc14
add esp, 0x14
jmp 0x44dc10
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x44dbf2
push 0x49c
call dword [sym.imp.USER32.dll_SetCapture]
jmp 0x44dc10
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x44dc10
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esp, ebp
pop ebp
ret
Function at 0x4514ea
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x45150e
push 0x45c5
push 0x2f78
push 1
call fcn.00451559
add esp, 0xc
jmp 0x451555
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x45154a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 0
mov ecx, dword [ebp - 0x14]
call fcn.0042fc2d
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x451555
push 0x247a
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x45173b
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x45175f
push 0x4b77
push 1
push 0x129c
call fcn.004517a5
add esp, 0xc
jmp 0x4517a1
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x451781
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x4517a1
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4517a1
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x466c25
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4ae681
call fcn.004adbe8
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 0x6f0
cmp dword [ebp - 0x14], 0xa1b
jle 0x466c7b
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
xor eax, edi
or eax, esi
cdq
push edx
push eax
mov ecx, 0xabbe58
call fcn.0042fa2a
inc ebx
cmp ebx, 0x7ce8
jl 0x466c4d
inc edi
cmp edi, 0x30bc
jl 0x466c4b
inc esi
cmp esi, 0xdbb
jl 0x466c49
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x683
jge 0x466c97
mov edx, str.koissd_livujdnu_bokyjl_knhhm_vcbdyllj_vosgdfdj_jkoo_ybxdjkm
mov ecx, 0xabbe58
call fcn.004313d0
or dword [ebp - 4], 0xffffffff
xor eax, eax
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468004
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x24], ecx
inc edi
mov eax, 0x4bda99da
mov dword [esp + 0x14], edi
xor ebx, ebx
mov dword [esp + 0x18], 0xa023703a
mov esi, edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], 0x6cc72b75
mov dword [esp + 0x20], 0x800f4d4e
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x468064
push ebx
push 0x195a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp dword [esp + 0x14], ebx
je 0x468078
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x14], edi
je 0x468078
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
xor edx, edx
imul ecx, dword [esp + 0x14], 0xc4e2
mov eax, dword [esp + 0x14]
add eax, 8
add ecx, eax
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0x30], ecx
test ecx, ecx
je 0x4680b3
mov ecx, edi
cmp dword [esp + 0x14], ebx
jne 0x4680b5
mov ecx, ebx
xor eax, eax
cmp ecx, edi
sete al
sub eax, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
add eax, dword [esp + 0x14]
je 0x4680d3
mov eax, edi
cmp dword [esp + 0x1c], ebx
jne 0x4680d5
mov eax, ebx
cmp dword [esp + 0x14], eax
jge 0x4680e1
cmp dword [esp + 0x30], ebx
je 0x4680e3
mov ebx, edi
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, ebx
setne cl
mov dword [esp + 0x20], ecx
call fcn.00467ba0
mov eax, esi
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x24]
mov esi, edx
mov edi, eax
call fcn.00466f34
add eax, esi
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46943f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae6e5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x4211
mov dword [ebp - 0x24], str.qnvsn_kcsj_wiukaewmv_cuungcrz_dgiytwgxe_scaaf_btfutfn_ftxps_drp_tdqp_teft_gmvow_tjjzsehaj_sjxacix
cmp dword [ebp - 0x1c], 0x44d0
jle 0x4694cd
and dword [ebp - 0x14], 0
jmp 0x46948b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x559f
jge 0x4694cd
and dword [ebp - 0x18], 0
jmp 0x4694a1
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xac9
jge 0x4694cb
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
cdq
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
mov ecx, 0xabbe58
call fcn.0042fa2a
jmp 0x46949a
jmp 0x469484
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4694dd
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x3f30
jge 0x4694f7
mov edx, dword [ebp - 0x24]
mov ecx, 0xabbe58
call fcn.004313d0
jmp 0x469513
or dword [ebp - 4], 0xffffffff
jmp 0x46951d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46a65b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x46a691
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x46a685
push 0x247a
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0x46a6a9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 0
push 0x6560
push dword [ebp - 8]
call fcn.0046be12
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x46accd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae717
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x46ae18
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x46ad1c
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x46ae16
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x6bcf
mov dword [ebp - 0x2c], str.vndn_gmzyzyyyh_zlzuh_khtpeo_rtomndax
cmp dword [ebp - 0x1c], 0x6e9c
jle 0x46adbd
and dword [ebp - 0x14], 0
jmp 0x46ad4a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3b2a
jge 0x46ada2
and dword [ebp - 0x18], 0
jmp 0x46ad60
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x22cd
jge 0x46ada0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
shl eax, cl
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.004018f3
pop ecx
pop ecx
mov ecx, eax
call fcn.0042fa1f
push eax
call fcn.00498447
pop ecx
lea ecx, [ebp - 0x68]
call fcn.0042fa15
jmp 0x46ad59
jmp 0x46ad43
push 0
push 0x15a
push 0x27e
push 0x18a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x69df
jge 0x46add9
push dword [ebp - 0x2c]
call fcn.00498447
pop ecx
jmp 0x46adf5
or dword [ebp - 4], 0xffffffff
jmp 0x46adff
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x46ae16
push 0
push 0x115e
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x46ae71
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
push 0x3b1b
push 0x11cd
push 0x310
push dword [ebp - 0x34]
push 0x299d
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0x6b54
push dword [ebp - 0x44]
push 0
push dword [ebp - 0x48]
call fcn.0046b394
add esp, 0x30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret