joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d4a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0xc], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x43d5f3
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.0043d3a0
mov ecx, dword [ebx + 4]
lea eax, [edi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x43d5c6
movzx eax, byte [ecx + 8]
mov edx, dword [edx]
xor eax, 0x811c9dc5
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp - 4], eax
cmp ebx, esi
jne 0x43d53e
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x43d5b9
mov eax, dword [eax + 4]
movzx edi, word [ecx + 8]
cmp di, word [eax + 8]
jne 0x43d57a
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp eax, ecx
je 0x43d572
mov ebx, dword [ecx + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ecx
jmp 0x43d5b9
mov edi, eax
cmp ebx, eax
je 0x43d596
mov eax, dword [eax + 4]
mov edi, eax
movzx esi, word [ecx + 8]
cmp si, word [eax + 8]
mov esi, dword [ebp + 8]
je 0x43d5cf
cmp ebx, eax
jne 0x43d580
mov eax, dword [ecx + 4]
mov dword [ebp - 8], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp - 8]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], ecx
mov ebx, dword [ebp - 0xc]
mov ecx, edx
cmp edx, esi
jne 0x43d502
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x43d5b9
push str.invalid_hash_bucket_count
call fcn.00449d69
int3
Function at 0x44f9a3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45d6ac
push 0x45d6a4
push str.FlsAlloc
push 0x1e
call fcn.0044f881
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44f9d7
push dword [ebp + 8]
mov ecx, esi
call dword [0x459308]
call esi
jmp 0x44f9dd
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x44fa21
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45d6bc
push 0x45d6b4
push str.FlsGetValue
push 0x20
call fcn.0044f881
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44fa58
push dword [ebp + 8]
mov ecx, esi
call dword [0x459308]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4512eb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x451388
push ebx
push esi
call fcn.004512b4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0044f654
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x451335
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x451387
push edi
push eax
call fcn.0044f341
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x451355
call fcn.0044f307
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x451386
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0044f654
add esp, 0x20
test eax, eax
jne 0x451374
push edi
call fcn.0044f307
jmp 0x45137c
push ebx
call fcn.0044f307
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x75fe5a49
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x75ff8f1b
call fcn.75fd11d3
push ecx
push esi
push edi
mov esi, ecx
call sym.MSVCP60.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_
push dword [esp + 0x20]
xor edi, edi
mov ecx, esi
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], 0x20
call sym.MSVCP60.dll_private:_int___thiscall_std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__::_Mode_int_
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov eax, dword [esi + 0x2c]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov eax, dword [esi + 0x30]
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x75fe5b4a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x75ff8f53
call fcn.75fd11d3
push ecx
push esi
push edi
mov esi, ecx
call sym.MSVCP60.dll_protected:_void___thiscall_std::basic_streambuf_unsigned_short_int__struct_std::char_traits_unsigned_short_int__::constructor_void_
push dword [esp + 0x20]
xor edi, edi
mov ecx, esi
mov dword [esi], vtable.std::basic_stringbuf_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__.0
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], 0x20
call sym.MSVCP60.dll_private:_int___thiscall_std::basic_stringbuf_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Mode_int_
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov eax, dword [esi + 0x2c]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov eax, dword [esi + 0x30]
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x75feb3f4
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
push esi
mov esi, ecx
jne 0x75feb40f
xor eax, eax
jmp 0x75feb4be
mov eax, dword [esi + 0x20]
push edi
xor edi, edi
cmp dword [eax], edi
je 0x75feb43c
mov ecx, dword [esi + 0x30]
mov eax, dword [eax]
mov ecx, dword [ecx]
add ecx, eax
cmp eax, ecx
jae 0x75feb43c
mov eax, dword [esi + 0x30]
dec dword [eax]
mov esi, dword [esi + 0x20]
mov eax, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
mov byte [eax], bl
jmp 0x75feb505
mov eax, dword [esi + 0x50]
cmp eax, edi
je 0x75feb4ba
cmp dword [esi + 0x38], edi
jne 0x75feb44c
push eax
push ebx
jmp 0x75feb4af
mov ecx, dword [esi + 0x44]
push 0xffffffffffffffff
push edi
mov byte [ebp + 8], bl
call sym.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_int__unsigned_int_
mov ecx, dword [esi + 0x44]
push edi
push 8
call sym.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_unsigned_int__char_
mov edi, dword [esi + 0x44]
mov ecx, edi
call sym.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Freeze_void_
mov ecx, dword [esi + 0x44]
mov edi, dword [edi + 4]
call sym.MSVCP60.dll_public:_char____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::end_void_
mov ecx, dword [esi + 0x38]
lea edx, [ebp - 0xc]
push edx
mov dword [ebp - 4], eax
push dword [ebp - 4]
mov eax, dword [ecx]
push edi
lea edx, [ebp - 8]
push edx
lea edx, [ebp + 9]
push edx
lea edx, [ebp + 8]
push edx
lea edx, [esi + 0x40]
push edx
call dword [eax + 0x14]
sub eax, 0
je 0x75feb4cc
dec eax
je 0x75feb4c4
dec eax
dec eax
jne 0x75feb4ba
push dword [esi + 0x50]
push dword [ebp + 8]
call fcn.75fd4e2e
test al, al
pop ecx
pop ecx
jne 0x75feb505
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 4
lea eax, [ebp + 8]
cmp dword [ebp - 8], eax
je 0x75feb4ba
mov ecx, dword [esi + 0x44]
mov dword [ebp - 4], ecx
call sym.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Freeze_void_
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
mov ecx, dword [esi + 0x44]
sub edi, dword [eax + 4]
mov dword [ebp - 4], ecx
call sym.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Freeze_void_
push dword [esi + 0x50]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push edi
push 1
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
cmp eax, edi
jne 0x75feb4ba
mov eax, ebx
jmp 0x75feb4bd
Function at 0x75feb7c4
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
cmp bx, 0xffff
push esi
mov esi, ecx
jne 0x75feb7e1
xor ax, ax
jmp 0x75feb8eb
mov eax, dword [esi + 0x20]
push edi
xor edi, edi
cmp dword [eax], edi
je 0x75feb813
mov ecx, dword [esi + 0x30]
mov eax, dword [eax]
mov ecx, dword [ecx]
lea ecx, [eax + ecx*2]
cmp eax, ecx
jae 0x75feb813
mov eax, dword [esi + 0x30]
dec dword [eax]
mov esi, dword [esi + 0x20]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], bx
mov ax, bx
jmp 0x75feb8ea
mov eax, dword [esi + 0x50]
cmp eax, edi
jne 0x75feb823
or ax, 0xffff
jmp 0x75feb8ea
cmp dword [esi + 0x38], edi
jne 0x75feb82c
push eax
push ebx
jmp 0x75feb88f
mov ecx, dword [esi + 0x44]
push 0xffffffffffffffff
push edi
mov dword [ebp + 8], ebx
call sym.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_int__unsigned_int_
mov ecx, dword [esi + 0x44]
push edi
push 8
call sym.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_unsigned_int__char_
mov edi, dword [esi + 0x44]
mov ecx, edi
call sym.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Freeze_void_
mov ecx, dword [esi + 0x44]
mov edi, dword [edi + 4]
call sym.MSVCP60.dll_public:_char____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::end_void_
mov ecx, dword [esi + 0x38]
lea edx, [ebp - 0xc]
push edx
mov dword [ebp - 4], eax
push dword [ebp - 4]
mov eax, dword [ecx]
push edi
lea edx, [ebp - 8]
push edx
lea edx, [ebp + 0xa]
push edx
lea edx, [ebp + 8]
push edx
lea edx, [esi + 0x40]
push edx
call dword [eax + 0x14]
sub eax, 0
je 0x75feb8aa
dec eax
je 0x75feb89e
dec eax
dec eax
jne 0x75feb81a
push dword [esi + 0x50]
push dword [ebp + 8]
call fcn.75fd4e50
pop ecx
test al, al
pop ecx
mov eax, ebx
jne 0x75feb8ea
jmp 0x75feb8e5
lea eax, [ebp + 8]
cmp dword [ebp - 8], eax
je 0x75feb81a
mov ecx, dword [esi + 0x44]
mov dword [ebp - 4], ecx
call sym.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Freeze_void_
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
mov ecx, dword [esi + 0x44]
sub edi, dword [eax + 4]
mov dword [ebp - 4], ecx
call sym.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Freeze_void_
push dword [esi + 0x50]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push edi
push 1
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
cmp eax, edi
mov eax, ebx
je 0x75feb8ea
mov eax, 0xffff
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x75ff68fa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
invalid
Function at 0x4c174b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
mov eax, dword [edi + 0x44]
xor ebx, ebx
cmp eax, ebx
je 0x4c17a6
cmp eax, 0xffffffff
je 0x4c17a6
cmp dword [ebp + 8], ebx
je 0x4c17a6
push esi
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [edi + 0x44]
push ebx
mov esi, eax
lea eax, [ebp - 4]
push eax
add esi, esi
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4cf302
cmp esi, dword [ebp - 4]
jne 0x4cf31d
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret 4
mov ebx, 0x80070057
jmp 0x4c179e

Function at 0x4c227c
Capabilities:
Query environment variable

Disassembly:
push 0x20
mov eax, 0x4d621c
call fcn.004c1350
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
push ebx
push 0x20019
push dword [0x4db458]
lea ecx, [ebp - 0x2c]
push 0x80000002
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
call fcn.004c2097
test eax, eax
jne 0x4c23c4
lea eax, [ebp - 0x20]
push eax
push dword [0x4db45c]
lea ecx, [ebp - 0x2c]
push ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ebx
call fcn.004c23dc
test eax, eax
jne 0x4c23c4
mov eax, dword [ebp - 0x20]
xor ecx, ecx
push 2
add eax, eax
pop edx
mul edx
seto cl
mov byte [ebp - 4], 1
neg ecx
or ecx, eax
push ecx
call fcn.004c13e0
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
cmp esi, ebx
je 0x4c23c4
lea eax, [ebp - 0x20]
push eax
push dword [0x4db45c]
lea ecx, [ebp - 0x2c]
push esi
call fcn.004c23dc
test eax, eax
jne 0x4c23bb
push ebx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call esi
mov edi, eax
cmp edi, ebx
je 0x4c23bb
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c13e0
pop ecx
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x4c23bb
push edi
push eax
push dword [ebp - 0x1c]
call esi
mov esi, eax
cmp esi, ebx
je 0x4c23b2
cmp dword [ebp + 8], ebx
je 0x4cea08
push dword [0x4db460]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + esi + 1]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c13e0
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x4c23b2
push dword [ebp - 0x14]
push esi
push eax
call fcn.004c21cb
push dword [0x4db460]
push edi
push dword [ebp - 0x18]
call fcn.004c2436
push dword [ebp - 0x14]
call fcn.004c13c0
pop ecx
push dword [ebp - 0x1c]
call fcn.004c13c0
pop ecx
lea ecx, [ebp - 0x2c]
call fcn.004c1f10
mov eax, dword [ebp - 0x18]
call fcn.004c1390
ret 4
Function at 0x4c23dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push edi
push esi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], ebx
jbe 0x4c242c
cmp dword [ebp - 4], 2
ja 0x4ce965
mov ecx, dword [edi]
test cl, 1
jne 0x4c242c
cmp esi, ebx
je 0x4c2425
shr ecx, 1
cmp word [esi + ecx*2 - 2], bx
jne 0x4c242c
pop edi
pop esi
pop ebx
leave
ret 0xc
push 0xd
pop eax
jmp 0x4c2425

Function at 0x4c24ed
Capabilities:
Delete file
Move file

Disassembly:
push 0x14
mov eax, 0x4d6b05
call fcn.004c1350
mov esi, ecx
mov eax, dword [esi + 0x44]
xor edi, edi
mov ebx, 0x8007000e
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
cmp eax, edi
je 0x4c2519
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x44], edi
cmp dword [ebp + 8], edi
je 0x4c265b
cmp dword [ebp + 0xc], edi
je 0x4c265b
push 1
call fcn.004c227c
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x4c264a
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov dword [ebp - 4], edi
call esi
push dword [ebp + 8]
mov edi, eax
call esi
lea eax, [eax + edi + 1]
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x20], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c13e0
pop ecx
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4c259b
push dword [ebp - 0x1c]
inc edi
push edi
push eax
call fcn.004c21cb
mov ebx, eax
test ebx, ebx
jl 0x4c259b
push dword [ebp + 8]
push dword [ebp - 0x20]
push dword [ebp - 0x18]
call fcn.004c2436
mov ebx, eax
test ebx, ebx
jl 0x4c259b
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
test ebx, ebx
jl 0x4c2632
push 2
pop ebx
push dword [ebp - 0x1c]
mov dword [ebp - 4], ebx
call esi
push dword [ebp + 0xc]
mov edi, eax
call esi
lea esi, [eax + edi + 1]
xor ecx, ecx
mov eax, esi
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c13e0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4c2654
push dword [ebp - 0x1c]
inc edi
push edi
push eax
call fcn.004c21cb
mov ebx, eax
test ebx, ebx
jl 0x4c2623
push dword [ebp + 0xc]
push esi
push dword [ebp - 0x14]
call fcn.004c2436
mov ebx, eax
test ebx, ebx
jl 0x4c2623
xor ebx, ebx
inc ebx
test ebx, ebx
jl 0x4c2623
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x4cf3a2
xor ebx, ebx
cmp dword [ebp - 0x14], 0
je 0x4c2632
push dword [ebp - 0x14]
call fcn.004c13c0
pop ecx
cmp dword [ebp - 0x18], 0
je 0x4c2641
push dword [ebp - 0x18]
call fcn.004c13c0
pop ecx
push dword [ebp - 0x1c]
call fcn.004c13c0
pop ecx
mov eax, ebx
call fcn.004c1390
ret 8
mov ebx, 0x8007000e
jmp 0x4c25fe
mov ebx, 0x80070057
jmp 0x4c264a
Function at 0x4c3a67
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4c3ae4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4c3ac0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x4c3ad0
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0xffffffff
pop esi
je 0x4ce30e
mov eax, dword [ebp - 8]
leave
ret
Function at 0x4c4267
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [0x4db00c], esi
jne 0x4c42be
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x4c2c6f
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4db00c], eax
cmp eax, esi
je 0x4ce4ec
push 0xffffffffffffffff
push dword [0x4db014]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x4db014]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [0x4db018], esi
jl 0x4ce50a
pop esi
leave
ret

Function at 0x4c4441
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x4c4498
call fcn.004c2712
xor eax, eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4c4490
cmp ecx, 0xffffffff
je 0x4c4490
and dword [ebp - 4], eax
mov edx, 0x5a4d
cmp word [ecx], dx
jne 0x4c4489
mov edx, dword [ecx + 0x3c]
test edx, edx
jl 0x4c4489
cmp edx, 0x10000000
jae 0x4c4489
lea eax, [edx + ecx]
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
jne 0x4ce892
mov dword [ebp - 4], 0xfffffffe
call fcn.004c2757
ret 4

Function at 0x4c681f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4db004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov esi, ecx
inc eax
cmp dword [esi + 0x2c], 0
jne 0x4c6933
push edi
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x105
push edi
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x420], eax
cmp eax, edi
ja 0x4ced16
lea eax, [ebp - 0x41c]
push eax
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.004c21cb
test eax, eax
jl 0x4c6932
mov ecx, dword [ebp - 0x420]
cmp word [ebp + ecx*2 - 0x210], 0x5c
je 0x4c68c3
push 0x4c6994
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.004c2436
test eax, eax
jl 0x4c6932
push 0x4c6980
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.004c2436
test eax, eax
jl 0x4c6932
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x2c], eax
test eax, eax
je 0x4ced20
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4c6970
push eax
call edi
push 0x4c695c
push dword [esi + 0x2c]
mov dword [esi + 0x30], eax
call edi
push 0x4c6948
push dword [esi + 0x2c]
mov dword [esi + 0x34], eax
call edi
cmp dword [esi + 0x30], 0
mov dword [esi + 0x38], eax
je 0x4c6940
cmp dword [esi + 0x34], 0
je 0x4c6940
test eax, eax
je 0x4c6940
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004c20d4
leave
ret
mov eax, 0x8007007f
jmp 0x4c6932