joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422b24
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x422bf7
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409cbc
cmp byte [ebp - 9], 0
je 0x422bb5
mov eax, ebx
call fcn.0040a504
push eax
call sub.kernel32.dll_GetFileAttributesW
test ah, 4
je 0x422bb5
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00420c04
test al, al
je 0x422bb5
mov eax, dword [ebp - 8]
call fcn.0042313c
test al, al
je 0x422baa
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00422f14
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0042927c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
call fcn.0040a770
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00409cbc
push edi
mov eax, dword [ebp - 4]
call fcn.0040a504
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x422bcf
call sub.kernel32.dll_GetLastError
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422bfe
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004098f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004098f4
ret

Function at 0x422d30
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.0040a504
mov ebp, eax
push ebp
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x422d85
call sub.kernel32.dll_GetLastError
mov edi, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x422d7f
test ah, 4
je 0x422d7f
test al, 0x10
je 0x422d7f
mov eax, esi
call fcn.0040a504
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
push edi
call sub.kernel32.dll_SetLastError

Function at 0x426d7c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x426db5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00409a1c
jmp 0x426dbe
mov eax, ebx
mov edx, esi
call fcn.00409c74
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x426dc8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x426dea
movzx eax, word [esp]
jmp 0x426dec
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x427e00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x427f25
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00427c08
mov esi, eax
mov eax, dword [0x72aee0]
cmp byte [eax], 0
je 0x427ecd
mov eax, dword [0x72a94c]
call fcn.00407554
call fcn.00407084
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x427dd0]
call fcn.0040bd20
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x427f40
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x427f09
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x72a878]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x72f634]
call fcn.0040c140
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427f2c
lea eax, [ebp - 4]
mov edx, dword [0x427dd0]
call fcn.0040be44
ret

Function at 0x428c28
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x428cfe
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409cbc
lea eax, [ebp - 4]
call fcn.00409e2c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a504
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x428ce8
mov eax, ebx
call fcn.00406f10
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x428ce1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a504
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x428ccb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x428d10
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x428ccb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428ce8
mov eax, dword [ebp - 0x10]
call fcn.00406f2c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428d05
lea eax, [ebp - 4]
call fcn.00409894
ret
Function at 0x428d14
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x428e14
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409cbc
lea eax, [ebp - 4]
call fcn.00409e2c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a504
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x428dfe
mov eax, ebx
call fcn.00406f10
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x428df7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a504
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x428de1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x428e28
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x428de1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428dfe
mov eax, dword [ebp - 0x10]
call fcn.00406f2c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428e1b
lea eax, [ebp - 4]
call fcn.00409894
ret

Function at 0x42a7cc
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff800
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.00409894
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.0040a504
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
mov ebx, eax
cmp ebx, 0x400
jge 0x42a811
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.00409a1c
jmp 0x42a82a
mov edx, ebx
dec edx
mov eax, esi
call fcn.0040a698
push ebx
mov eax, dword [esi]
call fcn.0040a504
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
add esp, 0x800
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42af3c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42af5c
sub eax, 4
mov eax, dword [eax]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x42af76
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42af71
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x42af7b
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x42afe9
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x42b032
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42afa7
inc dword [ebp - 0xc]
jmp 0x42afbf
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x42afbf
cmp dword [ebp - 0xc], 0
jle 0x42afbf
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x42afe1
xor eax, eax
jmp 0x42afdd
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42afdc
mov eax, esi
jmp 0x42b035
inc eax
cmp eax, ecx
jle 0x42afc9
inc esi
cmp esi, dword [ebp - 8]
jl 0x42af93
jmp 0x42b032
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x42b032
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42b00a
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x42b02c
xor eax, eax
jmp 0x42b028
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42b027
mov eax, esi
jmp 0x42b035
inc eax
cmp eax, ecx
jle 0x42b014
inc esi
cmp esi, dword [ebp - 8]
jl 0x42aff2
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42b2a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42b2c7
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42b2d7
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x42b3f9
test ebx, ebx
jl 0x42b3f9
test esi, esi
jle 0x42b3f9
mov eax, dword [ebp - 8]
call fcn.0040a504
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040a504
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42b396
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x42b3f9
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42b37b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42b34a
inc dword [ebp - 0x14]
jmp 0x42b35a
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x42b35a
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x42b365
or eax, 0xffffffff
jmp 0x42b37b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42b378
inc eax
jmp 0x42b37b
or eax, 0xffffffff
test eax, eax
jl 0x42b383
cmp esi, eax
jg 0x42b338
cmp esi, eax
jg 0x42b38e
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42b3fc
inc edx
dec dword [ebp - 0x1c]
jne 0x42b334
jmp 0x42b3f9
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x42b3f9
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42b3e0
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42b3bf
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42b3ca
or eax, 0xffffffff
jmp 0x42b3e0
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42b3dd
inc eax
jmp 0x42b3e0
or eax, 0xffffffff
test eax, eax
jl 0x42b3e8
cmp esi, eax
jg 0x42b3a8
cmp esi, eax
jg 0x42b3f3
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42b3fc
inc edx
dec dword [ebp - 0x1c]
jne 0x42b3a4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46d738
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x46d740
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4a73ec
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a748a
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x4a744e
cmp byte [ebx + 0x11], 0
jne 0x4a744e
cmp byte [ebx + 0x24], 0
jne 0x4a744e
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4a746f
lea edx, [ebp - 4]
mov eax, dword [0x72adf4]
call fcn.0040ecf0
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x47e934]
call fcn.00427f50
call fcn.00408f50
jmp 0x4a746f
lea edx, [ebp - 8]
mov eax, dword [0x72adf4]
call fcn.0040ecf0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x47e934]
call fcn.00427f50
call fcn.00408f50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7491
lea eax, [ebp - 8]
mov edx, 2
call fcn.004098f4
ret

Function at 0x4a7958
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4a79a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004a7338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a79bf
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4a79c8
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004a7338
dec esi
jne 0x4a79ea
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x4aa208
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x731e38
cmp dword [edi], 0
jne 0x4aa284
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x731e34]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x6a45dc
mov ecx, 2
call fcn.00407188
mov edx, 0x4aa1e0
lea eax, [esi + 5]
call fcn.004aa200
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004aa200
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4aa259
mov dword [0x731e34], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4c0180
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
xor ebx, ebx
cmp dword [esp], 0
je 0x4c01e5
mov eax, dword [esp]
call fcn.004c06a0
test al, al
je 0x4c01e5
mov eax, dword [esp]
call fcn.004c0390
mov esi, eax
call sub.kernel32.dll_GetLogicalDrives
mov edi, eax
dec esi
mov eax, dword [esp]
movzx eax, word [eax + esi*2]
mov edx, eax
mov ecx, eax
add ecx, 0xffffff9f
sub cx, 0x1a
jae 0x4c01c8
mov edx, eax
and dx, 0xffdf
mov eax, edx
cmp ax, 0x41
jb 0x4c01e5
cmp ax, 0x5a
ja 0x4c01e5
sub al, 0x41
mov ecx, eax
shr edi, cl
and edi, 1
cmp edi, 1
sete bl
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4c4c88
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c4e1d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4c4df2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x4c4dd5
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dl, 1
call fcn.004227f0
test al, al
je 0x4c4dd5
push 0x20
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dl, 1
mov eax, dword [0x4798c0]
call fcn.00499b74
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4c4dce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx]
mov ebx, eax
mov eax, dword [ebp - 0x10]
call fcn.0049918c
sub ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x404b84]
call fcn.0040bd20
add esp, 4
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 8]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.0042bc04
mov ebx, eax
mov dl, 1
mov eax, dword [0x4767f4]
call fcn.0049912c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c4db1
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 4]
test esi, esi
je 0x4c4d6e
sub esi, 4
mov esi, dword [esi]
sub esi, ebx
push esi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov ecx, ebx
mov edx, dword [ebp - 4]
call fcn.0042c1cc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004c50ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4db8
mov eax, dword [ebp - 0xc]
call fcn.00407aa0
ret
mov eax, dword [ebp - 8]
call fcn.004c4ae4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4df9
mov eax, dword [ebp - 8]
mov byte [eax + 0x10], 0
ret
Function at 0x4c72b4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c746f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409cbc
mov eax, dword [ebp - 4]
call fcn.004c6e14
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4c7306
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040a928
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004c78e8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4c73e5
xor eax, eax
push ebp
push 0x4c73de
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004c6f94
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004c7480
test al, al
je 0x4c73bc
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00409a1c
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4c73bc
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040a504
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004c6ef4
test al, al
je 0x4c73b6
mov eax, dword [ebp - 8]
call fcn.0040a504
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040a56c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004c72b4
dec ebx
cmp ebx, 0xffffffff
jne 0x4c7365
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c73e5
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004c6f94
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey
ret
cmp byte [0x731e84], 0
je 0x4c7425
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.0040a504
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004c6f80
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004c6ef4
mov ebx, eax
jmp 0x4c744c
mov eax, dword [ebp - 4]
call fcn.0040a504
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004c6f80
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004c6ef4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7476
lea eax, [ebp - 0x3c]
call fcn.00409894
lea eax, [ebp - 8]
mov edx, 2
call fcn.004098f4
ret
Function at 0x4c77f8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.004c6e2c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040a504
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.004c6ef4
test al, al
jne 0x4c7860
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x72ac5c]
mov dl, 1
mov eax, dword [0x4c5bf8]
call fcn.00428048
call fcn.00408f50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4c786c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040a504
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.004c6ef4
test al, al
jne 0x4c78cd
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x72b214]
mov dl, 1
mov eax, dword [0x4c5bf8]
call fcn.00428048
call fcn.00408f50
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004c6e5c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4d05f0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4d05f6
ret
Function at 0x4edc00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x6a67f4
test edx, edx
jne 0x4edc1f
xor eax, eax
jmp 0x4edd3d
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x4edc3c
push esi
push edx
push eax
call fcn.004edd44
add esp, 0xc
jmp 0x4edd3d
push esi
push edx
push eax
call fcn.004ee004
add esp, 0xc
jmp 0x4edd3d
pop esi
pop ebx
pop ecx
pop ebp
ret