joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c170
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51fe03
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x589560]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
fld dword [0x56ee64]
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0x11
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 0xa
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
fstp dword [esi + 0xc]
fld dword [0x56ee68]
mov ecx, esi
fstp dword [esi + 0x10]
fld dword [0x56ee6c]
fstp dword [esi + 0x14]
call fcn.00499a00
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x46cd10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x523070
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
mov eax, dword [0x589560]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor eax, eax
mov byte [esp + 0xc], al
mov dword [esp + 8], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], vtable.t_fileTextRead.0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0xc]
push ecx
lea ebx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.00478c30
test al, al
jne 0x46cda1
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46cd83
push eax
call fcn.004fdda1
add esp, 4
lea ecx, [esp + 8]
call fcn.004707c0
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x24
ret 8
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.0046d1a0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46cdc1
push eax
call fcn.004fdda1
add esp, 4
lea ecx, [esp + 8]
call fcn.004707c0
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x24
ret 8
Function at 0x46d820
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x521c6b
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x589560]
xor eax, esp
push eax
lea eax, [esp + 0x144]
mov dword fs:[0], eax
mov edi, dword [esp + 0x158]
mov eax, dword [edi + 4]
mov ebx, dword [esp + 0x154]
xor ebp, ebp
xor esi, esi
cmp eax, ebp
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ebp
jbe 0x46d8ab
lea esp, [esp]
mov eax, esi
and eax, 1
mov ecx, edi
lea ebp, [esp + eax*2 + 0x14]
call fcn.0046adb0
movzx ecx, word [eax + esi*2]
push ecx
call fcn.005024bc
xor word [ebp], ax
add esi, 1
add esp, 4
cmp esi, dword [edi + 4]
jb 0x46d880
xor ebp, ebp
lea edx, [esp + 0x28]
mov edi, vtable.t_str.0
mov ecx, 1
lea esi, [esp + 0x24]
mov dword [esp + 0x1c], edi
mov byte [esp + 0x138], 1
mov word [esp + 0x136], 4
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x13c], ebp
mov dword [esp + 0x20], ebp
call fcn.0046b260
cmp byte [esp + 0x138], 0
lea eax, [esp + 0x28]
jne 0x46d8fd
mov eax, dword [esp + 0x24]
mov word [eax + 4], bp
push 0x5627bc
lea eax, [esp + 0x20]
push 0x551604
push eax
mov dword [esp + 0x158], ebp
call fcn.0046adf0
push str.mutex_file_
lea ecx, [esp + 0x2c]
push 0x551604
push ecx
call fcn.0046adf0
mov edx, dword [esp + 0x2c]
push edx
lea eax, [esp + 0x38]
push str.0x_08x
push eax
call fcn.0046adf0
add esp, 0x24
cmp byte [esp + 0x138], 0
lea eax, [esp + 0x28]
jne 0x46d959
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
add eax, 4
push eax
push ebx
call fcn.0046b470
test al, al
jne 0x46d9ac
mov ecx, ebx
call fcn.00470820
push 0x562ba8
push 0x551604
push eax
call fcn.0046adf0
add esp, 0xc
cmp byte [esp + 0x138], 0
mov dword [esp + 0x1c], edi
jne 0x46d9a8
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
cmp eax, ecx
je 0x46d9a8
push eax
call fcn.004fdda1
add esp, 4
xor al, al
jmp 0x46d9d1
cmp byte [esp + 0x138], 0
mov dword [esp + 0x1c], edi
jne 0x46d9cf
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x28]
cmp eax, edx
je 0x46d9cf
push eax
call fcn.004fdda1
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.004fe05a
add esp, 0x13c
ret 8
Function at 0x46ee80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x520af7
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x254], eax
push ebx
push esi
mov eax, dword [0x589560]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x46eed3
mov eax, dword [esi + 8]
push 2
add eax, 4
push 0x562c70
push eax
call fcn.004ffe23
add esp, 0xc
test eax, eax
je 0x46f050
mov ecx, esi
call fcn.0046e330
test al, al
je 0x46ef7e
cmp byte [ebp + 0xc], 0
je 0x46f050
cmp byte [esi + 0x11c], 0
je 0x46ef15
add esi, 0xc
jmp 0x46ef18
mov esi, dword [esi + 8]
lea ecx, [esp + 0x10]
call fcn.0046a650
lea eax, [esi + 4]
lea edx, [esp + 0x10]
call fcn.0046a7f0
lea eax, [esp + 0x10]
push eax
push 0x562c78
mov ecx, ebx
mov dword [esp + 0x278], 1
call fcn.00470820
mov ecx, eax
call fcn.00471790
cmp byte [esp + 0x12c], 0
mov dword [esp + 0x10], vtable.t_str.0
jne 0x46ef77
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
cmp eax, ecx
je 0x46ef77
push eax
call fcn.004fdda1
add esp, 4
xor al, al
jmp 0x46f052
lea ecx, [esp + 0x134]
call fcn.0046da30
lea edx, [esp + 0x134]
push edx
mov ecx, esi
mov dword [esp + 0x274], 2
call fcn.0046f810
test al, al
je 0x46efbb
push 0
push ebx
lea ecx, [esp + 0x13c]
call fcn.0046ee80
test al, al
je 0x46f026
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x46efca
mov eax, dword [esi + 8]
push 0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x46f036
cmp byte [esi + 0x11c], al
je 0x46efe7
add esi, 0xc
jmp 0x46efea
mov esi, dword [esi + 8]
lea ecx, [esp + 0x10]
call fcn.0046a650
lea eax, [esi + 4]
lea edx, [esp + 0x10]
call fcn.0046a7f0
lea eax, [esp + 0x10]
push eax
push 0x562c94
mov byte [esp + 0x278], 4
call fcn.00471620
mov ecx, eax
call fcn.00471790
lea ecx, [esp + 0x10]
call fcn.0046dfd0
lea ecx, [esp + 0x134]
call fcn.0046dfd0
xor al, al
jmp 0x46f052
mov eax, esi
call fcn.00470030
mov eax, esi
call fcn.0046ffe0
lea ecx, [esp + 0x134]
call fcn.0046dfd0
mov al, 1
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x254]
xor ecx, esp
call fcn.004fe05a
mov esp, ebp
pop ebp
ret 8
Function at 0x472250
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x51fcdb
mov eax, dword fs:[0]
push eax
sub esp, 0x330
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x32c], eax
push esi
push edi
mov eax, dword [0x589560]
xor eax, esp
push eax
lea eax, [esp + 0x33c]
mov dword fs:[0], eax
push 0x206
lea eax, [esp + 0x136]
push 0
push eax
mov edi, ecx
mov esi, edx
mov word [esp + 0x13c], 0
call fcn.005002f0
add esp, 0xc
lea ecx, [esp + 0x130]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4722fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.00470820
push 0x563dc4
mov esi, eax
push 0x551604
push esi
call fcn.0046adf0
push edi
push 0x562788
push esi
call fcn.0046adf0
add esp, 0x18
xor al, al
jmp 0x4723a9
lea eax, [esp + 0x130]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x472306
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x12e], 0x5c
jne 0x472347
lea eax, [esp + 0x130]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x472330
sub eax, edx
sar eax, 1
mov word [esp + eax*2 + 0x12e], cx
lea ecx, [esp + 0xc]
call fcn.0046a650
lea eax, [esp + 0x130]
lea edx, [esp + 0xc]
call fcn.0046a7f0
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x472372
mov eax, dword [esp + 0x14]
add eax, 4
lea edx, [edi + 0x130]
call fcn.0046a7f0
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x4723a7
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x4723a7
push eax
call fcn.004fdda1
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x33c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x32c]
xor ecx, esp
call fcn.004fe05a
add esp, 0x33c
ret
Function at 0x472700
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x51fc96
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x589560]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x270]
mov edi, ecx
lea ecx, [esp + 0x138]
call fcn.0046a650
xor ebx, ebx
mov ecx, 0x105
mov dword [esp + 0x268], ebx
lea esi, [esp + 0x140]
mov dword [esp + 0x258], ecx
call fcn.0046b260
cmp byte [esp + 0x254], bl
lea eax, [esp + 0x144]
jne 0x472788
mov eax, dword [esp + 0x140]
push ebx
push 0x1a
add eax, 4
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
je 0x472832
cmp dword [esp + 0x258], ebx
je 0x4727af
mov dword [esp + 0x258], ebx
mov ecx, 1
lea esi, [esp + 0x140]
mov dword [esp + 0x13c], ebx
call fcn.0046b260
cmp byte [esp + 0x254], bl
lea eax, [esp + 0x144]
jne 0x4727de
mov eax, dword [esp + 0x140]
mov ecx, edi
mov word [eax + 4], bx
call fcn.00470820
push 0x563df0
push 0x551604
push eax
call fcn.0046adf0
add esp, 0xc
cmp byte [esp + 0x254], bl
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jne 0x47282b
mov eax, dword [esp + 0x140]
lea ecx, [esp + 0x144]
cmp eax, ecx
je 0x47282b
push eax
call fcn.004fdda1
add esp, 4
xor al, al
jmp 0x4728dd
lea edi, [esp + 0x138]
call fcn.0046ab70
cmp byte [esp + 0x254], bl
lea esi, [esp + 0x144]
jne 0x472855
mov esi, dword [esp + 0x140]
lea ecx, [esp + 0x14]
call fcn.0046a650
lea eax, [esi + 4]
lea edx, [esp + 0x14]
call fcn.0046a7f0
cmp byte [esp + 0x130], bl
lea eax, [esp + 0x20]
jne 0x47287b
mov eax, dword [esp + 0x1c]
add eax, 4
lea edx, [ebp + 0x254]
call fcn.0046a7f0
cmp byte [esp + 0x130], bl
mov esi, vtable.t_str.0
mov dword [esp + 0x14], esi
jne 0x4728b0
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
cmp eax, edx
je 0x4728b0
push eax
call fcn.004fdda1
add esp, 4
cmp byte [esp + 0x254], bl
mov dword [esp + 0x138], esi
jne 0x4728db
mov eax, dword [esp + 0x140]
lea ecx, [esp + 0x144]
cmp eax, ecx
je 0x4728db
push eax
call fcn.004fdda1
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.004fe05a
add esp, 0x258
ret 4

Function at 0x472be0
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call edi
call edi
lea edx, [esi + 0x4d4]
call fcn.0046a7f0
cmp byte [esi + 0x5f0], 0
lea eax, [esi + 0x4e0]
jne 0x472c0e
mov eax, dword [esi + 0x4dc]
add esi, 0x5f8
add eax, 4
mov edx, esi
call fcn.0046a7f0
mov eax, esi
call fcn.0046b200
pop edi
mov al, 1
pop esi
ret
Function at 0x473a00
Capabilities:
Get file version info

Disassembly:
sub esp, 0x424
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push ebp
mov ebp, dword [esp + 0x430]
xor ebx, ebx
push 0x206
lea eax, [esp + 0x1e]
push ebx
push eax
mov word [esp + 0x24], bx
call fcn.005002f0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x473a65
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004fe05a
add esp, 0x424
ret
push esi
push 0x206
lea edx, [esp + 0x22a]
push ebx
push edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
mov word [esp + 0x230], bx
call fcn.005002f0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jne 0x473ac3
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004fe05a
add esp, 0x424
ret
push edi
push esi
call fcn.004fdc99
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x473ada
xor al, al
jmp 0x473b85
mov edx, dword [esp + 0x1c]
push edi
push esi
push edx
lea eax, [esp + 0x2c]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x473b7a
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x473b7a
cmp dword [esp + 0x10], 4
jb 0x473b7a
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
lea eax, [esp + 0x230]
push str.StringFileInfo_04x_04xCompanyName
push eax
call fcn.0040e060
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x230]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x473b7a
mov ecx, dword [esp + 0x10]
cmp ecx, 2
jbe 0x473b7a
mov eax, dword [esp + 0x18]
cmp word [eax + ecx*2 - 2], bx
jne 0x473b6e
mov edx, ebp
call fcn.0046a7f0
jmp 0x473b78
push eax
mov eax, ecx
mov ebx, ebp
call fcn.0046a850
mov bl, 1
push edi
call fcn.004fdda1
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004fe05a
add esp, 0x424
ret
Function at 0x474120
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebx, ecx
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 4]
push edx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x20]
push eax
push 0
push ebx
push ecx
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x474239
test ebx, ebx
je 0x4741e7
cmp word [ebx], 0
je 0x4741e7
cmp byte [esi + 0x128], 0
je 0x47417d
add esi, 0x18
mov dword [esp + 0x1c], esi
jmp 0x474184
mov edx, dword [esi + 0x14]
mov dword [esp + 0x1c], edx
mov ecx, ebp
call fcn.00470820
mov esi, eax
call fcn.00471650
mov ecx, ebp
call fcn.00470820
push 0x5640bc
mov esi, eax
push 0x551604
push esi
call fcn.0046adf0
mov eax, dword [esp + 0x28]
add eax, 4
push eax
push 0x551604
push esi
call fcn.0046adf0
push 0x54ea84
push 0x551604
push esi
call fcn.0046adf0
push ebx
push 0x551604
push esi
call fcn.0046adf0
add esp, 0x30
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0xc
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x4741f6
mov ebx, dword [esi + 0x14]
mov ecx, ebp
call fcn.00470820
mov esi, eax
call fcn.00471650
mov ecx, ebp
call fcn.00470820
push 0x5640bc
mov esi, eax
push 0x551604
push esi
call fcn.0046adf0
add ebx, 4
push ebx
push 0x551604
push esi
call fcn.0046adf0
add esp, 0x18
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x20]
je 0x474316
test ebx, ebx
je 0x4742d0
cmp word [ebx], 0
je 0x4742d0
cmp byte [esi + 0x128], 0
je 0x474267
add esi, 0x18
mov dword [esp + 0x1c], esi
jmp 0x47426e
mov edx, dword [esi + 0x14]
mov dword [esp + 0x1c], edx
mov ecx, ebp
call fcn.00470820
xor edi, edi
mov esi, eax
call fcn.00471650
mov ecx, ebp
call fcn.00470820
push 0x5640cc
mov esi, eax
push 0x551604
push esi
call fcn.0046adf0
mov eax, dword [esp + 0x28]
add esp, 0xc
add eax, 4
push eax
mov ecx, esi
call fcn.00471770
push 0x54ea84
mov esi, eax
push 0x551604
push esi
call fcn.0046adf0
add esp, 0xc
push ebx
mov ecx, esi
call fcn.00471770
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0xc
cmp byte [esi + 0x128], 0
je 0x4742de
add esi, 0x18
jmp 0x4742e1
mov esi, dword [esi + 0x14]
mov ecx, ebp
call fcn.00470820
push 0x5640cc
mov edi, eax
push 0x551604
push edi
call fcn.0046adf0
add esi, 4
push esi
push 0x551604
push edi
call fcn.0046adf0
add esp, 0x18
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 0xc
Function at 0x474320
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x474438
test ebx, ebx
je 0x4743e7
cmp word [ebx], 0
je 0x4743e7
cmp byte [esi + 0x128], 0
je 0x47436e
add esi, 0x18
mov dword [esp + 0x1c], esi
jmp 0x474375
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x1c], ecx
mov ecx, ebp
call fcn.00470820
mov esi, eax
call fcn.00471650
mov ecx, ebp
call fcn.00470820
push 0x5640e4
mov esi, eax
push 0x551604
push esi
call fcn.0046adf0
mov edx, dword [esp + 0x28]
add edx, 4
push edx
push 0x551604
push esi
call fcn.0046adf0
push 0x5640fc
push 0x551604
push esi
call fcn.0046adf0
push ebx
push 0x551604
push esi
call fcn.0046adf0
push 0x54bc68
push 0x551604
push esi
call fcn.0046adf0
add esp, 0x3c
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x4743f6
mov ebx, dword [esi + 0x14]
mov ecx, ebp
call fcn.00470820
mov esi, eax
call fcn.00471650
mov ecx, ebp
call fcn.00470820
push 0x5640e4
mov esi, eax
push 0x551604
push esi
call fcn.0046adf0
add ebx, 4
push ebx
push 0x551604
push esi
call fcn.0046adf0
add esp, 0x18
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0xc

Function at 0x474450
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
test edi, edi
je 0x4744ed
cmp edi, 2
je 0x4744ed
cmp byte [esi + 0x128], 0
push ebx
lea ebx, [esi + 0x18]
jne 0x47448b
mov ebx, dword [esi + 0x14]
mov ecx, ebp
call fcn.00470820
mov esi, eax
call fcn.00471650
mov ecx, ebp
call fcn.00470820
push 0x564104
mov esi, eax
push 0x551604
push esi
call fcn.0046adf0
add ebx, 4
push ebx
push 0x551604
push esi
call fcn.0046adf0
push 0x54ea84
push 0x551604
push esi
call fcn.0046adf0
mov edx, dword [esp + 0x3c]
push edx
push 0x551604
push esi
call fcn.0046adf0
add esp, 0x30
pop ebx
pop edi
pop esi
xor al, al
pop ebp
ret 8
pop edi
pop esi
mov al, 1
pop ebp
ret 8
Function at 0x474500
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 4]
push str.SogouPyPreloader
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
test edi, edi
je 0x4745b5
cmp edi, 2
je 0x4745b5
cmp byte [esi + 0x128], 0
push ebx
lea ebx, [esi + 0x18]
jne 0x474543
mov ebx, dword [esi + 0x14]
mov ecx, ebp
call fcn.00470820
mov esi, eax
call fcn.00471650
mov ecx, ebp
call fcn.00470820
push 0x564118
mov esi, eax
push 0x551604
push esi
call fcn.0046adf0
add ebx, 4
push ebx
push 0x551604
push esi
call fcn.0046adf0
push 0x5640fc
push 0x551604
push esi
call fcn.0046adf0
push str.SogouPyPreloader
push 0x551604
push esi
call fcn.0046adf0
push 0x54bc68
push 0x551604
push esi
call fcn.0046adf0
add esp, 0x3c
pop ebx
pop edi
pop esi
xor al, al
pop ebp
ret 4
pop edi
pop esi
mov al, 1
pop ebp
ret 4

Function at 0x474700
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, eax
mov ebx, ecx
mov ecx, 0x401
lea esi, [edi + 8]
mov dword [edi + 0x120], ecx
call fcn.0046b260
cmp byte [esi + 0x114], 0
lea eax, [esi + 4]
jne 0x474729
mov eax, dword [esi]
mov ecx, dword [ebx + 4]
push 0x3ff
add eax, 4
push eax
mov eax, dword [esp + 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebp, eax
call fcn.0046ab70
test ebp, ebp
je 0x4747dc
xor eax, eax
cmp dword [edi + 0x120], eax
je 0x474760
mov dword [edi + 0x120], eax
mov ecx, 1
mov dword [edi + 4], eax
call fcn.0046b260
cmp byte [esi + 0x114], 0
je 0x47477b
add esi, 4
jmp 0x47477d
mov esi, dword [esi]
mov word [esi + 4], 0
cmp byte [ebx + 0x128], 0
je 0x474791
add ebx, 0x18
jmp 0x474794
mov ebx, dword [ebx + 0x14]
mov ecx, dword [esp + 0x14]
call fcn.00470820
mov edi, ebp
mov esi, eax
call fcn.00471650
mov ecx, dword [esp + 0x14]
call fcn.00470820
push 0x564160
mov esi, eax
push 0x551604
push esi
call fcn.0046adf0
add ebx, 4
push ebx
push 0x551604
push esi
call fcn.0046adf0
add esp, 0x18
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
Function at 0x4759b0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push edi
push 0
push eax
mov eax, dword [esp + 0x14]
mov edi, ecx
push edi
call fcn.00476540
test al, al
jne 0x4759cc
pop edi
ret 8
mov edx, dword [edi + 4]
push esi
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4759f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4759f7
xor esi, esi
mov dword [edi + 0x350], esi
pop esi
mov al, 1
pop edi
ret 8

Function at 0x475ba0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52185b
mov eax, dword fs:[0]
push eax
sub esp, 0x370
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x368], eax
push ebx
push esi
push edi
mov eax, dword [0x589560]
xor eax, esp
push eax
lea eax, [esp + 0x380]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea edi, [esp + 0x1c]
mov ebx, ecx
mov dword [esp + 0x14], eax
call fcn.004763d0
xor edi, edi
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
mov dword [esp + 0x36c], edi
mov dword [esp + 0x370], edi
mov dword [esp + 0x388], edi
mov ecx, dword [esp + 0x14]
push ecx
push esi
lea ecx, [esp + 0x24]
call fcn.004759b0
test al, al
jne 0x475c7a
mov ecx, esi
call fcn.00470820
push 0x5554d8
push 0x551604
push eax
call fcn.0046adf0
mov dword [esp + 0x394], 0xffffffff
add esp, 0xc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.00476480
xor al, al
jmp 0x475cfb
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x475ca9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x475ca5
xor eax, eax
jmp 0x475ca9
mov eax, dword [esp + 0x18]
push eax
mov dword [ebx + 8], eax
call fcn.004fdc99
mov ecx, dword [ebx + 8]
add esp, 4
push ecx
push eax
push esi
lea ecx, [esp + 0x374]
mov dword [ebx + 4], eax
call fcn.00475a10
test al, al
je 0x475c32
mov dword [esp + 0x388], 0xffffffff
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.00476480
mov al, 1
mov ecx, dword [esp + 0x380]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x368]
xor ecx, esp
call fcn.004fe05a
mov esp, ebp
pop ebp
ret 8

Function at 0x475e30
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
jmp fcn.0047ab50

Function at 0x475f40
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret