joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429fd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x429ff0
sub eax, 4
mov eax, dword [eax]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x42a00a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42a005
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x42a00f
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x42a07d
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x42a0c6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42a03b
inc dword [ebp - 0xc]
jmp 0x42a053
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x42a053
cmp dword [ebp - 0xc], 0
jle 0x42a053
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x42a075
xor eax, eax
jmp 0x42a071
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42a070
mov eax, esi
jmp 0x42a0c9
inc eax
cmp eax, ecx
jle 0x42a05d
inc esi
cmp esi, dword [ebp - 8]
jl 0x42a027
jmp 0x42a0c6
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x42a0c6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42a09e
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x42a0c0
xor eax, eax
jmp 0x42a0bc
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42a0bb
mov eax, esi
jmp 0x42a0c9
inc eax
cmp eax, ecx
jle 0x42a0a8
inc esi
cmp esi, dword [ebp - 8]
jl 0x42a086
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42a238
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42a257
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42a267
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x42a389
test ebx, ebx
jl 0x42a389
test esi, esi
jle 0x42a389
mov eax, dword [ebp - 8]
call fcn.0040aac8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040aac8
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42a326
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x42a389
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42a30b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42a2da
inc dword [ebp - 0x14]
jmp 0x42a2ea
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x42a2ea
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x42a2f5
or eax, 0xffffffff
jmp 0x42a30b
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42a308
inc eax
jmp 0x42a30b
or eax, 0xffffffff
test eax, eax
jl 0x42a313
cmp esi, eax
jg 0x42a2c8
cmp esi, eax
jg 0x42a31e
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42a38c
inc edx
dec dword [ebp - 0x1c]
jne 0x42a2c4
jmp 0x42a389
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x42a389
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42a370
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42a34f
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42a35a
or eax, 0xffffffff
jmp 0x42a370
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42a36d
inc eax
jmp 0x42a370
or eax, 0xffffffff
test eax, eax
jl 0x42a378
cmp esi, eax
jg 0x42a338
cmp esi, eax
jg 0x42a383
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42a38c
inc edx
dec dword [ebp - 0x1c]
jne 0x42a334
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x437a68
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x437a70
mov eax, edx
pop esi
pop ebx
ret

Function at 0x43a544
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x43a55b
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x43a54b
mov eax, ecx
pop ebx
ret
Function at 0x4498ec
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x449900
add esp, 0xfffffff0
call fcn.004088d8
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x443988]
call fcn.00463d68
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x448928]
call fcn.004653c4
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x448928]
call fcn.004653c4
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x449955
call fcn.00408930
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49de5c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x49deaa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0049d840
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49dec3
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4ad508
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x4ad5a4
push 0
mov eax, ebx
call fcn.0040aac8
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x4ad57f
mov ebx, esi
test ebx, ebx
je 0x4ad551
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040aac8
push eax
push 1
push 0
mov eax, edi
call fcn.0040aac8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
test ebx, ebx
je 0x4ad59a
mov ecx, dword [0x4d87f4]
mov dl, 1
mov eax, dword [0x4ac234]
call fcn.004273d0
call fcn.00409768
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4ae47c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
test ecx, ecx
jbe 0x4ae4ad
dec ecx
test ecx, ecx
jb 0x4ae4ad
inc ecx
xor ebx, ebx
movzx esi, byte [edx + ebx]
mov edi, dword [eax]
and edi, 0xff
xor esi, edi
mov esi, dword [esi*4 + 0x4df984]
mov edi, dword [eax]
shr edi, 8
xor esi, edi
mov dword [eax], esi
inc ebx
dec ecx
jne 0x4ae48b
pop edi
pop esi
pop ebx
ret
Function at 0x4aedf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4aef3e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4d4584]
mov edx, dword [eax]
call dword [edx]
xor eax, eax
push ebp
push 0x4aef17
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d4590], 0
jne 0x4aeeea
mov dword [0x4d4590], 0x104
mov eax, dword [0x4d458c]
test eax, eax
je 0x4aee66
cmp word [eax], 0
je 0x4aee66
lea eax, [ebp - 4]
mov edx, dword [0x4d458c]
call fcn.0040ab28
mov eax, dword [ebp - 4]
sub eax, 0xa
movzx esi, word [eax]
jmp 0x4aee6a
mov si, 2
movzx eax, si
imul dword [0x4d4590]
call fcn.00407264
mov dword [0x4d458c], eax
mov eax, dword [0x4d458c]
push eax
mov eax, dword [0x4d4590]
push eax
call sub.kernel32.dll_GetTempPathW
mov dword [0x4d4590], eax
mov eax, ebx
mov ecx, dword [0x4d4590]
mov edx, dword [0x4d458c]
call fcn.0040a208
mov eax, dword [ebx]
call fcn.004aedd4
mov eax, dword [ebx]
call fcn.004afda8
test al, al
jne 0x4aeefd
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, 0x4aedcc
call fcn.0040fd9c
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x418fd0]
call fcn.0042734c
call fcn.00409768
jmp 0x4aeefd
mov eax, ebx
mov ecx, dword [0x4d4590]
mov edx, dword [0x4d458c]
call fcn.0040a208
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aef1e
mov eax, dword [0x4d4584]
mov edx, dword [eax]
call dword [edx + 4]
pop eax
jmp eax
Function at 0x4af388
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004af29c
mov eax, 0x4d4594
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xb
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
jne 0x4af3c8
call fcn.004291c8
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x20
call fcn.00407d78
mov dword [ebp - 0x2c], 0x10000000
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 3
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 5
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
push 1
call sub.advapi32.dll_SetEntriesInAclW
test eax, eax
je 0x4af418
call fcn.004291c8
xor eax, eax
push ebp
push 0x4af4b4
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
lea eax, [ebp - 0x4c]
push eax
call sub.advapi32.dll_InitializeSecurityDescriptor
test eax, eax
jne 0x4af43a
call fcn.004291c8
push 0
mov eax, dword [ebp - 4]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x4c]
push eax
call sub.advapi32.dll_SetSecurityDescriptorDacl
test eax, eax
jne 0x4af454
call fcn.004291c8
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0xc
call fcn.00407d78
mov dword [ebp - 0x38], 0xc
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebx]
call fcn.0040aac8
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4af49b
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x4af49b
call fcn.004291c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af4bb
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LocalFree
pop eax
jmp eax
Function at 0x4af6ac
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
mov ebx, eax
mov dword [ebp - 0xc], 0xffffffff
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.0040aac8
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4af6e9
call fcn.004291c8
xor eax, eax
push ebp
push 0x4af857
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetFileSizeEx
test al, al
jne 0x4af70d
call fcn.004291c8
cmp dword [ebp - 0x1c], 0
jne 0x4af71f
cmp dword [ebp - 0x20], 0
jbe 0x4af83e
jmp 0x4af725
jle 0x4af83e
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4af746
call fcn.004291c8
xor eax, eax
push ebp
push 0x4af837
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x24], 0x400000
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
jmp 0x4af806
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp edx, dword [ebp - 0x1c]
jne 0x4af77f
cmp eax, dword [ebp - 0x20]
ja 0x4af789
jmp 0x4af781
jg 0x4af789
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
jmp 0x4af78f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 4
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x4af7b4
call fcn.004291c8
xor eax, eax
push ebp
push 0x4af7e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
call fcn.004ae47c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af7f0
mov eax, dword [ebp - 0x2c]
push eax
call sub.kernel32.dll_UnmapViewOfFile
pop eax
jmp eax
cmp dword [ebp - 0x1c], 0
jne 0x4af818
cmp dword [ebp - 0x20], 0
ja 0x4af76e
jmp 0x4af81e
jg 0x4af76e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af83e
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af85e
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
Function at 0x4afa28
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
mov dword [esi], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x14]
push eax
mov eax, edi
call fcn.0040aac8
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
seta byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x4afb10
mov eax, ebx
call fcn.00407264
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4afb09
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
mov eax, edi
call fcn.0040aac8
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4afaf1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4afb20
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4afaf1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
mov edx, eax
shr edx, 0x10
mov dword [esi], edx
and eax, 0xffff
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov edx, eax
shr edx, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
and eax, 0xffff
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afb10
mov eax, dword [ebp - 0xc]
call fcn.00407280
pop eax
jmp eax
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4afb24
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, edi
mov edx, dword [0x4d89f0]
mov edx, dword [edx]
call fcn.0040a460
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040aac8
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jbe 0x4afc05
mov eax, ebx
call fcn.00407264
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4afbfe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040aac8
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4afbe6
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4afc0c
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4afbb7
mov ecx, dword [ebp - 8]
dec ecx
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.0040a208
jmp 0x4afbe6
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4afc54
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4afbe6
mov eax, dword [ebp - 0x14]
test byte [eax + 0x1c], 1
je 0x4afbe6
mov eax, edi
mov edx, 0x4afc64
call fcn.0040a460
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afc05
mov eax, dword [ebp - 4]
call fcn.00407280
pop eax
jmp eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b3544
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4b3641
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x46e4d8]
call fcn.00493004
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4b3622
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetEnvironmentStringsW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4b35ff
xor eax, eax
push ebp
push 0x4b35f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 0xc]
jmp 0x4b35d9
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040ab28
mov edx, dword [ebp - 4]
mov eax, 0x4b365c
call fcn.004aa198
mov ebx, eax
test bl, bl
jne 0x4b35c9
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, esi
call fcn.0040a568
mov edi, eax
inc edi
mov eax, edi
add eax, eax
add esi, eax
cmp word [esi], 0
jne 0x4b35a1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b35ff
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FreeEnvironmentStringsW
pop eax
jmp eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3629
mov eax, dword [ebp - 0x10]
call fcn.00408404
pop eax
jmp eax
Function at 0x4b54a0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x4b5710
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4dfd98
xor ecx, ecx
mov edx, 0x10
call fcn.00407d78
mov eax, dword [0x4d86f4]
movzx eax, byte [eax]
xor al, 1
mov byte [ebp - 9], al
mov byte [ebp - 0xa], 0
cmp byte [ebp - 9], 0
jne 0x4b55c4
lea eax, [ebp - 0x20]
call fcn.004b542c
mov eax, dword [ebp - 0x20]
call fcn.0040aac8
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b55c4
xor eax, eax
push ebp
push 0x4b55bd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b55a4
xor eax, eax
push ebp
push 0x4b559d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4dfd98
mov eax, dword [ebp - 8]
mov ecx, 0x10
call fcn.00407780
cmp dword [0x4dfd98], 0
je 0x4b557b
cmp dword [0x4dfd9c], 0
je 0x4b557b
cmp dword [0x4dfda0], 0
je 0x4b557b
cmp dword [0x4dfda4], 0
jne 0x4b557f
xor eax, eax
jmp 0x4b5581
mov al, 1
mov byte [ebp - 0xa], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b55a4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b55c4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
cmp byte [ebp - 0xa], 0
jne 0x4b56b0
mov eax, dword [0x4d45c8]
call fcn.00407264
mov dword [0x4d461c], eax
mov eax, 0x4d4628
mov edx, dword [0x4d89f0]
mov edx, dword [edx]
call fcn.0040a460
cmp byte [ebp - 9], 0
je 0x4b56b0
lea eax, [ebp - 0x24]
call fcn.004b542c
mov eax, dword [ebp - 0x24]
call fcn.0040aac8
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingW
mov dword [0x4d462c], eax
cmp dword [0x4d462c], 0
je 0x4b56b0
push 0
push 0
push 0
push 2
mov eax, dword [0x4d462c]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b56b0
xor eax, eax
push ebp
push 0x4b56a9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.00407d78
mov dword [ebp - 0x1c], fcn.004b1ef0
mov dword [ebp - 0x18], 0x4b1c90
mov dword [ebp - 0x14], 0x4b1e44
mov dword [ebp - 0x10], 0x4b2968
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov ecx, 0x10
call fcn.00407780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b56b0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
pop eax
jmp eax
cmp byte [ebp - 9], 0
je 0x4b56d7
cmp dword [0x4d462c], 0
je 0x4b56cb
mov eax, 0x4b5728
call fcn.004b1cdc
jmp 0x4b56f3
mov eax, 0x4b577c
call fcn.004b1cdc
jmp 0x4b56f3
cmp byte [ebp - 0xa], 0
je 0x4b56e9
mov eax, 0x4b57d8
call fcn.004b1cdc
jmp 0x4b56f3
mov eax, 0x4b582c
call fcn.004b1cdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5717
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040a0d0
pop eax
jmp eax
Function at 0x4bd998
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, eax
and eax, 0xff
shr ecx, 8
inc edx
xor ecx, dword [eax*4 + 0x4d5844]
cmp edx, 4
mov eax, ecx
jl 0x4bd9a0
pop ebp
ret

Function at 0x4bd9bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, eax
inc edx
shr eax, 0x18
and eax, 0xff
shl ecx, 8
xor ecx, dword [eax*4 + 0x4d5c44]
cmp edx, 4
mov eax, ecx
jl 0x4bd9c4
pop ebp
ret
Function at 0x4c1208
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4c12c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x48]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.004c1198
test al, al
je 0x4c12a2
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a208
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x4c12a2
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040aac8
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.0040aac8
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040ab28
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
dec ebx
jne 0x4c125b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c12c9
lea eax, [ebp - 0x2c]
call fcn.0040a070
lea eax, [ebp - 4]
call fcn.0040a070
pop eax
jmp eax

Function at 0x4c15a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040aac8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.004c0f10
test al, al
jne 0x4c1605
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4d8af4]
mov dl, 1
mov eax, dword [0x4bfc08]
call fcn.0042740c
call fcn.00409768
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004c0e3c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8