joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5270
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x5a4
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x5a0], eax
push ebx
mov ebx, dword [esp + 0x5ac]
push edi
mov edi, dword [esp + 0x5b4]
call fcn.00470750
test eax, eax
jne 0x4a52ad
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x4a53a5
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
jmp 0x4a52c0
cmp word [edi], 0
mov dword [0x58c910], 0
je 0x4a53a3
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5396
xor esi, esi
mov dword [esp + 0x10], 0xc8
lea eax, [esp + 0x18]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push esi
push dword [esp + 0x30]
call ebp
test eax, eax
jne 0x4a536e
lea eax, [esp + 0x20]
push eax
push edi
push 0x5265b4
lea eax, [esp + 0x1bc]
push 0x200
push eax
call fcn.00402720
add esp, 0x14
lea eax, [esp + 0x1b0]
push eax
push ebx
call fcn.004a55b0
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0xc8
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
inc esi
push eax
lea eax, [esp + 0x34]
push eax
push esi
push dword [esp + 0x30]
call ebp
test eax, eax
je 0x4a5317
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4a537d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x4a5396
mov eax, dword [0x58c910]
inc eax
mov dword [0x58c910], eax
jmp 0x4a539b
mov eax, dword [0x58c910]
test eax, eax
jne 0x4a52c0
pop esi
pop ebp
mov ecx, dword [esp + 0x5a8]
pop edi
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x5a4
ret 8
Function at 0x4a55b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x5a4
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x5a0], eax
push ebx
mov ebx, dword [esp + 0x5ac]
push esi
mov esi, dword [esp + 0x5b4]
cmp word [esi], 0
je 0x4a56aa
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a56aa
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x14]
push edi
push eax
xor edi, edi
mov dword [esp + 0x14], 0xc8
push edi
push edi
push edi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push edi
push dword [esp + 0x30]
call ebp
test eax, eax
jne 0x4a5687
lea esp, [esp]
lea eax, [esp + 0x20]
push eax
push esi
push 0x5265b4
lea eax, [esp + 0x1bc]
push 0x200
push eax
call fcn.00402720
add esp, 0x14
lea eax, [esp + 0x1b0]
push eax
push ebx
call fcn.004a55b0
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0xc8
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
inc edi
push eax
lea eax, [esp + 0x34]
push eax
push edi
push dword [esp + 0x30]
call ebp
test eax, eax
je 0x4a5630
mov eax, dword [esp + 0x14]
pop edi
pop ebp
test eax, eax
je 0x4a5698
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x4a56aa
inc dword [0x58c910]
mov ecx, dword [esp + 0x5a8]
pop esi
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x5a4
ret 8

Function at 0x4a56d0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x404
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
mov esi, dword [esp + 0x40c]
push edi
mov edi, dword [esp + 0x414]
push 0x51787c
push edi
push esi
call fcn.004a3da0
test al, al
jne 0x4a5725
push 0x200
lea eax, [esp + 0xc]
push eax
push edi
push esi
call fcn.004a63c0
test al, al
je 0x4a5725
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp + 0x408]
pop edi
pop esi
xor ecx, esp
call fcn.004f833c
add esp, 0x404
ret 8

Function at 0x4a5740
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x404
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
mov esi, dword [esp + 0x40c]
push 0x51787c
push esi
push SysReAllocString
call fcn.004a3da0
test al, al
jne 0x4a57c5
movzx eax, word [esi]
cmp eax, 0x5c
je 0x4a57a2
test ax, ax
mov eax, 0x517828
jne 0x4a5787
mov eax, 0x51787c
push esi
push eax
push str.SoftwareWinRAR_s_s
lea eax, [esp + 0x10]
push 0x200
push eax
call fcn.00402720
add esp, 0x14
jmp 0x4a57b5
push 0x200
lea eax, [esi + 2]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.004947d0
lea eax, [esp + 4]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp + 0x404]
pop esi
xor ecx, esp
call fcn.004f833c
add esp, 0x404
ret 4
Function at 0x4a57e0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x408
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
mov ebx, dword [esp + 0x414]
push esi
mov esi, dword [esp + 0x414]
push edi
mov edi, dword [esp + 0x420]
push edi
push ebx
push esi
call fcn.004a3da0
test al, al
jne 0x4a5863
push 0x200
lea eax, [esp + 0x14]
push eax
push ebx
push esi
call fcn.004a63c0
test al, al
je 0x4a5863
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5863
push edi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4a5863
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x408
ret 0xc

Function at 0x4a5b40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x28]
push eax
push esi
push edi
push dword [esp + 0x30]
push ebx
push ebp
call fcn.004a44c0
test al, al
je 0x4a5b7e
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x14
push ebx
push ebp
call fcn.004a6440
mov ebp, eax
mov dword [esp + 0x20], 8
test ebp, ebp
je 0x4a5bce
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push dword [esp + 0x34]
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x4a5bce
cmp dword [esp + 0x20], 0
je 0x4a5bce
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x14

Function at 0x4a5c00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x1c]
push eax
mov eax, esi
cdq
push edx
push eax
push dword [esp + 0x2c]
push edi
push ebx
call fcn.004a44c0
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x1c], ecx
test al, al
je 0x4a5c3e
pop edi
pop esi
mov eax, ecx
pop ebx
add esp, 8
ret 0x10
push edi
push ebx
call fcn.004a6440
mov edi, eax
mov dword [esp + 0x24], 4
test edi, edi
je 0x4a5c8a
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x30]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push edi
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x4a5c8a
cmp dword [esp + 0x24], 0
je 0x4a5c8a
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 8
ret 0x10
Function at 0x4a5ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x28]
push eax
push ebp
push ebx
push dword [esp + 0x28]
mov dword [esp + 0x38], edi
push esi
push dword [esp + 0x28]
call fcn.004a43d0
test al, al
je 0x4a5cdc
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
push esi
push dword [esp + 0x18]
call fcn.004a6440
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], edi
test eax, eax
je 0x4a5d22
lea ecx, [esp + 0x24]
push ecx
push ebx
lea ecx, [esp + 0x28]
push ecx
push 0
push dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4a5d22
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4a5d47
push edi
test ebp, ebp
je 0x4a5d3a
push ebp
push ebx
call fcn.004fa2e0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
push 0
push ebx
call fcn.004fa860
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x18

Function at 0x4a5da0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x810], eax
mov ecx, dword [esp + 0x820]
lea edx, [esp + 0x10]
mov eax, dword [esp + 0x81c]
push ebx
mov ebx, dword [esp + 0x82c]
push ebp
mov ebp, dword [esp + 0x820]
push esi
mov esi, dword [esp + 0x830]
push edi
push 0x400
push edx
push ecx
push eax
push ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
call fcn.004a4a60
test al, al
jne 0x4a5e9d
mov edi, dword [esp + 0x83c]
push edi
push ebx
push esi
call fcn.004947d0
cmp byte [0x5423a9], 0
sete al
test al, al
jne 0x4a5ebb
push dword [esp + 0x14]
push ebp
call fcn.004a6440
mov ebp, eax
mov byte [esp + 0x13], 0
test ebp, ebp
je 0x4a5e8f
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x24]
push eax
push 0
push dword [esp + 0x28]
lea ecx, [edi + edi]
push ebp
mov dword [esp + 0x2c], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
sete byte [esp + 0x17]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x13], 0
je 0x4a5e8f
mov eax, dword [esp + 0x14]
shr eax, 1
test edi, edi
jne 0x4a5e7c
xor eax, eax
mov word [esi], ax
mov al, byte [esp + 0x13]
jmp 0x4a5ebd
dec edi
cmp eax, edi
jb 0x4a5e83
mov eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
mov al, byte [esp + 0x13]
jmp 0x4a5ebd
push edi
push ebx
push esi
call fcn.004947d0
mov al, byte [esp + 0x13]
jmp 0x4a5ebd
lea eax, [esp + 0x20]
push eax
call fcn.004a4680
test eax, eax
je 0x4a5ead
mov ebx, eax
push dword [esp + 0x83c]
push ebx
push esi
call fcn.004947d0
mov al, 1
mov ecx, dword [esp + 0x820]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x814
ret 0x18
Function at 0x4a5f10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [esp + 0x414]
lea ecx, [esp + 8]
push ebx
mov ebx, dword [esp + 0x41c]
push esi
mov esi, dword [esp + 0x418]
push edi
push 0x200
push ecx
push eax
push esi
call fcn.004a63c0
test al, al
je 0x4a5fa3
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x58c914]
or eax, 9
push eax
push 0
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5fa3
mov edi, dword [esp + 0xc]
test edi, edi
je 0x4a5fa3
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg esi
sbb esi, esi
not esi
and esi, dword [esp + 0x10]
mov eax, esi
jmp 0x4a5fa5
xor eax, eax
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x40c
ret 0xc
Function at 0x4a6000
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x5b0
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x5ac], eax
push ebx
mov ebx, dword [esp + 0x5b8]
push ebp
mov ebp, dword [esp + 0x5c0]
push 0xf
push str.SoftwareWinRAR
push ebp
mov dword [esp + 0x28], ebp
call fcn.00497de0
test eax, eax
je 0x4a6040
xor al, al
jmp 0x4a6222
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a6039
push edi
push 0x100000
call fcn.004fe8be
mov edi, eax
add esp, 4
test edi, edi
jne 0x4a607d
mov ecx, 0x57f41c
call fcn.00466710
xor al, al
jmp 0x4a6221
push esi
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], 0x200
push eax
push edi
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], 0x100000
push eax
push 0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1d0]
push eax
push 0
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4a6185
lea eax, [ebp + 0x1e]
xor ebp, ebp
mov dword [esp + 0x20], eax
mov esi, eax
cmp word [esi], 0x5c
jne 0x4a60d0
add esi, 2
mov eax, dword [esp + 0x14]
cmp eax, 3
jne 0x4a60f1
push dword [esp + 0x1c]
lea eax, [esp + 0x1c0]
push edi
push eax
push esi
push ebx
call fcn.004a4cb0
mov eax, dword [esp + 0x14]
cmp eax, 4
jne 0x4a610d
push 0
push dword [edi]
lea eax, [esp + 0x1c4]
push eax
push esi
push ebx
call fcn.004a4d90
mov eax, dword [esp + 0x14]
cmp eax, 0xb
jne 0x4a612a
push dword [edi + 4]
lea eax, [esp + 0x1c0]
push dword [edi]
push eax
push esi
push ebx
call fcn.004a4d90
mov eax, dword [esp + 0x14]
cmp eax, 1
jne 0x4a613f
push edi
lea eax, [esp + 0x1c0]
push eax
push esi
push ebx
call fcn.004a4c20
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], 0x200
push eax
push edi
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], 0x100000
push eax
push 0
lea eax, [esp + 0x20]
inc ebp
push eax
lea eax, [esp + 0x1d0]
push eax
push ebp
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
mov eax, dword [esp + 0x20]
je 0x4a60c5
mov ebp, dword [esp + 0x24]
push edi
call fcn.004fe8b9
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x28]
add esp, 4
mov dword [esp + 0x10], 0xc8
xor esi, esi
push eax
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x40]
push eax
push esi
push dword [esp + 0x34]
call edi
test eax, eax
jne 0x4a620f
jmp 0x4a61c0
push 0x200
lea eax, [esp + 0x1c0]
push eax
lea eax, [esp + 0x34]
push eax
push ebp
call fcn.0047d340
lea eax, [esp + 0x1bc]
push eax
push ebx
call fcn.004a6000
lea eax, [esp + 0x24]
mov dword [esp + 0x10], 0xc8
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
inc esi
push eax
lea eax, [esp + 0x40]
push eax
push esi
push dword [esp + 0x34]
call edi
test eax, eax
je 0x4a61c0
mov eax, dword [esp + 0x18]
pop esi
test eax, eax
je 0x4a621f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop edi
mov ecx, dword [esp + 0x5b4]
pop ebp
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x5b0
ret 8
Function at 0x4a6780
Capabilities:
Set registry value

Disassembly:
sub esp, 0x808
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x804], eax
push ebx
mov ebx, dword [esp + 0x814]
lea eax, [esp + 8]
push ebp
mov ebp, dword [esp + 0x81c]
push esi
mov esi, dword [esp + 0x824]
push edi
mov edi, dword [esp + 0x81c]
push 0x400
push eax
push ebp
push ebx
push edi
call fcn.004a4a60
test al, al
jne 0x4a6829
cmp byte [0x5423a9], al
sete al
test al, al
jne 0x4a6836
lea eax, [esp + 0x10]
push eax
push ebx
push edi
call fcn.004a51d0
mov edi, eax
test edi, edi
je 0x4a6821
mov ecx, esi
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a67f0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4a6838
mov esi, dword [esp + 0x10]
mov eax, esi
jmp 0x4a6838
push 1
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.004a3b70
xor eax, eax
mov ecx, dword [esp + 0x814]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x808
ret 0x10
Function at 0x4a69a0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push eax
push esi
mov edi, ecx
mov dword [esp + 0x18], 0
call fcn.004a6d10
test eax, eax
je 0x4a69cf
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 8
push ebx
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004a6d10
mov dword [edi + 0x10], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004a6d10
mov dword [edi + 0x18], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004a6d10
mov dword [edi + 0x1c], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004a6d10
mov dword [edi + 0x20], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004a6d10
mov dword [edi + 0x24], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004a6d10
push ebp
mov dword [edi + 0x28], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x100
lea eax, [edi + 0x2c]
push eax
call fcn.004a6d70
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004a6d10
push ebp
mov dword [edi + 0x12c], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x100
lea eax, [edi + 0x130]
push eax
call fcn.004a6d70
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004a6d10
mov dword [edi + 0x230], eax
lea eax, [esp + 0x10]
push ebp
push eax
push esi
push 0x100
lea eax, [edi + 0x234]
push eax
mov ecx, edi
call fcn.004a6d70
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004a6d10
mov dword [edi + 0x334], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004a6d10
mov dword [edi + 0x338], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004a6d10
push ebp
mov dword [edi + 0x33c], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x20
lea eax, [edi + 0x340]
push eax
call fcn.004a6d70
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
push 0x100
lea eax, [edi + 0x380]
push eax
call fcn.004a6d70
mov ecx, dword [esp + 0x10]
xor bl, bl
xor eax, eax
test ecx, ecx
je 0x4a6b2a
xor bl, byte [eax + esi]
inc eax
cmp eax, ecx
jb 0x4a6b22
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004a6d10
movzx ecx, bl
xor edx, edx
pop ebx
pop edi
cmp ecx, eax
pop esi
sete al
pop ebp
pop ecx
ret 8

Function at 0x4a6df0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
xor ecx, ecx
xor esi, esi
jmp 0x4a6e00
xor byte [esi + edi], cl
mov eax, 0xaaaaaaab
mul ecx
add ecx, 3
inc esi
shr edx, 1
add ecx, edx
and ecx, 0xffffff
cmp esi, 0x480
jb 0x4a6e00
pop edi
pop esi
ret
Function at 0x4a8d00
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov eax, 0x4324
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x4320], eax
push esi
push edi
mov edi, dword [esp + 0x4330]
push edi
call fcn.0047cbe0
mov esi, eax
test esi, esi
je 0x4a8f20
push 0xc8
push 0x51787c
lea eax, [esp + 0x10]
push eax
push 0x51787c
push esi
push SysReAllocString
call fcn.004a5da0
cmp word [esp + 8], 0
je 0x4a8f20
push 0xc8
push str._shellprintcommand
lea eax, [esp + 0x10]
push eax
call fcn.00494790
push 0x800
push 0x51787c
lea eax, [esp + 0x330]
push eax
push 0x51787c
lea eax, [esp + 0x18]
push eax
push SysReAllocString
call fcn.004a5da0
cmp word [esp + 0x328], 0
jne 0x4a8e49
push esi
push str.SoftwareClasses_s
lea eax, [esp + 0x1a0]
push 0xc8
push eax
call fcn.00402720
add esp, 0x10
lea eax, [esp + 8]
push 0xc8
push 0x51787c
push eax
push 0x51787c
lea eax, [esp + 0x1a8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004a5da0
cmp word [esp + 8], 0
je 0x4a8f20
lea eax, [esp + 8]
push eax
push str.SoftwareClasses_s_shellprintcommand
lea eax, [esp + 0x1a0]
push 0xc8
push eax
call fcn.00402720
add esp, 0x10
lea eax, [esp + 0x328]
push 0x800
push 0x51787c
push eax
push 0x51787c
lea eax, [esp + 0x1a8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004a5da0
cmp word [esp + 0x328], 0
je 0x4a8f20
push 0x1000
lea eax, [esp + 0x232c]
push eax
lea eax, [esp + 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4a8f20
cmp eax, 0x1000
jae 0x4a8f20
lea eax, [esp + 0x2328]
push 0x5269f4
push eax
call fcn.004fae43
add esp, 8
test eax, eax
je 0x4a8f20
push ebx
lea ecx, [esp + 0x232c]
xor bl, bl
cmp eax, ecx
jbe 0x4a8eab
cmp word [eax - 2], 0x22
jne 0x4a8eab
mov bl, 1
xor ecx, ecx
push 0x1000
mov word [eax], cx
lea eax, [esp + 0x2330]
push edi
push eax
call fcn.00494790
test bl, bl
pop ebx
je 0x4a8edf
push 0x1000
push 0x52651c
lea eax, [esp + 0x2330]
push eax
call fcn.00494790
push 0x800
lea eax, [esp + 0x132c]
push eax
lea eax, [esp + 0x2330]
push eax
call fcn.00493f60
push 8
push 0
push eax
lea eax, [esp + 0x1334]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x20
cmp ecx, eax
sbb eax, eax
neg eax
jmp 0x4a8f22
xor al, al
mov ecx, dword [esp + 0x4328]
pop edi
pop esi
xor ecx, esp
call fcn.004f833c
add esp, 0x4324
ret 4
Function at 0x4a9610
Capabilities:
Write file on windows

Disassembly:
mov eax, 0xa808
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0xa804], eax
push esi
mov esi, dword [esp + 0xa810]
lea eax, [esp + 0xa81c]
push eax
push 0
push dword [esp + 0xa820]
lea eax, [esp + 0x1810]
push 0x1800
push eax
call fcn.00402710
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004fe76c
xor eax, eax
add esp, 0x1c
mov word [esp + 0x4802], ax
mov eax, dword [esp + 0xa814]
sub eax, 0
je 0x4a96dc
sub eax, 1
je 0x4a96b3
sub eax, 1
jne 0x4a971d
push 0x1800
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x180c]
push eax
call fcn.004979e0
lea ecx, [esp + 4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a96a6
lea eax, [esp + 4]
jmp 0x4a970e
lea ecx, [esp + 0x1804]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a96c0
sub ecx, edx
lea eax, [esp + 0x1804]
push esi
sar ecx, 1
push ecx
push 2
jmp 0x4a9714
push 0x6000
lea eax, [esp + 0x480c]
push eax
lea eax, [esp + 0x180c]
push eax
call fcn.00497a60
lea ecx, [esp + 0x4808]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a9700
lea eax, [esp + 0x4808]
push esi
sub ecx, edx
push ecx
push 1
push eax
call fcn.004ff1cc
add esp, 0x10
mov ecx, dword [esp + 0xa808]
pop esi
xor ecx, esp
call fcn.004f833c
add esp, 0xa808
ret
Function at 0x4aa5e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x404], eax
mov eax, dword [esp + 0x410]
push ebp
mov ebp, dword [esp + 0x410]
push esi
push edi
push 0x519c98
push eax
mov esi, ecx
call fcn.004ccb60
mov edi, eax
test edi, edi
sete cl
mov byte [esi + 0x3028], cl
test cl, cl
jne 0x4aa753
push edi
call fcn.00503a74
add esp, 4
cmp eax, 0x42
jne 0x4aa74a
push edi
call fcn.00503a74
add esp, 4
cmp eax, 0x4d
jne 0x4aa74a
push ebx
push 0
push 2
push edi
call fcn.00502aa9
push edi
push 1
lea eax, [esp + 0x24]
push 4
push eax
call fcn.0050273f
mov eax, dword [esp + 0x2c]
sub eax, 0xe
push eax
mov dword [esp + 0x30], eax
call fcn.004fe8be
mov ebx, eax
add esp, 0x20
test ebx, ebx
jne 0x4aa6a5
push edi
call fcn.004fede7
add esp, 4
xor al, al
pop ebx
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004f833c
add esp, 0x408
ret 8
push 0
push 0xe
push edi
call fcn.00502aa9
push edi
push dword [esp + 0x20]
push 1
push ebx
call fcn.0050273f
add esp, 0x1c
cmp eax, dword [esp + 0x10]
je 0x4aa715
push str.BMP__PNG
push 0x686
call fcn.0048e4c0
push eax
lea eax, [esp + 0x1c]
push 0x200
push eax
call fcn.00402720
add esp, 0x10
push 0x10
push 0x66
call fcn.0048e4c0
push eax
lea eax, [esp + 0x1c]
push eax
push dword [0x54b9c8]
call fcn.004cd560
push ebx
call fcn.004fe8b9
push edi
call fcn.004fede7
add esp, 8
jmp 0x4aa688
push edi
call fcn.004fede7
add esp, 4
push dword [esp + 0x10]
push ebx
push 0x400
push 0x65
push 2
push ebp
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
push ebx
mov esi, eax
call fcn.004fe8b9
xor eax, eax
add esp, 4
test esi, esi
setne al
jmp 0x4aa68a
push edi
call fcn.004fede7
add esp, 4
xor al, al
jmp 0x4aa68b