joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457f40
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push edi
push eax
push esi
mov byte [esi + 0x3c], al
mov byte [esi + 6], 0
call fcn.00457d00
add esp, 8
test al, al
jne 0x457fa2
lea edi, [esi + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebx, [esi + 0x38]
push 0
xor eax, eax
mov ecx, ebx
call fcn.004579b0
cmp eax, 0xf4241
jne 0x457f80
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [esi + 0x14]
push ecx
push 0
push esi
push 0x457af0
push 0
push 0
call fcn.0061a7da
add esp, 0x18
push edi
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x457ff0
Capabilities:
Terminate thread

Disassembly:
cmp byte [esi + 5], 0
push ebp
mov ebp, dword [esp + 8]
push edi
je 0x458005
push esi
call fcn.00457e30
add esp, 4
cmp dword [esi + 0x14], 0
mov byte [esi + 6], 1
je 0x45806b
push 0
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edi, eax
test edi, edi
je 0x45806b
test ebp, ebp
je 0x458029
mov eax, ebp
jmp 0x45802c
or eax, 0xffffffff
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x458060
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x14], 0
mov byte [esi + 6], 0
mov eax, 0xf4242
pop edi
pop ebp
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 6], 0
pop edi
xor eax, eax
pop ebp
ret 4

Function at 0x459920
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x6d7160]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp dword [ebx], 0
push esi
push edi
je 0x459947
mov edi, ebx
call fcn.00401700
mov dword [ebx], 0
mov al, byte [0x6fc250]
test al, al
mov byte [ebp - 5], al
je 0x45995f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
jmp 0x459969
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
test edi, edi
je 0x4599c7
add edi, 1
cmp byte [ebp - 5], 0
je 0x45999a
lea eax, [edi + edi]
call fcn.00616f40
mov edx, dword [ebp + 8]
mov esi, esp
push edi
push esi
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
push esi
mov eax, ebx
call fcn.004596c0
jmp 0x4599c7
push 0
push edi
call fcn.004592b0
cmp dword [ebx], 0
je 0x4599c7
mov eax, ebx
call fcn.00459380
mov ebx, dword [ebx]
test ebx, ebx
je 0x4599b9
lea eax, [ebx + 4]
jmp 0x4599bb
xor eax, eax
push edi
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00607d6d
mov esp, ebp
pop ebp
ret 4

Function at 0x460430
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x4603b0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x47506332
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp]
add esp, 0xc
ret
Function at 0x46cb00
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [esp + 4], 0
je 0x46cb13
cmp byte [0x6fa057], 0
jne 0x46cb13
xor al, al
ret
mov eax, dword [0x6f51d8]
test eax, eax
jne 0x46cb32
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
neg eax
add eax, 1
mov dword [0x6f51d8], eax
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, 0x8000
seta al
ret

Function at 0x46cb50
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [0x6fa057], 0
jne 0x46cb5c
xor al, al
ret
mov eax, dword [0x6f51d8]
test eax, eax
jne 0x46cb7b
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
neg eax
add eax, 1
mov dword [0x6f51d8], eax
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, 0x8000
seta al
ret

Function at 0x46d9a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x850
mov eax, dword [0x6d7160]
xor eax, esp
mov dword [esp + 0x848], eax
push edi
push 0x800
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x46d9e2
or eax, 0xffffffff
pop edi
mov ecx, dword [esp + 0x848]
xor ecx, esp
call fcn.00607d6d
add esp, 0x850
ret
push 0x38
xor edi, edi
lea ecx, [esp + 0x14]
push edi
push ecx
call fcn.0060c930
add esp, 0xc
lea edx, [esp + 0x48]
push esi
push str._select___s_
lea eax, [esp + 0x10]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x20], str.open
mov dword [esp + 0x24], str.explorer
mov dword [esp + 0x30], 5
mov dword [esp + 0x10], edi
call fcn.00407360
add esp, 8
lea eax, [esp + 8]
call fcn.00459380
mov eax, dword [esp + 8]
cmp eax, edi
je 0x46da4c
add eax, 4
mov dword [esp + 0x20], eax
jmp 0x46da50
mov dword [esp + 0x20], edi
lea eax, [esp + 0xc]
push eax
call dword [0x6fc244]
lea edi, [esp + 8]
call fcn.00401700
mov ecx, dword [esp + 0x84c]
pop edi
xor ecx, esp
xor eax, eax
call fcn.00607d6d
add esp, 0x850
ret

Function at 0x46e0b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x6d7160]
xor eax, esp
mov dword [esp + 0x94], eax
call fcn.0046e0a0
test al, al
je 0x46e11c
push 0x94
lea eax, [esp + 4]
push 0
push eax
call fcn.0060c930
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x46e11c
cmp dword [esp + 0x10], 2
jne 0x46e11c
cmp dword [esp + 4], 6
jb 0x46e11c
mov al, 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00607d6d
add esp, 0x98
ret
mov ecx, dword [esp + 0x94]
xor ecx, esp
xor al, al
call fcn.00607d6d
add esp, 0x98
ret
Function at 0x46e140
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x6d7160]
xor eax, esp
mov dword [esp + 0x94], eax
call fcn.0046e0a0
test al, al
je 0x46e19e
push 0x94
lea eax, [esp + 4]
push 0
push eax
call fcn.0060c930
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x46e19e
cmp dword [esp + 0x10], 2
jne 0x46e19e
mov eax, dword [esp + 4]
cmp eax, 6
jne 0x46e1b5
cmp dword [esp + 8], 1
jae 0x46e1b7
xor al, al
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00607d6d
add esp, 0x98
ret
jbe 0x46e19e
mov ecx, dword [esp + 0x94]
xor ecx, esp
mov al, 1
call fcn.00607d6d
add esp, 0x98
ret

Function at 0x46ea80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x6d7160]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
call fcn.0046ea40
mov bl, byte [0x6fc250]
test bl, bl
push esi
je 0x46eab0
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
jmp 0x46eab6
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
test edi, edi
je 0x46eb38
add edi, 1
test bl, bl
je 0x46eb1e
lea eax, [edi + edi]
mov dword [ebp - 0xc], eax
call fcn.00616f40
mov ebx, esp
push edi
push ebx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
call fcn.004596c0
mov eax, dword [ebp - 8]
test eax, eax
lea edi, [eax + 4]
jne 0x46eafa
mov edi, 0x67b348
mov esi, dword [ebp + 8]
call fcn.0046e9a0
lea eax, [ebp - 8]
call fcn.0045b340
mov ecx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00499310
lea edi, [ebp - 8]
call fcn.00401700
jmp 0x46eb38
mov ebx, dword [ebp + 8]
push 0
mov eax, edi
mov ecx, ebx
call fcn.00487200
mov eax, dword [ebx + 4]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00607d6d
mov esp, ebp
pop ebp
ret 4
Function at 0x47bd50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0x18]
mov edx, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
add edx, eax
push ebp
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0xc]
push esi
add eax, ecx
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
lea esi, [esp + 0x40]
mov ecx, edi
mov dword [esp + 0x28], edx
call fcn.0047a970
cmp eax, 3
je 0x47bebe
mov ecx, dword [esp + 0x44]
cmp ecx, dword [esp + 0x4c]
mov dword [esp + 0x14], ecx
jge 0x47bebe
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x40]
cmp eax, edx
mov dword [esp + 0x18], eax
jge 0x47bead
lea ecx, [ecx]
mov edx, dword [edi + 4]
imul edx, ecx
sub ecx, dword [ebx + 0x1c]
mov esi, dword [edi + 0x10]
imul ecx, dword [ebx + 4]
sub ecx, dword [ebx + 0x18]
add edx, eax
add ecx, eax
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + ecx*4]
xor dword [esi + edx*4], 0xffffff
movzx ebp, byte [esi + edx*4 + 2]
mov ecx, dword [esi + edx*4]
lea edi, [esi + edx*4]
mov ebx, eax
xor ebx, 0xffffff
mov dword [esp + 0x1c], ebx
xor edx, edx
mov dh, byte [esp + 0x1e]
mov esi, ecx
and esi, 0xff00
imul ebp, edx
mov edx, ebx
and edx, 0xff00
imul esi, edx
movzx ebx, bl
movzx edx, cl
imul edx, ebx
and ecx, 0xff000000
shr edx, 8
or ecx, edx
shr esi, 0x10
and esi, 0xff00
or ecx, esi
mov esi, dword [esp + 0x38]
mov ebx, eax
and ebp, 0xff0000
or ecx, ebp
xor ecx, 0xffffff
and ebx, 0xff00ff
and eax, 0xff00
mov edx, ecx
and edx, 0xff00ff
sub ebx, edx
and ecx, 0xff00
imul ebx, esi
sub eax, ecx
imul eax, esi
shr ebx, 8
shr eax, 8
add ebx, edx
mov edx, dword [esp + 0x48]
add eax, ecx
mov ecx, dword [esp + 0x14]
and eax, 0xff00
and ebx, 0xff00ff
or ebx, eax
mov eax, dword [esp + 0x18]
add eax, 1
cmp eax, edx
mov dword [edi], ebx
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x18], eax
jl 0x47bdc0
mov eax, dword [esp + 0x40]
add ecx, 1
cmp ecx, dword [esp + 0x4c]
mov dword [esp + 0x14], ecx
jl 0x47bdb1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0x1c
Function at 0x47c590
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esi + 0xc]
imul eax, dword [esi + 8]
mov edx, dword [esi + 0x10]
push edi
xor edi, edi
test eax, eax
jbe 0x47c5f7
push ebx
push ebp
mov eax, dword [edx]
mov ecx, eax
shr ecx, 0x18
add ecx, 1
mov ebx, eax
and ebx, 0xffff00ff
imul ebx, ecx
mov ebp, eax
and ebp, 0xff00
imul ebp, ecx
xor ebx, ebp
mov ebp, eax
and ebp, 0xff00ff
imul ebp, ecx
and ebx, 0xff0000
xor ebx, ebp
shr ebx, 8
and eax, 0xff000000
or ebx, eax
mov dword [edx], ebx
mov ecx, dword [esi + 0xc]
imul ecx, dword [esi + 8]
add edi, 1
add edx, 4
cmp edi, ecx
jb 0x47c5a3
pop ebp
pop ebx
xor eax, eax
pop edi
ret

Function at 0x4800c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
sub esp, 8
cmp byte [edx + 0x2c], 0
je 0x4801e7
push ebx
mov ebx, dword [edx + 0x5c]
test ebx, ebx
je 0x4801e4
mov ecx, dword [edx + 0x58]
push ebp
push esi
shr ecx, 3
cmp byte [edx + 0x60], 0
push edi
jne 0x480140
test ecx, ecx
jbe 0x4801c9
mov edi, ecx
lea ebx, [ebx]
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov esi, ecx
mov ebp, edx
shr ecx, 2
shr edx, 2
and esi, 0xff00ff
and ebp, 0xff00ff
and ecx, 0x3fc03fc0
and edx, 0x3fc03fc0
add esi, ebp
add ecx, edx
mov dword [ebx], ecx
mov dword [ebx + 4], esi
add ebx, 8
add eax, 8
sub edi, 1
jne 0x480100
jmp 0x4801c5
test ecx, ecx
mov dword [esp + 0x10], ebx
jbe 0x4801c9
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + 4]
mov edi, dword [eax]
mov eax, dword [ebx]
mov edx, ecx
and ecx, 0xff00ff
mov esi, edi
and edi, 0xff00ff
add ecx, edi
add ecx, dword [ebx + 4]
shr edx, 2
shr esi, 2
mov edi, edx
mov ebp, esi
and edi, 0xffc03fc0
add edi, eax
shr ecx, 2
and ebp, 0xffc03fc0
add ebp, edi
and edx, 0x3fc03fc0
add edx, eax
mov eax, dword [esp + 0x10]
xor ecx, ebp
and esi, 0x3fc03fc0
and ecx, 0xff00ff
add esi, edx
xor ecx, esi
mov dword [eax], ecx
add eax, 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
add eax, 8
add ebx, 8
sub dword [esp + 0x14], 1
mov dword [esp + 0x20], eax
jne 0x480150
mov edx, dword [esp + 0x1c]
cmp byte [edx + 0x60], 0
pop edi
sete al
test al, al
pop esi
mov byte [edx + 0x60], al
pop ebp
jne 0x4801e4
mov eax, dword [edx + 0x5c]
pop ebx
add esp, 8
ret 8
xor eax, eax
pop ebx
add esp, 8
ret 8
Function at 0x480790
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [eax + 0xc]
push ebp
mov ebp, dword [eax + 8]
mov eax, dword [ecx + 8]
cdq
sub eax, edx
push esi
mov esi, eax
push edi
mov edi, dword [ecx + 0xc]
mov eax, edi
cdq
sub eax, edx
sar esi, 1
sar eax, 1
cmp ebp, esi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebx
jle 0x4807cb
mov ebp, esi
mov dword [esp + 0x28], ebp
cmp ebx, eax
jle 0x4807d5
mov dword [esp + 0x2c], eax
mov ebx, eax
xor esi, esi
test ebx, ebx
mov dword [esp + 0x1c], esi
jle 0x4808d9
mov dword [esp + 0x10], 1
jmp 0x4807f0
mov eax, dword [ecx + 4]
mov edi, dword [ecx + 0x10]
mov edx, eax
imul edx, esi
lea ebx, [edi + edx*8]
mov edx, dword [esp + 0x10]
imul edx, eax
test ebp, ebp
lea edi, [edi + edx*4]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 0
jle 0x4808c3
mov edx, dword [edi + 4]
mov edi, dword [edi]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov eax, ecx
and eax, 0xff00ff
mov ebp, edi
and ebp, 0xff00ff
add eax, ebp
shr ecx, 8
mov ebp, esi
and ebp, 0xff00ff
add eax, ebp
and ecx, 0xff00ff
shr edi, 8
mov ebp, edx
and edi, 0xff00ff
add ecx, edi
mov edi, dword [esp + 0x14]
shr esi, 8
shr edx, 8
and esi, 0xff00ff
add ecx, esi
mov esi, dword [esp + 0x1c]
and ebp, 0xff00ff
add eax, ebp
and edx, 0xff00ff
add ecx, edx
mov edx, dword [esp + 0x34]
mov ebp, dword [edx + 4]
mov edx, dword [edx + 0x10]
imul ebp, esi
shl ecx, 6
shr eax, 2
xor eax, ecx
and eax, 0xff00ff
xor eax, ecx
mov ecx, dword [esp + 0x18]
add ebp, ecx
mov dword [edx + ebp*4], eax
mov ebp, dword [esp + 0x28]
add ecx, 1
add edi, 8
add ebx, 8
cmp ecx, ebp
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
jl 0x48081c
mov ecx, dword [esp + 0x38]
add dword [esp + 0x10], 2
add esi, 1
cmp esi, dword [esp + 0x2c]
mov dword [esp + 0x1c], esi
jl 0x4807f0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
Function at 0x4820d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
cmp dword [esi + 0x4b0], 0
je 0x4820e4
mov eax, dword [esi + 0x4b4]
jmp 0x4820f3
mov eax, dword [esi + 0x4a0]
push eax
call fcn.00609413
add esp, 4
push ebx
mov ebx, dword [esp + 0x14]
cmp word [ebx + 0x10], 0
push ebp
push edi
mov dword [ebx + 0x64], eax
mov dword [esp + 0x14], 0
jbe 0x48230b
mov edx, dword [esi + 0x4b0]
test edx, edx
je 0x48216d
lea eax, [ebx + 0x54]
test eax, eax
mov edi, 2
je 0x482165
mov eax, dword [esi + 0x4b8]
cmp eax, edi
jb 0x48213d
mov ecx, dword [esi + 0x4b4]
lea ebp, [ecx + 2]
cmp ebp, eax
jbe 0x482149
mov ecx, dword [esi + 0x4b4]
sub eax, ecx
mov edi, eax
je 0x482165
push edi
add ecx, edx
push ecx
lea eax, [ebx + 0x54]
push eax
call fcn.0060d1b0
add dword [esi + 0x4b4], edi
add esp, 0xc
shr edi, 1
mov eax, edi
jmp 0x48218c
xor edi, edi
shr edi, 1
mov eax, edi
jmp 0x48218c
mov eax, dword [esi + 0x4a0]
test eax, eax
je 0x48218a
push eax
push 1
lea eax, [ebx + 0x54]
push 2
push eax
call fcn.0060860a
add esp, 0x10
jmp 0x48218c
xor eax, eax
cmp eax, 1
jne 0x482316
mov cx, word [ebx + 0x54]
rol cx, 8
movzx eax, cx
cmp ax, 1
mov word [ebx + 0x54], cx
jne 0x482290
mov edx, dword [ebx + 0xc]
xor ebp, ebp
sub edx, dword [ebx + 4]
mov dword [esp + 0xc], ebp
je 0x482273
mov ecx, dword [esi + 0x4b0]
test ecx, ecx
je 0x482222
mov eax, dword [esi + 0x4b8]
mov ebx, 2
cmp eax, ebx
jb 0x4821e6
mov edi, dword [esi + 0x4b4]
lea edx, [edi + 2]
cmp edx, eax
jbe 0x4821f2
mov edi, dword [esi + 0x4b4]
sub eax, edi
mov ebx, eax
je 0x482216
lea eax, [edi + ecx]
push ebx
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0060d1b0
add edi, ebx
add esp, 0xc
shr ebx, 1
mov eax, ebx
mov ebx, dword [esp + 0x1c]
mov dword [esi + 0x4b4], edi
jmp 0x482242
xor ebx, ebx
shr ebx, 1
mov eax, ebx
mov ebx, dword [esp + 0x1c]
jmp 0x482242
mov eax, dword [esi + 0x4a0]
test eax, eax
je 0x482240
push eax
push 1
lea edx, [esp + 0x18]
push 2
push edx
call fcn.0060860a
add esp, 0x10
jmp 0x482242
xor eax, eax
cmp eax, 1
jne 0x482316
mov ax, word [esp + 0x10]
mov edx, dword [ebx + 0xc]
sub edx, dword [ebx + 4]
rol ax, 8
movzx eax, ax
movzx ecx, ax
add dword [esp + 0xc], ecx
add ebp, 1
cmp ebp, edx
mov dword [esp + 0x10], eax
jb 0x4821c0
cmp dword [esi + 0x4b0], 0
je 0x482288
mov eax, dword [esi + 0x4b4]
add eax, dword [esp + 0xc]
jmp 0x4822ce
mov eax, dword [esp + 0xc]
push 1
jmp 0x4822e4
test ax, ax
jne 0x4822f4
mov edi, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
sub edi, dword [ebx + 4]
sub edx, dword [ebx]
imul edi, edx
cmp dword [esi + 0x4b0], 0
je 0x4822b4
mov eax, dword [esi + 0x4b4]
jmp 0x4822c3
mov eax, dword [esi + 0x4a0]
push eax
call fcn.00609413
add esp, 4
add eax, edi
cmp dword [esi + 0x4b0], 0
je 0x4822e2
mov ecx, dword [esi + 0x4b8]
cmp ecx, eax
ja 0x4822da
mov eax, ecx
mov dword [esi + 0x4b4], eax
jmp 0x4822f4
push 0
mov ecx, dword [esi + 0x4a0]
push eax
push ecx
call fcn.006081d8
add esp, 0xc
mov eax, dword [esp + 0x14]
movzx edx, word [ebx + 0x10]
add eax, 1
cmp eax, edx
mov dword [esp + 0x14], eax
jl 0x482110
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
pop edi
pop ebp
mov eax, 3
pop ebx
add esp, 0xc
ret 4
Function at 0x482330
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6d7160]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 0x14]
push ebx
push esi
push edi
mov esi, ecx
call fcn.00616f40
mov ebx, esp
xor edi, edi
cmp ebx, edi
je 0x482506
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x6f524c], edi
mov dword [ebp - 0xc], eax
je 0x48237c
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0047cfb0
jmp 0x482382
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
cmp dword [ebp + 0x18], edi
mov dword [ebp - 0x18], edi
jbe 0x48248b
mov edx, dword [ebp + 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4823a4
cmp dword [eax], 0
jne 0x4824b9
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 8]
movzx eax, word [eax]
add edi, 0x49c
cmp dword [edi + 0x14], 0
je 0x4823c0
call fcn.00410220
jmp 0x4823d8
mov edi, dword [edi + 4]
test edi, edi
je 0x4823d6
push edi
push eax
push 1
push ebx
call fcn.0060860a
add esp, 0x10
jmp 0x4823d8
xor eax, eax
mov ecx, dword [ebp - 8]
movzx ecx, word [ecx]
cmp eax, ecx
jne 0x4824d3
xor edi, edi
test ecx, ecx
jle 0x482475
mov dl, byte [edi + ebx]
lea eax, [edi + ebx]
xor ecx, ecx
test dl, dl
jge 0x482436
neg dl
movzx edx, dl
add edx, 1
test edx, edx
jle 0x482464
jmp 0x482410
cmp esi, dword [ebp + 0xc]
jae 0x4824f0
movzx edx, byte [eax + 1]
mov byte [esi], dl
movzx edx, byte [eax]
neg dl
movzx edx, dl
add ecx, 1
add edx, 1
add esi, 4
cmp ecx, edx
jl 0x482410
jmp 0x482464
movsx edx, dl
add edx, 1
test edx, edx
jle 0x48245f
cmp esi, dword [ebp + 0xc]
jae 0x48250d
mov dl, byte [eax + ecx + 1]
mov byte [esi], dl
movsx edx, byte [eax]
add ecx, 1
add edx, 1
add esi, 4
cmp ecx, edx
jl 0x482440
movsx eax, byte [eax]
add edi, eax
mov ecx, dword [ebp - 8]
movzx edx, word [ecx]
add edi, 2
cmp edi, edx
jl 0x4823f0
mov eax, dword [ebp - 0x18]
add dword [ebp - 8], 2
add eax, 1
cmp eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
jb 0x482394
cmp dword [0x6f524c], 0
je 0x4824a1
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
push edx
push eax
call fcn.0047d2c0
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00607d6d
mov esp, ebp
pop ebp
ret 0x14
cmp dword [0x6f524c], 0
je 0x4824cc
mov ecx, dword [ebp - 0xc]
push ecx
push eax
call fcn.0047d2c0
mov eax, 0xf4242
jmp 0x4824a3
cmp dword [0x6f524c], 0
je 0x4824e9
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
push edx
push eax
call fcn.0047d2c0
mov eax, 3
jmp 0x4824a3
cmp dword [0x6f524c], 0
je 0x482506
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push ecx
push edx
call fcn.0047d2c0
mov eax, 4
jmp 0x4824a3
cmp dword [0x6f524c], 0
je 0x482523
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call fcn.0047d2c0
mov eax, 4
jmp 0x4824a3
Function at 0x482530
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6d7160]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [edi + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
imul eax, esi
call fcn.00616f40
lea eax, [ebp - 0x10]
mov ebx, esp
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
cmp dword [0x6f524c], ecx
mov dword [ebp - 8], eax
je 0x482577
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0047cfb0
jmp 0x48257d
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x14], 0
jbe 0x482672
mov edi, edi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4825a0
cmp dword [eax], 0
jne 0x48269f
cmp dword [edi + 0x4b0], 0
movzx ecx, word [edi + 0x10]
mov dword [ebp - 0x18], ecx
je 0x482614
test ecx, ecx
je 0x48262c
mov esi, ecx
imul esi, dword [ebp + 0xc]
test ebx, ebx
je 0x482608
mov ecx, dword [edi + 0x4b8]
cmp esi, ecx
ja 0x4825d5
mov eax, dword [edi + 0x4b4]
lea edx, [eax + esi]
cmp edx, ecx
jbe 0x4825df
mov eax, dword [edi + 0x4b4]
sub ecx, eax
mov esi, ecx
test esi, esi
je 0x482608
mov ecx, dword [edi + 0x4b0]
push esi
add eax, ecx
push eax
push ebx
call fcn.0060d1b0
add dword [edi + 0x4b4], esi
mov eax, esi
mov esi, dword [ebp + 0xc]
xor edx, edx
add esp, 0xc
div dword [ebp - 0x18]
jmp 0x48262e
mov esi, dword [ebp + 0xc]
xor eax, eax
xor edx, edx
div dword [ebp - 0x18]
jmp 0x48262e
mov eax, dword [edi + 0x4a0]
test eax, eax
je 0x48262c
push eax
push esi
push ecx
push ebx
call fcn.0060860a
add esp, 0x10
jmp 0x48262e
xor eax, eax
cmp eax, esi
jne 0x4826b9
xor eax, eax
test esi, esi
jbe 0x482660
lea esp, [esp]
movzx ecx, word [edi + 0x10]
mov esi, dword [ebp + 8]
imul ecx, eax
mov dl, byte [ecx + ebx]
mov byte [esi], dl
add esi, 4
add eax, 1
cmp eax, dword [ebp + 0xc]
mov dword [ebp + 8], esi
jb 0x482640
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
jb 0x482590
cmp dword [0x6f524c], 0
je 0x482688
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
push ecx
push edx
call fcn.0047d2c0
xor eax, eax
lea esp, [ebp - 0x24]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00607d6d
mov esp, ebp
pop ebp
ret 0xc
cmp dword [0x6f524c], 0
je 0x4826b2
mov ecx, dword [ebp - 8]
push ecx
push eax
call fcn.0047d2c0
mov eax, 0xf4242
jmp 0x48268a
cmp dword [0x6f524c], 0
je 0x4826cf
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push edx
push eax
call fcn.0047d2c0
mov eax, 3
jmp 0x48268a
Function at 0x484a50
Capabilities:
Delete registry value

Disassembly:
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x484a6a
add eax, 4
push eax
mov eax, dword [ecx]
push 0x67b348
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
ret
xor eax, eax
push eax
mov eax, dword [ecx]
push 0x67b348
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
ret