joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ba34
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
lea ebx, [ebp - 0x3c]
mov esi, sym.NFOPad.exe__formMain
mov edi, 0x67725c
mov eax, 0x67a240
call fcn.006658cc
mov word [ebx + 0x10], 0xc
lea edx, [edi + 0x586]
lea eax, [ebp - 4]
call fcn.00673474
inc dword [ebx + 0x1c]
lea edx, [ebp - 4]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x718]
add eax, 8
call fcn.006736d8
push eax
dec dword [ebx + 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00673604
pop ecx
test cl, cl
je 0x40baa4
mov al, 1
mov edx, dword [ebx]
mov dword fs:[0], edx
jmp 0x40bc4e
mov word [ebx + 0x10], 0x18
lea edx, [edi + 0x588]
lea eax, [ebp - 8]
call fcn.00673474
inc dword [ebx + 0x1c]
lea edx, [ebp - 8]
mov eax, dword [esi]
mov eax, dword [eax + 0x720]
add eax, 8
call fcn.006736d8
push eax
dec dword [ebx + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00673604
pop ecx
test cl, cl
je 0x40bb2e
lea edx, [edi + 0x58a]
lea eax, [ebp - 0xc]
call fcn.00673474
inc dword [ebx + 0x1c]
lea edx, [ebp - 0xc]
mov eax, dword [esi]
mov eax, dword [eax + 0x5dc]
add eax, 8
call fcn.006736d8
push eax
dec dword [ebx + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00673604
pop ecx
test cl, cl
jne 0x40bb2e
mov al, 1
mov edx, dword [ebx]
mov dword fs:[0], edx
jmp 0x40bc4e
mov word [ebx + 0x10], 0x24
lea edx, [edi + 0x58c]
lea eax, [ebp - 0x10]
call fcn.00673474
inc dword [ebx + 0x1c]
lea edx, [ebp - 0x10]
mov eax, dword [esi]
mov eax, dword [eax + 0x728]
add eax, 8
call fcn.006736d8
push eax
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00673604
pop ecx
test cl, cl
je 0x40bb89
mov ecx, dword [esi]
cmp byte [ecx + 0x764], 0
je 0x40bb89
mov al, 1
mov edx, dword [ebx]
mov dword fs:[0], edx
jmp 0x40bc4e
mov word [ebx + 0x10], 0x30
lea edx, [edi + 0x58e]
lea eax, [ebp - 0x14]
call fcn.00673474
inc dword [ebx + 0x1c]
lea edx, [ebp - 0x14]
mov eax, dword [esi]
mov eax, dword [eax + 0x71c]
add eax, 8
call fcn.006736d8
push eax
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00673604
pop ecx
test cl, cl
je 0x40bbe2
push 0x12
call sub.USER32.DLL_GetKeyState
test ah, 0x80
je 0x40bbe2
mov al, 1
mov edx, dword [ebx]
mov dword fs:[0], edx
jmp 0x40bc4e
mov word [ebx + 0x10], 0x3c
lea edx, [edi + 0x590]
lea eax, [ebp - 0x18]
call fcn.00673474
inc dword [ebx + 0x1c]
lea edx, [ebp - 0x18]
mov eax, dword [esi]
mov eax, dword [eax + 0x724]
add eax, 8
call fcn.006736d8
push eax
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00673604
pop ecx
test cl, cl
je 0x40bc43
push 0x91
call sub.USER32.DLL_GetKeyState
and ax, 0xffff
movzx ecx, ax
dec ecx
jne 0x40bc43
mov al, 1
mov edx, dword [ebx]
mov dword fs:[0], edx
jmp 0x40bc4e
xor eax, eax
mov edx, dword [ebx]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426d50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x685f44
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.006658cc
mov word [ebp - 0x14], 0xc
cmp dword [ebx], 0
je 0x426d75
mov edx, dword [ebx]
jmp 0x426d7a
mov edx, 0x6845f2
push edx
call sub.KERNEL32.DLL_GetFileAttributesW
mov word [ebp - 0x14], 0xc
cmp eax, 0xffffffff
jne 0x426d99
xor eax, eax
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
jmp 0x426dca
test al, 1
je 0x426dab
mov al, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x426dca
mov word [ebp - 0x14], 0
jmp 0x426dbe
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427574
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
mov eax, 0x68625c
call fcn.006658cc
lea edx, [ebp - 0x238]
push edx
push 0
push 0
push 0x1a
push 0
call sub.SHFOLDER.DLL_SHGetFolderPathW
test eax, eax
jl 0x42761a
mov word [ebp - 0x20], 0xc
lea eax, [ebp - 8]
call fcn.00404fd8
push eax
inc dword [ebp - 0x14]
mov edx, str.NFOPad
lea eax, [ebp - 4]
call fcn.00673474
mov edx, eax
inc dword [ebp - 0x14]
lea eax, [ebp - 0x238]
pop ecx
call fcn.00673b60
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
call fcn.0067362c
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x18
push eax
lea eax, [ebp - 8]
dec dword [ebp - 0x14]
call fcn.00673604
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00673604
pop eax
mov word [ebp - 0x20], 0xc
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x427666
mov word [ebp - 0x20], 0x24
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.0040509c
inc dword [ebp - 0x14]
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.0067362c
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x30
push eax
lea eax, [ebp - 0xc]
dec dword [ebp - 0x14]
call fcn.00673604
pop eax
mov word [ebp - 0x20], 0x24
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x430aa0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov eax, 0x687f0c
push ebx
push esi
push edi
call fcn.006658cc
mov word [ebp - 0x1c], 0xc
mov word [ebp - 0x1c], 0x24
lea eax, [ebp - 4]
call fcn.00404fd8
push eax
inc dword [ebp - 0x10]
call fcn.00430e54
cmp dword [ebp - 4], 0
pop ecx
je 0x430adc
mov edx, dword [ebp - 4]
jmp 0x430ae1
mov edx, 0x687898
push edx
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00673604
mov word [ebp - 0x1c], 0x18
cmp ebx, 0xffffffff
jne 0x430b12
mov ecx, dword [ebp - 0x2c]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x430b7b
test bl, 1
je 0x430b59
and ebx, 0xfffffffe
push ebx
mov word [ebp - 0x1c], 0x30
lea eax, [ebp - 8]
call fcn.00404fd8
push eax
inc dword [ebp - 0x10]
call fcn.00430e54
cmp dword [ebp - 8], 0
pop ecx
je 0x430b3e
mov edx, dword [ebp - 8]
jmp 0x430b43
mov edx, 0x68789a
push edx
call sub.KERNEL32.DLL_SetFileAttributesW
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00673604
mov word [ebp - 0x1c], 0xc
mov word [ebp - 0x1c], 0
jmp 0x430b72
mov eax, dword [ebp - 0x2c]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430cc8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov eax, 0x688040
push ebx
push esi
push edi
call fcn.006658cc
mov word [ebp - 0x18], 0xc
push 0
mov word [ebp - 0x18], 0x18
lea eax, [ebp - 4]
call fcn.00404fd8
push eax
inc dword [ebp - 0xc]
call fcn.00427574
cmp dword [ebp - 4], 0
pop ecx
je 0x430d06
mov edx, dword [ebp - 4]
jmp 0x430d0b
mov edx, 0x6878da
push edx
call sub.KERNEL32.DLL_CreateDirectoryW
test eax, eax
mov edx, 2
sete al
and eax, 1
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0xc]
call fcn.00673604
pop ecx
test cl, cl
je 0x430d53
call sub.KERNEL32.DLL_GetLastError
mov word [ebp - 0x18], 0xc
test eax, eax
je 0x430d53
cmp eax, 0xb7
je 0x430d53
xor eax, eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x430d87
mov word [ebp - 0x18], 0
jmp 0x430d7b
mov al, 1
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430d90
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov eax, 0x6880a0
push ebx
push esi
push edi
call fcn.006658cc
mov word [ebp - 0x18], 0xc
mov word [ebp - 0x18], 0x18
lea eax, [ebp - 4]
call fcn.00404fd8
push eax
inc dword [ebp - 0xc]
call fcn.00427574
cmp dword [ebp - 4], 0
pop ecx
je 0x430dcc
mov edx, dword [ebp - 4]
jmp 0x430dd1
mov edx, 0x687928
push edx
call sub.KERNEL32.DLL_RemoveDirectoryW
test eax, eax
mov edx, 2
sete al
and eax, 1
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0xc]
call fcn.00673604
pop ecx
test cl, cl
je 0x430e17
call sub.KERNEL32.DLL_GetLastError
mov word [ebp - 0x18], 0xc
test eax, eax
je 0x430e17
cmp eax, 2
je 0x430e17
xor eax, eax
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
jmp 0x430e4b
mov word [ebp - 0x18], 0
jmp 0x430e3f
mov al, 1
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x447a9c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x68ef5c
test edx, edx
jne 0x447abb
xor eax, eax
jmp 0x447bd9
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x447ad8
push esi
push edx
push eax
call fcn.00447be0
add esp, 0xc
jmp 0x447bd9
push esi
push edx
push eax
call fcn.00447ea0
add esp, 0xc
jmp 0x447bd9
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x46ebe8
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x46ec86
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xc]
je 0x46ec4a
cmp byte [ebx + 0x10], 0
jne 0x46ec4a
cmp byte [ebx + 0x3c], 0
jne 0x46ec4a
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 1
je 0x46ec6b
lea edx, [ebp - 4]
mov eax, dword [0x69a928]
call fcn.004bece0
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x45b190]
call fcn.0049f5dc
call fcn.004ba8fc
jmp 0x46ec6b
lea edx, [ebp - 8]
mov eax, dword [0x69a928]
call fcn.004bece0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x45b190]
call fcn.0049f5dc
call fcn.004ba8fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ec8d
lea eax, [ebp - 8]
mov edx, 2
call fcn.004bb154
ret

Function at 0x46f588
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x46f5d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.KERNEL32.DLL_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0046eb2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46f5ef
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x46f5f8
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0046eb2c
dec esi
jne 0x46f61a
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x47184c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x69b5f0
cmp dword [edi], 0
jne 0x4718c8
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x69b5ec]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x6913dc
mov ecx, 2
call fcn.004b8bf0
mov edx, 0x471824
lea eax, [esi + 5]
call fcn.00471844
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00471844
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x47189d
mov dword [0x69b5ec], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4773c8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x477583
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004bb51c
mov eax, dword [ebp - 4]
call fcn.00476c80
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x47741a
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.004bc2a4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00478004
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4774f9
xor eax, eax
push ebp
push 0x4774f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00476fb8
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004775b8
test al, al
je 0x4774d0
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.004bb27c
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4774d0
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.004bbe30
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00476f18
test al, al
je 0x4774ca
mov eax, dword [ebp - 8]
call fcn.004bbe30
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004bbe88
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004773c8
dec ebx
cmp ebx, 0xffffffff
jne 0x477479
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4774f9
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00476fb8
mov eax, dword [ebp - 0x1c]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
cmp byte [0x69b600], 0
je 0x477539
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.004bbe30
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00476fa4
push eax
call sub.ADVAPI32.DLL_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00476f18
mov ebx, eax
jmp 0x477560
mov eax, dword [ebp - 4]
call fcn.004bbe30
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00476fa4
push eax
call sub.ADVAPI32.DLL_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00476f18
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47758a
lea eax, [ebp - 0x3c]
call fcn.004bb0f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004bb154
ret
Function at 0x477ee0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.00476c98
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.004bbe30
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.00476f18
test al, al
jne 0x477f48
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x69a8f4]
mov dl, 1
mov eax, dword [0x475a6c]
call fcn.0049f7e0
call fcn.004ba8fc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x477f54
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004bbe30
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.00476f18
test al, al
jne 0x477fb5
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x69a8ec]
mov dl, 1
mov eax, dword [0x475a6c]
call fcn.0049f7e0
call fcn.004ba8fc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00476cc8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4785b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4786dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.00476fb8
xor eax, eax
push ebp
push 0x4786b7
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004775b8
test al, al
je 0x47869b
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00478494
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.004bb27c
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x47869b
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004bbe30
push eax
push edi
push esi
call sub.ADVAPI32.DLL_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00476f18
test al, al
je 0x478697
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004bbe30
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.004bbe88
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00478494
pop ecx
inc edi
dec ebx
jne 0x47863f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4786be
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.00476fb8
ret
Function at 0x4786ec
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47893a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.00476fb8
xor eax, eax
push ebp
push 0x478910
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004775b8
test al, al
je 0x4788f4
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.004bb27c
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x4788f4
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.004bbe30
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00476f18
test al, al
je 0x4788e8
mov eax, dword [ebp - 4]
call fcn.004bbe30
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.004bbe88
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00478004
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4788e8
xor eax, eax
push ebp
push 0x4788e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.00476fb8
xor eax, eax
push ebp
push 0x4788c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004bbe30
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.004bbe88
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00476fbc
mov eax, dword [ebp - 4]
call fcn.004bbe30
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.004bbe88
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00478004
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4788a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004785b4
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004786ec
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4788a7
mov eax, dword [ebp - 0x24]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x478777
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478917
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.00476fb8
ret
Function at 0x4991e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x499239
test eax, edx
je 0x49923c
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x4991f7
movzx eax, word [eax]
sub eax, ecx
jmp 0x49921e
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x49921f
add ecx, 4
js 0x49920f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x49921c
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x49921e
xor eax, eax
ret
test eax, eax
je 0x499248
test edx, edx
jne 0x4991e8
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x49a5cc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.004bbe30
mov edi, eax
push edi
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x49a636
test ah, 4
je 0x49a62f
test bl, bl
jne 0x49a5f4
mov al, 1
jmp 0x49a65d
test al, 0x10
je 0x49a5fc
xor eax, eax
jmp 0x49a65d
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
je 0x49a620
push eax
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
jmp 0x49a65d
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x49a65d
test al, 0x10
sete al
jmp 0x49a65d
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x49a657
cmp ebx, 3
je 0x49a657
cmp ebx, 0x7b
je 0x49a657
mov eax, esi
call fcn.0049a58c
test al, al
jne 0x49a65b
xor eax, eax
jmp 0x49a65d
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x49e748
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x49e781
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.004bb27c
jmp 0x49e78a
mov eax, ebx
mov edx, esi
call fcn.004bb4d4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x49e794
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.KERNEL32.DLL_GetLocaleInfoW
test eax, eax
jle 0x49e7b6
movzx eax, word [esp]
jmp 0x49e7b8
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret