joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a1740
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1044
call fcn.004af5f0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x1040], eax
mov eax, dword [esp + 0x105c]
push ebx
mov ebx, dword [esp + 0x1064]
push ebp
mov ebp, dword [esp + 0x105c]
push esi
mov esi, dword [esp + 0x1058]
push edi
mov edi, dword [esp + 0x1060]
push 0x3c
lea ecx, [esp + 0x18]
push 0
push ecx
mov dword [esp + 0x1c], eax
call fcn.004af620
add esp, 0xc
cmp byte [esp + 0x1068], 0
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x500
jne 0x4a17b6
mov dword [esp + 0x18], 0x540
push esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebp
call fcn.00455b40
cmp eax, esi
jne 0x4a17f0
push esi
lea edx, [esp + 0x54]
push str.._s
push edx
mov edx, 0x800
call fcn.004a5ca0
lea eax, [esp + 0x5c]
add esp, 0xc
mov dword [esp + 0x24], eax
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [esp + 0x14]
mov ebx, 1
push ecx
mov dword [esp + 0x34], ebx
mov byte [0x526d8b], bl
call esi
test eax, eax
jne 0x4a1821
cmp dword [esp + 0x20], eax
je 0x4a1821
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x24], eax
call esi
mov byte [0x526d8b], 0
test eax, eax
je 0x4a18d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x483
je 0x4a18d2
cmp byte [esp + 0x1068], 0
jne 0x4a18ce
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x4a1882
mov eax, dword [0x56a7f8]
mov edx, dword [esp + 0x34]
mov dword [eax*4 + 0x56a7b8], ecx
mov dword [eax*4 + 0x56a778], edx
inc eax
and eax, 0x8000000f
jns 0x4a187b
dec eax
or eax, 0xfffffff0
inc eax
mov dword [0x56a7f8], eax
jmp 0x4a18c4
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor esi, esi
lea ebx, [ebx]
mov eax, dword [esi + 0x56a778]
cmp eax, dword [esp + 0x34]
jne 0x4a18b8
mov ecx, dword [esi + 0x56a7b8]
push 0
push ecx
call edi
cmp eax, 0x102
jne 0x4a18b8
mov edx, dword [esi + 0x56a7b8]
mov dword [esp + 0x4c], edx
add esi, 4
cmp esi, 0x40
jl 0x4a1890
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4a18ce
mov dword [eax], ecx
mov al, bl
jmp 0x4a18d4
xor al, al
mov ecx, dword [esp + 0x1050]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004aedbb
add esp, 0x1044
ret 0x1c
Function at 0x4a18f0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4c42cb
mov eax, dword fs:[0]
push eax
mov eax, 0x40ac
call fcn.004af5f0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x40a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d8620]
xor eax, esp
push eax
lea eax, [esp + 0x40c0]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x40d4]
mov ebp, dword [esp + 0x40d0]
push eax
call fcn.00455b40
mov ebx, eax
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a1950
sub eax, edx
mov ecx, ebx
sar eax, 1
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4a1964
sub ecx, esi
sar ecx, 1
lea eax, [ecx + eax + 1]
cmp eax, 0x800
jae 0x4a1b12
lea edx, [esp + 0x10bc]
mov eax, edi
sub edx, edi
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4a1990
lea ecx, [esp + 0x10bc]
push ecx
call fcn.004554c0
mov eax, ebx
mov edx, ebx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a19b0
lea edi, [esp + 0x10bc]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4a19d0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4a19d0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call fcn.0046f930
mov dword [esp + 0x40c8], 0
push 0x1000
push 0x4c5d70
lea edx, [esp + 0x20c4]
push edx
push str.ViewerIgnoreModifications
push str.Viewer
call fcn.0045fba0
cmp word [esp + 0x20bc], 0
je 0x4a1a42
push 0
push 0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x20c8]
push ecx
call fcn.0046fd30
push 0x400
lea edx, [esp + 0xc0]
push edx
lea ecx, [esp + 0x1c]
call fcn.0046fcf0
test al, al
je 0x4a1afe
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x4a1a70
push 0x400
lea eax, [esp + 0x8c0]
push eax
lea ecx, [esp + 0xc4]
push ecx
call edi
lea edx, [esp + 0x8be]
push 0x4cd270
push edx
call fcn.004b27b6
mov esi, eax
add esp, 8
test esi, esi
je 0x4a1b3e
xor eax, eax
mov word [esi], ax
add esi, 4
cmp word [esi], ax
jne 0x4a1ab8
mov esi, 0x4c5f34
push 4
push ebp
lea ecx, [esp + 0x8c4]
push ecx
call fcn.0044a340
test al, al
je 0x4a1ae0
push 4
lea edx, [esp + 0x10c0]
push edx
push esi
call fcn.0044a340
test al, al
jne 0x4a1b47
push 0x400
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0x1c]
call fcn.0046fcf0
test al, al
jne 0x4a1a70
mov dword [esp + 0x40c8], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00401a70
xor al, al
mov ecx, dword [esp + 0x40c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40a8]
xor ecx, esp
call fcn.004aedbb
add esp, 0x40b8
ret 8
lea esi, [esp + 0x8bc]
jmp 0x4a1acc
mov dword [esp + 0x40c8], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00401a70
mov al, 1
jmp 0x4a1b14
Function at 0x4a37f0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push 1
push esi
mov ecx, 0x56c928
call fcn.004a1490
mov bl, byte [esp + 0x10]
push 0
test bl, bl
push 0x56c928
sete al
movzx ecx, al
push ecx
push 0
push 0
push esi
push 0
call fcn.004a1740
test al, al
jne 0x4a385d
mov eax, dword [0x56c930]
cmp eax, 0xffffffff
je 0x4a3842
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x56c930], 0xffffffff
push 0x80
push 0
push 0x56e94a
call fcn.004af620
add esp, 0xc
pop esi
xor al, al
pop ebx
ret 8
test bl, bl
je 0x4a387f
push 0x56c928
push 0x10000
push 0x4a2310
call fcn.004b043b
add esp, 0xc
pop esi
mov al, 1
pop ebx
ret 8
mov eax, dword [0x56c930]
cmp eax, 0xffffffff
je 0x4a389a
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x56c930], 0xffffffff
push 0x80
push 0
push 0x56e94a
call fcn.004af620
add esp, 0xc
pop esi
mov al, 1
pop ebx
ret 8

Function at 0x4a38c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push 0x526d90
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4a38f9
push 0x40
push 0x2bc
call fcn.00465ec0
push eax
push 0x2bd
call fcn.00465ec0
push eax
mov eax, dword [0x527edc]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
ret
push 0
push 0x526d90
mov ecx, esi
call fcn.004a2b20
pop esi
ret
Function at 0x4a3910
Capabilities:
Create thread

Disassembly:
mov eax, 0x1804
call fcn.004af5f0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x1800], eax
push esi
mov esi, dword [esp + 0x180c]
test esi, esi
je 0x4a3985
push 0x4cd25c
push esi
call fcn.00455f40
test al, al
jne 0x4a394c
call fcn.004a16d0
test al, al
je 0x4a3985
push 0x30
push 0x65
call fcn.00465ec0
push eax
push 0x596
call fcn.00465ec0
push eax
mov eax, dword [0x527edc]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
mov ecx, dword [esp + 0x1800]
xor ecx, esp
call fcn.004aedbb
add esp, 0x1804
ret 4
cmp byte [0x526d89], 0
jne 0x4a39d4
push 0
push 0
push 1
push 0
push 0
push esi
push 0
call fcn.004a1740
test al, al
jne 0x4a3ac7
push esi
push 0x201
call fcn.00465ec0
push eax
call fcn.004985f0
add esp, 8
pop esi
mov ecx, dword [esp + 0x1800]
xor ecx, esp
call fcn.004aedbb
add esp, 0x1804
ret 4
push 1
lea ecx, [esp + 0x808]
push ecx
push str.Rar_EX
call fcn.0048a730
test al, al
je 0x4a3ac7
push 0x400
lea edx, [esp + 0x1008]
push edx
call fcn.0048af80
lea eax, [esp + 0x804]
push eax
call fcn.0048af60
call fcn.00486850
push 0x400
push 0x5362aa
mov ecx, 0x52dfe8
call fcn.00412e90
mov ecx, dword [0x52e1f4]
mov dword [0x53423c], ecx
mov ecx, dword [0x536aac]
push 0x4c579c
call fcn.0046f9d0
push 0
push 0
mov ecx, 0x52dfe8
mov byte [0x53395a], 0
mov byte [0x533831], 0
mov byte [0x533830], 0
mov dword [0x533e28], 4
call fcn.00417ad0
cmp byte [0x526d88], 0
jne 0x4a3ac7
lea edx, [esp + 4]
push edx
push esi
call fcn.00455d20
lea eax, [esp + 4]
push eax
mov ecx, eax
push ecx
call fcn.00455800
push 0
lea edx, [esp + 8]
push edx
mov ecx, 0x56ea50
call fcn.004a1490
lea eax, [esp + 0x1004]
push eax
call fcn.0048af60
push 0x56ea50
push 0x10000
push 0x4a2310
call fcn.004b043b
add esp, 0xc
mov ecx, dword [esp + 0x1804]
pop esi
xor ecx, esp
call fcn.004aedbb
add esp, 0x1804
ret 4
Function at 0x4a4ea0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4a4ead
xor eax, eax
ret 0xc
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
push esi
not eax
test edx, edx
je 0x4a4ee0
lea esp, [esp]
test cl, 3
je 0x4a4ee0
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4cd4f8]
inc ecx
sub edx, 1
jne 0x4a4ec0
push edi
cmp edx, 0x10
jb 0x4a5033
mov esi, edx
shr esi, 4
nop
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x4cd4f8]
add ecx, 4
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x4cd4f8]
add ecx, 4
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x4cd4f8]
add ecx, 4
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x4cd4f8]
sub edx, 0x10
xor eax, dword [ecx - 0xc]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x4cd4f8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x4cd4f8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x4cd4f8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x4cd4f8]
xor eax, dword [ecx - 8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x4cd4f8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x4cd4f8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x4cd4f8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x4cd4f8]
xor eax, dword [ecx - 4]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4cd4f8]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4cd4f8]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4cd4f8]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4cd4f8]
sub esi, 1
jne 0x4a4ef0
cmp edx, 4
jb 0x4a5095
mov esi, edx
shr esi, 2
lea ecx, [ecx]
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4cd4f8]
sub edx, 4
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4cd4f8]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4cd4f8]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4cd4f8]
sub esi, 1
jne 0x4a5040
pop edi
test edx, edx
je 0x4a50bb
lea ebx, [ebx]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4cd4f8]
inc ecx
sub edx, 1
jne 0x4a50a0
not eax
pop esi
ret 0xc
Function at 0x4a50d0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, 0x12345678
mov edx, 0x23456789
mov esi, 0x34567890
mov dword [0x571b94], eax
mov dword [0x571b98], edx
mov dword [0x571b9c], esi
mov cl, byte [edi]
test cl, cl
je 0x4a514c
push ebx
mov ebx, dword [0x571bb8]
movsx ecx, cl
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ebx + ecx*4]
inc edi
movzx ecx, al
add ecx, edx
imul ecx, ecx, 0x8088405
inc ecx
mov edx, ecx
shr ecx, 0x18
xor ecx, esi
and ecx, 0xff
shr esi, 8
mov dword [0x571b94], eax
mov dword [0x571b98], edx
xor esi, dword [ebx + ecx*4]
mov dword [0x571b9c], esi
mov cl, byte [edi]
test cl, cl
jne 0x4a5103
pop ebx
pop edi
pop esi
ret 4

Function at 0x4a5160
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
cmp word [0x533304], 0
je 0x4a5208
push ebx
mov ebx, dword [esp + 0xc]
imul ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
test ebx, ebx
je 0x4a5206
push ebp
push esi
jmp 0x4a5190
movsx eax, byte [edi]
mov esi, dword [0x571b94]
mov ebp, dword [0x571bb8]
xor eax, esi
and eax, 0xff
mov ecx, dword [0x571b9c]
shr esi, 8
xor esi, dword [ebp + eax*4]
mov edx, ecx
mov eax, esi
mov dword [0x571b94], eax
movzx eax, al
add eax, dword [0x571b98]
and edx, 0xfffd
imul eax, eax, 0x8088405
inc eax
mov dword [0x571b98], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [ebp + eax*4]
or edx, 2
mov dword [0x571b9c], ecx
mov ecx, edx
xor ecx, 1
imul ecx, edx
shr ecx, 8
xor byte [edi], cl
inc edi
sub ebx, 1
jne 0x4a5190
pop esi
pop ebp
pop edi
pop ebx
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push edx
push eax
push ecx
call fcn.00435170
ret 0xc
Function at 0x4a92f0
Capabilities:
Read file on windows

Disassembly:
push ecx
push eax
push 4
lea ecx, [esp + 8]
push 1
push ecx
call fcn.004b1faa
add esp, 0x10
cmp eax, 4
je 0x4a930e
xor eax, eax
pop ecx
ret 4
mov ecx, dword [esp + 8]
lea edx, [esp]
xor eax, eax
sub ecx, edx
lea esp, [esp]
lea edx, [ecx + eax]
mov dl, byte [esp + edx]
cmp dl, byte [esp + eax]
jne 0x4a9331
inc eax
cmp eax, 4
jl 0x4a9320
xor ecx, ecx
cmp eax, 4
sete cl
mov eax, ecx
pop ecx
ret 4
Function at 0x4adc60
Capabilities:
Read file on windows

Disassembly:
cmp byte [0x527e58], 0
je 0x4adc6e
xor eax, eax
ret 8
mov eax, dword [esp + 8]
mov ecx, dword [0x571bec]
push esi
push edi
mov edi, dword [esp + 0xc]
push eax
push edi
push ecx
call fcn.004bb12c
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x4add3e
test esi, esi
je 0x4add3e
mov edx, dword [0x571ff0]
push ebx
push esi
push edi
push edx
call fcn.004a4ea0
mov ecx, dword [0x571bd8]
mov dword [0x571ff0], eax
mov eax, dword [0x571bdc]
xor edi, edi
mov ebx, ecx
add ecx, esi
mov edx, eax
adc eax, edi
cmp eax, edx
mov dword [0x571bd8], ecx
mov dword [0x571bdc], eax
jg 0x4adce1
jl 0x4adcda
cmp ecx, ebx
jae 0x4adce1
push 6
call fcn.004a59d0
mov eax, dword [0x571ba8]
mov ecx, dword [0x571bac]
mov edx, dword [0x572000]
mov ebx, dword [0x572004]
add eax, esi
adc ecx, edi
add edx, esi
adc ebx, edi
mov edi, dword [0x571bb4]
push edi
mov edi, dword [0x571bb0]
push edi
push ecx
push eax
mov dword [0x571ba8], eax
mov eax, dword [0x571ffc]
push eax
mov dword [0x571bac], ecx
mov ecx, dword [0x571ff8]
push ecx
push ebx
push edx
mov dword [0x572000], edx
mov dword [0x572004], ebx
call fcn.00409ca0
mov eax, esi
pop ebx
pop edi
pop esi
ret 8
Function at 0x4ae8c0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ae8e9
and eax, 0xffffffdf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4ae8e9
mov eax, 1
pop esi
ret 4
push esi
push 0x4bf
call fcn.00465ec0
push eax
mov eax, dword [0x513954]
push eax
call fcn.00498be0
add esp, 0xc
xor eax, eax
pop esi
ret 4

Function at 0x4aedbb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d8620]
jne 0x4aedc5
repz ret
jmp fcn.004b4cbe

Function at 0x4be48e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004b797f
and dword [ebp - 4], 0
cmp dword [0x572dc8], 0
mov ebx, eax
jne 0x4be53f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4be5f0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4be5f0
push eax
call fcn.004b790d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x572dc8], eax
call esi
push eax
call fcn.004b790d
mov dword [esp], 0x4cec68
push edi
mov dword [0x572dcc], eax
call esi
push eax
call fcn.004b790d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x572dd0], eax
call esi
push eax
call fcn.004b790d
pop ecx
mov dword [0x572dd8], eax
test eax, eax
je 0x4be53f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004b790d
pop ecx
mov dword [0x572dd4], eax
mov eax, dword [0x572dd4]
cmp eax, ebx
je 0x4be597
cmp dword [0x572dd8], ebx
je 0x4be597
push eax
call fcn.004b7988
push dword [0x572dd8]
mov esi, eax
call fcn.004b7988
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4be597
test edi, edi
je 0x4be597
call esi
test eax, eax
je 0x4be58e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4be58e
test byte [ebp - 0xc], 1
jne 0x4be597
or dword [ebp + 0x10], 0x200000
jmp 0x4be5d0
mov eax, dword [0x572dcc]
cmp eax, ebx
je 0x4be5d0
push eax
call fcn.004b7988
pop ecx
test eax, eax
je 0x4be5d0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4be5d0
mov eax, dword [0x572dd0]
cmp eax, ebx
je 0x4be5d0
push eax
call fcn.004b7988
pop ecx
test eax, eax
je 0x4be5d0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x572dc8]
call fcn.004b7988
pop ecx
test eax, eax
je 0x4be5f0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4be5f2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4174e3
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x4983d8]
sub esp, 0xc
push esi
xor esi, esi
push edi
mov edi, ecx
test eax, eax
jne 0x417584
push ebx
mov ebx, 0x4983dc
push ebx
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
cmp dword [0x4983d8], esi
jne 0x417573
lea edx, [ebp - 0xc]
mov ecx, edi
call fcn.00417171
mov esi, eax
test esi, esi
js 0x41756a
push 0x4063ac
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4983d8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x4983d8], 0
jne 0x41755f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41756a
movzx esi, si
or esi, 0x80070000
jmp 0x41756a
sub eax, 0xb7
neg eax
sbb eax, eax
and esi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
pop ebx
test esi, esi
js 0x4175d1
mov eax, dword [0x4983d8]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4175d1
cmp eax, 0x80
je 0x4175cc
cmp eax, 0x102
je 0x4175c5
cmp eax, 0xffffffff
je 0x4175ae
mov esi, 0x8000ffff
jmp 0x4175d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4175d1
movzx esi, si
or esi, 0x80070000
jmp 0x4175d1
mov esi, 0x800705b4
jmp 0x4175d1
mov esi, 0x800702df
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41774c
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x49600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], edx
push eax
push ecx
mov edx, 0x40642c
call fcn.0041706f
mov esi, eax
test esi, esi
js 0x41781e
push ebx
push edi
lea eax, [ebp - 0x20c]
xor edi, edi
push eax
push edi
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebx, eax
test ebx, ebx
jne 0x4177b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4177b5
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x417811
push 4
push edi
push edi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x4177df
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4177e1
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4177ed
mov ecx, dword [ebp - 0x210]
mov eax, dword [edi]
mov dword [ecx], eax
test edi, edi
je 0x417811
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x417811
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x417811
movzx esi, si
or esi, 0x80070000
test ebx, ebx
je 0x41781c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00484070
mov esp, ebp
pop ebp
ret
Function at 0x417a27
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x49600c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push esi
push edi
push eax
push 0x406578
push 1
push 0
push 0x402a94
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x417a75
mov eax, dword [ebp - 8]
push 2
push 1
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x49943c]
call esi
mov edi, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x417a8c
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x49943c]
call esi
test edi, edi
js 0x417ac3
cmp byte [0x4983c8], 0
je 0x417a9e
or edi, 0xffffffff
jmp 0x417ac3
and dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 8]
push ecx
push eax
call fcn.00417d65
cmp al, 1
jne 0x417ac0
push ecx
call fcn.00417e19
mov edi, eax
jmp 0x417ac3
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00484070
mov esp, ebp
pop ebp
ret 0x10

Function at 0x417d14
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x498410], eax
test eax, eax
je 0x417d5b
lea eax, [ebp - 4]
push eax
push esi
push 0x4983e0
push 0x417f10
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x417d59
push dword [0x498410]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419047
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x23c
mov eax, 0x485178
call fcn.004847e9
mov esi, ecx
mov edi, dword [ebp + 8]
xor eax, eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x238], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
cmp dword [ebx + 0x14], 8
mov dword [ebp - 0x234], 1
mov dword [ebp - 0x220], 0x208
jb 0x419095
mov eax, dword [ebx]
jmp 0x419097
mov eax, ebx
cmp dword [edi + 0x14], 8
jb 0x4190a1
mov ecx, dword [edi]
jmp 0x4190a3
mov ecx, edi
lea edx, [ebp - 0x220]
push edx
lea edx, [ebp - 0x21c]
push edx
push 0
push 0x20
push eax
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x4190f6
lea edx, [ebp - 0x21c]
lea ecx, [ebp - 0x230]
call fcn.00419290
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.0041b797
lea ecx, [ebp - 0x230]
call fcn.0041b899
jmp 0x419196
cmp eax, 0xea
jne 0x419196
mov eax, dword [ebp - 0x220]
xor ecx, ecx
shr eax, 1
inc eax
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], ecx
lea ecx, [ebp - 0x230]
push eax
call fcn.0041bb47
mov dword [ebp - 4], 2
cmp dword [ebx + 0x14], 8
jb 0x419139
mov ebx, dword [ebx]
cmp dword [edi + 0x14], 8
jb 0x419141
mov edi, dword [edi]
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x230]
push 0
push 0x20
push ebx
push edi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x41918b
mov edx, dword [ebp - 0x230]
lea ecx, [ebp - 0x248]
call fcn.00419290
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0041b797
lea ecx, [ebp - 0x248]
call fcn.0041b899
lea ecx, [ebp - 0x230]
call fcn.0041bbd3
mov eax, esi
call fcn.00484789
ret 8