joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401210
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
imul ebx
rcl edx, 0xff
and ebx, 0xab
add esi, 0xe5
inc esi
ror ebx, 0x59
imul esi
rcl edi, 0x5a
sub ebx, 0x59
inc esi
sub edx, 2
and edi, 0x61
ror edx, 0xb2
mov edx, 0x75
rol edx, 0xe9
and edx, 0xd4
imul ebx
imul edi
ror esi, 0x97
rcl esi, 0xac
inc edx
or edi, 0xdc
rol edi, 0x5f
neg eax
dec ebx
and esi, 0x98
not edi
rcl edi, 0xc
inc ebx
not eax
neg esi
not esi
ror eax, 0x21
rcl ebx, 0x78
or edi, 0x6d
mov ebx, 0xc9
sbb ebx, 0xd8
inc ebx
dec esi
neg edi
rcr ebx, 0x8d
imul edi
sub eax, 0xd4
bswap edi
dec eax
bswap esi
imul esi
dec ebx
dec ebx
dec edi
xor ecx, ecx
xor edi, edi
neg edx
rcr edx, 0xf5
sbb eax, 0xaa
not edi
inc edx
add edx, 0x5b
mov edx, 0x96
add ebx, 0xb2
neg eax
dec edi
rcr eax, 0x95
sub esi, 0x1e
sub eax, 0xd1
neg eax
imul edi
not ebx
inc esi
rol esi, 0x7b
sbb edi, 0xcb
mov ebx, 0xcb
rcr edi, 0x67
not esi
dec edi
imul esi
bswap esi
add eax, 0xce
neg edx
not ebx
dec esi
mov edx, 0xb9
and eax, 0xcd
neg eax
not edx
add edi, 0x6c
dec edi
inc edi
imul edx
imul edi
rcr esi, 0x56
neg ebx
not edi
neg eax
inc edx
rcr ebx, 0x41
dec eax
rcl edx, 0x1c
sbb ebx, 0x58
dec eax
imul edi
or ebx, 0x9e
mov ecx, dword [ebp + 0xc]
not edi
sub edi, 0xb8
rcr eax, 0x36
or esi, 0x25
not edx
rol edi, 0xd4
inc edx
inc edx
not eax
and ebx, 0x97
sub edi, 0x64
rcr edx, 0x8f
mov ebx, 0x6d
not edx
sub eax, 0x15
rcr edi, 0xcc
inc esi
and ebx, 0xab
imul edx
add eax, 0x90
rcl edi, 0xc9
or esi, 0xf
bswap eax
imul edi
rol edx, 0xaa
bswap ebx
bswap edi
imul edx
not edi
ror edx, 0xd1
not esi
add edi, 0x31
add eax, 0xea
sub eax, 0xe2
bswap eax
not edx
add esi, 0x84
rcl esi, 0x72
inc eax
not ebx
sbb ebx, 0x9b
dec edx
neg eax
not eax
inc eax
not edx
rcl ebx, 0xff
imul edx
sub eax, 0xc5
neg esi
mov edi, dword [ebp + 8]
xor ebx, eax
xor eax, eax
mov eax, eax
not byte [edi]
xor eax, eax
xor ebx, ebx
xor esi, eax
xor eax, eax
xor esi, eax
xor eax, ebx
mov ebx, esi
xor ebx, esi
mov ebx, esi
add byte [edi], 0x79
xor esi, esi
xor eax, eax
xor esi, eax
xor eax, esi
xor ebx, ebx
xor esi, ebx
mov ebx, ebx
mov esi, esi
xor eax, ebx
sub byte [edi], 0x30
mov esi, eax
xor ebx, eax
mov esi, ebx
xor esi, eax
xor ebx, eax
xor esi, esi
mov esi, ebx
mov eax, esi
mov eax, esi
imul byte [edi]
inc edi
loop 0x4013c5
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404f65
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x465800]
jne 0x404f6f
repz ret
jmp fcn.00407300
Function at 0x4055d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404385
and dword [ebp - 4], 0
cmp dword [0x466990], 0
mov ebx, eax
jne 0x405686
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405737
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405737
push eax
call fcn.00404313
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x466990], eax
call esi
push eax
call fcn.00404313
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x466994], eax
call esi
push eax
call fcn.00404313
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x466998], eax
call esi
push eax
call fcn.00404313
pop ecx
mov dword [0x4669a0], eax
test eax, eax
je 0x405686
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404313
pop ecx
mov dword [0x46699c], eax
mov eax, dword [0x46699c]
cmp eax, ebx
je 0x4056de
cmp dword [0x4669a0], ebx
je 0x4056de
push eax
call fcn.0040438e
push dword [0x4669a0]
mov esi, eax
call fcn.0040438e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4056de
test edi, edi
je 0x4056de
call esi
test eax, eax
je 0x4056d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4056d5
test byte [ebp - 0xc], 1
jne 0x4056de
or dword [ebp + 0x10], 0x200000
jmp 0x405717
mov eax, dword [0x466994]
cmp eax, ebx
je 0x405717
push eax
call fcn.0040438e
pop ecx
test eax, eax
je 0x405717
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405717
mov eax, dword [0x466998]
cmp eax, ebx
je 0x405717
push eax
call fcn.0040438e
pop ecx
test eax, eax
je 0x405717
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x466990]
call fcn.0040438e
pop ecx
test eax, eax
je 0x405737
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405739
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0xb6f8cc
Capabilities:
Encode data using xor

Disassembly:
sbb esp, dword [edi]
dec edx
ljmp 0x68fa
lea esp, [esp + 0x40]
je 0xb8334f
call fcn.00b7bf8f
jb 0xb6f92f
push eax
sar dl, 1
xchg ecx, eax
test dword [edx + 0x47], edi
jg 0xb6f8a9
pop eax
sbb byte [ebp + 0x4245611], cl
fidiv dword [ecx + 0x51c832fd]
popfd
out dx, al
nop
cwde
pop ebp
jge 0xb6f909
nop
lodsb al, byte [esi]
invalid
inc ebp
mov esp, 0xe262728a
std
int1
movsb byte es:[edi], byte [esi]
jl 0xb6f978
int3
add eax, dword [edi - 0x491a2657]
leave
int3
mov word [eax + 0x2a0872e5], ss
push cs
les edi, [edi + 0x47675a13]
test dword [edi], esi
invalid
loopne 0xb6f942
sub dword [edx], ebp
test dword [0x1e1f41e], ebx
loope 0xb6f983
inc esi
push eax
pushal
dec esi
pop edx
xor byte [eax + 0x7a9f14e], al
lahf
adc dword [ebp + 0x3b], esi
dec ebx
xchg ebp, eax
inc ecx
insd dword es:[edi], dx
and al, 0x27
xchg ebx, eax
sbb byte [edx], 0xae
out 0x81, al
dec ecx
cld
scasb al, byte es:[edi]
xor byte [eax + 0x38ca0dcc], bl
sub eax, 0xb9b9670b
or ebx, dword [di - 0x440b]
jecxz 0xb6f980
stc
int3

Function at 0xb703d9
Capabilities:
Encode data using xor

Disassembly:
jmp 0xa65b0e
lea esp, [esp + 0xc]
jae 0x8cf11d
pushfd
call fcn.00a6ef1e
xlatb
add bh, dl
in eax, dx
xchg ebp, eax
xchg ebx, eax
push ebx
xor dl, cl
mov edi, 0xca3c0191
aam 0x9b
cmp edx, dword [eax + 0x46]
loop 0xa63f31
inc ebx
invalid
pushal
lea esp, [esp + 0x20]
call fcn.00b7c494
jmp 0xa694c8
aaa
outsd dx, dword [esi]
aam 0xc2
in al, 0x59
add eax, 0x1cd2b905
outsd dx, dword [esi]
aaa
jns 0xa694cb
xchg edi, eax
add al, 0xb2
fcos
nop
invalid
pushfd
call fcn.00a6deb9
dec ecx
add byte [eax], al
dec eax
out dx, eax
stosd dword es:[edi], eax
test byte [esi + 0x1d], ah
fst st(2)
dec ebx
cld
loope 0xa69508
jo 0xa694db
push dword [edi - 0x4f]
ja 0xa6948f
xor eax, 0x1ed0744e
inc ebp
fstp xword [edi - 0x294ba283]
push edx
test byte [eax - 0x7016b36], bh
or eax, 0xc131dfbb
jb 0xa69517
leave
lds eax, [esi + 0x6f57ede9]
adc al, 0x66
inc edx
cmp byte [edx - 0x4eda91b4], al
adc eax, 0x13048c01
call 0x6dc3950a
mov cl, 0x15
add dword [esp + eax - 0x817ed], ecx
sbb al, 0x6d
invalid
aaa
inc ebx
mov ch, 0xa7
inc edx
cmp al, 0x5e
push eax
jnp 0xa6952d
xchg ebx, eax
mov ah, 0x47
mov al, 0x22
sub eax, 0xfe6f94cd
movsb byte es:[edi], byte [esi]
xor edi, ebp
lds ebx, [edx + 0x57]
retf
jmp 0xa63f22

Function at 0xb71c7c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp - 8], 0
clc
mov ecx, dword [edx + 0x18]
lea esp, [esp + 0x28]
Function at 0xb7e7c5
Capabilities:
Encode data using xor

Disassembly:
cmp edi, ebx
pushfd
lea esp, [esp + 0x10]
ja 0xa6f1b8
shr al, cl
sub ebx, edi
dec al
add ebx, esp
pushfd
enter 0xffffffffffffe301, 0xffffffffffffff9c
pop edi
lea edi, [ebx*8 - 0x3875172e]
xor al, 0xea
mov edi, ebx
call fcn.008df091
jecxz 0xb7e7d7
in eax, 0x5f
xchg edi, eax
sub byte [ecx + ebp*4 - 0xe], 0x8c
js 0xb7e813
clc
cmp al, byte fs:[ebp - 0x66d0e518]
stc
push cs
jecxz 0xb7e81b
fmul st(2)
pop ecx
pushal
xchg edx, eax
xor edi, dword [ecx]
mov eax, dword [0xd9abfa38]
push ecx
adc al, 0xc8
pop esi
jb 0xb7e810
sbb eax, 0x7ed85826
insb byte es:[edi], dx
std
pop ecx
mov edx, edi
cwde
mov byte [edx], dh
pop ecx
popfd
out dx, al
mov byte [eax - 0x2853d502], ah
pause
inc edx
inc ecx
sub ch, byte [edi + edx*8 + 0x414290f3]
popal
mov edi, 0x921e8803
xor al, 0xe7
or byte ss:[esi + 0x5c], 0xe8
dec esi
rol byte [edx], 1
inc edx
sbb al, 0xca
jge 0xb7e829
and edx, ecx
ror byte [ecx - 0x6a], 1
adc byte [edx + 0x74], bl
push esi
invalid
Function at 0x401570
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41649d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x45c
push ebx
mov ebx, ecx
mov dword [ebp - 0x34], vtable.std::_Func_impl_no_alloc_class__lambda_4ce9315b962bf53fa07d39b14ecdff22___int__struct_tagMODULEENTRY32W__.0
push esi
lea ecx, [ebp - 0x34]
push edi
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], edx
movq xmm0, qword [ebp - 0x40]
movq qword [ebp - 0x30], xmm0
mov esi, dword [eax + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], ecx
push 0x424
lea eax, [ebp - 0x464]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x468], 0x428
call fcn.00402e60
add esp, 0xc
push esi
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x40163e
cmp esi, 0xffffffff
je 0x40163e
lea eax, [ebp - 0x468]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x401637
mov edi, dword [sym.imp.KERNEL32.dll_Module32NextW]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x40167a
mov eax, dword [ecx]
lea edx, [ebp - 0x468]
push edx
call dword [eax + 8]
test eax, eax
je 0x401637
lea eax, [ebp - 0x468]
push eax
push esi
call edi
test eax, eax
jne 0x401612
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x40165d
mov edx, dword [ecx]
lea eax, [ebp - 0x34]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x10], 0
mov ecx, dword [ebx + 8]
xor eax, eax
pop edi
pop esi
pop ebx
cmp dword [ecx], eax
mov ecx, dword [ebp - 0xc]
sete al
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
call fcn.00401941
int3
Function at 0x4016d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x524
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
add ebx, 0x220
mov dword [esp + 0x20], ebx
mov edx, ebx
mov esi, dword [edi + 4]
movzx eax, word [edx]
lea edx, [edx + 2]
mov word [esi], ax
lea esi, [esi + 2]
test ax, ax
jne 0x4016f3
push 0x5c
push dword [edi + 4]
call fcn.00402b38
mov esi, eax
add esp, 8
test esi, esi
je 0x40189b
movups xmm0, xmmword [str.Script.pvf]
lea eax, [esp + 0x90]
push eax
movups xmmword [esi], xmm0
movq xmm0, qword [0x41cab4]
movq qword [esi + 0x10], xmm0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
test eax, eax
je 0x40189b
cmp eax, 0xffffffff
je 0x40189b
movups xmm0, xmmword [str.ImagePacks2]
movups xmmword [esi], xmm0
movq xmm0, qword [0x41cacc]
movq qword [esi + 0x10], xmm0
mov ax, word [0x41cad4]
mov word [esi + 0x18], ax
lea eax, [esp + 0x2e0]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
test eax, eax
je 0x40189b
cmp eax, 0xffffffff
je 0x40189b
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x40189b
push esi
call fcn.004019a7
add esp, 4
mov ebx, eax
push ebx
push esi
push 0
push dword [esp + 0x2c]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x401892
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x14], 4
push eax
push str.VarFileInfoTranslation
push ebx
call esi
cmp dword [esp + 0x10], 0
je 0x401892
mov ecx, dword [esp + 0x24]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04X_04XOriginalFilename
lea eax, [esp + 0x34]
push 0x32
push eax
call fcn.00401170
add esp, 0x14
mov dword [esp + 0x14], 8
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
push ebx
call esi
test eax, eax
je 0x401892
cmp dword [esp + 0x14], 0
je 0x401892
mov eax, dword [esp + 0x18]
mov ecx, str.DNF.exe
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40187e
test dx, dx
je 0x40187a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40187e
add eax, 4
add ecx, 4
test dx, dx
jne 0x401858
xor eax, eax
jmp 0x401883
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401892
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
mov eax, dword [eax + 8]
mov dword [ecx], eax
push ebx
call fcn.00401964
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x424690
Capabilities:
Extract resource via kernel32 functions

Disassembly:
invalid
jno 0x424613
add edi, dword [ebx + 0x56708ddc]
int3
je 0x424948
jne 0x424948
or dword [edi], 0x800000
push 0xbe4234
mov eax, dword [0x699a3fa0]
push dword [ebp - 0x90]
mov dword [esi + 0x18], 0x11153e70
call dword [fcn.0044a3a8]
jnp 0x424687
mov ch, 0x25
or bl, bh
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x4247da
pop edi
je 0x424b49
jne 0x424b49
push 0xab3d0c
push 0xa90c94
mov eax, dword [eax + 0xd]
adc ah, byte [ebp + 0xade31a4]
arpl word [edi + 0x53], bp
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x424af3
ret
push esi
jmp 0x4249f8
push ebp
mov ebp, esp
push 0x4246f6
ret
mov esi, eax
push 0x4248da
ret
push eax
je 0x424b6c
jne 0x424b6c
push 0xadff9c
push 0x10180274
cmp edi, 0x42d320
mov esi, dword [0x44a388]
mov edx, dword [0x100040f0]
push 0x1153d3f8
lea eax, [ecx - 1]
lea eax, [esi + 0x3a4]
imul eax, dword [esi + 0x1c]
aas
sbb al, 0x67
adc al, 0x5e
pop edi
pop ebx
pop ebp
ret
pop ebp
ret
pop ebx
je 0x424ab1
jne 0x424ab1
mov eax, dword [0x11540688]
push 0xbc830c
mov eax, 0x548a68
adc byte [esi], dl
arpl bp, cx
dec ebx
xchg ebx, eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.DLL_LockResource]
je 0x42496f
jne 0x42496f
mov eax, dword [0xf54b38]
mov eax, 0x10007ae0
mov dword [0x1129e9ac], edx
mov eax, 0x103698e4
mov dword [0x112aca4c], eax
mov byte [esi + 0x300], 0
push 0x10247cb0
adc dword [ecx + 0x63], ecx
mov byte [esi + ecx + 0xde], bl
jmp dword [0x106df55c]

Function at 0x4546bb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x51481c]
jne 0x4546c5
repz ret
jmp fcn.00457d54
Function at 0x45d839
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x51481c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004577c9
and dword [ebp - 0x14], 0
cmp dword [0x51657c], 0
mov dword [ebp - 0x18], eax
jne 0x45d8ec
push 0x402ab0
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x45d994
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x402aa4
push ebx
call edi
test eax, eax
je 0x45d994
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push 0x402a94
push ebx
mov dword [0x51657c], eax
call edi
push eax
call esi
push 0x402a80
push ebx
mov dword [0x516580], eax
call edi
push eax
call esi
push 0x402a64
push ebx
mov dword [0x516584], eax
call edi
push eax
call esi
mov dword [0x51658c], eax
test eax, eax
je 0x45d8ec
push 0x402a4c
push ebx
call edi
push eax
call esi
mov dword [0x516588], eax
mov eax, dword [0x516588]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x45d945
cmp dword [0x51658c], ecx
je 0x45d945
push eax
call esi
push dword [0x51658c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x45d945
test ebx, ebx
je 0x45d945
call edi
test eax, eax
je 0x45d93c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x45d93c
test byte [ebp - 8], 1
jne 0x45d945
or dword [ebp + 0x10], 0x200000
jmp 0x45d978
mov eax, dword [0x516580]
cmp eax, dword [ebp - 0x18]
je 0x45d978
push eax
call esi
test eax, eax
je 0x45d978
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x45d978
mov eax, dword [0x516584]
cmp eax, dword [ebp - 0x18]
je 0x45d978
push eax
call esi
test eax, eax
je 0x45d978
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x51657c]
call esi
test eax, eax
je 0x45d994
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x45d996
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004546bb
leave
ret
Function at 0x463420
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464ec0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x51481c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x18]
push 0x513f20
xor ebx, ebx
push eax
xor esi, esi
mov dword [ebp - 4], ebx
call fcn.004497b0
mov ecx, dword [ebp - 0x18]
add esp, 8
cmp dword [ecx - 0xc], ebx
je 0x4634f6
mov edi, dword [ebp + 8]
cmp ebx, 2
jge 0x4634f6
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x14]
push edx
push 0
xor eax, eax
push 2
test ebx, ebx
push 0
setne al
push 0
push 0
push ecx
mov dword [ebp - 0x14], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4634ed
mov esi, dword [ebp - 0x14]
mov ecx, esi
mov dword [ebp - 0x28], ecx
test edi, edi
jne 0x4634b9
lea eax, [edi + 0xd]
jmp 0x4634d9
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push 0x4019a4
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x28]
xor edx, edx
test eax, eax
sete dl
mov esi, edx
test ecx, ecx
je 0x4634ed
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x18]
inc ebx
jmp 0x463472
lea eax, [ecx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x463536
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463550
Capabilities:
Delete file
Get common file path
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464eeb
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x51481c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
xor ebx, ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], edi
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x230]
push ecx
push edx
push eax
mov byte [ebp - 4], 1
call fcn.00430e90
add esp, 0xc
cmp eax, edi
je 0x4636f8
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x22c]
je 0x4636f8
lea ecx, [ebp - 0x230]
push 0x4019d8
push ecx
call fcn.00431e20
add esp, 8
push 0x4019c8
push 0x4019b0
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, edi
je 0x4636f8
push esi
call eax
cmp eax, edi
je 0x46367d
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x46367d
push 0x206
lea eax, [ebp - 0x21a]
xor edx, edx
push edi
push eax
mov word [ebp - 0x21c], dx
call fcn.00454bd0
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
je 0x4636f8
lea edx, [ebp - 0x21c]
push edx
push edi
push edi
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
test eax, eax
je 0x4636f8
push 1
lea ecx, [ebp - 0x21c]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
test eax, eax
je 0x4636f8
push 0x4019a8
lea edx, [ebp - 0x220]
push esi
push edx
mov dword [ebp - 0x220], edi
call fcn.004567f8
add esp, 0xc
test eax, eax
jne 0x4636f8
mov eax, dword [ebp - 0x220]
cmp eax, edi
je 0x4636f8
mov ecx, dword [ebp - 0x22c]
push eax
mov eax, dword [ebp - 0x230]
sub ecx, eax
push ecx
push 1
push eax
call fcn.004566c0
mov edx, dword [ebp - 0x220]
push edx
call fcn.0045650d
mov eax, dword [ebp - 0x220]
mov esi, dword [ebp - 0x22c]
sub esi, dword [ebp - 0x230]
push eax
call fcn.0045631e
mov ecx, dword [ebp - 0x220]
xor ebx, ebx
cmp esi, eax
push ecx
sete bl
call fcn.00456116
add esp, 0x1c
mov eax, dword [ebp - 0x230]
cmp eax, edi
je 0x463723
push eax
call fcn.00454a31
add esp, 4
jmp 0x463723
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004546bb
mov esp, ebp
pop ebp
ret