joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ea870
Capabilities:
Get memory capacity

Disassembly:
push 0xffffffffffffffff
push 0x555cc7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
xor ebx, ebx
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], ebx
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esp + 0xc]
mov dword [esp + 0x48], 1
call sub.MFC42.DLL_CString::CString_4
mov eax, 0x20
xor ecx, ecx
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x4c], 2
lea edi, [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
sub esp, 8
fild qword [esp + 0x20]
lea edx, [esp + 0x14]
fmul qword [0x560318]
fstp qword [esp]
push str.Total_Physical_Memory:__9.0f_KB_r_n
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
sub esp, 8
fild qword [esp + 0x20]
lea edx, [esp + 0x14]
fmul qword [0x560318]
fstp qword [esp]
push str.Available_Physical_Memory:__9.0f_KB_r_n
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0xc]
fild qword [esp + 0x18]
fmul qword [0x560318]
fstp qword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
push str.Total_Virtual_Memory:__9.0f_KB_r_n
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea edx, [esp + 0xc]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42.DLL_CString::operator_2
mov esi, dword [esp + 0x50]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 0x14], 1
mov byte [esp + 0x48], 1
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x40]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x4eb7c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x555df8
push eax
mov dword fs:[0], esp
sub esp, 0x18
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, ecx
mov ecx, dword [esi + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [edi + 0x74]
lea edx, [esp + 0x10]
push edx
call sub.MFC42.DLL_CWnd::ScreenToClient
cmp dword [esp + 0x38], 2
jne 0x4eb8bb
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::CString_4
lea eax, [esp + 0x34]
mov ecx, esi
push eax
mov dword [esp + 0x2c], 0
call sub.MFC42.DLL_CWnd::GetWindowTextA
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx - 8]
test eax, eax
je 0x4eb8aa
mov eax, dword [edi + 0x74]
push ebx
mov edx, dword [eax + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call sub.MFC42.DLL_CDC::FromHandle
mov esi, eax
mov eax, dword [edi + 0x74]
push 0
push 0
mov eax, dword [eax + 0x20]
push 0x31
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [esi]
push eax
call sub.MFC42.DLL_CGdiObject::FromHandle
push eax
mov ecx, esi
call dword [ebx + 0x30]
mov ebx, eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0xc]
mov ecx, dword [eax - 8]
push edx
push ecx
push eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push ebx
lea eax, [edx + ecx - 1]
mov ecx, esi
mov dword [esp + 0x24], eax
mov edx, dword [esi]
call dword [edx + 0x30]
mov edi, dword [edi + 0x74]
mov eax, dword [esi + 4]
push eax
mov ecx, dword [edi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop ebx
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
mov edx, eax
pop edi
pop esi
mov dword [edx], ecx
mov ecx, dword [esp + 0xc]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x14]
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
Function at 0x4ef520
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x556278
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, ecx
test esi, esi
push edi
jne 0x4ef546
xor eax, eax
jmp 0x4ef549
mov eax, dword [esi + 0x20]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test al, 0x20
jne 0x4ef56b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
mov eax, dword [esi + 0x20]
push 0
push 0
push 0x418
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x10]
or edi, 0xffffffff
push ecx
mov ebx, eax
mov dword [esi + 0xbc], edi
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov dword [0x5bc60c], edi
xor edi, edi
test ebx, ebx
jle 0x4ef65e
mov ebp, dword [sym.imp.USER32.dll_PtInRect]
push edi
mov ecx, esi
call fcn.004ee860
test eax, eax
jne 0x4ef5ea
mov edx, dword [esi]
lea eax, [esp + 0x18]
push eax
push edi
mov ecx, esi
call dword [edx + 0xe8]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
call ebp
test eax, eax
jne 0x4ef5f1
inc edi
cmp edi, ebx
jl 0x4ef5b9
jmp 0x4ef655
push edi
mov ecx, esi
call fcn.004f04c0
test eax, eax
jne 0x4ef610
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
push esi
lea ecx, [esp + 0x2c]
mov dword [0x5bc60c], edi
call sub.MFC42.DLL_CClientDC::CClientDC
xor ecx, ecx
xor eax, eax
push ecx
mov edx, 2
push ecx
push ecx
mov edi, edx
push eax
mov dword [esp + 0x54], ecx
push ecx
push edi
lea ecx, [esp + 0x30]
push edx
push ecx
lea ecx, [esp + 0x48]
call sub.MFC42.DLL_CDC::DrawDragRect
lea ecx, [esp + 0x28]
mov dword [esp + 0x44], 0xffffffff
call fcn.005482c8
mov eax, dword [0x5bc60c]
test eax, eax
jge 0x4ef673
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
mov edi, dword [sym.imp.USER32.dll_CreateCursor]
push 0x560be0
push 0x560b60
push 0x20
push 0x20
push 2
push 4
push 0
call edi
push 0x560ce0
push 0x560c60
push 0x20
push 0x20
push 2
push 4
push 0
mov dword [0x5c61ac], eax
call edi
mov dword [0x5c61b0], eax
mov edx, dword [esi + 0x20]
push edx
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov ecx, esi
call sub.MFC42.DLL_CWnd::SetFocus
mov eax, dword [0x5c61ac]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x5c61a8], eax
lea ecx, [esp + 0x10]
mov eax, 1
push ecx
mov dword [0x5c61b8], eax
mov dword [0x5c61b4], eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0x5c61a0
push esi
mov ecx, esi
mov dword [0x5c61a0], edx
mov dword [0x5c61a4], eax
mov dword [0x5c61bc], esi
call fcn.004f0380
mov ecx, dword [esp + 0x3c]
mov eax, dword [0x5c61b4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x4f2370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x556527
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
lea ecx, [esp + 4]
mov dword [esp + 0xc], 0
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 1
call fcn.004d3b90
push SysStringLen
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 2
call fcn.004d3c30
push 0x20019
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x5c61cc
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x24]
call fcn.004d41e0
test eax, eax
je 0x4f247f
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x5bf148
call sub.MFC42.DLL_CString::CString_2
push ecx
mov byte [esp + 0x38], 3
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Version
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
mov byte [esp + 0x3c], 2
call fcn.004d4610
push 0x5c61d0
lea ecx, [esp + 8]
mov byte [esp + 0x34], 4
call sub.MFC42.DLL_CString::operator
push 0x58645c
push 0x574f5c
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::Replace
push 0x5bf144
lea ecx, [esp + 8]
call fcn.00548178
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_2
push 0x5bf144
lea ecx, [esp + 8]
call fcn.00548178
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString
mov esi, dword [esp + 0x38]
lea edx, [esp + 4]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 0xc], 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.004d3bc0
lea ecx, [esp + 4]
mov byte [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x30
ret 4

Function at 0x4f2b00
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x55668b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
pop edi
je 0x4f2b8e
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_2
push str.RocscienceUpdateTemp
lea ecx, [esp + 4]
mov dword [esp + 0x114], 0
call fcn.00548178
lea edx, [esp]
push edx
call fcn.004f2bb0
add esp, 4
lea ecx, [esp]
mov dword [esp + 0x110], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
add esp, 0x114
ret
Function at 0x4f2bb0
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x5566b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [esp + 0x3c]
push 0x5bf18c
lea ecx, [esp + 4]
push eax
push ecx
mov dword [esp + 0x40], 0
call sub.MFC42.DLL_operator_3
mov edx, dword [esp]
push 0
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 1
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
mov dword [esp + 0xc], eax
je 0x4f2cb7
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__unlink]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push edi
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileFind::FindNextFileA
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x4f2cac
mov eax, dword [esp + 0x1c]
push 0x10
lea ecx, [esp + 0x20]
call dword [eax + 0x40]
test eax, eax
je 0x4f2c8d
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileFind::GetFilePath
lea edx, [esp + 0x48]
mov byte [esp + 0x40], 2
push edx
call fcn.004f2bb0
add esp, 4
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
call sub.MFC42.DLL_CFileFind::GetFilePath
mov eax, dword [eax]
push eax
call esi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
mov byte [esp + 0x40], 1
lea ecx, [esp + 0x48]
jmp 0x4f2ca7
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileFind::GetFilePath
mov eax, dword [eax]
push eax
call ebp
add esp, 4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
test edi, edi
jne 0x4f2c1d
pop edi
pop esi
pop ebp
lea ecx, [esp]
mov byte [esp + 0x34], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0xffffffff
call fcn.00548f58
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x4f4310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
xor al, al
mov byte [esp + 5], 0x10
mov byte [esp + 4], al
mov byte [esp + 3], al
mov eax, dword [esp + 0x28]
mov byte [esp + 6], 0x18
and eax, 0xffff
mov byte [esp + 7], 0x20
mov ecx, eax
mov byte [esp + 8], 0x28
and ecx, 0x1f
mov byte [esp + 9], 0x30
mov byte [esp + 0xa], 0x38
mov byte [esp + 0xb], 0x40
mov byte [esp + 0xc], 0x48
mov byte [esp + 0xd], 0x50
mov byte [esp + 0xe], 0x58
mov byte [esp + 0xf], 0x60
mov byte [esp + 0x10], 0x68
mov byte [esp + 0x11], 0x70
mov byte [esp + 0x12], 0x78
mov byte [esp + 0x13], 0x80
mov byte [esp + 0x14], 0x88
mov byte [esp + 0x15], 0x90
mov byte [esp + 0x16], 0x98
mov byte [esp + 0x17], 0xa0
mov byte [esp + 0x18], 0xa8
mov byte [esp + 0x19], 0xb0
mov byte [esp + 0x1a], 0xb8
mov byte [esp + 0x1b], 0xc0
mov byte [esp + 0x1c], 0xc8
mov byte [esp + 0x1d], 0xd0
mov byte [esp + 0x1e], 0xd8
mov byte [esp + 0x1f], 0xe0
mov byte [esp + 0x20], 0xe8
mov byte [esp + 0x21], 0xf0
mov byte [esp + 0x22], 0xf8
mov byte [esp + 0x23], 0xff
mov dl, byte [esp + ecx + 4]
mov ecx, eax
shr ecx, 5
shr eax, 0xa
and ecx, 0x1f
and eax, 0x1f
mov byte [esp], dl
mov dl, byte [esp + ecx + 4]
mov al, byte [esp + eax + 4]
mov byte [esp + 1], dl
mov byte [esp + 2], al
mov eax, dword [esp]
add esp, 0x24
ret
Function at 0x4f5660
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov dword [edi + 4], ebx
call fcn.004f6d40
push 0x54
push edi
mov dword [esp + 0x18], eax
call fcn.004f6cd0
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x4f56a4
push edi
call fcn.004f6d50
mov eax, dword [edi]
push edi
mov dword [eax + 0x14], 0x36
mov ecx, dword [edi]
mov dword [ecx + 0x18], ebx
mov edx, dword [edi]
call dword [edx]
add esp, 8
mov dword [esi], fcn.004f57a0
mov dword [esi + 4], fcn.004f58f0
mov dword [esi + 8], fcn.004f59a0
mov dword [esi + 0xc], fcn.004f5a50
mov dword [esi + 0x10], 0x4f5b00
mov dword [esi + 0x14], 0x4f5b70
mov dword [esi + 0x18], 0x4f5be0
mov dword [esi + 0x1c], 0x4f5d60
mov dword [esi + 0x20], 0x4f5f50
mov dword [esi + 0x24], fcn.004f6140
mov dword [esi + 0x28], 0x4f6240
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 0xc]
mov ecx, 2
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x40]
mov dword [eax - 8], ebx
mov dword [eax], ebx
sub eax, 4
dec ecx
jne 0x4f5706
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
cmp eax, ebx
je 0x4f5798
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
push edx
push str._ld_c
push eax
mov byte [esp + 0x24], 0x78
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x4f5798
mov al, byte [esp + 0x14]
cmp al, 0x6d
je 0x4f5761
cmp al, 0x4d
jne 0x4f5785
mov eax, dword [esp + 0xc]
pop edi
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esi + 0x2c], eax
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esp + 0xc]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4fc66d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ecx, dword [esp + 0x18]
mov ebp, esp
sub esp, 0xcd4
mov dword [ecx], 0
push ebx
push esi
mov eax, dword [ebp + 0x10]
push edi
cmp eax, 1
mov dword [ebp - 8], 0xc30
je 0x4fc6a1
cmp eax, 2
je 0x4fc6e5
mov eax, 0xe
jmp 0x4fc8a5
push 0
mov esi, dword [ebp + 8]
push esi
call sub.MSVCRT.dll__access
add esp, 8
cmp eax, 0xffffffff
jne 0x4fc7d7
test byte [ebp + 0xc], 8
je 0x4fc8a0
mov eax, dword [ebp + 0xc]
and eax, 7
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push esi
call fcn.00500949
cmp eax, 1
je 0x4fc7d7
jmp 0x4fc8a5
xor edi, edi
mov esi, dword [ebp + 8]
mov al, byte [edi + esi]
test al, al
je 0x4fc709
movsx eax, al
push eax
inc edi
call sub.MSVCRT.dll_toupper
add esp, 4
add al, 7
mov byte [ebp + edi - 0x41], al
cmp edi, 0x32
jl 0x4fc6ea
push str.softwareclasses_vdsp
lea eax, [ebp - 0xa4]
mov byte [ebp + edi - 0x40], 0
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp byte [esi], 0x3a
jne 0x4fc75c
xor eax, eax
cmp byte [esi + 4], 0x3a
je 0x4fc742
mov cl, byte [eax + esi + 4]
inc eax
cmp byte [eax + esi + 4], 0x3a
mov byte [ebp + eax - 0xa5], cl
jne 0x4fc72f
mov byte [ebp + eax - 0xa4], 0
add eax, esi
lea ecx, [ebp - 0x40]
add eax, 5
push eax
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 4]
lea ecx, [ebp - 0xa4]
push eax
push ecx
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4fc7af
lea eax, [ebp - 8]
lea ecx, [ebp - 0xcd4]
push eax
lea edx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0x40]
push edx
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4fc7af
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4fc7d7
mov eax, 0x2c
jmp 0x4fc8a5
test byte [ebp + 0xc], 8
je 0x4fc897
mov eax, dword [ebp + 0xc]
and eax, 7
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push esi
call fcn.00500949
cmp eax, 1
jne 0x4fc8a5
push 0x1ae
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x4fc7f4
mov eax, 0x10
jmp 0x4fc8a5
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
push 0
push esi
push ebx
call fcn.005008fc
add esp, 0xc
cmp dword [ebp + 0x10], 3
jne 0x4fc813
push 0x11
jmp 0x4fc81f
cmp dword [ebp + 0x10], 4
jne 0x4fc81d
push 0x1a
jmp 0x4fc81f
push 0
push dword [ebp + 0x14]
lea ecx, [ebx + 0x104]
push ecx
call fcn.005008fc
add esp, 0xc
xor ecx, ecx
mov eax, dword [ebp + 0x10]
mov byte [ebx + 0x181], cl
mov edx, dword [ebp + 0xc]
mov dword [ebx + 0x182], ecx
push edi
mov dword [ebx + 0x100], eax
mov dword [ebx + 0x186], ecx
mov dword [ebx + 0x1a6], ecx
mov dword [ebx + 0x1a2], ecx
mov dword [ebx + 0x1aa], edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 0xcd4]
push eax
push edi
call fcn.004fc8ae
add esp, 8
mov esi, eax
cmp esi, 1
je 0x4fc88b
push edi
call fcn.004fdf4b
mov eax, esi
jmp 0x4fc8a5
mov ecx, dword [ebp + 0x18]
mov eax, 1
mov dword [ecx], edi
jmp 0x4fc8a5
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x500fc0
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret

Function at 0x50105c
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ecx, dword [esp + 0xc]
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov word [ebp - 0x16], ax
push esi
mov word [ebp - 0x12], dx
mov ecx, dword [ecx + 8]
mov word [ebp - 0x18], cx
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov word [ebp - 0x10], ax
mov ecx, dword [ecx + 8]
mov word [ebp - 0xe], dx
lea eax, [ebp - 8]
mov word [ebp - 0xc], cx
push eax
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
xor eax, eax
push eax
push eax
push 3
push eax
push eax
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, eax
mov eax, 0
je 0x5010dc
lea eax, [ebp - 8]
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 1
sbb eax, eax
inc eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5011c8
Capabilities:
Delete file

Disassembly:
push 0
push dword [esp + 8]
call fcn.00500fb1
add esp, 8
test eax, eax
mov eax, 0xf
je 0x5011f5
push dword [esp + 4]
call sub.MSVCRT.dll_remove
add esp, 4
cmp eax, 1
sbb eax, eax
and al, 0xf7
add eax, 0xa
ret 4
Function at 0x50d266
Capabilities:
Encrypt data using speck

Disassembly:
retf
jb 0x50400b
push esi
pop esi
mov eax, dword [esi + 4]
mov eax, dword [ebp + eax]
mov ebx, dword [esi + 8]
mov eax, dword [eax]
lea esi, [esi + 0xc]
cmp ch, ch
jno 0x522405
jo 0x503fd5
mov ecx, 0x800fa93e
sub ah, ah
add dword [eax], eax
jo 0x522405
jne 0x51aedf
je 0x503fe6
xlatb
push ebp
shr edx, 0x40
mov edx, dword [esp + 8]
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, eax
mov eax, ecx
dec ecx
or ch, ch
stc
jb 0x50d284
sar dl, 0xf
sub byte [esi], 0x50
add al, byte [eax]
jb 0x5322b8
add eax, 0xff8166fc
sbb eax, dword [eax]
and dword [ebp + ebx], eax
jb 0x51792d
jmp dword [esi]
mov byte [edx], al
inc edx
shr ax, 0x40
mov eax, ecx
dec ecx
test eax, eax
jb 0x503fb5
xchg si, cx
xchg cx, si
jne 0x5322cd
je 0x52853c
lahf
jmp 0x528570
pop esi
mov bl, bl
pop ebp
ret
cmp dword [ebp + 0x7000002d], 0x41d64e04
or ch, ch
test eax, eax
jb 0x503f83
je 0x52853c
jne 0x5322cd
neg bl
mov al, byte [esi]
inc esi
ja 0x528519
jbe 0x5322dc
cmp edi, eax
mov esp, ecx
jbe 0x528519
invalid
Function at 0x52190e
Capabilities:
Packed with generic packer

Disassembly:
cmp al, 0x43
jne 0x531870
je 0x50bd68
push ebx
daa
rol dword [edx], cl
cmp edi, edi
cmp byte [esi + 1], 0
jne 0x531870
je 0x50bd7a
cpuid
add al, 0xc3
xor eax, eax
jb 0x52e783
pop edi
shl ax, 0x20
pop esi
pop ebx
pop ebp
js 0x531869
jns 0x50bd94
sub ecx, dword es:[edi]
mov edi, ecx
pop edx
add al, byte [eax]
jns 0x531869
ficomp dword [edx + 0x531d76c3]
jmp dword [esi]
add dl, 0x30
push 0x50af29
ret
mov eax, dword [esi + 4]
xchg dh, cl
xchg cl, dh
call fcn.00526a55
mov esi, dword [ebp + 8]
xor edi, edi
jb 0x527674
xchg ebx, eax
xchg ebx, eax
mov al, byte [esi]
push eax
call fcn.00529bd8
add esp, 4
cmp al, 0x50
jne 0x53236b
je 0x51b02b
jp 0x51b061
jo 0x51b05d
xor eax, eax
jb 0x52767d
ror byte [edi], 0x82
dec edx
mov byte [eax], 0
xchg ebp, eax
xchg ebp, eax
pop edi
pop esi
mov di, di
ja 0x532366
jbe 0x51b046
cpuid
ret
jbe 0x532366
xor al, 0xbd
xchg edi, eax
add dword [eax], eax
push edx
pop edx
push ebp
mov bp, bp
mov ebp, esp
lea ebx, [ebx]
push ebx
xor bx, bx
jb 0x52765c
jmp 0x521924
push esi
jmp 0x521927
push edi
ja 0x51b003
jbe 0x521933
pop ds
xchg ebx, eax
jbe 0x51b003
fnstenv [edi + ecx - 0x1a5907f]
push dword [eax + 4]
or eax, 0xf20b43a
and byte [ebx + 0x5a], 0xfe
inc dword [edx - 0x643ca25d]
adc dl, byte [ebp - 0x77]
push ebp
mov ebp, esp
sub esp, 0xc
jmp dword [esi]
mov ecx, 0xefc16626
inc eax
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [ebp + eax]
jne 0x52e770
je 0x527677
test byte [ebp - 0x69], dh
je 0x52e770
invalid
lea esi, [esi + 0xc]
add dword [ebx], eax
cmp cl, bl
ja 0x519fff
jbe 0x52e786
sal byte [edx], 1
aad 0xf
xchg byte [ebx - 0x48], dh
invalid
jbe 0x519fff
ret
pop ebx
pop ebp
ret
add eax, 0
cmp al, 0x49
jne 0x50bd5a
je 0x53237d
mov ebx, 0xc03113c2
xor eax, eax
jb 0x52e779
call fcn.0050bd48
and byte [esi], 0xc1
call 0xc5289d3
js 0x51888e
jns 0x53239e
dec esi
xor al, 0x66
jns 0x51888e
or byte [0x8b0f098d], 0x26
mov edx, 0x8966fffe
ror byte [ebp - 0x77f0f78a], 0x23
or eax, 0x368dffff
jns 0x5323c0
lcall 0xff0d, 0x17890f3b
push dword [esi + ebp*4]
jns 0x5230dd
xor al, 0xae
cmp cx, cx
cmp dl, 9
jbe 0x519ae5
ja 0x5323d9
ja 0x532435
and ch, byte [eax - 0x28]
lcall 0x2561, 0xdac30051
invalid
push 0x519ad8
ret
les ecx, [eax]
add byte [eax], al
add byte [eax - 0x7af0a025], cl
push edi
and ch, bh
jmp dword [esi - 0x77]