joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e29f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], edx
mov ebx, eax
xor eax, eax
mov dword [esp + 4], eax
test ebx, ebx
je 0x4e2a98
mov eax, ebx
mov edx, dword [eax + 0x3c]
add edx, eax
mov eax, edx
mov esi, eax
mov edx, dword [esi + 0x78]
mov eax, ebx
call fcn.004e275c
mov esi, eax
mov ebp, dword [esi + 0x18]
dec ebp
test ebp, ebp
jb 0x4e2a98
inc ebp
xor edi, edi
mov edx, dword [esi + 0x20]
mov eax, ebx
call fcn.004e275c
mov eax, dword [eax + edi*4]
mov dword [esp + 8], eax
mov edx, dword [esp + 8]
mov eax, ebx
call fcn.004e275c
mov dword [esp + 0xc], eax
mov eax, dword [esp]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x4e2a94
mov edx, dword [esi + 0x24]
mov eax, ebx
call fcn.004e275c
movzx eax, word [eax + edi*2]
mov word [esp + 0x10], ax
mov edx, dword [esi + 0x1c]
mov eax, ebx
call fcn.004e275c
movzx edx, word [esp + 0x10]
mov eax, dword [eax + edx*4]
mov edx, eax
mov eax, ebx
call fcn.004e275c
mov dword [esp + 4], eax
inc edi
dec ebp
jne 0x4e2a30
mov eax, dword [esp + 4]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4e5a1c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor edx, edx
mov dword [esp], edx
lea edx, [eax + 0x250]
xor ecx, ecx
mov dword [edx], ecx
inc dword [esp]
add edx, 4
cmp dword [esp], 8
jb 0x4e5a2c
xor edx, edx
mov dword [esp], edx
jmp 0x4e5b09
mov ecx, dword [esp]
mov edx, dword [eax + 0x240]
shl ecx, 6
xor ebx, ebx
movzx esi, byte [edx + ecx]
xor edx, edx
jmp 0x4e5a97
lea edi, [edx + ecx]
mov ebp, dword [eax + 0x240]
inc edx
movzx edi, byte [ebp + edi]
xor edi, esi
mov ebp, dword [eax + 0x240]
or ebx, edi
lea edi, [edx + ecx]
inc edx
movzx edi, byte [ebp + edi]
xor edi, esi
mov ebp, dword [eax + 0x240]
or ebx, edi
lea edi, [edx + ecx]
inc edx
movzx edi, byte [ebp + edi]
xor edi, esi
mov ebp, dword [eax + 0x240]
or ebx, edi
lea edi, [edx + ecx]
movzx edi, byte [ebp + edi]
xor edi, esi
or ebx, edi
inc edx
cmp edx, 0x40
jb 0x4e5a97
test ebx, ebx
jne 0x4e5b06
mov ecx, dword [esp]
and ecx, 0x1f
mov edx, 1
shl edx, cl
mov ecx, dword [esp]
shr ecx, 5
or dword [eax + ecx*4 + 0x250], edx
inc dword [esp]
mov edx, dword [esp]
cmp edx, dword [eax + 0xcc]
jb 0x4e5a46
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ec088
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.0040bb80
mov edx, eax
mov eax, esi
test eax, eax
je 0x4ec0a0
mov eax, dword [eax - 4]
xor ecx, ecx
test eax, eax
jle 0x4ec0b2
imul ecx, ecx, 0x2b
movzx esi, byte [edx]
xor ecx, esi
inc edx
dec eax
jne 0x4ec0a6
mov eax, ecx
xor edx, edx
div dword [ebx + 0xc]
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4ec0c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov esi, eax
mov eax, ebp
test eax, eax
je 0x4ec0d1
mov eax, dword [eax - 4]
mov edi, eax
xor ebx, ebx
mov eax, ebp
call fcn.0040bb80
mov edx, eax
mov eax, edi
test eax, eax
jle 0x4ec0f6
mov ecx, ebx
shl ecx, 5
sub ecx, ebx
movzx ebx, byte [edx]
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4ec0e4
mov eax, ebx
xor edx, edx
div dword [esi + 0xc]
mov eax, edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4ec104
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov esi, eax
mov eax, ebp
test eax, eax
je 0x4ec115
mov eax, dword [eax - 4]
mov edi, eax
xor ebx, ebx
mov eax, ebp
call fcn.0040bb80
mov edx, eax
mov eax, edi
test eax, eax
jle 0x4ec13d
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
xor ecx, ebx
movzx ebx, byte [edx]
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4ec128
mov eax, ebx
xor edx, edx
div dword [esi + 0xc]
mov eax, edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ec734
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor esi, esi
mov edi, 0x12
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x48]
lea eax, [esi + 1]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx ebx, byte [eax + edx]
shl ebx, 0x10
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
shl eax, 0x18
add ebx, eax
lea eax, [esi + 2]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
shl eax, 8
add ebx, eax
lea eax, [esi + 3]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
add ebx, eax
xor dword [ecx], ebx
lea eax, [esi + 4]
xor edx, edx
div dword [ebp - 8]
mov esi, edx
add ecx, 4
dec edi
jne 0x4ec750
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edi, edi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x48]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.004ec384
pop ecx
mov eax, edi
add eax, eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*4 - 0x48], ecx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [edx + eax*4 - 0x44], ecx
inc edi
cmp edi, 9
jne 0x4ec7b1
mov edi, 4
mov eax, dword [ebp + 8]
lea ebx, [eax - 0x1048]
xor esi, esi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x48]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.004ec384
pop ecx
mov eax, esi
add eax, eax
mov edx, dword [ebp - 0xc]
mov dword [ebx + eax*4], edx
mov edx, dword [ebp - 0x10]
mov dword [ebx + eax*4 + 4], edx
inc esi
cmp esi, 0x80
jne 0x4ec7f7
add ebx, 0x400
dec edi
jne 0x4ec7f5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ec83c
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffff9c
push ebx
push esi
push edi
mov byte [ebp - 0x1051], cl
mov dword [ebp - 0x1050], edx
mov dword [ebp - 0x104c], eax
mov ebx, dword [ebp + 0x14]
lea esi, [ebp - 0x1060]
push esi
mov esi, 0x7f3454
lea edi, [ebp - 0x48]
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
mov esi, 0x7f349c
lea edi, [ebp - 0x1048]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
pop esi
mov edi, ebx
test edi, edi
je 0x4ec895
mov edi, dword [edi - 4]
push ebp
mov eax, ebx
call fcn.0040b7cc
mov edx, edi
call fcn.004ec734
pop ecx
mov ebx, dword [ebp - 0x104c]
cmp byte [ebp - 0x1051], 0
je 0x4ec8c9
lea eax, [ebp - 0x48]
mov dword [ebp - 0x1058], eax
mov dword [ebp - 0x105c], 1
jmp 0x4ec8dc
lea eax, [ebp - 4]
mov dword [ebp - 0x1058], eax
mov dword [ebp - 0x105c], 0xffffffff
mov edi, dword [ebp - 0x1050]
shr edi, 3
dec edi
test edi, edi
jl 0x4ec9f1
inc edi
cmp dword [ebp + 0x10], 0
jne 0x4ec8f9
cmp dword [ebp + 0xc], 0
je 0x4ec978
mov dword [esi], 7
lea eax, [ebp + 0xc]
add eax, dword [esi]
movzx eax, byte [eax]
inc eax
and al, 0xff
lea edx, [ebp + 0xc]
add edx, dword [esi]
mov byte [edx], al
lea eax, [ebp + 0xc]
add eax, dword [esi]
cmp byte [eax], 0
jne 0x4ec924
dec dword [esi]
cmp dword [esi], 0xffffffff
jne 0x4ec901
mov eax, dword [ebp + 0xc]
call fcn.004ec358
mov dword [esi], eax
lea eax, [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
call fcn.004ec358
mov dword [ebp - 0x1064], eax
push ebp
mov eax, dword [ebp - 0x105c]
push eax
lea edx, [ebp - 0x1064]
mov eax, esi
mov ecx, dword [ebp - 0x1058]
call fcn.004ec384
pop ecx
mov eax, dword [esi]
call fcn.004ec358
xor dword [ebx], eax
mov eax, dword [ebp - 0x1064]
call fcn.004ec358
lea edx, [ebx + 4]
xor dword [edx], eax
jmp 0x4ec9e7
cmp byte [ebp + 8], 0
jne 0x4ec9ce
mov eax, dword [ebx]
call fcn.004ec358
mov dword [esi], eax
lea eax, [ebx + 4]
mov eax, dword [eax]
call fcn.004ec358
mov dword [ebp - 0x1064], eax
push ebp
mov eax, dword [ebp - 0x105c]
push eax
lea edx, [ebp - 0x1064]
mov eax, esi
mov ecx, dword [ebp - 0x1058]
call fcn.004ec384
pop ecx
mov eax, dword [esi]
call fcn.004ec358
mov dword [ebx], eax
mov eax, dword [ebp - 0x1064]
call fcn.004ec358
lea edx, [ebx + 4]
mov dword [edx], eax
jmp 0x4ec9e7
push ebp
mov eax, dword [ebp - 0x105c]
push eax
mov edx, ebx
lea eax, [ebx + 4]
mov ecx, dword [ebp - 0x1058]
call fcn.004ec384
pop ecx
add ebx, 8
dec edi
jne 0x4ec8ef
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4f45e4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4f47a3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040b1e4
mov eax, dword [ebp - 4]
call fcn.004f3ec4
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4f4636
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040bfa0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004f5568
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4f4717
xor eax, eax
push ebp
push 0x4f4710
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004f41d0
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004f47d8
test al, al
je 0x4f46ec
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040af44
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4f46ec
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040bb80
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004f4130
test al, al
je 0x4f46e6
mov eax, dword [ebp - 8]
call fcn.0040bb80
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040bbe0
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004f45e4
dec ebx
cmp ebx, 0xffffffff
jne 0x4f4695
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f4717
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004f41d0
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
cmp byte [0x806a78], 0
je 0x4f4757
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.0040bb80
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004f41bc
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004f4130
mov ebx, eax
jmp 0x4f477e
mov eax, dword [ebp - 4]
call fcn.0040bb80
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004f41bc
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004f4130
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f47aa
lea eax, [ebp - 0x3c]
call fcn.0040adac
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040ae0c
pop eax
jmp eax
Function at 0x4f5444
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.004f3edc
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040bb80
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.004f4130
test al, al
jne 0x4f54ac
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x7f61b0]
mov dl, 1
mov eax, dword [0x4f2aec]
call fcn.00432844
call fcn.0040a458
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4f54b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040bb80
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.004f4130
test al, al
jne 0x4f5519
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x7f63d8]
mov dl, 1
mov eax, dword [0x4f2aec]
call fcn.00432844
call fcn.0040a458
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004f3f44
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f5b30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f5c5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.004f41d0
xor eax, eax
push ebp
push 0x4f5c35
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004f47d8
test al, al
je 0x4f5c17
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004f5a08
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040af44
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x4f5c17
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040bb80
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004f4130
test al, al
je 0x4f5c13
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040bb80
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040bbe0
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004f5a08
pop ecx
inc edi
dec ebx
jne 0x4f5bbb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f5c3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.004f41d0
pop eax
jmp eax
Function at 0x4f5c6c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4f5ec4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.004f41d0
xor eax, eax
push ebp
push 0x4f5e98
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004f47d8
test al, al
je 0x4f5e7a
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040af44
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x4f5e7a
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040bb80
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004f4130
test al, al
je 0x4f5e6e
mov eax, dword [ebp - 4]
call fcn.0040bb80
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040bbe0
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004f5568
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4f5e6e
xor eax, eax
push ebp
push 0x4f5e67
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.004f41d0
xor eax, eax
push ebp
push 0x4f5e47
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040bb80
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040bbe0
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004f41d4
mov eax, dword [ebp - 4]
call fcn.0040bb80
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040bbe0
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004f5568
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4f5e22
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004f5b30
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004f5c6c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f5e29
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x4f5cf7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f5e9f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.004f41d0
pop eax
jmp eax
Function at 0x519a30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
test esi, esi
je 0x519a42
test edi, edi
jne 0x519a56
mov ecx, 0x3e3
mov edx, 0x519ab4
mov eax, 0x519b04
call fcn.0040abf8
push 0x40
push 0x1000
push 0x20
push 0
call sub.kernel32.dll_VirtualAlloc
mov ebp, eax
mov eax, dword [ebx]
xor ecx, ecx
mov edx, esi
call fcn.00519b28
mov esi, eax
mov eax, dword [ebx]
xor ecx, ecx
mov edx, edi
call fcn.00519b28
mov edi, eax
push edi
mov ecx, ebp
mov edx, esi
mov eax, ebx
call fcn.00519bf4
test al, al
jne 0x519aa1
push 0x8000
push 0x20
push ebp
call sub.kernel32.dll_VirtualFree
xor ebp, ebp
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x7c47fc
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x7c48f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0xc], 1
push 0
push 5
call fcn.004e3804
push 0
push 3
call fcn.004e3804
mov eax, dword [ebx + 0x1c]
call fcn.00408fac
mov eax, dword [ebx + 0x18]
call fcn.00408fac
mov eax, dword [ebx + 8]
call fcn.00408fac
mov eax, dword [ebx + 0x10]
call fcn.00408fac
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00407818
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0042b940
mov eax, dword [ebp - 8]
call fcn.0040bb80
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x7c48d7
inc eax
mov dword [ebp - 4], eax
xor esi, esi
lea ecx, [ebp - 0x10]
mov eax, dword [ebx + 0x88]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
mov dl, 1
call fcn.0042b7a4
test al, al
je 0x7c48d1
lea ecx, [ebp - 0x18]
mov eax, dword [ebx + 0x88]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x18]
call fcn.0040bb80
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.0040bbe0
mov eax, dword [ebp - 0x14]
call fcn.0042b8e4
inc esi
dec dword [ebp - 4]
jne 0x7c4889
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7c48fb
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.0040ae0c
pop eax
jmp eax
Function at 0x7c4c68
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7c4e27
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 1
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.0040bb80
push eax
call fcn.004e37a0
mov esi, eax
cmp esi, 0xffffffff
je 0x7c4e0a
mov ecx, esi
mov dl, 1
mov eax, dword [0x495224]
call fcn.004bb848
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x492124]
call fcn.004b946c
mov ebx, eax
call sub.kernel32.dll_GetCurrentThreadId
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.0042af4c
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [0x806b6c]
mov edx, dword [eax + 0x4c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [0x806b6c]
mov edx, dword [eax + 0x44]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, 0x7c4e44
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x806b6c]
mov eax, dword [eax + 0x5c]
xor ecx, ecx
mov edx, 0x7c4e5c
mov edi, dword [eax]
call dword [edi + 0x164]
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov eax, dword [0x806b6c]
call fcn.007c1a94
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea edx, [ebp - 0x18]
mov eax, dword [0x806b6c]
movzx eax, byte [eax + 0x90]
call fcn.0042af30
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [0x806b6c]
mov edx, dword [eax + 0x74]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov edx, 0x7c4e70
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x806b6c]
mov eax, dword [eax + 0x5c]
xor ecx, ecx
mov edx, 0x7c4e80
mov edi, dword [eax]
call dword [edi + 0x164]
mov edx, dword [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x20]
push eax
mov eax, dword [0x806b6c]
mov eax, dword [eax + 0x5c]
xor ecx, ecx
mov edx, 0x7c4e94
mov edi, dword [eax]
call dword [edi + 0x164]
mov edx, dword [ebp - 0x20]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x3c]
call fcn.0043a4a0
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x8c]
mov eax, ebx
call fcn.00408fac
mov eax, dword [ebp - 8]
call fcn.00408fac
push esi
call sub.kernel32.dll_CloseHandle
push 2
mov eax, dword [ebp - 4]
call fcn.0040bb80
push eax
call sub.kernel32.dll_SetFileAttributesW
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7c4e2e
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.0040ae0c
pop eax
jmp eax