joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475fc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x6eee0c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x476006
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
test eax, eax
je 0x47600c
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x476020
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x6eee0c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x476091
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
test eax, eax
jne 0x476082
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, 1
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x476560
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69aefb
mov eax, dword fs:[0]
push eax
sub esp, 0x180
mov eax, dword [0x75868c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x2c]
push eax
push str.KeyMCDW2
call fcn.00476020
add esp, 8
test eax, eax
je 0x4765b4
lea eax, [ebp - 0x2c]
push eax
push str.KeyMCDW3
call fcn.00476020
add esp, 8
call fcn.00475f50
test eax, eax
je 0x47674f
push 0x280
mov dword [ebp - 0x2c], 4
call fcn.00653415
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x47674f
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [ebp - 0x2c]
push eax
push ebx
call esi
cmp eax, 0x6f
jne 0x476606
push dword [ebp - 0x2c]
call fcn.00653415
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x47674f
push 1
lea ecx, [ebp - 0x18c]
call fcn.00478210
push 1
lea ecx, [ebp - 0xdc]
mov dword [ebp - 4], 0
call fcn.00478210
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push ebx
call esi
test eax, eax
jne 0x4766c0
mov esi, ebx
nop dword [eax]
mov eax, dword [esi]
test eax, eax
jne 0x4766ba
movzx eax, byte [esi + 0x194]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004783b0
movzx eax, byte [esi + 0x195]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004783b0
movzx eax, byte [esi + 0x196]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004783b0
movzx eax, byte [esi + 0x197]
lea ecx, [ebp - 0xcc]
push eax
call fcn.004783b0
movzx eax, byte [esi + 0x198]
lea ecx, [ebp - 0xcc]
push eax
call fcn.004783b0
movzx eax, byte [esi + 0x199]
lea ecx, [ebp - 0xcc]
push eax
call fcn.004783b0
mov eax, dword [esi]
mov esi, eax
test eax, eax
jne 0x476640
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x174]
call fcn.00479a50
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00653036
add esp, 4
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.004787b0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xc4]
call fcn.00479a50
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
call fcn.00653036
add esp, 4
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.004787b0
push edi
push str.KeyMCDW2
call fcn.00475fc0
push esi
push str.KeyMCDW3
call fcn.00475fc0
push ebx
call fcn.006530f3
add esp, 0x14
lea ecx, [ebp - 0xdc]
call fcn.00476770
lea ecx, [ebp - 0x18c]
call fcn.00476770
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00617a25
mov esp, ebp
pop ebp
ret
Function at 0x476840
Capabilities:
Contain obfuscated stackstrings
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x75868c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x11
mov dword [ebp - 0x28], 4
call fcn.00653415
push 0x280
mov ebx, eax
call fcn.00653415
mov esi, eax
add esp, 8
test esi, esi
je 0x47692d
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x47689e
push dword [ebp - 0x28]
call fcn.00653415
mov esi, eax
add esp, 4
test esi, esi
je 0x47692d
movaps xmm0, xmmword [str._02X:_02X:_02X:_55555555555555559999999999999999]
lea eax, [ebp - 0x28]
push eax
push esi
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x3a583230
mov dword [ebp - 0x10], 0x58323025
mov dword [ebp - 0xc], 0x3230253a
mov word [ebp - 8], 0x58
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x476924
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
call fcn.004751b0
add esp, 0x20
mov eax, ebx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00617a25
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.006530f3
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 0x6eed93
pop esi
xor ecx, ebp
pop ebx
call fcn.00617a25
mov esp, ebp
pop ebp
ret 4

Function at 0x47a9a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69b2f0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x75868c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00617a38
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.006157dc
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48ebe0
Capabilities:
Create directory

Disassembly:
jmp 0x4b2a15
push ebp
test ebx, esp
xor ah, ch
mov ebp, esp
push 0xffffffffffffffff
push 0x8e7467
movzx eax, ax
bts eax, esp
mov eax, dword fs:[0]
stc
cmp ah, 0x11
clc
push eax
rol ah, 0x93
nop
clc
sub esp, 0x10
push ebx
bsr bx, cx
jmp loc.008d24ee
Function at 0x490261
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
sar ax, cl
lahf
mov ebp, esp
inc dh
rdtsc
sub esp, 8
cmova edx, eax
setno dl
mov eax, ecx
jmp loc.008e98d3

Function at 0x4907b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004907c0

Function at 0x4907c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x20], al
lea ecx, [edi + 0x18]
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
lea eax, [esi + 0x18]
push eax
call fcn.0047b7c0
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x5c], eax
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
mov eax, dword [esi + 0x6c]
mov dword [edi + 0x6c], eax
mov eax, dword [esi + 0x78]
mov dword [edi + 0x78], eax
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x7c], eax
movzx eax, byte [esi + 0x80]
mov byte [edi + 0x80], al
mov eax, dword [esi + 0x84]
mov dword [edi + 0x84], eax
mov eax, dword [esi + 0x88]
mov dword [edi + 0x88], eax
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
mov eax, dword [esi + 0x8c]
mov dword [edi + 0x8c], eax
mov eax, dword [esi + 0x90]
mov dword [edi + 0x90], eax
cmp edi, esi
je 0x4908bd
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x4908b2
mov eax, dword [esi]
push dword [esi + 0x10]
mov ecx, edi
push eax
call fcn.00479ba0
movzx eax, byte [esi + 0x94]
mov byte [edi + 0x94], al
movzx eax, byte [esi + 0x95]
mov byte [edi + 0x95], al
movzx eax, byte [esi + 0x96]
mov byte [edi + 0x96], al
movzx eax, byte [esi + 0x97]
mov byte [edi + 0x97], al
pop edi
pop esi
pop ebp
ret 4
Function at 0x4965a0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
mov eax, dword [0x75868c]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x14]
push edi
xorps xmm0, xmm0
mov dword [esp + 0x38], 0
push eax
movups xmmword [esp + 0x1c], xmm0
movups xmmword [esp + 0x2c], xmm0
call fcn.00496520
push 0x6eff88
push esi
call fcn.006534e2
add esp, 8
mov edi, eax
push pe_nt_image_headers32
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
movss xmm0, dword [esp + 0x20]
sub esp, 0x18
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
movss xmm0, dword [esp + 0x34]
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x30]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push str.CenterPos__f__f__f_n
push 0
push edi
call fcn.0058a450
movss xmm0, dword [esp + 0x54]
add esp, 0xc
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
movss xmm0, dword [esp + 0x4c]
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x50]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push str.CameraSetting__f__f__f_n
push 0
push edi
call fcn.0058a450
movss xmm0, dword [esp + 0x50]
add esp, 0xc
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
movss xmm0, dword [esp + 0x40]
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
movss xmm0, dword [esp + 0x3c]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push str.CmrPos__f__f__f_n
push 0
push edi
call fcn.0058a450
cvttss2si eax, dword [esp + 0x50]
push eax
cvttss2si eax, dword [esp + 0x50]
push eax
cvttss2si eax, dword [esp + 0x50]
push eax
cvttss2si eax, dword [esp + 0x60]
push eax
cvttss2si eax, dword [esp + 0x68]
push eax
cvttss2si eax, dword [esp + 0x70]
push eax
cvttss2si eax, dword [esp + 0x5c]
push eax
cvttss2si eax, dword [esp + 0x5c]
push eax
cvttss2si eax, dword [esp + 0x5c]
push eax
push str.Line__x__dy__dz__ddistance__dpitch__drot__dup__dview__dcross__d__n
push 0
push edi
call fcn.0058a450
add esp, 0x54
push edi
call fcn.00653570
mov ecx, dword [esp + 0x40]
add esp, 4
pop edi
pop esi
xor ecx, esp
call fcn.00617a25
mov esp, ebp
pop ebp
ret 4

Function at 0x499d50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
push 0x40
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 6
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 0xc

Function at 0x4b1fba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + ebx*4 - 0x717925fc], esi
pop edi
jmp loc.0081f195

Function at 0x4be345
Capabilities:
Get common file path

Disassembly:
push ebx
sal eax, cl
mov ebx, esp
sub esp, 8
rcl ah, cl
stc
and esp, 0xfffffff8
sal al, 0x25
add esp, 4
bts ax, dx
cbw
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
shrd bp, bp, 0x2a
and bp, 0x387
mov ebp, esp
movsx eax, di
push 0xffffffffffffffff
bts eax, eax
adc eax, ecx
xor eax, ebp
push 0x8f79e4
rcl ah, 0x21
mov eax, dword fs:[0]
test bh, 0x81
push eax
jmp loc.00882e90
Function at 0x4cafd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69f21d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x75868c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x14], 0
jne 0x4cb057
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x51bde0
lea ecx, [ebp - 0x18]
call fcn.004cf1c0
add esp, 4
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
push 0
push dword [ebp - 0x18]
push 0x4cf1f0
push 0
push 0
call fcn.00659935
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x20], ecx
test ecx, ecx
je 0x4cb067
cmp dword [esi + 0x10], 0
jne 0x4cb075
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], eax
mov byte [esi + 0x14], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x1c], 0
call fcn.00615f28
call fcn.00659d41
int3

Function at 0x4db6ea
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x40c]
mov eax, dword [0x75868c]
cmp ax, 0xc4b1
cmp cx, bx
xor eax, ebp
jmp 0x4dc4a8
mov dword [ebp - 4], eax
push ebx
push esi
cwde
push edi
cwde
lahf
lea eax, [ebp - 0x108]
movsx esi, bp
mov dword [ebp - 0x40c], ecx
movsx esi, si
push eax
jmp 0x93c0a1

Function at 0x4edbe0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push str.offlineshop
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4edbf5
cmp eax, 0x10
je 0x4edc02
push 0
push str.offlineshop
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
ret
Function at 0x4f3ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x4f3b97
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x4f3b86
jg 0x4f3af0
test edx, edx
je 0x4f3b86
nop dword [eax]
call fcn.00479b30
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4f3b43
jg 0x4f3b07
test esi, esi
je 0x4f3b43
cmp ebx, eax
jg 0x4f3b17
jl 0x4f3b11
cmp edi, esi
jae 0x4f3b17
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
push esi
push dword [esp + 0x14]
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.00645880
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x4f3b6a
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x4f3b80
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x4f3af0
jl 0x4f3b80
test edi, edi
jne 0x4f3af0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4f3bb9
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x4f3bbb
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x4f3c39
jg 0x4f3bce
test esi, esi
je 0x4f3c39
test eax, eax
jl 0x4f3c1d
jg 0x4f3bd8
test ebx, ebx
je 0x4f3c1d
cmp edi, eax
jg 0x4f3be8
jl 0x4f3be2
cmp esi, ebx
jae 0x4f3be8
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00645880
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x4f3c39
jg 0x4f3c20
test esi, esi
je 0x4f3c39
jmp 0x4f3c20
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x4f3c39
push eax
push esi
push 1
push edx
call fcn.00653813
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f4290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x75868c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4f42c0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00617a25
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4f42fc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4f42fc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00617a25
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4f43e4
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4f4324
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4f4357
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0065bbe7
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00617a25
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x4f43b7
sub eax, 1
je 0x4f43b7
sub eax, 2
jne 0x4f43e4
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.004edb00
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00617a25
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4f43d4
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00653813
add esp, 0x10
cmp edi, eax
jne 0x4f43e4
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x4f42e7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00617a25
mov esp, ebp
pop ebp
ret 4
Function at 0x4f4930
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x75868c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4f49ec
cmp byte [esi + 0x3d], 0
je 0x4f49ec
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4f49da
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x4f49a2
sub eax, 1
je 0x4f49a6
sub eax, 2
jne 0x4f49da
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00617a25
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4f49c3
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00653813
add esp, 0x10
cmp edi, eax
jne 0x4f49da
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00617a25
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00617a25
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00617a25
mov esp, ebp
pop ebp
ret
Function at 0x51bb70
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx + 0x54], 0
mov eax, ecx
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x5c], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
ret
Function at 0x53a500
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x75868c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
cmp edi, eax
je 0x53a53a
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x53a531
mov eax, dword [eax]
push ecx
push eax
mov ecx, edi
call fcn.0053b6d0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x408], 0x400
jb 0x53a54c
mov esi, dword [esi]
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x404]
push eax
push 0
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x53a593
lea edx, [ebp - 0x404]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x53a575
sub edx, ecx
lea eax, [ebp - 0x404]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.0053b6d0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00617a25
mov esp, ebp
pop ebp
ret 0x10