joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c2b4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4db0c8]
cmp byte [eax + 0xc], 0
je 0x46c421
push 0x8000
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46c41a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4dc348], 0
jne 0x46c308
push 0x46c428
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
push 0x46c430
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4dc348], eax
cmp dword [0x4cf9e4], 0
jne 0x46c403
push 0x46c440
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x4cf9e4], eax
cmp dword [0x4cf9e4], 0
je 0x46c403
push 0x46c44c
mov eax, dword [0x4cf9e4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4dc34c], eax
push 0x46c45c
mov eax, dword [0x4cf9e4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4dc350], eax
push 0x46c470
mov eax, dword [0x4cf9e4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4dc354], eax
push 0x46c488
mov eax, dword [0x4cf9e4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4dc358], eax
push 0x46c4a0
mov eax, dword [0x4cf9e4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4dc35c], eax
push 0x46c4b4
mov eax, dword [0x4cf9e4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4dc360], eax
push 0x46c4cc
mov eax, dword [0x4cf9e4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4dc364], eax
push 0x46c4e4
mov eax, dword [0x4cf9e4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4dc368], eax
push 0x46c500
mov eax, dword [0x4cf9e4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4dc36c], eax
push 0x46c50c
mov eax, dword [0x4cf9e4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4dc370], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c421
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x4701c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x470298
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4dc384], 0
jne 0x47027c
lea eax, [ebp - 4]
mov edx, 0x4702b0
call fcn.00430080
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00430498
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x47027c
mov eax, ebx
call fcn.0042e5b8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x470275
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x47025f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4702c0
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x47025f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4dc384], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47027c
mov eax, dword [ebp - 0xc]
call fcn.0042e5d8
ret
mov ebx, dword [0x4dc384]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47029f
lea eax, [ebp - 4]
call fcn.0042ffe8
ret

Function at 0x47c39c
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x4dc3a8], 0
jne 0x47c3bf
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x47c310
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x4dc3a8], eax
ret

Function at 0x481dfc
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp ebx, dword [0x4d1d98]
jb 0x481e20
push 6
call fcn.004822b8
pop ecx
jmp 0x481eb7
push ebx
call fcn.00481f04
pop ecx
mov esi, dword [ebx*4 + 0x4dc94c]
push 0x24
push 0
push edi
call fcn.00480234
add esp, 0xc
push esi
call sub.KERNEL32.DLL_GetFileType
dec eax
je 0x481e54
dec eax
je 0x481e4c
dec eax
je 0x481ea6
jmp 0x481eac
mov word [edi + 4], 0x2000
jmp 0x481eac
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x10]
push ecx
push esi
call sub.KERNEL32.DLL_GetFileTime
dec eax
je 0x481e72
call fcn.00482324
mov esi, eax
jmp 0x481eae
push 0
push esi
call sub.KERNEL32.DLL_GetFileSize
push eax
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x10]
push ecx
test byte [ebx*4 + 0x4d1d9d], 1
je 0x481e95
xor eax, eax
jmp 0x481e9a
mov eax, 1
push eax
push edi
call fcn.00487da0
add esp, 0x18
jmp 0x481eac
mov word [edi + 4], 0x1000
xor esi, esi
push ebx
call fcn.00481f98
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x486304
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x486366
call fcn.004862b4
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00480314
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00480314
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4863e4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4d2dfc], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4864be
cmp dword [0x4d2df8], 0
jne 0x4864be
cmp dword [0x4d2fdc], 0
je 0x486478
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004861b4
add esp, 8
mov ebx, eax
test eax, eax
jne 0x48645e
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004861b4
add esp, 8
mov ebx, eax
test eax, eax
jne 0x48645e
lea ebx, [ebp - 0x84]
jmp 0x48645f
inc ebx
call fcn.004863a0
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4864f9
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4d2e00
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00480314
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4d2e03
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4864f9
cmp dword [0x4d2df8], 0
je 0x4864d8
cmp dword [0x4d2df8], 0xffffffff
je 0x4864f9
push esi
call dword [0x4d2df8]
pop ecx
mov eax, dword [0x4d2dfc]
test eax, eax
je 0x4864f9
cmp dword [0x4d2dfc], 0xffffffff
je 0x4864f9
cmp byte [eax], 0
je 0x4864f9
push esi
push eax
call fcn.00486304
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x486cf4
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4dcc60], 0
jne 0x486d75
cmp dword [0x4dcc80], 0
jne 0x486d24
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4dcc80], eax
test eax, eax
jne 0x486d24
push str.GetEnvironmentStrings_failed
call fcn.00486510
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4dcc80]
jmp 0x486d38
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00480314
pop ecx
mov edi, eax
test eax, eax
jne 0x486d30
lea edi, [ebp + 1]
push edi
call fcn.0047ec50
pop ecx
mov ebx, eax
mov dword [0x4dcc64], ebx
test ebx, ebx
jne 0x486d62
xor eax, eax
jmp 0x486e38
push edi
mov edx, dword [0x4dcc80]
push edx
push ebx
call fcn.004801c4
add esp, 0xc
jmp 0x486d95
xor esi, esi
mov ebx, dword [0x4dcc60]
jmp 0x486d8f
push eax
call fcn.00480314
pop ecx
test eax, eax
jne 0x486d8b
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x486d7f
lea ebx, [esi + 4]
push 4
mov dword [0x4dcc68], ebx
inc ebx
push ebx
call fcn.0047e40c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x486db8
xor eax, eax
jmp 0x486e38
cmp dword [0x4dcc60], 0
jne 0x486de9
xor esi, esi
mov ebx, dword [0x4dcc64]
mov eax, dword [esp]
mov ebp, eax
jmp 0x486dda
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00480314
pop ecx
mov edi, eax
test eax, eax
jne 0x486dd0
jmp 0x486e1a
xor esi, esi
mov ebx, dword [0x4dcc60]
mov eax, dword [esp]
mov edi, eax
jmp 0x486e14
push eax
call fcn.00480314
pop ecx
test eax, eax
je 0x486e09
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x486e0d
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x486df8
mov eax, dword [0x4dcc60]
test eax, eax
je 0x486e2a
push eax
call fcn.0047ec60
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4dcc60], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x48d5f4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x48d622
mov eax, ebx
call fcn.0048e0ac
cmp dword [ebx + 0x3c], 0
je 0x48d61b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x48d693
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x48d685
cmp dword [ebx + 8], 0
je 0x48d644
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x48d656
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x48d685
cmp dword [ebx + 8], 0
je 0x48d637
cmp eax, 3
je 0x48d669
dec eax
jne 0x48d637
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x48d637
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x48d637
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x48d6b1
cmp dword [ebx + 0x10], 0xcc
je 0x48d6b1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0048d6bc
pop ebx
ret
Function at 0x49f098
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
lea eax, [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call fcn.00482758
add esp, 0x10
lea eax, [ebp - 0x1000]
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov esp, ebp
pop ebp
ret

Function at 0x4a0e50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
lea ebx, [ebp + 8]
mov eax, 0x4d5f60
call fcn.00480638
mov word [ebp - 0x14], 8
mov edx, 0x4d6174
mov ecx, dword [ebx]
mov dword [ecx], edx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 8], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0xc], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x10], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x14], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x18], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x1c], edx
mov ecx, dword [ebx]
add ecx, 0x20
push ecx
call fcn.004c6830
pop ecx
inc dword [ebp - 8]
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x24], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x28], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x2c], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x30], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x34], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x38], ecx
mov eax, dword [ebx]
xor edx, edx
mov dword [eax + 0x3c], edx
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x40], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x44], ecx
mov eax, dword [ebx]
add eax, 0x4c
push eax
call fcn.004a00e8
pop ecx
add dword [ebp - 8], 4
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a4cfc
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4a4d25
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x4a4d25
xor eax, eax
jmp 0x4a4d28
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret

Function at 0x4a4d2c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
mov eax, 0x4d6d08
push ebx
mov ebx, dword [ebp + 8]
call fcn.00480638
mov dword [ebx], 0xffffffff
xor edx, edx
mov dword [ebx + 8], edx
mov byte [ebx + 0xc], 0
mov byte [ebx + 0xd], 0
cmp dword [0x4d6d04], 0
jne 0x4a4d6d
lea ecx, [ebp - 0x48]
push ecx
call sub.KERNEL32.DLL_GetSystemInfo
mov eax, dword [ebp - 0x44]
mov dword [0x4d6d04], eax
xor edx, edx
mov dword [ebx + 4], edx
cmp dword [0x4d6d04], 0
ja 0x4a4d85
mov dword [0x4d6d04], 0x1000
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a4f7c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_ReadFile
test byte [esi + 8], 4
jne 0x4a504c
cmp dword [ebp - 4], 0
je 0x4a504c
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
dec eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
jmp 0x4a5021
mov al, byte [ebx]
movsx edx, al
cmp edx, 0xd
je 0x4a4fd3
mov byte [edi], al
inc edi
jmp 0x4a5020
cmp ebx, dword [ebp - 8]
jae 0x4a4fe7
movsx ecx, byte [ebx + 1]
cmp ecx, 0xa
je 0x4a5020
mov byte [edi], 0xd
inc edi
jmp 0x4a5020
mov byte [ebp - 9], 0x20
lea eax, [ebp - 0x10]
push 0
push eax
lea edx, [ebp - 9]
push 1
push edx
mov ecx, dword [esi]
push ecx
call sub.KERNEL32.DLL_ReadFile
cmp dword [ebp - 0x10], 0
je 0x4a5013
push 1
push 0
push 0xffffffffffffffff
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_SetFilePointer
movsx edx, byte [ebp - 9]
cmp edx, 0xa
je 0x4a5020
mov byte [edi], 0xd
inc edi
inc ebx
cmp ebx, dword [ebp - 8]
ja 0x4a502e
movsx ecx, byte [ebx]
cmp ecx, 0x1a
jne 0x4a4fc4
cmp ebx, dword [ebp - 8]
ja 0x4a5046
push 1
push 0
mov eax, dword [ebp - 8]
inc eax
sub eax, ebx
push eax
mov edx, dword [esi]
push edx
call sub.KERNEL32.DLL_SetFilePointer
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a5058
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffd4
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
test byte [eax + 8], 1
je 0x4a5081
push 4
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.004a51d0
add esp, 0xc
mov ecx, dword [ebp + 8]
test byte [ecx + 8], 4
je 0x4a50ab
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
push edx
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebp - 4]
jmp 0x4a51a0
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
mov dword [ebp - 8], eax
lea ebx, [ebp - 0x102c]
mov edx, dword [ebp + 0xc]
add edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 0x1000
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0x10]
jge 0x4a50d7
lea eax, [ebp - 0x10]
jmp 0x4a50da
lea eax, [ebp + 0x10]
mov edi, dword [eax]
jmp 0x4a512c
mov edi, dword [ebp - 0x14]
sub edi, esi
push edi
push esi
push ebx
call fcn.004801c4
add ebx, edi
xor ecx, ecx
inc edi
add esp, 0xc
mov byte [ebx], 0xd
inc ebx
add esi, edi
mov byte [ebx], 0xa
inc ebx
mov edx, dword [ebp - 8]
sub edx, ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jge 0x4a5115
lea eax, [ebp - 0x18]
jmp 0x4a5118
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
sub edx, esi
mov dword [ebp - 0x20], edx
mov ecx, dword [eax]
cmp ecx, dword [ebp - 0x20]
jl 0x4a512a
lea eax, [ebp - 0x20]
mov edi, dword [eax]
test edi, edi
jle 0x4a5143
push edi
push 0xa
push esi
call fcn.0048040d
add esp, 0xc
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4a50de
test edi, edi
jle 0x4a5156
push edi
push esi
push ebx
call fcn.004801c4
add esp, 0xc
add ebx, edi
add esi, edi
lea eax, [ebp - 0x102c]
mov dword [ebp - 0x24], eax
sub ebx, eax
test ebx, ebx
je 0x4a519b
push 0
lea edx, [ebp - 0x28]
push edx
mov edi, ebx
push edi
mov eax, dword [ebp - 0x24]
push eax
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
push ecx
call sub.KERNEL32.DLL_WriteFile
cmp edi, dword [ebp - 0x28]
je 0x4a519b
cmp dword [ebp - 0x28], 0
jne 0x4a518c
xor eax, eax
jmp 0x4a51c6
mov edx, dword [ebp - 0x28]
add dword [ebp - 0x24], edx
sub edi, dword [ebp - 0x28]
mov ebx, edi
test ebx, ebx
jne 0x4a5165
mov eax, esi
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jne 0x4a51a9
mov al, 1
jmp 0x4a51c6
test eax, eax
jle 0x4a51bd
cmp eax, dword [ebp + 0x10]
jge 0x4a51bd
sub dword [ebp + 0x10], eax
add dword [ebp + 0xc], eax
jmp 0x4a5068
xor eax, eax
jmp 0x4a51c6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a5260
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
mov esi, eax
mov dword [ebx + 4], esi
test esi, esi
je 0x4a52cc
mov eax, dword [ebp + 0x10]
mov edx, edi
and edx, 0xffffffff
push eax
mov eax, edi
push edx
cdq
mov eax, edx
xor edx, edx
push eax
push 4
push esi
call sub.KERNEL32.DLL_MapViewOfFile
mov esi, eax
test esi, esi
je 0x4a52ba
push 1
add edi, dword [ebp + 0x10]
push edi
push ebx
call fcn.004a51d0
add esp, 0xc
test eax, eax
jge 0x4a52ce
mov edx, dword [ebp + 0x10]
push edx
push esi
push ebx
call fcn.004a52d8
add esp, 0xc
xor esi, esi
jmp 0x4a52ce
xor esi, esi
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x905058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009051a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x90507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90506a
add dl, dl
jne 0x905089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9050dc
xor eax, eax
add dl, dl
jne 0x905096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90517d
add dl, dl
jne 0x9050a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9050b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9050bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9050c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9050d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x905075
mov eax, 1
add dl, dl
jne 0x9050ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9050f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9050e1
sub eax, ebx
mov ebx, 1
jne 0x905128
mov ecx, 1
add dl, dl
jne 0x90510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x905119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x905105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x905075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x90513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x90514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x905136
cmp eax, 0x7d00
jae 0x90516d
cmp eax, 0x500
jb 0x905168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x905075
cmp eax, 0x7f
ja 0x905170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x905075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x90519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x905075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401df3
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x401e0d
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 0xc

Function at 0x401e36
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x401e41
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x4027ad
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.00401dbe
cmp eax, esi
jne 0x402825
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x4027ee
lea eax, [ebp - 0x110]
push eax
call fcn.004027ad
cmp eax, esi
jne 0x402824
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 8], 0x100
call edi
test eax, eax
lea ecx, [ebp - 4]
je 0x4027de
call fcn.00401d59
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
lea ecx, [ebp - 4]
mov esi, eax
call fcn.00401d59
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x4029e4
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, edi
mov dword [esi + 0x34], eax
jne 0x402a00
xor al, al
jmp 0x402a1a
lea eax, [esp + 8]
push eax
push edi
push esi
push 0x4029d6
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ecx
ret