joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4993fc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x499467
cmp byte [ebx + 0xd3], 0
jne 0x499467
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004065d0
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x499454
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x499474
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406828
jmp 0x499474
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406828
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x49a9b8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x49aa26
mov eax, esi
call fcn.004592c4
test al, al
je 0x49aa26
mov eax, dword [ebx + 0x84]
call fcn.00458f18
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x49aa26
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x49aa1a
push 0
mov eax, dword [ebx + 0x84]
call fcn.00458f18
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004502fc
jmp 0x49aa26
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0049a7f0
pop esi
pop ebx
ret

Function at 0x49bb64
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov ebp, edx
mov edi, eax
test ebx, ebx
je 0x49bb84
mov eax, ebx
test eax, eax
je 0x49bb7d
sub eax, 4
mov eax, dword [eax]
inc eax
mov esi, eax
add esi, esi
jmp 0x49bb86
xor esi, esi
push esi
push ebx
push 1
push 0
push ebp
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x49d7d0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4c4274
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x49d7f2
shr eax, 1
xor eax, 0xedb88320
jmp 0x49d7f4
shr eax, 1
dec edx
jne 0x49d7e0
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x49d7d9
mov byte [0x4c4674], 1
pop esi
pop ebx
ret

Function at 0x49d810
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4c4674], 0
jne 0x49d827
call fcn.0049d7d0
mov eax, edi
dec eax
test eax, eax
jl 0x49d84f
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4c4274]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x49d831
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4a0564
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x4a05fe.0
jmp dword [ecx*4 + 0x4a0597]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4a05c9
sub dl, 8
je 0x4a05d8
jmp case.0x4a05fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a020c
jmp case.0x4a05fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a0264
jmp case.0x4a05fe.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x4a05fe.0
movzx ecx, byte [ecx + 0x4a0605]
jmp dword [ecx*4 + 0x4a0616]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a0310
jmp case.0x4a05fe.0
cmp dl, 3
jne 0x4a0643
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a0368
jmp case.0x4a05fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a0324
jmp case.0x4a05fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a03ac
jmp case.0x4a05fe.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4a066e
sub dl, 8
je 0x4a067a
jmp case.0x4a05fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a03d8
jmp case.0x4a05fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a0444
jmp case.0x4a05fe.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4a0699
sub dl, 8
je 0x4a06a5
jmp case.0x4a05fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a0500
jmp case.0x4a05fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a0528
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x4a0747
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0049f710
test eax, eax
je 0x4a0747
mov eax, ebx
call fcn.004a0750
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x4a06e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a0750
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4a0781
dec al
je 0x4a07bc
dec al
je 0x4a0801
dec al
je 0x4a086a
jmp 0x4a08f4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4a08f4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a0791
jmp 0x4a08f4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a08f4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a07cc
jmp 0x4a08f4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a08f4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4a0830
xor ebp, ebp
jmp 0x4a0840
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4a0849
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a0811
jmp 0x4a08f4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a08f4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4a08c3
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0049d858
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a087e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a817c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a820a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406478
push 2
push 0
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x1c]
call fcn.004a7ebc
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_LoadLibraryExW_1
mov ebx, eax
test ebx, ebx
je 0x4a81f4
push 0xa
push 0x4a8218
push ebx
call sub.kernel32.dll_FindResourceW
test eax, eax
je 0x4a81ee
push eax
push ebx
call sub.kernel32.dll_LoadResource
mov edi, eax
test edi, edi
je 0x4a81ee
push edi
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
call fcn.00406dfc
push edi
call sub.kernel32.dll_FreeResource
push ebx
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8211
lea eax, [ebp - 4]
call fcn.00406478
ret
Function at 0x4a8afc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0xd], cl
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a8c9b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x4a8c73
cmp dword [ebp - 0x14], 0
jbe 0x4a8c73
inc dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x18]
call fcn.00406f28
mov edx, dword [ebp - 0x1c]
shr edx, 1
lea eax, [ebp - 8]
call fcn.00406f28
mov ebx, dword [ebp - 0x14]
dec ebx
test ebx, ebx
jb 0x4a8c73
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
test eax, eax
jne 0x4a8c6b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push esi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4a8c6b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax - 4]
cmp byte [eax + 5], 2
je 0x4a8c29
push ebp
movzx eax, byte [ebp - 0xd]
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x24]
shr ecx, 1
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00407170
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00407170
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
pop ecx
call fcn.004a882c
pop ecx
jmp 0x4a8c6b
push ebp
movzx eax, byte [ebp - 0xd]
push eax
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00407170
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x24]
shr ecx, 1
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00407170
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xc]
pop ecx
call fcn.004a882c
pop ecx
inc edi
dec ebx
jne 0x4a8b8d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8ca2
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.004064d8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004064d8
ret
Function at 0x4a8d38
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 9], cl
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a8e73
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049b9f4
test al, al
je 0x4a8e50
push ebp
movzx ecx, byte [ebp - 9]
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.004a8afc
pop ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x4a8e47
cmp dword [ebp - 0x18], 0
jbe 0x4a8e47
inc dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x1c]
call fcn.00406f28
mov ebx, dword [ebp - 0x18]
dec ebx
test ebx, ebx
jb 0x4a8e47
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x4a8e43
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.0049b9f4
test al, al
je 0x4a8e43
push ebp
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00407170
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.004a8cac
mov edx, dword [ebp - 0x24]
movzx ecx, byte [ebp - 9]
mov eax, dword [ebp - 0x14]
call fcn.004a8afc
pop ecx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
inc esi
dec ebx
jne 0x4a8dd4
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8e7a
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004064d8
lea eax, [ebp - 8]
call fcn.00406478
ret
Function at 0x4a918c
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a9265
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x4a9247
cmp dword [ebp - 8], 0
jbe 0x4a9247
inc dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00406f28
mov ebx, dword [ebp - 8]
dec ebx
cmp ebx, 0
jb 0x4a9247
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
push esi
call sub.advapi32.dll_RegEnumValueW
test eax, eax
jne 0x4a9241
push ebp
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00407170
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.004a90b0
pop ecx
test al, al
je 0x4a9241
mov eax, dword [ebp - 4]
push eax
push esi
call sub.advapi32.dll_RegDeleteValueW
dec ebx
cmp ebx, 0xffffffff
jne 0x4a91f2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a926c
lea eax, [ebp - 0x18]
call fcn.00406478
lea eax, [ebp - 4]
call fcn.00406478
ret
Function at 0x4a9274
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov byte [ebp - 5], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x4a93bb
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, ebx
mov eax, 0x80000002
call fcn.0049b9f4
test al, al
je 0x4a939d
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea ecx, [ebp - 0xc]
mov edx, ebx
mov eax, 0x80000002
call fcn.0049ba18
test al, al
je 0x4a939d
push ebp
movzx ecx, byte [ebp - 5]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004a918c
pop ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x4a9394
cmp dword [ebp - 0x14], 0
jbe 0x4a9394
inc dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x18]
call fcn.00406f28
mov ebx, dword [ebp - 0x14]
dec ebx
test ebx, ebx
jb 0x4a9394
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x4a9390
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0049ba18
test al, al
je 0x4a9390
push ebp
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00407170
mov edx, dword [ebp - 0x20]
movzx ecx, byte [ebp - 5]
mov eax, dword [ebp - 0x10]
call fcn.004a918c
pop ecx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
inc esi
dec ebx
jne 0x4a932c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a93c2
lea eax, [ebp - 0x20]
call fcn.00406478
lea eax, [ebp - 4]
call fcn.00406478
ret
Function at 0x4a93c8
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a94a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 8]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4a948e
inc esi
xor edi, edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 8]
mov edx, edi
call fcn.0042c818
mov ebx, eax
cmp byte [ebx + 6], 0
je 0x4a9486
cmp byte [ebx + 7], 0
je 0x4a9486
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 0x1c]
call fcn.004a7ebc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406dac
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4a9486
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00406dac
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4a947d
test ah, 4
je 0x4a947d
test al, 0x10
je 0x4a947d
mov eax, dword [ebp - 4]
call fcn.00406dac
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4a9486
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetLastError
inc edi
dec esi
jne 0x4a93fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a94ab
lea eax, [ebp - 0xc]
call fcn.00406478
ret

Function at 0x4aa65c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004a9fe4
xor eax, eax
push ebp
push 0x4aa6f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0xe8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x29c]
call fcn.00483c48
mov esi, eax
dec esi
test esi, esi
jl 0x4aa6db
inc esi
xor edi, edi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x29c]
mov edx, edi
call fcn.00483c80
mov ebx, eax
mov edx, 3
mov eax, ebx
call fcn.00483730
mov ecx, eax
xor cl, 1
mov edx, 3
mov eax, ebx
call fcn.004837a0
inc edi
dec esi
jne 0x4aa6a5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa6f8
mov eax, dword [ebp - 4]
call fcn.004aa008
ret

Function at 0x4ad72c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor ecx, ecx
mov dword [ebp - 0x210], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4ad7b7
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x20a]
push edx
push 0
push 0
or eax, 0x8000
push eax
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, 0x80000000
sete al
test al, al
je 0x4ad797
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406e50
mov eax, dword [ebp - 0x210]
mov edx, ebx
call fcn.0041ca74
jmp 0x4ad79e
mov eax, ebx
call fcn.00406478
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad7be
lea eax, [ebp - 0x210]
call fcn.00406478
ret
Function at 0x4ad9a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4adaa4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4ad9d8
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_UpdateWindow
mov eax, dword [0x4be018]
mov eax, dword [eax]
mov dx, 0xffed
call fcn.004971a4
xor eax, eax
push ebp
push 0x4ada2a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push ebx
mov eax, dword [ebp - 8]
push eax
push 0x4adab4
push 0
call sub.shell32.dll_ShellExecuteW
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ada31
mov eax, dword [0x4be018]
mov eax, dword [eax]
xor edx, edx
call fcn.004971a4
ret

Function at 0x4aec80
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
xor edx, edx
mov dword [esp + 8], edx
mov edx, dword [eax + 4]
mov dword [esp], edx
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x4aec2c
call sub.user32.dll_EnumWindows
mov esi, dword [esp + 8]
test esi, esi
setne bl
test bl, bl
je 0x4aecc7
mov eax, esi
call fcn.004aea08
call fcn.004aebb4
mov eax, dword [esp + 8]
call fcn.0040b26c
mov eax, ebx
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x4aed3c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x4aee50
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x44
call fcn.0040448c
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
mov word [ebp - 0x30], 1
lea eax, [ebp - 0xc]
call fcn.004ad894
lea eax, [ebp - 4]
mov edx, 0x4aee70
call fcn.00406870
lea eax, [ebp - 4]
call fcn.004069d8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0xc]
call fcn.004ad920
test bl, bl
je 0x4aee3a
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_WaitForInputIdle
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebp - 0x6c], eax
xor eax, eax
mov dword [ebp - 0x68], eax
xor eax, eax
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x6c]
push eax
push 0x4aecd0
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_EnumThreadWindows
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x4aee1e
cmp dword [ebp - 0x68], 0
je 0x4aee1e
cmp dword [ebp - 0x64], 0
jne 0x4aee22
xor ebx, ebx
jmp 0x4aee24
mov bl, 1
test bl, bl
je 0x4aee3a
mov dword [esi], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x68]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x64]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aee57
lea eax, [ebp - 4]
call fcn.00406478
ret

Function at 0x4af810
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, ecx
mov edi, edx
mov esi, eax
mov edx, edi
mov ecx, ebx
mov eax, esi
call fcn.004af7e8
test al, al
je 0x4af864
push 0
lea eax, [esp + 8]
push eax
push 4
lea eax, [esp + 0xc]
push eax
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x4af864
mov eax, dword [edi + 0x10]
cmp eax, dword [esp]
je 0x4af853
mov eax, dword [edi + 0x14]
cmp eax, dword [esp]
jne 0x4af864
mov byte [edi], bl
mov eax, dword [edi + 0x14]
cmp eax, dword [esp]
sete al
mov byte [edi + 1], al
mov byte [edi + 2], al
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret