joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4250ae
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov word [esi + 0xaa], ax
call edi
cwde
mov ebx, SysReAllocStringLen
test ebx, eax
je 0x4250d7
or word [esi + 0xaa], 4
push 0x11
call edi
cwde
test ebx, eax
je 0x4250e8
or word [esi + 0xaa], 2
push 0x10
call edi
cwde
test ebx, eax
je 0x4250f9
or word [esi + 0xaa], 1
pop edi
pop esi
pop ebx
ret

Function at 0x43889e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xc
mov eax, 0x5ea135
call fcn.005bb14d
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 1
call fcn.004887ac
push eax
lea ecx, [ebp - 0x10]
call fcn.0040654d
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0xc]
mov ebx, eax
push esi
push esi
push 0x8000000
push 3
push esi
push 1
push SysReAllocStringLen
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push eax
call fcn.0045ae3c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10]
push eax
call fcn.004067de
jmp 0x438952
cmp dword [ebp + 0x14], 0
je 0x4389a4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, dword [ebp + 0x14]
jae 0x4389a4
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 0xc]
xor eax, eax
push eax
push eax
push 0x8000000
push 3
push eax
push 1
push SysReAllocStringLen
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push eax
call fcn.0045ae3c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10]
push eax
call fcn.004067de
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00406e44
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
jne 0x4388ff
mov ecx, dword [ebp + 8]
push 0x60bba8
call fcn.00408edd
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 1
lea ecx, [esi - 0x10]
call fcn.00406e44
and dword [ebp - 4], 0
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00406e44
mov eax, dword [ebp + 8]
call fcn.005bb116
ret 0x14
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00408eaa
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 1
lea ecx, [esi - 0x10]
call fcn.00406e44
jmp 0x43898a
Function at 0x44796e
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x69c24c]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0x2c
mov eax, 0x5ede6d
call fcn.005bb14d
mov eax, dword [ebp + 0x420]
mov edi, dword [ebp + 0x41c]
mov ebx, dword [ebp + 0x424]
mov esi, dword [ebp + 0x42c]
and dword [ebp - 0x18], 0
push 0x36e
push 9
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x38]
push str.MFCEx.cpp
push eax
mov dword [ebp - 0x20], edi
call fcn.00408f4f
add esp, 0x10
mov dword [ebp - 4], 1
call fcn.004887ac
push eax
lea ecx, [ebp - 0x10]
call fcn.0040654d
mov byte [ebp - 4], 3
lea eax, [ebp]
push dword [ebp + 0x428]
push dword [ebp - 0x14]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x447a94
push dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push str.SHGetSpecialFolderPath__x_
push eax
call fcn.00459852
mov byte [ebp - 4], 4
push 0
push dword [eax]
lea eax, [ebp - 0x14]
push 3
push eax
call fcn.0042928a
add esp, 0x1c
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10]
push eax
call fcn.004067de
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00406e44
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00406e44
mov ecx, dword [0x699020]
mov esi, dword [ebp - 0x10]
add ecx, 0x11c
push esi
push 0
mov eax, dword [ecx]
call dword [eax]
test ebx, ebx
je 0x447a78
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.004067de
push 0x60bba8
mov ecx, edi
call fcn.00408edd
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 1
lea ecx, [esi - 0x10]
jmp 0x447ab0
lea eax, [ebp]
mov ecx, edi
push eax
call fcn.00408edd
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00406e44
mov byte [ebp - 4], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.005bb105
lea esp, [ebp + 0x414]
pop ebp
ret

Function at 0x4483e3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x69c24c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push ebx
xor esi, esi
push edi
push 8
mov edi, esi
pop ebx
mov edx, edi
mov ecx, edi
shr edx, 1
mov eax, edx
mov edi, edx
xor eax, 0xedb88320
and cl, 1
cmovne edi, eax
sub ebx, 1
jne 0x448400
mov dword [ebp + esi*4 - 0x404], edi
inc esi
cmp esi, 0x100
jl 0x4483fb
mov edx, dword [ebp + 0xc]
or ecx, 0xffffffff
pop edi
pop ebx
test edx, edx
je 0x448451
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [ebp + eax*4 - 0x404]
inc esi
sub edx, 1
jne 0x448439
not ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005bb105
mov esp, ebp
pop ebp
ret
Function at 0x45690d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x24
mov eax, 0x5f1617
call fcn.005bb14d
mov esi, ecx
push 0x2c
push 0xb
lea eax, [ebp - 0x30]
push str.Setting.cpp
push eax
call fcn.00408f4f
add esp, 0x10
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.004887ac
push eax
lea ecx, [ebp - 0x10]
call fcn.0040654d
mov byte [ebp - 4], 2
call fcn.004887ac
push eax
lea ecx, [ebp - 0x14]
call fcn.0040654d
mov byte [ebp - 4], 4
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.00456b5a
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x14]
push eax
call fcn.004067de
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00406e44
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
cmp dword [esi - 0xc], ebx
je 0x4569a0
push 0x40000000
push esi
call fcn.00429158
pop ecx
pop ecx
jmp 0x4569b3
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4569b0
test al, 0x10
je 0x4569b3
xor ebx, ebx
inc ebx
mov byte [ebp - 4], 2
lea ecx, [edi - 0x10]
call fcn.00406e44
mov byte [ebp - 4], 0
lea ecx, [esi - 0x10]
call fcn.00406e44
or dword [ebp - 4], 0xffffffff
mov eax, ebx
call fcn.005bb116
ret
Function at 0x459beb
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x69c24c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x14
mov eax, 0x5f26e9
call fcn.005bb14d
mov edi, dword [ebp + 0x214]
lea eax, [ebp]
xor esi, esi
push 0x208
push esi
push eax
mov dword [ebp - 0x10], esi
call fcn.005bd7e0
add esp, 0xc
mov ecx, edi
call fcn.0049806f
mov ecx, edi
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x20], eax
call fcn.0049806f
push esi
mov eax, dword [eax + 0x1c]
cmp word [eax], si
je 0x459c67
mov ecx, edi
call fcn.0049806f
push dword [eax + 0x1c]
lea eax, [ebp - 0x18]
push eax
call fcn.0045b061
add esp, 0xc
mov dword [ebp - 4], esi
xor ebx, ebx
inc ebx
jmp 0x459c82
lea eax, [ebp - 0x1c]
push 0x6161c4
push eax
call fcn.0045af3e
add esp, 0xc
mov dword [ebp - 4], 1
push 2
pop ebx
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], ebx
call fcn.00408eaa
mov dword [ebp - 4], 3
test bl, 2
je 0x459caf
and ebx, 0xfffffffd
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00406e44
mov byte [ebp - 4], 5
test bl, 1
je 0x459ccd
and ebx, 0xfffffffe
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00406e44
mov ebx, dword [ebp + 0x218]
test ebx, ebx
je 0x459ce6
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
call fcn.0049806f
cmp dword [eax + 0x2c], esi
jne 0x459cff
mov esi, dword [ebp - 0x14]
mov ecx, edi
call fcn.0049806f
mov dword [eax + 0x2c], esi
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x174]
mov esi, eax
cmp esi, 1
je 0x459d74
call dword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
cmp eax, 0x3002
jne 0x459d74
push 0
lea eax, [ebp - 0x18]
push 0x6161c4
push eax
call fcn.0045af3e
add esp, 0xc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x14]
push eax
call fcn.004067de
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00406e44
mov ecx, edi
call fcn.0049806f
xor ecx, ecx
mov eax, dword [eax + 0x1c]
mov word [eax], cx
mov ecx, edi
mov esi, dword [ebp - 0x14]
call fcn.0049806f
mov ecx, edi
mov dword [eax + 0x2c], esi
mov eax, dword [edi]
call dword [eax + 0x174]
mov esi, eax
test ebx, ebx
je 0x459d89
cmp word [ebp], 0
je 0x459d89
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, edi
call fcn.0049806f
mov ecx, dword [ebp - 0x20]
mov dword [eax + 0x2c], ecx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00406e44
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.005bb105
lea esp, [ebp + 0x20c]
pop ebp
ret
Function at 0x45a51a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov esi, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x45a54d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x45a54d
push dword [esi + 0xc]
push eax
call fcn.004aa78e
mov edx, dword [ebp - 4]
xor eax, eax
or eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45a860
Capabilities:
Get disk information

Disassembly:
push ebp
sub esp, 0x660
lea ebp, [esp - 4]
mov eax, dword [0x69c24c]
xor eax, ebp
mov dword [ebp + 0x660], eax
push 0x1c
mov eax, 0x5f2a9a
call fcn.005bb14d
mov eax, dword [ebp + 0x674]
xor esi, esi
mov edi, dword [ebp + 0x66c]
mov ebx, dword [ebp + 0x670]
push eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
call fcn.0046dfff
pop ecx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x250]
push eax
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x45a9a6
cmp eax, 0x104
jae 0x45a9a1
lea eax, [ebp + 0x250]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0045a722
pop ecx
pop ecx
inc esi
mov dword [ebp - 4], esi
xor ecx, ecx
push ecx
push ecx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
push ecx
push ecx
push ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x45a955
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x285
push str.D:SOURCESMacheteMachete51_3MacheteWinNTInclude_VS2005CFile64_2.cpp
push dword [ebp - 0x10]
push str.GetVolumeInformation
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push dword [ebp - 0x18]
call fcn.0046e15b
add esp, 0x34
lea eax, [ebp + 0x250]
mov ecx, edi
push eax
call fcn.00408edd
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00406e44
jmp 0x45a9e1
test byte [ebp - 0x1c], 4
jne 0x45a984
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x45a984
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x104
lea eax, [ebp + 0x2c]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp + 0x250]
mov ecx, edi
push eax
call fcn.00408edd
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
jmp 0x45a94b
push 0x7a
pop eax
jmp 0x45a9ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x278
push str.D:SOURCESMacheteMachete51_3MacheteWinNTInclude_VS2005CFile64_2.cpp
push ebx
push str.GetFullPathName
push eax
xor esi, esi
inc esi
push esi
push dword [ebp - 0x18]
call fcn.0046e15b
add esp, 0x34
mov ecx, edi
push ebx
call fcn.00408edd
and dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x660]
xor ecx, ebp
call fcn.005bb105
lea esp, [ebp + 0x664]
pop ebp
ret
Function at 0x45ad67
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x1c
mov eax, 0x5f2b9c
call fcn.005bb14d
mov esi, ecx
xor eax, eax
lea ecx, [ebp - 0x28]
push eax
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x10], eax
call fcn.0044879c
mov dword [ebp - 4], 1
call fcn.004887ac
push eax
lea ecx, [ebp - 0x14]
call fcn.0040654d
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esi]
mov ebx, eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [edx + 0x24]
jmp 0x45ade7
cmp dword [ebp + 0x14], 0
je 0x45ae25
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, dword [ebp + 0x14]
jae 0x45ae25
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi]
lea ecx, [ebp - 0x28]
push ecx
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
call dword [eax + 0x24]
test eax, eax
je 0x45adba
mov ecx, dword [ebp + 8]
push 0x60bba8
call fcn.00408edd
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00406e44
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004487e9
mov eax, dword [ebp + 8]
call fcn.005bb116
ret 0x14
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call fcn.0045a075
pop ecx
pop ecx
mov dword [ebp - 0x10], 1
jmp 0x45adff

Function at 0x45b132
Capabilities:
Delete file

Disassembly:
push 0x10
mov eax, 0x5f2cf1
call fcn.005bb14d
xor edi, edi
lea eax, [ebp - 0x10]
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x18], edi
push eax
call fcn.0045a860
add esp, 0xc
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x45b178
mov ecx, dword [ebp + 8]
push 0x60bba8
call fcn.00408edd
mov dword [ebp - 0x18], ebx
jmp 0x45b1ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push edi
push edi
push edi
mov esi, eax
lea eax, [ebp - 0x1c]
push edi
push esi
push eax
call fcn.00459f3f
add esp, 0x1c
mov byte [ebp - 4], 3
call fcn.004887ac
push eax
lea ecx, [ebp - 0x14]
call fcn.0040654d
mov byte [ebp - 4], 5
lea eax, [ebp - 0x14]
push dword [ebp - 0x1c]
push esi
push dword [ebp - 0x10]
push str.Unable_to_delete_the_file___s____system_error__lu___s_
push eax
call fcn.00406c3b
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
add esp, 0x14
push eax
call fcn.00408eaa
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00406e44
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00406e44
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00406e44
mov eax, dword [ebp + 8]
call fcn.005bb116
ret
Function at 0x4631fc
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x5f3b03
call fcn.005bb14d
mov ebx, ecx
lea esi, [ebx + 0x18]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebx + 0x14], edi
jne 0x46323c
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
push 0x4631d8
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x14], eax
test eax, eax
je 0x46323c
inc edi
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
call fcn.005bb116
ret

Function at 0x46f228
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46f23f
test al, 0x10
je 0x46f23f
xor eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x46fc67
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
push edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x46fc73
mov edi, dword [esp + 0x10]
sub esi, ecx
push edi
sar esi, 1
call fcn.0046dfff
pop ecx
cmp esi, dword [esp + 0x18]
jb 0x46fcbf
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x85
push str.D:SOURCESMacheteMachete51_3MacheteWinNTInclude_VS2005BaseRegistry.c
push ebx
push str.BaRe_ExpandSz
xor ebx, ebx
push 0x57
inc ebx
push ebx
push edi
call fcn.0046e15b
add esp, 0x34
mov eax, ebx
jmp 0x46fd8e
push ebp
lea ebp, [esi*2 + 2]
push ebp
call fcn.005c3f21
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x46fd1c
push eax
push eax
push eax
push eax
push eax
push eax
push 0x8d
push str.D:SOURCESMacheteMachete51_3MacheteWinNTInclude_VS2005BaseRegistry.c
push eax
push str.malloc
push 0xe
push 1
push edi
call fcn.0046e15b
add esp, 0x34
test edi, edi
je 0x46fd17
push ebp
push 0x60bd10
push 0xffffffffffffffff
lea ecx, [edi + 0x288]
push 0x100
push ecx
call fcn.0040c5e7
add esp, 0x14
push 0xe
pop eax
jmp 0x46fd8d
lea eax, [esi + 1]
push eax
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov esi, eax
call fcn.005c3f1c
xor ebx, ebx
inc ebx
pop ecx
cmp ebp, dword [esp + 0x1c]
jbe 0x46fd59
push 0x7a
pop esi
jmp 0x46fd68
test ebp, ebp
je 0x46fd63
xor eax, eax
mov esi, eax
jmp 0x46fd8b
test esi, esi
cmove esi, ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x9c
push str.D:SOURCESMacheteMachete51_3MacheteWinNTInclude_VS2005BaseRegistry.c
push eax
push str.ExpandEnvironmentStrings
push esi
push ebx
push edi
call fcn.0046e15b
add esp, 0x34
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47016e
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x210
mov eax, dword [0x69c24c]
xor eax, esp
mov dword [esp + 0x20c], eax
mov ecx, dword [esp + 0x220]
mov eax, dword [esp + 0x21c]
push ebx
push ebp
mov ebp, dword [esp + 0x220]
push esi
mov esi, dword [esp + 0x220]
push ecx
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push ebp
mov ebx, eax
call fcn.0046dfff
pop ecx
test ebx, ebx
je 0x47020d
push edi
push dword [esp + 0x10]
lea eax, [esp + 0x20]
mov ecx, 0x80
push dword [esp + 0x18]
lea edi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00471ccb
xor eax, eax
push eax
push eax
push eax
push eax
push dword [esp + 0x34]
lea eax, [esp + 0x3c]
push 2
push 0x165
push str.D:SOURCESMacheteMachete51_3MacheteWinNTInclude_VS2005BaseRegistry.c
push eax
push str.RegDeleteKey
push ebx
push 1
push ebp
call fcn.0046e15b
add esp, 0x40
pop edi
mov ecx, dword [esp + 0x218]
mov eax, ebx
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005bb105
add esp, 0x210
ret
Function at 0x48c85c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x48c8a1
call fcn.00496f4c
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x48c8a1
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x48c8bd
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0048a0a8
mov ebx, eax
test edi, edi
je 0x48c8bb
test esi, esi
je 0x48c8bb
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x48d588
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x48d646
cmp dword [esi + 0x20], 0
je 0x48d646
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x48d646
cmp dword [ebp + 8], 0
je 0x48d646
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.00496f4c
push 0x6272f0
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x48d617
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp + 8]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x48d646
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.004af832
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x48d637
test edi, edi
je 0x48d637
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x48d642
mov ecx, esi
call fcn.0048d352
mov eax, ebx
jmp 0x48d648
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x491de2
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x608433
call fcn.005bb14d
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x74], esi
jne 0x491e08
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x491e5c
call fcn.004887ac
push eax
lea ecx, [ebp - 0x10]
call fcn.0040654d
mov ecx, dword [edi + 0x74]
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 4], esi
mov eax, dword [ecx]
call dword [eax + 0x8c]
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
call fcn.005cab0f
push eax
call fcn.004069cf
add esp, 0x14
test edi, edi
je 0x491e4f
push edi
call fcn.005cab7e
pop ecx
mov esi, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00406e44
mov eax, esi
call fcn.005bb116
ret 8
Function at 0x4925aa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x4925d5
cmp dword [ebx + 0x80], 0
jne 0x4925d5
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.00496f4c
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.00492842
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x49260f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00496f4c
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x492646
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00492667
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8