joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452078
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x47581c]
cmp byte [eax + 0x95], 0
jne 0x4520ef
cmp dword [0x475838], 0
jne 0x4520ad
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x452034
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x475838], eax
cmp dword [0x475834], 0
jne 0x4520c8
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x475834], eax
cmp dword [0x47583c], 0
jne 0x4520ef
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x451fd4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x47583c], eax
pop ecx
pop ebp
ret

Function at 0x4521b8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.00452150
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4521d9
xor eax, eax
call fcn.00452188
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 9], 0
je 0x4521f3
mov al, 1
call fcn.00452188
mov esp, ebp
pop ebp
ret

Function at 0x45280c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x47581c]
cmp dword [eax + 0x24], 0
je 0x4528d3
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
jne 0x4528ca
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 5]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x14]
push eax
push 0x45278c
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
cmp dword [eax + 8], 0
je 0x4528ca
push 3
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x14], eax
push 0xffffffffffffffec
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x452887
mov dword [ebp - 0x14], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x4528ca
mov dword [ebp - 0xc], eax
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
call fcn.00411cc4
push eax
call sub.user32.dll_SetWindowPos
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x45289c
mov eax, dword [ebp - 4]
inc dword [eax + 0x84]
mov esp, ebp
pop ebp
ret

Function at 0x453458
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x94], 0
je 0x45349d
push pe_nt_image_headers32
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 8]
call fcn.004044b0
jmp 0x4534ab
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x7c]
call fcn.0040441c
mov esp, ebp
pop ebp
ret
Function at 0x454518
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x74], 0
je 0x45455f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
call fcn.00437774
test al, al
je 0x45455f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
call fcn.004372b0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45455f
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
call fcn.004372b0
push eax
call sub.user32.dll_ShowWindow
pop ecx
pop ebp
ret

Function at 0x457e68
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, 0x4758b0
mov edx, dword [esi]
mov eax, ebx
call fcn.00458b44
mov edi, eax
mov dword [esi], edi
and edi, 0xff
add dword [esi + 4], edi
imul ebx, dword [esi + 4], 0x8088405
inc ebx
mov dword [esi + 4], ebx
mov eax, ebx
call fcn.00407b34
call fcn.00407b38
mov edx, dword [esi + 8]
call fcn.00458b44
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret

Function at 0x457f5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.00404824
xor eax, eax
push ebp
push 0x458025
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 0
cmp dword [ebp + 8], 0
je 0x45800f
mov eax, dword [ebp + 8]
call fcn.00457eb0
mov al, byte [ebp - 1]
dec eax
test al, al
jb 0x457fd2
inc eax
mov byte [ebp - 4], al
mov bl, 0
call fcn.00457e48
xor edx, edx
mov dl, bl
xor ecx, ecx
mov cl, byte [ebp - 1]
add edx, ecx
xor al, byte [esi + edx]
mov byte [ebp - 3], al
mov al, byte [ebp - 3]
call fcn.00457e68
xor eax, eax
mov al, bl
mov dl, byte [ebp - 3]
mov byte [esi + eax], dl
inc ebx
dec byte [ebp - 4]
jne 0x457fa4
xor eax, eax
mov al, byte [ebp - 1]
mov bl, byte [esi + eax - 1]
and di, 8
cmp di, 8
je 0x457ffc
mov eax, dword [ebp + 0x10]
call fcn.00407b34
call fcn.00407b38
cmp bl, al
jne 0x45800f
mov byte [ebp - 2], 1
jmp 0x45800f
xor eax, eax
mov al, bl
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
jne 0x45800f
mov byte [ebp - 2], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45802c
lea eax, [ebp + 8]
call fcn.004043c8
ret

Function at 0x458710
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00404834
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
test esi, esi
je 0x458739
cmp ebx, 0xffffffff
je 0x458734
and ebx, 0x10
cmp ebx, 0x10
je 0x458739
xor eax, eax
pop esi
pop ebx
ret
mov al, 1
pop esi
pop ebx
ret

Function at 0x458fe4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
test edx, edx
jle 0x45900e
mov ebx, dword [ecx]
movzx esi, byte [eax]
xor ebx, esi
and ebx, 0xff
movzx ebx, word [ebx*2 + 0x47309c]
mov esi, dword [ecx]
shr esi, 8
xor ebx, esi
mov dword [ecx], ebx
inc eax
dec edx
test edx, edx
jg 0x458fea
pop esi
pop ebx
ret
Function at 0x459358
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404824
xor eax, eax
push ebp
push 0x45942a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x459405
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404670
test eax, eax
jle 0x4593ea
push pe_nt_image_headers32
lea eax, [ebx + 0x10d]
push eax
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 4]
push eax
push ebx
push pe_nt_image_headers32
lea eax, [ebx + 0xc]
push eax
lea eax, [ebp - 0x10]
mov ecx, 0x459444
mov edx, dword [ebp - 4]
call fcn.004046bc
mov eax, dword [ebp - 0x10]
call fcn.00404834
push eax
call sub.kernel32.dll_GetVolumeInformationA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
jmp 0x4593ee
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45940c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x4596c4
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404824
xor eax, eax
push ebp
push 0x4597a4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [esi + 0x78], 4
jne 0x4596fd
mov byte [ebp - 5], 1
jmp 0x459786
mov eax, ebx
xor ecx, ecx
mov edx, 0x18
call fcn.00403238
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45977f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 4]
push eax
push ebx
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0045853c
mov eax, dword [ebp - 0x10]
call fcn.00404834
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
mov eax, dword [ebx + 4]
imul dword [ebx]
imul dword [ebx + 8]
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 4]
imul dword [ebx]
imul dword [ebx + 0xc]
mov dword [ebx + 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459786
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4597ab
lea eax, [ebp - 0x10]
call fcn.004043c8
lea eax, [ebp - 4]
call fcn.004043c8
ret
Function at 0x4598b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404824
xor eax, eax
push ebp
push 0x45991b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404670
test eax, eax
jle 0x4598fe
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0045853c
mov eax, dword [ebp - 8]
call fcn.00404834
push eax
call sub.kernel32.dll_GetDriveTypeA
mov ebx, eax
jmp 0x459900
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459922
lea eax, [ebp - 8]
mov edx, 2
call fcn.004043ec
ret

Function at 0x45b0a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff10
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xf0]
mov edx, dword [ebp + 0xc]
call fcn.00409b74
push eax
lea eax, [ebp - 0xa0]
mov edx, edi
call fcn.00409b74
push eax
lea eax, [ebp - 0x50]
mov edx, esi
call fcn.00409b74
push eax
push 0
push ebx
call sub.shell32.dll_ShellExecuteA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45d538
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
test dl, dl
je 0x45d5ae
mov al, byte [ebx + 0x48]
add al, 0xf9
sub al, 2
jb 0x45d578
sub al, 2
jb 0x45d55b
sub al, 3
je 0x45d55b
add al, 0xf4
sub al, 2
jae 0x45d5ae
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
jle 0x45d5ae
call fcn.00457e48
xor byte [esi], al
mov al, byte [esi]
call fcn.00457e68
inc esi
dec edi
jne 0x45d564
jmp 0x45d5ae
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
jle 0x45d5ae
movzx eax, word [ebx + 0x4a]
mov edx, dword [ebx + 0x38]
mov al, byte [edx + eax - 1]
xor byte [esi], al
mov eax, dword [ebx + 0x38]
call fcn.00404670
movzx edx, word [ebx + 0x4a]
cmp eax, edx
jne 0x45d5a6
mov word [ebx + 0x4a], 1
jmp 0x45d5aa
inc word [ebx + 0x4a]
inc esi
dec edi
jne 0x45d581
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4655e4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404824
xor eax, eax
push ebp
push 0x46576e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x465740
lea edx, [ebp - 0x154]
mov eax, dword [ebp - 4]
call fcn.00465590
mov edx, dword [ebp - 0x154]
lea eax, [ebp - 4]
call fcn.00404460
lea eax, [ebp - 0x150]
xor ecx, ecx
mov edx, 0x140
call fcn.00403238
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x158]
mov ecx, 0x465784
mov edx, dword [ebp - 4]
call fcn.004046bc
mov eax, dword [ebp - 0x158]
call fcn.00404834
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x465740
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x124]
call fcn.00409d04
test byte [ebp - 0x150], 0x10
je 0x4656f9
cmp byte [ebp - 5], 0
je 0x46571f
mov eax, dword [ebp - 0xc]
mov edx, 0x465794
call fcn.00404780
je 0x46571f
mov eax, dword [ebp - 0xc]
mov edx, 0x4657a0
call fcn.00404780
je 0x46571f
push dword [ebp - 4]
push 0x4657ac
push dword [ebp - 0xc]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.00404730
mov eax, dword [ebp - 0x15c]
call fcn.004657b0
jmp 0x46571f
push dword [ebp - 4]
push 0x4657ac
push dword [ebp - 0xc]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.00404730
mov eax, dword [ebp - 0x160]
call fcn.00409510
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x465696
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465775
lea eax, [ebp - 0x160]
mov edx, 4
call fcn.004043ec
lea eax, [ebp - 0xc]
call fcn.004043c8
lea eax, [ebp - 4]
call fcn.004043c8
ret
Function at 0x4657cc
Capabilities:
Get disk information
Get disk size
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
xor eax, eax
push ebp
push 0x4658c7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x3c]
mov dword [0x4734b0], eax
mov eax, dword [ebp - 0x24]
mov dword [0x4734b8], eax
xor eax, eax
mov dword [0x4734b4], eax
call sub.kernel32.dll_GetLogicalDrives
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0x1f
ja 0x465821
bt dword [ebp - 0x1c], eax
jae 0x46589f
mov al, byte [ebp - 0x18]
add al, 0x61
mov byte [ebp - 0x11], al
lea eax, [ebp - 0x44]
mov dl, byte [ebp - 0x11]
call fcn.00404598
lea eax, [ebp - 0x44]
mov edx, 0x4658dc
call fcn.00404678
mov eax, dword [ebp - 0x44]
call fcn.00404834
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x46589f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x48]
mov dl, byte [ebp - 0x11]
call fcn.00404598
lea eax, [ebp - 0x48]
mov edx, 0x4658dc
call fcn.00404678
mov eax, dword [ebp - 0x48]
call fcn.00404834
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
mov eax, dword [ebp - 4]
cmp eax, dword [0x4734b4]
jbe 0x46589f
mov eax, dword [ebp - 4]
mov dword [0x4734b4], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1a
jne 0x465815
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4658ce
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004043ec
ret

Function at 0x469030
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
and edx, edx
je 0x46904d
jcxz 0x46904d
push ebx
movzx ebx, al
xor bl, byte [edx]
shr eax, 8
xor eax, dword cs:[ebx*4 + 0x46904e]
inc edx
dec ecx
jne 0x469038
pop ebx
ret
Function at 0x46b620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 4]
add eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
add eax, 8
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
add eax, 0xc
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4 + 0xc]
shl eax, 0x18
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [edx + ecx*4 + 0xc]
shr edx, 8
or eax, edx
mov dword [ebp - 0x14], eax
xor eax, eax
mov al, byte [ebp - 0x14]
mov eax, dword [eax*4 + 0x473b64]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
shr eax, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x473b64]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x473b64]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
shr eax, 0x18
and eax, 0xff
mov eax, dword [eax*4 + 0x473b64]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
shl eax, 8
mov edx, dword [ebp - 0x1c]
shr edx, 0x18
or eax, edx
xor eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
shl edx, 0x10
mov ecx, dword [ebp - 0x20]
shr ecx, 0x10
or edx, ecx
xor eax, edx
mov edx, dword [ebp - 0x24]
shl edx, 0x18
mov ecx, dword [ebp - 0x24]
shr ecx, 8
or edx, ecx
xor eax, edx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4]
mov edx, dword [ebp - 0x10]
xor eax, dword [edx*4 + 0x4736e8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x10], eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4 + 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4 + 0x10]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x14], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4 + 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4 + 0x14]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [eax + edx*4 + 0xc]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4 + 0x18]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + ecx*4 + 0x1c], eax
add dword [ebp - 0xc], 4
cmp dword [ebp - 0xc], 0x28
jl 0x46b66c
mov esp, ebp
pop ebp
ret
Function at 0x46ed30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404824
mov eax, dword [ebp - 8]
call fcn.00404824
mov eax, dword [ebp - 0xc]
call fcn.00404824
xor eax, eax
push ebp
push 0x46eedd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov ecx, 0x46eef4
mov edx, dword [ebp - 4]
call fcn.004046bc
lea eax, [ebp - 0x18]
mov ecx, 0x46eef4
mov edx, dword [ebp - 8]
call fcn.004046bc
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x1c]
mov edx, 0x40
mov eax, dword [ebp - 0xc]
call fcn.0046eb88
mov eax, dword [ebp - 0x14]
call fcn.00465534
test al, al
je 0x46edd1
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.0046ef3c
mov eax, dword [ebp - 0x14]
call fcn.00404834
push eax
call sub.kernel32.dll_DeleteFileA
mov byte [ebp - 0xd], 1
lea eax, [ebp - 0x14]
mov ecx, 0x46ef08
mov edx, dword [ebp - 4]
call fcn.004046bc
lea eax, [ebp - 0x18]
mov ecx, 0x46ef08
mov edx, dword [ebp - 8]
call fcn.004046bc
mov eax, dword [ebp - 0x14]
call fcn.00465534
test al, al
je 0x46ee1d
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.0046ef3c
mov eax, dword [ebp - 0x14]
call fcn.00404834
push eax
call sub.kernel32.dll_DeleteFileA
mov byte [ebp - 0xd], 1
lea eax, [ebp - 0x14]
mov ecx, 0x46ef1c
mov edx, dword [ebp - 4]
call fcn.004046bc
lea eax, [ebp - 0x18]
mov ecx, 0x46ef1c
mov edx, dword [ebp - 8]
call fcn.004046bc
mov eax, dword [ebp - 0x14]
call fcn.00465534
test al, al
je 0x46ee69
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.0046ef3c
mov eax, dword [ebp - 0x14]
call fcn.00404834
push eax
call sub.kernel32.dll_DeleteFileA
mov byte [ebp - 0xd], 1
lea eax, [ebp - 0x14]
mov ecx, 0x46ef30
mov edx, dword [ebp - 4]
call fcn.004046bc
lea eax, [ebp - 0x18]
mov ecx, 0x46ef30
mov edx, dword [ebp - 8]
call fcn.004046bc
mov eax, dword [ebp - 0x14]
call fcn.00465534
test al, al
je 0x46eeb5
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.0046ef3c
mov eax, dword [ebp - 0x14]
call fcn.00404834
push eax
call sub.kernel32.dll_DeleteFileA
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46eee4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004043ec
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004043ec
ret
Function at 0x409bf0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46b10b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045fb29
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x409c72
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045da40
mov eax, dword [eax]
push 0x48e1f0
push eax
call fcn.00450674
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045fdb4
test bl, bl
je 0x409c72
push 0x48e1f0
lea ecx, [esp + 0xc]
call fcn.00460144
push 0x491d5c
lea ecx, [esp + 0xc]
call fcn.00460144
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x409cae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045fdb4
jmp 0x409d79
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x409d32
lea edx, [esp + 0x7c]
push 0x491d58
push edx
call fcn.00450674
add esp, 8
test eax, eax
je 0x409d32
lea eax, [esp + 0x7c]
push 0x491d54
push eax
call fcn.00450674
add esp, 8
test eax, eax
je 0x409d32
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x409cc2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045fdb4
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40a590
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40a5f2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc