joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473024
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x47308e
mov eax, ebx
call fcn.00475338
test al, al
jne 0x47308e
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405444
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x47307b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x47309b
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004053a8
jmp 0x47309b
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004053a8
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x47445c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4744ca
mov eax, esi
call fcn.0045da84
test al, al
je 0x4744ca
mov eax, dword [ebx + 0x84]
call fcn.0045d6d4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4744ca
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x4744be
push 0
mov eax, dword [ebx + 0x84]
call fcn.0045d6d4
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00455544
jmp 0x4744ca
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00474298
pop esi
pop ebx
ret

Function at 0x47a458
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47a5c9
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47a5a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.0040553c
lea eax, [ebp - 0x118]
mov edx, 0x47a5e0
call fcn.00405620
mov eax, dword [ebp - 0x118]
call fcn.004057e4
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x47a516
lea eax, [ebp - 0x111]
call fcn.0040ade8
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.00405444
jmp 0x47a51d
mov eax, esi
call fcn.00405354
cmp bl, 0x61
jae 0x47a53e
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0040ef7c
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.004053a8
jmp 0x47a558
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0040eee8
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.004053a8
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x47a5ec
call fcn.0040b518
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.004053a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a5ab
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x47fc14
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004057d4
xor eax, eax
push ebp
push 0x47fc72
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.0047fcf0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x47fc5a
lea eax, [ebp - 4]
call fcn.0047fcf0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x47fc5c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fc79
lea eax, [ebp - 4]
call fcn.00405354
ret

Function at 0x47fc80
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004057d4
xor eax, eax
push ebp
push 0x47fce4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.0047fcf0
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.0040b028
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fceb
lea eax, [ebp - 4]
call fcn.00405354
ret

Function at 0x4802a4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004057d4
xor eax, eax
push ebp
push 0x48039d
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [esi + 4]
mov word [ebx + 4], ax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.0047f9a4
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
movzx eax, word [esi + 0x20]
mov word [ebx + 0x22], ax
movzx eax, word [esi + 0x22]
mov word [ebx + 0x24], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040abcc
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00480c74
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040aa8c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00480cec
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4803a4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405378
ret
Function at 0x4803ac
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004057d4
xor eax, eax
push ebp
push 0x4804b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
movzx eax, word [esi + 4]
mov word [ebx + 6], ax
movzx eax, word [esi + 6]
mov word [ebx + 8], ax
movzx eax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.0047f9a4
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
movzx eax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
movzx eax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x48047b
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040abcc
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00480c74
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040aa8c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00480cec
jmp 0x48048d
xor edx, edx
mov eax, ebx
call fcn.00480c74
xor edx, edx
mov eax, ebx
call fcn.00480cec
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4804bc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405378
ret

Function at 0x486da4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.00486fe0
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.00486fe0
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x486e18
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x486e3e
inc esi
mov eax, edi
call fcn.00486dfc
xor byte [ebx], al
movzx edx, byte [ebx]
mov eax, edi
call fcn.00486da4
inc ebx
dec esi
jne 0x486e27
pop edi
pop esi
pop ebx
ret
Function at 0x486ed4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004057d4
xor eax, eax
push ebp
push 0x486f4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00486e44
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.00486dfc
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.00486da4
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x486f14
movzx ebx, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486f51
lea eax, [ebp - 4]
call fcn.00405354
ret
Function at 0x487be4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x487dca
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x487d86
mov eax, dword [ebp - 4]
call fcn.0048958c
cmp ebx, eax
jge 0x487d86
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.0047e388
mov edx, dword [0x47fd44]
call fcn.004046b8
mov esi, eax
mov eax, esi
call fcn.00480c08
test al, al
je 0x487d7c
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x487d70
xor eax, eax
push ebp
push 0x487d69
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0048819c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041dbe4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00405a74
mov eax, dword [ebp - 8]
call fcn.00405844
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx eax, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00487f60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
movzx edx, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487db4
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x487d68
mov eax, dword [ebp - 4]
call fcn.00488220
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040b028
jmp 0x487db4
mov eax, dword [ebp - 8]
call fcn.00405354
jmp 0x487db4
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040a414
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x418e48]
call fcn.0040e104
call fcn.00404d7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487dd1
lea eax, [ebp - 0x54]
call fcn.00405354
ret
Function at 0x48ce78
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x408428]
call fcn.00405e7c
xor eax, eax
push ebp
push 0x48d019
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a5fa8], 0
jne 0x48ced3
mov ecx, dword [0x52b828]
mov dl, 1
mov eax, dword [0x408a94]
call fcn.0040e184
call fcn.00404d7c
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403afc
mov eax, ebx
call fcn.00405cec
mov dword [ebp - 0x24], eax
mov esi, 0x48d028
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406fa0
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405cfc
test eax, eax
jle 0x48cfbc
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48cfa8
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004055c4
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x48cf4e
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.004055dc
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x48cf64
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.004055dc
mov eax, dword [ebp - 0x54]
call fcn.004057e4
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004055c4
mov eax, dword [ebp - 0x58]
call fcn.004057e4
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x48cfaa
xor eax, eax
test al, al
je 0x48cfb5
mov ebx, 0x15
jmp 0x48cfc1
mov ebx, 0x10
jmp 0x48cfc1
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4a5fa8]
call fcn.0048ccf8
mov eax, dword [ebp - 4]
call fcn.0048ccf8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406fb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d020
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00405378
lea eax, [ebp - 0xc]
mov edx, dword [0x408428]
call fcn.00405f4c
ret

Function at 0x494e3c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403afc
ret
Function at 0x495228
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
xor edx, edx
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x4953ec
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x495400
call fcn.00495090
lea eax, [ebp - 0x3f0]
call fcn.00405354
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.004057e4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4953ad
xor eax, eax
push ebp
push 0x4953a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x3e9
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
push 0x495438
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x495302
push ebp
mov eax, 0x495454
call fcn.00495180
pop ecx
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x495460
call fcn.00495090
mov eax, dword [ebp - 0x408]
call fcn.004057e4
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x49538c
push dword [ebp - 0x3f0]
push 0x495484
lea eax, [ebp - 0x40c]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.004055c4
push dword [ebp - 0x40c]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.004056e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4953ad
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.004053a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4953f3
lea eax, [ebp - 0x40c]
mov edx, 2
call fcn.00405378
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.00405378
ret
Function at 0x4998c8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004057d4
xor eax, eax
push ebp
push 0x499a03
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4999d3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004057e4
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040a638
test al, al
jne 0x499943
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00403858
lea eax, [ebp - 0x1d0]
call fcn.004035f4
call fcn.00403090
push dword [0x530f6c]
push 0x499a1c
push dword [0x530f70]
push 0x499a1c
push dword [0x530f74]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.004056e8
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.0049e10c
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00405b04
call fcn.00403f50
call fcn.00403090
lea eax, [ebp - 0x1d0]
call fcn.00403920
call fcn.00403090
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4999dd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499a0a
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.00405378
lea eax, [ebp - 4]
call fcn.00405354
ret
Function at 0x49a368
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004057d4
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x49a4d0
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.00499d44
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00499d64
mov ebx, eax
jmp 0x49a4a2
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004055c4
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040abcc
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004098a4
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004098a4
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.0040577c
je 0x49a482
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004055c4
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004098a4
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004098a4
mov edx, dword [ebp - 0x148]
pop eax
call fcn.0040577c
jne 0x49a497
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.00499d84
mov ebx, eax
test ebx, ebx
jne 0x49a3e3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a4d7
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00405378
lea eax, [ebp - 4]
call fcn.00405354
ret
Function at 0x49a87f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x49a8d9
mov eax, ebx
add eax, dword [eax + 0x3c]
mov edi, dword [eax + 0x78]
add edi, ebx
xor esi, esi
jmp 0x49a8d4
mov eax, dword [edi + 0x20]
lea edx, [ebx + eax]
mov eax, dword [edx + esi*4]
add eax, ebx
push dword [ebp + 0xc]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x49a8d3
mov edx, dword [edi + 0x24]
lea ecx, [ebx + edx]
mov ax, word [ecx + esi*2]
movzx edx, ax
mov ecx, dword [edi + 0x1c]
lea eax, [ebx + ecx]
mov eax, dword [eax + edx*4]
add eax, ebx
mov dword [ebp - 4], eax
inc esi
cmp esi, dword [edi + 0x18]
jb 0x49a8a0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret