joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00416e52
and dword [ebp - 0x14], 0
cmp dword [0x46d558], 0
mov dword [ebp - 0x18], eax
jne 0x41fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46d558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46d55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46d560], eax
call edi
push eax
call esi
mov dword [0x46d568], eax
test eax, eax
je 0x41fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46d564], eax
mov eax, dword [0x46d564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41fc78
cmp dword [0x46d568], ecx
je 0x41fc78
push eax
call esi
push dword [0x46d568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41fc78
test ebx, ebx
je 0x41fc78
call edi
test eax, eax
je 0x41fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41fc6f
test byte [ebp - 8], 1
jne 0x41fc78
or dword [ebp + 0x10], 0x200000
jmp 0x41fcab
mov eax, dword [0x46d55c]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41fcab
mov eax, dword [0x46d560]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46d558]
call esi
test eax, eax
je 0x41fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004113cb
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x424d00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x43be48
push 0x434cb0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x442f9c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
cmp dword [0x4435b4], 0
jne 0x424ddb
mov eax, dword [0x4435b0]
test eax, eax
jne 0x424ddb
mov ecx, dword [0x4435bc]
test ecx, ecx
je 0x424d78
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x4435b0]
mov ecx, dword [0x4435bc]
test eax, eax
jne 0x424ddb
test ecx, ecx
jne 0x424d89
call fcn.00424ea0
test eax, eax
je 0x424d9c
lea eax, [ebp - 0x20]
push eax
push dword [section..data]
call fcn.00424bd0
test eax, eax
jne 0x424ddb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x424dd1
cmp eax, 0x7e
je 0x424dd1
cmp eax, 0x78
je 0x424dd1
cmp eax, 1
je 0x424dd1
cmp eax, 0x32
je 0x424dd1
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
invalid
add eax, 0x4435b0

Function at 0x425520
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d930
add esp, 8
test eax, eax
jne 0x425543
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x18
push esi
push dword [ebp + 0x14]
call fcn.00429c50
add esp, 4
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.0042dd50
push dword [ebp + 0x18]
lea ecx, [ebp - 0x14]
push esi
call fcn.0042e8f0
test al, al
jne 0x42557f
lea ecx, [ebp - 0x14]
mov esi, 1
call fcn.0042df70
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push dword [ebp + 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4255ad
push dword [ebp + 0x1c]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
xor esi, esi
call fcn.0042df70
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x423937
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x423965
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x423983
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004238a1
jmp 0x423983
mov eax, dword [esi + 0x14]
test eax, eax
je 0x423983
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004238a1
test edi, edi
mov eax, edi
jne 0x42396d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x438c24]
test ecx, ecx
je 0x423a36
jmp 0x423936
ret 8
Function at 0x420d08
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x420d59
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x420d40
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x420d30
jmp 0x420d59
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x420d41
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e9b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x45ea33
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, esi
call fcn.004049d0
mov edi, eax
push edi
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
test ebx, ebx
jg 0x45e9f7
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
call fcn.00404564
jmp 0x45ea1d
mov edx, ebx
dec edx
lea eax, [ebp - 8]
call fcn.00404b5c
push ebx
mov eax, dword [ebp - 8]
call fcn.004049d0
push eax
push edi
call sub.kernel32.dll_GetEnvironmentVariableA
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00404564
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ea3a
lea eax, [ebp - 8]
call fcn.00404510
ret

Function at 0x463630
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 0x202
call sub.WS2_32.DLL_WSAStartup
test eax, eax
je 0x46365b
mov ecx, 0x46366c
mov dl, 1
mov eax, dword [0x4076f4]
call fcn.0040c45c
call fcn.00403ea0
add esp, 0x190
ret
Function at 0x47a674
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x47a661
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x47a67f
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
add byte [ebp + 0xf8c784], cl
add byte [eax], al
add byte [ebp + 0xf8c784], cl
add byte [eax], al
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x47a6dd
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x47a6c4
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x47a6cd
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x47a6d7
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x47a6b9
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x47a643
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x47a72a
dec eax
je 0x47a721
sub eax, 3
je 0x47a718
mov dword [ebp - 4], 0x40
jmp 0x47a747
mov dword [ebp - 4], 4
jmp 0x47a72d
mov dword [ebp - 4], 0x20
jmp 0x47a72d
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x47a779
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x47a6f9
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00479f8a
imul edi, esi, 0x31
pop ebp
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x47a785
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x47aba8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
invalid
invalid
Function at 0x448850
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x10
cmp word [0x59af18], 1
push ebx
push esi
push edi
jne 0x44888e
mov eax, dword [ecx + 8]
mov edx, dword [ecx]
mov ebx, dword [ecx + 4]
mov esi, dword [ecx + 0x10]
mov edi, dword [ecx + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x10], eax
jmp 0x448991
movzx edx, byte [ecx + 3]
movzx eax, byte [ecx + 2]
movzx ebx, byte [ecx + 7]
movzx esi, byte [ecx + 0xb]
shl edx, 8
or edx, eax
shl esi, 8
movzx eax, byte [ecx + 1]
shl edx, 8
or edx, eax
shl ebx, 8
movzx eax, byte [ecx]
shl edx, 8
or edx, eax
movzx edi, byte [ecx + 0x17]
movzx eax, byte [ecx + 6]
or ebx, eax
shl edi, 8
movzx eax, byte [ecx + 5]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 4]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 0xa]
or esi, eax
movzx eax, byte [ecx + 9]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 8]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0xe]
mov dword [ebp - 4], esi
movzx esi, byte [ecx + 0xf]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0xd]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0xc]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0x12]
mov dword [ebp - 8], esi
movzx esi, byte [ecx + 0x13]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0x11]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0x10]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 0x16]
or edi, eax
movzx eax, byte [ecx + 0x15]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x14]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x1a]
mov dword [ebp - 0xc], edi
movzx edi, byte [ecx + 0x1b]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x19]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x18]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x1e]
mov dword [ebp - 0x10], edi
movzx edi, byte [ecx + 0x1f]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x1d]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 0x1c]
shl edi, 8
or edi, eax
mov ecx, dword [ebp + 8]
mov eax, edx
and eax, 0x3ffffff
shr edx, 0x1a
mov dword [ecx], eax
mov eax, ebx
shl eax, 6
or edx, eax
shr ebx, 0x13
and edx, 0x1ffffff
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov eax, edx
shl eax, 0xd
or eax, ebx
shr edx, 0xd
mov ebx, dword [ebp - 8]
and eax, 0x3ffffff
mov dword [ecx + 8], eax
mov eax, ebx
shl eax, 0x13
or eax, edx
shr ebx, 6
mov edx, dword [ebp - 0xc]
and eax, 0x1ffffff
mov dword [ecx + 0xc], eax
mov eax, esi
and eax, 0x1ffffff
shr esi, 0x19
mov dword [ecx + 0x14], eax
mov eax, edx
shl eax, 7
or esi, eax
mov dword [ecx + 0x10], ebx
mov ebx, dword [ebp - 0x10]
and esi, 0x3ffffff
mov eax, ebx
shr edx, 0x13
shl eax, 0xd
or eax, edx
shr ebx, 0xc
and eax, 0x1ffffff
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x1c], eax
mov eax, edi
shl eax, 0x14
or eax, ebx
shr edi, 6
and eax, 0x3ffffff
and edi, 0x1ffffff
mov dword [ecx + 0x24], edi
pop edi
pop esi
mov dword [ecx + 0x20], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d420
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x48], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0xf3bcc908
mov dword [eax + 0xc], 0x6a09e667
mov dword [eax + 0x10], 0x84caa73b
mov dword [eax + 0x14], 0xbb67ae85
mov dword [eax + 0x18], 0xfe94f82b
mov dword [eax + 0x1c], 0x3c6ef372
mov dword [eax + 0x20], 0x5f1d36f1
mov dword [eax + 0x24], 0xa54ff53a
mov dword [eax + 0x28], 0xade682d1
mov dword [eax + 0x2c], 0x510e527f
mov dword [eax + 0x30], 0x2b3e6c1f
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x38], 0xfb41bd6b
mov dword [eax + 0x3c], 0x1f83d9ab
mov dword [eax + 0x40], 0x137e2179
mov dword [eax + 0x44], 0x5be0cd19
xor eax, eax
pop ebp
ret
Function at 0x456100
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 2
xor edi, edi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
test esi, esi
je 0x4561ef
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0xa
push str.STEAM_SPLIT_GUID
push esi
call ebx
mov ecx, eax
test ecx, ecx
je 0x456169
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x456169
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x456169
mov edx, dword [ebp + 0x10]
mov edi, 1
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
push 0xa
push str.STEAM_GUIDD
push esi
call ebx
test eax, eax
je 0x4561a8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4561a8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4561a8
mov edx, dword [ebp + 0xc]
inc edi
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
push 0xa
push str.STEAM_MINSTANCE
push esi
call ebx
pop ebx
test eax, eax
je 0x4561e8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4561e8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4561e8
mov edx, dword [ebp + 0x14]
inc edi
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, 3
pop edi
sete al
pop esi
pop ebp
ret
Function at 0x457f40
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x114
mov ecx, dword [0x6abc48]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x62d0d0]
cmp eax, dword [ecx + 4]
jg 0x458088
mov eax, dword [0x62d0cc]
test eax, eax
jne 0x457f7b
mov eax, 1
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0
push ebx
push edi
push esi
call eax
test eax, eax
je 0x45807f
lea eax, [ebp - 8]
push eax
mov eax, ebx
or eax, 0x20019
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x457fbf
xor ecx, ecx
cmp eax, 2
pop edi
pop esi
cmove eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x457fc4
sub ecx, edx
cmp byte [ecx + edi - 1], 0x5c
lea esi, [ecx + edi]
je 0x457fdd
mov byte [esi], 0x5c
inc esi
mov byte [esi], al
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x45805e
jmp 0x458010
push 0x104
lea eax, [ebp - 0x114]
push eax
push esi
call fcn.005764b0
push ebx
push edi
push dword [ebp + 8]
call fcn.00457f40
add esp, 0x18
test eax, eax
jne 0x45805e
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x458010
mov byte [esi - 1], 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push ebx
push edi
push dword [ebp + 8]
call dword [0x62d0cc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x62d0d0
call fcn.0056bdc6
add esp, 4
cmp dword [0x62d0d0], 0xffffffff
jne 0x457f69
push str.RegDeleteKeyExA
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x62d0d0
mov dword [0x62d0cc], eax
call fcn.0056bd75
add esp, 4
jmp 0x457f69
Function at 0x4596d0
Capabilities:
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x590945
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
push edi
push 0
push 0
push 0
lea ecx, [ebp - 0x44]
xor bl, bl
call fcn.0046b7b0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x44]
push 0
push 0
push eax
push ecx
mov eax, esp
mov dword [ebp - 4], 0
mov dword [eax], esi
call fcn.00472390
add esp, 0x10
test al, al
je 0x459916
push 0
lea ecx, [ebp - 0x44]
call fcn.0046c4a0
push 0
push 0
call fcn.00579a2c
add esp, 8
mov dword [ebp + 8], eax
test esi, esi
mov dword [ebp - 0x1c], 0
mov ecx, 0x593544
mov dword [ebp - 0x18], 0
cmovne ecx, esi
mov dword [ebp - 0x14], 0x4000000
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00459950
push 0
push eax
push 0
call fcn.005769e4
add esp, 0xc
mov byte [ebp - 4], 0
cmp byte [ebp - 0x14], 0
mov edi, eax
je 0x459790
push dword [ebp - 0x20]
call fcn.0056baf4
add esp, 4
cmp byte [ebp - 0x13], 0
je 0x4597a1
push dword [ebp - 0x1c]
call fcn.0056baf4
add esp, 4
cmp byte [ebp - 0x12], 0
je 0x4597b2
push dword [ebp - 0x18]
call fcn.0056baf4
add esp, 4
cmp dword [ebp + 8], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0x4000000
je 0x459905
test edi, edi
je 0x459905
push 0x5c
push edi
call fcn.0056dfa7
add esp, 8
test eax, eax
je 0x459905
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ecx, ecx
push edi
mov word [eax], cx
call esi
push edi
push str.INSTALLDIR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov al, byte [ebp + 0x10]
mov ecx, 0x628070
mov word [0x62808c], 0x3000
mov dword [0x628084], 0
mov byte [0x62808c], al
mov eax, dword [ebp + 0xc]
mov word [0x6280cd], 0
mov byte [0x6280cf], 0
mov dword [0x628088], 0
mov dword [0x628104], 0
mov dword [0x628100], 0
mov dword [0x628084], eax
call fcn.004588d0
mov eax, dword [0x628084]
mov ecx, 0x628070
mov edx, dword [ebp - 0x44]
mov dword [0x628088], eax
mov eax, dword [ebp - 0x34]
add eax, edx
mov dword [0x6280ec], 0
mov dword [0x6280f0], 0
mov dword [0x6280dc], 0x62808d
mov dword [0x6280d8], 0
mov dword [0x6280e0], 0
mov dword [0x6280e4], 0
mov dword [0x6280d4], 1
mov word [0x6280d0], 0
mov dword [0x6280e8], 0
mov byte [0x62808d], 0
mov dword [0x628074], edx
mov dword [0x628078], edx
mov dword [0x62807c], eax
push 0
mov byte [0x628080], 0
call fcn.00458cf0
push dword [ebp + 8]
mov bl, al
call esi
push edi
call fcn.005765d4
push dword [ebp + 8]
call fcn.005765d4
add esp, 8
cmp dword [ebp - 0x3c], 0
mov dword [ebp - 4], 3
jl 0x45993a
cmp dword [ebp - 0x44], 0
je 0x45993a
call fcn.00480170
push 0
push dword [ebp - 0x44]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e3e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x590ced
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x14], 0x4000000
test eax, eax
mov dword [ebp - 0x1c], edi
mov ebx, 0x593544
mov dword [ebp - 0x18], edi
cmovne ebx, eax
mov dword [ebp - 0x20], ebx
cmp byte [0x62d430], 0
mov dword [ebp - 4], edi
je 0x45e473
push 4
push edi
push edi
push ebx
mov byte [ebp - 0x13], 1
call fcn.0046dcd0
mov esi, eax
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0056baeb
push 0
mov edi, eax
push esi
push edi
push ebx
mov dword [ebp - 0x1c], edi
call fcn.0046dcd0
add esp, 0x24
push 0x200030
push 0x5b13dc
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call fcn.00579ed1
add esp, 4
mov dword [ebp - 0x10], eax
test edi, edi
jne 0x45e4be
push 4
push edi
push edi
push ebx
mov byte [ebp - 0x13], 1
call fcn.0046dcd0
mov esi, eax
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0056baeb
push 0
mov edi, eax
push esi
push edi
push ebx
mov dword [ebp - 0x1c], edi
call fcn.0046dcd0
mov eax, dword [ebp - 0x10]
add esp, 0x24
push eax
push edi
call fcn.0057a014
add esp, 8
test edi, edi
jne 0x45e503
push 4
push edi
push edi
push ebx
mov byte [ebp - 0x13], 1
call fcn.0046dcd0
mov esi, eax
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0056baeb
push 0
mov edi, eax
push esi
push edi
push ebx
mov dword [ebp - 0x1c], edi
call fcn.0046dcd0
add esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x62d748], 0
je 0x45e5bf
push 0x62d748
lea eax, [ebp - 0x30]
push str._s_service_log.txt
push eax
call fcn.0046a880
add esp, 0xc
cmp byte [ebp - 0x21], 0
jge 0x45e541
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x45e544
mov eax, 0x593544
jmp 0x45e544
lea eax, [ebp - 0x30]
push fcn.00576b6f
push 0x5acdc4
push eax
call fcn.00482a30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x45e5a4
lea eax, [ebp - 0x40]
push 0x10
push eax
call fcn.00579dfe
lea eax, [ebp - 0x50]
push 0x10
push eax
call fcn.00579d45
push dword [ebp + 0x18]
cmp byte [ebp + 0x14], 0
mov ecx, 0x593544
mov eax, str.ERROR_
cmove eax, ecx
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x50]
push eax
push str._s__s_:__s_s
push esi
call fcn.0045a040
push esi
call fcn.00576c14
add esp, 0x2c
cmp byte [ebp - 0x21], 0
mov byte [ebp - 4], 1
jge 0x45e5bf
call fcn.00480170
push 0
push dword [ebp - 0x30]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp byte [ebp - 0x13], 0
je 0x45e5ce
push edi
call fcn.0056baf4
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret