joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae9d0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x5a4
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x5a0], eax
push ebx
mov ebx, dword [esp + 0x5ac]
push esi
mov esi, dword [esp + 0x5b4]
cmp word [esi], 0
je 0x4aeac3
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4aeac3
push edi
xor edi, edi
mov dword [esp + 0xc], 0xc8
lea eax, [esp + 0x14]
push eax
push edi
push edi
push edi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
push edi
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4aeaa1
lea eax, [esp + 0x1c]
push eax
push esi
push 0x550f34
lea eax, [esp + 0x1b8]
push 0x200
push eax
call fcn.00402930
add esp, 0x14
lea eax, [esp + 0x1ac]
push eax
push ebx
call fcn.004ae9d0
lea eax, [esp + 0x14]
mov dword [esp + 0xc], 0xc8
push eax
push 0
push 0
push 0
lea eax, [esp + 0x1c]
inc edi
push eax
lea eax, [esp + 0x30]
push eax
push edi
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4aea46
mov eax, dword [esp + 0x10]
pop edi
test eax, eax
je 0x4aeab1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x4aeac3
inc dword [0x5c4cd8]
mov ecx, dword [esp + 0x5a8]
pop esi
pop ebx
xor ecx, esp
call fcn.00507712
add esp, 0x5a4
ret 8

Function at 0x4aeae0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x404
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
mov esi, dword [esp + 0x40c]
push edi
mov edi, dword [esp + 0x414]
push 0x541b9c
push edi
push esi
call fcn.004ad1c0
test al, al
jne 0x4aeb35
push 0x200
lea eax, [esp + 0xc]
push eax
push edi
push esi
call fcn.004af7a0
test al, al
je 0x4aeb35
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp + 0x408]
pop edi
pop esi
xor ecx, esp
call fcn.00507712
add esp, 0x404
ret 8

Function at 0x4aeb50
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x404
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
mov esi, dword [esp + 0x40c]
push 0x541b9c
push esi
push SysReAllocString
call fcn.004ad1c0
test al, al
jne 0x4aebd5
movzx eax, word [esi]
cmp eax, 0x5c
je 0x4aebb2
test ax, ax
mov eax, 0x541b48
jne 0x4aeb97
mov eax, 0x541b9c
push esi
push eax
push str.SoftwareWinRAR_s_s
lea eax, [esp + 0x10]
push 0x200
push eax
call fcn.00402930
add esp, 0x14
jmp 0x4aebc5
push 0x200
lea eax, [esi + 2]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.0049dc20
lea eax, [esp + 4]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp + 0x404]
pop esi
xor ecx, esp
call fcn.00507712
add esp, 0x404
ret 4
Function at 0x4aebf0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x408
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
mov ebx, dword [esp + 0x414]
push esi
mov esi, dword [esp + 0x414]
push edi
mov edi, dword [esp + 0x420]
push edi
push ebx
push esi
call fcn.004ad1c0
test al, al
jne 0x4aec73
push 0x200
lea eax, [esp + 0x14]
push eax
push ebx
push esi
call fcn.004af7a0
test al, al
je 0x4aec73
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4aec73
push edi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4aec73
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00507712
add esp, 0x408
ret 0xc

Function at 0x4aef10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp + 8]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x30]
push eax
push esi
push edi
push dword [esp + 0x38]
push ebx
push ebp
call fcn.004ad8e0
test al, al
je 0x4aef4f
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14
push ebx
push ebp
call fcn.004af820
mov ebp, eax
mov dword [esp + 0x10], 8
test ebp, ebp
je 0x4aef9f
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x3c]
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x4aef9f
cmp dword [esp + 0x10], 0
je 0x4aef9f
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14

Function at 0x4aefd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x28]
push eax
mov eax, esi
cdq
push edx
push eax
push dword [esp + 0x38]
push edi
push ebx
call fcn.004ad8e0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
test al, al
je 0x4af00e
pop edi
pop esi
mov eax, ecx
pop ebx
add esp, 0x14
ret 0x10
push edi
push ebx
call fcn.004af820
mov edi, eax
mov dword [esp + 0xc], 4
test edi, edi
je 0x4af05a
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x3c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push edi
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x4af05a
cmp dword [esp + 0xc], 0
je 0x4af05a
mov esi, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret 0x10
Function at 0x4af070
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x20]
lea eax, [esp + 4]
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
push eax
push ebp
push ebx
push dword [esp + 0x34]
mov dword [esp + 0x20], edi
push esi
push dword [esp + 0x34]
call fcn.004ad7f0
test al, al
je 0x4af0b2
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x18
push esi
push dword [esp + 0x24]
call fcn.004af820
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edi
test eax, eax
je 0x4af0f8
lea ecx, [esp + 0x14]
push ecx
push ebx
lea ecx, [esp + 0x20]
push ecx
push 0
push dword [esp + 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4af0f8
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4af120
push edi
test ebp, ebp
je 0x4af113
push ebp
push ebx
call fcn.0051ff80
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x18
push 0
push ebx
call fcn.00520500
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x18

Function at 0x4af180
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x810], eax
mov ecx, dword [esp + 0x820]
lea edx, [esp + 0x10]
mov eax, dword [esp + 0x81c]
push ebx
mov ebx, dword [esp + 0x82c]
push ebp
mov ebp, dword [esp + 0x820]
push esi
mov esi, dword [esp + 0x830]
push edi
push 0x400
push edx
push ecx
push eax
push ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
call fcn.004ade80
test al, al
jne 0x4af27d
mov edi, dword [esp + 0x83c]
push edi
push ebx
push esi
call fcn.0049dc20
cmp byte [0x5735f9], 0
sete al
test al, al
jne 0x4af29b
push dword [esp + 0x14]
push ebp
call fcn.004af820
mov ebp, eax
mov byte [esp + 0x13], 0
test ebp, ebp
je 0x4af26f
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x24]
push eax
push 0
push dword [esp + 0x28]
lea ecx, [edi + edi]
push ebp
mov dword [esp + 0x2c], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
sete byte [esp + 0x17]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x13], 0
je 0x4af26f
mov eax, dword [esp + 0x14]
shr eax, 1
test edi, edi
jne 0x4af25c
xor eax, eax
mov word [esi], ax
mov al, byte [esp + 0x13]
jmp 0x4af29d
dec edi
cmp eax, edi
jb 0x4af263
mov eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
mov al, byte [esp + 0x13]
jmp 0x4af29d
push edi
push ebx
push esi
call fcn.0049dc20
mov al, byte [esp + 0x13]
jmp 0x4af29d
lea eax, [esp + 0x20]
push eax
call fcn.004adaa0
test eax, eax
je 0x4af28d
mov ebx, eax
push dword [esp + 0x83c]
push ebx
push esi
call fcn.0049dc20
mov al, 1
mov ecx, dword [esp + 0x820]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00507712
add esp, 0x814
ret 0x18
Function at 0x4af2f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [esp + 0x414]
lea ecx, [esp + 8]
push ebx
mov ebx, dword [esp + 0x41c]
push esi
mov esi, dword [esp + 0x418]
push edi
push 0x200
push ecx
push eax
push esi
call fcn.004af7a0
test al, al
je 0x4af383
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x5c4cdc]
or eax, 9
push eax
push 0
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4af383
mov edi, dword [esp + 0xc]
test edi, edi
je 0x4af383
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg esi
sbb esi, esi
not esi
and esi, dword [esp + 0x10]
mov eax, esi
jmp 0x4af385
xor eax, eax
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00507712
add esp, 0x40c
ret 0xc
Function at 0x4af3e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x5b0
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x5ac], eax
push ebx
mov ebx, dword [esp + 0x5b8]
push esi
mov esi, dword [esp + 0x5c0]
push 0xf
push str.SoftwareWinRAR
push esi
mov dword [esp + 0x2c], esi
call fcn.004a1380
test eax, eax
je 0x4af420
xor al, al
jmp 0x4af605
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4af419
push edi
push 0x100000
call fcn.00524aa7
mov edi, eax
add esp, 4
test edi, edi
jne 0x4af45d
mov ecx, 0x5b77e4
call fcn.0046e5a0
xor al, al
jmp 0x4af604
push ebp
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], 0x200
push eax
push edi
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], 0x100000
push eax
xor ebp, ebp
lea eax, [esp + 0x1c]
push ebp
push eax
lea eax, [esp + 0x1d0]
push eax
push ebp
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4af55f
lea eax, [esi + 0x1e]
mov dword [esp + 0x20], eax
mov esi, eax
cmp word [esi], 0x5c
jne 0x4af4ae
add esi, 2
mov eax, dword [esp + 0x14]
cmp eax, 3
jne 0x4af4cf
push dword [esp + 0x1c]
lea eax, [esp + 0x1c0]
push edi
push eax
push esi
push ebx
call fcn.004ae0d0
mov eax, dword [esp + 0x14]
cmp eax, 4
jne 0x4af4eb
push 0
push dword [edi]
lea eax, [esp + 0x1c4]
push eax
push esi
push ebx
call fcn.004ae1b0
mov eax, dword [esp + 0x14]
cmp eax, 0xb
jne 0x4af508
push dword [edi + 4]
lea eax, [esp + 0x1c0]
push dword [edi]
push eax
push esi
push ebx
call fcn.004ae1b0
mov eax, dword [esp + 0x14]
cmp eax, 1
jne 0x4af51d
push edi
lea eax, [esp + 0x1c0]
push eax
push esi
push ebx
call fcn.004ae040
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], 0x200
push eax
push edi
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], 0x100000
push eax
push 0
lea eax, [esp + 0x20]
inc ebp
push eax
lea eax, [esp + 0x1d0]
push eax
push ebp
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
mov eax, dword [esp + 0x20]
je 0x4af4a3
push edi
call fcn.00524aa2
add esp, 4
mov dword [esp + 0x10], 0xc8
xor esi, esi
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x40]
push eax
push esi
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
pop ebp
test eax, eax
jne 0x4af5f3
mov edi, dword [esp + 0x24]
jmp 0x4af5a0
push 0x200
lea eax, [esp + 0x1bc]
push eax
lea eax, [esp + 0x30]
push eax
push edi
call fcn.00485ce0
lea eax, [esp + 0x1b8]
push eax
push ebx
call fcn.004af3e0
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], 0xc8
push eax
push 0
push 0
push 0
lea eax, [esp + 0x1c]
inc esi
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4af5a0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4af602
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop edi
mov ecx, dword [esp + 0x5b4]
pop esi
pop ebx
xor ecx, esp
call fcn.00507712
add esp, 0x5b0
ret 8
Function at 0x4afad0
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x14]
push edi
push dword [esp + 0x20]
mov edi, dword [esp + 0x18]
push dword [esp + 0x20]
push esi
push edi
push dword [esp + 0x20]
call fcn.004ae1b0
test al, al
je 0x4afafa
pop edi
xor eax, eax
pop esi
pop ecx
ret 0x14
lea eax, [esp + 8]
push eax
push edi
push dword [esp + 0x18]
call fcn.004ae5f0
mov edi, eax
test edi, edi
je 0x4afb33
push 8
lea eax, [esp + 0x20]
push eax
push 0xb
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ecx
ret 0x14
mov esi, dword [esp + 8]
mov eax, esi
pop edi
pop esi
pop ecx
ret 0x14

Function at 0x4afb60
Capabilities:
Set registry value

Disassembly:
sub esp, 0x808
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x804], eax
push ebx
mov ebx, dword [esp + 0x814]
lea eax, [esp + 8]
push ebp
mov ebp, dword [esp + 0x81c]
push esi
mov esi, dword [esp + 0x824]
push edi
mov edi, dword [esp + 0x81c]
push 0x400
push eax
push ebp
push ebx
push edi
call fcn.004ade80
test al, al
jne 0x4afc09
cmp byte [0x5735f9], al
sete al
test al, al
jne 0x4afc16
lea eax, [esp + 0x10]
push eax
push ebx
push edi
call fcn.004ae5f0
mov edi, eax
test edi, edi
je 0x4afc01
mov ecx, esi
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4afbd0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4afc18
mov esi, dword [esp + 0x10]
mov eax, esi
jmp 0x4afc18
push 1
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.004acf90
xor eax, eax
mov ecx, dword [esp + 0x814]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00507712
add esp, 0x808
ret 0x10
Function at 0x4afd80
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push eax
push esi
mov edi, ecx
mov dword [esp + 0x18], 0
call fcn.004b00c0
test eax, eax
je 0x4afdaf
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 8
push ebx
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004b00c0
mov dword [edi + 0x10], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004b00c0
mov dword [edi + 0x18], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004b00c0
mov dword [edi + 0x1c], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004b00c0
mov dword [edi + 0x20], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004b00c0
mov dword [edi + 0x24], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004b00c0
push ebp
mov dword [edi + 0x28], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x100
lea eax, [edi + 0x2c]
push eax
call fcn.004b0120
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004b00c0
push ebp
mov dword [edi + 0x12c], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x100
lea eax, [edi + 0x130]
push eax
call fcn.004b0120
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004b00c0
mov dword [edi + 0x230], eax
lea eax, [esp + 0x10]
push ebp
push eax
push esi
push 0x100
lea eax, [edi + 0x234]
push eax
mov ecx, edi
call fcn.004b0120
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004b00c0
mov dword [edi + 0x334], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004b00c0
mov dword [edi + 0x338], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004b00c0
push ebp
mov dword [edi + 0x33c], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x20
lea eax, [edi + 0x340]
push eax
call fcn.004b0120
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
push 0x100
lea eax, [edi + 0x380]
push eax
call fcn.004b0120
mov ecx, dword [esp + 0x10]
xor bl, bl
xor eax, eax
test ecx, ecx
je 0x4aff0a
xor bl, byte [eax + esi]
inc eax
cmp eax, ecx
jb 0x4aff02
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004b00c0
movzx ecx, bl
xor edx, edx
pop ebx
pop edi
cmp ecx, eax
pop esi
sete al
pop ebp
pop ecx
ret 8

Function at 0x4b01a0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
xor ecx, ecx
xor esi, esi
jmp 0x4b01b0
xor byte [esi + edi], cl
mov eax, 0xaaaaaaab
mul ecx
add ecx, 3
inc esi
shr edx, 1
add ecx, edx
and ecx, 0xffffff
cmp esi, 0x480
jb 0x4b01b0
pop edi
pop esi
ret
Function at 0x4b2280
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov eax, 0x4324
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x4320], eax
push esi
push edi
mov edi, dword [esp + 0x4330]
push edi
call fcn.00485580
mov esi, eax
test esi, esi
je 0x4b24a0
push 0xc8
push 0x541b9c
lea eax, [esp + 0x10]
push eax
push 0x541b9c
push esi
push SysReAllocString
call fcn.004af180
cmp word [esp + 8], 0
je 0x4b24a0
push 0xc8
push str._shellprintcommand
lea eax, [esp + 0x10]
push eax
call fcn.0049dbe0
push 0x800
push 0x541b9c
lea eax, [esp + 0x330]
push eax
push 0x541b9c
lea eax, [esp + 0x18]
push eax
push SysReAllocString
call fcn.004af180
cmp word [esp + 0x328], 0
jne 0x4b23c9
push esi
push str.SoftwareClasses_s
lea eax, [esp + 0x1a0]
push 0xc8
push eax
call fcn.00402930
add esp, 0x10
lea eax, [esp + 8]
push 0xc8
push 0x541b9c
push eax
push 0x541b9c
lea eax, [esp + 0x1a8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004af180
cmp word [esp + 8], 0
je 0x4b24a0
lea eax, [esp + 8]
push eax
push str.SoftwareClasses_s_shellprintcommand
lea eax, [esp + 0x1a0]
push 0xc8
push eax
call fcn.00402930
add esp, 0x10
lea eax, [esp + 0x328]
push 0x800
push 0x541b9c
push eax
push 0x541b9c
lea eax, [esp + 0x1a8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004af180
cmp word [esp + 0x328], 0
je 0x4b24a0
push 0x1000
lea eax, [esp + 0x232c]
push eax
lea eax, [esp + 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4b24a0
cmp eax, 0x1000
jae 0x4b24a0
lea eax, [esp + 0x2328]
push 0x551394
push eax
call fcn.0052087b
add esp, 8
test eax, eax
je 0x4b24a0
push ebx
lea ecx, [esp + 0x232c]
xor bl, bl
cmp eax, ecx
jbe 0x4b242b
cmp word [eax - 2], 0x22
jne 0x4b242b
mov bl, 1
xor ecx, ecx
push 0x1000
mov word [eax], cx
lea eax, [esp + 0x2330]
push edi
push eax
call fcn.0049dbe0
test bl, bl
pop ebx
je 0x4b245f
push 0x1000
push 0x550e9c
lea eax, [esp + 0x2330]
push eax
call fcn.0049dbe0
push 0x800
lea eax, [esp + 0x132c]
push eax
lea eax, [esp + 0x2330]
push eax
call fcn.0049d3c0
push 8
push 0
push eax
lea eax, [esp + 0x1334]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x20
cmp ecx, eax
sbb eax, eax
neg eax
jmp 0x4b24a2
xor al, al
mov ecx, dword [esp + 0x4328]
pop edi
pop esi
xor ecx, esp
call fcn.00507712
add esp, 0x4324
ret 4

Function at 0x4b24c0
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push 8
push 0
push 0
push esi
push str.print
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
test bl, bl
jne 0x4b2502
push esi
call fcn.004b2280
test al, al
jne 0x4b2502
push esi
push 0x557
call fcn.00497960
push eax
call fcn.004dcc30
add esp, 8
pop esi
mov al, bl
pop ebx
ret 4
Function at 0x4b2bc0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0xa808
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0xa804], eax
push esi
mov esi, dword [esp + 0xa810]
lea eax, [esp + 0xa81c]
push eax
push 0
push dword [esp + 0xa820]
lea eax, [esp + 0x1810]
push 0x1800
push eax
call fcn.00402920
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.00524725
xor eax, eax
add esp, 0x1c
mov word [esp + 0x4802], ax
mov eax, dword [esp + 0xa814]
sub eax, 0
je 0x4b2c8c
sub eax, 1
je 0x4b2c63
sub eax, 1
jne 0x4b2ccd
push 0x1800
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x180c]
push eax
call fcn.004a0f90
lea ecx, [esp + 4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b2c56
lea eax, [esp + 4]
jmp 0x4b2cbe
lea ecx, [esp + 0x1804]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b2c70
sub ecx, edx
lea eax, [esp + 0x1804]
push esi
sar ecx, 1
push ecx
push 2
jmp 0x4b2cc4
push 0x6000
lea eax, [esp + 0x480c]
push eax
lea eax, [esp + 0x180c]
push eax
call fcn.004a1010
lea ecx, [esp + 0x4808]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b2cb0
lea eax, [esp + 0x4808]
push esi
sub ecx, edx
push ecx
push 1
push eax
call fcn.00525e32
add esp, 0x10
mov ecx, dword [esp + 0xa808]
pop esi
xor ecx, esp
call fcn.00507712
add esp, 0xa808
ret
Function at 0x4b3cb0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x404], eax
mov eax, dword [esp + 0x410]
push ebp
mov ebp, dword [esp + 0x410]
push esi
push edi
push 0x54403c
push eax
mov esi, ecx
call fcn.004d77f0
mov edi, eax
test edi, edi
sete cl
mov byte [esi + 0x302c], cl
test cl, cl
jne 0x4b3e2a
push edi
call fcn.00529c64
add esp, 4
cmp eax, 0x42
jne 0x4b3e21
push edi
call fcn.00529c64
add esp, 4
cmp eax, 0x4d
jne 0x4b3e21
push ebx
push 0
push 2
push edi
call fcn.00528c86
push edi
push 1
lea eax, [esp + 0x24]
push 4
push eax
call fcn.0052891c
mov eax, dword [esp + 0x2c]
sub eax, 0xe
push eax
mov dword [esp + 0x30], eax
call fcn.00524aa7
mov ebx, eax
add esp, 0x20
test ebx, ebx
jne 0x4b3d75
push edi
call fcn.00525a4d
add esp, 4
xor al, al
pop ebx
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00507712
add esp, 0x408
ret 0xc
push 0
push 0xe
push edi
call fcn.00528c86
push edi
push dword [esp + 0x20]
push 1
push ebx
call fcn.0052891c
add esp, 0x1c
cmp eax, dword [esp + 0x10]
je 0x4b3de5
push str.BMP__PNG
push 0x686
call fcn.00497960
push eax
lea eax, [esp + 0x1c]
push 0x200
push eax
call fcn.00402930
add esp, 0x10
push 0x10
push 0x66
call fcn.00497960
push eax
lea eax, [esp + 0x1c]
push eax
push dword [0x57cf9c]
call fcn.004d8380
push ebx
call fcn.00524aa2
push edi
call fcn.00525a4d
add esp, 8
jmp 0x4b3d58
push edi
call fcn.00525a4d
movzx eax, word [esp + 0x428]
add esp, 4
push dword [esp + 0x10]
push ebx
push 0x400
push eax
push 2
push ebp
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
push ebx
mov esi, eax
call fcn.00524aa2
xor eax, eax
add esp, 4
test esi, esi
setne al
jmp 0x4b3d5a
push edi
call fcn.00525a4d
add esp, 4
xor al, al
jmp 0x4b3d5b