joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d460
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x46d4ca
mov eax, ebx
call fcn.0046f8b8
test al, al
jne 0x46d4ca
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040529c
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x46d4b7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x46d4d7
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405200
jmp 0x46d4d7
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405200
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x46e9b8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46ea26
mov eax, esi
call fcn.00456858
test al, al
je 0x46ea26
mov eax, dword [ebx + 0x84]
call fcn.004564b8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46ea26
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x46ea1a
push 0
mov eax, dword [ebx + 0x84]
call fcn.004564b8
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0044e328
jmp 0x46ea26
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0046e7f4
pop esi
pop ebx
ret
Function at 0x46fe94
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x4087b0]
call fcn.00405ff4
xor eax, eax
push ebp
push 0x470035
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d59f0], 0
jne 0x46feef
mov ecx, dword [0x4d8a50]
mov dl, 1
mov eax, dword [0x408b80]
call fcn.0040e128
call fcn.00404af8
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403978
mov eax, ebx
call fcn.00405c10
mov dword [ebp - 0x24], eax
mov esi, 0x470044
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00407020
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405c20
test eax, eax
jle 0x46ffd8
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46ffc4
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.0040541c
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x46ff6a
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00405434
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x46ff80
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00405434
mov eax, dword [ebp - 0x54]
call fcn.0040563c
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.0040541c
mov eax, dword [ebp - 0x58]
call fcn.0040563c
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x46ffc6
xor eax, eax
test al, al
je 0x46ffd1
mov ebx, 0x15
jmp 0x46ffdd
mov ebx, 0x10
jmp 0x46ffdd
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4d59f0]
call fcn.0046fd14
mov eax, dword [ebp - 4]
call fcn.0046fd14
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00407038
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47003c
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.004051d0
lea eax, [ebp - 0xc]
mov edx, dword [0x4087b0]
call fcn.004060c4
ret

Function at 0x471100
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x47115a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4d8af8]
cmp byte [eax], 0
je 0x47112a
push ebx
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
jmp 0x471144
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004053d4
mov eax, dword [ebp - 4]
call fcn.0040563c
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471161
lea eax, [ebp - 4]
call fcn.004051ac
ret
Function at 0x471390
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x471465
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4d8af8]
cmp byte [eax], 0
je 0x4713e8
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push edi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00405b84
mov eax, dword [ebp - 4]
call fcn.00470b1c
push eax
push ebx
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
jmp 0x471442
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 8]
mov edx, dword [ebp + 0xc]
call fcn.004053d4
mov eax, dword [ebp - 8]
call fcn.00470b08
push eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 0x10]
call fcn.004053d4
mov eax, dword [ebp - 0xc]
call fcn.00470b08
push eax
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.004053d4
mov eax, dword [ebp - 0x10]
call fcn.00470b08
push eax
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.004053d4
mov eax, dword [ebp - 0x14]
call fcn.00470b08
push eax
push ebx
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47146c
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004051d0
lea eax, [ebp - 4]
call fcn.00405a28
ret

Function at 0x472310
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x472374
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040541c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.0040a3c4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47237b
lea eax, [ebp - 0xc]
call fcn.004051ac
ret

Function at 0x472414
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x472470
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x47243f
call fcn.0040f834
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00403120
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x472470
call fcn.0040f834
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x49321c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4933a1
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, byte [ebx + 0x2be]
sub al, 2
jb 0x493386
cmp byte [ebx + 0x2b0], 0
je 0x493386
mov eax, dword [ebp - 4]
call fcn.00499aac
mov word [ebp - 6], ax
xor eax, eax
push ebp
push 0x49337f
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp - 6]
sub ax, 8
je 0x4932c3
dec ax
je 0x493299
sub ax, 0x12
jne 0x4932dd
call fcn.00404ba4
jmp 0x493386
cmp byte [ebx + 0x2b1], 0
je 0x493365
mov eax, ebx
call fcn.004389a8
test al, al
je 0x493365
xor edx, edx
mov eax, ebx
call fcn.004389cc
jmp 0x493365
mov eax, dword [esi]
call fcn.00405c20
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00405e14
jmp 0x493365
cmp byte [ebx + 0x2b1], 0
je 0x4932fa
mov eax, ebx
call fcn.004389a8
test al, al
jne 0x4932fa
mov dl, 1
mov eax, ebx
call fcn.004389cc
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 8]
sub eax, dword [edx]
cmp eax, 0x4e2
jb 0x493312
mov eax, esi
call fcn.00405a28
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0
push 1
lea eax, [ebp - 0x10]
movzx edx, word [ebp - 6]
call fcn.00405b44
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi]
lea eax, [ebp - 0xc]
call fcn.00405c8c
mov ecx, dword [ebp - 0xc]
mov edx, edi
mov eax, ebx
call fcn.00493030
test al, al
je 0x493365
lea eax, [ebp - 0x14]
movzx edx, word [ebp - 6]
call fcn.00405b44
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00405c2c
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493386
mov eax, dword [ebp - 4]
movzx edx, word [ebp - 6]
call fcn.00499ae0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4933a8
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405a40
ret

Function at 0x496c40
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00405a28
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x496c8e
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405be4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x496c94
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x496ccc
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x496ccc
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x496ccc
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x4977b4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x497946
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 8]
mov dword [edx + 0xbc], eax
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
test esi, esi
jne 0x4977f5
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x497812
mov edi, dword [esi + 0x6c]
test edi, edi
je 0x497808
mov eax, edi
call fcn.004423c8
mov dword [ebp - 4], eax
jmp 0x497812
mov eax, esi
call fcn.004423c8
mov dword [ebp - 4], eax
mov eax, dword [0x4d8af8]
cmp byte [eax], 0
je 0x49792b
mov eax, dword [ebp - 8]
cmp dword [eax + 0x64], 0
je 0x49792b
test ebx, ebx
je 0x49792b
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x1c]
and ax, word [0x497954]
movzx edx, word [0x497958]
cmp dx, ax
jne 0x49792b
mov eax, dword [ebp - 8]
cmp byte [eax + 0x3e], 0
je 0x49792b
push ebp
call fcn.00497654
pop ecx
test al, al
je 0x49792b
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00497468
mov eax, dword [ebp - 8]
call fcn.00444f14
test eax, eax
jne 0x4978d9
mov eax, dword [ebp - 8]
cmp word [eax + 0x60], 0
je 0x4978d9
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
test esi, esi
je 0x4978b2
cmp dword [esi + 0x64], 0
jne 0x4978b2
mov eax, dword [esi + 4]
mov edx, dword [0x440ce0]
call fcn.004043a8
test al, al
jne 0x4978d9
push dword [ebp - 0xc]
push 0x497960
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x60]
call fcn.00496cd4
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405cfc
push ebp
lea eax, [ebp - 0x14]
call fcn.004976b0
pop ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00405d44
je 0x49792b
push ebp
mov eax, dword [ebp - 0xc]
call fcn.00497724
pop ecx
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
cmp esi, dword [ebx + 0x34]
je 0x49790b
cmp dword [esi + 0x6c], 0
je 0x49792b
mov eax, ebx
mov edx, dword [0x440ce0]
call fcn.004043a8
test al, al
je 0x49792b
cmp dword [ebx + 0x38], 0
je 0x49792b
mov eax, dword [ebx + 0x38]
push eax
call sub.user32.dll_DrawMenuBar
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49794d
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405a40
ret

Function at 0x4a4308
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4df0fc
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4a432a
shr eax, 1
xor eax, 0xedb88320
jmp 0x4a432c
shr eax, 1
dec edx
jne 0x4a4318
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4a4311
mov byte [0x4df4fc], 1
pop esi
pop ebx
ret

Function at 0x4a4348
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4df4fc], 0
jne 0x4a435f
call fcn.004a4308
mov eax, edi
dec eax
test eax, eax
jl 0x4a4387
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4df0fc]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4a4369
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4a67b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x45d]
movzx ecx, dl
cmp ecx, 6
ja case.0x4a684a.0
jmp dword [ecx*4 + 0x4a67e3]
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x4a6815
sub dl, 8
je 0x4a6824
jmp case.0x4a684a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a6540
jmp case.0x4a684a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a658c
jmp case.0x4a684a.0
movzx ecx, byte [eax + 0x45c]
cmp ecx, 0x10
ja case.0x4a684a.0
movzx ecx, byte [ecx + 0x4a6851]
jmp dword [ecx*4 + 0x4a6862]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a65dc
jmp case.0x4a684a.0
cmp dl, 3
jne 0x4a688f
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a6630
jmp case.0x4a684a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a65ec
jmp case.0x4a684a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a6674
jmp case.0x4a684a.0
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x4a68ba
sub dl, 8
je 0x4a68c6
jmp case.0x4a684a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a6690
jmp case.0x4a684a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a66f4
jmp case.0x4a684a.0
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x4a68e5
sub dl, 8
je 0x4a68f1
jmp case.0x4a684a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a675c
jmp case.0x4a684a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4a6784
mov esi, dword [eax + 0x448]
mov edx, dword [ebx + 0x1c]
dec edx
imul esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0xc], esi
mov eax, dword [eax + 0x450]
mov dword [ebp - 8], eax
mov esi, edx
test esi, esi
jb 0x4a6981
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004a5b5c
test eax, eax
je 0x4a6981
mov eax, ebx
call fcn.004a698c
mov eax, dword [ebp - 8]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x448]
sub dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x4a6921
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a698c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4a69bd
dec al
je 0x4a69f8
dec al
je 0x4a6a3d
dec al
je 0x4a6aa6
jmp 0x4a6b30
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4a6b30
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a69cd
jmp 0x4a6b30
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a6b30
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a6a08
jmp 0x4a6b30
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a6b30
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4a6a6c
xor ebp, ebp
jmp 0x4a6a7c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4a6a85
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a6a4d
jmp 0x4a6b30
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a6b30
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4a6aff
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004a4390
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a6aba
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4aa3cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4aa536
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4d8af8]
cmp byte [eax], 0
jne 0x4aa427
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00405434
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov eax, ebx
call fcn.00429a88
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00405c00
jmp 0x4aa50e
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00405c10
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x4aa459
mov eax, esi
call fcn.00405a28
jmp 0x4aa50e
mov eax, dword [ebp - 4]
dec eax
sub eax, 2
jb 0x4aa490
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 0xf
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x1c]
mov eax, dword [0x4d8ca0]
call fcn.0040751c
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x429410]
call fcn.0040e0a8
call fcn.00404af8
cmp dword [ebp - 8], 1
jne 0x4aa49d
mov dword [ebp - 8], 2
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, esi
call fcn.00405f90
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
call fcn.00405c10
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00405c10
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x4aa4fe
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 0xf
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x4d9120]
call fcn.0040751c
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x429410]
call fcn.0040e0a8
call fcn.00404af8
mov eax, dword [esi]
call fcn.00405c10
mov edx, eax
mov eax, esi
call fcn.00405b84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa53d
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004051d0
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004051d0
ret
Function at 0x4aa544
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4aa64e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4d8af8]
cmp byte [eax], 0
jne 0x4aa5cf
cmp dword [ebp - 4], 1
jne 0x4aa5aa
lea eax, [ebp - 8]
mov edx, esi
call fcn.00405434
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.00405434
mov edx, dword [ebp - 0xc]
mov eax, ebx
pop ecx
call fcn.00429a28
jmp 0x4aa62b
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.00405434
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00405434
mov edx, dword [ebp - 0x14]
mov eax, ebx
pop ecx
call fcn.00429a58
jmp 0x4aa62b
mov eax, esi
call fcn.00405c20
inc eax
add eax, eax
push eax
mov eax, esi
call fcn.00405c10
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00405c10
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x4aa62b
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x18], 0xf
lea eax, [ebp - 0x1c]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x4d8dd4]
call fcn.0040751c
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x429410]
call fcn.0040e0a8
call fcn.00404af8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa655
lea eax, [ebp - 0x20]
call fcn.004051ac
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004051d0
ret