joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48e314
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [eax + 4]
and dword [ebp + 8], 0
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov dword [ebp - 8], edi
mov edi, dword [eax]
mov dword [ebp - 4], edi
mov edi, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], eax
mov dword [ebp + 0xc], 0x20
sub dword [ebp + 8], 0x61c88647
mov eax, edx
mov edi, edx
shl eax, 4
add eax, dword [ebp - 4]
shr edi, 5
add edi, dword [ebp - 8]
xor eax, edi
mov edi, dword [ebp + 8]
add edi, edx
xor eax, edi
add ecx, eax
mov eax, ecx
mov edi, ecx
shl eax, 4
add eax, dword [ebp - 0xc]
shr edi, 5
add edi, dword [ebp - 0x10]
xor eax, edi
mov edi, dword [ebp + 8]
add edi, ecx
xor eax, edi
add edx, eax
dec dword [ebp + 0xc]
jne 0x48e349
mov dword [esi], ecx
mov dword [esi + 4], edx
pop edi
pop esi
leave
ret
Function at 0x48e394
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, 0x9e3779b9
cmp eax, 0xc
mov dword [ebp - 4], eax
mov ebx, edi
jb 0x48e49c
push 0xc
xor edx, edx
pop ecx
div ecx
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x10], eax
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 5]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 4]
add edx, edi
shl eax, 8
lea edi, [edx + eax]
movzx eax, byte [ecx + 0xb]
movzx edx, byte [ecx + 0xa]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 9]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 8]
shl eax, 8
add edx, esi
lea esi, [edx + eax]
movzx edx, byte [ecx + 3]
movzx eax, byte [ecx + 2]
shl edx, 8
add edx, eax
movzx eax, byte [ecx + 1]
shl edx, 8
add edx, eax
movzx eax, byte [ecx]
shl edx, 8
add edx, eax
mov eax, esi
sub edx, esi
add ecx, 0xc
sub edx, edi
sub edi, esi
add edx, ebx
shr eax, 0xd
xor edx, eax
mov eax, edx
sub edi, edx
shl eax, 8
xor edi, eax
sub esi, edi
mov eax, edi
sub esi, edx
shr eax, 0xd
xor esi, eax
sub edx, esi
mov eax, esi
sub edx, edi
sub edi, esi
shr eax, 0xc
xor edx, eax
mov eax, edx
sub edi, edx
shl eax, 0x10
xor edi, eax
sub esi, edi
mov eax, edi
sub esi, edx
shr eax, 5
xor esi, eax
sub edx, esi
mov eax, esi
sub edx, edi
sub edi, esi
shr eax, 3
xor edx, eax
mov ebx, edx
mov eax, ebx
sub edi, ebx
shl eax, 0xa
xor edi, eax
sub esi, edi
mov eax, edi
sub esi, ebx
shr eax, 0xf
xor esi, eax
sub dword [ebp - 4], 0xc
dec dword [ebp + 0x10]
jne 0x48e3c1
jmp 0x48e49f
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
add esi, dword [ebp + 0xc]
dec eax
cmp eax, 0xa
ja case.default.0x48e4ab
jmp dword [eax*4 + 0x48e576]
movzx eax, byte [ecx + 0xa]
shl eax, 0x18
add esi, eax
movzx eax, byte [ecx + 9]
shl eax, 0x10
add esi, eax
movzx eax, byte [ecx + 8]
shl eax, 8
add esi, eax
movzx eax, byte [ecx + 7]
shl eax, 0x18
add edi, eax
movzx eax, byte [ecx + 6]
shl eax, 0x10
add edi, eax
movzx eax, byte [ecx + 5]
shl eax, 8
add edi, eax
movzx eax, byte [ecx + 4]
add edi, eax
movzx eax, byte [ecx + 3]
shl eax, 0x18
add ebx, eax
movzx eax, byte [ecx + 2]
shl eax, 0x10
add ebx, eax
movzx eax, byte [ecx + 1]
shl eax, 8
add ebx, eax
movzx eax, byte [ecx]
add ebx, eax
sub ebx, esi
mov eax, esi
sub ebx, edi
sub edi, esi
shr eax, 0xd
xor ebx, eax
mov eax, ebx
sub edi, ebx
shl eax, 8
xor edi, eax
sub esi, edi
mov eax, edi
sub esi, ebx
shr eax, 0xd
xor esi, eax
sub ebx, esi
mov eax, esi
sub ebx, edi
sub edi, esi
shr eax, 0xc
xor ebx, eax
mov eax, ebx
sub edi, ebx
shl eax, 0x10
xor edi, eax
sub esi, edi
mov eax, edi
sub esi, ebx
shr eax, 5
xor esi, eax
mov eax, esi
sub ebx, eax
mov ecx, eax
sub ebx, edi
sub edi, eax
shr ecx, 3
xor ebx, ecx
mov ecx, ebx
sub edi, ebx
shl ecx, 0xa
xor edi, ecx
sub eax, edi
sub eax, ebx
shr edi, 0xf
xor eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x48efb2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1584
call fcn.004dc850
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x217]
mov byte [ebp - 0x218], bl
mov dword [ebp - 8], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
push dword [edi]
call fcn.0048f76f
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1584]
push eax
call fcn.004904d6
push 0x400
lea eax, [ebp - 0x618]
push ebx
push eax
call fcn.004d9ad0
mov esi, 0x104
lea eax, [ebp - 0x114]
push esi
push eax
push dword [ebp + 0xc]
push edi
call fcn.00491d52
add esp, 0x24
test eax, eax
je 0x48f048
mov esi, 0x32a
push 2
push esi
push 0x545598
push dword [ebp - 4]
call fcn.0045fd8e
add esp, 0x10
jmp 0x48f143
lea eax, [ebp - 0x1584]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push dword [ebp + 0x10]
push eax
push edi
call fcn.0048f1d3
add esp, 0x18
mov edi, 0x545598
test eax, eax
je 0x48f086
push 1
push 0x323
push edi
push dword [ebp - 4]
call fcn.0045fd8e
add esp, 0x10
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.0044be4d
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x48f0fb
lea eax, [ebp - 0x218]
push esi
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call fcn.00491bc1
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0044be4d
add esp, 0x18
cmp eax, 0xffffffff
jne 0x48f0e6
lea eax, [ebp - 0x218]
push eax
call fcn.004e2fee
cmp eax, 0xffffffff
pop ecx
jne 0x48f0e6
mov esi, 0x332
push 2
push esi
push edi
jmp 0x48f038
lea eax, [ebp - 0x114]
push 0x520164
push eax
call fcn.004de577
pop ecx
pop ecx
jmp 0x48f122
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call fcn.004919d5
lea eax, [ebp - 0x114]
push 0x53f9ac
push eax
call fcn.004de577
add esp, 0x14
mov esi, eax
cmp esi, ebx
jne 0x48f14a
lea eax, [ebp - 0x114]
mov esi, 0x32d
push eax
push 2
push esi
push edi
push dword [ebp - 4]
call fcn.0045fd8e
add esp, 0x14
mov eax, esi
jmp 0x48f1ce
mov eax, dword [ebp - 8]
push ebx
shl eax, 0xa
push eax
push esi
call fcn.004de42e
add esp, 0xc
push 0x5f
push ebx
push ebx
push dword [ebp + 0x14]
call fcn.004d9400
pop ecx
push eax
lea eax, [ebp - 0x618]
push eax
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.004a65dc
push esi
push 1
lea eax, [ebp - 0x618]
push 0x400
push eax
call fcn.004e2f39
push esi
call fcn.004de06b
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.0044be4d
add esp, 0x38
cmp eax, 0xffffffff
je 0x48f1b7
lea eax, [ebp - 0x114]
push eax
call fcn.00449aa0
pop ecx
push dword [ebp - 0xc]
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call fcn.00491ad9
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x491e93
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 8]
push dword [edi]
call fcn.0048f76f
pop ecx
mov dword [ebp + 8], eax
call fcn.00491f20
mov ebx, eax
test ebx, ebx
jge 0x491edd
push str.Vendor_Id_not_Found
mov esi, 0x32e
push 2
push esi
push 0x545598
push dword [ebp + 8]
call fcn.0045fd8e
add esp, 0x14
mov eax, esi
jmp 0x491f1b
mov esi, dword [ebp + 0xc]
test byte [esi + 0xc], 0x10
jne 0x491f18
push esi
push 0x258
lea eax, [ebp - 0x25c]
push 1
push eax
call fcn.004de387
add esp, 0x10
test eax, eax
je 0x491f18
push ebx
push eax
lea eax, [ebp - 0x25c]
push eax
push edi
call fcn.00491e6f
add esp, 0x10
add dword [ebp - 4], eax
jmp 0x491ee0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4935e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x49372d
cmp dword [ebp + 0xc], edi
jl 0x49372d
je 0x493729
call sub.KERNEL32.dll_GetCurrentProcessId
mov esi, str._08lx
push eax
push esi
lea eax, [ebp - 0xc]
push 0xc
push eax
call fcn.004de975
lea eax, [ebp - 0xc]
push 8
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004dcb20
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
push esi
lea eax, [ebp - 0xc]
push 0xc
push eax
call fcn.004de975
lea eax, [ebp - 0xc]
push 8
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004dcb20
lea eax, [ebp - 0x20]
push 0x12
push eax
lea eax, [ebp - 0x20]
push 0x10
push eax
call fcn.004634ec
add esp, 0x48
test eax, eax
jne 0x49372d
cmp dword [ebp + 0xc], eax
jle 0x493729
mov eax, edi
push 0x10
cdq
pop ecx
idiv ecx
test edx, edx
jne 0x4936f3
call sub.KERNEL32.dll_GetTickCount
push eax
push esi
lea eax, [ebp - 0xc]
push 0xc
push eax
call fcn.004de975
add esp, 0x10
xor eax, eax
mov cl, byte [ebp + eax - 0xc]
add byte [ebp + eax - 0x20], cl
inc eax
cmp eax, 8
jl 0x493694
push 0
call fcn.004efa24
push eax
push esi
lea eax, [ebp - 0xc]
push 0xc
push eax
call fcn.004de975
add esp, 0x14
xor eax, eax
mov cl, byte [ebp + eax - 0xc]
add byte [ebp + eax - 0x18], cl
inc eax
cmp eax, 8
jl 0x4936bb
xor eax, eax
mov cl, byte [eax + 0x559010]
xor byte [ebp + eax - 0x20], cl
inc eax
cmp eax, 0x10
jl 0x4936cb
lea eax, [ebp - 0x20]
push 0x12
push eax
lea eax, [ebp - 0x20]
push 0x10
push eax
call fcn.004634ec
add esp, 0x10
test eax, eax
jne 0x49372d
xor eax, eax
cmp edi, dword [ebp + 0xc]
jge 0x49370d
cmp eax, 0x10
jge 0x49370d
mov edx, dword [ebp + 8]
mov cl, byte [ebp + eax - 0x20]
mov byte [edi + edx], cl
inc edi
inc eax
jmp 0x4936f5
lea eax, [ebp - 0x20]
push 0x12
push eax
push 0x559010
call fcn.004dcb20
add esp, 0xc
cmp edi, dword [ebp + 0xc]
jl 0x493671
xor eax, eax
jmp 0x493730
push 0xfffffffffffffffe
pop eax
pop edi
pop esi
leave
ret
Function at 0x493734
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 4], edi
je 0x4937a5
cmp dword [ebp + 0xc], edi
jl 0x4937a5
jne 0x493750
xor eax, eax
jmp 0x4937a8
lea eax, [ebp - 0x68]
push 0x64
push eax
call fcn.004937ab
pop ecx
lea eax, [ebp - 0x68]
pop ecx
push 0xf0000000
push 1
push eax
lea eax, [ebp - 4]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
cmp eax, 1
jne 0x4937a5
cmp dword [ebp - 4], edi
je 0x4937a5
push esi
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push edi
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
dec eax
neg eax
sbb eax, eax
and al, 0xfe
jmp 0x4937a8
push 0xfffffffffffffffe
pop eax
pop edi
leave
ret

Function at 0x4939cb
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor ebx, ebx
push 4
mov dword [ebp - 4], ebx
pop esi
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
add eax, ecx
sub edi, ecx
add dword [ebp - 4], esi
lea edx, [ebp + ebx - 0x18]
mov dword [ebp - 8], esi
mov cl, byte [edi + eax]
mov byte [edx], cl
mov byte [eax], cl
add edx, esi
inc eax
dec dword [ebp - 8]
jne 0x4939f3
inc ebx
cmp ebx, esi
jl 0x4939dc
cmp dword [ebp - 4], 0xb0
jge 0x493a8a
mov dword [ebp + 0xc], 0x5405cc
xor eax, eax
lea ecx, [ebp - 0x18]
lea edi, [eax + 1]
mov ebx, esi
mov eax, edi
cdq
idiv ebx
movzx eax, byte [ebp + edx*4 - 0x15]
mov al, byte [eax + str.cw]
xor byte [ecx], al
mov eax, edi
add ecx, esi
cmp eax, esi
jl 0x493a1c
mov eax, dword [ebp + 0xc]
push 1
pop ecx
mov al, byte [eax]
xor byte [ebp - 0x18], al
add dword [ebp + 0xc], esi
lea eax, [ebp + ecx - 0x18]
mov edi, esi
mov dl, byte [eax - 1]
xor byte [eax], dl
add eax, esi
dec edi
jne 0x493a4f
inc ecx
cmp ecx, esi
jl 0x493a49
xor ecx, ecx
lea eax, [ebp + ecx - 0x18]
mov dword [ebp - 8], esi
mov dl, byte [eax]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp - 4]
inc dword [ebp - 4]
add eax, esi
dec dword [ebp - 8]
mov byte [ebx + edi], dl
jne 0x493a67
inc ecx
cmp ecx, esi
jl 0x493a60
cmp dword [ebp - 4], 0xb0
jl 0x493a17
pop edi
pop esi
pop ebx
leave
ret
Function at 0x493a8f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call fcn.00493b9c
mov esi, str.cw
push esi
push ebx
call fcn.00493bbb
push ebx
call fcn.00493c66
lea eax, [edi + 0x10]
push eax
push ebx
call fcn.00493b9c
push esi
push ebx
call fcn.00493bbb
push ebx
call fcn.00493c66
lea eax, [edi + 0x20]
push eax
push ebx
call fcn.00493b9c
push esi
push ebx
call fcn.00493bbb
push ebx
call fcn.00493c66
lea eax, [edi + 0x30]
push eax
push ebx
call fcn.00493b9c
add esp, 0x44
push esi
push ebx
call fcn.00493bbb
push ebx
call fcn.00493c66
lea eax, [edi + 0x40]
push eax
push ebx
call fcn.00493b9c
push esi
push ebx
call fcn.00493bbb
push ebx
call fcn.00493c66
lea eax, [edi + 0x50]
push eax
push ebx
call fcn.00493b9c
push esi
push ebx
call fcn.00493bbb
push ebx
call fcn.00493c66
lea eax, [edi + 0x60]
push eax
push ebx
call fcn.00493b9c
push esi
push ebx
call fcn.00493bbb
add esp, 0x44
push ebx
call fcn.00493c66
lea eax, [edi + 0x70]
push eax
push ebx
call fcn.00493b9c
push esi
push ebx
call fcn.00493bbb
push ebx
call fcn.00493c66
lea eax, [edi + 0x80]
push eax
push ebx
call fcn.00493b9c
push esi
push ebx
call fcn.00493bbb
push ebx
call fcn.00493c66
lea eax, [edi + 0x90]
push eax
push ebx
call fcn.00493b9c
push esi
push ebx
call fcn.00493bbb
add edi, 0xa0
push edi
push ebx
call fcn.00493b9c
add esp, 0x44
pop edi
pop esi
pop ebx
ret

Function at 0x493e5a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x10]
lea eax, [edi + 0xa0]
push eax
push ebx
call fcn.00493b9c
mov esi, 0x5400cc
push esi
push ebx
call fcn.00493f69
lea eax, [edi + 0x90]
push eax
push ebx
call fcn.00493b9c
push ebx
call fcn.00494014
push esi
push ebx
call fcn.00493f69
lea eax, [edi + 0x80]
push eax
push ebx
call fcn.00493b9c
push ebx
call fcn.00494014
push esi
push ebx
call fcn.00493f69
lea eax, [edi + 0x70]
push eax
push ebx
call fcn.00493b9c
add esp, 0x40
push ebx
call fcn.00494014
push esi
push ebx
call fcn.00493f69
lea eax, [edi + 0x60]
push eax
push ebx
call fcn.00493b9c
push ebx
call fcn.00494014
push esi
push ebx
call fcn.00493f69
lea eax, [edi + 0x50]
push eax
push ebx
call fcn.00493b9c
push ebx
call fcn.00494014
push esi
push ebx
call fcn.00493f69
lea eax, [edi + 0x40]
push eax
push ebx
call fcn.00493b9c
push ebx
call fcn.00494014
add esp, 0x40
push esi
push ebx
call fcn.00493f69
lea eax, [edi + 0x30]
push eax
push ebx
call fcn.00493b9c
push ebx
call fcn.00494014
push esi
push ebx
call fcn.00493f69
lea eax, [edi + 0x20]
push eax
push ebx
call fcn.00493b9c
push ebx
call fcn.00494014
push esi
push ebx
call fcn.00493f69
lea eax, [edi + 0x10]
push eax
push ebx
call fcn.00493b9c
push ebx
call fcn.00494014
push esi
push ebx
call fcn.00493f69
add esp, 0x44
push edi
push ebx
call fcn.00493b9c
pop ecx
pop ecx
pop edi
pop esi
pop ebx
ret
Function at 0x497b6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x497bbd
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.0048bf35
push eax
push dword [ebp + 0xc]
push str.Could_not_open_registry_key__s.__s
push dword [ebp + 0x1c]
call fcn.004dd565
add esp, 0x18
jmp 0x497c0f
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push dword [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x497c13
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.0048bf35
push eax
push dword [ebp + 0x10]
push str.Could_not_read_registry_value__s.__s
push dword [ebp + 0x1c]
call fcn.004dd565
add esp, 0x18
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
leave
ret
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Operation_complete.
push dword [ebp + 0x1c]
call fcn.004dd750
pop ecx
pop ecx
push 1
pop eax
leave
ret

Function at 0x497c30
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push edi
call fcn.0048b624
cmp eax, 1
jne 0x497c63
lea eax, [ebp - 0x10]
push eax
call fcn.0045f6fd
test eax, eax
pop ecx
je 0x497c5b
or eax, 0xffffffff
jmp 0x497d15
lea eax, [ebp - 4]
push eax
push 3
jmp 0x497c69
lea eax, [ebp - 4]
push eax
push 2
xor esi, esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
je 0x497c9f
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x110]
push 0x100
push eax
call fcn.0048bf35
push eax
push dword [ebp + 0xc]
push str.could_not_create_registry_key__s.__s
jmp 0x497ceb
mov edi, dword [ebp + 0x10]
push esi
push esi
push esi
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
jne 0x497ccc
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, esi
je 0x497cfa
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x110]
push 0x100
push eax
call fcn.0048bf35
push eax
push edi
push str.could_not_set_value__s.__s
push dword [ebp + 0x20]
call fcn.004dd565
add esp, 0x18
xor eax, eax
jmp 0x497d15
push str.Operation_complete.
push dword [ebp + 0x20]
call fcn.004dd750
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x4a641d
Capabilities:
Query environment variable
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2110
call fcn.004dc850
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push dword [eax]
call fcn.0048f76f
mov dword [ebp - 4], eax
lea eax, [ebp - 0x110]
mov dword [esp], 0x104
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x110]
push 0x51d538
push eax
call fcn.004dd760
lea eax, [ebp - 0x110]
push str.t0000002.tmp
push eax
call fcn.004dd760
mov esi, dword [ebp + 0xc]
push 0x51b96c
push esi
call fcn.004de577
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x4a64aa
push esi
mov esi, 0x32d
push 2
push esi
push 0x545598
push dword [ebp - 4]
call fcn.0045fd8e
add esp, 0x14
jmp 0x4a65b7
lea eax, [ebp - 0x110]
push 0x53f8b8
push eax
call fcn.004de577
pop ecx
mov dword [ebp - 8], eax
test eax, eax
pop ecx
jne 0x4a64d7
push edi
call fcn.004de06b
push esi
push 2
mov esi, 0x32d
jmp 0x4a65a6
test byte [edi + 0xc], 0x10
jne 0x4a6563
mov esi, 0x1000
push esi
lea eax, [ebp - 0x1110]
push 0
push eax
call fcn.004d9ad0
push esi
lea eax, [ebp - 0x2110]
push 0
push eax
call fcn.004d9ad0
push edi
call fcn.004e2a59
mov ebx, eax
push edi
push esi
lea eax, [ebp - 0x1110]
push 1
push eax
call fcn.004de387
push dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x2110]
push ebx
push 0
push esi
push eax
lea eax, [ebp - 0x1110]
push eax
push dword [ebp + 8]
call fcn.004a6667
add esp, 0x48
test eax, eax
jne 0x4a65bb
push dword [ebp - 8]
lea eax, [ebp - 0x2110]
push dword [ebp - 0xc]
push 1
push eax
call fcn.004e2f39
add esp, 0x10
test byte [edi + 0xc], 0x10
je 0x4a64e6
mov esi, dword [ebp + 0xc]
push edi
call fcn.004de06b
push dword [ebp - 8]
call fcn.004de06b
push esi
call fcn.004e24fa
add esp, 0xc
cmp eax, 0xffffffff
je 0x4a6592
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.004e2fbb
pop ecx
test eax, eax
pop ecx
je 0x4a65d5
lea eax, [ebp - 0x110]
push eax
call fcn.004e24fa
push esi
push 2
mov esi, 0x32e
push esi
push 0x545598
push dword [ebp - 4]
call fcn.0045fd8e
add esp, 0x18
mov eax, esi
jmp 0x4a65d7
mov esi, 0x32a
push 2
push esi
push 0x545598
push dword [ebp - 4]
call fcn.0045fd8e
add esp, 0x10
jmp 0x4a65b7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a7224
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x608
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push dword [edi]
call fcn.0048f76f
mov esi, 0x400
mov dword [ebp + 8], eax
xor ebx, ebx
push esi
lea eax, [ebp - 0x608]
push ebx
push eax
call fcn.004d9ad0
lea eax, [ebp - 0x208]
push 0x104
push eax
push dword [ebp + 0xc]
push edi
call fcn.00491d52
lea eax, [ebp - 0x208]
push eax
call fcn.004d9400
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
push edi
call fcn.00491bc1
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.0044be4d
add esp, 0x3c
cmp eax, 0xffffffff
jne 0x4a72bb
lea eax, [ebp - 0x104]
push eax
call fcn.004e2fee
cmp eax, 0xffffffff
pop ecx
jne 0x4a72bb
push 2
mov esi, 0x332
jmp 0x4a733b
push 0x53f9ac
push dword [ebp + 0xc]
call fcn.004de577
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp + 0xc], eax
jne 0x4a72f0
push 0x54a0b4
mov esi, 0x32d
push 2
push esi
push 0x545598
push dword [ebp + 8]
call fcn.0045fd8e
add esp, 0x14
jmp 0x4a734c
push ebx
push dword [ebp + 0x10]
push eax
call fcn.004de42e
add esp, 0xc
push 0x5f
push ebx
push ebx
push dword [ebp + 0x14]
call fcn.004d9400
pop ecx
push eax
lea eax, [ebp - 0x608]
push eax
push dword [ebp + 0x14]
push edi
call fcn.004a65dc
push dword [ebp + 0xc]
lea eax, [ebp - 0x608]
push 1
push esi
push eax
call fcn.004e2f39
add esp, 0x2c
test eax, eax
jne 0x4a7350
push 2
mov esi, 0x32a
push esi
push 0x545598
push dword [ebp + 8]
call fcn.0045fd8e
add esp, 0x10
mov eax, esi
jmp 0x4a735b
push dword [ebp + 0xc]
call fcn.004de06b
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a75ef
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
push dword [eax]
call fcn.0048f76f
mov esi, dword [0x5459e0]
mov dword [esp], 0x51b96c
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
neg esi
call fcn.004de577
mov edi, eax
pop ecx
test edi, edi
pop ecx
jne 0x4a7640
push 0x54a0b4
mov esi, 0x32d
push 2
push esi
push 0x545598
push dword [ebp - 4]
call fcn.0045fd8e
add esp, 0x14
jmp 0x4a76ac
push edi
push 1
lea eax, [ebp + 8]
push 1
push eax
call fcn.004de387
add esp, 0x10
test eax, eax
je 0x4a768b
push dword [ebp + 8]
add esi, eax
call fcn.004a76b2
mov eax, dword [0x5459e0]
dec eax
push eax
push dword [ebp + 0x10]
push dword [0x55ab1c]
call fcn.004def1d
add esp, 0x10
test eax, eax
jne 0x4a7640
mov eax, dword [ebp + 0x14]
push edi
mov dword [eax], esi
call fcn.004de06b
pop ecx
xor eax, eax
jmp 0x4a76ae
push edi
call fcn.004de06b
push dword [ebp + 0xc]
mov esi, 0x33b
push 2
push esi
push 0x545598
push dword [ebp - 4]
call fcn.0045fd8e
add esp, 0x18
mov eax, esi
pop edi
pop esi
leave
ret