joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4669b0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf2d8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x505034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
test edi, edi
je 0x466b68
cmp word [edi], 0
je 0x466b68
test dl, dl
jne 0x466a08
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne al
jmp 0x466b6a
push 3
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
xor eax, eax
movq qword [ebp - 0x1c], xmm0
push 0x4eb5d0
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
call fcn.00415170
mov ecx, edi
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x466a60
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x34]
call fcn.00415170
push 0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 1
push 1
push eax
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x1c]
call fcn.00466d30
add esp, 0xc
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x466ad1
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x466ac7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466b86
push edx
push ecx
call fcn.00479e95
add esp, 8
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x466b1f
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x466b15
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466b86
push edx
push ecx
call fcn.00479e95
add esp, 8
mov esi, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
cmp esi, dword [ebp - 0x1c]
je 0x466b51
nop dword [eax + eax]
add esi, 0xffffffe8
xor dl, dl
mov ecx, esi
call fcn.00422fb0
cmp esi, dword [ebp - 0x1c]
jne 0x466b40
xor dl, dl
mov ecx, edi
call fcn.004669b0
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.00416120
mov al, bl
jmp 0x466b6a
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00479e61
mov esp, ebp
pop ebp
ret
call fcn.0049b19a
int3
Function at 0x466b90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf313
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x505034]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, edx
mov dword [ebp - 0x28], eax
mov edi, ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x2c], eax
push ecx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x466c9e
push ebx
call fcn.0047a32d
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
push esi
push ebx
mov byte [ebp - 4], 1
push dword [ebp - 0x18]
push dword [ebp - 0x28]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x466cc0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x4e5ddc
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x466ce2
mov ecx, dword [ebp - 0x24]
cmp dword [ecx], 0xfeef04bd
jne 0x466d04
mov edx, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
mov eax, ecx
shr eax, 0x10
mov word [edi], ax
mov eax, edx
shr eax, 0x10
mov word [edi + 2], cx
mov word [edi + 4], ax
mov word [edi + 6], dx
test esi, esi
je 0x466c66
push esi
call fcn.0047a31f
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00479e61
mov esp, ebp
pop ebp
ret
push 0x4eda14
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x40]
call fcn.0046c650
push 0x50271c
lea eax, [ebp - 0x40]
push eax
call fcn.00491d27
push 0x4eda00
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x54]
call fcn.0046c650
push 0x50271c
lea eax, [ebp - 0x54]
push eax
call fcn.00491d27
push 0x4eda50
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x68]
call fcn.0046c650
push 0x50271c
lea eax, [ebp - 0x68]
push eax
call fcn.00491d27
push str.VerQueryValueW_signature_is_invalid
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x7c]
call fcn.0046c650
push 0x50271c
lea eax, [ebp - 0x7c]
push eax
call fcn.00491d27
int3
Function at 0x467320
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf428
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x505034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x24], esi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x46737d
mov eax, dword [edi]
push eax
mov eax, dword [ebp + 8]
movzx eax, ax
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x467424
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x46744f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x4673f1
push dword [ebp - 0x20]
push 0x400000
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4673e4
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0042abd0
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push ebx
call fcn.00491db0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x18]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 8], eax
mov eax, esi
mov dword [esi], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00479e61
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.00414fe0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push dword [ebp + 8]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.00467730
push 0x50271c
lea eax, [ebp - 0x38]
push eax
call fcn.00491d27
push str.resource_was_not_properly_loaded
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x38]
call fcn.0046c650
push 0x50271c
lea eax, [ebp - 0x38]
push eax
call fcn.00491d27
int3
Function at 0x468220
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x505034]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], ecx
mov dword [ebp - 0x208], 0
push esi
push edi
mov edi, edx
test ecx, ecx
je 0x468336
test edi, edi
je 0x468336
cmp word [edi], 0
je 0x468336
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
mov eax, ebx
or eax, 8
push eax
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x468318
nop word [eax + eax]
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4682d9
mov ecx, dword [ebp - 0x208]
lea edx, [ebp - 0x204]
push ebx
call fcn.00468220
add esp, 4
test al, al
je 0x4682cb
xor esi, esi
jmp 0x468290
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x468290
jmp 0x468318
test esi, esi
jne 0x468318
push str.advapi32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x468309
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x468309
push esi
push ebx
push edi
push dword [ebp - 0x20c]
call eax
jmp 0x468316
push edi
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [ebp - 0x208]
pop ebx
test eax, eax
je 0x46833b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x208], 0
jmp 0x46833b
mov esi, 0x57
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.00479e61
mov esp, ebp
pop ebp
ret
Function at 0x468360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x505034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jne 0x46839a
lea ebx, [ecx + 0x57]
jmp 0x46845c
test edx, edx
je 0x4683c5
cmp word [edx], 0
je 0x4683c5
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x14]
or eax, 1
push eax
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x468443
jmp 0x4683c8
mov dword [ebp - 0xc], esi
mov edx, dword [edi]
xor esi, esi
mov dword [ebp - 8], esi
nop
mov ebx, dword [edi + 4]
mov ecx, ebx
sub ecx, edx
cmp esi, ecx
jae 0x4683e0
lea eax, [edx + esi]
jmp 0x468407
jbe 0x46840a
mov eax, dword [edi + 8]
sub eax, edx
cmp esi, eax
jbe 0x4683f6
push ecx
push esi
mov ecx, edi
call fcn.0042abd0
jmp 0x46840a
sub esi, ecx
push esi
push 0
push ebx
call fcn.004928b0
add esp, 0xc
lea eax, [esi + ebx]
mov dword [edi + 4], eax
lea eax, [ebp - 8]
push eax
push dword [edi]
push dword [ebp - 0x10]
push 0
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [ebp - 8]
mov ebx, eax
mov eax, dword [edi]
test eax, eax
jne 0x468436
test esi, esi
je 0x468436
xor edx, edx
test ebx, ebx
je 0x4683d0
mov edx, eax
cmp ebx, 0xea
je 0x4683d0
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46845c
cmp eax, esi
je 0x46845c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
test ebx, ebx
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.00479e61
mov esp, ebp
pop ebp
ret
Function at 0x468a40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x505034]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
test edx, edx
je 0x468ab3
test edi, edi
je 0x468ab3
push 0
lea eax, [ebp - 8]
push eax
push 0
push 2
push 0
push 0
push 0
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x468a9c
push 4
push edi
push 4
push eax
push str.SfxInstProgress
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x468ab8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 0
jmp 0x468ab8
mov esi, 0x57
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.00479e61
mov esp, ebp
pop ebp
ret
Function at 0x468f90
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf628
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x505034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], eax
test edx, edx
jne 0x468fea
lea esi, [ecx + 0x57]
jmp 0x4690dc
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x468ff0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.00415170
push str.NtDeleteKey
push 0x4ebb68
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x469033
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x4690ce
lea ecx, [ebp - 0x158]
call fcn.004692f0
cmp dword [eax + 0x11c], 5
je 0x469070
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x469069
cmp dword [ebp - 0x14], 0
jne 0x469070
mov ecx, 0xf003f
jmp 0x469087
lea ecx, [ebp - 0x2c]
call fcn.00468ae0
test al, al
mov ecx, 0xf013f
mov edx, 0xf023f
cmovne ecx, edx
cmp dword [ebp - 0x18], 8
lea edx, [ebp - 0x30]
push edx
push ecx
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push 8
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4690ce
push str.SymbolicLinkValue
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
jne 0x4690ce
push dword [ebp - 0x30]
call edi
test eax, eax
mov ecx, 5
cmovne esi, ecx
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4690dc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [ebp - 0x18]
test esi, esi
sete bl
cmp edx, 8
jb 0x46911e
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x469114
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46913c
push edx
push ecx
call fcn.00479e95
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00479e61
mov esp, ebp
pop ebp
ret
call fcn.0049b19a
int3
Function at 0x469150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf658
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x505034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x1c], 7
xor eax, eax
mov dword [ebp - 0x20], edi
mov word [ebp - 0x30], ax
mov dword [ebp - 4], eax
test esi, esi
jne 0x4691a3
lea edi, [ecx + 0x57]
jmp 0x469288
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4691b0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x30]
call fcn.00415170
lea ecx, [ebp - 0x158]
call fcn.004692f0
cmp dword [eax + 0x11c], 5
je 0x469206
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x4691ff
cmp dword [ebp - 0x14], 0
jne 0x469206
mov ecx, 0x20019
jmp 0x46921d
lea ecx, [ebp - 0x30]
call fcn.00468ae0
test al, al
mov ecx, 0x20119
mov edx, 0x20219
cmovne ecx, edx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
push 8
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x469267
push eax
push eax
mov byte [ebx], al
lea eax, [ebp - 0x18]
push eax
push esi
push str.SymbolicLinkValue
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x46925e
xor esi, esi
jmp 0x469267
cmp dword [ebp - 0x18], 6
jne 0x469267
mov byte [ebx], 1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x469275
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x469288
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [ebp - 0x1c]
test edi, edi
sete bl
cmp edx, 8
jb 0x4692ca
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4692c0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4692e8
push edx
push ecx
call fcn.00479e95
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00479e61
mov esp, ebp
pop ebp
ret
call fcn.0049b19a
int3
Function at 0x4695c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf688
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x505034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0x10000
mov dword [ebp - 0x14], esi
call fcn.0047a32d
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
push 0x8000
push edi
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x46966d
cmp eax, 0x8000
ja 0x46966d
xor ecx, ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
push eax
mov word [esi], cx
mov ecx, esi
push edi
call fcn.00415170
test edi, edi
je 0x46964f
push edi
call fcn.0047a31f
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00479e61
mov esp, ebp
pop ebp
ret
push ebx
push str.Unable_to_retrieve_environment_variable__ls_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x28]
call fcn.0042a730
push 0x50271c
lea eax, [ebp - 0x28]
push eax
call fcn.00491d27
int3
Function at 0x46a740
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi
Get disk size
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x505034]
xor eax, ebp
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x1b4]
call fcn.0046ca80
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 8
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x1b4]
call fcn.0046cad0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 4
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1b4]
call fcn.0046cad0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 4
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1b4]
call fcn.0046cad0
push 0x3c
lea eax, [ebp - 0x88]
mov dword [ebp - 0x8c], 0x40
push 0
push eax
call fcn.004928b0
add esp, 0x10
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x46a809
push 8
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x1b4]
call fcn.0046cad0
push 8
lea edx, [ebp - 0x6c]
lea ecx, [ebp - 0x1b4]
call fcn.0046cad0
add esp, 8
push 0
push 0
lea eax, [ebp - 0x44]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x46a830
push 8
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x1b4]
call fcn.0046cad0
add esp, 4
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimes]
test eax, eax
je 0x46a8a9
push 4
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x1b4]
call fcn.0046cad0
push 4
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x1b4]
call fcn.0046cad0
push 4
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x1b4]
call fcn.0046cad0
push 4
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x1b4]
call fcn.0046cad0
push 4
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x1b4]
call fcn.0046cad0
push 4
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x1b4]
call fcn.0046cad0
add esp, 0x18
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x46a8ca
push 8
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x1b4]
call fcn.0046cad0
add esp, 4
rdtsc
mov dword [ebp - 0x10], edx
lea ecx, [ebp - 0x1b4]
push 8
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
call fcn.0046cad0
add esp, 4
lea eax, [ebp - 0x18]
push 0xf0000040
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x46a93a
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 8
push dword [ebp - 0x18]
movlpd qword [ebp - 0x14], xmm0
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x46a92f
push 8
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x1b4]
call fcn.0046cad0
add esp, 4
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x1b4]
call fcn.0046cb30
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor ecx, ebp
call fcn.00479e61
mov esp, ebp
pop ebp
ret
Function at 0x46bd70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x500128
push 0x4911e0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x505034]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
push 1
call fcn.00479f49
add esp, 4
test al, al
je 0x46bf45
mov al, 1
mov ecx, 0x50b61c
xchg byte [ecx], al
xor bl, bl
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0
call fcn.00479f17
mov byte [ebp - 0x24], al
mov eax, dword [0x50973c]
cmp eax, 1
je 0x46bf4c
test eax, eax
jne 0x46be4a
mov dword [0x50973c], 1
push 0x4d23fc
push 0x4d23d8
call fcn.004a997d
add esp, 8
test eax, eax
je 0x46be22
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x46c1d0
call fcn.0047a10f
push 0x4d23d4
push 0x4d230c
call fcn.004a9938
add esp, 0xc
mov dword [0x50973c], 2
jmp 0x46be4f
mov bl, 1
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0047a09d
add esp, 4
call fcn.0047ad4e
mov esi, eax
cmp dword [esi], 0
je 0x46be7d
push esi
call fcn.0047a009
add esp, 4
test al, al
je 0x46be7d
mov eax, dword [esi]
push 0
push 2
push 0
call eax
call fcn.0047ad54
mov esi, eax
cmp dword [esi], 0
je 0x46bea0
push esi
call fcn.0047a009
add esp, 4
test al, al
je 0x46bea0
push dword [esi]
call fcn.004a9c21
add esp, 4
call fcn.0047ac21
movzx esi, ax
call fcn.004a982b
push esi
push eax
call fcn.004286b0
mov esi, eax
mov ecx, 0x50b618
call fcn.0046c0e0
call fcn.0047ac57
test al, al
je 0x46bf53
test bl, bl
jne 0x46bed6
call fcn.004a9bfc
push 0
push 1
call fcn.0047a0ba
add esp, 8
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 7
call fcn.0047ab07
push 7
call fcn.0047ab07
push esi
call fcn.004a9c47
push dword [ebp - 0x20]
call fcn.004a9c0b
int3