joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x5be9c0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
jmp 0x468db8
mov eax, dword [ebp - 8]
add eax, 1
mov ecx, dword [ebp - 4]
adc ecx, 0
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
ja 0x468dd0
jb 0x468dc6
cmp dword [ebp - 8], 0x40
jae 0x468dd0
mov edx, dword [ebp - 8]
mov byte [ebp + edx - 0x50], 0
jmp 0x468da6
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
jmp 0x468df2
mov eax, dword [ebp - 8]
add eax, 1
mov ecx, dword [ebp - 4]
adc ecx, 0
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
ja 0x468eed
jb 0x468e0c
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jae 0x468eed
cmp dword [ebp + 0x18], 0
je 0x468e4d
mov ecx, dword [ebp - 8]
and ecx, 0xff
mov edx, dword [ebp - 4]
and edx, 0
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], edx
mov eax, dword [ebp - 0x70]
or eax, dword [ebp - 0x6c]
jne 0x468e4d
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0x18]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x468e4d
mov eax, dword [ebp - 0x5c]
jmp 0x468eef
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [edx + 0xc]
call ecx
mov edx, dword [ebp - 0x68]
push edx
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [edx + 0x10]
call ecx
lea edx, [ebp - 0x50]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ecx + 0x14]
call eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [edx + 0x18]
call ecx
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x40
jbe 0x468ea1
mov eax, 1
jmp 0x468eef
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x60], 0
jmp 0x468eba
mov edx, dword [ebp - 0x60]
add edx, 4
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x58]
jae 0x468ed1
mov ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0x54]
xor edx, dword [ebp + ecx - 0x50]
mov dword [ebp - 0x54], edx
jmp 0x468eb1
cmp dword [ebp + 0x10], 0
je 0x468ee8
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [eax]
je 0x468ee8
mov eax, 1
jmp 0x468eef
jmp 0x468de0
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004c2ee0
mov esp, ebp
pop ebp
ret 0x14
Function at 0x46a900
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], ecx
mov byte [ebp - 0x11], 0
push str.GetDiskFreeSpaceExW
push 0x562764
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x46a96e
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x38]
push eax
call dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
xor ecx, ecx
cmp dword [ebp - 0x34], 0
setne cl
mov byte [ebp - 0x11], cl
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [edx], eax
mov ecx, dword [ebp - 0x2c]
mov dword [edx + 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x28]
mov dword [edx], eax
mov ecx, dword [ebp - 0x24]
mov dword [edx + 4], ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0x46a990
xor al, al
jmp 0x46a9e6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mul ecx
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov dword [ecx + 4], edx
movzx edx, byte [ebp - 0x11]
test edx, edx
jne 0x46a9e4
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, dword [ebp - 0x3c]
push ecx
push eax
mov eax, dword [edx + 4]
push eax
mov ecx, dword [edx]
push ecx
call fcn.004c9120
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
xor eax, eax
mov ecx, dword [ebp - 0x3c]
push eax
push edx
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ecx]
push eax
call fcn.004c9120
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x46be30
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x6c], ecx
mov eax, dword [ebp - 0x6c]
mov dword [eax], SysReAllocString
mov dword [eax + 4], 0
mov dword [ebp - 0x48], 0x40
push 0x57984c
push 0x562764
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46beb9
lea ecx, [ebp - 0x48]
push ecx
call dword [ebp - 4]
test eax, eax
je 0x46beb9
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x3c]
ja 0x46be9b
jb 0x46be8d
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x40]
jae 0x46be9b
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x74], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x70], edx
jmp 0x46bea7
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x74]
mov dword [edx], eax
mov ecx, dword [ebp - 0x70]
mov dword [edx + 4], ecx
mov al, 1
jmp 0x46beef
mov dword [ebp - 0x68], 0x20
lea edx, [ebp - 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x60]
jae 0x46beda
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x78], ecx
jmp 0x46bee0
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x78], edx
mov eax, dword [ebp - 0x78]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
mov dword [edx], eax
mov dword [edx + 4], ecx
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x48ea00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x551c8b
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x5be9c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6c], ecx
push 0x581f5f
lea ecx, [ebp - 0x2c]
call fcn.00471c50
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x6c]
add ecx, 0x18
call fcn.00471f60
movzx eax, al
test eax, eax
je 0x48ea64
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ecx]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00471dd0
jmp 0x48eace
push 0x5828f0
mov eax, dword [ebp - 0x6c]
add eax, 0x18
push eax
lea ecx, [ebp - 0xac]
push ecx
call fcn.00490820
add esp, 0xc
mov dword [ebp - 0x78], eax
mov edx, dword [ebp - 0x78]
mov dword [ebp - 0x74], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x74]
push edx
lea eax, [ebp - 0x94]
push eax
call fcn.00474cc0
add esp, 0xc
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0048f490
lea ecx, [ebp - 0x94]
call fcn.00471d30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xac]
call fcn.00471d30
mov byte [ebp - 0x65], 0
lea ecx, [ebp - 0x64]
call fcn.0047c070
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x6c]
add edx, 8
push edx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x64]
call fcn.0047c100
push 0
push 0x80
push 2
push 0
push 7
push 0x40000000
lea ecx, [ebp - 0x2c]
call fcn.00471ed0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xffffffff
je 0x48eb55
lea ecx, [ebp - 0x44]
call fcn.0046dae0
mov dword [ebp - 0x14], eax
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x44]
call fcn.00471ed0
push eax
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x48eb4b
mov byte [ebp - 0x65], 1
mov ecx, dword [ebp - 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dl, byte [ebp - 0x65]
mov byte [ebp - 0x66], dl
lea ecx, [ebp - 0x44]
call fcn.00471d30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.0047b7a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00471d30
mov al, byte [ebp - 0x66]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c2ee0
mov esp, ebp
pop ebp
ret
Function at 0x493500
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x551ffb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x5be9c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x493634
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x49359b
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x238]
call fcn.00495650
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
push ecx
call fcn.00496f70
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.004956b0
jmp 0x493634
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4935b0
mov al, 1
jmp 0x493636
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.004c62d0
add esp, 0xc
mov ecx, 0x82
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x218]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004c4d94
add esp, 8
test eax, eax
jne 0x493634
push 4
push 0
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov al, 1
jmp 0x493636
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c2ee0
mov esp, ebp
pop ebp
ret

Function at 0x493660
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x85c
mov eax, dword [0x5be9c0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x804], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x802]
push ecx
call fcn.004c62d0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
push str._s___s_
lea ecx, [ebp - 0x804]
push ecx
call fcn.00496fb0
add esp, 0x10
push 0x44
push 0
lea edx, [ebp - 0x848]
push edx
call fcn.004c62d0
add esp, 0xc
mov dword [ebp - 0x848], 0x44
mov dword [ebp - 0x81c], 1
mov eax, 5
mov word [ebp - 0x818], ax
lea ecx, [ebp - 0x858]
push ecx
lea edx, [ebp - 0x848]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x493717
mov byte [ebp - 0x859], 1
jmp 0x49371e
mov byte [ebp - 0x859], 0
mov al, byte [ebp - 0x859]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c2ee0
mov esp, ebp
pop ebp
ret
Function at 0x4939f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5be9c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00493740
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x493a5e
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x493a45
mov dword [ebp - 0x10], 1
jmp 0x493a4c
mov dword [ebp - 0x10], 0
mov dl, byte [ebp - 0x10]
mov byte [ebp - 9], dl
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x493ab6
lea ecx, [ebp - 8]
push ecx
push 0xf023f
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00493740
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x493ab6
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x493a9f
mov dword [ebp - 0x14], 1
jmp 0x493aa6
mov dword [ebp - 0x14], 0
mov al, byte [ebp - 0x14]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 9]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c2ee0
mov esp, ebp
pop ebp
ret

Function at 0x493ad0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5be9c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
mov dword [ebp - 8], 0
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x493b6e
push str.RegDeleteTreeW
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x493b64
lea ecx, [ebp - 8]
push ecx
push 0xf013f
push 0
push 0x5833a4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x493b64
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [ebp - 0x18]
test eax, eax
jne 0x493b4d
mov dword [ebp - 0x14], 1
jmp 0x493b54
mov dword [ebp - 0x14], 0
mov dl, byte [ebp - 0x14]
mov byte [ebp - 9], dl
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 8]
push edx
push 0xf023f
push 0
push 0x5833a8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x493bbe
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jne 0x493ba7
mov dword [ebp - 0x1c], 1
jmp 0x493bae
mov dword [ebp - 0x1c], 0
mov al, byte [ebp - 0x1c]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 9]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c2ee0
mov esp, ebp
pop ebp
ret
Function at 0x493bd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5be9c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x11], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00493740
add esp, 4
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x10]
push ecx
push 0x2021f
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x493c57
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x493c57
lea edx, [ebp - 0x10]
push edx
push 0x2021f
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push str.dword
mov edx, dword [ebp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x493c9b
mov eax, dword [ebp + 0x14]
push eax
call fcn.004c4de4
add esp, 4
mov dword [ebp - 0xc], eax
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x493c99
mov byte [ebp - 0x11], 1
jmp 0x493d03
push 0x5833b8
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x493d03
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
add eax, 2
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x18]
mov dx, word [ecx]
mov word [ebp - 0x1e], dx
add dword [ebp - 0x18], 2
cmp word [ebp - 0x1e], 0
jne 0x493cbd
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x24]
sar eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
lea edx, [ecx + ecx + 2]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 1
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x493d03
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c2ee0
mov esp, ebp
pop ebp
ret
Function at 0x493d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5be9c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x11], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00493740
add esp, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push 0x2021f
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x493e3f
mov dword [ebp - 8], 0x400
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 8]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
push eax
call fcn.004b0c55
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x493dd4
mov ecx, dword [ebp - 0x20]
push ecx
push 0
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004c62d0
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
jmp 0x493ddb
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x493e11
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 0x14]
call fcn.0046d5a0
mov byte [ebp - 0x11], 1
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.004b0c50
add esp, 4
cmp dword [ebp - 0x28], 0
jne 0x493e32
mov dword [ebp - 0x30], 0
jmp 0x493e3f
mov dword [ebp - 0x18], 0x8123
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x30], ecx
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c2ee0
mov esp, ebp
pop ebp
ret
Function at 0x4940e0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc70
mov eax, dword [0x5be9c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov word [ebp - 0xc14], ax
push 0xa06
push 0
lea ecx, [ebp - 0xc12]
push ecx
call fcn.004c62d0
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.__s___s
lea ecx, [ebp - 0xc14]
push ecx
call fcn.00497010
add esp, 0x10
xor edx, edx
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.004c62d0
add esp, 0xc
mov ecx, 0x82
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x44
push 0
lea edx, [ebp - 0xc58]
push edx
call fcn.004c62d0
add esp, 0xc
mov dword [ebp - 0xc58], 0x44
mov dword [ebp - 0xc2c], 1
push str.hide
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4941b1
xor ecx, ecx
mov word [ebp - 0xc28], cx
jmp 0x4941bd
mov edx, 5
mov word [ebp - 0xc28], dx
mov dword [ebp - 0xc70], 0
push str.infi
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4941e6
mov dword [ebp - 0xc70], 0xffffffff
jmp 0x4941f8
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.004c4de4
add esp, 4
mov dword [ebp - 0xc70], eax
mov byte [ebp - 0xc69], 0
push 0x58342c
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x494271
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x494271
lea ecx, [ebp - 0xc68]
push ecx
lea edx, [ebp - 0xc58]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0xc14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x49425c
mov byte [ebp - 0xc6a], 1
jmp 0x494263
mov byte [ebp - 0xc6a], 0
mov cl, byte [ebp - 0xc6a]
mov byte [ebp - 0xc69], cl
jmp 0x4942bf
lea edx, [ebp - 0xc68]
push edx
lea eax, [ebp - 0xc58]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0x20
push 0
push 0
push 0
lea edx, [ebp - 0xc14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4942ac
mov byte [ebp - 0xc6b], 1
jmp 0x4942b3
mov byte [ebp - 0xc6b], 0
mov al, byte [ebp - 0xc6b]
mov byte [ebp - 0xc69], al
movzx ecx, byte [ebp - 0xc69]
test ecx, ecx
je 0x494301
cmp dword [ebp - 0xc70], 0
je 0x4942e7
mov edx, dword [ebp - 0xc70]
push edx
mov eax, dword [ebp - 0xc68]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0xc64]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc68]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0xc69]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c2ee0
mov esp, ebp
pop ebp
ret