joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa81d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xa81d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xa81d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xa81d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xa81d94
push eax
push esi
call fcn.00a8420b
add esp, 8
pop esi
ret 0x10

Function at 0xa81da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa81e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xa81e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xa9a320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00a83dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xa81dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xa81e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa81ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xa81eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xa9a320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00a83dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xa81eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xa81e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xa82000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xa82131
push esi
call fcn.00a85145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00a74080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xa82131
push 0
push ebp
call fcn.00a743a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00a74260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xa8208b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00a742f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xa82121
push 0xa9a918
push edi
call fcn.00a833f0
push eax
push ebx
push esi
call fcn.00a81f60
push 0xa9a8f8
push edi
call fcn.00a833f0
push eax
push ebx
push esi
call fcn.00a81f60
push 0xa9a8d8
push edi
call fcn.00a833f0
push eax
push ebx
push esi
call fcn.00a81f60
push 0xa9a8c0
push edi
call fcn.00a833f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00a81f60
push 0xa9a8a0
push edi
call fcn.00a833f0
push eax
push ebx
push esi
call fcn.00a81f60
push 0xa9a888
push edi
call fcn.00a833f0
push eax
push ebx
push esi
call fcn.00a81f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xa831b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00a83140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00a83140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00a83140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00a83140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xa83bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xa83c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xa9587c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xa83c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xa83c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x442ec0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x481014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [ecx + 0x38], 0
je 0x442f62
mov esi, ecx
cmp byte [ecx + 0x3d], 0
je 0x442f62
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0xffffffffffffffff
call edi
cmp eax, 0xffffffff
je 0x442f60
mov ebx, dword [esi + 0x38]
lea eax, [esi + 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [ebx]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
mov ecx, ebx
mov ebx, edx
push eax
lea eax, [ebp - 0x10]
push eax
push edx
push dword [ebp - 0x38]
call edi
cmp eax, 3
je 0x442f76
cmp eax, 1
je 0x442f3c
test eax, eax
jne 0x442f60
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x34]
sub edi, ebx
je 0x442f57
push dword [esi + 0x4c]
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x442f60
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x442f62
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043f980
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x3d], 0
mov bl, 1
jmp 0x442f62
Function at 0x406451
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40e9c3
call fcn.0040d3d4
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x4166f0]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x4065c3
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4065c3
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4065c3
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x4065c3
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x40653b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x4065b1
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x4065b1
mov ecx, 0x1234
cmp cx, ax
jne 0x4065b1
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x40658e
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp eax, 0xffffffff
je 0x4065c1
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x4064a9
jmp 0x4065c3
xor edi, edi
mov eax, edi
call fcn.0040d38f
ret 4

Function at 0x40c819
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40c828
pop dword [ebp - 0x38]
mov eax, 0xde45b11a
sub eax, 0xde04e8f2
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x39e86
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x7f76f712
sub ecx, 0x7f76a964
xor ebx, ebx
add ebx, eax
mov esi, 0x9bfec372
sub esi, 0x9bbd1972
add esi, dword [ebp - 0x38]
mov edx, 0x15206d59
sub edx, 0xb950293
add dword [ebp - 0xc], ebx
mov edi, dword [esi]
xor dword [ebp - 8], 0x2a24e01
add edi, edx
xor dword [ebp - 0x20], 0x7f1d3f8f
mov dword [ebx], edi
add ebx, 0xe87e01f3
sub ebx, 0xe87e01ef
add esi, 0x974bb09d
add esi, 0x68b44f67
loop 0x40c884
add eax, 0xd26d4972
sub eax, 0xd26c1fe7
mov ebx, eax
add eax, 0xb4a3db2a
add eax, 0x4b5c24db
mov ecx, 0xf80749f9
sub ecx, 0xf7c749f9
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x44fc10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jne 0x44fc2d
mov eax, dword [ebp + 8]
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
mov dword [eax], 1
pop ebx
pop ebp
ret
push esi
push edi
push 2
push 0
push 0
push ebx
call fcn.0046103c
push ebx
call fcn.0045f53f
push 0
push 0
push 0
push ebx
mov edi, eax
mov esi, edx
call fcn.0046103c
add esp, 0x24
test esi, esi
jg 0x44fc68
jl 0x44fc5e
test edi, edi
jae 0x44fc68
mov ecx, 2
jmp 0x44fd26
xor eax, eax
cmp eax, esi
jne 0x44fd21
mov esi, dword [section..data]
lea eax, [edi + 2]
push eax
mov ecx, esi
call dword [0x483430]
call esi
mov esi, eax
add esp, 4
test esi, esi
jne 0x44fca3
mov eax, dword [ebp + 8]
pop edi
mov dword [eax + 8], esi
mov dword [eax + 4], esi
pop esi
mov dword [eax], 3
pop ebx
pop ebp
ret
push ebx
push edi
push 1
push esi
call fcn.00462862
add esp, 0x10
cmp eax, edi
je 0x44fce4
push esi
mov esi, dword [fcn.004166d0]
mov ecx, esi
call dword [0x483430]
call esi
mov eax, dword [ebp + 8]
add esp, 4
pop edi
pop esi
mov dword [eax], 2
mov dword [eax + 8], 0
mov dword [eax + 4], 0
pop ebx
pop ebp
ret
push edi
push esi
push dword [ebp + 0x18]
call fcn.0044f6e0
add esp, 0xc
push dword [ebp + 0x1c]
push 1
push 1
push eax
push dword [ebp + 0x14]
push eax
push edi
push esi
call fcn.00452900
add esp, 0xc
push eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push eax
push eax
push esi
call fcn.0044f8d0
add esp, 0x28
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, 3
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov dword [eax + 8], 0
mov dword [eax + 4], 0
pop ebp
ret
Function at 0x46c0d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0046bdd6
sub ebp, esp
push ecx
popal
lea eax, [ebp - 0x40]
push eax
call fcn.0046bde6
push eax
push esi
push dword [ebp + 8]
call fcn.0046bd9b
add esp, 0x10
mov dword [ebp - 0x88], eax
js 0x46c131
invalid
invalid
call fcn.0046bdd6
push eax
xchg ebx, eax
jle 0x46c0ff
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0046bde6
push eax
push esi
push dword [ebp + 8]
call fcn.0046bd9b
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0046bde6
push eax
push esi
push dword [ebp + 8]
call fcn.0046bd9b
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0046bde6
push eax
push esi
push dword [ebp + 8]
call fcn.0046bd9b
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0046bdd6
invalid

Function at 0x46c352
Capabilities:
Inspect section memory permissions

Disassembly:
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x46c5c5
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x46c37b
cmp dword [eax + 0xc], ebx
je 0x46c41e
mov edi, dword [eax + 0xc]
add edi, esi
push edi
invalid
Function at 0x46c4e5
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x46c4ad
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x46c4cb
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
inc ebp
invalid
ja 0x46c529
inc ebp
mov esp, 0xd78b4077
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x46c510
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x46c519
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x46c523
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x46c505
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x46c48f
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
add al, 7
sub eax, ecx
je 0x46c576
dec eax
je 0x46c56d
sub eax, 3
je 0x46c564
mov dword [ebp - 4], 0x40
jmp 0x46c593
mov dword [ebp - 4], 4
jmp 0x46c579
mov dword [ebp - 4], 0x20
jmp 0x46c579
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x46c5c5
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x46c545
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0046bdd6
sub cl, 2
in eax, dx
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x46c5d1
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46cd37
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
invalid
invalid
invalid

Function at 0x46dde4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp ah, 0xff
inc dword [ebx - 0x37f43]
invalid

Function at 0x470df0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x488024
push 0x48801c
push str.FlsAlloc
push 0x1e
call fcn.00470c71
mov esi, eax
add esp, 0x10
test esi, esi
je 0x470e24
push dword [ebp + 8]
mov ecx, esi
call dword [0x483430]
call esi
jmp 0x470e2a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x470e6e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x488034
push 0x48802c
push str.FlsGetValue
push 0x20
call fcn.00470c71
mov esi, eax
add esp, 0x10
test esi, esi
je 0x470ea5
push dword [ebp + 8]
mov ecx, esi
call dword [0x483430]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x471fde
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00471e4f

Function at 0x473665
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4a4100]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4736b0
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00473804
test al, al
jne 0x4736aa
sub edx, 2
cmp edx, edi
jne 0x473690
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4736d2
lea eax, [edi + 2]
cmp edx, eax
je 0x4736d2
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004735b1
add esp, 0x10
jmp 0x4737cc
push esi
lea ecx, [ebp - 0x255]
call fcn.00473804
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x473715
push dword [ebp - 0x25c]
jmp 0x4736c2
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x473752
cmp word [ebp - 0x226], 0
je 0x473773
cmp word [ebp - 0x226], ax
jne 0x473752
cmp word [ebp - 0x224], 0
je 0x473773
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004735b1
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4737bf
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x47372c
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4737a7
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4737cc
push 0x4733e1
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00479250
add esp, 0x10
jmp 0x47379c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045360d
leave
ret

Function at 0x47a050
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47a07d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47a07d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x445273
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push 0x40143c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x4452e3
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x4052c8
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4452da
cmp dword [ebp - 0xc], 4
jne 0x4452da
cmp dword [ebp - 0x10], edi
je 0x4452da
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x608298], edi
xor eax, eax
jmp 0x445322
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x608298], edi
jge 0x44531d
lea eax, [ebp - 0x34]
push eax
mov dword [0x608298], edi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x44531d
cmp word [ebp - 0x14], 5
jb 0x44531d
call fcn.00590d29
test eax, eax
je 0x44531d
emms
mov dword [0x608298], 1
mov eax, dword [0x608298]
pop edi
leave
ret

Function at 0x4bc71d
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x620894]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x20]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp + 0x24]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
je 0x4bc81a
mov edi, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
xor esi, esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push ebx
push esi
push esi
call edi
mov dword [ebp - 0xac], eax
add eax, 3
and eax, 0xfffffffc
call fcn.006001b0
cmp dword [ebp - 0xac], esi
mov dword [ebp - 0xa8], esp
jne 0x4bc7cb
push 0x40610c
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov eax, 0x8876086c
jmp 0x4bc845
push esi
push esi
push dword [ebp - 0xac]
push dword [ebp - 0xa8]
push 0xffffffffffffffff
push ebx
push esi
push esi
call edi
fld dword [ebp + 0x18]
push dword [ebp - 0xa4]
push dword [ebp - 0x9c]
push dword [ebp - 0xa0]
push ecx
push ecx
fstp dword [esp + 4]
fld dword [ebp + 0x14]
fstp dword [esp]
push dword [ebp - 0xa8]
push dword [ebp - 0xb0]
push dword [ebp - 0xb4]
call fcn.00590d29
jmp 0x4bc845
fld dword [ebp + 0x18]
push 1
push dword [ebp - 0xa4]
push dword [ebp - 0x9c]
push dword [ebp - 0xa0]
push ecx
push ecx
fstp dword [esp + 4]
fld dword [ebp + 0x14]
fstp dword [esp]
push ebx
push edi
push esi
call fcn.00590d29
lea esp, [ebp - 0xc0]
mov ecx, dword [ebp - 4]
call fcn.006006b0
pop edi
pop esi
pop ebx
leave
ret 0x20