joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x7588], eax
mov edx, 1
shl edx, cl
mov dword [esi + 0x7584], ecx
mov dword [esi + 0x30], ecx
dec ecx
mov eax, 1
shl eax, cl
xor ebx, ebx
dec edx
push edi
mov dword [esi + 0x758c], eax
inc eax
mov dword [esi + 0x7590], eax
mov ax, word [esi + 0x758c]
add ax, 2
mov word [esi + 0x757e], ax
mov eax, dword [esi + 0x20]
mov dword [esi + 0x7580], ebx
mov word [esi + 0x38], dx
mov dword [esi + 0x7594], ebx
cmp eax, ebx
jne 0x43946a
or eax, 0xffffffff
jmp 0x439495
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
dec eax
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x10]
mov edi, eax
imul edi, edx
add edi, dword [esi + 0x2c]
inc ecx
movzx edi, byte [edi + ecx - 1]
mov dword [esi + 0x18], ecx
cmp ecx, eax
jne 0x439493
inc edx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], edx
mov eax, edi
movzx ecx, ax
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov eax, 0x138b
add eax, eax
inc ecx
cmp eax, 0x10000
jl 0x4394a3
mov eax, 8
sub eax, ecx
push 0x138b
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.00439060
movzx edx, word [esi + 0x758c]
push edx
mov ecx, esi
call fcn.004391b0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4395fa
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
dec eax
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x10]
mov edi, eax
imul edi, edx
add edi, dword [esi + 0x2c]
inc ecx
movzx ebp, byte [edi + ecx - 1]
mov dword [esi + 0x18], ecx
cmp ecx, eax
jne 0x43950b
inc edx
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], edx
cmp ebp, 0xffffffff
je 0x4395fa
mov ecx, dword [esi + 0x34]
mov eax, dword [esp + 0x14]
mov ebx, ebp
shl ebx, cl
movsx ecx, ax
add ebx, ecx
mov ecx, dword [esp + 0x18]
mov edx, ebp
shl edx, cl
xor edx, eax
movzx edi, dx
movsx eax, di
mov ecx, dword [esi + eax*4 + 0x3c]
cmp ecx, ebx
jne 0x43954a
movzx eax, word [esi + eax*2 + 0x4e68]
mov dword [esp + 0x14], eax
jmp 0x4394d3
test ecx, ecx
jl 0x43957e
mov ecx, 0x138b
sub ecx, edi
movzx ecx, cx
test di, di
jne 0x439562
mov ecx, 1
sub edi, ecx
test di, di
jge 0x43956f
add edi, 0x138b
movsx edx, di
mov eax, dword [esi + edx*4 + 0x3c]
cmp eax, ebx
je 0x4395b9
test eax, eax
jg 0x439562
mov edx, dword [esp + 0x14]
push edx
mov ecx, esi
call fcn.004391b0
movzx ecx, word [esi + 0x757e]
cmp cx, word [esi + 0x3a]
movzx eax, bp
mov dword [esp + 0x14], eax
jge 0x4395cd
movsx eax, di
mov word [esi + eax*2 + 0x4e68], cx
inc word [esi + 0x757e]
mov dword [esi + eax*4 + 0x3c], ebx
jmp 0x4394d3
movsx eax, di
movzx ecx, word [esi + eax*2 + 0x4e68]
mov dword [esp + 0x14], ecx
jmp 0x4394d3
push 0x138b
mov ecx, esi
call fcn.00439060
mov cx, word [esi + 0x758c]
add cx, 2
mov word [esi + 0x757e], cx
mov dword [esi + 0x7580], 1
jmp 0x4394c4
mov eax, dword [esp + 0x14]
push eax
mov ecx, esi
call fcn.004391b0
movzx ecx, word [esi + 0x7590]
push ecx
mov ecx, esi
call fcn.004391b0
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x4396f0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0x5891fc
push eax
mov edi, ecx
call fcn.0055ac9d
mov esi, eax
xor eax, eax
add esp, 8
cmp esi, eax
jne 0x439724
push 0x1a
push str.Cant_open_GIF_for_writing
lea ecx, [edi + 0xc]
call fcn.00403070
pop edi
xor eax, eax
pop esi
ret 0x20
mov ecx, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x20]
mov edx, ebx
imul edx, ebp
push esi
push 6
push 1
push str.GIF87a
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebp
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x20], edx
mov dword [edi + 0x1c], eax
mov dword [edi + 0x18], eax
call fcn.0055db95
mov eax, ebx
and eax, 0xff
push esi
push eax
call fcn.0055d927
mov eax, ebx
cdq
and edx, 0xff
add eax, edx
sar eax, 8
and eax, 0xff
push esi
push eax
call fcn.0055d927
mov ecx, ebp
and ecx, 0xff
push esi
push ecx
call fcn.0055d927
mov eax, ebp
cdq
and edx, 0xff
add eax, edx
sar eax, 8
and eax, 0xff
push esi
push eax
call fcn.0055d927
push esi
push 0xe7
call fcn.0055d927
mov edx, dword [esp + 0x5c]
push esi
push edx
call fcn.0055d927
add esp, 0x40
push esi
push 0
call fcn.0055d927
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x38]
add esp, 8
sub ebp, ebx
sub eax, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0x100
nop
mov eax, dword [ebx + ebp]
push esi
push eax
call fcn.0055d927
mov ecx, dword [ebx]
push esi
push ecx
call fcn.0055d927
mov edx, dword [esp + 0x28]
mov eax, dword [edx + ebx]
push esi
push eax
call fcn.0055d927
add esp, 0x18
add ebx, 4
sub dword [esp + 0x14], 1
jne 0x4397f0
push esi
push 0x2c
call fcn.0055d927
push esi
push 0
call fcn.0055d927
push esi
push 0
call fcn.0055d927
push esi
push 0
call fcn.0055d927
push esi
push 0
call fcn.0055d927
mov ebx, dword [edi + 0x10]
mov ecx, ebx
and ecx, 0xff
push esi
push ecx
call fcn.0055d927
mov eax, ebx
cdq
and edx, 0xff
add eax, edx
sar eax, 8
and eax, 0xff
push esi
push eax
call fcn.0055d927
mov ebx, dword [edi + 0x14]
mov edx, ebx
and edx, 0xff
push esi
push edx
call fcn.0055d927
mov eax, ebx
cdq
and edx, 0xff
add eax, edx
add esp, 0x40
sar eax, 8
and eax, 0xff
push esi
push eax
call fcn.0055d927
push esi
push 0
call fcn.0055d927
push esi
push 8
call fcn.0055d927
add esp, 0x18
push esi
push 9
mov ecx, edi
call fcn.00439400
push esi
push 0
call fcn.0055d927
push esi
push 0x3b
call fcn.0055d927
push esi
call fcn.0055ad2b
add esp, 0x14
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
ret 0x20
Function at 0x43e460
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push 0x104
mov edi, ecx
call fcn.00525c36
add esp, 4
push str.H:mm
push eax
mov dword [edi + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 0
push 0x1003
push 0x400
call esi
mov ebx, eax
test ebx, ebx
je 0x43e4b7
push ebx
call fcn.00525c36
add esp, 4
push ebx
push eax
push 0x1003
push 0x400
mov dword [edi + 0x18], eax
call esi
push 0
push 0
push 0x1f
push 0x400
call esi
mov ebx, eax
test ebx, ebx
je 0x43e4e1
push ebx
call fcn.00525c36
add esp, 4
push ebx
push eax
push 0x1f
push 0x400
mov dword [edi + 0x14], eax
call esi
push 0
push 0
push 0x20
push 0x400
call esi
mov ebx, eax
test ebx, ebx
je 0x43e50b
push ebx
call fcn.00525c36
add esp, 4
push ebx
push eax
push 0x20
push 0x400
mov dword [edi + 0x10], eax
call esi
push 0
push 0
push 0x1d
push 0x400
call esi
mov ebx, eax
test ebx, ebx
je 0x43e535
push ebx
call fcn.00525c36
add esp, 4
push ebx
push eax
push 0x1d
push 0x400
mov dword [edi + 0x20], eax
call esi
push 0
push 0
push 0x1e
push 0x400
call esi
mov ebx, eax
test ebx, ebx
je 0x43e55f
push ebx
call fcn.00525c36
add esp, 4
push ebx
push eax
push 0x1e
push 0x400
mov dword [edi + 0x24], eax
call esi
push 0
push 0
push 0x51
push 0x400
call esi
mov ebx, eax
test ebx, ebx
je 0x43e589
push ebx
call fcn.00525c36
add esp, 4
push ebx
push eax
push 0x51
push 0x400
mov dword [edi + 4], eax
call esi
push 0
push 0
push 0xe
push 0x400
call esi
mov ebx, eax
test ebx, ebx
je 0x43e5b3
push ebx
call fcn.00525c36
add esp, 4
push ebx
push eax
push 0xe
push 0x400
mov dword [edi + 8], eax
call esi
push 0
push 0
push 0xf
push 0x400
call esi
mov ebx, eax
test ebx, ebx
je 0x43e5dd
push ebx
call fcn.00525c36
add esp, 4
push ebx
push eax
push 0xf
push 0x400
mov dword [edi + 0xc], eax
call esi
pop edi
pop esi
pop ebx
ret
Function at 0x441680
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x164
mov eax, dword [0x5ecfcc]
xor eax, esp
mov dword [esp + 0x160], eax
mov ecx, dword [esp + 0x16c]
mov eax, dword [esp + 0x168]
push ecx
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [esp + 0x160]
mov eax, dword [esp + 4]
xor ecx, esp
call fcn.0055953b
add esp, 0x164
ret 8
Function at 0x44ea90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x324]
call fcn.00433630
mov eax, dword [esi + 0x338]
mov ecx, dword [esi + 0x334]
push eax
push ecx
push 1
call fcn.00424e70
mov ecx, eax
call fcn.004251b0
mov byte [esi + 0x330], 0
pop esi
ret
sub esp, 8
push esi
push edi
mov esi, ecx
or edi, 0xffffffff
mov dword [esp + 0xc], esi
cmp dword [esi + 0x280], edi
je 0x44eabb
mov eax, dword [esi + 0x20]
push 0x102
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0x280], edi
mov eax, dword [esi + 0x284]
test eax, eax
je 0x44ead8
push eax
call fcn.00525c2b
add esp, 4
mov dword [esi + 0x284], 0
mov eax, dword [0x5ee7e8]
test eax, eax
je 0x44ec83
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea esi, [eax + 0xc]
push esi
mov edi, eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
mov byte [edi + 4], 0
call ebx
mov ecx, dword [0x5ee7e8]
cmp byte [ecx + 0x2c], 0
jne 0x44ec71
call fcn.00424a00
mov eax, dword [0x5ee7e8]
lea esi, [eax + 0xc]
push esi
mov edi, eax
call ebp
push esi
mov byte [edi + 0x31c], 0
call ebx
mov ecx, dword [0x5ee7e8]
call fcn.00434000
mov ecx, dword [0x5ee7e8]
call fcn.00424a10
mov esi, 1
cmp dword [0x5ee7c8], esi
jne 0x44eb78
call fcn.00532110
mov eax, dword [eax + 4]
mov edx, dword [eax]
push str.Please_wait_while_stopping_the_redraw...
push 0
mov ecx, eax
mov eax, dword [edx + 0x74]
push 0x8064
call eax
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov edx, dword [esp + 0x14]
mov byte [edx + 0x37c], 0
mov edi, eax
mov eax, dword [0x5ee7e8]
cmp byte [eax + 0x2c], 0
mov dword [esp + 0x10], esi
jne 0x44ec39
cmp byte [0x5ee7cc], 0
jne 0x44ec39
lea esi, [eax + 0xc]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov byte [ebx + 0x31c], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call ebp
cmp eax, edi
jb 0x44ec26
call ebp
sub eax, edi
cmp eax, 0x5dc
jbe 0x44ec2a
cmp dword [0x5ee7c8], 1
jne 0x44ec17
call fcn.00532110
mov esi, dword [esp + 0x10]
mov eax, dword [eax + 4]
mov edx, dword [eax]
mov ecx, esi
neg ecx
sbb ecx, ecx
not ecx
and ecx, str.Please_wait_while_stopping_the_redraw...
push ecx
push esi
mov ecx, eax
mov eax, dword [edx + 0x74]
push 0x8064
call eax
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x44ec1b
mov esi, dword [esp + 0x10]
xor edx, edx
test esi, esi
sete dl
mov dword [esp + 0x10], edx
call ebp
mov edi, eax
mov eax, dword [0x5ee7e8]
cmp byte [eax + 0x2c], 0
je 0x44eba0
mov eax, dword [esp + 0x14]
mov byte [eax + 0x37c], 1
cmp dword [0x5ee7c8], 1
jne 0x44ec71
call fcn.00532110
mov eax, dword [eax + 4]
mov edx, dword [eax]
push 0
push 0
mov ecx, eax
mov eax, dword [edx + 0x74]
push 0x8064
call eax
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [0x5ee7e8]
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
jmp 0x433fc0
pop edi
pop esi
add esp, 8
ret
Function at 0x4588b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57ecc1
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x5ecfcc]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor edi, edi
push 0x10
mov dword [esp + 0x2c], edi
mov dword [esp + 0x10], edi
call fcn.00525bfc
add esp, 4
cmp eax, edi
je 0x4588fa
mov dword [eax + 4], edi
mov dword [eax], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
jmp 0x4588fc
xor eax, eax
mov esi, dword [esp + 0x30]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [eax + 8], edi
mov eax, 1
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
mov edi, dword [esp + 0x34]
mov dword [esp + 0x28], eax
mov eax, dword [esi]
push eax
mov eax, dword [edi]
push edx
push eax
lea ecx, [esp + 0x1c]
call fcn.00457e00
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 4]
push edx
mov dword [esi + 4], ecx
call fcn.00525c2b
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x45d240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57f15c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5ecfcc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.00459fd0
lea edi, [esi + 0xdc]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x1c], ebx
call fcn.00441280
mov dword [edi], vtable.CShellTree.0
mov byte [esp + 0x1c], 1
mov dword [esi], vtable.CShellTree.1.0
lea edi, [esi + 0xfc]
call fcn.005322b0
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x45d2b3
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
push 0x54ab6a
push 0x44cf60
push 0x20
push 8
lea ecx, [esi + 0x210]
push ecx
mov byte [esp + 0x30], 2
call fcn.0055c7e0
push ebx
push 0x587fe5
mov ecx, edi
mov byte [esp + 0x24], 3
mov byte [esi + 0xed], bl
mov dword [esi + 0x10c], ebx
mov byte [esi + 0x108], bl
mov dword [esi + 0x310], ebx
call fcn.00403070
mov byte [esi + 0x100], bl
cmp dword [0x5f04f4], 6
mov dword [esi + 0x104], ebx
sete dl
mov byte [esi + 0xec], dl
mov dword [esi + 0xf4], 0xe6e6e6
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x45d400
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x57f18b
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x5ecfcc]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ecfcc]
xor eax, esp
push eax
lea eax, [esp + 0x124]
mov dword fs:[0], eax
cmp dword [ecx + 0x310], 0
mov dword [esp + 0x18], ecx
jne 0x45d538
lea eax, [esp + 0x1c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x45d538
cmp eax, 0x104
ja 0x45d538
call fcn.005322b0
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45d489
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
cmp byte [esp + 0x1c], 0
mov dword [esp + 0x12c], 0
lea esi, [esp + 0x1c]
je 0x45d511
mov ebp, dword [esp + 0x134]
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea esp, [esp]
test esi, esi
jne 0x45d4c8
xor eax, eax
jmp 0x45d4d9
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x45d4d0
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.00403070
mov edi, dword [esp + 0x14]
push edi
call ebx
cmp eax, 3
je 0x45d4fa
cmp eax, 4
je 0x45d4fa
cmp eax, 6
jne 0x45d509
push ebp
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
call fcn.0045d100
add esi, 4
cmp byte [esi], 0
jne 0x45d4c0
lea eax, [edi - 0x10]
mov dword [esp + 0x12c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x45d538
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0055953b
add esp, 0x11c
ret 4
Function at 0x45ed70
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x57f2e8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ecfcc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
call fcn.005322b0
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45edb1
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ecx, [eax + 0x10]
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x28]
xor bl, bl
cmp dword [eax + 0xc], 0
mov dword [esp + 0x20], 0
jne 0x45edf2
lea eax, [ecx - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x45ee79
mov esi, dword [eax + 4]
test esi, esi
je 0x45ee5d
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
nop
mov eax, esi
test esi, esi
je 0x45ee9b
mov esi, dword [esi]
add eax, 8
push eax
lea ecx, [esp + 0x18]
call fcn.00403590
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x45ee4d
lea edx, [esp + 0x14]
push edx
lea ecx, [edi + 0x54]
call fcn.0045f7e0
test al, al
je 0x45ee4d
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x20]
push eax
push 0
push 0x143
push ecx
call ebp
mov bl, 1
test esi, esi
jne 0x45ee00
test bl, bl
je 0x45ee5d
lea ecx, [edi + 0x54]
call fcn.0045f120
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x45ee85
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
call fcn.00525d49
int3

Function at 0x460740
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x46074e
lea eax, [esi + 0xd]
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
inc eax
push eax
mov eax, dword [esp + 0x14]
push esi
push 1
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret
Function at 0x460890
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
mov eax, dword [0x5ecfcc]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x228]
cmp byte [ebp], 0x2e
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov byte [esp + 0xb], bl
je 0x4608da
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.0055953b
add esp, 0x21c
ret
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push ebp
push SysReAllocString
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x4608c1
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebx
push 0x587fe5
push esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 0x200
call edi
test eax, eax
jne 0x4609e8
cmp dword [esp + 0x1c], ebx
je 0x4609e8
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebx
push str.Backup
push esi
call edi
test eax, eax
jne 0x460991
cmp dword [esp + 0x1c], ebx
jbe 0x460991
push 0x587fe5
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x1f], 1
call fcn.00460740
add esp, 0xc
push str.Backup
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [esp + 0x14]
call fcn.00401210
cmp byte [esp + 0x13], bl
jne 0x4609c1
push ebp
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], SysReAllocString
call fcn.00402280
test eax, eax
je 0x4609c1
lea ecx, [esp + 0x14]
call fcn.00402260
jmp 0x4609f3
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], SysReAllocString
call fcn.00402280
lea ecx, [esp + 0x14]
test eax, eax
jne 0x4609ba
call fcn.00402260
mov al, 1
jmp 0x4609f5
cmp esi, ebx
je 0x4609f3
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0055953b
add esp, 0x21c
ret
Function at 0x460eb0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0x10
push esi
push edi
mov edi, ecx
jb 0x460ec3
mov eax, dword [eax + 4]
jmp 0x460ec6
add eax, 4
push 0x5891fc
push eax
call fcn.0055ac9d
mov esi, eax
add esp, 8
test esi, esi
je 0x460efb
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0x10]
push esi
push 1
push eax
push ecx
call fcn.0055db95
add esp, 0x10
push esi
cmp eax, 1
je 0x460f02
call fcn.0055ad2b
add esp, 4
pop edi
xor al, al
pop esi
ret 4
call fcn.0055ad2b
add esp, 4
pop edi
mov al, 1
pop esi
ret 4

Function at 0x463ab0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
mov eax, dword [0x5ecfcc]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
push esi
mov esi, dword [esp + 0x11c]
push edi
mov edi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x463b41
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebp
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push edi
push esi
call ebx
test eax, eax
jne 0x463b41
mov ecx, dword [esp + 0x10]
push 0x104
lea eax, [esp + 0x18]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x463b3a
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, 1
jmp 0x463b43
mov eax, dword [esp + 0x10]
push eax
call ebp
xor eax, eax
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0055953b
add esp, 0x10c
ret 8
Function at 0x47cb90
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, 0xffffffff
test edx, edx
jle 0x47cbc0
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x5ef4d8]
dec edx
inc ecx
test edx, edx
jg 0x47cba1
pop edi
pop esi
not eax
ret

Function at 0x47f940
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5816d8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x5ecfcc]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x30]
push 0
push eax
lea ecx, [esp + 0x18]
call fcn.00547827
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push 0xe1
push edx
mov dword [esp + 0x34], 0
call fcn.0047f810
mov esi, eax
add esp, 0xc
test esi, esi
je 0x47f9d7
mov eax, dword [esp + 0xc]
push 0
push eax
push esi
call fcn.0047f370
push esi
mov bl, al
call fcn.00525c2b
add esp, 0x10
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.00547303
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.00547303
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x480260
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
test eax, eax
je 0x480279
push eax
call fcn.00525c2b
add esp, 4
mov dword [esi], 0
mov eax, dword [esp + 0xc]
push 0x58c678
push eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 4], 0
call fcn.0055ac9d
mov edi, eax
add esp, 8
test edi, edi
je 0x4802dc
push ebx
push 2
push 0
push edi
call fcn.0055f3a8
push edi
call fcn.0055f5ca
push 0
push 0
push edi
mov ebx, eax
call fcn.0055f3a8
add esp, 0x1c
push ebx
mov ecx, esi
call fcn.004801f0
pop ebx
push edi
test al, al
jne 0x4802e3
call fcn.0055ad2b
add esp, 4
pop edi
xor al, al
pop esi
ret 4
mov ecx, dword [esi + 8]
mov edx, dword [esi]
push 1
push ecx
push edx
call fcn.0055d90a
push edi
call fcn.0055ad2b
add esp, 0x14
pop edi
mov al, 1
pop esi
ret 4