joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a140
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6dd5d8
mov eax, dword fs:[0]
push eax
sub esp, 0x808
mov eax, dword [0x7b2214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x814], ebx
mov dword [ebp - 0x814], ebx
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00668940
add esp, 0xc
lea eax, [ebp - 0x810]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
cmp ax, word [ebp - 0x810]
jne 0x44a201
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], 7
mov word [ebx], ax
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x44a2ed
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44a2e3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44a30b
jmp 0x44a2e3
cmp dword [ebp + 0x18], eax
jne 0x44a240
mov dword [ebx + 0x10], eax
lea ecx, [ebp - 0x810]
xor eax, eax
mov dword [ebx + 0x14], 7
mov word [ebx], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44a220
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.00432ef0
jmp 0x44a1c4
lea edi, [ebp - 0x810]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x44a250
cmp dword [ebp + 0x1c], 8
lea edx, [ebp + 8]
mov eax, dword [0x76a02c]
cmovae edx, dword [ebp + 8]
mov dword [edi], eax
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x44a270
lea edi, [ebp - 0x810]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x44a286
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x810]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
lea edx, [ecx + 2]
mov word [ebx], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44a2c0
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.00432ef0
jmp 0x44a1c4
push edx
push ecx
call fcn.0062a23d
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00629f1d
mov esp, ebp
pop ebp
ret
call fcn.0068843e
int3
Function at 0x450a80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0x200
cmp dword [ebp + 0x50], 0
mov ecx, 0x100
cmove ecx, eax
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
push esi
cmovae eax, dword [ebp + 8]
mov esi, edx
lea edx, [ebp - 8]
or ecx, 0x20006
push edx
lea edx, [ebp - 4]
push edx
push 0
push ecx
push 0
push 0
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x450b05
push dword [ebp + 0x48]
cmp dword [ebp + 0x4c], 0x10
lea ecx, [ebp + 0x38]
lea eax, [ebp + 0x20]
cmovae ecx, dword [ebp + 0x38]
cmp dword [ebp + 0x34], 0x10
push ecx
cmovae eax, dword [ebp + 0x20]
push 1
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x450bb7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x450b3b
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x450b31
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x450be8
push edx
push ecx
call fcn.0062a23d
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x450b7d
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x450b73
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x450be8
push edx
push ecx
call fcn.0062a23d
add esp, 8
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
cmp edx, 0x10
jb 0x450be1
mov ecx, dword [ebp + 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x450bd7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x450be8
jmp 0x450bd7
test esi, esi
je 0x450bc4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
jmp 0x450b07
push edx
push ecx
call fcn.0062a23d
add esp, 8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0068843e
int3
Function at 0x450bf0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0x200
cmp dword [ebp + 0x50], 0
mov ecx, 0x100
cmove ecx, eax
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push esi
cmovae eax, dword [ebp + 8]
mov esi, edx
lea edx, [ebp - 8]
or ecx, 0x20006
push edx
lea edx, [ebp - 4]
push edx
push 0
push ecx
push 0
push 0
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x450c78
cmp dword [ebp + 0x4c], 8
lea edx, [ebp + 0x38]
mov eax, dword [ebp + 0x48]
lea ecx, [ebp + 0x20]
cmovae edx, dword [ebp + 0x38]
cmp dword [ebp + 0x34], 8
cmovae ecx, dword [ebp + 0x20]
add eax, eax
push eax
push edx
push 1
push 0
push ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x450d40
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x450cb4
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x450caa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x450d71
push edx
push ecx
call fcn.0062a23d
add esp, 8
mov edx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp edx, 8
jb 0x450cfe
mov ecx, dword [ebp + 0x20]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x450cf4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x450d71
push edx
push ecx
call fcn.0062a23d
add esp, 8
mov edx, dword [ebp + 0x4c]
xor eax, eax
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 7
mov word [ebp + 0x20], ax
cmp edx, 8
jb 0x450d6a
mov ecx, dword [ebp + 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x450d60
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x450d71
jmp 0x450d60
test esi, esi
je 0x450d4d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
jmp 0x450c7a
push edx
push ecx
call fcn.0062a23d
add esp, 8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0068843e
int3
Function at 0x450d80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x3c], 0
mov eax, 0x200
push esi
mov dword [ebp - 8], edx
mov ecx, 0x100
cmove ecx, eax
lea edx, [ebp - 0xc]
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push edx
cmovae eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push 0
or ecx, 0x20006
push ecx
push 0
push 0
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x450df9
cmp dword [ebp + 0x34], 0x10
lea ecx, [ebp - 8]
push 4
push ecx
push 4
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x450e65
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x450e2b
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x450e21
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x450e98
push edx
push ecx
call fcn.0062a23d
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x450e91
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x450e87
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x450e98
jmp 0x450e87
cmp dword [ebp + 0x38], 0
je 0x450e74
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
jmp 0x450dfb
push edx
push ecx
call fcn.0062a23d
add esp, 8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0068843e
int3
Function at 0x451450
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ddb78
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x7b2214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x41c], edi
mov ebx, ecx
mov dword [ebp - 0x420], ebx
push 0x400
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00668940
add esp, 0xc
mov dword [ebp - 0x418], 0x400
cmp dword [ebp + 0x20], 0
lea edx, [ebp - 0x414]
mov eax, 0x200
mov ecx, 0x100
cmove ecx, eax
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
push edx
cmovae eax, dword [ebp + 8]
or ecx, 0xf003f
push ecx
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45160f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [ebp - 0x428]
push eax
xor esi, esi
lea eax, [ebp - 0x418]
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x410]
xorps xmm0, xmm0
push eax
push esi
push dword [ebp - 0x414]
movlpd qword [ebp - 0x428], xmm0
call ebx
test eax, eax
jne 0x4515c6
nop dword [eax]
push dword [ebp + 0x20]
lea eax, [ebp - 0x410]
sub esp, 0x18
lea edi, [eax + 1]
mov edx, esp
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x451552
sub eax, edi
mov ecx, edx
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.00430430
mov edi, dword [ebp - 0x41c]
mov edx, edi
mov ecx, dword [ebp - 0x414]
call fcn.00451450
add esp, 0x1c
test eax, eax
jne 0x451585
inc esi
lea eax, [ebp - 0x428]
mov dword [ebp - 0x418], 0x400
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x418]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x410]
movlpd qword [ebp - 0x428], xmm0
push eax
push esi
push dword [ebp - 0x414]
call ebx
test eax, eax
je 0x451530
mov esi, dword [sym.imp.ADVAPI32.dll_RegFlushKey]
test edi, edi
je 0x4515d8
push dword [ebp - 0x414]
call esi
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
mov ebx, dword [ebp - 0x420]
cmovae eax, dword [ebp + 8]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x45160f
test edi, edi
je 0x451608
push ebx
call esi
mov esi, 1
jmp 0x451611
xor esi, esi
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x451641
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x451637
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45165f
push edx
push ecx
call fcn.0062a23d
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00629f1d
mov esp, ebp
pop ebp
ret
call fcn.0068843e
int3
Function at 0x451670
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ddba8
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x7b2214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x81c], edi
mov ebx, ecx
mov dword [ebp - 0x820], ebx
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00668940
add esp, 0xc
mov dword [ebp - 0x818], 0x400
cmp dword [ebp + 0x20], 0
lea edx, [ebp - 0x814]
mov eax, 0x200
mov ecx, 0x100
cmove ecx, eax
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push edx
cmovae eax, dword [ebp + 8]
or ecx, 0xf003f
push ecx
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x451837
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x828]
push eax
xor esi, esi
lea eax, [ebp - 0x818]
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x810]
xorps xmm0, xmm0
push eax
push esi
push dword [ebp - 0x814]
movlpd qword [ebp - 0x828], xmm0
call ebx
test eax, eax
jne 0x4517ee
nop dword [eax]
push dword [ebp + 0x20]
sub esp, 0x18
xor eax, eax
mov edx, esp
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
lea eax, [ebp - 0x810]
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x451774
sub eax, edi
mov ecx, edx
sar eax, 1
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.00432ef0
mov edi, dword [ebp - 0x81c]
mov edx, edi
mov ecx, dword [ebp - 0x814]
call fcn.00451670
add esp, 0x1c
test eax, eax
jne 0x4517ad
inc esi
lea eax, [ebp - 0x828]
mov dword [ebp - 0x818], 0x400
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x818]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x810]
movlpd qword [ebp - 0x828], xmm0
push eax
push esi
push dword [ebp - 0x814]
call ebx
test eax, eax
je 0x451750
mov esi, dword [sym.imp.ADVAPI32.dll_RegFlushKey]
test edi, edi
je 0x451800
push dword [ebp - 0x814]
call esi
push dword [ebp - 0x814]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
mov ebx, dword [ebp - 0x820]
cmovae eax, dword [ebp + 8]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x451837
test edi, edi
je 0x451830
push ebx
call esi
mov esi, 1
jmp 0x451839
xor esi, esi
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x45186f
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x451865
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45188d
push edx
push ecx
call fcn.0062a23d
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00629f1d
mov esp, ebp
pop ebp
ret
call fcn.0068843e
int3
Function at 0x460360
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x7b2214]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
mov dword [ebp - 0x234], ecx
push edi
push 0
push 2
mov eax, dword [esi]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4603a5
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00629f1d
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x46041d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax + eax]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x234]
call fcn.006867b9
add esp, 8
test eax, eax
jne 0x46040e
mov ecx, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x4603ff
mov eax, dword [ebp - 0x228]
mov dword [ecx], eax
add dword [esi + 4], 4
jmp 0x46040e
lea eax, [ebp - 0x228]
push eax
push ecx
mov ecx, esi
call fcn.004627f0
lea eax, [ebp - 0x230]
push eax
push edi
call ebx
test eax, eax
jne 0x4603d0
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00629f1d
mov esp, ebp
pop ebp
ret

Function at 0x460d00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ded88
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x7b2214]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.00460360
mov ebx, dword [ebp - 0x24]
test eax, eax
jne 0x460d57
xor esi, esi
jmp 0x460dbf
mov eax, dword [ebp - 0x20]
xor edi, edi
sub eax, ebx
sar eax, 2
mov dword [ebp - 0x18], eax
test eax, eax
je 0x460dba
nop dword [eax + eax]
push dword [ebx + edi*4]
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x460db4
push 0x42b
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x460db4
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SetLastError]
inc edi
cmp edi, dword [ebp - 0x18]
jb 0x460d70
mov esi, 1
test ebx, ebx
je 0x460def
mov ecx, dword [ebp - 0x1c]
mov eax, ebx
sub ecx, ebx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x460de5
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x460e03
push ecx
push ebx
call fcn.0062a23d
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0068843e
int3
Function at 0x461400
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x858
mov eax, dword [0x7b2214]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x800
lea eax, [ebp - 0x804]
mov esi, ecx
push 0
push eax
call fcn.00668940
push 0x44
lea eax, [ebp - 0x858]
push 0
push eax
call fcn.00668940
add esp, 0x18
xorps xmm0, xmm0
movups xmmword [ebp - 0x814], xmm0
test esi, esi
je 0x4614bd
xor eax, eax
cmp ax, word [esi]
je 0x4614bd
push esi
lea eax, [ebp - 0x804]
push 0x3ff
push eax
call fcn.006935f9
add esp, 0xc
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x858]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4614bd
push dword [ebp - 0x810]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x814]
call esi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00629f1d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00629f1d
mov esp, ebp
pop ebp
ret

Function at 0x4659c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6df2f8
mov eax, dword fs:[0]
push eax
mov eax, 0x2808
call fcn.0062ad90
mov eax, dword [0x7b2214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x2814], ebx
push 0x2800
xor edi, edi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2810]
push edi
push eax
call fcn.00668940
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push 0x7698f4
cmovae eax, dword [ebp + 8]
push eax
call fcn.006872c5
mov esi, eax
add esp, 0x14
test esi, esi
je 0x465ac8
push esi
call fcn.00686f9c
add esp, 4
test eax, eax
jne 0x465aa9
nop word [eax + eax]
push 0x2800
lea eax, [ebp - 0x2810]
push 0
push eax
call fcn.00668940
push esi
push 0x2800
lea eax, [ebp - 0x2810]
push 1
push eax
call fcn.00687c9a
push esi
mov ebx, eax
call fcn.00686fc7
add esp, 0x20
test eax, eax
jne 0x465abf
push ebx
lea eax, [ebp - 0x2810]
push eax
push edi
call fcn.0062eda7
push esi
mov edi, eax
call fcn.00686f9c
add esp, 0x10
test eax, eax
je 0x465a50
mov ebx, dword [ebp - 0x2814]
push esi
call fcn.006873a5
add esp, 4
test ebx, ebx
je 0x465ab8
mov dword [ebx], edi
mov esi, 1
jmp 0x465aca
push esi
call fcn.006873a5
add esp, 4
xor esi, esi
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x465afa
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x465af0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x465b18
push edx
push ecx
call fcn.0062a23d
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00629f1d
mov esp, ebp
pop ebp
ret
call fcn.0068843e
int3
Function at 0x4734d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x7b2214]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
mov edi, edx
mov esi, ecx
push edi
push 0x7731c8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x7731d8
test eax, eax
jne 0x473589
sub esp, 0x18
mov ecx, esp
push eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 7
push 0x76a24c
mov word [ecx], ax
call fcn.00432ef0
lea ecx, [ebp - 0x1c]
call fcn.0044a140
add esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x473534
mov eax, dword [eax]
push eax
push str._s_s
push 0x103
push 0x103
push esi
call fcn.00462c90
mov edx, dword [ebp - 8]
add esp, 0x18
cmp edx, 8
jb 0x4735a2
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47357d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x473635
push edx
push ecx
call fcn.0062a23d
add esp, 8
jmp 0x4735a2
push edi
push str._s_s
push 0x103
push 0x103
push esi
call fcn.00462c90
add esp, 0x18
sub esp, 0x18
mov ecx, esi
mov edx, esp
xor eax, eax
lea edi, [ecx + 2]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4735c0
sub ecx, edi
sar ecx, 1
push ecx
push esi
mov ecx, edx
call fcn.00432ef0
call fcn.00443a50
add esp, 0x18
test eax, eax
jne 0x473620
sub esp, 0x18
mov ecx, esi
mov edx, esp
lea edi, [ecx + 2]
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], 7
mov word [edx], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473600
sub ecx, edi
sar ecx, 1
push ecx
push esi
mov ecx, edx
call fcn.00432ef0
call fcn.004436a0
add esp, 0x18
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00629f1d
mov esp, ebp
pop ebp
ret
call fcn.0068843e
int3
Function at 0x473640
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x7b2214]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
mov edi, edx
mov esi, ecx
push edi
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.SaltBox
test eax, eax
jne 0x4736ee
sub esp, 0x18
mov ecx, esp
push eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
push 0x766dcf
mov byte [ecx], al
call fcn.00430430
lea ecx, [ebp - 0x1c]
call fcn.00449f90
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x47369f
mov eax, dword [eax]
push eax
push 0x76a048
push 0x103
push 0x103
push esi
call fcn.004327b0
mov edx, dword [ebp - 8]
add esp, 0x18
cmp edx, 0x10
jb 0x473707
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4736e2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x473785
push edx
push ecx
call fcn.0062a23d
add esp, 8
jmp 0x473707
push edi
push 0x76a048
push 0x103
push 0x103
push esi
call fcn.004327b0
add esp, 0x18
sub esp, 0x18
mov ecx, esi
mov edx, esp
lea edi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x473722
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.00430430
call fcn.00443ac0
add esp, 0x18
test eax, eax
jne 0x473770
sub esp, 0x18
mov ecx, esi
mov edx, esp
lea edi, [ecx + 1]
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], 0xf
mov byte [edx], al
mov al, byte [ecx]
inc ecx
test al, al
jne 0x473756
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.00430430
call fcn.004438b0
add esp, 0x18
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00629f1d
mov esp, ebp
pop ebp
ret
call fcn.0068843e
int3