joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ca8dc
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xfffffeec
mov ebx, esp
push 1
push 0
push 0
push 0xa
call fcn.004cadd0
add esp, 0x10
mov dword [0x5b8630], eax
push 1
push 0
push 3
push 6
call fcn.004cadd0
add esp, 0x10
mov dword [0x5b8634], eax
push 1
push 0
push 2
push 6
call fcn.004cadd0
add esp, 0x10
mov dword [0x5b8638], eax
push 1
push 0
push 1
push 6
call fcn.004cadd0
add esp, 0x10
mov dword [0x5b863c], eax
push 1
push 0
push 0
push 6
call fcn.004cadd0
add esp, 0x10
mov dword [0x5b8640], eax
push 1
push 3
push 2
push 5
call fcn.004cadd0
add esp, 0x10
test eax, eax
jne 0x4ca97a
push 1
push 2
push 2
push 5
call fcn.004cadd0
add esp, 0x10
test eax, eax
jne 0x4ca97a
xor eax, eax
jmp 0x4ca97f
mov eax, 1
mov dword [0x5b8644], eax
push 1
push 0
push 0
push 5
call fcn.004cadd0
add esp, 0x10
mov dword [0x5b8648], eax
mov dword [ebx], 0x114
push ebx
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
je 0x4caa41
cmp dword [ebx + 0x10], 1
je 0x4ca9bd
xor edx, edx
mov dword [0x5b8650], edx
jmp 0x4ca9f7
cmp dword [ebx + 4], 4
jne 0x4ca9d5
cmp dword [ebx + 8], 0xa
jae 0x4ca9d5
mov dword [0x5b8650], 5
jmp 0x4ca9f7
cmp dword [ebx + 4], 4
jne 0x4ca9ed
cmp dword [ebx + 8], 0xa
jne 0x4ca9ed
mov dword [0x5b8650], 8
jmp 0x4ca9f7
mov dword [0x5b8650], 9
cmp dword [ebx + 0x10], 2
je 0x4caa07
xor ecx, ecx
mov dword [0x5b864c], ecx
jmp 0x4caa41
cmp dword [ebx + 4], 3
jne 0x4caa1f
cmp dword [ebx + 8], 0x33
jne 0x4caa1f
mov dword [0x5b864c], 3
jmp 0x4caa41
cmp dword [ebx + 4], 4
jne 0x4caa37
cmp dword [ebx + 8], 0
jne 0x4caa37
mov dword [0x5b864c], 4
jmp 0x4caa41
mov dword [0x5b864c], 5
push str.ntdll.dll
call sub.KERNEL32.DLL_GetModuleHandleW
test eax, eax
je 0x4caa68
push str.wine_get_version
push eax
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x4caa68
mov dword [0x5b8654], 1
cmp dword [0x5b8648], 0
je 0x4caa7b
mov dword [0x5b864c], 5
mov dword [0x5b862c], 1
add esp, 0x114
pop ebx
ret
Function at 0x4e9b48
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
lea ebx, [ebp + 8]
mov eax, 0x5cb770
call fcn.004f35d8
mov word [ebp - 0x18], 0xc
mov edx, 0x5cbc30
mov ecx, dword [ebx]
mov dword [ecx], edx
push 0x10
call fcn.004ee514
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4e9b95
mov word [ebp - 0x18], 0x30
mov edx, dword [ebp - 4]
push edx
call fcn.004ecd68
pop ecx
mov word [ebp - 0x18], 0x24
mov ecx, dword [ebp - 4]
jmp 0x4e9b98
mov ecx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [eax + 0x3c], ecx
mov word [ebp - 0x18], 0x18
mov eax, dword [ebx]
mov edx, dword [ebx]
add edx, 0xc
mov dword [eax + 0x14], edx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x10
mov dword [ecx + 0x18], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x1c
mov dword [edx + 0x24], eax
mov eax, dword [ebx]
mov ecx, dword [ebx]
add ecx, 0x20
mov dword [eax + 0x28], ecx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x2c
mov dword [ecx + 0x34], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x30
mov dword [edx + 0x38], eax
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x18]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x28]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x38]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x14]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x24]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x34]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ef30c
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
lea ebx, [ebp + 8]
mov eax, 0x5ccb28
call fcn.004f35d8
mov word [ebp - 0x18], 0xc
mov edx, 0x5cce98
mov ecx, dword [ebx]
mov dword [ecx], edx
push 0x10
call fcn.004ee514
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4ef359
mov word [ebp - 0x18], 0x30
mov edx, dword [ebp - 4]
push edx
call fcn.004ecd68
pop ecx
mov word [ebp - 0x18], 0x24
mov ecx, dword [ebp - 4]
jmp 0x4ef35c
mov ecx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [eax + 0x3c], ecx
mov word [ebp - 0x18], 0x18
mov eax, dword [ebx]
mov edx, dword [ebx]
add edx, 0xc
mov dword [eax + 0x14], edx
mov ecx, dword [ebx]
mov edx, dword [ebx]
adc eax, dword [ebx + 0x518910c2]
sbb byte [ebx - 0x7cfc74ed], cl
rcr byte [ecx + ecx*4], 0x42
and al, 0x8b
add ecx, dword [ebx + 0x20c1830b]

Function at 0x4f2d5c
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x4f41f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4f4210
call fcn.004f5b30
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4f422f
test bl, 1
je 0x4f422f
call fcn.004fc69c
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4f4410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004f56ac
test byte [ebp + 0xd], 0xc0
jne 0x4f4434
mov eax, dword [0x5cdf88]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4f4441
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4f446e
je 0x4f4480
sub ecx, 0x100
je 0x4f448e
sub ecx, 0x100
je 0x4f4495
sub ecx, 0x100
je 0x4f4487
jmp 0x4f449c
sub ecx, 0x600
je 0x4f4495
sub ecx, 0x100
je 0x4f4480
jmp 0x4f449c
mov edi, 1
jmp 0x4f44a1
mov edi, 2
jmp 0x4f44a1
mov edi, 4
jmp 0x4f44a1
mov edi, 5
jmp 0x4f44a1
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4f44c8
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x5cda00]
test al, 0x80
je 0x4f44c1
mov ebx, 0x80
jmp 0x4f44da
mov ebx, 1
jmp 0x4f44da
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4f44da
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4f44ec
je 0x4f44f5
dec eax
je 0x4f44fe
jmp 0x4f4507
mov dword [ebp - 4], CreateStatusWindowA
jmp 0x4f4516
mov dword [ebp - 4], 0x40000000
jmp 0x4f4516
mov dword [ebp - 4], 0xc0000000
jmp 0x4f4516
push 1
call fcn.004f5ac4
pop ecx
mov ebx, eax
jmp 0x4f4606
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4f4532
sub eax, 0x10
je 0x4f4539
sub eax, 0x10
je 0x4f4542
sub eax, 0x10
je 0x4f454b
jmp 0x4f454b
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4f4552
mov dword [ebp - 8], 1
jmp 0x4f4552
mov dword [ebp - 8], 2
jmp 0x4f4552
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4f45bf
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4f45b4
test byte [ebp + 0xd], 1
je 0x4f45af
mov ebx, 0x50
jmp 0x4f45b4
mov ebx, 2
push ebx
call fcn.004f5ac4
pop ecx
mov ebx, eax
jmp 0x4f4606
mov edi, esi
push edi
call fcn.004f4374
pop ecx
test eax, eax
je 0x4f45d3
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4f45df
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004f57ec
add esp, 8
mov ebx, eax
inc eax
jne 0x4f4606
push 4
call fcn.004f5ac4
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.004f56e0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f47c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004f56ac
test byte [ebp + 0xd], 0xc0
jne 0x4f47ec
mov eax, dword [0x5cdf88]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4f47f9
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4f4826
je 0x4f4838
sub ecx, 0x100
je 0x4f4846
sub ecx, 0x100
je 0x4f484d
sub ecx, 0x100
je 0x4f483f
jmp 0x4f4854
sub ecx, 0x600
je 0x4f484d
sub ecx, 0x100
je 0x4f4838
jmp 0x4f4854
mov edi, 1
jmp 0x4f4859
mov edi, 2
jmp 0x4f4859
mov edi, 4
jmp 0x4f4859
mov edi, 5
jmp 0x4f4859
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4f4880
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x5cda00]
test al, 0x80
je 0x4f4879
mov ebx, 0x80
jmp 0x4f4892
mov ebx, 1
jmp 0x4f4892
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4f4892
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4f48a4
je 0x4f48ad
dec eax
je 0x4f48b6
jmp 0x4f48bf
mov dword [ebp - 4], CreateStatusWindowA
jmp 0x4f48ce
mov dword [ebp - 4], 0x40000000
jmp 0x4f48ce
mov dword [ebp - 4], 0xc0000000
jmp 0x4f48ce
push 1
call fcn.004f5ac4
pop ecx
mov ebx, eax
jmp 0x4f49be
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4f48ea
sub eax, 0x10
je 0x4f48f1
sub eax, 0x10
je 0x4f48fa
sub eax, 0x10
je 0x4f4903
jmp 0x4f4903
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4f490a
mov dword [ebp - 8], 1
jmp 0x4f490a
mov dword [ebp - 8], 2
jmp 0x4f490a
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
cmp eax, 0xffffffff
jne 0x4f4977
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4f496c
test byte [ebp + 0xd], 1
je 0x4f4967
mov ebx, 0x50
jmp 0x4f496c
mov ebx, 2
push ebx
call fcn.004f5ac4
pop ecx
mov ebx, eax
jmp 0x4f49be
mov edi, esi
push edi
call fcn.004f4374
pop ecx
test eax, eax
je 0x4f498b
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4f4997
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004f57ec
add esp, 8
mov ebx, eax
inc eax
jne 0x4f49be
push 4
call fcn.004f5ac4
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.004f56e0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f88b4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.004f3204
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.004f3294
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.004f3294
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x5cec3d
lea ecx, [ebp - 0x200]
push ecx
call fcn.004f3204
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.004f3294
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.004f9c00
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x4f89c5
push esi
call fcn.004f3294
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.004f3294
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.0045424c
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x4f899c
xor eax, eax
jmp 0x4f8a4c
push esi
call fcn.004f3294
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.004f3294
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.004f315c
add esp, 0xc
jmp 0x4f8a05
mov edi, dword [ebx + 0x24]
push edi
call fcn.004f3294
pop ecx
push eax
push esi
call fcn.004f3294
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004f3294
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.004555ac
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x4f8a05
xor eax, eax
jmp 0x4f8a4c
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.004f3204
add esp, 8
push 0x5cec3f
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004f3204
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.004f3204
add esp, 8
push 0x5cec41
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004f3204
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4fc630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x4fc65d
jmp 0x4fc694
call fcn.004fc5e0
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004f3294
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004f3294
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4fc714
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x5cf3b0], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4fc7ee
cmp dword [0x5cf3ac], 0
jne 0x4fc7ee
cmp dword [0x5cf5b8], 0
je 0x4fc7a8
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004fc4e0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4fc78e
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004fc4e0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4fc78e
lea ebx, [ebp - 0x84]
jmp 0x4fc78f
inc ebx
call fcn.004fc6d0
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4fc829
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x5cf3b4
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004f3294
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x5cf3b7
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4fc829
cmp dword [0x5cf3ac], 0
je 0x4fc808
cmp dword [0x5cf3ac], 0xffffffff
je 0x4fc829
push esi
call dword [0x5cf3ac]
pop ecx
mov eax, dword [0x5cf3b0]
test eax, eax
je 0x4fc829
cmp dword [0x5cf3b0], 0xffffffff
je 0x4fc829
cmp byte [eax], 0
je 0x4fc829
push esi
push eax
call fcn.004fc630
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fd04c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x5d2c60], 0
jne 0x4fd0cd
cmp dword [0x5d2c80], 0
jne 0x4fd07c
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x5d2c80], eax
test eax, eax
jne 0x4fd07c
push str.GetEnvironmentStrings_failed
call fcn.004fc840
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x5d2c80]
jmp 0x4fd090
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004f3294
pop ecx
mov edi, eax
test eax, eax
jne 0x4fd088
lea edi, [ebp + 1]
push edi
call fcn.0045424c
pop ecx
mov ebx, eax
mov dword [0x5d2c64], ebx
test ebx, ebx
jne 0x4fd0ba
xor eax, eax
jmp 0x4fd190
push edi
mov edx, dword [0x5d2c80]
push edx
push ebx
call fcn.004f30c8
add esp, 0xc
jmp 0x4fd0ed
xor esi, esi
mov ebx, dword [0x5d2c60]
jmp 0x4fd0e7
push eax
call fcn.004f3294
pop ecx
test eax, eax
jne 0x4fd0e3
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4fd0d7
lea ebx, [esi + 4]
push 4
mov dword [0x5d2c68], ebx
inc ebx
push ebx
call fcn.00454d58
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4fd110
xor eax, eax
jmp 0x4fd190
cmp dword [0x5d2c60], 0
jne 0x4fd141
xor esi, esi
mov ebx, dword [0x5d2c64]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4fd132
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004f3294
pop ecx
mov edi, eax
test eax, eax
jne 0x4fd128
jmp 0x4fd172
xor esi, esi
mov ebx, dword [0x5d2c60]
mov eax, dword [esp]
mov edi, eax
jmp 0x4fd16c
push eax
call fcn.004f3294
pop ecx
test eax, eax
je 0x4fd161
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4fd165
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4fd150
mov eax, dword [0x5d2c60]
test eax, eax
je 0x4fd182
push eax
call fcn.00454590
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x5d2c60], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x66d74ea5
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, str._5xp
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x78752bc0
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4014d8
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, esi
lea eax, [ebp - 4]
push eax
and esi, 0x300
mov eax, esi
or eax, 9
push eax
push dword [ebp + 0xc]
and edi, 1
push dword [ebp + 8]
call fcn.00406334
xor ebx, ebx
cmp eax, ebx
jne 0x4015bc
test byte [ebp + 0x10], 2
je 0x40153a
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x4015a1
push 0x105
lea eax, [ebp - 0x214]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x401576
test edi, edi
jne 0x4015a1
push dword [ebp + 0x10]
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 4]
call fcn.004014d8
test eax, eax
jne 0x40157f
push 0x105
lea eax, [ebp - 0x214]
push eax
push edi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x40154f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.0040664a
test eax, eax
jne 0x4015b1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x4015bc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x4015bc
push 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x405f2f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x4259f8
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x4259f8], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405f6e
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405f72
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x24], 0
push eax
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x40613b
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40615b
and eax, 0xfffffffe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x406161
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x406190
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x409994]
mov dword [ebp - 8], eax
mov eax, dword [0x409998]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4061e0
test edi, edi
jne 0x40619d
and word [esi], di
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x4061da

Function at 0x406395
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x800
push dword [ebp + 8]
call fcn.00406334
test eax, eax
mov esi, dword [ebp + 0x14]
jne 0x406405
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0x18]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and word [esi + 0x7fe], 0
test edi, edi
pop edi
jne 0x406405
cmp dword [ebp + 0xc], 1
je 0x406409
cmp dword [ebp + 0xc], 2
je 0x406409
and word [esi], 0
pop esi
leave
ret 0x14