joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044d0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404700
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404553
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404700
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404553
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40471c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4045dc
xor eax, eax
push ebp
push 0x4045d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404318
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4045ba
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40473c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4045ba
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4045dc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale_1
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4046f6
cmp byte [ebp - 0xd], 0
jne 0x404623
cmp byte [ebp - 0x12], 0
je 0x4046f6
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40463c
dec ebx
cmp byte [ebx], 0x2e
je 0x40464b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40463b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4046f6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404688
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4046f6
cmp byte [ebp - 0xd], 0
je 0x4046f6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4046f6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40488c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4048f2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403dc4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ab8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4048dc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4048f9
lea eax, [ebp - 0x10]
call fcn.00403b70
ret

Function at 0x406770
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x40677f
mov edx, dword [edx + 0x36]
jmp fcn.00403d4c
mov ecx, dword [edx + 0x18]
jecxz 0x406777
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.0040402c
pop edx
mov ecx, dword [ebx]
jecxz 0x4067a7
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret

Function at 0x4090b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x4090e9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403c60
jmp 0x4090f2
mov eax, ebx
mov edx, esi
call fcn.00403bc4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4090fc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x40911d
mov al, byte [esp]
jmp 0x40911f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a214
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40a278
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403dc4
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00408344
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a27f
lea eax, [ebp - 0xc]
call fcn.00403b70
ret
Function at 0x4035d1
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0046fdd0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40363e
push 0x2a
push 0x40324cc
push 6
call fcn.0046c458
add esp, 0xc
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40364e
push ebx
call fcn.0046c446
add esp, 4
cmp dword [ebp - 4], 0
jg 0x40365f
mov dword [ebp - 4], 0x100
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.0046fdf0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403692
push ebx
call fcn.0046c446
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4036cb
push 0x125
push 0x40324cc
push 6
call fcn.0046c458
add esp, 0xc
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4036de
mov eax, 0x49b2f9
push eax
push 1
mov ebx, 0x174
call fcn.0046fe30
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403708
push ebx
call fcn.0046c446
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0x49b2f9
push dword [ebp - 8]
call fcn.0040163b
add esp, 8
cmp eax, 0
jne 0x403745
call fcn.0040377c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403741
push ebx
call fcn.0046c446
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x403761
push eax
mov ebx, eax
call fcn.004011ce
inc eax
push eax
call fcn.0046c44c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x403766
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x403777
push ebx
call fcn.0046c446
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40498d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [0x4a674e]
call fcn.004011a6
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x4049ce
push 0x12
push 0x40115fc
push 4
call fcn.0046c458
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x4049eb
push 0x12
push 0x40115fc
push 1
call fcn.0046c458
add esp, 0xc
shl eax, 2
add ebx, eax
mov ebx, dword [ebx]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx]
call fcn.0040118d
xor ecx, ecx
push eax
lea eax, [ebp - 4]
mov ebx, eax
pop eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
push eax
cmp ecx, eax
jg 0x404b17
mov ebx, dword [0x4a674e]
call fcn.004011a6
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x404a40
push 0x5d
push 0x40115fc
push 4
call fcn.0046c458
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x404a5d
push 0x5d
push 0x40115fc
push 1
call fcn.0046c458
add esp, 0xc
shl eax, 2
add ebx, eax
mov ebx, dword [ebx]
mov ebx, dword [ebx]
call fcn.004011a6
push ebx
push ecx
mov eax, dword [ebp - 4]
dec eax
jns 0x404a8a
push 0x5d
push 0x40115fc
push 4
call fcn.0046c458
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x404aa7
push 0x5d
push 0x40115fc
push 1
call fcn.0046c458
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x404add
push 0x5d
push 0x40115fc
push 6
call fcn.0046c458
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x404af8
cmp dword [ebp - 8], 1
je 0x404af8
xor eax, eax
jmp 0x404afd
mov eax, 1
test eax, eax
je 0x404b0f
mov eax, 0
jmp 0x404b24
pop eax
pop ebx
pop ecx
jmp 0x404a08
add esp, 0xc
mov eax, 1
jmp 0x404b24
mov esp, ebp
pop ebp
ret 4
Function at 0x40c3f1
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x40c421
mov edx, 0xffffffff
mov eax, 0xffffffff
jmp 0x40c45c
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40c451
push 0xa0
push 0x4031f01
push 6
call fcn.0046c458
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
jmp 0x40c45c
mov esp, ebp
pop ebp
ret 4

Function at 0x40e433
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x40e45e
mov eax, 0x49b310
jmp 0x40e5c0
cmp dword [ebp + 0xc], 0
jg 0x40e4b6
mov dword [ebp - 0xc], esp
mov eax, dword [ebp + 0xc]
cdq
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40e4a2
push 0xe2
push 0x4031f00
push 6
call fcn.0046c458
add esp, 0xc
cmp dword [ebp + 0xc], 0
jg 0x40e4b6
mov eax, 0x49b310
jmp 0x40e5c0
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call fcn.0040e5d8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40e4ed
mov eax, 0x49b310
jmp 0x40e5c0
mov dword [ebp - 0xc], esp
push 0
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40e527
push 0x2a4
push 0x4031f00
push 6
call fcn.0046c458
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40e53e
mov eax, 0x49b310
jmp 0x40e5c0
push 0x80000301
push 0
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0x910
call fcn.0046fd10
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40e57d
push ebx
call fcn.0046c446
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.0040e665
mov eax, dword [ebp - 8]
test eax, eax
je 0x40e5bb
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0046c44c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40e5c0
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40e5d1
push ebx
call fcn.0046c446
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40fc29
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 2
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
nop
nop
cmp dword [ebp - 8], esp
je 0x40fc6a
push 0x2c
push 0x40121d3
push 6
call fcn.0046c458
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x41
jl 0x40fc88
cmp dword [ebp - 4], 0x5a
jg 0x40fc88
mov eax, 1
jmp 0x40fc8d
mov eax, 0
test eax, eax
je 0x40fc99
add dword [ebp - 4], 0x20
mov eax, dword [ebp - 4]
jmp 0x40fca1
mov esp, ebp
pop ebp
ret 4
Function at 0x462730
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x46273a
add dword [esp], 5
retf

Function at 0x462ff6
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x4a6872]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x463031
add dword [esp], 5
retf

Function at 0x46de60
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.004735a0
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x494670
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x46df22
mov ecx, dword [esp + 0x10]
mov eax, 1
cmp ecx, eax
mov dword [esp + 0xc], eax
jle 0x46df1b
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ebx, [edi + 4]
mov ecx, dword [ebx]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
push 0
push 0x3a8
call ebp
mov esi, eax
test esi, esi
jle 0x46df06
lea edx, [esi + 1]
push edx
call fcn.0046d9b0
mov edi, eax
add esp, 4
test edi, edi
je 0x46def8
mov eax, dword [ebx]
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0x3a8
call ebp
mov byte [eax + edi], 0
push edi
lea ecx, [esp + 0x20]
call fcn.00473830
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x46deb2
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx]
test eax, eax
je 0x46df35
push eax
call fcn.004739d0
add esp, 4
mov edi, dword [esp + 0x28]
shr edi, 2
shl edi, 2
lea ecx, [edi + 8]
push ecx
call fcn.0046d9b0
mov dword [eax], 1
mov edx, dword [esp + 0x2c]
shr edx, 2
mov dword [eax + 4], edx
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
add esp, 4
neg esi
sbb esi, esi
and esi, ecx
mov ecx, edi
mov edx, ecx
lea edi, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
mov dword [ebx], eax
mov dword [esp + 0x18], 0x49466c
call fcn.004737a0
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x46f610
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.0048bb29
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x46f67a
push esi
lea edi, [eax + 0x400]
call fcn.0048bb52
push edi
call fcn.0048bb29
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x46f64a
push esi
xor edi, edi
call dword [0x4a727c]
add esp, 4
test eax, eax
je 0x46f696
push eax
push esi
call fcn.00474780
add esp, 8
mov edi, eax
push esi
call fcn.0048bb52
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x46ff10
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret
Function at 0x4718a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x471932
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x471924
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x47191c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x4718e5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x471940
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x47195e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x471953
pop esi
ret
Function at 0x471ca0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00474f00
mov edi, dword [esp + 0x38]
xor ebp, ebp
push edi
mov ebx, eax
mov dword [esp + 0x18], ebp
call dword [0x4a727c]
add esp, 8
test ebx, ebx
je 0x471de4
test eax, eax
je 0x471de4
inc eax
push eax
call fcn.0048bb29
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00480bc0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x471d12
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x471dd1
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.0048bb29
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x471d9a
cmp eax, 0xea
jne 0x471dbd
push esi
call fcn.0048bb52
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0048bb29
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x471d65
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x471da8
cmp eax, 2
jne 0x471dbd
push esi
call dword [0x4a727c]
push eax
push esi
call fcn.00474780
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call fcn.0048bb52
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.0048bb52
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x471e0d
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x471e19
mov esi, dword [esp + 0x40]
test esi, esi
je 0x471e19
push esi
call dword [0x4a727c]
push eax
push esi
call fcn.00474780
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x471e30
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x471e99
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.0046d9b0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x471f30
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x154]
xor ebp, ebp
test edi, edi
je 0x471fb0
push edi
call dword [0x4a727c]
add esp, 4
test eax, eax
jbe 0x471fb0
test esi, esi
je 0x471f6e
cmp esi, 0xffffffff
je 0x471f6e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebx], esi
je 0x471ff2
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x471f9c
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
je 0x471fb0
jmp 0x471fab
mov edx, dword [esp + 0x158]
mov eax, dword [esp + 0x10]
test edx, eax
je 0x471fb0
mov ebp, 1
test esi, esi
je 0x471ff2
cmp esi, 0xffffffff
je 0x471ff2
test ebp, ebp
jne 0x472029
mov eax, dword [esp + 0x15c]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x10]
push eax
push esi
je 0x471fff
call edi
test eax, eax
je 0x471ff2
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
jne 0x472029
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x471fda
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
call edi
test eax, eax
je 0x471ff2
mov ebx, dword [esp + 0x158]
test dword [esp + 0x10], ebx
jne 0x472029
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
jne 0x47200c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
lea edx, [esp + 0x3c]
push edx
call dword [0x4a727c]
inc eax
push eax
call fcn.0046d9b0
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret

Function at 0x473c70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x473c91
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x473ceb
inc edi
cmp edi, esi
jl 0x473c85
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x473d20
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x473cda
cmp byte [eax], bl
je 0x473cf5
cmp byte [eax + 1], bl
je 0x473cfe
cmp byte [eax + 2], bl
je 0x473d08
cmp byte [eax + 3], bl
je 0x473d14
add eax, 4
cmp eax, edi
jb 0x473cb1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4