joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47eae0
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0xaaaaaaab
mul dword [esp + 0xc]
shr edx, 1
lea ecx, [edx + edx*2 + 3]
add ecx, ecx
add ecx, ecx
mov eax, 0xaaaaaaab
mul ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
shr edx, 1
push edi
lea edi, [edx + edx + 2]
xor ebx, ebx
call fcn.00414050
mov ecx, eax
test ecx, ecx
jne 0x47eb46
fldz
sub esp, 8
fstp qword [esp]
push eax
push eax
push 0x10000
push 0x4f1010
call fcn.004a4b10
add esp, 4
push eax
call fcn.004b0b80
add esp, 0x18
lea eax, [ebx + 0x64]
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, dword [esp + 0x1c]
cmp esi, 2
jbe 0x47ebd1
lea edx, [esi - 3]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
movzx eax, byte [ebp]
shr eax, 2
movzx eax, word [eax*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx + ebx*2], ax
movzx eax, byte [ebp]
movzx edi, byte [ebp + 1]
and eax, 3
shl eax, 4
shr edi, 4
add eax, edi
movzx eax, word [eax*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx + ebx*2 + 2], ax
movzx eax, byte [ebp + 1]
movzx edi, byte [ebp + 2]
and eax, 0xf
shr edi, 6
lea eax, [edi + eax*4]
movzx eax, word [eax*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx + ebx*2 + 4], ax
movzx eax, byte [ebp + 2]
and eax, 0x3f
movzx eax, word [eax*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx + ebx*2 + 6], ax
add ebx, 4
add ebp, 3
sub esi, 3
dec edx
jne 0x47eb60
test esi, esi
je 0x47ec59
movzx edx, byte [ebp]
shr edx, 2
mov ax, word [edx*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx + ebx*2], ax
movzx edx, byte [ebp]
and edx, 3
cmp esi, 1
jbe 0x47ec3f
movzx eax, byte [ebp + 1]
shl edx, 4
shr eax, 4
add edx, eax
movzx edx, word [edx*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx + ebx*2 + 2], dx
movzx eax, byte [ebp + 1]
and eax, 0xf
movzx edx, word [eax*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx + ebx*2 + 4], dx
mov eax, 0x3d
mov word [ecx + ebx*2 + 6], ax
add ebx, 4
xor edx, edx
mov word [ecx + ebx*2], dx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
shl edx, 5
mov ax, word [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ecx + ebx*2 + 2], ax
mov dword [ecx + ebx*2 + 4], 0x3d003d
add ebx, 4
pop edi
pop esi
xor edx, edx
pop ebp
mov word [ecx + ebx*2], dx
xor eax, eax
pop ebx
ret
Function at 0x482860
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
test eax, eax
je 0x482a20
cmp word [eax], 0
je 0x482a20
push 0
push 0x8000000
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x482a20
mov ecx, ebp
call fcn.004ad110
mov esi, dword [esp + 0x28]
lea edi, [eax + 2]
mov dword [esp + 0x14], eax
call fcn.00414050
mov ebx, dword [esi + 4]
mov esi, dword [esp + 0x14]
test esi, esi
je 0x482a19
cmp esi, 0xffffffff
jae 0x482a19
test ebx, ebx
je 0x482a19
push 0
lea eax, [esp + 0x14]
push eax
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
cmp edi, edx
je 0x482a20
mov eax, dword [esp + 0x10]
cmp esi, eax
jne 0x482a20
mov byte [eax + ebx], dl
mov ecx, dword [esp + 0x10]
mov byte [ecx + ebx + 1], dl
cmp byte [esp + 0x2c], dl
jne 0x482920
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, dword [0x5165ec]
mov esi, dword [eax + 0xfc]
mov ecx, dword [esp + 0x10]
and esi, 0x7fffffff
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
cmp ecx, 3
jb 0x48299a
cmp byte [ebx], 0xef
jne 0x48299a
cmp byte [ebx + 1], 0xbb
jne 0x48299a
cmp byte [ebx + 2], 0xbf
jne 0x48299a
mov edi, dword [esp + 0x28]
lea esi, [esp + 0x18]
call fcn.00414130
sub dword [esp + 0x10], 3
add ebx, 3
push ebx
mov eax, edi
call fcn.00414460
test eax, eax
je 0x482a06
mov eax, edi
call fcn.00414e80
mov esi, eax
lea ecx, [esp + 0x18]
add esi, esi
call fcn.00413fb0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
cmp ecx, 2
jb 0x4829d4
cmp byte [ebx], 0xff
jne 0x4829d4
cmp byte [ebx + 1], 0xfe
jne 0x4829d4
mov al, 1
test al, al
je 0x4829ba
add ebx, 2
sub ecx, 2
mov dword [esp + 0x10], ecx
mov edi, dword [esp + 0x28]
lea esi, [esp + 0x18]
call fcn.00414130
test ebx, ebx
je 0x482a06
mov eax, edi
call fcn.00414350
jmp 0x482974
xor al, al
cmp esi, 0x4b0
je 0x4829ac
cmp esi, edx
je 0x4829ec
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp esi, eax
jne 0x482a06
mov edi, dword [esp + 0x28]
lea esi, [esp + 0x18]
call fcn.00414130
push ebx
mov eax, edi
call fcn.004143f0
jmp 0x482974
lea ecx, [esp + 0x18]
call fcn.00413fb0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
Function at 0x482a30
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x208
push edi
mov edi, dword [esp + 0x210]
test edi, edi
je 0x482af6
cmp word [edi], 0
je 0x482af6
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x482a69
shr eax, 4
and al, 1
pop edi
add esp, 0x208
ret
push ebx
push 0x5c
push edi
call fcn.004cb9fc
mov ebx, eax
add esp, 8
cmp ebx, edi
jbe 0x482adf
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x482a80
sub eax, edx
sar eax, 1
cmp eax, 0x104
jae 0x482ac2
push esi
mov esi, ebx
sub esi, edi
sar esi, 1
push esi
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004cb3f1
lea edx, [esp + 0x18]
xor ecx, ecx
push edx
mov word [esp + esi*2 + 0x1c], cx
call fcn.00482a30
add esp, 0x10
pop esi
test al, al
jne 0x482acd
pop ebx
xor al, al
pop edi
add esp, 0x208
ret
cmp word [ebx + 2], 0
jne 0x482adf
pop ebx
mov al, 1
pop edi
add esp, 0x208
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
pop ebx
setne al
pop edi
add esp, 0x208
ret
xor al, al
pop edi
add esp, 0x208
ret
Function at 0x482e20
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push 0xffffffffffffffff
push 0x4dc590
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
xor ebp, ebp
push esi
push edi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
push 0xa4
mov byte [esp + 0x34], 1
push ebp
mov dword [esp + 0x24], 0x52
call fcn.004caea7
mov edi, eax
add esp, 8
cmp edi, ebp
jne 0x482e95
push ebp
call fcn.004ca991
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
xor eax, eax
dec dword [0x5164e0]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebp
mov word [edi], ax
jne 0x482eaf
call fcn.00413d80
mov eax, dword [0x519dfc]
mov esi, dword [eax]
mov ecx, esi
shr ecx, 0xb
xor esi, ecx
mov edx, esi
add eax, 4
and edx, 0xff3a58ad
shl edx, 7
mov dword [0x519dfc], eax
xor esi, edx
mov eax, esi
and eax, 0xffffdf8c
shl eax, 0xf
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
shr ecx, 0x12
xor ecx, esi
add eax, ecx
call fcn.00409dc0
test eax, eax
je 0x482fb5
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x482f00
sub eax, edx
sar eax, 1
add eax, eax
push 1
mov edx, edi
lea ecx, [esp + 0x14]
call fcn.0047e5b0
mov esi, dword [esp + 0x18]
add esp, 4
test eax, eax
jne 0x482f9c
cmp esi, ebp
je 0x482f4c
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x482f32
sub eax, edx
sar eax, 1
cmp eax, 0xa
jbe 0x482f4c
xor edx, edx
mov word [esi + 0x14], dx
push ebp
push ebp
push 0x4ef0b8
call fcn.004a4b10
mov ebx, dword [esp + 0x44]
add esp, 4
push eax
lea eax, [ebx + 4]
push esi
push eax
call fcn.0047ece0
add esp, 0x14
test eax, eax
jne 0x482f9c
mov ebx, dword [ebx + 8]
push ebp
push ebp
push 0x4f09a0
call fcn.004a4b10
add esp, 4
push eax
push ebx
mov ebx, dword [esp + 0x48]
lea ecx, [ebx + 0x10]
push ecx
call fcn.0047ece0
add esp, 0x14
test eax, eax
jne 0x482f9c
mov byte [ebx], 1
cmp esi, ebp
je 0x482fb5
mov edx, dword [esp + 0x10]
push edx
push ebp
push esi
call fcn.004d2f90
push esi
call fcn.004ca991
add esp, 0x10
push 0x52
push ebp
push edi
call fcn.004d2f90
push edi
call fcn.004ca991
mov ecx, dword [esp + 0x38]
add esp, 0x10
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 4
Function at 0x485a10
Capabilities:
Create pipe
Create process on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, eax
mov ebx, ecx
test ebp, ebp
je 0x485ade
cmp word [ebp], 0
je 0x485ade
test edi, edi
je 0x485ade
test esi, esi
je 0x485ade
cmp dword [esi], 0
je 0x485ade
test ebx, ebx
je 0x485a56
cmp word [ebx], 0
jne 0x485a56
xor ebx, ebx
push 0xa00000
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x485ade
or dword [esi + 0x2c], 0x100
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push edi
mov dword [esi + 0x38], eax
mov eax, dword [esp + 0x24]
push esi
push ebx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
xor eax, eax
push eax
push eax
push 1
push eax
push eax
mov dword [edi], eax
mov dword [edi + 4], eax
push ebp
mov dword [edi + 8], eax
push eax
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x485ae0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x20]
push ecx
call esi
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x485d60
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4dbc8b
push eax
mov eax, 0x2023c
mov dword fs:[0], esp
call fcn.004d5830
push ebx
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [esp + 0x20258], ebx
jne 0x485daa
push str.4_799
call fcn.004a4b10
add esp, 4
mov dword [esp + 0x20258], eax
cmp eax, ebx
je 0x485fa2
mov eax, dword [esp + 0x20258]
cmp word [eax], bx
je 0x485fa2
mov eax, dword [esp + 0x2025c]
cmp eax, ebx
je 0x485fa2
cmp word [eax], bx
je 0x485fa2
push ebp
push 0x528
push ebx
lea ebp, [esp + 0x20]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], 0x294
call fcn.004caea7
add esp, 8
cmp eax, ebx
jne 0x485e08
push ebx
call fcn.004ca991
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
jmp 0x485e15
xor ecx, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
mov word [eax], cx
push esi
mov dword [esp + 0x20254], ebx
cmp edi, ebx
je 0x485e9e
cmp word [edi], bx
je 0x485e9e
push 0x5c
push edi
call fcn.004ca9cb
add esp, 8
test eax, eax
jne 0x485e88
push 0x106
lea edx, [esp + 0x20]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x1c]
push 0x5c
push eax
call fcn.004cb9fc
add esp, 8
cmp eax, ebx
je 0x485e5f
xor ecx, ecx
mov word [eax + 2], cx
push 1
push ebx
lea edx, [esp + 0x24]
push edx
lea esi, [esp + 0x1c]
call fcn.004148c0
push 1
push ebx
push edi
call fcn.004148c0
mov ebp, dword [esp + 0x14]
mov eax, esi
call fcn.00414e80
mov edi, eax
jmp 0x485eef
push ebx
lea eax, [esp + 0x20]
push eax
push 0x118
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov edi, eax
jmp 0x485eef
mov edx, dword [0x51cbbc]
push ebx
lea ecx, [esp + 0x20]
push ecx
push 0x118
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov edi, eax
lea eax, [esp + 0x1c]
push 0x2e
push eax
call fcn.004cb9fc
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x485eef
push str.__.
call fcn.004a4b10
mov edx, esi
add esp, 4
sub edx, eax
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x485ee0
cmp edi, 0x104
ja 0x485f95
mov ecx, dword [esp + 0x20264]
cmp word [ecx], bx
je 0x485f95
xor edx, edx
push 0x4f0b28
mov word [esp + 0x250], dx
call fcn.004a4b10
mov ecx, dword [esp + 0x20268]
mov edx, dword [esp + 0x20264]
add esp, 4
push ebp
push 0xffff
mov esi, eax
lea eax, [esp + 0x254]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x24c]
push esi
push eax
call fcn.004c9bad
add esp, 8
test eax, eax
je 0x485f95
mov eax, dword [esp + 0x2025c]
lea ebx, [esp + 0x24c]
call fcn.00414350
lea ecx, [esp + 0x10]
call fcn.00413fb0
mov al, 1
pop esi
pop ebp
pop edi
pop ebx
mov ecx, dword [esp + 0x2023c]
mov dword fs:[0], ecx
add esp, 0x20248
ret
lea ecx, [esp + 0x10]
call fcn.00413fb0
xor al, al
jmp 0x485f7c
mov ecx, dword [esp + 0x20244]
pop edi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x20248
ret
Function at 0x4a1c30
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x4dc418
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x28]
mov edx, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [esp + 0x10]
mov esi, 1
mov dword [esp + 0x30], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [ebp + 4], edi
mov dword [esp + 0x28], ebx
cmp ecx, ebx
jg 0x4a1ca2
mov dword [ebp + 4], edx
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x10
xor ebx, ebx
cmp eax, dword [esp + 0x3c]
jl 0x4a1ce1
mov eax, dword [0x5165ec]
mov ecx, 0x42
mov esi, 0x519af0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dword [eax + 0x2c], ebx
mov dword [0x51cbd8], ebx
mov dword [0x51cbdc], ebx
cmp dword [0x51b06c], ebx
je 0x4a1cdd
push 0x51b6d8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp]
lea eax, [eax + eax*2]
mov ecx, dword [ecx + eax*4]
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x38]
push eax
push edx
push 0x4e6a10
xor eax, eax
mov ebx, ecx
call fcn.0049ec30
add esp, 0x10
test eax, eax
je 0x4a1d4d
cmp dword [esp + 0x30], 0
jne 0x4a1d6f
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, dword [esp + 0x1c]
jl 0x4a1ca0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], eax
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x10
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [ecx + 4], edx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x10
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop edi
pop esi
mov dword [ecx + 4], edx
mov ecx, dword [esp + 0x18]
pop ebp
mov eax, 3
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x4a3000
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x20214
call fcn.004d5830
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x4a301a
cmp word [esi], 0
jne 0x4a301f
mov esi, str.ERROR
xor eax, eax
lea edx, [esp + 0xc]
push edx
mov word [esp + 0x220], ax
xor ecx, ecx
lea eax, [esp + 0x14]
push eax
mov word [esp + 0x10], cx
mov ecx, dword [esp + 0x20228]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp word [ebx], 0
je 0x4a309d
cmp word [edi], 0
jne 0x4a305d
lea edi, [esp + 8]
lea edx, [esp + 0x10]
push edx
push 0xffff
lea eax, [esp + 0x224]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [0x51ae08]
push 1
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x228]
push eax
push ecx
call fcn.004aefb0
pop edi
pop esi
add esp, 0x20214
ret 4
cmp word [edi], 0
je 0x4a30be
lea ecx, [esp + 0x10]
push ecx
push 0xffff
lea edx, [esp + 0x224]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
jmp 0x4a30d6
lea eax, [esp + 0x10]
push eax
push 0xffff
lea ecx, [esp + 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
test eax, eax
je 0x4a3078
lea eax, [esp + 0x21c]
cmp word [eax], 0
jne 0x4a30f6
cmp word [eax + 2], 0
je 0x4a3078
mov edx, 0xa
mov word [eax], dx
add eax, 2
jmp 0x4a30e1

Function at 0x4a3100
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
sub esp, 0x258
push ebx
push ebp
push esi
mov esi, eax
mov ebp, 1
push edi
mov dword [esp + 0x10], ebp
test esi, esi
je 0x4a317c
cmp word [esi], 0
je 0x4a317c
push 4
push 0x50f014
push esi
call fcn.004cbb84
add esp, 0xc
test eax, eax
mov eax, esi
jne 0x4a3138
lea eax, [esi + 8]
mov ebx, 0x4f492c
call fcn.00409d30
test eax, eax
je 0x4a316b
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4a317c
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x258
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
jne 0x4a315e
push 0
push 0
push 1
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4a315e
mov edx, dword [esp + 0x26c]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a31a5
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
sub eax, esi
sar eax, 1
mov esi, eax
mov ecx, 0x5d
push 0
mov word [edx + esi*2], cx
lea edx, [esp + 0x18]
push edx
push 4
push 0x50e954
push edi
lea ebx, [esi + esi + 2]
call ebp
test eax, eax
je 0x4a3202
cmp dword [esp + 0x14], 4
jne 0x4a3202
mov ecx, dword [esp + 0x26c]
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push ecx
push edi
call ebp
test eax, eax
je 0x4a3202
cmp dword [esp + 0x14], ebx
je 0x4a320a
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4a3219
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x26c]
pop edi
xor edx, edx
mov word [eax + esi*2], dx
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
add esp, 0x258
ret
Function at 0x4a3ac0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x210
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push edi
mov dword [esp + 0x30], 0xff
call ebx
cmp eax, 0x103
je 0x4a3b87
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [0x5165ec]
mov edx, dword [ecx + 0xd0]
lea eax, [esp + 0x14]
push eax
or edx, 0x20019
push edx
push 0
lea eax, [esp + 0x2c]
push eax
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x4a3b94
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004a3ac0
mov edx, dword [esp + 0x18]
add esp, 4
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4a3b94
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
test esi, esi
jne 0x4a3b94
lea ecx, [esp + 0x18]
push ecx
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
push esi
push edi
mov dword [esp + 0x30], 0xff
call ebx
cmp eax, 0x103
jne 0x4a3b0a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret

Function at 0x4a3bb0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push esi
test ebx, ebx
je 0x4a3ca0
test edi, edi
je 0x4a3bc9
cmp word [edi], 0
jne 0x4a3bd1
test ebp, ebp
je 0x4a3ca0
mov ecx, dword [0x5165ec]
mov edx, dword [ecx + 0xd0]
lea eax, [esp + 0x14]
push eax
or edx, 0x2001f
push edx
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4a3c72
mov eax, dword [esp + 0x14]
test ebp, ebp
jne 0x4a3c89
push eax
call fcn.004a3ac0
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4a3c72
mov eax, 1
test byte [0x51f570], al
jne 0x4a3c50
or dword [0x51f570], eax
push str.RegDeleteKeyExW
push str.advapi32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x51f56c], eax
jmp 0x4a3c55
mov eax, dword [0x51f56c]
mov edx, dword [0x5165ec]
mov ecx, dword [edx + 0xd0]
test ecx, ecx
je 0x4a3c7f
test eax, eax
je 0x4a3c7f
push 0
push ecx
push edi
push ebx
call eax
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a3ca5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4a3ca7
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x4a3c70
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0x14]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4a3c72
mov esi, 0x57
mov eax, esi
mov edx, dword [0x5165ec]
mov dword [edx + 0x30], eax
mov edx, dword [esp + 0x10]
test esi, esi
setne al
movzx ecx, al
push ecx
push edx
call fcn.0042db70
pop esi
pop ebp
pop ecx
ret 8
Function at 0x4a55f0
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esi + 0x2c]
push ebx
push ebp
xor ebp, ebp
push edi
cmp eax, ebp
je 0x4a5616
sub eax, dword [esi + 0x30]
mov edi, dword [esi]
sub eax, dword [esi + 8]
push 1
cdq
push edx
push eax
mov eax, dword [edi + 0x14]
mov ecx, esi
call eax
mov dword [esi + 0x2c], ebp
mov dword [esi + 8], ebp
mov eax, dword [esi + 8]
cmp eax, ebp
je 0x4a5633
cmp dword [esi + 0x2c], ebp
jne 0x4a5633
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
push eax
mov eax, dword [esi + 0x30]
push eax
mov ecx, esi
call edx
mov dword [esi + 8], ebp
mov edx, dword [esi]
xor eax, eax
mov word [esi + 0x28], ax
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
push ebp
mov ebp, dword [esp + 0x18]
mov ebx, edx
mov edx, dword [esi]
mov edx, dword [edx + 0x14]
mov edi, eax
mov eax, dword [esp + 0x14]
push ebp
push eax
mov ecx, esi
call edx
test al, al
je 0x4a56a0
mov eax, dword [esi + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x4a56a0
cmp ebp, ebx
jg 0x4a5680
jl 0x4a5678
cmp dword [esp + 0x10], edi
jae 0x4a5680
mov eax, dword [esp + 0x10]
mov ecx, ebp
jmp 0x4a5684
mov eax, edi
mov ecx, ebx
mov edx, dword [esi]
push 0
push ecx
push eax
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
mov ecx, esi
call eax
pop edi
pop ebp
pop ebx
ret 8
pop edi
or eax, 0xffffffff
pop ebp
or edx, eax
pop ebx
ret 8