joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0f00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x546ad2
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x596634]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x824], esi
mov dword [ebp - 0x81c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x818], 0
mov word [esi], dx
mov dword [ebp - 4], edx
mov dword [ebp - 0x81c], 1
test ecx, ecx
je 0x4c1030
test eax, eax
je 0x4c1030
test ebx, ebx
je 0x4c1030
lea edx, [ebp - 0x818]
push edx
push 0x20219
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c101f
cmp dword [ebp - 0x818], eax
je 0x4c1030
push 0x802
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.004dcfa0
add esp, 0xc
mov dword [ebp - 0x820], 0x800
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x814]
push eax
push 0
push 0xffff
push ebx
push 0
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x4c101f
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c1001
sub ecx, edx
lea eax, [ebp - 0x814]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00428460
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x4c1030
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4c1200
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
test ecx, ecx
je 0x4c120f
pop ebp
jmp fcn.004c1220
xor al, al
pop ebp
ret 4
Function at 0x4c3ba0
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x546ea0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x596634]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
test edi, edi
je 0x4c3ce9
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4c3ce9
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c3ce9
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4c3ce9
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 5
push SysReAllocString
push edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, 0xffffffff
je 0x4c3cd5
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push edi
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4c3cce
cmp dword [ebp - 0x1c], ebx
jne 0x4c3cce
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
cmp eax, ecx
ja 0x4c3c6d
mov dword [esi + 0x10], eax
mov ecx, esi
cmp dword [esi + 0x14], 0x10
jb 0x4c3c67
mov ecx, dword [esi]
mov byte [ecx + eax], 0
jmp 0x4c3c79
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00436f50
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push dword [ebp - 0x20]
mov ecx, esi
push 0
call fcn.0047b2cb
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jne 0x4c3cce
push edi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d7040
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.004d7650
add esp, 8
test al, al
je 0x4d7065
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4d7065
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x4d7650
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x4d8ac0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4d8aeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4d8aeb
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x4db640
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c8
mov eax, dword [0x596634]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c4], ecx
mov dword [ebp - 0x4c0], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test ecx, ecx
je 0x4db721
test eax, eax
je 0x4db721
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4db721
mov ax, word [ebp - 0x4bc]
xor esi, esi
test ax, ax
je 0x4db721
xor ecx, ecx
movzx edx, ax
nop dword [eax + eax]
mov ax, word [ebp + ecx - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push 0x64
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], dx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4db70c
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebp - 0xd4]
push ebx
push eax
push dword [ebp - 0x4c4]
mov dword [ebp - 0x4c8], ebx
call fcn.00518971
add esp, 0xc
test eax, eax
je 0x4db734
add esi, 4
lea ecx, [esi + esi]
movzx eax, word [ebp + ecx - 0x4bc]
mov edx, eax
test ax, ax
jne 0x4db6b0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x4db782
cmp edi, 0x7fffffff
ja 0x4db782
mov ecx, dword [ebp - 0x4c0]
lea ebx, [ebp - 0xc]
mov esi, SysReAllocString
mov edx, edi
sub esi, edi
sub ebx, ecx
lea eax, [esi + edx]
test eax, eax
je 0x4db76f
movzx eax, word [ebx + ecx]
test ax, ax
je 0x4db76f
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4db754
mov ebx, dword [ebp - 0x4c8]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor ecx, ecx
test edi, edi
je 0x4db790
cmp edi, 0x7fffffff
jbe 0x4db795
mov ecx, 0x80070057
test ecx, ecx
js 0x4db7cb
mov eax, dword [ebp - 0x4c0]
mov esi, edi
test edi, edi
je 0x4db7b3
cmp word [eax], 0
je 0x4db7b3
add eax, 2
sub esi, 1
jne 0x4db7a5
xor eax, eax
mov ecx, 0x80070057
test esi, esi
cmovne ecx, eax
mov eax, edi
sub eax, esi
neg esi
sbb esi, esi
and esi, eax
jmp 0x4db7cd
xor esi, esi
test ecx, ecx
js 0x4db81e
mov eax, dword [ebp - 0x4c0]
mov edx, edi
lea ecx, [eax + esi*2]
sub edx, esi
je 0x4db811
mov eax, edx
sub eax, edi
mov edi, dword [ebp - 0x4c4]
add eax, 0x7fffffff
add esi, eax
lea eax, [ebx + ebx]
sub eax, ecx
add edi, eax
test esi, esi
je 0x4db811
movzx eax, word [edi + ecx]
test ax, ax
je 0x4db811
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x4db7f8
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00496d46
mov esp, ebp
pop ebp
ret
Function at 0x4dbc00
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00496d60
mov eax, dword [0x596634]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
je 0x4dbd31
mov edi, dword [ebp + 0x10]
cmp edi, 0x64
jl 0x4dbd31
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4dbd31
push 0x400
lea eax, [ebp - 0x804]
mov dword [ebp - 0x804], 0
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
mov dword [ebp - 0x1008], eax
test eax, eax
je 0x4dbd06
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.004dcfa0
lea eax, [ebp - 0x804]
push 0x7e
push eax
call fcn.004de03e
add esp, 0x14
test eax, eax
je 0x4dbcc8
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
ja 0x4dbcc8
mov ecx, 1
jmp 0x4dbcca
xor ecx, ecx
test ecx, ecx
lea edx, [ebp - 0x1004]
lea eax, [ebp - 0x804]
push edi
cmovne eax, edx
push eax
push ebx
call fcn.0050b03e
add esp, 0xc
mov edi, dword [ebp - 0x1008]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x4dbce6
push edi
lea eax, [ebp - 0x804]
push ebx
push eax
call fcn.004db640
add esp, 0xc
mov edi, eax
jmp 0x4dbcec
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00496d46
mov esp, ebp
pop ebp
ret
Function at 0x4dbd50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5493e8
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x596634]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4dbda0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00428460
push 0
push 2
mov dword [ebp - 4], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x270], ebx
cmp ebx, 0xffffffff
je 0x4dbf03
push 0x22c
lea eax, [ebp - 0x26c]
push 0
push eax
call fcn.004dcfa0
add esp, 0xc
mov dword [ebp - 0x26c], 0x22c
lea eax, [ebp - 0x26c]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4dbefc
nop
xor eax, eax
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4dbe30
sub ecx, edx
lea eax, [ebp - 0x248]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00428460
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x40]
mov edi, dword [ebp - 0x40]
lea esi, [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
cmp ebx, 8
cmovae eax, edi
cmp dword [ebp - 0x14], 8
cmovae esi, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x30]
jne 0x4dbead
mov edx, ecx
test edx, edx
je 0x4dbe91
sub esi, eax
nop dword [eax]
mov cx, word [esi + eax]
cmp cx, word [eax]
jne 0x4dbead
add eax, 2
sub edx, 1
jne 0x4dbe80
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x264]
lea ecx, [ebp - 0x40]
call fcn.004218e0
jmp 0x4dbf05
cmp ebx, 8
jb 0x4dbee1
lea ecx, [ebx*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x4dbed7
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4dbf59
push ecx
push edi
call fcn.00496936
add esp, 8
mov ebx, dword [ebp - 0x270]
lea eax, [ebp - 0x26c]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4dbe10
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4dbf3b
mov edx, dword [ebp - 0x28]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4dbf31
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4dbf59
push ecx
push edx
call fcn.00496936
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret
call fcn.004e8718
int3
Function at 0x4dc1f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549486
mov eax, dword fs:[0]
push eax
sub esp, 0x2dc
mov eax, dword [0x596634]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x2e0]
push 0x2d0
push 0
push eax
call fcn.004dcfa0
mov esi, dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
lea eax, [ebp - 0x2e4]
add esp, 0xc
mov dword [ebp - 0x2e4], 0x168
push eax
lea eax, [ebp - 0x2e0]
push eax
push 0x550938
push str.http
push 1
push 0
call esi
xor ebx, ebx
test eax, eax
setns bl
test eax, eax
jns 0x4dc292
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2e0]
push eax
push 0
push str.iexplore.exe
push 2
push 2
call esi
xor ebx, ebx
test eax, eax
setns bl
test ebx, ebx
je 0x4dc3d6
call fcn.0040d750
mov ecx, eax
test ecx, ecx
je 0x4dc3f4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2e8], eax
lea eax, [ebp - 0x2e0]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x2e8]
call fcn.0041d980
test al, al
jne 0x4dc302
lea ecx, [ebp - 0x2e0]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4dc2e0
sub ecx, edx
lea eax, [ebp - 0x2e0]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2e8]
call fcn.0040de70
mov esi, dword [ebp - 0x2e8]
mov dword [ebp - 4], 1
cmp dword [esi - 0xc], 0
jge 0x4dc31a
or eax, 0xffffffff
jmp 0x4dc335
push str..exe
push esi
call fcn.004de105
add esp, 8
test eax, eax
jne 0x4dc331
or eax, 0xffffffff
jmp 0x4dc335
sub eax, esi
sar eax, 1
mov ecx, dword [esi - 0xc]
test eax, eax
jle 0x4dc366
sub ecx, eax
add eax, 4
add ecx, 4
push ecx
push eax
lea ecx, [ebp - 0x2e8]
call fcn.0046cac0
push 1
push 0
lea ecx, [ebp - 0x2e8]
call fcn.0046cac0
mov esi, dword [ebp - 0x2e8]
push 1
push 0
push dword [edi]
push esi
push 0x550938
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x4dc3a0
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4dc3d6
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x4dc3d6
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push 1
push dword [edi]
push esi
call fcn.004dc6f0
add esp, 0x20
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4dc3d6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040af60
int3
Function at 0x4dc400
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5494b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x596634]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push esi
mov dword [ebp - 0x10], 0
call fcn.0040fdb0
push 0x566a30
push 0x566a34
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.004232c0
push 0xa
push 0
push dword [esi]
push 0x566a38
push 0x550938
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x20
mov dword [ebp - 4], 0xffffffff
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sbb esi, esi
add eax, 0xfffffff0
neg esi
or ecx, 0xffffffff
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4dc495
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4dc6f0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549538
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x596634]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], eax
test edi, edi
jne 0x4dc734
xor eax, eax
jmp 0x4dc8b6
cmp word [edi], 0
je 0x4dc72d
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4dc740
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x4dc72d
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4dc72d
cmp dword [ebp + 0x14], 0
je 0x4dc778
push dword [ebp - 0x6c]
push edi
call fcn.004743f0
add esp, 8
test eax, eax
je 0x4dc72d
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], 0
call fcn.00416060
push esi
push edi
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 0
push 0x551134
push eax
call fcn.0041dc70
mov esi, dword [ebp - 0x68]
add esp, 0x10
cmp dword [esi - 4], 1
jle 0x4dc7b8
push dword [esi - 0xc]
lea ecx, [ebp - 0x68]
call fcn.0040c7c0
mov esi, dword [ebp - 0x68]
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
xor eax, eax
movlpd qword [ebp - 0x60], xmm0
mov word [ebp - 0x22], ax
mov eax, 0xa
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x32], xmm0
movlpd qword [ebp - 0x2a], xmm0
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 0x81
mov word [ebp - 0x34], ax
call fcn.004baa90
mov dword [ebp - 0x74], eax
test eax, eax
je 0x4dc88d
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4dc830
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4dc875
push str.CreateProcessWithTokenW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4dc875
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x64]
push ecx
push 0
push 0
push 0
push esi
push 0
push 0
push dword [ebp - 0x74]
call eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4dc87b
push dword [ebp - 0x1c]
call esi
push dword [ebp - 0x20]
call esi
mov dword [ebp - 0x6c], 1
jmp 0x4dc87b
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x74]
call esi
cmp dword [ebp - 0x6c], 0
je 0x4dc88d
mov esi, 1
jmp 0x4dc8ac
push 0xa
push 0
push dword [ebp - 0x70]
push edi
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov dword [ebp - 0x70], ecx
mov esi, ecx
lea ecx, [ebp - 0x68]
call fcn.0040d150
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret

Function at 0x521508
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052110d

Function at 0x521513
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052128e
Function at 0x528d17
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005284f1

Function at 0x528d22
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052872c

Function at 0x5291b5
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00528f3c

Function at 0x5324c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5495b0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x596634]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 0xc]
xor edi, edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
push 0xffffffffffffffff
push 0x532830
push 0x532780
push 0x532850
push 0x5327f0
push 0x5327a0
push 0x5328a0
push 0x532890
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call sub.Cabinet.dll_FDICreate
mov ebx, eax
add esp, 0x24
test ebx, ebx
je 0x53261d
push dword [ebp - 0x20]
push edi
push 0x5328b0
push edi
push dword [ebp - 0x28]
push esi
push ebx
call sub.Cabinet.dll_FDICopy
add esp, 0x1c
test eax, eax
jne 0x5325b3
lea ecx, [ebp - 0x20]
call fcn.00416060
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
push esi
mov dword [ebp - 4], edi
call fcn.00532640
push eax
push esi
lea eax, [ebp - 0x20]
push str.FDICopy_failed_with_error_code__d_:__s
push eax
call fcn.0041dc70
mov esi, dword [ebp - 0x20]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x5325b8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x5325b8
mov edi, 1
push ebx
call sub.Cabinet.dll_FDIDestroy
add esp, 4
cmp eax, 1
je 0x53261d
lea ecx, [ebp - 0x20]
call fcn.00416060
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
push esi
mov dword [ebp - 4], 1
call fcn.00532640
push eax
push esi
lea eax, [ebp - 0x20]
push str.FDIDestroy_failed_with_error_code__d_:__s
push eax
call fcn.0041dc70
mov esi, dword [ebp - 0x20]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x53261d
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403954
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x484020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4039ec
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x4039cc
xor eax, eax
push ebp
push 0x4039c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403a24
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4039cc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x484020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x484020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404b30
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x486050], 0
je 0x404b91
cmp word [0x48632c], 0xd7b2
jne 0x404b59
cmp dword [0x486334], 0
jbe 0x404b59
mov eax, 0x486328
call dword [0x486344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404bbc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x48402c], 0
jne 0x404bad
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404d10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x484030], 0
je 0x404d36
mov edx, esi
mov eax, ebx
call dword [0x484030]
jmp 0x404d45
mov eax, 8
call fcn.00402f9c
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x486051], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404cd8
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc