joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x7c]
mov ebx, dword [esp + 0x60]
mov dword [esp + 0x24], ecx
mov esi, dword [esp + 0x64]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x80]
mov ebp, dword [esp + 0x6c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x70]
add eax, 0x6c
mov dword [esp], eax
call method.std::ctype_char__const_std::use_facet_std.ctype_char____std::locale_const_
mov ecx, dword [esp + 0x74]
mov dword [ecx], 0
cmp byte [eax + 0x1c], 0
je 0x435323
movzx ecx, byte [eax + 0x42]
cmp byte [esp + 0x20], 0
mov byte [esp + 0x3c], cl
je 0x435310
movzx eax, byte [esp + 0x20]
mov byte [esp + 0x3f], 0
mov byte [esp + 0x3d], al
movzx eax, byte [esp + 0x28]
mov byte [esp + 0x3e], al
lea eax, [esp + 0x3c]
mov dword [esp], ebx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 4], esi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], eax
call sym.__ZNKSt7__cxx118time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE21_M_extract_via_formatES4_S4_RSt8ios_baseRSt12_Ios_Ios
sub esp, 0x20
mov ebx, eax
cmp edx, 0xffffffff
mov esi, edx
sete dl
test ebx, ebx
setne al
and al, dl
mov byte [esp + 0x20], al
jne 0x435360
cmp ebp, 0xffffffff
sete al
test edi, edi
je 0x4352f3
test al, al
jne 0x4353a0
cmp dl, al
jne 0x4352fe
mov eax, dword [esp + 0x74]
or dword [eax], 2
add esp, 0x4c
mov eax, ebx
mov edx, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x24
movzx eax, byte [esp + 0x28]
mov byte [esp + 0x3e], 0
mov byte [esp + 0x3d], al
jmp 0x43528b
mov ecx, eax
mov dword [esp + 0x2c], eax
call method.std::ctype_char_._M_widen_init___const
mov eax, dword [esp + 0x2c]
mov ecx, 0x25
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
cmp edx, method.std::ctype_char_.do_widen_char__const
je 0x435265
mov ecx, eax
mov dword [esp], 0x25
call edx
sub esp, 4
mov ecx, eax
jmp 0x435265
xor edx, edx
mov eax, dword [ebx + 0xc]
cmp dword [ebx + 8], eax
jb 0x4352e1
mov eax, dword [ebx]
mov ecx, ebx
mov byte [esp + 0x24], dl
call dword [eax + 0x24]
movzx ecx, byte [esp + 0x20]
movzx edx, byte [esp + 0x24]
cmp eax, 0xffffffff
mov eax, 0
cmove edx, ecx
cmove ebx, eax
jmp 0x4352e1
xor eax, eax
mov ecx, dword [edi + 0xc]
cmp dword [edi + 8], ecx
jb 0x4352f3
mov eax, dword [edi]
mov byte [esp + 0x20], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x20]
cmp eax, 0xffffffff
sete al
jmp 0x4352f3
Function at 0x435660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
lea eax, [esp + 0x4c]
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x1c], 4
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x80]
mov ebp, dword [esp + 0x7c]
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], 0x270f
mov dword [esp + 0x14], 0
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebp
mov dword [esp], eax
mov dword [esp + 0x4c], 0
call sym.__ZNKSt7__cxx118time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE14_M_extract_numES4_S4_RiiijRSt8ios_baseRSt12_Ios_Iosta
sub esp, 0x28
mov esi, eax
mov dword [esp + 0x38], eax
movzx eax, dx
or ebx, eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], esi
test eax, eax
jne 0x435770
mov ecx, dword [esp + 0x48]
lea ebx, [ecx + 0x64]
test ecx, ecx
lea eax, [ecx - 0x76c]
mov ecx, dword [esp + 0x88]
cmovs eax, ebx
cmp dx, 0xffff
sete bl
test esi, esi
setne dl
mov dword [ecx + 0x14], eax
and dl, bl
jne 0x43578a
cmp bp, 0xffff
sete al
mov edx, eax
test edi, edi
je 0x43572c
test al, al
jne 0x435750
cmp bl, dl
jne 0x43573a
mov eax, dword [esp + 0x84]
or dword [eax], 2
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jae 0x4357b2
movzx eax, word [eax]
cmp ax, 0xffff
sete dl
cmp bl, dl
jne 0x43573a
jmp 0x435730
mov eax, dword [esp + 0x84]
or dword [eax], 4
cmp dx, 0xffff
sete bl
test esi, esi
setne dl
and dl, bl
je 0x43571b
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jae 0x4357c0
movzx eax, word [eax]
cmp ax, 0xffff
mov eax, 0
mov ebx, 0
cmovne eax, esi
cmove ebx, edx
mov dword [esp + 0x30], eax
jmp 0x43571b
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x24]
jmp 0x43575b
mov eax, dword [esi]
mov byte [esp + 0x30], dl
mov ecx, esi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x30]
jmp 0x435795
Function at 0x435a90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
mov esi, dword [esp + 0xb0]
mov eax, dword [esp + 0xac]
mov dword [esp + 0x34], ecx
mov ebp, dword [esp + 0xa0]
mov ebx, dword [esp + 0xa4]
mov dword [esp + 0x30], eax
lea eax, [esi + 0x6c]
mov edi, dword [esp + 0xa8]
mov dword [esp], eax
call method.std::__timepunct_wchar_t__const_std::use_facet_std.__timepunct_wchar_t____std::locale_const_
mov dword [esp + 0x44], 0
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x48]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 0x4c]
mov dword [esp + 0x4c], edx
mov edx, dword [eax + 0x50]
mov dword [esp + 0x50], edx
mov edx, dword [eax + 0x54]
mov dword [esp + 0x54], edx
mov edx, dword [eax + 0x58]
mov dword [esp + 0x58], edx
mov edx, dword [eax + 0x5c]
mov dword [esp + 0x5c], edx
mov edx, dword [eax + 0x60]
mov dword [esp + 0x60], edx
mov edx, dword [eax + 0x2c]
mov dword [esp + 0x64], edx
mov edx, dword [eax + 0x30]
mov dword [esp + 0x68], edx
mov edx, dword [eax + 0x34]
mov dword [esp + 0x6c], edx
mov edx, dword [eax + 0x38]
mov dword [esp + 0x70], edx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x74], edx
mov edx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x18], 7
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [esp], ebp
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
call sym.__ZNKSt7__cxx118time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE24_M_extract_wday_or_monthES4_S4_RiPPKwjRSt8ios_baseRSt
sub esp, 0x24
mov esi, eax
mov dword [esp + 0x38], eax
movzx eax, dx
mov ebp, esi
or ebx, eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x3c], edx
test eax, eax
jne 0x435c04
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0x40]
mov dword [eax + 0x18], ecx
cmp dx, 0xffff
sete dl
test esi, esi
setne al
and al, dl
mov byte [esp + 0x34], al
jne 0x435c10
cmp word [esp + 0x30], 0xffff
sete al
mov ecx, eax
test edi, edi
je 0x435bd1
test al, al
jne 0x435bf0
cmp dl, cl
jne 0x435bdf
mov eax, dword [esp + 0xb4]
or dword [eax], 2
add esp, 0x8c
mov eax, ebp
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jae 0x435c40
movzx eax, word [eax]
cmp ax, 0xffff
sete cl
jmp 0x435bd1
mov eax, dword [esp + 0xb4]
or dword [eax], 4
jmp 0x435baa
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jae 0x435c52
movzx eax, word [eax]
movzx ecx, byte [esp + 0x34]
cmp ax, 0xffff
mov edx, 0
mov ebp, 0
cmovne ebp, esi
cmove edx, ecx
jmp 0x435bbe
mov eax, dword [edi]
mov byte [esp + 0x30], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x30]
jmp 0x435bfb
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
jmp 0x435c1b
Function at 0x438760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x78]
mov ebp, dword [esp + 0x70]
mov dword [esp + 0x34], ecx
mov esi, dword [esp + 0x8c]
mov edi, dword [esp + 0x90]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x80]
add eax, 0x6c
mov dword [esp], eax
call method.std::ctype_wchar_t__const_std::use_facet_std.ctype_wchar_t____std::locale_const_
mov ecx, dword [esp + 0x84]
mov edx, dword [eax]
mov dword [ecx], 0
mov ecx, eax
mov dword [esp], 0x25
call dword [edx + 0x28]
sub esp, 4
mov word [esp + 0x48], ax
mov eax, esi
movsx si, al
mov eax, edi
test al, al
jne 0x4388b0
xor eax, eax
mov word [esp + 0x4a], si
mov word [esp + 0x4c], ax
lea eax, [esp + 0x48]
mov dword [esp], ebp
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], eax
call sym.__ZNKSt7__cxx118time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE21_M_extract_via_formatES4_S4_RSt8ios_baseRSt12_Ios_Ios
sub esp, 0x20
mov esi, eax
mov dword [esp + 0x38], eax
movzx eax, dx
mov ebp, esi
or ebx, eax
cmp dx, 0xffff
mov dword [esp + 0x3c], edx
sete dl
test esi, esi
setne al
and al, dl
mov edi, eax
jne 0x4388d0
cmp word [esp + 0x30], 0xffff
mov esi, dword [esp + 0x2c]
sete al
mov ecx, eax
test esi, esi
je 0x43886b
test al, al
jne 0x438890
cmp dl, cl
jne 0x438879
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, ebp
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x24
mov edi, dword [esp + 0x2c]
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jae 0x4388f4
movzx eax, word [eax]
cmp ax, 0xffff
sete cl
jmp 0x43886b
movsx di, al
mov word [esp + 0x4c], si
mov word [esp + 0x4a], di
xor edi, edi
mov word [esp + 0x4e], di
jmp 0x4387e2
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jae 0x438910
movzx eax, word [eax]
cmp ax, 0xffff
mov edx, 0
mov ebp, 0
cmove edx, edi
cmovne ebp, esi
jmp 0x438854
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0x30], dl
mov eax, dword [ecx]
call dword [eax + 0x24]
movzx edx, byte [esp + 0x30]
jmp 0x43889f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
jmp 0x4388db
Function at 0x455a90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x58
lea eax, [esp + 0x4c]
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x1c], 4
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], 0x270f
mov dword [esp + 8], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x14], 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 0x4c], 0
call method.std::time_get_wchar_t__std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____._M_extract_num_std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____int__int__int__unsi
sub esp, 0x28
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x60], eax
movzx eax, word [esp + 0x3c]
mov word [esp + 0x64], ax
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x455b60
mov edx, dword [esp + 0x48]
lea ecx, [edx + 0x64]
lea eax, [edx - 0x76c]
test edx, edx
mov edx, dword [esp + 0x78]
cmovs eax, ecx
mov dword [edx + 0x14], eax
lea eax, [esp + 0x68]
lea ecx, [esp + 0x60]
mov dword [esp], eax
call method.std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t___.equal_std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t____const__const
sub esp, 4
test al, al
je 0x455b48
or dword [ebx], 2
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
add esp, 0x58
pop ebx
ret 0x1c
or dword [ebx], 4
jmp 0x455b2e
Function at 0x46ac30
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
jmp 0x46ac4e
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
jne 0x46ac6c
mov ecx, edi
call method.std::__basic_file_char_.fd__
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._read
mov ebp, eax
cmp eax, 0xffffffff
je 0x46ac43
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x4d67b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov al, byte [ebp - 9]
dec eax
test eax, eax
jl 0x4d6803
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
lea eax, [eax + edx*8]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
lea edx, [edx + ecx*8]
mov ecx, dword [ebp - 0x14]
xor byte [edx + ecx], al
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x4d67dd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x4d67c8
mov esp, ebp
pop ebp
ret
Function at 0x4d6ef4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x200]
push ecx
mov ecx, 0x78
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, 0x80
je 0x4d6f30
sub eax, 0x40
je 0x4d6f39
sub eax, 0x40
je 0x4d6f42
jmp 0x4d6f4b
mov dword [ebp - 0x18], 4
jmp 0x4d6f57
mov dword [ebp - 0x18], 6
jmp 0x4d6f57
mov dword [ebp - 0x18], 8
jmp 0x4d6f57
mov dword [ebp - 0x10], 0xfffffffe
jmp 0x4d704a
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
setge al
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004d6738
sub eax, 0x80
je 0x4d6f7e
sub eax, 0x40
je 0x4d6f87
sub eax, 0x40
je 0x4d6f90
jmp 0x4d6f99
mov dword [ebp - 0x1c], 0xa
jmp 0x4d6fa5
mov dword [ebp - 0x1c], 0xc
jmp 0x4d6fa5
mov dword [ebp - 0x1c], 0xe
jmp 0x4d6fa5
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x4d704a
mov cl, byte [ebp - 0x18]
lea edx, [ebp - 0x200]
mov eax, dword [ebp - 4]
call fcn.004d67b4
mov eax, dword [ebp - 0x1c]
dec eax
test eax, eax
jle 0x4d7010
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 1
mov cl, byte [ebp - 0x18]
mov edx, str.cw
mov eax, dword [ebp - 4]
call fcn.004d68c8
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.004d6810
mov dl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004d692c
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x14]
shl eax, 2
lea edx, [ebp + eax*8 - 0x200]
mov eax, dword [ebp - 4]
call fcn.004d67b4
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x4d6fc8
mov cl, byte [ebp - 0x18]
mov edx, str.cw
mov eax, dword [ebp - 4]
call fcn.004d68c8
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.004d6810
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea edx, [ebp + eax*8 - 0x200]
mov eax, dword [ebp - 4]
call fcn.004d67b4
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4d7058
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe04
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x1fc]
push ecx
mov ecx, 0x78
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, 0x80
je 0x4d7094
sub eax, 0x40
je 0x4d709d
sub eax, 0x40
je 0x4d70a6
jmp 0x4d70af
mov dword [ebp - 0x18], 4
jmp 0x4d70bb
mov dword [ebp - 0x18], 6
jmp 0x4d70bb
mov dword [ebp - 0x18], 8
jmp 0x4d70bb
mov dword [ebp - 0x10], 0xfffffffe
jmp 0x4d71a9
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
setge al
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004d6738
sub eax, 0x80
je 0x4d70e2
sub eax, 0x40
je 0x4d70eb
sub eax, 0x40
je 0x4d70f4
jmp 0x4d70fd
mov dword [ebp - 0x1c], 0xa
jmp 0x4d7109
mov dword [ebp - 0x1c], 0xc
jmp 0x4d7109
mov dword [ebp - 0x1c], 0xe
jmp 0x4d7109
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x4d71a9
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea edx, [ebp + eax*8 - 0x1fc]
mov eax, dword [ebp - 4]
call fcn.004d67b4
mov cl, byte [ebp - 0x18]
mov edx, 0x4f0f60
mov eax, dword [ebp - 4]
call fcn.004d68c8
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
mov dl, 1
call fcn.004d6810
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, 1
jl 0x4d7193
mov dword [ebp - 0x14], eax
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x14]
shl eax, 2
lea edx, [ebp + eax*8 - 0x1fc]
mov eax, dword [ebp - 4]
call fcn.004d67b4
mov dl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004d6a44
mov cl, byte [ebp - 0x18]
mov edx, 0x4f0f60
mov eax, dword [ebp - 4]
call fcn.004d68c8
mov cl, byte [ebp - 0x18]
mov eax, dword [ebp - 4]
mov dl, 1
call fcn.004d6810
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jne 0x4d714a
mov cl, byte [ebp - 0x18]
lea edx, [ebp - 0x1fc]
mov eax, dword [ebp - 4]
call fcn.004d67b4
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4d74c0
Capabilities:
List groups for user account

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.0040628c
xor eax, eax
push ebp
push 0x4d7532
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.004060fc
push eax
push 0
call sub.netapi32.dll_NetUserGetLocalGroups
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
je 0x4d751c
mov eax, dword [ebp - 0xc]
push eax
call sub.netapi32.dll_NetApiBufferFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7539
lea eax, [ebp - 4]
call fcn.00405f9c
ret
Function at 0x4da88c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
xor edx, edx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4da915
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x80
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x88]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4da8ef
lea eax, [ebp - 0x8c]
lea edx, [ebp - 0x88]
mov ecx, 0x80
call fcn.004059d8
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 4]
call fcn.00409e64
jmp 0x4da8fc
mov eax, dword [ebp - 4]
mov edx, 0x4da928
call fcn.004057ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da91c
lea eax, [ebp - 0x8c]
call fcn.00405758
ret

Function at 0x4da930
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4da9d4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0040318c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 8]
call fcn.0040ad0c
cmp dword [ebp - 8], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x4da9b1
lea eax, [ebp - 0x14]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405c8c
mov eax, dword [ebp - 0x14]
mov edx, 0x4da9ec
call fcn.00405b78
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
jne 0x4da9b1
mov eax, dword [ebp - 8]
call fcn.00405c2c
push eax
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da9db
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040577c
lea eax, [ebp - 8]
call fcn.00405758
ret

Function at 0x4daa3c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, 0x104
call fcn.0040b234
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4daab2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 0x104
call fcn.004039f4
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4daa94
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00405960
jmp 0x4daa9c
mov eax, dword [ebp - 8]
call fcn.00405758
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4daab9
mov eax, dword [ebp - 0xc]
call fcn.0040b280
ret
Function at 0x4dab8c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405c1c
xor eax, eax
push ebp
push 0x4dac45
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x4dac58
call fcn.004057ac
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405c2c
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4dac22
lea ecx, [ebp - 0x18]
movzx eax, word [ebp - 0x14]
mov edx, 4
call fcn.0040a3fc
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00408720
movzx eax, ax
lea ecx, [ebp - 0x1c]
mov edx, 4
call fcn.0040a3fc
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
pop ecx
call fcn.00405a78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dac4c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040577c
lea eax, [ebp - 4]
call fcn.00405758
ret

Function at 0x4db370
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], 7
push 0
lea eax, [ebp - 8]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret

Function at 0x4db398
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
call fcn.004db370
test al, al
je 0x4db3db
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00405c2c
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 5]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret