joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f6782
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
and dword [esp + 4], 0
or dword [esp], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4f6908
cmp dword [ebp + 0xc], 0
je 0x4f6908
mov eax, dword [ebp + 0x14]
lea ebx, [esi + 0x1c]
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x18]
push ebx
mov dword [esi + 0x28], eax
lea eax, [esp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4f6902
cmp byte [esi + 0x4c], al
jne 0x4f6937
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4f68fe
push dword [esi + 0x30]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4f685c
push eax
lea eax, [esp + 0xc]
push eax
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x4f681a
mov eax, dword [esp + 8]
jmp 0x4f693a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x4f68fe
push dword [ebp + 0x10]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push str.GetOverlappedResult_off_lld_size_u_error:
push str.os_local_file_pread
push 0x262
push str.E:work_netbar_smcli_srcliblibpaloswindows_os_file2.h
push 0x5a9534
push pe_nt_image_headers32
push 0
call fcn.004e8a0a
add esp, 0x28
jmp 0x4f68cb
cmp eax, 0x102
jne 0x4f688b
push 0x45d
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.WaitForSingleObject_retWAIT_TIMEOUT_n
push str.os_local_file_pread
push 0x268
push str.E:work_netbar_smcli_srcliblibpaloswindows_os_file2.h
push 0x5a9534
push 8
jmp 0x4f68c1
cmp eax, 0x80
jne 0x4f68a3
push str.WaitForSingleObject_retWAIT_ABANDONED_n
push str.os_local_file_pread
push 0x26c
jmp 0x4f687d
push str.WaitForSingleObject_error:
push str.os_local_file_pread
push 0x270
push str.E:work_netbar_smcli_srcliblibpaloswindows_os_file2.h
push 0x5a9534
push pe_nt_image_headers32
push 0
call fcn.004e8a0a
add esp, 0x1c
push dword [ebp + 0x10]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push str.ReadFile_offset_lld_size_d_error:
push str.os_local_file_pread
push 0x277
push str.E:work_netbar_smcli_srcliblibpaloswindows_os_file2.h
push 0x5a9534
push pe_nt_image_headers32
push 0
call fcn.004e8a0a
add esp, 0x28
jmp 0x4f6937
xor eax, eax
jmp 0x4f693a
mov eax, dword [esp + 0xc]
jmp 0x4f693a
push str.file__data
push str.expr__s_:_assert_failed_n
push str.os_local_file_pread
push 0x253
push str.E:work_netbar_smcli_srcliblibpaloswindows_os_file2.h
push 0x5a9534
push 3
push 0
call fcn.004e8a0a
add esp, 0x20
call fcn.004ee4bf
or eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f6940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
and dword [esp], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x4f6a80
cmp dword [ebp + 0xc], 0
je 0x4f6a80
mov eax, dword [ebp + 0x18]
lea edi, [esi + 0x1c]
mov ebx, dword [ebp + 0x14]
push edi
mov dword [esi + 0x28], eax
lea eax, [esp + 0x10]
push eax
push dword [ebp + 0x10]
mov dword [esi + 0x24], ebx
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4f69c6
cmp byte [esi + 0x4c], al
jne 0x4f6aaf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4f6a4f
push dword [esi + 0x34]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4f69e0
push eax
lea eax, [esp + 0x10]
push eax
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x4f69cf
mov eax, dword [esp + 0xc]
jmp 0x4f6ab2
push str.GetOverlappedResult_error:
push str.os_local_file_pwrit
push 0x28f
jmp 0x4f6a36
cmp eax, 0x102
jne 0x4f6a0f
push 0x45d
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.WaitForSingleObject_retWAIT_TIMEOUT_n
push str.os_local_file_pwrit
push 0x295
push str.E:work_netbar_smcli_srcliblibpaloswindows_os_file2.h
push 0x5a9534
push 8
jmp 0x4f6a45
cmp eax, 0x80
jne 0x4f6a27
push str.WaitForSingleObject_retWAIT_ABANDONED_n
push str.os_local_file_pwrit
push 0x299
jmp 0x4f6a01
push str.WaitForSingleObject_error:
push str.os_local_file_pwrit
push 0x29d
push str.E:work_netbar_smcli_srcliblibpaloswindows_os_file2.h
push 0x5a9534
push pe_nt_image_headers32
push 0
call fcn.004e8a0a
add esp, 0x1c
push dword [ebp + 0x10]
push dword [ebp + 0x18]
push ebx
push str.WriteFile_offset_lld_size_d_error:
push str.os_local_file_pwrit
push 0x2a0
push str.E:work_netbar_smcli_srcliblibpaloswindows_os_file2.h
push 0x5a9534
push pe_nt_image_headers32
push 0
call fcn.004e8a0a
add esp, 0x28
jmp 0x4f6aaf
push str.file__data
push str.expr__s_:_assert_failed_n
push str.os_local_file_pwrit
push 0x283
push str.E:work_netbar_smcli_srcliblibpaloswindows_os_file2.h
push 0x5a9534
push 3
push 0
call fcn.004e8a0a
add esp, 0x20
call fcn.004ee4bf
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f8237
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, edx
mov esi, ecx
push 0x208
lea edx, [ebp - 0x210]
call fcn.004ed834
pop ecx
mov ecx, 0x104
lea eax, [ebp - 0x418]
push ecx
push eax
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x638]
push eax
push ecx
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x4f82df
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
je 0x4f82d7
cmp eax, 3
je 0x4f82d7
cmp eax, 1
je 0x4f82d7
push esi
push str.GetVolumeInformationW___s__error:
push str.get_vol_info
push 0x1f
push str.srcliblibpaloswindowsos_vol.c
push 0x5a9534
push 0x107
push 0
call fcn.004e8a0a
add esp, 0x20
or eax, 0xffffffff
jmp 0x4f83a8
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0x4f832a
push esi
push str.GetDiskFreeSpaceW___s__error:
push str.get_vol_info
push 0x26
push str.srcliblibpaloswindowsos_vol.c
push 0x5a9534
push pe_nt_image_headers32
jmp 0x4f82cd
test edi, edi
je 0x4f83a6
lea ecx, [ebp - 0x418]
call fcn.004edbf6
push ecx
push eax
push 0x20
lea ecx, [edi + 0x180]
pop edx
call fcn.004ea31a
lea ecx, [ebp - 0x620]
call fcn.004edbf6
add esp, 4
lea ecx, [edi + 0x80]
mov edx, 0x100
push eax
call fcn.004ea31a
pop ecx
push esi
mov edx, 0x80
mov ecx, edi
call fcn.004ea31a
mov eax, dword [ebp - 0x628]
mul dword [ebp - 0x62c]
pop ecx
pop ecx
mov ecx, eax
mov eax, edx
mul dword [ebp - 0x624]
mov esi, eax
mov eax, ecx
mul dword [ebp - 0x624]
add esi, edx
mov dword [edi + 0x1a8], eax
mov dword [edi + 0x1ac], esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0051b034
leave
ret
Function at 0x4f867c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
lea edx, [ebp - 0x110]
push ecx
call fcn.004f83b6
pop ecx
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x4f86d1
or eax, 0xffffffff
jmp 0x4f8732
mov eax, dword [ebp - 0x114]
xor ecx, ecx
mul dword [ebp - 0x118]
mov dword [esi + 8], ecx
mov dword [esi], eax
mov eax, dword [ebp - 0x11c]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x120]
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
xor eax, eax
mov dword [esi + 4], edx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], 0xff
mov dword [esi + 0x54], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0051b034
leave
ret
Function at 0x4f9b6f
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov esi, 0x584db0
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
jne 0x4f9bc2
mov ecx, esi
call fcn.0050313e
mov edi, eax
test edi, edi
jne 0x4f9bc2
push str.module
push str.expr__s_:_assert_failed_n
push str.pl_kernel32_instance_init
push 0xa
push str.srcliblibpaloswindowsinterkernel32.c
push 0x5a9534
push 3
push eax
call fcn.004e8a0a
add esp, 0x20
call fcn.004ee4bf
xor al, al
jmp 0x4f9d5d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlCaptureStackBackTrace
push edi
call esi
push 0x5aeab0
push edi
mov dword [0x8963e0], eax
call esi
push str.GetQueuedCompletionStatusEx
push edi
mov dword [0x8963e4], eax
call esi
push str.InterlockedCompareExchange64
push edi
mov dword [0x8963e8], eax
call esi
push 0x589ae4
push edi
mov dword [0x8963ec], eax
call esi
push 0x5aeae0
push edi
mov dword [0x8963f0], eax
call esi
push str.SetDllDirectoryW
push edi
mov dword [0x8963f4], eax
call esi
push 0x5aeb0c
push edi
mov dword [0x8963f8], eax
call esi
push 0x5aeb1c
push edi
mov dword [0x8963fc], eax
call esi
push 0x5aeb30
push edi
mov dword [0x896400], eax
call esi
push 0x5aeb48
push edi
mov dword [0x896404], eax
call esi
push 0x5aeb5c
push edi
mov dword [0x896408], eax
call esi
push str.SuspendThread
push edi
mov dword [0x89640c], eax
call esi
push 0x5aeb80
push edi
mov dword [0x896410], eax
call esi
push 0x5aeb90
push edi
mov dword [0x896414], eax
call esi
push 0x5aeba8
push edi
mov dword [0x896418], eax
call esi
push 0x5aebc0
push edi
mov dword [0x89641c], eax
call esi
push 0x5aebd8
push edi
mov dword [0x896420], eax
call esi
push 0x5aebfc
push edi
mov dword [0x896424], eax
call esi
push 0x589a8c
push edi
mov dword [0x896428], eax
call esi
mov dword [0x89642c], eax
push str.TerminateJobObject
push edi
call esi
push 0x589b10
push edi
mov dword [0x896430], eax
call esi
push 0x589aa0
push edi
mov dword [0x896434], eax
call esi
push str.GetActiveProcessorCount
push edi
mov dword [0x896438], eax
call esi
push str.GetLogicalProcessorInformationEx
push edi
mov dword [0x89643c], eax
call esi
push 0x5aec60
push edi
mov dword [0x896440], eax
call esi
push str.SetFileValidData
push edi
mov dword [0x896444], eax
call esi
push 0x5aec84
push edi
mov dword [0x896448], eax
call esi
push 0x5aec98
push edi
mov dword [0x89644c], eax
call esi
push 0x5aecb4
push edi
mov dword [0x896450], eax
call esi
push str.Wow64DisableWow64FsRedirection
push edi
mov dword [0x896454], eax
call esi
mov dword [0x896458], eax
mov al, 1
pop edi
pop esi
ret
Function at 0x4fa9e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x896460]
lea edi, [esp + 0x10]
mov dword [esp + 0xc], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ecx, ecx
jne 0x4faa2a
call fcn.004fa92f
mov ecx, dword [0x896460]
cmp ecx, 1
jne 0x4faa34
or eax, 0xffffffff
jmp 0x4faaad
lea ecx, [esp + 0x10]
call fcn.004f4232
xor edx, edx
lea esi, [esp + 0x10]
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
movzx eax, word [ecx*2 + 0x57df90]
xor edx, eax
inc esi
lea eax, [esp + 0x20]
cmp esi, eax
jb 0x4faa43
movzx eax, dx
push eax
push ebx
push str._s__04x
lea eax, [esp + 0x2c]
push 0x40
push eax
call fcn.004ea423
add esp, 0x14
push dword [0x89645c]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x896464]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x10]
lea edx, [ecx + 0x14]
call fcn.00503946
pop ecx
pop ecx
push dword [0x89645c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051b034
mov esp, ebp
pop ebp
ret
Function at 0x4fbb0f
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push 0xf003f
xor edi, edi
or ebp, 0xffffffff
push edi
push edi
mov esi, ecx
mov dword [esp + 0x20], ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x4fbcb2
mov ecx, esi
push 0xf01ff
cmp dword [0x5c9c58], edi
jne 0x4fbb55
call fcn.004edcb1
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
jmp 0x4fbb62
call fcn.004edc5a
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x4fbc7e
push 0x89677c
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 6
pop ebp
mov dword [esp + 0x10], ebp
test eax, eax
je 0x4fbc1c
push esi
push str.Stopping__s._n
push str.os_remove_service
push 0x1a7
push str.srcliblibpaloswindowsos_service.c
push 0x5a9534
push ebp
push 0
call fcn.004e8a0a
add esp, 0x20
jmp 0x4fbbb5
cmp eax, 3
jne 0x4fbbd5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x89677c
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
mov eax, dword [0x896780]
jne 0x4fbbb0
push esi
cmp eax, 1
jne 0x4fbbf7
push str._s_stopped._n
push str.os_remove_service
push 0x1b2
push str.srcliblibpaloswindowsos_service.c
push 0x5a9534
push ebp
jmp 0x4fbc12
push str._s_failed_to_stop._n
push str.os_remove_service
push 0x1b4
push str.srcliblibpaloswindowsos_service.c
push 0x5a9534
push 3
push 0
call fcn.004e8a0a
add esp, 0x20
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x4fbc38
and dword [esp + 0x14], 0
mov ebp, 0x1bb
mov eax, str._s_service_removed._n
jmp 0x4fbc51
mov dword [esp + 0x10], 3
mov ebp, 0x1bf
call fcn.004fb67d
mov esi, eax
mov eax, str.DeleteService_failed____s_n
push esi
push eax
push str.os_remove_service
push ebp
push str.srcliblibpaloswindowsos_service.c
push 0x5a9534
push dword [esp + 0x28]
push 0
call fcn.004e8a0a
add esp, 0x20
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebp, dword [esp + 0x14]
jmp 0x4fbca9
call fcn.004fb67d
push eax
push str.OpenService_failed____s_n
push str.os_remove_service
push 0x1c3
push str.srcliblibpaloswindowsos_service.c
push 0x5a9534
push 7
push 0
call fcn.004e8a0a
add esp, 0x20
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4fbcdc
call fcn.004fb67d
push eax
push str.OpenSCManager_failed____s_n
push str.os_remove_service
push 0x1c7
push str.srcliblibpaloswindowsos_service.c
push 0x5a9534
push 7
push edi
call fcn.004e8a0a
add esp, 0x20
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x4fc598
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0xc], 0x4c2c033
push esi
push str.kernel32.dll
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov byte [ebp - 8], al
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4fc645
push 0x5afa28
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4fc645
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 5
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
test ebx, ebx
jne 0x4fc631
push str.WriteProcessMemory_error:
push str.PreventSetUnhandledExceptionFilter
push 0x1a1
push str.srcliblibpaloswindowsos_panic.c
push 0x5a9534
push 0x107
push eax
call fcn.004e8a0a
add esp, 0x1c
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, ebx
jmp 0x4fc647
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0051b034
leave
ret

Function at 0x4fc655
Capabilities:
Check for sandbox and av modules

Disassembly:
push esi
push edi
mov esi, str.dbghelp.dll
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edi, edi
mov dword [0x8bf7f8], eax
mov ecx, eax
test eax, eax
jne 0x4fc681
push 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [0x8bf7f8], eax
mov ecx, eax
test ecx, ecx
jne 0x4fc6b1
push str.LoadLibrary_dbghelp.dll_error_n
push str.dbghelp_init
push 0x1b0
push str.srcliblibpaloswindowsos_panic.c
push 0x5a9534
push 8
push edi
call fcn.004e8a0a
add esp, 0x1c
or eax, 0xffffffff
jmp 0x4fc751
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SymInitialize
push eax
call esi
mov dword [0x8bf800], eax
test eax, eax
jne 0x4fc6e5
push str.GetProcAddress_SymInitialize_failed_n
push str.dbghelp_init
push 0x1b7
push str.srcliblibpaloswindowsos_panic.c
push 0x5a9534
push 7
jmp 0x4fc6a0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x8bf800]
test eax, eax
jne 0x4fc719
push str.SymInitialize_error:
push str.dbghelp_init
push 0x1bd
push str.srcliblibpaloswindowsos_panic.c
push 0x5a9534
push 0x107
jmp 0x4fc6a0
push str.SymFromAddrW
push dword [0x8bf7f8]
call esi
push str.MiniDumpWriteDump
push dword [0x8bf7f8]
mov dword [0x896798], eax
call esi
push str.SymGetLineFromAddrW64
push dword [0x8bf7f8]
mov dword [0x8bd7b0], eax
call esi
mov dword [0x8987a0], eax
xor eax, eax
pop edi
pop esi
ret
Function at 0x4fc82b
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x200c], 0x1000
push eax
lea eax, [ebp - 0x2008]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov ebx, str.none
push 0x80
test eax, eax
je 0x4fc882
mov edx, esi
lea ecx, [ebp - 0x2008]
call fcn.004ed73d
pop ecx
jmp 0x4fc896
push esi
push ebx
mov edx, str.ComputerName
mov ecx, str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlComputerNameComputerName
call fcn.004ec8d3
add esp, 0xc
cmp byte [esi], 0
je 0x4fc8ac
push str._none_
push esi
call fcn.005205d0
pop ecx
pop ecx
test eax, eax
jne 0x4fc8bc
push ecx
push ebx
mov edx, 0x80
mov ecx, esi
call fcn.004ea31a
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051b034
leave
ret
Function at 0x4fc8cc
Capabilities:
Get common file path
Get system information on windows

Disassembly:
mov eax, 0x2014
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x200c], eax
push ebx
push ebp
push esi
push edi
mov esi, 0x1000
lea eax, [esp + 0x18]
push esi
xor edi, edi
push edi
push eax
call fcn.0051c010
add esp, 0xc
lea edx, [esp + 0x18]
xor ecx, ecx
inc ecx
push esi
call fcn.004ec764
lea eax, [esp + 0x1c]
mov dword [esp], str.unkown_os_errno
push eax
call fcn.0051c3e0
pop ecx
pop ecx
test eax, eax
je 0x4fc928
mov dword [0x603e34], edi
push edi
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, str.os_env_windows_init
mov ebx, str.srcliblibpaloswindowsos_windows.c
mov ebp, 0x5a9534
test eax, eax
jns 0x4fc960
cmp eax, 0x80010106
je 0x4fc960
push eax
push str.CoInitializeEx_Ret0x_x_n
push esi
push 0x1a
push ebx
push ebp
push 3
push edi
call fcn.004e8a0a
add esp, 0x20
push 0x8c0080
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea edx, [esp + 0x14]
mov ecx, 0x8bffe0
call fcn.004ef1a6
call fcn.004ef35a
call dword [sym.imp.KERNEL32.dll_GetACP]
mov ecx, str.SeBackupPrivilege
mov dword [0x8c00a4], 1
call fcn.004edbf6
mov ecx, eax
call fcn.004eb8f9
test al, al
jne 0x4fc9c1
push str.Set_SE_BACKUP_NAME_error:
push esi
push 0x23
push ebx
push ebp
push 0x107
push edi
call fcn.004e8a0a
add esp, 0x1c
mov dword [0x8c00a4], edi
mov ecx, str.SeRestorePrivilege
call fcn.004edbf6
mov ecx, eax
call fcn.004eb8f9
test al, al
jne 0x4fc9f4
push str.Set_SE_RESTORE_NAME_error:
push esi
push 0x27
push ebx
push ebp
push 0x107
push edi
call fcn.004e8a0a
add esp, 0x1c
mov dword [0x8c00a4], edi
mov ecx, str.SeSecurityPrivilege
call fcn.004edbf6
mov ecx, eax
call fcn.004eb8f9
test al, al
jne 0x4fca21
push str.Set_SE_SECURITY_NAME_error:
push esi
push 0x2d
push ebx
push ebp
push 0x107
push edi
call fcn.004e8a0a
add esp, 0x1c
call fcn.004eb717
call fcn.004ef2f9
xor ecx, ecx
test al, al
setne cl
mov dword [0x8c00ac], ecx
call fcn.004ef2f9
movsx eax, al
neg eax
sbb eax, eax
and eax, 2
mov dword [0x8c00a8], eax
lea eax, [esp + 0x18]
push eax
push edi
push edi
push 5
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4fca77
push ecx
lea ecx, [esp + 0x1c]
call fcn.004edbf6
mov edx, eax
mov ecx, str.HOMEDOC
call fcn.004f18d9
pop ecx
mov ecx, dword [esp + 0x201c]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x2014
ret
Function at 0x4fcafd
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea edx, [ebp - 0x4010]
mov ecx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
xor esi, esi
call fcn.004fca92
mov edi, eax
test edi, edi
jne 0x4fcb36
or eax, 0xffffffff
jmp 0x4fcc2c
lea eax, [ebp - 0x400c]
push eax
mov eax, dword [ebp - 0x4010]
push 0x102
push esi
lea ecx, [eax + str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
cmp dword [0x5c9c58], esi
jne 0x4fcb66
call fcn.004edcb1
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x4fcb73
call fcn.004edc5a
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4fcba7
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.RegOpenKeyEx_error:
push str.reg_del_val
push 0xa3
push str.srcliblibpaloswindowsos_reg_imp.c
push 0x5a9534
push pe_nt_image_headers32
push esi
call fcn.004e8a0a
add esp, 0x1c
jmp 0x4fcb2e
mov edi, 0x55ed10
lea edx, [ebp - 0x4008]
push 0x4000
mov ecx, edi
call fcn.004ed834
pop ecx
cmp dword [0x5c9c58], esi
jne 0x4fcbd6
push edi
push dword [ebp - 0x400c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x4fcbe9
lea eax, [ebp - 0x4008]
push eax
push dword [ebp - 0x400c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4fcc1e
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.RegDeleteValue_error:
push str.reg_del_val
push 0xb1
push str.srcliblibpaloswindowsos_reg_imp.c
push 0x5a9534
push pe_nt_image_headers32
push esi
call fcn.004e8a0a
add esp, 0x1c
or esi, 0xffffffff
push dword [ebp - 0x400c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0051b034
leave
ret
Function at 0x4fd661
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, edx
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
xor esi, esi
mov edx, dword [esp + 0x14]
mov ebp, ecx
mov ebx, dword [esp + 0x10]
test edi, edi
je 0x4fd6a5
movzx ecx, byte [esi + ebp]
movzx eax, bl
shrd ebx, edx, 8
xor ecx, eax
shr edx, 8
xor ebx, dword [ecx*8 + 0x57e190]
xor edx, dword [ecx*8 + 0x57e194]
inc esi
cmp esi, edi
jb 0x4fd682
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
pop ecx
ret

Function at 0x4fdbd1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8004
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, edx
cmp word [esi + 2], 0x3a
jne 0x4fdc04
mov edx, esi
lea ecx, [ebp - 0x4004]
call fcn.004fd8d2
jmp 0x4fdc29
lea eax, [ebp - 0x8004]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
lea edx, [ebp - 0x8004]
lea ecx, [ebp - 0x4004]
call fcn.004fdaa4
pop ecx
lea eax, [ebp - 0x4004]
push eax
push 0x1000
push edi
call fcn.00537885
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor eax, eax
pop edi
pop esi
call fcn.0051b034
leave
ret