joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2dfc
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov eax, esp
mov edx, 0x94
call fcn.00407b74
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 6
jne 0x4a2e30
cmp dword [esp + 8], 0
jne 0x4a2e30
cmp dword [esp + 0x10], 2
je 0x4a2e34
xor eax, eax
jmp 0x4a2e36
mov al, 1
add esp, 0x94
ret

Function at 0x4b0e4c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4b0e84]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4b0e62
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4b0e71
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4b0e80
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x4b21b8
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [0x442208]
call fcn.00403ce0
test al, al
je 0x4b21fa
mov eax, dword [0x530968]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4b21fa
mov edx, dword [0x530968]
xor edx, edx
call fcn.004606b4
push 0
mov eax, dword [0x530968]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x4b3b60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.00407be8
mov byte [esp + 0xa], al
mov eax, ebx
call fcn.00407bec
mov byte [esp + 9], al
mov eax, ebx
call fcn.00407bf0
mov byte [esp + 8], al
mov byte [esp + 0xb], 0
mov eax, esi
call fcn.00407be8
mov byte [esp + 0xe], al
mov eax, esi
call fcn.00407bec
mov byte [esp + 0xd], al
mov eax, esi
call fcn.00407bf0
mov byte [esp + 0xc], al
mov byte [esp + 0xf], 0
movzx edi, byte [esp + 0xe]
xor eax, eax
mov al, byte [esp + 0xa]
sub edi, eax
movzx ebp, byte [esp + 0xd]
xor eax, eax
mov al, byte [esp + 9]
sub ebp, eax
xor eax, eax
mov al, byte [esp + 0xc]
xor edx, edx
mov dl, byte [esp + 8]
sub eax, edx
mov dword [esp + 4], eax
xor ecx, ecx
mov ebx, dword [esp]
mov esi, ebx
mov eax, ecx
imul edi
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
add al, byte [esp + 0xa]
mov byte [esi + 2], al
mov eax, ecx
imul ebp
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
add al, byte [esp + 9]
mov byte [esi + 1], al
mov eax, ecx
imul dword [esp + 4]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
add al, byte [esp + 8]
mov byte [esi], al
inc ecx
add ebx, 4
cmp ecx, 0x100
jne 0x4b3beb
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b8804
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4b8832
mov eax, ebx
call fcn.004b92bc
cmp dword [ebx + 0x3c], 0
je 0x4b882b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4b88a3
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x4b8895
cmp dword [ebx + 8], 0
je 0x4b8854
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x4b8866
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4b8895
cmp dword [ebx + 8], 0
je 0x4b8847
cmp eax, 3
je 0x4b8879
dec eax
jne 0x4b8847
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4b8847
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x4b8847
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4b88c1
cmp dword [ebx + 0x10], 0xcc
je 0x4b88c1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004b88cc
pop ebx
ret

Function at 0x4cb07c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cb166
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00404df4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], ebx
test ebx, ebx
jbe 0x4cb150
xor eax, eax
push ebp
push 0x4cb13a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00402768
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00404df4
push eax
call sub.version.dll_GetFileVersionInfoA
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 4]
mov byte [eax + 8], bl
test bl, bl
je 0x4cb130
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cb1d4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add eax, 0x18
call fcn.00404998
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cb150
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb16d
lea eax, [ebp - 8]
call fcn.00404944
ret
Function at 0x4eb5b8
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x104], edx
mov esi, eax
mov eax, esi
call fcn.00404bfc
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x20
jle 0x4eb5f2
mov dword [ebp - 0x10c], 0x20
mov eax, dword [ebp - 0x10c]
test eax, eax
jle 0x4eb61d
mov dword [ebp - 0x110], eax
mov ebx, 1
lea eax, [ebp - 0x134]
mov dl, byte [esi + ebx - 1]
mov byte [eax], dl
inc ebx
inc eax
dec dword [ebp - 0x110]
jne 0x4eb60d
xor edi, edi
lea eax, [ebp - 0x100]
mov edx, edi
mov byte [eax], dl
inc edi
inc eax
cmp edi, 0x100
jne 0x4eb625
xor ebx, ebx
xor esi, esi
xor edi, edi
lea eax, [ebp - 0x100]
mov dword [ebp - 0x114], eax
xor eax, eax
mov al, byte [ebp + ebx - 0x134]
mov edx, dword [ebp - 0x114]
movzx edx, byte [edx]
add eax, edx
add esi, eax
and esi, 0xff
movzx eax, si
mov esi, eax
push ebp
mov edx, esi
mov eax, edi
call fcn.004eb584
pop ecx
lea eax, [ebx + 1]
cdq
idiv dword [ebp - 0x10c]
mov ebx, edx
inc edi
inc dword [ebp - 0x114]
cmp edi, 0x100
jne 0x4eb645
mov eax, dword [ebp - 0x104]
call fcn.00404bfc
mov edx, eax
mov eax, dword [ebp - 0x108]
call fcn.00404f80
xor edi, edi
xor esi, esi
mov eax, dword [ebp - 0x104]
call fcn.00404bfc
test eax, eax
jle 0x4eb73b
mov dword [ebp - 0x110], eax
mov ebx, 1
inc edi
and edi, 0xff
movzx eax, di
mov edi, eax
xor eax, eax
mov al, byte [ebp + edi - 0x100]
add esi, eax
and esi, 0xff
movzx eax, si
mov esi, eax
push ebp
mov edx, esi
mov eax, edi
call fcn.004eb584
pop ecx
mov eax, dword [ebp - 0x108]
call fcn.00404e4c
xor edx, edx
mov dl, byte [ebp + edi - 0x100]
xor ecx, ecx
mov cl, byte [ebp + esi - 0x100]
add edx, ecx
and edx, 0xff
movzx edx, dx
mov dl, byte [ebp + edx - 0x100]
mov ecx, dword [ebp - 0x104]
mov cl, byte [ecx + ebx - 1]
xor dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
dec dword [ebp - 0x110]
jne 0x4eb6c6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ec254
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov dword [esp], 0x94
xor ebx, ebx
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4ec2e6
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
dec ecx
je 0x4ec2bf
dec ecx
jne 0x4ec2e6
cmp eax, 4
jg 0x4ec289
mov bl, 4
jmp 0x4ec2e6
cmp eax, 5
jne 0x4ec296
test edx, edx
jne 0x4ec296
mov bl, 5
jmp 0x4ec2e6
cmp eax, 5
jne 0x4ec2a4
cmp edx, 1
jne 0x4ec2a4
mov bl, 6
jmp 0x4ec2e6
cmp eax, 5
jne 0x4ec2b2
cmp edx, 2
jne 0x4ec2b2
mov bl, 7
jmp 0x4ec2e6
cmp eax, 6
jne 0x4ec2e6
test edx, edx
jne 0x4ec2e6
mov bl, 8
jmp 0x4ec2e6
cmp eax, 4
jne 0x4ec2cc
test edx, edx
jne 0x4ec2cc
mov bl, 1
jmp 0x4ec2e6
cmp eax, 4
jne 0x4ec2da
cmp edx, 0xa
jne 0x4ec2da
mov bl, 2
jmp 0x4ec2e6
cmp eax, 4
jne 0x4ec2e6
cmp edx, 0x5a
jne 0x4ec2e6
mov bl, 3
mov eax, ebx
add esp, 0x94
pop ebx
ret
Function at 0x4ec328
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4ec374
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x4ec374
lea eax, [ebp - 8]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
mov dword [ebp - 0xc], eax
test bl, bl
je 0x4ec447
xor eax, eax
push ebp
push 0x4ec440
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x400
call fcn.00402768
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x400
mov eax, dword [ebp - 0xc]
push eax
push 2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x4ec424
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x5303e4]
push eax
mov eax, dword [0x5303e0]
push eax
push 2
push 0x5303d8
call sub.advapi32.dll_AllocateAndInitializeSid
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
dec ebx
test ebx, ebx
jl 0x4ec41b
inc ebx
xor esi, esi
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + esi*8 + 4]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4ec417
mov byte [ebp - 1], 1
jmp 0x4ec41b
inc esi
dec ebx
jne 0x4ec3fc
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_FreeSid
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec447
cmp dword [ebp - 0xc], 0
je 0x4ec43f
mov eax, dword [ebp - 0xc]
call fcn.00402788
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ec498
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4ec4a0
push ebx
xor eax, eax
push ebp
push 0x4ec6e3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4ec6f0
call sub.kernel32.dll_GetModuleHandleA_2
mov dword [0x531f34], eax
call fcn.004ec254
mov byte [0x531f08], al
lea eax, [ebp - 8]
call fcn.004ec2f0
mov edx, dword [ebp - 8]
mov eax, 0x531f30
call fcn.00404998
push 0x4ec700
call sub.kernel32.dll_LoadLibraryA
mov dword [0x5303bc], eax
push 0x4ec708
mov eax, dword [0x5303bc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5303c0], eax
push 2
call sub.user32.dll_GetSystemMetrics
mov dword [0x531f24], eax
push 0x15
call sub.user32.dll_GetSystemMetrics
mov dword [0x531f20], eax
mov eax, 0x531e50
mov edx, 0x104
call fcn.00404f80
push 0x104
mov eax, dword [0x531e50]
call fcn.00404df4
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, dword [0x531e50]
call fcn.00404df4
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00404b34
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004ec1a4
mov edx, dword [ebp - 0xc]
mov eax, 0x531e50
call fcn.00404998
mov eax, 0x531e54
mov edx, 0x104
call fcn.00404f80
push 0x104
mov eax, dword [0x531e54]
call fcn.00404df4
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, dword [0x531e54]
call fcn.00404df4
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.00404b34
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004ec1a4
mov edx, dword [ebp - 0x14]
mov eax, 0x531e54
call fcn.00404998
call fcn.0040b318
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x1c]
mov eax, 0x4ec724
call fcn.0040bf70
mov ecx, dword [ebp - 0x1c]
mov eax, 0x531f0c
mov edx, 0x4ec738
call fcn.00404c48
lea edx, [ebp - 4]
xor eax, eax
call fcn.00402af8
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4caf1c]
call fcn.004caffc
mov ebx, eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.004cb338
mov edx, dword [ebp - 0x20]
mov eax, 0x531e58
call fcn.00404998
mov eax, ebx
call fcn.00403b54
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004098f4
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.0040dd54
mov edx, dword [ebp - 0x24]
mov eax, 0x531e4c
call fcn.00404998
call fcn.004ec1b8
mov byte [0x531e5c], al
call fcn.004ec450
mov byte [0x531e5d], al
lea edx, [ebp - 0x2c]
mov eax, 0x1c
call fcn.004ec07c
mov edx, dword [ebp - 0x2c]
mov eax, 0x531e48
call fcn.00404998
cmp dword [0x531e48], 0
je 0x4ec6ae
lea edx, [ebp - 0x30]
mov eax, dword [0x531e48]
call fcn.0040dd54
mov edx, dword [ebp - 0x30]
mov eax, 0x531e48
mov ecx, 0x4ec748
call fcn.00404c48
mov eax, dword [0x531e48]
call fcn.004029a0
call fcn.00402980
jmp 0x4ec6be
mov eax, 0x531e48
mov edx, dword [0x531e4c]
call fcn.00404998
call fcn.004ec474
call fcn.004ede1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ec6ea
lea eax, [ebp - 0x30]
mov edx, 0xc
call fcn.00404968
ret
Function at 0x4ecac8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, esp
call fcn.00409c4c
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404a34
push esp
push 0
push 0x4ecb20
mov eax, dword [ebx]
call fcn.00404df4
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, esp
call fcn.00409c4c
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404a34
add esp, 0x108
pop ebx
ret

Function at 0x4ece58
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4ed008
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, esi
call fcn.00404df4
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xea
je 0x4ecebc
cmp dword [ebp - 0x14], 0
jne 0x4ecfdd
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00404f80
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00404e4c
mov edx, 1
dec edx
test eax, eax
je 0x4ecee2
cmp edx, dword [eax - 4]
jb 0x4ecee7
call fcn.00403a94
inc edx
lea eax, [eax + edx - 1]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, esi
call fcn.00404df4
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
cmp dword [ebp - 8], 2
je 0x4ecf0d
cmp dword [ebp - 8], 1
jne 0x4ecf24
push edi
mov ecx, dword [ebp - 0xc]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00404e54
jmp 0x4ecfe7
cmp dword [ebp - 8], 3
jne 0x4ecf30
cmp dword [ebp - 0xc], 4
je 0x4ecf36
cmp dword [ebp - 8], 4
jne 0x4ecf84
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
call fcn.00404e4c
mov edx, 1
dec edx
test eax, eax
je 0x4ecf52
cmp edx, dword [eax - 4]
jb 0x4ecf57
call fcn.00403a94
inc edx
lea eax, [eax + edx - 1]
lea edx, [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
call fcn.004029cc
lea edx, [ebp - 0x114]
mov eax, dword [ebp - 0x14]
call fcn.004033c8
lea edx, [ebp - 0x114]
mov eax, edi
call fcn.00404ba0
jmp 0x4ecfe7
cmp dword [ebp - 8], 3
jne 0x4ecfe7
mov eax, edi
mov edx, 0x4ed020
call fcn.00404998
mov ebx, dword [ebp - 0xc]
test ebx, ebx
jle 0x4ecfe7
mov esi, 1
mov eax, dword [ebp - 0x10]
dec esi
test eax, eax
je 0x4ecfaf
cmp esi, dword [eax - 4]
jb 0x4ecfb4
call fcn.00403a94
inc esi
movzx eax, byte [eax + esi - 1]
lea ecx, [ebp - 0x118]
mov edx, 2
call fcn.004092a8
mov edx, dword [ebp - 0x118]
mov eax, edi
call fcn.00404c04
inc esi
dec ebx
jne 0x4ecfa2
jmp 0x4ecfe7
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404998
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed00f
lea eax, [ebp - 0x118]
call fcn.00404944
lea eax, [ebp - 0x10]
call fcn.00404944
ret
Function at 0x4ed3c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404de4
xor eax, eax
push ebp
push 0x4ed453
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x4ed3eb
mov ebx, 1
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403168
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
cmp ebx, 0xffff
jbe 0x4ed415
call fcn.00403a94
mov word [ebp - 0x18], bx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404df4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed45a
lea eax, [ebp - 4]
call fcn.00404944
ret
Function at 0x4edb48
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404de4
xor eax, eax
push ebp
push 0x4edd6b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.00404944
push 0x40
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41582c]
call fcn.0041a754
mov ebx, eax
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 8]
cmp dword [ebp - 0x14], 0x4034b50
jne 0x4edc36
lea eax, [ebp - 0x10]
call fcn.004ecac8
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.004ed9b0
mov eax, ebx
call fcn.00403b54
mov eax, dword [ebp - 4]
call fcn.004097c8
lea eax, [ebp - 4]
mov ecx, 0x4edd84
mov edx, dword [ebp - 0x10]
call fcn.00404c48
lea eax, [ebp - 0x10]
call fcn.004ecac8
lea eax, [ebp - 0xc]
mov ecx, 0x4edd90
mov edx, dword [ebp - 4]
call fcn.00404c48
mov eax, dword [ebp - 0xc]
call fcn.00404df4
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
jns 0x4edc16
call fcn.00403a94
mov ecx, dword [ebp - 0x10]
mov edx, 0x3de
mov eax, ebx
call fcn.004ed958
test ebx, ebx
jns 0x4edc2e
call fcn.00403a94
push ebx
call sub.kernel32.dll_FreeLibrary_1
jmp 0x4edc7c
mov eax, ebx
call fcn.00403b54
lea eax, [ebp - 0x10]
call fcn.004ecac8
mov eax, dword [ebp - 4]
call fcn.00404df4
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
jns 0x4edc5e
call fcn.00403a94
mov ecx, dword [ebp - 0x10]
mov edx, 0x3de
mov eax, ebx
call fcn.004ed958
test ebx, ebx
jns 0x4edc76
call fcn.00403a94
push ebx
call sub.kernel32.dll_FreeLibrary_1
lea edx, [ebp - 0x6c]
mov eax, dword [ebp - 0x10]
call fcn.00409a58
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 0xc]
mov ecx, 0x4edda4
call fcn.00404c48
push 0x4eddbc
push dword [ebp - 0xc]
push 0x4eddd4
push dword [ebp - 4]
push 0x4edde0
lea edx, [ebp - 0x70]
xor eax, eax
call fcn.00402af8
push dword [ebp - 0x70]
push 0x4eddec
mov eax, dword [0x530968]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x74]
call fcn.00409274
push dword [ebp - 0x74]
lea eax, [ebp - 8]
mov edx, 8
call fcn.00404cbc
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.00403168
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], 1
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404df4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4edd33
xor ebx, ebx
jmp 0x4edd43
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
test ebx, ebx
jns 0x4edd43
call fcn.00403a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4edd72
lea eax, [ebp - 0x74]
mov edx, 3
call fcn.00404968
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404968
ret
Function at 0x4efb34
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4efd1a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00402b98
mov ebx, eax
cmp bl, 0x41
jb 0x4efc35
cmp bl, 0x5a
ja 0x4efc35
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404b24
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x4efd34
call fcn.00404c48
mov esi, ebx
and esi, 0xff
add esi, 0xffffffbf
cmp esi, 0x19
jbe 0x4efb97
call fcn.00403a94
add esi, 0x41
cmp dword [esi*4 + 0x531e3c], 0xffffffff
jne 0x4efbd6
mov eax, dword [ebp - 4]
call fcn.00404df4
push eax
call sub.kernel32.dll_GetDriveTypeA
test eax, eax
jns 0x4efbbb
call fcn.00403a94
xor edx, edx
mov dl, bl
add edx, 0xffffffbf
cmp edx, 0x19
jbe 0x4efbcc
call fcn.00403a94
add edx, 0x41
mov dword [esi*4 + 0x531e3c], eax
xor eax, eax
mov al, bl
add eax, 0xffffffbf
cmp eax, 0x19
jbe 0x4efbe7
call fcn.00403a94
add eax, 0x41
mov eax, dword [eax*4 + 0x531e3c]
cmp eax, 2
je 0x4efc28
xor edx, edx
mov dl, bl
add edx, 0xffffffbf
cmp edx, 0x19
jbe 0x4efc07
call fcn.00403a94
add edx, 0x41
cmp eax, 1
jle 0x4efc28
xor edx, edx
mov dl, bl
add edx, 0xffffffbf
cmp edx, 0x19
jbe 0x4efc20
call fcn.00403a94
add edx, 0x41
cmp eax, 5
jne 0x4efc2c
xor eax, eax
jmp 0x4efc2e
mov al, 1
mov ebx, eax
jmp 0x4efcff
cmp bl, 0x3a
jne 0x4efcd4
mov ecx, dword [0x531ebc]
mov eax, ecx
shr eax, 0x10
and ecx, 0xffff
xor eax, ecx
xor eax, dword [0x531ec0]
mov edx, 0x9c40
sub edx, dword [0x531ec4]
xor eax, edx
mov ecx, 0x3e8
cdq
idiv ecx
mov eax, edx
mov edx, dword [0x531eb8]
xor edx, 0x170e0
cmp edx, 0x17c17
jne 0x4efc98
mov edx, dword [0x531fa8]
cmp edx, dword [0x531ec0]
jl 0x4efc98
cmp eax, dword [0x531ec8]
je 0x4efc9c
xor ebx, ebx
jmp 0x4efc9e
mov bl, 1
test bl, bl
jne 0x4efca9
xor eax, eax
mov dword [0x531ebc], eax
mov eax, dword [0x531ec4]
sub eax, dword [0x531ec0]
cmp eax, 0x5d
jge 0x4efcff
test bl, bl
je 0x4efcca
mov eax, dword [0x531fa8]
cmp eax, dword [0x531ec4]
jle 0x4efcce
xor eax, eax
jmp 0x4efcd0
mov al, 1
mov ebx, eax
jmp 0x4efcff
cmp bl, 0x5c
jne 0x4efcfd
mov al, 0x3a
call fcn.004efb34
mov ebx, eax
test bl, bl
je 0x4efcf3
mov eax, dword [0x531fa8]
cmp eax, dword [0x531ec4]
jle 0x4efcf7
xor eax, eax
jmp 0x4efcf9
mov al, 1
mov ebx, eax
jmp 0x4efcff
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4efd21
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404968
ret