joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bbf38
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x417098]
call fcn.004051a8
xor eax, eax
push ebp
push 0x4bc07c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4fc414], 0
jne 0x4bbf8b
mov ecx, dword [0x4fc658]
mov dl, 1
mov eax, dword [0x407e4c]
call fcn.0040cebc
call fcn.00404180
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004031ec
mov eax, ebx
call fcn.00405058
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4bc08c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004062fc
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405068
test eax, eax
jle 0x4bc023
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4bc01c
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404a70
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404a58
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408cf8
test eax, eax
jne 0x4bc01c
mov ebx, 0x15
jmp 0x4bc028
mov ebx, 0x10
jmp 0x4bc028
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4fc414]
call fcn.004bbe34
mov eax, dword [ebp - 8]
call fcn.004bbe34
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406314
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc083
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040480c
lea eax, [ebp - 0x10]
mov edx, dword [0x417098]
call fcn.00405278
ret

Function at 0x4bd610
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00407818
ret
Function at 0x4bdc48
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaac
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x54c], eax
mov dword [ebp - 0x550], eax
mov dword [ebp - 0x548], eax
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4bde44
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x540]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov ecx, eax
lea edx, [ebp - 0x540]
lea eax, [ebp - 0x10]
call fcn.004048d8
lea edx, [ebp - 0x544]
mov eax, dword [ebp - 0x10]
call fcn.00408b54
mov edx, dword [ebp - 0x544]
lea eax, [ebp - 0x10]
mov ecx, 0x4bde5c
call fcn.00404af4
xor edx, edx
mov eax, 0xf
call fcn.004bb9fc
mov edi, eax
mov dword [ebp - 0x140], 0x128
lea edx, [ebp - 0x140]
mov eax, edi
call fcn.004bba1c
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4bddf2
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00404a58
lea edx, [ebp - 0x548]
xor eax, eax
call fcn.00402b84
mov eax, dword [ebp - 0x548]
lea edx, [ebp - 0x18]
call fcn.0040991c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
call fcn.00404bf4
jne 0x4bdd65
mov eax, dword [ebp - 0x128]
mov esi, eax
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
jmp 0x4bdda7
lea eax, [ebp - 0x550]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00404a58
mov eax, dword [ebp - 0x550]
lea edx, [ebp - 0x54c]
call fcn.00408b54
mov eax, dword [ebp - 0x54c]
mov edx, 0x4bde74
call fcn.00404bf4
jne 0x4bdda7
mov eax, dword [ebp - 0x138]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x554]
mov eax, dword [ebp - 0x14]
call fcn.00408b54
mov eax, dword [ebp - 0x554]
mov edx, 0x4bde8c
call fcn.00404bf4
jne 0x4bdddf
mov bl, 1
mov eax, dword [ebp - 0x138]
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x140]
mov eax, edi
call fcn.004bba3c
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4bdd10
test bl, bl
je 0x4bde09
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
cmp esi, dword [ebp - 8]
je 0x4bde19
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bde4b
lea eax, [ebp - 0x554]
mov edx, 5
call fcn.0040480c
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040480c
ret
Function at 0x4be2f8
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4be47f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43c6f8]
call fcn.0043c7f8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4be45d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [ebp - 8]
mov edx, 0x4be494
call fcn.00404880
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0043c898
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], 0
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043c900
test al, al
je 0x4be3bf
mov edx, dword [0x4bd8ec]
mov eax, 0x10
call fcn.004056ec
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 8]
call fcn.0040483c
lea eax, [ebx + 8]
mov edx, 0x4be4e0
call fcn.0040483c
lea ecx, [ebp - 0xc]
mov edx, 0x4be4e0
mov eax, dword [ebp - 4]
call fcn.0043ce7c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.0040483c
mov edx, ebx
mov eax, esi
call fcn.0041a4d8
lea eax, [ebp - 8]
mov edx, 0x4be494
call fcn.00404880
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.0043c898
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], 0
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043c900
test al, al
je 0x4be447
mov edx, dword [0x4bd8ec]
mov eax, 0x10
call fcn.004056ec
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 8]
call fcn.0040483c
lea eax, [ebx + 8]
mov edx, 0x4be4f8
call fcn.0040483c
lea ecx, [ebp - 0x10]
mov edx, 0x4be4f8
mov eax, dword [ebp - 4]
call fcn.0043ce7c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0xc]
call fcn.0040483c
mov edx, ebx
mov eax, esi
call fcn.0041a4d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be464
mov eax, dword [ebp - 4]
call fcn.004039b4
ret

Function at 0x4be960
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [0x4fcbc4]
mov eax, dword [eax]
call fcn.00489ae4
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x4be9a1
cmp eax, dword [esp]
pop edx
pop eax
ja 0x4be96b
pop esi
pop ebx
ret
pop edx
pop eax
jg 0x4be96b
pop esi
pop ebx
ret
Function at 0x4be9a8
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov dword [ebp - 8], 0xff
mov eax, dword [ebp - 8]
call fcn.004027c4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bea02
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4be9ec
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004049e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bea09
mov eax, dword [ebp - 4]
call fcn.004027e4
ret

Function at 0x4bed30
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4beeda
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 0x43
cmp byte [0x4fdfcc], 3
je 0x4beebf
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004049d0
lea eax, [ebp - 8]
mov edx, 0x4beef0
call fcn.00404ab0
mov eax, dword [ebp - 8]
call fcn.00404ca8
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 2
je 0x4beda1
sub eax, 2
je 0x4bede8
dec eax
je 0x4bee2f
dec eax
je 0x4bee73
jmp 0x4beeb5
lea eax, [ebp - 4]
call fcn.004047e8
lea eax, [ebp - 0xc]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.00403098
mov edx, 0x4beef4
lea eax, [ebp - 0x10]
mov cl, 2
call fcn.00403068
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00404a4c
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4beeb5
lea eax, [ebp - 4]
call fcn.004047e8
lea eax, [ebp - 0xc]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.00403098
mov edx, 0x4beef4
lea eax, [ebp - 0x10]
mov cl, 2
call fcn.00403068
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00404a4c
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4beeb5
lea eax, [ebp - 4]
call fcn.004047e8
lea eax, [ebp - 0xc]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.00403098
mov edx, 0x4beef4
lea eax, [ebp - 0x10]
mov cl, 2
call fcn.00403068
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00404a4c
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4beeb5
lea eax, [ebp - 4]
call fcn.004047e8
lea eax, [ebp - 0xc]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.00403098
mov edx, 0x4beef4
lea eax, [ebp - 0x10]
mov cl, 2
call fcn.00403068
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00404a4c
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
cmp bl, 0x5b
jne 0x4bed52
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4beee1
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040480c
ret
Function at 0x4c062c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c069c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
push ebx
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.00409cec
mov eax, dword [ebp - 0x104]
mov ecx, 3
xor edx, edx
call fcn.00404d08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c06a3
lea eax, [ebp - 0x104]
call fcn.004047e8
ret

Function at 0x4c06a8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c0786
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.00409cec
mov edx, dword [ebp - 4]
mov eax, 0x4c079c
call fcn.00404dec
dec eax
jl 0x4c072d
lea eax, [ebp - 0x110]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404d08
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 4]
mov ecx, 0x4c07ac
call fcn.00404af4
jmp 0x4c0756
lea eax, [ebp - 0x114]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404d08
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x4c07c0
call fcn.00404af4
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040483c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c078d
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.0040480c
lea eax, [ebp - 4]
call fcn.004047e8
ret
Function at 0x4c2e14
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c2ef2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.00409cec
mov edx, dword [ebp - 4]
mov eax, 0x4c2f08
call fcn.00404dec
dec eax
jl 0x4c2e99
lea eax, [ebp - 0x110]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404d08
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 4]
mov ecx, 0x4c2f18
call fcn.00404af4
jmp 0x4c2ec2
lea eax, [ebp - 0x114]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404d08
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x4c2f2c
call fcn.00404af4
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040483c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2ef9
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.0040480c
lea eax, [ebp - 4]
call fcn.004047e8
ret
Function at 0x4c49fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4c4aef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.004027c4
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x4181d0]
call fcn.00403984
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4c4ac0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.004049e0
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, 0x4c4b04
call fcn.00404af4
call fcn.0040aefc
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x18]
call fcn.0040bbe8
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 8]
mov edx, 0x4c4b20
call fcn.004bb3f4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4ac7
mov eax, dword [ebp - 0x10]
call fcn.004039b4
mov eax, dword [ebp - 4]
call fcn.004027e4
ret
Function at 0x4c6760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c683e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.00409cec
mov edx, dword [ebp - 4]
mov eax, 0x4c6854
call fcn.00404dec
dec eax
jl 0x4c67e5
lea eax, [ebp - 0x110]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404d08
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 4]
mov ecx, 0x4c6864
call fcn.00404af4
jmp 0x4c680e
lea eax, [ebp - 0x114]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404d08
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x4c6878
call fcn.00404af4
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040483c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6845
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.0040480c
lea eax, [ebp - 4]
call fcn.004047e8
ret
Function at 0x4c7560
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
call fcn.00404c98
xor eax, eax
push ebp
push 0x4c77a0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x238]
mov eax, dword [ebp + 0xc]
call fcn.00408c58
mov eax, dword [ebp - 0x238]
push eax
lea edx, [ebp - 0x23c]
mov eax, 0x4c77b8
call fcn.00408c58
mov eax, dword [ebp - 0x23c]
pop edx
call fcn.00404dec
test eax, eax
jg 0x4c7767
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp + 0xc]
call fcn.00404ca8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4c775e
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov dword [ebp - 0x10], 0x3e8
mov ebx, dword [ebp - 0x18]
dec ebx
test ebx, ebx
jl 0x4c775e
inc ebx
mov dword [ebp - 0x30], 0
mov eax, dword [0x4fc898]
cmp byte [eax], 1
je 0x4c775e
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
cmp dword [ebp + 0xc], 0
jne 0x4c76ab
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x234]
mov dword [ebp - 0x244], eax
mov byte [ebp - 0x240], 6
lea edx, [ebp - 0x244]
xor ecx, ecx
mov eax, 0x4c77cc
call fcn.0040a1dc
jmp 0x4c76f2
push dword [ebp + 0xc]
push 0x4c77d8
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x234]
mov dword [ebp - 0x244], eax
mov byte [ebp - 0x240], 6
lea edx, [ebp - 0x244]
xor ecx, ecx
mov eax, 0x4c77cc
call fcn.0040a1dc
push dword [ebp - 0x248]
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00404b68
mov eax, dword [0x4fcbd8]
inc dword [eax]
mov eax, dword [0x4fcbd8]
mov eax, dword [eax]
mov ecx, 0xc8
cdq
idiv ecx
test edx, edx
jne 0x4c7717
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.00469d04
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, esi
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004c6f7c
push esi
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004c7560
mov dword [ebp - 0x10], 0x3e8
mov eax, dword [0x4fcbc4]
mov eax, dword [eax]
call fcn.00489ae4
inc dword [ebp - 0x30]
dec ebx
jne 0x4c764c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c77a7
lea eax, [ebp - 0x248]
call fcn.004047e8
lea eax, [ebp - 0x23c]
mov edx, 2
call fcn.0040480c
lea eax, [ebp - 0x34]
call fcn.004047e8
lea eax, [ebp + 0xc]
call fcn.004047e8
ret
Function at 0x4c8198
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c831f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x22c]
mov edx, dword [ebp - 4]
call fcn.0044fcc8
mov eax, dword [eax + 8]
mov ecx, 0x4c8338
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x22c]
mov edx, dword [ebp - 4]
call fcn.0044fcc8
mov eax, dword [eax + 8]
mov ecx, 0x4c8344
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov bl, 0x43
mov eax, dword [0x4fc898]
cmp byte [eax], 1
je 0x4c82b2
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.004049d0
lea eax, [ebp - 0x14]
mov edx, 0x4c8358
call fcn.00404ab0
mov eax, dword [ebp - 0x14]
call fcn.00404ca8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4c82a8
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.004049d0
lea eax, [ebp - 0x18]
mov edx, 0x4c8358
call fcn.00404ab0
mov eax, dword [ebp - 0x18]
call fcn.00402968
call fcn.0040292c
lea eax, [ebp - 0x1c]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x20]
call fcn.00403098
mov edx, 0x4c835c
lea eax, [ebp - 0x20]
mov cl, 2
call fcn.00403068
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x10]
call fcn.00404a4c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004c8598
inc ebx
cmp bl, 0x5b
jne 0x4c8206
mov eax, dword [0x4fc898]
cmp byte [eax], 1
jne 0x4c82e1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x22c]
mov edx, dword [ebp - 4]
call fcn.0044fcc8
mov eax, dword [eax + 8]
mov ecx, 0x4c8368
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x4c8304
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x22c]
mov edx, dword [ebp - 4]
call fcn.0044fcc8
mov eax, dword [eax + 8]
mov ecx, 0x4c837c
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8326
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040480c
ret
Function at 0x4c954c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404c98
mov eax, dword [ebp - 8]
call fcn.00404c98
xor eax, eax
push ebp
push 0x4c965e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040af28
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xc]
mov eax, 0x4c9674
call fcn.0040bc2c
lea edx, [ebp - 0x20]
mov eax, dword [0x4fcbc4]
mov eax, dword [eax]
call fcn.0048a2a0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409800
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
mov ecx, 0x4c968c
call fcn.00404af4
mov eax, dword [ebp - 0x10]
call fcn.00409650
test al, al
jne 0x4c95e2
mov eax, dword [ebp - 0x10]
call fcn.00409ae4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
lea edx, [ebp - 0x38]
mov ecx, 2
mov eax, 0x4c969c
call fcn.0040a1dc
push 0x4c96b8
push dword [ebp - 0x14]
push 0x4c96cc
push dword [ebp - 4]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404b68
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404ca8
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9665
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.0040480c
ret
Function at 0x4ca3e8
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x160], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404c98
lea eax, [ebp - 0x15c]
mov edx, dword [0x407e2c]
call fcn.004051a8
xor eax, eax
push ebp
push 0x4ca517
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404ca8
push eax
call sub.kernel32.dll_SetCurrentDirectoryA_1
lea ecx, [ebp - 0x15c]
mov edx, 0x10
mov eax, 0x4ca52c
call fcn.004096d8
jmp 0x4ca4d2
mov eax, dword [0x4fcbc4]
mov eax, dword [eax]
call fcn.00489ae4
mov eax, dword [ebp - 0x150]
mov edx, 0x4ca538
call fcn.00404bf4
je 0x4ca4d2
mov eax, dword [ebp - 0x150]
mov edx, 0x4ca544
call fcn.00404bf4
je 0x4ca4d2
mov eax, dword [esi + 0x22c]
call fcn.0044fc3c
mov ebx, eax
mov edx, dword [ebp - 0x150]
mov eax, ebx
call fcn.0044f6dc
push dword [ebp - 4]
push 0x4ca550
push dword [ebp - 0x150]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.00404b68
mov edx, dword [ebp - 0x160]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x4ca55c
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x15c]
call fcn.00409728
test eax, eax
je 0x4ca44f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca51e
lea eax, [ebp - 0x160]
call fcn.004047e8
lea eax, [ebp - 0x15c]
mov edx, dword [0x407e2c]
call fcn.00405278
lea eax, [ebp - 4]
call fcn.004047e8
ret