joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d8850
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556008
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x607070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
push 0
push 0
push 3
push 0
push 3
push 0
push str..PhysicalDrive0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4d8939
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], 0
push eax
push 8
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
push 0xc
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push 0x2d1400
movq qword [ebp - 0x2c], xmm0
push edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4d8932
mov esi, dword [ebp - 0x1c]
push esi
call fcn.004ff448
push esi
mov ebx, eax
push 0
push ebx
call fcn.00517950
add esp, 0x10
lea eax, [ebp - 0x18]
push 0
push eax
push esi
push ebx
push 0xc
lea eax, [ebp - 0x2c]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4d8940
push ebx
call fcn.004ff443
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x4d8a03
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
mov dword [ebp - 4], 0
test eax, eax
je 0x4d89e7
cmp eax, dword [ebx + 4]
jae 0x4d89e7
add eax, ebx
lea ecx, [ebp - 0x60]
push eax
call fcn.004334f0
push eax
lea ecx, [ebp - 0x44]
call fcn.00433470
lea ecx, [ebp - 0x60]
call fcn.00433430
sub esp, 8
mov byte [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x44]
push eax
call fcn.004da220
push eax
push 0
lea ecx, [ebp - 0x44]
call fcn.00433d50
sub esp, 8
mov byte [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x44]
push eax
call fcn.004da1b0
inc eax
lea ecx, [ebp - 0x44]
push eax
call fcn.00433df0
cmp dword [ebp - 0x30], 0x10
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x48]
cmovae ecx, dword [ebp - 0x44]
call fcn.004dde00
push ebx
call fcn.004ff443
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x4d89f9
push ebx
call fcn.004ff443
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
lea ecx, [ebp - 0x44]
call fcn.00433430
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fef09
mov esp, ebp
pop ebp
ret
Function at 0x4d8a20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556038
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x607070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x2c], 0xff
jb 0x4d8a68
mov eax, dword [esi]
jmp 0x4d8a6a
mov eax, esi
mov byte [eax], 0
lea eax, [ebp - 0x28]
movups xmm0, xmmword [0x5e45d4]
push eax
push 0
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], 0
push eax
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 4], 0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x4d8b52
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4d8b52
push eax
lea ecx, [ebp - 0x44]
call fcn.004333d0
mov edx, esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.004de0e0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x4d8adb
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.004341f0
xor eax, eax
mov dword [ebp - 0x30], 7
cmp byte [0x5983f0], al
mov ecx, esi
mov word [ebp - 0x44], ax
setne al
mov dword [ebp - 0x34], 0
push eax
push 0x5983f0
call fcn.00438580
xor ecx, ecx
mov eax, 5
cmp byte [str.Adobe], cl
cmove eax, ecx
mov ecx, esi
push eax
push str.Adobe
call fcn.00438580
xor eax, eax
mov ecx, esi
cmp byte [0x5983f0], al
setne al
push eax
push 0x5983f0
call fcn.00438580
push dword [ebp - 0x28]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
jmp 0x4d8b57
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fef09
mov esp, ebp
pop ebp
ret
Function at 0x4d8b80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556068
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x607070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x2c], 0xff
jb 0x4d8bc8
mov eax, dword [esi]
jmp 0x4d8bca
mov eax, esi
movups xmm0, xmmword [0x5e4614]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x28]
push eax
push ecx
push ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], ecx
push eax
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 4], ecx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x4d8c44
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4d8c44
push eax
lea ecx, [ebp - 0x44]
call fcn.004333d0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00433b80
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x4d8c2c
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.004341f0
push dword [ebp - 0x28]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
jmp 0x4d8c49
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fef09
mov esp, ebp
pop ebp
ret

Function at 0x4d8c70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556098
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x607070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x2c], 0xff
jb 0x4d8cb8
mov eax, dword [esi]
jmp 0x4d8cba
mov eax, esi
movups xmm0, xmmword [0x5e4604]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x28]
push eax
push ecx
push ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], ecx
push eax
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 4], ecx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x4d8d34
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4d8d34
push eax
lea ecx, [ebp - 0x44]
call fcn.004333d0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00433b80
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x4d8d1c
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.004341f0
push dword [ebp - 0x28]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
jmp 0x4d8d39
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fef09
mov esp, ebp
pop ebp
ret
Function at 0x4d8d60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5560c8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x607070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x2c], 0xff
jb 0x4d8da8
mov eax, dword [esi]
jmp 0x4d8daa
mov eax, esi
movups xmm0, xmmword [0x5e45f4]
mov byte [eax], 0
lea eax, [ebp - 0x28]
push eax
push 0
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], 0
push eax
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 4], 0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x4d8e92
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4d8e92
push eax
lea ecx, [ebp - 0x44]
call fcn.004333d0
mov edx, esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.004de0e0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x4d8e1b
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.004341f0
xor eax, eax
mov dword [ebp - 0x30], 7
cmp byte [0x5983f0], al
mov ecx, esi
mov word [ebp - 0x44], ax
setne al
mov dword [ebp - 0x34], 0
push eax
push 0x5983f0
call fcn.00438580
xor ecx, ecx
mov eax, 5
cmp byte [str.Adobe], cl
cmove eax, ecx
mov ecx, esi
push eax
push str.Adobe
call fcn.00438580
xor eax, eax
mov ecx, esi
cmp byte [0x5983f0], al
setne al
push eax
push 0x5983f0
call fcn.00438580
push dword [ebp - 0x28]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
jmp 0x4d8e97
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fef09
mov esp, ebp
pop ebp
ret
Function at 0x4d9c40
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556246
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x607070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xf
push str.unknown_machine
call fcn.00433800
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00517950
add esp, 0xc
mov dword [ebp - 0x414], 0x100
lea eax, [ebp - 0x414]
mov esi, 0xff
push eax
lea eax, [ebp - 0x210]
push eax
push 5
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x4d9db1
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x430]
call fcn.004333d0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x420], 0
sete al
test al, al
jne 0x4d9d07
cmp dword [ebp - 0x41c], 8
lea ecx, [ebp - 0x430]
mov edx, edi
cmovae ecx, dword [ebp - 0x430]
call fcn.004ddc50
xor esi, esi
jmp 0x4d9d8f
push 0x200
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00517950
add esp, 0xc
mov dword [ebp - 0x418], 0x100
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x4d9d8f
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x448]
call fcn.004333d0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x438], 0
je 0x4d9d7f
cmp dword [ebp - 0x434], 8
lea ecx, [ebp - 0x448]
mov edx, edi
cmovae ecx, dword [ebp - 0x448]
call fcn.004ddc50
xor esi, esi
jmp 0x4d9d84
mov esi, 0xff
lea ecx, [ebp - 0x448]
call fcn.00433390
mov ecx, dword [ebp - 0x41c]
cmp ecx, 8
jb 0x4d9dad
inc ecx
push ecx
push dword [ebp - 0x430]
lea ecx, [ebp - 0x430]
call fcn.004341f0
mov eax, esi
jmp 0x4d9db6
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fef09
mov esp, ebp
pop ebp
ret

Function at 0x4d9de0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x607070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x800
lea eax, [ebp - 0x804]
mov esi, ecx
push 0
push eax
call fcn.00517950
add esp, 0xc
lea eax, [ebp - 0x804]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x3fe
ja 0x4d9e8f
cmp word [ebp - 0x804], 0
jne 0x4d9e52
xor ecx, ecx
lea eax, [ebp - 0x804]
push ecx
push eax
mov ecx, esi
call fcn.00433660
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fef09
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x804]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d9e60
sub ecx, edx
lea eax, [ebp - 0x804]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00433660
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fef09
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.004fef09
mov esp, ebp
pop ebp
ret
Function at 0x4da930
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x607070]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x14], 8
push esi
mov esi, edx
jb 0x4da94b
mov ecx, dword [ecx]
lea eax, [ebp - 8]
push eax
push 0x2011f
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4da9a0
cmp dword [esi + 0x14], 8
jb 0x4da96e
mov esi, dword [esi]
push 0
push 0x100
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
push dword [ebp - 8]
neg eax
sbb esi, esi
and esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fef09
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.004fef09
mov esp, ebp
pop ebp
ret

Function at 0x4da9c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5563c0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x607070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, edx
mov dword [ebp - 0x20], ecx
cmp dword [esi + 0x14], 8
mov ebx, 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
jb 0x4daa08
mov eax, dword [esi]
jmp 0x4daa0a
mov eax, esi
lea edx, [ebp - 0x18]
push edx
push 0
push 0
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4daaac
mov dword [ebp - 4], eax
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov edx, 2
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ff448
add esp, 4
mov edi, eax
cmp dword [esi + 0x14], 8
jb 0x4daa4f
mov esi, dword [esi]
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x20]
push edi
push 0
push 0
push esi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4daa91
cmp word [edi], ax
jne 0x4daa71
xor ecx, ecx
jmp 0x4daa85
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4daa76
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x1c]
push edi
call fcn.00433660
xor ebx, ebx
push edi
call fcn.004ff443
add esp, 4
jmp 0x4daaac
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fef09
mov esp, ebp
pop ebp
ret
Function at 0x4daad0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5563f8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x607070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
mov eax, ecx
mov dword [ebp - 0x28], eax
xor ebx, ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x20]
mov esi, 2
push ecx
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push ebx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4dac4c
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
inc eax
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ff448
add esp, 4
mov esi, eax
push dword [ebp - 0x20]
call fcn.004ff448
add esp, 4
mov edi, eax
lea eax, [ebp - 0x20]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x28]
push esi
push ebx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4dac24
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], edi
mov word [esi + eax*2], cx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x60]
call fcn.00438d10
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x60]
push eax
mov byte [ebp - 4], 1
call fcn.00437ea0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x34]
cmp eax, 8
jb 0x4dabcf
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.004341f0
xor eax, eax
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x38], 0
cmp eax, 8
jb 0x4dabf8
inc eax
lea ecx, [ebp - 0x60]
push eax
push dword [ebp - 0x60]
call fcn.004341f0
xor eax, eax
mov dword [ebp - 0x4c], 7
push esi
mov dword [ebp - 0x50], 0
mov word [ebp - 0x60], ax
call fcn.004ff443
push edi
call fcn.004ff443
mov eax, dword [ebp - 0x28]
add esp, 8
inc ebx
jmp 0x4dab18
push esi
call fcn.004ff443
push edi
call fcn.004ff443
add esp, 8
mov eax, 1
jmp 0x4dac4e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fef09
mov esp, ebp
pop ebp
ret
Function at 0x4dac70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556428
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x607070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x48], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, dword [edx]
mov edi, dword [edx + 4]
nop dword [eax + eax]
cmp esi, edi
je 0x4dad60
xor eax, eax
mov dword [ebp - 0x30], 7
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
call fcn.00433b80
xor ecx, ecx
mov byte [ebp - 4], 1
push 0xffffffffffffffff
push ecx
lea eax, [esi + 0x18]
mov word [ebp - 0x2c], cx
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
call fcn.00433b80
mov byte [ebp - 4], 0
lea edx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmovae edx, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], 8
cmovae ecx, dword [ebp - 0x44]
add eax, eax
push eax
mov eax, dword [ebp - 0x48]
push edx
push 1
push 0
push ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x44]
test eax, eax
je 0x4dad43
mov ebx, 1
call fcn.004375c0
jmp 0x4dad60
call fcn.004375c0
add esi, 0x30
jmp 0x4dacb0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fef09
mov esp, ebp
pop ebp
ret

Function at 0x4de9a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5569fb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x607070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
mov dword [ecx], 0
mov byte [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov byte [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov byte [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov byte [ecx + 0x34], 0
mov dword [ebp - 4], 0
push dword [esi]
mov edx, dword [esi + 8]
push dword [esi + 0xc]
push dword [esi + 4]
push dword [esi]
call fcn.004df0d0
add esp, 0x10
test al, al
mov eax, esi
jne 0x4dea62
mov dword [esi + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4deaf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5569fb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x607070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
mov dword [ecx], 0
mov byte [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov byte [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov byte [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov byte [ecx + 0x34], 0
mov dword [ebp - 4], 0
push dword [esi]
mov edx, dword [esi + 8]
push dword [esi + 0xc]
push dword [esi + 4]
push dword [esi]
call fcn.004df290
add esp, 0x10
test al, al
mov eax, esi
jne 0x4debb2
mov dword [esi + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4df480
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x4df4b1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x4df4a0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x4e29d0
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4e2ba3
cmp eax, 0x7c
je 0x4e2ba3
cmp eax, 0x29
jne 0x4e2a08
cmp dword [esi + 0x10], 0
jne 0x4e2ba3
test dword [esi + 0x50], 0x10000000
je 0x4e2bb0
cmp eax, 0x2e
jne 0x4e2a65
push 5
lea ecx, [esi + 0x24]
call fcn.004549a0
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x4e2a59
cmp word [eax], 0x5c
jne 0x4e2a56
add eax, 2
cmp eax, ecx
je 0x4e2a56
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x4e2a42
movzx edx, word [eax]
cmp edx, 0x28
je 0x4e2a54
cmp edx, 0x29
je 0x4e2a54
test cl, 0x10
jne 0x4e2a56
movzx ecx, word [eax]
cmp ecx, 0x7b
je 0x4e2a54
cmp ecx, 0x7d
jne 0x4e2a56
mov dword [esi], eax
add dword [esi], 2
mov ecx, esi
call fcn.004e1a80
jmp 0x4e2b8e
cmp eax, 0x5c
jne 0x4e2acc
mov ecx, esi
call fcn.004e2980
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x4e2a98
cmp word [esi + 0x48], 0x62
jne 0x4e2a98
push 4
lea ecx, [esi + 0x24]
call fcn.004549a0
mov ecx, esi
call fcn.004e2980
jmp 0x4e2b95
test eax, eax
je 0x4e2ac0
cmp word [esi + 0x48], 0x42
jne 0x4e2ac0
push 4
lea ecx, [esi + 0x24]
call fcn.004549a0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.004e2980
jmp 0x4e2b95
mov ecx, esi
call fcn.004e3a70
jmp 0x4e2b8e
cmp eax, 0x5b
jne 0x4e2aee
mov ecx, esi
call fcn.004e2980
mov ecx, esi
call fcn.004e39c0
cmp dword [esi + 0x4c], 0x5d
je 0x4e2b87
jmp 0x4e2ba9
cmp eax, 0x28
jne 0x4e2b1a
mov ecx, esi
call fcn.004e2980
mov ecx, esi
call fcn.004e3c30
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4e2bb0
mov ecx, esi
call fcn.004e2980
test bl, bl
je 0x4e2b95
jmp 0x4e2b8e
cmp eax, 0x5e
jne 0x4e2b32
push 2
lea ecx, [esi + 0x24]
call fcn.004549a0
mov ecx, esi
call fcn.004e2980
jmp 0x4e2b95
cmp eax, 0x24
jne 0x4e2b4a
push 3
lea ecx, [esi + 0x24]
call fcn.004549a0
mov ecx, esi
call fcn.004e2980
jmp 0x4e2b95
cmp eax, 0x2a
je 0x4e2bbe
cmp eax, 0x2b
je 0x4e2bbe
cmp eax, 0x3f
je 0x4e2bbe
cmp eax, 0x7b
je 0x4e2bbe
cmp eax, 0x7d
jne 0x4e2b6c
test dword [esi + 0x50], 0x10000000
je 0x4e2bb7
cmp eax, 0x5d
jne 0x4e2b7a
test dword [esi + 0x50], 0x10000000
je 0x4e2ba9
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004e3e30
mov ecx, esi
call fcn.004e2980
mov ecx, esi
call fcn.004e3cf0
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x4e29e3
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 4
call fcn.004eb24b
push 5
call fcn.004eb24b
push 6
call fcn.004eb24b
push 0xa
call fcn.004eb24b
int3
Function at 0x4e9c80
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp dword [esi + 0x18], 8
lea eax, [esi + 4]
jb 0x4e9c91
mov eax, dword [eax]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x4e9cda
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4e9cbd
mov dl, 1
lea eax, [esi + 0x1c]
mov cl, dl
xchg byte [eax], cl
pop esi
mov al, dl
pop ebx
ret
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
lea ecx, [esi + 0x1c]
xor dl, dl
xchg byte [ecx], dl
pop esi
mov al, bl
pop ebx
ret