joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad700
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ad7cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402df4
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x40
mov eax, dword [0x53ab08]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x38], eax
mov eax, ebx
call fcn.00404738
mov dword [ebp - 0x30], eax
mov eax, 0x4ad7dc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
call fcn.00404738
mov dword [ebp - 0x2c], eax
mov eax, esi
call fcn.00404738
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 1
call sub.user32.dll_GetFocus
mov esi, eax
xor eax, eax
call fcn.0048782c
mov ebx, eax
push 0
call sub.user32.dll_SetFocus
mov eax, dword [0x53ab08]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetActiveWindow
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
mov eax, ebx
call fcn.004878e0
push esi
call sub.user32.dll_SetFocus
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad7d3
lea eax, [ebp - 4]
call fcn.00404278
ret

Function at 0x4af3cc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4af41d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4af404
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4af3f4
jmp 0x4af41d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4af405
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bd0f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
dec edx
test edx, edx
jl 0x4bd19d
inc edx
mov dword [ebp - 0x10], edx
mov edx, dword [eax]
and edx, 0xffff
or edx, 2
mov dword [ebp - 0xc], edx
mov dl, byte [esi]
mov ebx, dword [ebp - 0xc]
xor ebx, 1
imul ebx, dword [ebp - 0xc]
shr ebx, 8
xor dl, bl
mov byte [esi], dl
mov edx, dword [ecx]
mov bl, byte [esi]
xor dl, bl
and edx, 0xff
mov edx, dword [edx*4 + 0x539124]
mov ebx, dword [ecx]
shr ebx, 8
and ebx, 0xffffff
xor edx, ebx
mov dword [ecx], edx
mov edx, dword [ecx]
and edx, 0xff
add dword [edi], edx
mov edx, dword [edi]
imul edx, dword [ebp + 8]
inc edx
mov dword [edi], edx
mov edx, dword [eax]
mov ebx, dword [edi]
shr ebx, 0x18
xor dl, bl
and edx, 0xff
mov edx, dword [edx*4 + 0x539124]
mov ebx, dword [eax]
shr ebx, 8
and ebx, 0xffffff
xor edx, ebx
mov dword [eax], edx
inc esi
dec dword [ebp - 0x10]
jne 0x4bd118
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4bead0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.004098f4
mov eax, dword [ebx]
call fcn.00404538
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4beb16
mov eax, ebx
mov edx, 0x4beb24
call fcn.00404540
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d9ffc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.004d9fc4
mov eax, dword [ebx]
call fcn.00404538
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4da042
mov eax, ebx
mov edx, 0x4da050
call fcn.00404540
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4da054
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.004d9fc4
mov eax, dword [ebx]
call fcn.00404538
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4da09a
mov eax, ebx
mov edx, 0x4da0a8
call fcn.00404540
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4da430
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.004dc640
mov eax, dword [ebx]
call fcn.00404538
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4da476
mov eax, ebx
mov edx, 0x4da484
call fcn.00404540
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4dcef0
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov eax, esp
mov edx, 0x94
call fcn.004073b8
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 5
jb 0x4dcf24
cmp dword [esp + 8], 1
jb 0x4dcf24
cmp dword [esp + 0x10], 2
je 0x4dcf28
xor eax, eax
jmp 0x4dcf2a
mov al, 1
add esp, 0x94
ret

Function at 0x4e5d90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e5e00
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
push ebx
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.004098f4
mov eax, dword [ebp - 0x104]
mov ecx, 3
xor edx, edx
call fcn.00404798
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5e07
lea eax, [ebp - 0x104]
call fcn.00404278
ret
Function at 0x4e5e0c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e5eea
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.004098f4
mov edx, dword [ebp - 4]
mov eax, 0x4e5f00
call fcn.0040487c
dec eax
jl 0x4e5e91
lea eax, [ebp - 0x110]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404798
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 4]
mov ecx, 0x4e5f10
call fcn.00404584
jmp 0x4e5eba
lea eax, [ebp - 0x114]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404798
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x4e5f24
call fcn.00404584
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004042cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5ef1
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.0040429c
lea eax, [ebp - 4]
call fcn.00404278
ret
Function at 0x4e7f5c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e803a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.004098f4
mov edx, dword [ebp - 4]
mov eax, 0x4e8050
call fcn.0040487c
dec eax
jl 0x4e7fe1
lea eax, [ebp - 0x110]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404798
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 4]
mov ecx, 0x4e8060
call fcn.00404584
jmp 0x4e800a
lea eax, [ebp - 0x114]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404798
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x4e8074
call fcn.00404584
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004042cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8041
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.0040429c
lea eax, [ebp - 4]
call fcn.00404278
ret
Function at 0x4e8d5c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
call fcn.00404728
xor eax, eax
push ebp
push 0x4e8f9c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x238]
mov eax, dword [ebp + 0xc]
call fcn.004088b4
mov eax, dword [ebp - 0x238]
push eax
lea edx, [ebp - 0x23c]
mov eax, 0x4e8fb4
call fcn.004088b4
mov eax, dword [ebp - 0x23c]
pop edx
call fcn.0040487c
test eax, eax
jg 0x4e8f63
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp + 0xc]
call fcn.00404738
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4e8f5a
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov dword [ebp - 0x10], 0x3e8
mov ebx, dword [ebp - 0x18]
dec ebx
test ebx, ebx
jl 0x4e8f5a
inc ebx
mov dword [ebp - 0x30], 0
mov eax, dword [0x53a7c8]
cmp byte [eax], 1
je 0x4e8f5a
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
cmp dword [ebp + 0xc], 0
jne 0x4e8ea7
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x234]
mov dword [ebp - 0x244], eax
mov byte [ebp - 0x240], 6
lea edx, [ebp - 0x244]
xor ecx, ecx
mov eax, 0x4e8fc8
call fcn.00409de4
jmp 0x4e8eee
push dword [ebp + 0xc]
push 0x4e8fd4
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x234]
mov dword [ebp - 0x244], eax
mov byte [ebp - 0x240], 6
lea edx, [ebp - 0x244]
xor ecx, ecx
mov eax, 0x4e8fc8
call fcn.00409de4
push dword [ebp - 0x248]
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.004045f8
mov eax, dword [0x53ab30]
inc dword [eax]
mov eax, dword [0x53ab30]
mov eax, dword [eax]
mov ecx, 0xc8
cdq
idiv ecx
test edx, edx
jne 0x4e8f13
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.004707c4
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, esi
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004e8778
push esi
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004e8d5c
mov dword [ebp - 0x10], 0x3e8
mov eax, dword [0x53ab08]
mov eax, dword [eax]
call fcn.00490870
inc dword [ebp - 0x30]
dec ebx
jne 0x4e8e48
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8fa3
lea eax, [ebp - 0x248]
call fcn.00404278
lea eax, [ebp - 0x23c]
mov edx, 2
call fcn.0040429c
lea eax, [ebp - 0x34]
call fcn.00404278
lea eax, [ebp + 0xc]
call fcn.00404278
ret
Function at 0x4e9c84
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e9d62
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.004098f4
mov edx, dword [ebp - 4]
mov eax, 0x4e9d78
call fcn.0040487c
dec eax
jl 0x4e9d09
lea eax, [ebp - 0x110]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404798
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 4]
mov ecx, 0x4e9d88
call fcn.00404584
jmp 0x4e9d32
lea eax, [ebp - 0x114]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404798
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x4e9d9c
call fcn.00404584
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004042cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9d69
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.0040429c
lea eax, [ebp - 4]
call fcn.00404278
ret
Function at 0x4ecef4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ed07b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x22c]
mov edx, dword [ebp - 4]
call fcn.00450c68
mov eax, dword [eax + 8]
mov ecx, 0x4ed094
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x22c]
mov edx, dword [ebp - 4]
call fcn.00450c68
mov eax, dword [eax + 8]
mov ecx, 0x4ed0a0
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov bl, 0x43
mov eax, dword [0x53a7c8]
cmp byte [eax], 1
je 0x4ed00e
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00404460
lea eax, [ebp - 0x14]
mov edx, 0x4ed0b4
call fcn.00404540
mov eax, dword [ebp - 0x14]
call fcn.00404738
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4ed004
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404460
lea eax, [ebp - 0x18]
mov edx, 0x4ed0b4
call fcn.00404540
mov eax, dword [ebp - 0x18]
call fcn.00402950
call fcn.00402914
lea eax, [ebp - 0x1c]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x20]
call fcn.00402cd8
mov edx, 0x4ed0b8
lea eax, [ebp - 0x20]
mov cl, 2
call fcn.00402ca8
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x10]
call fcn.004044dc
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004ed2f4
inc ebx
cmp bl, 0x5b
jne 0x4ecf62
mov eax, dword [0x53a7c8]
cmp byte [eax], 1
jne 0x4ed03d
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x22c]
mov edx, dword [ebp - 4]
call fcn.00450c68
mov eax, dword [eax + 8]
mov ecx, 0x4ed0c4
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x4ed060
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x22c]
mov edx, dword [ebp - 4]
call fcn.00450c68
mov eax, dword [eax + 8]
mov ecx, 0x4ed0d8
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed082
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040429c
ret
Function at 0x4edfb4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
call fcn.00404728
xor eax, eax
push ebp
push 0x4ee194
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp + 0xc]
call fcn.00404738
push eax
mov eax, dword [ebp + 0x10]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4ee162
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x130]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov dword [ebp - 0x10], 0x3e8
cmp dword [ebp - 0x18], 0
jne 0x4ee063
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
call fcn.004edcc4
mov ebx, dword [ebp - 0x18]
dec ebx
test ebx, ebx
jl 0x4ee162
inc ebx
xor esi, esi
mov eax, dword [0x53a7c8]
cmp byte [eax], 1
je 0x4ee162
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x230]
push eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
cmp dword [ebp + 0xc], 0
jne 0x4ee0ce
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x238], eax
mov byte [ebp - 0x234], 6
lea edx, [ebp - 0x238]
xor ecx, ecx
mov eax, 0x4ee1ac
call fcn.00409de4
jmp 0x4ee115
push dword [ebp + 0xc]
push 0x4ee1b8
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x238], eax
mov byte [ebp - 0x234], 6
lea edx, [ebp - 0x238]
xor ecx, ecx
mov eax, 0x4ee1ac
call fcn.00409de4
push dword [ebp - 0x23c]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.004045f8
mov edx, dword [ebp - 0x30]
mov eax, edi
call fcn.004707c4
mov eax, dword [ebp - 0x30]
mov edx, 0x4ee1c4
call fcn.00404684
je 0x4ee147
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004edfb4
mov dword [ebp - 0x10], 0x3e8
mov eax, dword [0x53ab08]
mov eax, dword [eax]
call fcn.00490870
inc esi
dec ebx
jne 0x4ee072
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee19b
lea eax, [ebp - 0x23c]
call fcn.00404278
lea eax, [ebp - 0x30]
call fcn.00404278
lea eax, [ebp + 0xc]
call fcn.00404278
ret
Function at 0x4ee9bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4eea3d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.004098f4
lea eax, [ebp - 4]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404798
lea eax, [ebp - 4]
mov edx, 0x4eea54
call fcn.00404540
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004042cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eea44
lea eax, [ebp - 4]
call fcn.00404278
ret
Function at 0x4fcee0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4fcee8
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4fd0da
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4fd0f0
mov eax, esi
call fcn.004fad6c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004042cc
lea ecx, [ebp - 0x10]
mov edx, 0x4fd104
mov eax, esi
call fcn.004fad6c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004042cc
lea ecx, [ebp - 0x14]
mov edx, 0x4fd11c
mov eax, esi
call fcn.004fad6c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004042cc
lea ecx, [ebp - 0x18]
mov edx, 0x4fd138
mov eax, esi
call fcn.004fad6c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004042cc
lea ecx, [ebp - 0x1c]
mov edx, 0x4fd154
mov eax, esi
call fcn.004fad6c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004042cc
lea ecx, [ebp - 0x24]
mov edx, 0x4fd16c
mov eax, esi
call fcn.004fad6c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004089c4
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408f0c
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4fd184
mov eax, esi
call fcn.004fad6c
mov eax, dword [ebp - 0x28]
call fcn.004f4844
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4fd194
mov eax, esi
call fcn.004fad6c
mov eax, dword [ebp - 0x2c]
call fcn.004f4844
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4fd1ac
mov eax, esi
call fcn.004fad6c
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408f0c
inc eax
je 0x4fd07d
lea ecx, [ebp - 0x34]
mov edx, 0x4fd1ac
mov eax, esi
call fcn.004fad6c
mov eax, dword [ebp - 0x34]
call fcn.00408ed0
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a6f0
fstp qword [ebp - 0x3c]
wait
call fcn.0040aaf0
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4fd098
lea ecx, [ebp - 0x40]
mov edx, 0x4fd1ac
mov eax, esi
call fcn.004fad6c
mov eax, dword [ebp - 0x40]
call fcn.004f4844
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4fd1bc
mov eax, esi
call fcn.004fad6c
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004042cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd0e1
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0040429c
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.0040429c
ret
Function at 0x503e6c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x503ec6
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00503e5c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004f34b0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004f30b0
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503ecd
lea eax, [ebp - 4]
call fcn.00404278
ret
Function at 0x50a390
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x50a483
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.004027ac
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x41a4b8]
call fcn.00403414
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x50a454
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00404470
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, 0x50a498
call fcn.00404584
call fcn.0040aac4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x18]
call fcn.0040b728
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 8]
mov edx, 0x50a4b0
call fcn.004abf34
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50a45b
mov eax, dword [ebp - 0x10]
call fcn.00403444
mov eax, dword [ebp - 4]
call fcn.004027cc
ret