joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c82c4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4c831e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004c82b4
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004b6f80
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004b6b80
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8325
lea eax, [ebp - 4]
call fcn.004047cc
ret

Function at 0x4cb6c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x53193c]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x53193c]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x53193c]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x53193c]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x5314c0]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x4cb6ef
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4cf124
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x417154]
call fcn.0040518c
xor eax, eax
push ebp
push 0x4cf268
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x53259c], 0
jne 0x4cf177
mov ecx, dword [0x532c68]
mov dl, 1
mov eax, dword [0x407e70]
call fcn.0040cfbc
call fcn.00404164
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004031ac
mov eax, ebx
call fcn.0040503c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4cf278
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004062e0
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.0040504c
test eax, eax
jle 0x4cf20f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4cf208
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404a54
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404a3c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408d1c
test eax, eax
jne 0x4cf208
mov ebx, 0x15
jmp 0x4cf214
mov ebx, 0x10
jmp 0x4cf214
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x53259c]
call fcn.004cf020
mov eax, dword [ebp - 8]
call fcn.004cf020
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004062f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf26f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004047f0
lea eax, [ebp - 0x10]
mov edx, dword [0x417154]
call fcn.0040525c
ret

Function at 0x4d07fc
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.0040783c
ret
Function at 0x4d10e0
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaac
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x54c], eax
mov dword [ebp - 0x550], eax
mov dword [ebp - 0x548], eax
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4d12dc
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x540]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov ecx, eax
lea edx, [ebp - 0x540]
lea eax, [ebp - 0x10]
call fcn.004048bc
lea edx, [ebp - 0x544]
mov eax, dword [ebp - 0x10]
call fcn.00408b78
mov edx, dword [ebp - 0x544]
lea eax, [ebp - 0x10]
mov ecx, 0x4d12f4
call fcn.00404ad8
xor edx, edx
mov eax, 0xf
call fcn.004cebe8
mov edi, eax
mov dword [ebp - 0x140], 0x128
lea edx, [ebp - 0x140]
mov eax, edi
call fcn.004cec08
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4d128a
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00404a3c
lea edx, [ebp - 0x548]
xor eax, eax
call fcn.00402b44
mov eax, dword [ebp - 0x548]
lea edx, [ebp - 0x18]
call fcn.00409a1c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
call fcn.00404bd8
jne 0x4d11fd
mov eax, dword [ebp - 0x128]
mov esi, eax
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
jmp 0x4d123f
lea eax, [ebp - 0x550]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00404a3c
mov eax, dword [ebp - 0x550]
lea edx, [ebp - 0x54c]
call fcn.00408b78
mov eax, dword [ebp - 0x54c]
mov edx, 0x4d130c
call fcn.00404bd8
jne 0x4d123f
mov eax, dword [ebp - 0x138]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x554]
mov eax, dword [ebp - 0x14]
call fcn.00408b78
mov eax, dword [ebp - 0x554]
mov edx, 0x4d1324
call fcn.00404bd8
jne 0x4d1277
mov bl, 1
mov eax, dword [ebp - 0x138]
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x140]
mov eax, edi
call fcn.004cec28
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4d11a8
test bl, bl
je 0x4d12a1
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_TerminateProcess
cmp esi, dword [ebp - 8]
je 0x4d12b1
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d12e3
lea eax, [ebp - 0x554]
mov edx, 5
call fcn.004047f0
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004047f0
ret
Function at 0x4d1790
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4d1917
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43e9dc]
call fcn.0043eadc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d18f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [ebp - 8]
mov edx, 0x4d192c
call fcn.00404864
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0043eb7c
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], 0
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043ebe4
test al, al
je 0x4d1857
mov edx, dword [0x4d0ad8]
mov eax, 0x14
call fcn.004056d0
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 8]
call fcn.00404820
lea eax, [ebx + 8]
mov edx, 0x4d1978
call fcn.00404820
lea ecx, [ebp - 0xc]
mov edx, 0x4d1978
mov eax, dword [ebp - 4]
call fcn.0043f160
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404820
mov edx, ebx
mov eax, esi
call fcn.0041a594
lea eax, [ebp - 8]
mov edx, 0x4d192c
call fcn.00404864
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.0043eb7c
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], 0
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043ebe4
test al, al
je 0x4d18df
mov edx, dword [0x4d0ad8]
mov eax, 0x14
call fcn.004056d0
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 8]
call fcn.00404820
lea eax, [ebx + 8]
mov edx, 0x4d1990
call fcn.00404820
lea ecx, [ebp - 0x10]
mov edx, 0x4d1990
mov eax, dword [ebp - 4]
call fcn.0043f160
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0xc]
call fcn.00404820
mov edx, ebx
mov eax, esi
call fcn.0041a594
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d18fc
mov eax, dword [ebp - 4]
call fcn.00403998
ret

Function at 0x4d1e64
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [0x533210]
mov eax, dword [eax]
call fcn.0048e660
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x4d1ea5
cmp eax, dword [esp]
pop edx
pop eax
ja 0x4d1e6f
pop esi
pop ebx
ret
pop edx
pop eax
jg 0x4d1e6f
pop esi
pop ebx
ret
Function at 0x4d1eac
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov dword [ebp - 8], 0xff
mov eax, dword [ebp - 8]
call fcn.004027bc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d1f06
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4d1ef0
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004049c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1f0d
mov eax, dword [ebp - 4]
call fcn.004027dc
ret

Function at 0x4d2234
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d23de
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 0x43
cmp byte [0x534fe0], 3
je 0x4d23c3
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004049b4
lea eax, [ebp - 8]
mov edx, 0x4d23f4
call fcn.00404a94
mov eax, dword [ebp - 8]
call fcn.00404c8c
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 2
je 0x4d22a5
sub eax, 2
je 0x4d22ec
dec eax
je 0x4d2333
dec eax
je 0x4d2377
jmp 0x4d23b9
lea eax, [ebp - 4]
call fcn.004047cc
lea eax, [ebp - 0xc]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.00403058
mov edx, 0x4d23f8
lea eax, [ebp - 0x10]
mov cl, 2
call fcn.00403028
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00404a30
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4d23b9
lea eax, [ebp - 4]
call fcn.004047cc
lea eax, [ebp - 0xc]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.00403058
mov edx, 0x4d23f8
lea eax, [ebp - 0x10]
mov cl, 2
call fcn.00403028
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00404a30
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4d23b9
lea eax, [ebp - 4]
call fcn.004047cc
lea eax, [ebp - 0xc]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.00403058
mov edx, 0x4d23f8
lea eax, [ebp - 0x10]
mov cl, 2
call fcn.00403028
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00404a30
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4d23b9
lea eax, [ebp - 4]
call fcn.004047cc
lea eax, [ebp - 0xc]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.00403058
mov edx, 0x4d23f8
lea eax, [ebp - 0x10]
mov cl, 2
call fcn.00403028
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00404a30
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
cmp bl, 0x5b
jne 0x4d2256
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d23e5
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047f0
ret
Function at 0x4d2d0c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d2dd8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.004031ac
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x40
mov eax, dword [0x533210]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x38], eax
mov eax, ebx
call fcn.00404c8c
mov dword [ebp - 0x30], eax
mov eax, 0x4d2de8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
call fcn.00404c8c
mov dword [ebp - 0x2c], eax
mov eax, esi
call fcn.00404c8c
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 1
call sub.user32.dll_GetFocus
mov esi, eax
xor eax, eax
call fcn.004855c8
mov ebx, eax
push 0
call sub.user32.dll_SetFocus
mov eax, dword [0x533210]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetActiveWindow
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
mov eax, ebx
call fcn.0048567c
push esi
call sub.user32.dll_SetFocus
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2ddf
lea eax, [ebp - 4]
call fcn.004047cc
ret
Function at 0x4d4158
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d4210
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004d3d00
test al, al
je 0x4d41f5
push 0x44
mov ecx, 0x4d421c
mov edx, 0x4d422c
mov eax, dword [0x533210]
mov eax, dword [eax]
call fcn.0048e99c
cmp eax, 6
jne 0x4d41f5
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00402b44
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00409954
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x4d42bc
call fcn.00404ad8
push 5
push 0x4d42d0
push 0x4d42d0
mov eax, dword [ebp - 4]
call fcn.00404c8c
push eax
push 0x4d42d4
mov eax, dword [0x533210]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x533210]
mov eax, dword [eax]
call fcn.0048e8f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4217
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004047f0
ret

Function at 0x4d5340
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d53b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
push ebx
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.00409dec
mov eax, dword [ebp - 0x104]
mov ecx, 3
xor edx, edx
call fcn.00404cec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d53b7
lea eax, [ebp - 0x104]
call fcn.004047cc
ret

Function at 0x4d53bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d549a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.00409dec
mov edx, dword [ebp - 4]
mov eax, 0x4d54b0
call fcn.00404dd0
dec eax
jl 0x4d5441
lea eax, [ebp - 0x110]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404cec
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 4]
mov ecx, 0x4d54c0
call fcn.00404ad8
jmp 0x4d546a
lea eax, [ebp - 0x114]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404cec
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x4d54d4
call fcn.00404ad8
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d54a1
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.004047f0
lea eax, [ebp - 4]
call fcn.004047cc
ret
Function at 0x4d5b2c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
call fcn.00404c7c
xor eax, eax
push ebp
push 0x4d5d57
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp + 0x10]
call fcn.00404c8c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4d5d24
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov dword [ebp - 0x10], 0x3e8
mov ebx, dword [ebp - 0x18]
dec ebx
test ebx, ebx
jl 0x4d5d24
inc ebx
mov dword [ebp - 0x30], 0
mov eax, dword [0x532ec0]
cmp byte [eax], 1
je 0x4d5d24
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x238]
push eax
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
cmp dword [ebp + 0x10], 0
jne 0x4d5c41
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x240], eax
mov byte [ebp - 0x23c], 6
lea edx, [ebp - 0x240]
xor ecx, ecx
mov eax, 0x4d5d70
call fcn.0040a2dc
jmp 0x4d5c88
push dword [ebp + 0x10]
push 0x4d5d7c
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x240], eax
mov byte [ebp - 0x23c], 6
lea edx, [ebp - 0x240]
xor ecx, ecx
mov eax, 0x4d5d70
call fcn.0040a2dc
push dword [ebp - 0x244]
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00404b4c
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x240], eax
mov byte [ebp - 0x23c], 6
lea edx, [ebp - 0x240]
xor ecx, ecx
mov eax, 0x4d5d70
call fcn.0040a2dc
lea edx, [ebp - 0x24c]
mov eax, esi
call fcn.004d1618
push dword [ebp - 0x24c]
push 0x4d5d7c
push dword [ebp - 0x34]
lea eax, [ebp - 0x248]
mov edx, 3
call fcn.00404b4c
mov edx, dword [ebp - 0x248]
mov eax, edi
call fcn.0046dddc
push esi
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004d54dc
mov dword [ebp - 0x10], 0x3e8
mov eax, dword [0x533210]
mov eax, dword [eax]
call fcn.0048e660
inc dword [ebp - 0x30]
dec ebx
jne 0x4d5be2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5d5e
lea eax, [ebp - 0x24c]
mov edx, 3
call fcn.004047f0
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.004047f0
lea eax, [ebp + 0x10]
call fcn.004047cc
ret
Function at 0x4d7f98
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d8076
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.00409dec
mov edx, dword [ebp - 4]
mov eax, 0x4d808c
call fcn.00404dd0
dec eax
jl 0x4d801d
lea eax, [ebp - 0x110]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404cec
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 4]
mov ecx, 0x4d809c
call fcn.00404ad8
jmp 0x4d8046
lea eax, [ebp - 0x114]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404cec
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x4d80b0
call fcn.00404ad8
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d807d
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.004047f0
lea eax, [ebp - 4]
call fcn.004047cc
ret
Function at 0x4da170
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4da263
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.004027bc
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x41828c]
call fcn.00403968
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4da234
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.004049c4
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, 0x4da278
call fcn.00404ad8
call fcn.0040affc
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x18]
call fcn.0040bce8
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 8]
mov edx, 0x4da294
call fcn.004ce5e0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da23b
mov eax, dword [ebp - 0x10]
call fcn.00403998
mov eax, dword [ebp - 4]
call fcn.004027dc
ret
Function at 0x4db7e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4db8c6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.00409dec
mov edx, dword [ebp - 4]
mov eax, 0x4db8dc
call fcn.00404dd0
dec eax
jl 0x4db86d
lea eax, [ebp - 0x110]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404cec
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 4]
mov ecx, 0x4db8ec
call fcn.00404ad8
jmp 0x4db896
lea eax, [ebp - 0x114]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404cec
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x4db900
call fcn.00404ad8
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db8cd
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.004047f0
lea eax, [ebp - 4]
call fcn.004047cc
ret
Function at 0x4dd604
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4dd6c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 0x43
mov eax, dword [0x532ec0]
cmp byte [eax], 1
je 0x4dd6ab
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004049b4
lea eax, [ebp - 0x10]
mov edx, 0x4dd6e0
call fcn.00404a94
mov eax, dword [ebp - 0x10]
call fcn.00404c8c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4dd6a5
lea eax, [ebp - 0x14]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.00403058
mov edx, 0x4dd6e4
lea eax, [ebp - 0x18]
mov cl, 2
call fcn.00403028
lea edx, [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00404a30
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.004dd940
inc ebx
cmp bl, 0x5b
jne 0x4dd62c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd6cd
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004047f0
ret