joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4afda8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x13
push 0
push 0
dec ecx
jne 0x4afdb1
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4affbc
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
movzx eax, byte [ebx + 0x75]
call fcn.0041c98c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x58]
mov edx, dword [ebx + 0xa8]
mov eax, esi
call fcn.004748d0
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.00475a64
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0xb
lea ecx, [ebp - 0x60]
mov edx, dword [ebx + 0xac]
mov eax, edi
call fcn.004748d0
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00475a64
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0xb
lea ecx, [ebp - 0x68]
mov edx, dword [ebx + 0xb0]
mov eax, dword [ebp + 0x28]
call fcn.004748d0
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.00475a64
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0xb
lea ecx, [ebp - 0x70]
mov edx, dword [ebx + 0xb4]
mov eax, dword [ebp + 0x24]
call fcn.004748d0
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x6c]
call fcn.00475a64
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0xb
lea ecx, [ebp - 0x78]
mov edx, dword [ebx + 0xb8]
mov eax, dword [ebp + 0x20]
call fcn.004748d0
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x74]
call fcn.00475a64
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0xb
lea ecx, [ebp - 0x80]
mov edx, dword [ebx + 0xbc]
mov eax, dword [ebp + 0x1c]
call fcn.004748d0
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x7c]
call fcn.00475a64
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
lea ecx, [ebp - 0x88]
mov edx, dword [ebx + 0xc0]
mov eax, dword [ebp + 0x18]
call fcn.004748d0
mov eax, dword [ebp - 0x88]
lea edx, [ebp - 0x84]
call fcn.00475a64
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea ecx, [ebp - 0x90]
mov edx, dword [ebx + 0xc4]
mov eax, dword [ebp + 0x14]
call fcn.004748d0
mov eax, dword [ebp - 0x90]
lea edx, [ebp - 0x8c]
call fcn.00475a64
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea ecx, [ebp - 0x98]
mov edx, dword [ebx + 0xc8]
mov eax, dword [ebp + 0x10]
call fcn.004748d0
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x94]
call fcn.00475a64
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea ecx, [ebp - 0xa0]
mov edx, dword [ebx + 0xcc]
mov eax, dword [ebp + 0xc]
call fcn.004748d0
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x9c]
call fcn.00475a64
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea edx, [ebp - 0x50]
mov ecx, 9
mov eax, 0x4affd4
call fcn.0044b944
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4affc3
lea eax, [ebp - 0xa0]
mov edx, 0x14
call fcn.00405df4
ret
Function at 0x4b05fc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040626c
xor eax, eax
push ebp
push 0x4b0761
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 2
mov edx, dword [ebp - 4]
mov eax, 0x4b0778
call fcn.00473bec
mov ebx, eax
lea ecx, [ebx + 1]
mov edx, dword [ebp - 4]
mov eax, 0x4b0778
call fcn.00473bec
mov ebx, eax
mov esi, dword [ebp - 4]
test esi, esi
je 0x4b065d
sub esi, 4
mov esi, dword [esi]
push edi
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004062e4
mov eax, dword [ebp - 4]
test eax, eax
je 0x4b0676
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 4]
mov ecx, eax
mov eax, ebx
xchg edx, eax
call fcn.00406324
mov bl, 0x41
lea eax, [ebp - 8]
mov edx, 0x2800
call fcn.0040650c
mov esi, dword [ebp - 8]
test esi, esi
je 0x4b069e
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebp - 8]
call fcn.0040627c
push eax
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00405fb8
lea eax, [ebp - 0xc]
mov edx, 0x4b0784
call fcn.004060b8
mov eax, dword [ebp - 0xc]
call fcn.0040627c
push eax
call sub.kernel32.dll_QueryDosDeviceA
test eax, eax
je 0x4b0735
mov eax, dword [ebp - 8]
call fcn.0040627c
call fcn.0044b064
mov edx, eax
lea eax, [ebp - 8]
call fcn.0040650c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004492b8
test al, al
je 0x4b0735
lea eax, [ebp - 0x14]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.00403fc8
mov edx, 0x4b0788
lea eax, [ebp - 0x18]
mov cl, 2
call fcn.00403f98
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00406034
mov edx, dword [ebp - 0x10]
mov ecx, dword [edi]
mov eax, edi
call fcn.00406104
jmp 0x4b0746
inc ebx
cmp bl, 0x5b
jne 0x4b0685
mov eax, edi
call fcn.00405dd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0768
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405df4
ret
Function at 0x4b1f00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x4b1fd3
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 8]
call fcn.00406730
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004494bc
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00406074
cmp dword [edi], 0
je 0x4b1fab
mov eax, dword [edi]
cmp byte [eax], 0x22
jne 0x4b1f62
push edi
mov eax, dword [edi]
mov ecx, 0x7fffffff
mov edx, 2
call fcn.004062e4
mov bl, 0x22
jmp 0x4b1f64
mov bl, 0x20
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00405fb8
mov eax, dword [ebp - 0xc]
mov edx, dword [edi]
call fcn.004063c8
mov esi, eax
test esi, esi
jle 0x4b1f90
push edi
lea edx, [esi + 1]
mov eax, dword [edi]
mov ecx, 0x7fffffff
call fcn.004062e4
jmp 0x4b1f97
mov eax, edi
call fcn.00405dd0
lea edx, [ebp - 0x10]
mov eax, dword [edi]
call fcn.00449434
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00405e24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1fda
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405df4
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040660c
ret

Function at 0x4b25d8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b26d1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x400
call fcn.00406a9c
mov eax, dword [ebp - 4]
call fcn.004067c8
add eax, eax
push eax
mov eax, dword [ebp - 4]
call fcn.004067b8
xor ecx, ecx
pop edx
call fcn.0040d87c
mov eax, dword [ebp - 4]
call fcn.004067c8
sar eax, 1
jns 0x4b2635
adc eax, 0
push eax
mov eax, dword [ebp - 4]
call fcn.004067b8
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405ff8
cmp dword [ebx], 0
jne 0x4b26b3
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.0040650c
lea eax, [ebp - 8]
call fcn.004062dc
mov edx, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x4b267e
sub eax, 4
mov eax, dword [eax]
xor ecx, ecx
xchg edx, eax
call fcn.0040d87c
mov esi, dword [ebp - 8]
test esi, esi
je 0x4b2692
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebp - 8]
call fcn.0040627c
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00405fc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b26d8
lea eax, [ebp - 8]
call fcn.00405dd0
lea eax, [ebp - 4]
call fcn.004065f4
ret
Function at 0x4b2918
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [ebp - 1], 0
push 0x4b29d4
call fcn.0040e070
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
test ebx, ebx
je 0x4b2995
lea eax, [ebp - 0x41]
xor ecx, ecx
mov edx, 0x40
call fcn.0040d87c
mov dword [ebp - 0x41], 0x40
lea eax, [ebp - 0x41]
push eax
call ebx
test eax, eax
je 0x4b2995
mov eax, dword [ebp - 0x39]
mov dword [edi], eax
mov eax, dword [ebp - 0x35]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x31]
mov dword [esi], eax
mov eax, dword [ebp - 0x2d]
mov dword [esi + 4], eax
mov byte [ebp - 1], 1
jmp 0x4b29c8
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x20
call fcn.0040d87c
mov dword [ebp - 0x64], 0x20
lea eax, [ebp - 0x64]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x5c]
xor edx, edx
mov dword [edi], eax
mov dword [edi + 4], edx
mov eax, dword [ebp - 0x58]
xor edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b29ec
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0x10]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0042eff0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov edx, ebx
lea eax, [ebp - 0x10]
mov ecx, 8
call fcn.0040d904
mov byte [ebp - 5], 0
push 0x4b2b84
call fcn.0040e234
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
test ebx, ebx
je 0x4b2af2
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x2c
call fcn.0040d87c
mov dword [ebp - 0x3c], 0x2c
push 0x2c
lea eax, [ebp - 0x3c]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call ebx
test eax, eax
je 0x4b2a80
mov al, 1
jmp 0x4b2aaa
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x2c
call fcn.0040d87c
mov dword [ebp - 0x3c], 0x28
push 0x2c
lea eax, [ebp - 0x3c]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call ebx
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4b2af2
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [edi], eax
mov dword [edi + 4], edx
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x4b2ad8
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
jmp 0x4b2ae1
mov eax, ecx
xor edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov byte [ebp - 5], 1
push 0x4b2b9c
call fcn.0040e070
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
test ebx, ebx
je 0x4b2b47
lea eax, [ebp - 0x9c]
xor ecx, ecx
mov edx, 0x40
call fcn.0040d87c
mov dword [ebp - 0x9c], 0x40
lea eax, [ebp - 0x9c]
push eax
call ebx
test eax, eax
je 0x4b2b47
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x70]
sub eax, dword [ebp - 0x6c]
sbb edx, dword [ebp - 0x68]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
jmp 0x4b2b76
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x20
call fcn.0040d87c
mov dword [ebp - 0x5c], 0x20
lea eax, [ebp - 0x5c]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x40]
xor edx, edx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], edx
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b5298
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b53fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405dd0
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.0040627c
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4b53db
mov eax, dword [ebp - 8]
call fcn.00403498
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4b53d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4b53bb
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4b540c
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4b53bb
push 0x4b5430
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov edx, 4
call fcn.00449e90
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.00449e90
push dword [ebp - 0x20]
push 0x4b544c
lea eax, [ebp - 4]
mov edx, 4
call fcn.00406180
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.0040627c
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4b53bb
cmp dword [ebp - 0x10], 1
jbe 0x4b53bb
mov ebx, dword [ebp - 0x18]
mov eax, ebx
call fcn.0044b064
mov ecx, eax
mov eax, esi
mov edx, ebx
call fcn.00405ec0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b53db
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.004034b4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5405
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00405df4
lea eax, [ebp - 4]
call fcn.00405dd0
ret
Function at 0x4b5494
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0040626c
xor eax, eax
push ebp
push 0x4b5579
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405dd0
cmp dword [ebp - 4], 0
je 0x4b54e4
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x4b54e4
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00406324
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.0040627c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4b5563
mov eax, ebx
mov edx, 0x400
call fcn.0040650c
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4b551f
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.0040627c
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x4b5553
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.0040650c
jmp 0x4b555a
mov eax, ebx
call fcn.00405dd0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5580
lea eax, [ebp - 4]
call fcn.00405dd0
ret

Function at 0x4b5588
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040626c
mov eax, dword [ebp - 8]
call fcn.0040626c
xor eax, eax
push ebp
push 0x4b565e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x4b55da
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x4b55da
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00406324
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.0040627c
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4b5643
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040627c
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4b563a
cmp dword [ebp - 0x14], 4
jne 0x4b563a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5665
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405df4
ret
Function at 0x4b5f78
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push 0x4b600c
call sub.kernel32.dll_GetModuleHandleA_2
test eax, eax
je 0x4b5f9b
mov eax, ebx
mov edx, 0x4b6020
call fcn.00405e24
pop ebx
pop ebp
ret
push 0
push ebx
mov ecx, 0x4b6034
mov edx, 0x4b6048
mov eax, 0x80000002
call fcn.004c0338
mov eax, dword [ebx]
mov edx, 0x4b607c
call fcn.00406214
jne 0x4b5fcc
mov eax, ebx
mov edx, 0x4b609c
call fcn.00405e24
mov eax, dword [ebx]
mov edx, 0x4b60ac
call fcn.00406214
jne 0x4b5fe6
mov eax, ebx
mov edx, 0x4b60cc
call fcn.00405e24
mov eax, dword [ebx]
mov edx, 0x4b60e0
call fcn.00406214
jne 0x4b6002
mov eax, ebx
mov edx, 0x4b6100
call fcn.00405e24
jmp 0x4b6009
mov eax, ebx
call fcn.00405dd0
pop ebx
pop ebp
ret

Function at 0x4b63d4
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
call fcn.004b6108
test al, al
jne 0x4b63e7
xor eax, eax
jmp 0x4b6421
mov dword [ebp - 4], 0x40000000
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004b315c
cmp dword [ebp - 8], 0x61774d56
jne 0x4b641b
cmp dword [ebp - 0xc], 0x4d566572
jne 0x4b641b
cmp dword [ebp - 0x10], 0x65726177
je 0x4b641f
xor eax, eax
jmp 0x4b6421
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4b661c
Capabilities:
Reference processor manufacturer constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, dword [ebp + 8]
add ebx, 0xfffffff3
mov dword [ebp - 4], 0x40000000
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004b315c
cmp dword [ebp - 8], 0x7263694d
jne 0x4b665d
cmp dword [ebp - 0xc], 0x666f736f
jne 0x4b665d
cmp dword [ebp - 0x10], 0x76482074
je 0x4b6661
xor eax, eax
jmp 0x4b6663
mov al, 1
movzx edx, byte [ebp - 8]
and dl, 0xff
mov byte [ebx], dl
mov edx, dword [ebp - 8]
shr edx, 8
and dl, 0xff
mov byte [ebx + 1], dl
mov edx, dword [ebp - 8]
shr edx, 0x10
and dl, 0xff
mov byte [ebx + 2], dl
mov edx, dword [ebp - 8]
shr edx, 0x18
and dl, 0xff
mov byte [ebx + 3], dl
movzx edx, byte [ebp - 0xc]
and dl, 0xff
mov byte [ebx + 4], dl
mov edx, dword [ebp - 0xc]
shr edx, 8
and dl, 0xff
mov byte [ebx + 5], dl
mov edx, dword [ebp - 0xc]
shr edx, 0x10
and dl, 0xff
mov byte [ebx + 6], dl
mov edx, dword [ebp - 0xc]
shr edx, 0x18
and dl, 0xff
mov byte [ebx + 7], dl
movzx edx, byte [ebp - 0x10]
and dl, 0xff
mov byte [ebx + 8], dl
mov edx, dword [ebp - 0x10]
shr edx, 8
and dl, 0xff
mov byte [ebx + 9], dl
mov edx, dword [ebp - 0x10]
shr edx, 0x10
and dl, 0xff
mov byte [ebx + 0xa], dl
mov edx, dword [ebp - 0x10]
shr edx, 0x18
and dl, 0xff
mov byte [ebx + 0xb], dl
mov byte [ebx + 0xc], 0
test al, al
je 0x4b6717
mov dword [ebp - 4], 0x40000001
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004b315c
cmp dword [ebp - 4], 0x31237648
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b6a80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x4b6ba4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x662b7c], 0xff
je 0x4b6aae
movzx ebx, byte [0x662b7c]
jmp 0x4b6b89
xor ebx, ebx
call fcn.004202ac
test al, al
jne 0x4b6b89
mov eax, dword [0x66b984]
cmp dword [eax], 0
je 0x4b6b89
push 4
lea eax, [ebp - 4]
push eax
push 0x4b6bb4
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
ja 0x4b6b89
push 4
lea eax, [ebp - 4]
push eax
push 0x4b6bcc
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
ja 0x4b6b89
call fcn.004039a4
mov esi, eax
test esi, esi
jle 0x4b6b38
mov dword [ebp - 4], 1
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00403a04
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0041f130
mov eax, dword [ebp - 8]
mov edx, 0x4b6be8
call fcn.00406214
je 0x4b6b89
inc dword [ebp - 4]
dec esi
jne 0x4b6b0d
xor eax, eax
call fcn.0046ac48
test al, al
je 0x4b6b7d
xor edx, edx
xor eax, eax
call fcn.0046ac5c
xor eax, eax
push ebp
push 0x4b6b76
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004b695c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6b82
mov dl, 1
xor eax, eax
call fcn.0046ac5c
ret
call fcn.004b695c
movzx ebx, byte [0x662b7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6bab
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405df4
ret
Function at 0x4b6f58
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b7109
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405dd0
lea eax, [ebp - 0xc]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4b70e6
xor eax, eax
push ebp
push 0x4b70df
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [ebp - 0x10]
call fcn.00403498
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4b70c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x4b70ab
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
dec edi
test edi, edi
jl 0x4b70ab
inc edi
xor ebx, ebx
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x14]
add edx, 4
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [edx + eax*4 + 4]
mov dword [ebp - 0x1c], ecx
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x14]
add edx, 4
mov eax, dword [edx + eax*4 + 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.0040650c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040627c
push eax
lea eax, [ebp - 0x20]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.0040650c
push dword [esi]
lea ecx, [ebp - 0x24]
mov edx, 0x1f
mov eax, dword [ebp - 8]
call fcn.004b6f10
push dword [ebp - 0x24]
push ebp
lea eax, [ebp - 0x28]
call fcn.004b6df4
pop ecx
push dword [ebp - 0x28]
push 0x4b7120
mov eax, esi
mov edx, 4
call fcn.00406180
inc ebx
dec edi
jne 0x4b7006
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b70c8
mov eax, dword [ebp - 0x14]
call fcn.004034b4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7110
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405df4
lea eax, [ebp - 8]
call fcn.00405dd0
ret