joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ef24
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x55fc18]
cmp dword [eax + 0x30], 0
je 0x48efce
cmp dword [ebx + 0x94], 0
jne 0x48efc8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x48eeb4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x48efc8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x48ef8e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x48efc8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419ffc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x48ef9d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x48fb30
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x48fb65
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004042d0
jmp 0x48fb72
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404234
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x490c7c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x490cbd
mov eax, esi
call fcn.00476bfc
test al, al
je 0x490cbd
mov eax, dword [ebx + 0x84]
call fcn.004768f8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x490cbd
push 0
mov eax, dword [ebx + 0x84]
call fcn.004768f8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4931d4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49333d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404278
mov eax, dword [ebp - 0x10]
call fcn.00492bfc
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x493226
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404740
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049385c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4932fb
xor eax, eax
push ebp
push 0x4932f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00492e50
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0049336c
test al, al
je 0x4932d2
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004042d0
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4932d2
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004046a0
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x4932cc
mov eax, dword [ebp - 0x14]
call fcn.004046a0
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004043d8
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004931d4
dec ebx
cmp ebx, 0xffffffff
jne 0x493285
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4932fb
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00492e50
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.004046a0
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00492e3c
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493344
lea eax, [ebp - 0x3c]
call fcn.004041e0
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404204
ret
Function at 0x4932fb
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49333d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404278
mov eax, dword [ebp - 0x10]
call fcn.00492bfc
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x493226
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404740
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049385c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4932fb
xor eax, eax
push ebp
push 0x4932f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00492e50
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0049336c
test al, al
je 0x4932d2
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004042d0
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4932d2
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004046a0
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x4932cc
mov eax, dword [ebp - 0x14]
call fcn.004046a0
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004043d8
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004931d4
dec ebx
cmp ebx, 0xffffffff
jne 0x493285
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4932fb
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00492e50
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.004046a0
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00492e3c
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493344
lea eax, [ebp - 0x3c]
call fcn.004041e0
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404204
ret

Function at 0x49336c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402d20
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x55ecf8]
cmp byte [edx + 0xc], 0
je 0x4933d0
mov edx, dword [0x55eccc]
cmp dword [edx], 2
jne 0x4933d0
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x4933d4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x49348c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0049336c
test al, al
je 0x49346e
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004042d0
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x49346e
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004046a0
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.004046a0
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004043d8
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x493427
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x493493
lea eax, [ebp - 0x2c]
call fcn.004041e0
lea eax, [ebp - 0xc]
call fcn.004041e0
ret

Function at 0x49349c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x493554
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0049336c
test al, al
je 0x493536
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004042d0
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x493536
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004046a0
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.004046a0
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004043d8
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x4934ef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49355b
lea eax, [ebp - 0x2c]
call fcn.004041e0
lea eax, [ebp - 0xc]
call fcn.004041e0
ret
Function at 0x493770
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00492c10
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.004046a0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4937ce
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x55e678]
mov dl, 1
mov eax, dword [0x492b08]
call fcn.0040cd80
call fcn.00403b78
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4937d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004046a0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x493830
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x55ed0c]
mov dl, 1
mov eax, dword [0x492b08]
call fcn.0040cd80
call fcn.00403b78
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00492c40
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4967e8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x496816
mov eax, ebx
call fcn.0049729c
cmp dword [ebx + 0x40], 0
je 0x49680f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x496887
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x496879
cmp dword [ebx + 8], 0
je 0x496838
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x49684a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x496879
cmp dword [ebx + 8], 0
je 0x49682b
cmp eax, 3
je 0x49685d
dec eax
jne 0x49682b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x49682b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x49682b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4968a5
cmp dword [ebx + 0x14], 0xcc
je 0x4968a5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004968b0
pop ebx
ret

Function at 0x4adf4c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00407324
ret
Function at 0x4b6948
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4b6950
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b6b42
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4b6b58
mov eax, esi
call fcn.004b46c4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404234
lea ecx, [ebp - 0x10]
mov edx, 0x4b6b6c
mov eax, esi
call fcn.004b46c4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404234
lea ecx, [ebp - 0x14]
mov edx, 0x4b6b84
mov eax, esi
call fcn.004b46c4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404234
lea ecx, [ebp - 0x18]
mov edx, 0x4b6ba0
mov eax, esi
call fcn.004b46c4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404234
lea ecx, [ebp - 0x1c]
mov edx, 0x4b6bbc
mov eax, esi
call fcn.004b46c4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404234
lea ecx, [ebp - 0x24]
mov edx, 0x4b6bd4
mov eax, esi
call fcn.004b46c4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408874
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408ee0
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4b6bec
mov eax, esi
call fcn.004b46c4
mov eax, dword [ebp - 0x28]
call fcn.004aced8
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4b6bfc
mov eax, esi
call fcn.004b46c4
mov eax, dword [ebp - 0x2c]
call fcn.004aced8
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4b6c14
mov eax, esi
call fcn.004b46c4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408ee0
inc eax
je 0x4b6ae5
lea ecx, [ebp - 0x34]
mov edx, 0x4b6c14
mov eax, esi
call fcn.004b46c4
mov eax, dword [ebp - 0x34]
call fcn.00408ea4
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040aa68
fstp qword [ebp - 0x3c]
wait
call fcn.0040ae68
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4b6b00
lea ecx, [ebp - 0x40]
mov edx, 0x4b6c14
mov eax, esi
call fcn.004b46c4
mov eax, dword [ebp - 0x40]
call fcn.004aced8
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4b6c24
mov eax, esi
call fcn.004b46c4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404234
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6b49
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404204
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404204
ret
Function at 0x4bd8d4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4bd92e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004bd8c4
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004ab98c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004ab58c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd935
lea eax, [ebp - 4]
call fcn.004041e0
ret

Function at 0x4c0fb4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x55c90c]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x55c90c]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x55c90c]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x55c90c]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x55c490]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x4c0fdf
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4c4d44
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4c4e3c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.00402730
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4c4e0d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.004043d8
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, 0x4c4e50
call main
call fcn.0040ae3c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x18]
mov eax, 0x4c4e68
call fcn.0040bae4
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 8]
mov edx, 0x4c4e7c
call fcn.004c3ed0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4e14
mov eax, dword [ebp - 0x10]
call fcn.004033ac
mov eax, dword [ebp - 4]
call fcn.00402750
ret

Function at 0x4c68d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4c6921
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4c6908
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4c68f8
jmp 0x4c6921
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4c6909
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d70f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4d71e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
lea eax, [ebp - 4]
call fcn.00545780
push 1
push 0x4d71f8
push dword [ebp - 4]
push 0x4d720c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 8]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 1
push 0x4d71f8
push dword [ebp - 4]
push 0x4d7228
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0xc]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push ebx
push esi
mov ecx, edi
mov edx, 0x4d7244
mov eax, 0x4d7258
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d71e8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret
Function at 0x4d75dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4d76ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov ebx, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
lea eax, [ebp - 4]
call fcn.00545780
push 1
push 0x4d7718
push dword [ebp - 4]
push 0x4d772c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 8]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 1
push 0x4d7718
push dword [ebp - 4]
push 0x4d7748
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404560
mov eax, dword [ebp - 0xc]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push ebx
push esi
mov ecx, edi
mov edx, 0x4d7764
mov eax, 0x4d7778
call fcn.00548a30
mov eax, esi
call fcn.00548fd8
mov eax, ebx
call fcn.00549048
mov eax, 0x4d7790
call fcn.005479e4
mov eax, 0x4d77b0
call fcn.005479e4
mov eax, 0x4d77d0
call fcn.005479e4
mov eax, 0x4d77f0
call fcn.005479e4
mov eax, 0x4d7804
call fcn.005479e4
mov eax, edi
call fcn.004033ac
mov eax, ebx
call fcn.004033ac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7706
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404204
ret

Function at 0x4d8d00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x108], ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d8d9a
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
push 0x4d8da8
call sub.kernel32.dll_GetEnvironmentVariableA
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404450
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 4]
mov ecx, 0x4d8dc0
call main
cmp dword [ebp - 4], 0
je 0x4d8d79
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00546d9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8da1
lea eax, [ebp - 0x108]
call fcn.004041e0
lea eax, [ebp - 4]
call fcn.004041e0
ret