joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bf720
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ebx, dword [esi + 8]
mov ecx, ebx
call fcn.00434250
mov ecx, ebx
call fcn.00441810
test eax, eax
jne 0x4bf749
mov ecx, ebx
call fcn.00434260
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edx, dword [esi + 0x1078]
mov ecx, 0x10400
sub ecx, edx
cmp eax, ecx
jl 0x4bf75c
mov eax, ecx
mov ecx, dword [esi + 0x30]
push 0
push eax
lea eax, [edx + esi + 0x2228]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
test edi, edi
jle 0x4bf7c9
call ebp
mov ecx, dword [esi + 0x20]
sub eax, ecx
mov ecx, dword [esi + 0x18]
push eax
mov eax, edi
cdq
push edx
push eax
call fcn.00420370
call ebp
push edi
mov ecx, ebx
mov dword [esi + 0x20], eax
call fcn.004388a0
add dword [esi + 0x1078], edi
mov ecx, ebx
call fcn.00434260
mov ecx, esi
call fcn.004bf890
cmp eax, 5
ja case.0x4bf7b8.3
jmp dword [eax*4 + 0x4bf870]
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
ret
cmp edi, 0xffffffff
jne 0x4bf7a5
mov ecx, ebx
call fcn.00434260
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4bf7ac
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
ret
mov edx, dword [esi + 0x1c]
cmp dword [edx], 0
jne 0x4bf81c
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
ret
call ebp
mov ecx, dword [esi + 0x20]
mov edi, eax
mov eax, dword [esi + 0x24]
sub edi, ecx
cmp edi, eax
jbe 0x4bf742
mov ecx, dword [esi + 0x18]
call fcn.0041fd30
test eax, eax
je 0x4bf849
mov eax, dword [esi + 0x24]
shl eax, 1
cmp edi, eax
jbe 0x4bf742
mov ecx, dword [esi + 0x18]
push edi
push 0
push 0
call fcn.00420370
mov ecx, dword [esi + 0x10]
push 2
push 0xef22
call fcn.0047dac0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x4c3220
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x547440
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov esi, ecx
push 0
push 0xad
mov dword [esp + 0x14], esi
call fcn.00521b10
push fcn.0050d3fd
push 0x42c180
push 2
lea eax, [esi + 0x8c]
push 4
push eax
mov dword [esp + 0x30], 0
call fcn.004ee6c6
push ecx
mov byte [esp + 0x20], 1
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Schedule_PPG
mov dword [esi], 0x5573f0
call fcn.0050d46b
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
push ecx
call fcn.0042eff0
mov ecx, eax
call fcn.0043cb40
mov edx, dword [esp + 8]
mov byte [esp + 0x1c], 3
mov eax, dword [edx - 8]
test eax, eax
je 0x4c32cf
lea edi, [esi + 0x84]
lea eax, [esp + 8]
push eax
mov ecx, edi
call fcn.0050d536
mov eax, dword [esi + 0x60]
mov edi, dword [edi]
or al, 8
mov dword [esi + 0x70], edi
mov dword [esi + 0x60], eax
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 1
call fcn.0050d3fd
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x18
ret

Function at 0x4c6440
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x160
mov edx, dword [esp + 0x164]
mov ecx, 0x58
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x16c]
lea ecx, [esp + 4]
push eax
push 0x160
push ecx
push 0
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [esp + 8]
pop edi
add esp, 0x160
ret 8

Function at 0x4c7180
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x547928
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x164
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ecx, dword [esp + 0x184]
push 0x200
lea eax, [esp + 0x18]
push 0x160
push eax
push 0
push ecx
mov dword [esp + 0x190], 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
jne 0x4c71ed
lea ecx, [esp + 0x184]
mov dword [esp + 0x17c], 0xffffffff
call fcn.0050d3fd
xor eax, eax
jmp 0x4c728b
push 0
mov ecx, esi
call fcn.004c60d0
mov edx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x110a
push edx
call ebp
lea ecx, [esp + 0x184]
mov edi, eax
call fcn.0050d979
mov eax, dword [esi + 0x1c]
push 1
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push edi
push ecx
lea edx, [esp + 0x18c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0050d172
mov ecx, esi
call fcn.004c6d80
mov ebx, eax
mov eax, dword [esi + 0x1c]
push edi
push 1
push 0x110a
push eax
call ebp
test ebx, ebx
mov edi, eax
jne 0x4c725d
test edi, edi
jne 0x4c7227
mov ecx, dword [esi + 0x1c]
push 0
push 0xffffffffffffffeb
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, esi
call fcn.00513a2a
lea ecx, [esp + 0x184]
mov dword [esp + 0x17c], 0xffffffff
call fcn.0050d3fd
mov eax, ebx
mov ecx, dword [esp + 0x174]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x170
ret 4
Function at 0x4c73b0
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x547968
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
push edi
mov edi, ecx
lea esi, [edi + 4]
lea eax, [esp + 0x40]
push eax
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.0050d536
push str._Class
mov ecx, esi
call fcn.0050d7d9
mov eax, dword [esi]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4c746e
mov esi, dword [esi]
push 0
push esi
push 0
push 0
mov dword [edi], 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov esi, eax
test esi, esi
je 0x4c7448
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4c743a
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea ecx, [esp + 0x40]
mov dword [esp + 0x38], 0xffffffff
call fcn.0050d3fd
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 8
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0xb
call fcn.0051055c
mov dword [esp + 0xc], eax
call fcn.0052ba93
mov ecx, dword [esp + 0x44]
mov eax, dword [eax + 8]
and ecx, 0xffff
mov dword [esp + 0x18], eax
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov edx, dword [esp + 0x18]
push 0x7f00
push edx
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov esi, dword [esi]
mov dword [esp + 0x20], eax
lea eax, [esp + 8]
mov dword [esp + 0x24], 6
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], esi
call fcn.00511169
test eax, eax
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x40]
jne 0x4c750c
call fcn.0050d3fd
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 8
call fcn.0050d3fd
mov ecx, dword [esp + 0x30]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 8

Function at 0x4cd080
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push esi
mov esi, ecx
push edi
push 0
mov eax, dword [esi + 0x1c]
push 0
push 0x476
push eax
call ebx
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4cd0f8
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4cd0f8
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0x14], 0xffffff37
mov dword [esp + 0xc], ecx
mov ecx, esi
call fcn.005138ed
lea edx, [esp + 0xc]
mov dword [esp + 0x10], eax
push edx
push eax
push 0x4e
push edi
mov dword [esp + 0x28], 0
call ebx
test eax, eax
je 0x4cd0ef
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x4d2a10
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x548c08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x64]
test eax, eax
jne 0x4d2aba
mov eax, dword [0x591288]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.0050d82d
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.0050d87c
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.0050d7d9
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4d2aa1
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x4d2aa1
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x64], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.0050d3fd
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4d2ad0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4d2b32
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc

Function at 0x4d2d40
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x208
push ebx
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
push ebp
push 0
push eax
push str.iexplore.exe
push str.open
mov edi, ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4d2e32
lea ecx, [esp + 0x10]
push ecx
push str..htm
push SysReAllocStringLen
mov ecx, edi
call fcn.004d2ad0
test eax, eax
jne 0x4d2e32
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push SysReAllocStringLen
mov ecx, edi
call fcn.004d2ad0
test eax, eax
jne 0x4d2e32
lea edx, [esp + 0x10]
push str.__1_
push edx
call fcn.004efcb4
mov esi, eax
add esp, 8
test esi, esi
jne 0x4d2e03
lea eax, [esp + 0x10]
push 0x58b71c
push eax
call fcn.004ee070
mov esi, eax
add esp, 8
test esi, esi
jne 0x4d2e03
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x4d2e06
mov byte [esi], 0
push 0x588490
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
Function at 0x4d3c70
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, ecx
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esi + 0x10]
push ebx
push 1
push eax
mov eax, dword [esp + 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dword [esi + 4], edx
repne scasb al, byte es:[edi]
not ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 8], 1
test edx, edx
pop edi
pop esi
sete al
pop ebx
ret 8

Function at 0x4d43e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x108
push esi
mov esi, ecx
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x114]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x10]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x1c], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
pop esi
test eax, eax
jne 0x4d4449
mov ecx, dword [esp + 0x110]
lea edx, [esp + 8]
push edx
call fcn.0050d586
mov eax, 1
add esp, 0x108
ret 8
xor eax, eax
add esp, 0x108
ret 8

Function at 0x4d4b10
Capabilities:
Delete registry value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push eax
mov ecx, dword [esi + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor ecx, ecx
xor edx, edx
cmp eax, ecx
mov dword [esi + 4], eax
sete dl
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov eax, edx
pop esi
ret 4

Function at 0x4d4b40
Capabilities:
Delete registry key

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push eax
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor ecx, ecx
xor edx, edx
cmp eax, ecx
mov dword [esi + 4], eax
sete dl
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov eax, edx
pop esi
ret 8
Function at 0x4d4b87
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get kernel32 base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x548ea3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [0x591288]
lea ecx, [esi + 0x40]
xor ebx, ebx
mov dword [ecx], eax
mov edx, dword [0x591288]
mov dword [ecx + 4], edx
mov eax, dword [0x591288]
mov dword [ecx + 8], eax
mov edx, dword [0x591288]
mov dword [ecx + 0xc], edx
mov eax, dword [0x591288]
mov dword [ecx + 0x10], eax
mov edx, dword [0x591288]
mov dword [ecx + 0x14], edx
mov eax, dword [0x591288]
mov dword [ecx + 0x18], eax
mov edx, dword [0x591288]
mov dword [ecx + 0x1c], edx
mov eax, dword [0x591288]
mov dword [ecx + 0x20], eax
mov edx, dword [0x591288]
mov dword [ecx + 0x24], edx
mov eax, dword [0x591288]
mov dword [ecx + 0x28], eax
mov edx, dword [0x591288]
mov dword [ecx + 0x2c], edx
mov eax, dword [0x591288]
mov dword [ecx + 0x30], eax
mov edx, dword [0x591288]
mov dword [ecx + 0x34], edx
mov eax, dword [0x591288]
mov dword [esp + 0x14], ebx
mov dword [ecx + 0x38], eax
push 0x596660
mov byte [esp + 0x18], 1
mov dword [esi], method.CCommandLineInfo.virtual_0
call fcn.0050d586
push 0x596660
lea ecx, [esi + 0x44]
call fcn.0050d586
push 0x596660
lea ecx, [esi + 0x48]
call fcn.0050d586
push 0x596660
lea ecx, [esi + 0x4c]
call fcn.0050d586
push 0x596660
lea ecx, [esi + 0x50]
call fcn.0050d586
push 0x596660
lea ecx, [esi + 0x54]
call fcn.0050d586
push 0x596660
lea ecx, [esi + 0x58]
call fcn.0050d586
push 0x596660
lea ecx, [esi + 0x5c]
call fcn.0050d586
push 0x596660
lea ecx, [esi + 0x60]
call fcn.0050d586
push 0x596660
lea ecx, [esi + 0x64]
call fcn.0050d586
push 0x596660
lea ecx, [esi + 0x68]
call fcn.0050d586
push 0x596660
lea ecx, [esi + 0x6c]
call fcn.0050d586
push 0x596660
lea ecx, [esi + 0x70]
call fcn.0050d586
push 0x596660
lea ecx, [esi + 0x74]
call fcn.0050d586
mov ecx, dword [esp + 0xc]
mov word [esi + 0x7c], bx
mov word [esi + 0x7e], bx
mov dword [esi + 8], ebx
mov byte [esi + 0x80], bl
mov byte [esi + 0x81], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4d4d20
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x548f5a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], method.CCommandLineInfo.virtual_0
mov eax, dword [esi + 8]
mov dword [esp + 0x14], 1
test eax, eax
je 0x4d4d5d
push eax
call fcn.0050d161
add esp, 4
add esi, 0x40
mov dword [esp + 8], esi
lea ecx, [esi + 0x38]
mov byte [esp + 0x14], 0xf
call fcn.0050d3fd
lea ecx, [esi + 0x34]
mov byte [esp + 0x14], 0xe
call fcn.0050d3fd
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 0xd
call fcn.0050d3fd
lea ecx, [esi + 0x2c]
mov byte [esp + 0x14], 0xc
call fcn.0050d3fd
lea ecx, [esi + 0x28]
mov byte [esp + 0x14], 0xb
call fcn.0050d3fd
lea ecx, [esi + 0x24]
mov byte [esp + 0x14], 0xa
call fcn.0050d3fd
lea ecx, [esi + 0x20]
mov byte [esp + 0x14], 9
call fcn.0050d3fd
lea ecx, [esi + 0x1c]
mov byte [esp + 0x14], 8
call fcn.0050d3fd
lea ecx, [esi + 0x18]
mov byte [esp + 0x14], 7
call fcn.0050d3fd
lea ecx, [esi + 0x14]
mov byte [esp + 0x14], 6
call fcn.0050d3fd
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 5
call fcn.0050d3fd
lea ecx, [esi + 0xc]
mov byte [esp + 0x14], 4
call fcn.0050d3fd
lea ecx, [esi + 8]
mov byte [esp + 0x14], 3
call fcn.0050d3fd
lea ecx, [esi + 4]
mov byte [esp + 0x14], 2
call fcn.0050d3fd
mov ecx, esi
mov byte [esp + 0x14], 0
call fcn.0050d3fd
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4d4e90
Capabilities:
Get file version info

Disassembly:
sub esp, 0x110
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebx + 0x40]
mov eax, dword [edi - 8]
test eax, eax
jne 0x4d4eb1
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x110
ret
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
ja 0x4d4ef3
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x110
ret
mov eax, dword [ebx + 8]
test eax, eax
je 0x4d4f0a
push eax
call fcn.0050d161
add esp, 4
mov dword [ebx + 8], 0
push esi
call fcn.0050d138
add esp, 4
mov dword [ebx + 8], eax
push eax
push esi
lea eax, [esp + 0x20]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x4d4f34
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x110
ret
mov eax, dword [ebx + 8]
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
push edx
push 0x588788
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x4d4f5c
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x110
ret
mov esi, dword [esp + 0xc]
lea edi, [ebx + 0xc]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.004d51f0
test al, al
jne 0x4d4f7f
pop edi
pop esi
pop ebx
add esp, 0x110
ret
mov ecx, ebx
call fcn.004d4fb0
test al, al
jne 0x4d4f94
pop edi
pop esi
pop ebx
add esp, 0x110
ret
mov al, 1
pop edi
mov byte [ebx + 0x80], al
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x4d5c50
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x104
push ebx
push esi
mov esi, ecx
mov al, byte [esi + 0x80]
test al, al
jne 0x4d5d6d
call fcn.004d4e90
mov bl, al
test bl, bl
je 0x4d5d74
push edi
mov edi, dword [esp + 0x114]
lea eax, [esi + 0x40]
mov ecx, edi
push eax
call fcn.0050d536
lea ecx, [esi + 0x44]
push ecx
lea ecx, [edi + 4]
call fcn.0050d536
lea edx, [esi + 0x48]
lea ecx, [edi + 8]
push edx
call fcn.0050d536
lea eax, [esi + 0x4c]
lea ecx, [edi + 0xc]
push eax
call fcn.0050d536
lea ecx, [esi + 0x50]
push ecx
lea ecx, [edi + 0x10]
call fcn.0050d536
lea edx, [esi + 0x54]
lea ecx, [edi + 0x14]
push edx
call fcn.0050d536
lea eax, [esi + 0x58]
lea ecx, [edi + 0x18]
push eax
call fcn.0050d536
lea ecx, [esi + 0x5c]
push ecx
lea ecx, [edi + 0x1c]
call fcn.0050d536
lea edx, [esi + 0x60]
lea ecx, [edi + 0x20]
push edx
call fcn.0050d536
lea eax, [esi + 0x64]
lea ecx, [edi + 0x24]
push eax
call fcn.0050d536
lea ecx, [esi + 0x68]
push ecx
lea ecx, [edi + 0x28]
call fcn.0050d536
lea edx, [esi + 0x6c]
lea ecx, [edi + 0x2c]
push edx
call fcn.0050d536
lea eax, [esi + 0x70]
lea ecx, [edi + 0x30]
push eax
call fcn.0050d536
lea ecx, [esi + 0x74]
push ecx
lea ecx, [edi + 0x34]
call fcn.0050d536
mov dx, word [esi + 4]
lea ecx, [esp + 0xc]
mov word [edi + 0x3c], dx
mov ax, word [esi + 6]
xor edx, edx
mov word [edi + 0x3e], ax
mov dx, word [esi + 4]
push 0x104
push ecx
push 0x1001
push edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [esp + 0xc]
lea ecx, [edi + 0x38]
push eax
call fcn.0050d586
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0x104
ret 4
mov bl, 1
jmp 0x4d5c77
mov al, bl
pop esi
pop ebx
add esp, 0x104
ret 4
Function at 0x4d9c60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x4d9c6f
xor eax, eax
pop esi
ret 0xc
mov eax, dword [0x58fe10]
test eax, eax
je 0x4d9c7d
call fcn.004d9c00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
cmp edx, 8
push ebx
not eax
jb 0x4d9d7f
push edi
mov edi, edx
shr edi, 3
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [ecx*4 + 0x59a5a4]
sub edx, 8
xor eax, ebx
inc esi
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x59a5a4]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x59a5a4]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x59a5a4]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x59a5a4]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x59a5a4]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x59a5a4]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x59a5a4]
xor eax, ecx
inc esi
dec edi
jne 0x4d9c97
pop edi
test edx, edx
je 0x4d9da1
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x59a5a4]
xor eax, ecx
inc esi
dec edx
jne 0x4d9d83
pop ebx
pop esi
not eax
ret 0xc
Function at 0x4dc2dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4dc332
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x5599cc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4dc325
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4dc334
xor eax, eax
pop esi
leave
ret 4

Function at 0x4dcea0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret
Function at 0x4e03a0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret

Function at 0x4eea4a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4eea6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004f1a66
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4eea8d
test byte [esp + 8], 2
je 0x4eea8d
call fcn.004f1ad9
mov dword [eax], 0xd
call fcn.004f1ae2
mov dword [eax], 5
jmp 0x4eea66
xor eax, eax
ret