joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c4042
Capabilities:
Hide graphical window

Disassembly:
push 0x1e4
mov eax, 0x553579
call fcn.00514880
mov dword [ebp - 0x1e4], ecx
xor ebx, ebx
mov dword [ebp - 0x1f0], ebx
mov dword [ebp - 0x1ec], ebx
mov dword [ebp - 0x1e8], ebx
push 0x4c
pop ecx
mov esi, str.BN7d0AM0rgVIvI5FrshuSjbWEQBmywCthgYCbGC2B7N9OkiKXYqQHnXk8lIdB2vNHzrfbLokc2isltNtF8TkQyPpVRaMrnbmNIGsBM2k1WRKq8UwAAIDPFr661ZdlRceinZ7aafOWGM5VA7I0Z9EKWIiyLZl0Q40NGXmzUeoBFZAgTFMJGtwo1aZhWoDulIn7tYoUzS27auYajUKIc7MjKEkqDcLHp4QiJo1BmacopNErYgZNihhNEcYXumOPQQUjF3yFpoXmDhwf4pWcubjpCoOBAEtu7yv8yy9OnLlXJSBntgz
mov dword [ebp - 4], ebx
lea edi, [ebp - 0x144]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x15c]
movsb byte es:[edi], byte [esi]
call fcn.004057d0
lea eax, [ebp - 0x15c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x1f0]
call fcn.00407f90
push ebx
push 1
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], bl
call fcn.00479e2e
mov edi, dword [ebp - 0x1e4]
mov eax, dword [ebp + 8]
mov dword [edi + 0x1c], eax
mov dword [eax + 0x5d0], ebx
cmp dword [edi + 4], ebx
jne 0x4c414e
lea eax, [ebp - 0x154]
mov ecx, edi
push eax
call fcn.004c3aea
mov ecx, dword [edi + 0x1c]
mov ebx, 0x40000000
call fcn.004c41d0
test al, al
lea esi, [ebp - 0x154]
mov ecx, 0x40010029
cmovne ebx, ecx
mov ecx, dword [edi + 0x1c]
xor eax, eax
push eax
sub esp, 0x10
mov edi, esp
push eax
movsd dword es:[edi], dword [esi]
push ebx
push eax
mov eax, dword [ecx]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x2c]
mov ecx, eax
call fcn.00402cb0
mov edi, dword [ebp - 0x1e4]
mov ecx, edi
push eax
call fcn.00488297
mov esi, dword [edi + 0x1c]
mov ecx, esi
call fcn.004bb447
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x2c]
mov ecx, eax
call fcn.00483219
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.0047e378
mov ecx, dword [edi + 0x1c]
lea edx, [ebp - 0x1e0]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004816cb
lea ecx, [ebp - 0x1e0]
mov bl, al
call fcn.00481015
mov esi, 0x5c0
test bl, bl
je 0x4c418f
mov eax, dword [edi + 0x1c]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x1c]
add eax, esi
push eax
push 0
push 0x1002
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
lea ecx, [ebp - 0x1f0]
mov byte [edi + 0x24], 1
call fcn.00479e80
call fcn.0051483b
ret 4
Function at 0x4ca40f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x4ca433
cmp dword [esi + 8], edi
jge 0x4ca42b
push esi
call fcn.004c8697
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x4ca45c
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x4ca43f
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x4ca479
mov edx, dword [esi]
cmp edx, dword [esi + 4]
jb 0x4ca467
xor eax, eax
jmp 0x4ca46f
mov al, byte [edx]
inc edx
mov dword [esi], edx
movzx eax, al
mov byte [ebp + ecx + 8], al
inc ecx
cmp ecx, 4
jl 0x4ca45e
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x4ca4ae
push str.zlib_corrupt
call fcn.004c8552
add esp, 4
jmp 0x4ca4eb
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4ca4be
push str.read_past_buffer
jmp 0x4ca4a4
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x4ca4d5
push edi
push esi
call fcn.004c8561
pop ecx
pop ecx
test eax, eax
je 0x4ca4eb
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004f0f60
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x4ce2f4
Capabilities:
Link many functions at runtime

Disassembly:
push 0x1f8
mov eax, 0x553836
call fcn.00514880
mov ebx, ecx
push 0x36
pop ecx
mov esi, str.B5YjN0tbq4WfQPK0e8o1g9g6CmSkh7UQjnqW15bPEB8175DajU7VUpmWqtLj5JNIzpORujdP5w2s6CwWYicugEfRbGMFmF60s0YnOvQKTpL6ydvLlM9Zawiw2WAzstK39Q4tuTDGJf7srPH4m4hmtKGXpmZEECn0BkRsG3ojMa2HXFURfoS2nAR9GDj50QaBp1ZPKFBdxw4gXvm1hXQ6FoSns5
lea edi, [ebp - 0xec]
rep movsd dword es:[edi], dword [esi]
push 0x3c
pop ecx
xor eax, eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x1fc], eax
movsb byte es:[edi], byte [esi]
mov esi, str.6hRqRfY8gtNAuTIFR8AnRkXc7VsE8JaEIIQ4TpWvaLyLnYigbxlFrXXWBC0blRXiXAJK8ovGOcIdgrsBrg8JK2mw3HlEU88SehOSlWsPmKPMrTQUZ6jPr6Ka6Nxs8qSEgp3zElg0pdsG37WVqizp3O0GWqYQzdJJCwum0l48zem0MjFludpevnXdCCVgTohfXCPwO4Oduxcr8Q1Y7IUEB5qxx1ghoTPOBUb7Pz3lrqLDRnuGvn
lea edi, [ebp - 0x1e0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x1f8]
lea eax, [ebp - 0xec]
push eax
call fcn.004057d0
lea eax, [ebp - 0x1f8]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x204]
call fcn.00407f90
xor edi, edi
mov byte [ebp - 4], 0
push 0
inc edi
lea ecx, [ebp - 0x1f8]
push edi
call fcn.00479e2e
lea eax, [ebp - 0x1e0]
push eax
lea ecx, [ebp - 0x1f8]
call fcn.004057d0
lea eax, [ebp - 0x1f8]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x204]
call fcn.00407f90
push 0
push edi
lea ecx, [ebp - 0x1f8]
call fcn.00479e2e
push 0x5f1c38
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
test eax, eax
je 0x4ce433
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x636344
push eax
call esi
push str.IsWow64Process
push dword [ebx]
mov dword [ebx + 8], eax
call esi
push str.Wow64DisableWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0xc], eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0x18], eax
call esi
push str.GetSystemWow64DirectoryW
push dword [ebx]
mov dword [ebx + 0x14], eax
call esi
push str.advapi32.dll
mov dword [ebx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 4], eax
test eax, eax
je 0x4ce433
push str.Wow64RevertWow64FsRedirection
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [ebx + 4]
mov dword [ebx + 0x20], eax
call esi
mov dword [ebx + 0x1c], eax
jmp 0x4ce435
xor edi, edi
lea ecx, [ebp - 0x204]
call fcn.00479e80
mov eax, edi
call fcn.0051483b
ret
Function at 0x4ce52f
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x2b8
mov eax, 0x5538c8
call fcn.00514880
push 0x69
pop ecx
mov esi, str.TcUgr0iDALJFS6OLLFQhLecVw4uASHf8QTECEcDn3B3kUeiMJlLcKy9DbH1ZxI7FOM9jeD0belzeNLGvRB0KwIj1nmEAVWGl7HzlzUoOhd8xhDpY8FdUPt92K9uZCjw9EBu82rrkQJbyRzIM2XZI0UKjXJlFcRCPAMjAc2jvDmc1DhZneVjMzug5RzJeuOpWTR1lv2d954oThe7y7CknURzDS6YmUPybe7PK3nuPo9tBD1PIuZb9OfVfx5WtMCFLCLyn8dQxLmKeDcySIl6zNWjRsNl8oV4i8VRw55WbJg2pN5CItisOKzgx1pz36xVmF5I3MTDAqfm1p9RwoBkCXGtu4HpuJuUXBb2cLRQGrRcnniV6QWNOGek1h7ULnQknJJjgUd7Rb65sUKl7ZuqkxqLeCs0wOizuAvF8
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x298]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
push 0x38
pop ecx
mov dword [ebp - 0x2c4], eax
movsb byte es:[edi], byte [esi]
mov esi, str.VJhzVaoW3l3abDsWnvrUeLsfR9VRCaY0LHgLbeAYJ0oQrCkFJSFKnJHODXXvuv90IVTN6aFVtNUEAATF08OKKzkDXf5o30CAqI0LaGkDIwPdElrK6psbMQXE06RmUTZkHpFiijH92oe90yYjrJvaL8ndwO0mv7QXwtrMqEJQ6QVPIXPH485iGSRbE5sk8FoifV72SpBndPaCscSiyXlBwbQYbnaK5O9
mov dword [ebp - 0x2c0], eax
lea edi, [ebp - 0xf0]
mov dword [ebp - 0x2bc], eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x2b0]
lea eax, [ebp - 0x298]
push eax
call fcn.004057d0
xor eax, eax
lea ecx, [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x2b0]
push eax
call fcn.00407f90
xor ecx, ecx
mov byte [ebp - 4], 0
inc ecx
push 0
push ecx
lea ecx, [ebp - 0x2b0]
call fcn.00479e2e
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.004057d0
push 2
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x2c4]
lea eax, [ebp - 0x2b0]
push eax
call fcn.00407f90
push 0
push 1
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0
call fcn.00479e2e
push ebx
call fcn.005017a9
mov dword [ebp - 0x2b8], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00474ddd
mov esi, eax
push ebx
push esi
call fcn.00501787
mov ebx, dword [ebp - 0x2b8]
add esp, 0x10
xor edi, edi
test ebx, ebx
js 0x4ce66f
push 0x5c
pop eax
cmp word [esi + edi*2], ax
jne 0x4ce661
xor eax, eax
push esi
mov word [esi + edi*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4ce65a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4ce668
push 0x5c
pop eax
mov word [esi + edi*2], ax
inc edi
cmp edi, ebx
jle 0x4ce637
jmp 0x4ce66f
mov byte [ebp - 0x2b4], 0
push esi
call fcn.00474de6
pop ecx
lea ecx, [ebp - 0x2c4]
call fcn.00479e80
mov ecx, dword [ebp - 0x2b4]
movzx eax, cl
call fcn.0051483b
ret
Function at 0x4cf166
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2068
call fcn.00474db0
mov eax, dword [0x673114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
cmp byte [ebp + 0x10], 0
push edi
mov edi, dword [ebp + 8]
je 0x4cf354
push 0x2000
lea eax, [ebp - 0x2004]
mov dword [ebp - 0x2010], esi
push esi
push eax
mov dword [ebp - 0x2008], esi
call fcn.004f14e0
push ebx
push edi
lea eax, [ebp - 0x2004]
push str.__s___s
push eax
call fcn.00408010
push str.EXPLORER.EXE
call fcn.004cf673
add esp, 0x20
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x4cf31f
lea eax, [ebp - 0x2010]
mov edi, 0xf01ff
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4cf31f
lea eax, [ebp - 0x2008]
push eax
push 1
push 1
push esi
push edi
push dword [ebp - 0x2010]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x4cf31f
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4cf273
push str.WTSGetActiveConsoleSessionId
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4cf26c
call eax
push 4
mov dword [ebp - 0x2014], eax
lea eax, [ebp - 0x2014]
push eax
push 0xc
push dword [ebp - 0x2008]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x4cf31f
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44
pop edi
push edi
lea eax, [ebp - 0x2068]
push esi
push eax
call fcn.004f14e0
push 0x10
lea eax, [ebp - 0x2024]
push esi
push eax
call fcn.004f14e0
add esp, 0x18
mov dword [ebp - 0x2068], edi
mov dword [ebp - 0x2060], str.WinSta0Default
mov dword [ebp - 0x203c], 1
mov dword [ebp - 0x200c], esi
push 5
pop eax
push esi
push dword [ebp - 0x2008]
mov word [ebp - 0x2038], ax
lea eax, [ebp - 0x200c]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x4cf31f
lea eax, [ebp - 0x2024]
push eax
lea eax, [ebp - 0x2068]
push eax
push esi
push dword [ebp - 0x200c]
lea eax, [ebp - 0x2004]
push 0x430
push esi
push esi
push esi
push eax
push esi
push dword [ebp - 0x2008]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x4cf31f
cmp dword [ebp - 0x200c], esi
je 0x4cf31f
push dword [ebp - 0x200c]
call sub.USERENV.dll_DestroyEnvironmentBlock
mov eax, dword [ebp - 0x2008]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4cf337
cmp eax, 0xffffffff
je 0x4cf337
push eax
call edi
mov eax, dword [ebp - 0x2010]
test eax, eax
je 0x4cf349
cmp eax, 0xffffffff
je 0x4cf349
push eax
call edi
test ebx, ebx
jne 0x4cf350
push esi
call edi
xor al, al
jmp 0x4cf365
push esi
push esi
push ebx
push edi
call fcn.004cec04
add esp, 0x10
test eax, eax
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00474d9e
mov esp, ebp
pop ebp
ret
Function at 0x4d13fe
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc28
mov eax, dword [0x673114]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0xc24], eax
lea eax, [ebp - 0x20c]
push ebx
push eax
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xc18], ebx
call fcn.004f14e0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push ebx
jmp 0x4d14f8
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4d14ea
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0xc1c], 0x104
push eax
call fcn.004f14e0
add esp, 0xc
mov dword [ebp - 0xc20], 1
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xc20]
push eax
push 0
push str.DisplayName
push dword [ebp - 0xc18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d14de
push dword [ebp - 0xc24]
lea eax, [ebp - 0x414]
push eax
call fcn.004f0895
pop ecx
pop ecx
test eax, eax
jne 0x4d1526
push dword [ebp - 0xc18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4d1458
push 0x657910
mov ecx, esi
call fcn.004024f0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00474d9e
mov esp, ebp
pop ebp
ret
push 0x800
lea eax, [ebp - 0xc14]
push 0
push eax
call fcn.004f14e0
add esp, 0xc
mov dword [ebp - 0xc1c], 0x400
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
push 0
push str.UninstallString
push dword [ebp - 0xc18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xc14]
push eax
jmp 0x4d150c
Function at 0x4d177b
Capabilities:
Set registry value

Disassembly:
push 0x2e0
mov eax, 0x554104
call fcn.00514880
mov eax, dword [ebp + 8]
lea edi, [ebp - 0xf0]
push 0x37
pop ecx
mov esi, str.fQQluDelo58vJ8aIAAtsYKZcc12IJ7jBiBs5L8j2xUkaHtSxiGFFDsVbaxA6nm9UIMqEjXZX27KWEDeG8yQV1TlkKod84aBLXCeGyySpVtdlNzinwSa8JsZXiHXqH0NBsq8kYCSa8z5AwE5OqDxEz0bGOg9ScegKG1ib8XXVV2uwhsBf4bh0ObjR7atM76Zyn2GoZMM57LcrAxUCv3bNjSEfjkb8H
mov ebx, dword [ebp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp + 0x10]
movsw word es:[edi], word [esi]
push 0x70
mov dword [ebp - 0x2e0], eax
lea edi, [ebp - 0x2b0]
xor eax, eax
mov esi, str.3lGpRI8ND1YXba0EiaDIj8AGigYBWKuirEQJ5RXvMiYXpwJGQyYmLAvAfCGSUhOINFgnZOzb18j7RAjYewVk6TiRUQNXdfLAF4ZyvCLM4P9xVB9zKMOnEYONDWoJpylH3jvagWEvuG9uR9qcp9J5BWPZWkXy62HZoqpZrwYQf7BUSxgNTw2UNOz6FIIi3SbqhbwtjJr4o7CXEcnjuzBkoH6YKa5E84BKzGqjOgHQVcuB1S1mSBO03XuQ4F5AVJ349GuLg5yhrA42QQlWRczLu1EyXXoNVjeiJSfevLjKvqHU7nOfk4SVhAUCZWsnAJKXOGQLF3ybIj4UtLYEjMDfXsoUyJOMEkTEI3sUsAdCQ6ByNDNN6fdoua8VPducRyerJS1iFyReNWDtwlwfojfTS9H6Z5cR9flhtmga0aMrnth9g5B7gtRQxj5sVGIJyCA
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 0x2e8], eax
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x2c8]
lea eax, [ebp - 0xf0]
push eax
call fcn.004057d0
lea eax, [ebp - 0x2c8]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x2ec]
call fcn.00407f90
push 0
push 1
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0
call fcn.00479e2e
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x2c8]
call fcn.004057d0
lea eax, [ebp - 0x2c8]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x2ec]
call fcn.00407f90
push 0
push 1
lea ecx, [ebp - 0x2c8]
call fcn.00479e2e
lea eax, [ebp - 0x2d4]
xor ecx, ecx
push eax
mov edi, 0xf013f
mov dword [ebp - 0x2d4], ecx
push edi
push ecx
push str.SoftWare
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x2d0], ecx
mov dword [ebp - 0x2cc], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d193d
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2d0]
xor ecx, ecx
push ecx
push eax
push ecx
push edi
push ecx
push ecx
push ecx
push dword [ebp - 0x2d8]
push dword [ebp - 0x2d4]
call esi
test eax, eax
je 0x4d18c2
push dword [ebp - 0x2d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d193d
xor ecx, ecx
lea eax, [ebp - 0x2cc]
push ecx
push eax
push ecx
push edi
push ecx
push ecx
push ecx
push dword [ebp - 0x2dc]
push dword [ebp - 0x2d0]
call esi
test eax, eax
je 0x4d18f9
push dword [ebp - 0x2d0]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2cc]
jmp 0x4d193b
push ebx
call fcn.005017a9
pop ecx
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push dword [ebp - 0x2e0]
push dword [ebp - 0x2cc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2cc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2d0]
call esi
push dword [ebp - 0x2d4]
call esi
lea ecx, [ebp - 0x2ec]
call fcn.00479e80
call fcn.0051483b
ret
Function at 0x4d2c5c
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0xc8
mov eax, 0x554403
call fcn.00514880
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xd0], ebx
push ebx
xor eax, eax
mov dword [ebp - 4], ebx
push 0x657910
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
call fcn.00402650
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 1
call fcn.004e7d36
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d2dd0
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
push ebx
cmovae eax, dword [ebp + 0xc]
push 0x80
push 4
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4d2cfa
push 0x657910
mov ecx, esi
call fcn.004024f0
jmp 0x4d2ddb
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc8], eax
inc eax
push eax
mov dword [ebp - 0xcc], eax
call fcn.00474ddd
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4d2d39
push 0x657910
mov ecx, esi
call fcn.004024f0
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00402590
push ebx
jmp 0x4d2de7
push dword [ebp - 0xcc]
push 0
push ebx
call fcn.004f14e0
add esp, 0xc
lea eax, [ebp - 0xd4]
push 0
push eax
push dword [ebp - 0xc8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xc4]
push ebx
call fcn.004e8702
push ebx
call fcn.00474de6
pop ecx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xc4]
call fcn.004e7f50
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
call fcn.004dadb1
pop ecx
pop ecx
xor ebx, ebx
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.00479e2e
cmp dword [ebp - 0x30], ebx
jbe 0x4d2dc5
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402880
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00402590
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00404610
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00402590
push ebx
push 1
lea ecx, [ebp + 0xc]
call fcn.00402590
mov eax, esi
call fcn.0051483b
ret 0x1c
Function at 0x4d2ec7
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x55444d
call fcn.00514880
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.004f14e0
lea eax, [edi + 4]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4d2f21
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.004024f0
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x4d2f67
mov eax, dword [esi]
jmp 0x4d2f69
mov eax, esi
push ebx
push eax
call fcn.00501747
pop ecx
pop ecx
test eax, eax
jne 0x4d2fb4
cmp byte [edi], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x4d2f98
call fcn.004d2dfb
jmp 0x4d2f9d
call fcn.004d2e96
push eax
mov ecx, esi
call fcn.00403fe0
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.00402590
mov eax, esi
call fcn.0051483b
ret 0x10
Function at 0x4d44f6
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x5550d6
call fcn.00514880
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4d45f6
cmp byte [ebx + 0x3d], 0
je 0x4d45f6
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x4d4530
xor al, al
jmp 0x4d45f8
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.004d4b80
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4d458e
sub eax, 1
je 0x4d4592
dec eax
sub eax, 1
je 0x4d45e4
xor bl, bl
jmp 0x4d45e6
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x4d45ca
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004f9511
add esp, 0x10
cmp esi, eax
jne 0x4d458a
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x3d], 0
je 0x4d45e4
test esi, esi
jne 0x4d4554
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.004d4b1f
jmp 0x4d454e
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00479e2e
mov al, bl
jmp 0x4d45f8
mov al, 1
call fcn.0051483b
ret