joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cf230
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
test eax, eax
je 0x4cf4dc
test edx, edx
je 0x4cf4dc
movups xmm0, xmmword [eax]
xorps xmm4, xmm4
lea edx, [edx + 0x10]
cmp ecx, 0x100
je 0x4cf3f0
cmp ecx, 0xc0
je 0x4cf310
cmp ecx, 0x80
jne 0x4cf4e4
lea ecx, [ecx]
mov ecx, 9
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.004cf2f6
aeskeygenassist xmm1, xmm0, 2
call fcn.004cf2f0
aeskeygenassist xmm1, xmm0, 4
call fcn.004cf2f0
aeskeygenassist xmm1, xmm0, 8
call fcn.004cf2f0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004cf2f0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004cf2f0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004cf2f0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004cf2f0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004cf2f0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004cf2f0
movups xmmword [edx], xmm0
mov dword [edx + 0x50], ecx
xor eax, eax
ret
movq xmm2, qword [eax + 0x10]
mov ecx, 0xb
movups xmmword [edx - 0x10], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.004cf390
aeskeygenassist xmm1, xmm2, 2
call fcn.004cf3d0
aeskeygenassist xmm1, xmm2, 4
call fcn.004cf380
aeskeygenassist xmm1, xmm2, 8
call fcn.004cf3d0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004cf380
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004cf3d0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004cf380
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004cf3d0
movups xmmword [edx], xmm0
mov dword [edx + 0x30], ecx
xor eax, eax
ret
movups xmm2, xmmword [eax + 0x10]
mov ecx, 0xd
lea edx, [edx + 0x10]
movups xmmword [edx - 0x20], xmm0
movups xmmword [edx - 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.004cf4a6
aeskeygenassist xmm1, xmm0, 1
call fcn.004cf4c0
aeskeygenassist xmm1, xmm2, 2
call fcn.004cf4a0
aeskeygenassist xmm1, xmm0, 2
call fcn.004cf4c0
aeskeygenassist xmm1, xmm2, 4
call fcn.004cf4a0
aeskeygenassist xmm1, xmm0, 4
call fcn.004cf4c0
aeskeygenassist xmm1, xmm2, 8
call fcn.004cf4a0
aeskeygenassist xmm1, xmm0, 8
call fcn.004cf4c0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004cf4a0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004cf4c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004cf4a0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004cf4c0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004cf4a0
movups xmmword [edx], xmm0
mov dword [edx + 0x10], ecx
xor eax, eax
ret
mov eax, 0xffffffff
ret
mov eax, 0xfffffffe
ret

Function at 0x4cf510
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.004cf230
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x4cf571
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x4cf542
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
xor eax, eax
ret
Function at 0x4d7ba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x4d7c70
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x4d7c0e
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.004d7800
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4d7be0
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x4d7d17
call 0x4d7c20
pop edx
lea ecx, [edx + 0x120]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x4d7cc0
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.004d7800
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4d7c7d
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x4d7d17
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.004d7800
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4d7d15
jmp 0x4d7d17
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d7d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x4d7e59
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x4d7df7
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004d7940
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4d7dc9
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x4d7f00
call 0x4d7e09
pop edx
lea ecx, [edx + 0x137]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x4d7ea9
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004d7a70
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4d7e66
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x4d7f00
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.004d7a70
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4d7efe
jmp 0x4d7f00
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4e05b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57554a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5ea6f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.0054d780
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x4e0656
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.00552f43
push 0x5df3a4
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.00550768
push edi
push esi
call fcn.0054dc85
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550759
mov esp, ebp
pop ebp
ret 4

Function at 0x4e0bf0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5755d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x5ea6f0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.004eafb0
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.004e0b20
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x4e0c61
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.00552f43
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x4e0c8a
push dword [esp + 0xc]
call fcn.0054dfd9
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e15e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5ea6f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4e166b
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x4e162d
cmp eax, 2
jne 0x4e1649
mov ecx, dword [ebp - 0xc]
test esi, esi
je 0x4e1665
test ecx, ecx
je 0x4e1660
test cl, 1
jne 0x4e1649
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x4e1665
pop edi
mov eax, 0xd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00550759
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00550759
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e32c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5758bb
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x5ea6f0]
xor eax, esp
mov dword [esp + 0x244], eax
push esi
push edi
mov eax, dword [0x5ea6f0]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov eax, dword [0x5f0518]
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], 0
test al, 1
jne 0x4e3344
or eax, 1
mov dword [0x5f04e0], 7
mov dword [0x5f0518], eax
xor eax, eax
push 0x57e6c0
mov dword [0x5f04dc], 0
mov word [0x5f04cc], ax
call fcn.0054e249
add esp, 4
push 0
push 0x5d0874
push dword [0x5f04dc]
mov ecx, 0x5f04cc
push 0
call fcn.004ebe90
test eax, eax
jne 0x4e3459
push 0x104
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
cmp word [esp + 0x44], ax
jne 0x4e3397
xor ecx, ecx
jmp 0x4e33af
lea ecx, [esp + 0x44]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e33a0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x34]
call fcn.004e9a70
push 0x5d0890
lea eax, [esp + 0x30]
mov dword [esp + 0x264], 0
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004ee4c0
mov edi, eax
add esp, 0xc
cmp edi, 0x5f04cc
je 0x4e3428
cmp dword [0x5f04e0], 8
jb 0x4e3401
push dword [0x5f04cc]
call fcn.0054dfd9
add esp, 4
xor eax, eax
mov dword [0x5f04e0], 7
push edi
mov ecx, 0x5f04cc
mov dword [0x5f04dc], 0
mov word [0x5f04cc], ax
call fcn.004ebaa0
cmp dword [esp + 0x28], 8
jb 0x4e343b
push dword [esp + 0x14]
call fcn.0054dfd9
add esp, 4
mov dword [esp + 0x260], 0xffffffff
cmp dword [esp + 0x40], 8
jb 0x4e3459
push dword [esp + 0x2c]
call fcn.0054dfd9
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x5f04cc
mov word [esi], ax
call fcn.004ebbd0
mov eax, esi
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.00550759
mov esp, ebp
pop ebp
ret
Function at 0x4e34a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5758bb
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x5ea6f0]
xor eax, esp
mov dword [esp + 0x244], eax
push esi
push edi
mov eax, dword [0x5ea6f0]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov eax, dword [0x5f0524]
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], 0
test al, 1
jne 0x4e3524
or eax, 1
mov dword [0x5f0468], 7
mov dword [0x5f0524], eax
xor eax, eax
push 0x57e720
mov dword [0x5f0464], 0
mov word [0x5f0454], ax
call fcn.0054e249
add esp, 4
push 0
push 0x5d0874
push dword [0x5f0464]
mov ecx, 0x5f0454
push 0
call fcn.004ebe90
test eax, eax
jne 0x4e3639
push 0x104
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
cmp word [esp + 0x44], ax
jne 0x4e3577
xor ecx, ecx
jmp 0x4e358f
lea ecx, [esp + 0x44]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e3580
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x34]
call fcn.004e9a70
push str._sysnative_
lea eax, [esp + 0x30]
mov dword [esp + 0x264], 0
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004ee4c0
mov edi, eax
add esp, 0xc
cmp edi, 0x5f0454
je 0x4e3608
cmp dword [0x5f0468], 8
jb 0x4e35e1
push dword [0x5f0454]
call fcn.0054dfd9
add esp, 4
xor eax, eax
mov dword [0x5f0468], 7
push edi
mov ecx, 0x5f0454
mov dword [0x5f0464], 0
mov word [0x5f0454], ax
call fcn.004ebaa0
cmp dword [esp + 0x28], 8
jb 0x4e361b
push dword [esp + 0x14]
call fcn.0054dfd9
add esp, 4
mov dword [esp + 0x260], 0xffffffff
cmp dword [esp + 0x40], 8
jb 0x4e3639
push dword [esp + 0x2c]
call fcn.0054dfd9
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x5f0454
mov word [esi], ax
call fcn.004ebbd0
mov eax, esi
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.00550759
mov esp, ebp
pop ebp
ret
Function at 0x4e3680
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5758fb
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x5ea6f0]
xor eax, esp
mov dword [esp + 0x24c], eax
push esi
push edi
mov eax, dword [0x5ea6f0]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
mov eax, dword [0x5f048c]
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], 0
test al, 1
jne 0x4e3704
or eax, 1
mov dword [0x5f0488], 7
mov dword [0x5f048c], eax
xor eax, eax
push 0x57e780
mov dword [0x5f0484], 0
mov word [0x5f0474], ax
call fcn.0054e249
add esp, 4
sub esp, 0x18
mov dword [esp + 0x44], 0
mov ecx, esp
xor eax, eax
push 0xc
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push str.explorer.exe
mov word [ecx], ax
call fcn.004e9a70
lea ecx, [esp + 0x44]
call fcn.004e6770
add esp, 0x18
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
push 0x104
lea eax, [esp + 0x50]
push 0
push eax
call fcn.00550bc0
add esp, 0xc
mov dword [esp + 0x30], 0x104
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x34]
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
xor eax, eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
mov dword [esp + 0x268], eax
cmp word [esp + 0x4c], ax
jne 0x4e37a5
xor ecx, ecx
jmp 0x4e37bf
lea ecx, [esp + 0x4c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e37b0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x3c]
call fcn.004e9a70
push str.AppData_
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004ee4c0
mov edi, eax
add esp, 0xc
cmp edi, 0x5f0474
je 0x4e382d
cmp dword [0x5f0488], 8
jb 0x4e3806
push dword [0x5f0474]
call fcn.0054dfd9
add esp, 4
xor eax, eax
mov dword [0x5f0488], 7
push edi
mov ecx, 0x5f0474
mov dword [0x5f0484], 0
mov word [0x5f0474], ax
call fcn.004ebaa0
cmp dword [esp + 0x28], 8
jb 0x4e3840
push dword [esp + 0x14]
call fcn.0054dfd9
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x5f0474
mov word [esi], ax
call fcn.004ebbd0
cmp dword [esp + 0x48], 8
jb 0x4e3875
push dword [esp + 0x34]
call fcn.0054dfd9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.00550759
mov esp, ebp
pop ebp
ret
Function at 0x4e4350
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575a38
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5ea6f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
push ecx
xor edi, edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
xor esi, esi
push ecx
push edi
xor bl, bl
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp - 0x20]
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], esi
cmovae eax, dword [ebp + 8]
push edi
push eax
push edi
mov byte [ebp - 0x21], bl
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x4e4443
push dword [ebp - 0x20]
call fcn.00550f5e
mov esi, eax
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov edx, 2
mul edx
mov dword [ebp - 0x30], esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00550f5e
add esp, 8
mov edi, eax
mov dword [ebp - 0x2c], edi
test esi, esi
je 0x4e4421
test edi, edi
je 0x4e4421
cmp dword [ebp + 0x1c], 8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
push esi
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x4e442a
push 0
push 0
call fcn.00550768
mov bl, 1
jmp 0x4e4443
test edi, edi
je 0x4e4450
push edi
call fcn.00550f26
add esp, 4
test bl, bl
jne 0x4e4463
test esi, esi
je 0x4e4468
push esi
call fcn.00550f26
add esp, 4
jmp 0x4e4468
mov eax, dword [ebp - 0x28]
mov dword [eax], esi
cmp dword [ebp + 0x1c], 8
jb 0x4e4479
push dword [ebp + 8]
call fcn.0054dfd9
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00550759
mov esp, ebp
pop ebp
ret
Function at 0x4e44e0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x575a70
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5ea6f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
jne 0x4e451e
xor edi, edi
jmp 0x4e468b
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x5c
push eax
lea ecx, [ebp + 8]
call fcn.004ebdd0
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp + 8]
call fcn.004e9ca0
mov esi, eax
lea eax, [ebp + 8]
cmp eax, esi
je 0x4e457b
cmp dword [ebp + 0x1c], 8
jb 0x4e455e
push dword [ebp + 8]
call fcn.0054dfd9
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
push esi
lea ecx, [ebp + 8]
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
call fcn.004ebaa0
cmp dword [ebp - 0x18], 8
jb 0x4e458c
push dword [ebp - 0x2c]
call fcn.0054dfd9
add esp, 4
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp + 8]
push eax
call esi
cmp dword [ebp + 0x1c], 8
mov edi, eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call esi
test eax, eax
jne 0x4e4686
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmovae eax, dword [ebp + 8]
push 0
push eax
call esi
test eax, eax
jne 0x4e4686
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x2c], ax
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp + 8]
mov dword [ebp - 0x14], 0x5c
call fcn.004ebdd0
inc eax
lea ecx, [ebp + 8]
push eax
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.004e9ca0
push eax
lea ecx, [ebp - 0x2c]
call fcn.004e9920
cmp dword [ebp - 0x30], 8
jb 0x4e4629
push dword [ebp - 0x44]
call fcn.0054dfd9
add esp, 4
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.004ebbd0
call fcn.004e44e0
add esp, 0x18
test eax, eax
je 0x4e4673
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
call esi
test eax, eax
mov ecx, 1
cmovne edi, ecx
cmp dword [ebp - 0x18], 8
jb 0x4e468b
push dword [ebp - 0x2c]
call fcn.0054dfd9
add esp, 4
jmp 0x4e468b
mov edi, 1
cmp dword [ebp + 0x1c], 8
jb 0x4e469c
push dword [ebp + 8]
call fcn.0054dfd9
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550759
mov esp, ebp
pop ebp
ret