joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c01cf
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x5520a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x248], eax
push 0x228
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x234], ebx
push ebx
push eax
mov esi, ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x230], ebx
call fcn.004d11d0
add esp, 0xc
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x23c], ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4c0240
xor eax, eax
jmp 0x4c03b6
push edi
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4c0394
test esi, esi
je 0x4c026f
push esi
call edi
xor esi, esi
cmp dword [ebp - 0x234], 0
je 0x4c0287
push dword [ebp - 0x234]
call edi
and dword [ebp - 0x234], 0
lea eax, [ebp - 0x20c]
push str.explorer.exe
push eax
call fcn.004d3274
pop ecx
pop ecx
test eax, eax
jne 0x4c0351
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4c0351
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x240], eax
jne 0x4c0351
push dword [ebp - 0x228]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4c0351
lea eax, [ebp - 0x234]
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4c0351
and dword [ebp - 0x238], 0
lea eax, [ebp - 0x23c]
and dword [ebp - 0x23c], 0
push eax
lea eax, [ebp - 0x238]
push eax
push 1
push dword [ebp - 0x234]
call fcn.004bffb5
add esp, 0x10
test eax, eax
je 0x4c0351
mov eax, dword [ebp - 0x238]
push dword [eax]
call fcn.004c00e5
pop ecx
push dword [ebp - 0x238]
test eax, eax
je 0x4c0368
call fcn.004bff37
and dword [ebp - 0x238], 0
pop ecx
lea eax, [ebp - 0x230]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4c0266
jmp 0x4c038d
mov ecx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x244], 1
mov dword [ecx], eax
call fcn.004bff37
and dword [ebp - 0x238], 0
pop ecx
test esi, esi
je 0x4c0394
push esi
call edi
cmp dword [ebp - 0x234], 0
je 0x4c03ac
push dword [ebp - 0x234]
call edi
and dword [ebp - 0x234], 0
push ebx
call edi
mov eax, dword [ebp - 0x244]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d11b3
mov esp, ebp
pop ebp
ret
Function at 0x4c3923
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x5520a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x254], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x24c
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x250]
push 0
push eax
mov dword [ebp - 0x264], esi
call fcn.004d11d0
add esp, 0xc
lea ecx, [ebp - 0x260]
push esi
call fcn.004a6826
call fcn.004a7389
push eax
lea ecx, [ebp - 0x258]
call fcn.004a6766
push 0x52d094
mov edi, 0x104
lea ecx, [ebp - 0x260]
push edi
call fcn.004a7bcd
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x260]
call fcn.004ad6e5
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4c39fd
mov edi, dword [ebp - 0x258]
lea ecx, [edi - 0x10]
call fcn.004a7cf5
mov ecx, dword [ebp - 0x260]
lea ecx, [ecx - 0x10]
call fcn.004a7cf5
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d11b3
mov esp, ebp
pop ebp
ret
mov edi, 0x104
push esi
lea ecx, [ebp - 0x258]
call fcn.004a7e3e
lea eax, [ebp - 0x228]
push eax
push edi
lea ecx, [ebp - 0x258]
call fcn.004a7bcd
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x258]
call fcn.004ad6e5
push dword [ebp - 0x268]
lea ecx, [ebp - 0x25c]
call fcn.004a6826
lea eax, [ebp - 0x228]
push eax
push edi
lea ecx, [ebp - 0x25c]
call fcn.004a7bcd
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x25c]
call fcn.004ad6e5
test byte [ebp - 0x254], 0x10
mov edi, dword [ebp - 0x258]
mov esi, dword [ebp - 0x25c]
je 0x4c3af9
lea eax, [ebp - 0x228]
push 0x528690
push eax
call fcn.004d081c
pop ecx
pop ecx
test eax, eax
je 0x4c3abc
lea eax, [ebp - 0x228]
push 0x52867c
push eax
call fcn.004d081c
pop ecx
pop ecx
test eax, eax
je 0x4c3abc
mov eax, dword [ebp - 0x254]
mov ecx, 0x410
and eax, ecx
cmp eax, ecx
jne 0x4c3ac7
mov ecx, dword [ebp - 0x25c]
lea ecx, [ecx - 0x10]
jmp 0x4c3b06
cmp dword [ebp + 0x10], 0
je 0x4c3b03
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4c3adf
push esi
call fcn.004c3be3
pop ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4c3b03
push dword [ebp + 0x10]
push esi
push edi
call fcn.004c3923
add esp, 0xc
jmp 0x4c3b03
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esi - 0x10]
call fcn.004a7cf5
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, dword [ebp - 0x264]
test eax, eax
jne 0x4c39f8
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4c39cf
Function at 0x4c3b33
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.004a6826
push dword [ebp + 8]
lea ecx, [ebp - 8]
call fcn.004a6826
lea eax, [ebp - 8]
push eax
call fcn.004c868b
mov edi, dword [ebp - 8]
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
je 0x4c3b71
mov esi, dword [ebp - 4]
jmp 0x4c3bc9
push ebx
push edi
call fcn.004c82dc
pop ecx
pop ecx
test eax, eax
jne 0x4c3bc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4c3bc4
lea eax, [ebp - 4]
push eax
call fcn.004c86fe
mov esi, dword [ebp - 4]
pop ecx
cmp dword [esi - 0xc], ebx
je 0x4c3bca
push esi
call fcn.004c3b33
pop ecx
test eax, eax
je 0x4c3bca
push ebx
push edi
call fcn.004c82dc
pop ecx
pop ecx
test eax, eax
jne 0x4c3bc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4c3bc7
jmp 0x4c3bca
mov esi, dword [ebp - 4]
xor ebx, ebx
inc ebx
lea ecx, [edi - 0x10]
call fcn.004a7cf5
lea ecx, [esi - 0x10]
call fcn.004a7cf5
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c4575
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x5520a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x408]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
neg esi
mov dword [ebp - 0x410], ecx
push eax
sbb esi, esi
xor edi, edi
and esi, 0x100
mov eax, esi
or eax, 0xf003f
push eax
push edi
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c4630
jmp 0x4c45e2
push dword [ebp + 0x10]
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x408]
call fcn.004c4575
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x4c4641
lea eax, [ebp - 0x418]
mov dword [ebp - 0x40c], 0x200
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x404]
push eax
push edi
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4c45c4
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push esi
push dword [ebp - 0x410]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d11b3
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x4c4630
Function at 0x4c4679
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5520a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
add eax, 0x41
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ebp
mov edx, dword [ebp - 0x10]
call fcn.004d11b3
mov esp, ebp
pop ebp
ret

Function at 0x4c4ca4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x5520a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.004a6d36
add eax, 0x10
mov dword [esp], 0x52cb98
lea ecx, [ebp - 0x258]
mov dword [ebp - 0x258], eax
call fcn.004a6b19
mov esi, dword [ebp - 0x258]
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x26c], eax
cmp eax, 0xffffffff
jne 0x4c4d33
xor eax, eax
mov ecx, edi
push eax
push eax
mov dword [edi], eax
mov dword [edi + 4], eax
call fcn.004ca553
lea ecx, [esi - 0x10]
mov dword [edi], eax
call fcn.004a7cf5
lea ecx, [ebp + 0x10]
call fcn.004cb5ce
lea ecx, [ebp + 0x10]
call fcn.004cb5ce
jmp 0x4c4e6a
xor eax, eax
lea ecx, [ebp - 0x260]
push ebx
push eax
push eax
mov dword [ebp - 0x25c], eax
call fcn.004ca553
mov ebx, eax
mov dword [ebp - 0x260], ebx
test byte [ebp - 0x254], 0x10
je 0x4c4e05
cmp dword [ebp + 0x20], 0
lea eax, [ebp - 0x228]
push eax
jne 0x4c4d91
lea ecx, [ebp - 0x258]
call fcn.004a6826
lea eax, [ebp - 0x258]
push eax
push ebx
lea ecx, [ebp - 0x260]
call fcn.004c0fc8
mov ecx, dword [ebp - 0x258]
jmp 0x4c4df7
lea ecx, [ebp - 0x268]
call fcn.004a6826
mov ecx, dword [ebp + 0x20]
test ecx, ecx
je 0x4c4e7c
mov eax, dword [ecx]
lea edx, [ebp - 0x268]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x268]
mov bl, al
add ecx, 0xfffffff0
call fcn.004a7cf5
test bl, bl
je 0x4c4dff
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x264]
call fcn.004a6826
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x260]
lea ecx, [ebp - 0x260]
call fcn.004c0fc8
mov ecx, dword [ebp - 0x264]
lea ecx, [ecx - 0x10]
call fcn.004a7cf5
mov ebx, dword [ebp - 0x260]
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4c4d51
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x260]
mov ecx, edi
push eax
call fcn.004c2785
lea ecx, [ebp - 0x260]
call fcn.004cb892
push dword [ebp - 0x260]
call fcn.004d0550
pop ecx
lea ecx, [esi - 0x10]
call fcn.004a7cf5
lea ecx, [ebp + 0x10]
call fcn.004cb5ce
lea ecx, [ebp + 0x10]
call fcn.004cb5ce
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004d11b3
mov esp, ebp
pop ebp
ret
call fcn.00505065
int3
Function at 0x4c520d
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5520a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x554fec]
push esi
xor esi, esi
test al, 1
jne 0x4c5257
or eax, 1
mov dword [0x554fe8], 7
mov dword [0x554fec], eax
xor eax, eax
push 0x526e30
mov dword [0x554fe4], esi
mov word [0x554fd4], ax
call fcn.004d0680
pop ecx
cmp dword [0x554fe4], esi
je 0x4c5269
mov eax, 0x554fd4
jmp 0x4c5325
push ebx
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.004d11d0
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ebx, 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, 0x554fd4
test eax, eax
je 0x4c5321
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004d076e
pop ecx
pop ecx
push esi
push esi
push esi
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x210]
push esi
push eax
push esi
push esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4c5321
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push 0x52ceb4
push ebx
push eax
call fcn.004c9719
add esp, 0x10
cmp word [ebp - 0x20c], si
je 0x4c5312
lea eax, [ebp - 0x20c]
push eax
call fcn.004d085a
pop ecx
mov esi, eax
push esi
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, edi
call fcn.00406380
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d11b3
mov esp, ebp
pop ebp
ret

Function at 0x4c5c41
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5520a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c5cf4
lea eax, [ebp - 0x214]
mov dword [ebp - 0x210], esi
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], esi
push eax
push edi
call fcn.004c5d07
add esp, 0xc
test al, al
je 0x4c5cf4
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.004d11d0
mov ecx, dword [ebp - 0x214]
mov edx, dword [ebp - 0x210]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
movzx eax, dx
push eax
shr edx, 0x10
lea eax, [ebp - 0x20c]
push edx
push str._d._d._d._d
push 0x104
push eax
call fcn.004d455f
add esp, 0x28
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.004a7e3e
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d11b3
mov esp, ebp
pop ebp
ret
Function at 0x4c5d07
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
push edi
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov dword [eax], ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x4c5d8e
push esi
push edi
call fcn.004d0695
pop ecx
mov esi, eax
push esi
push edi
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4c5d82
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push 0x53e748
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4c5d82
cmp dword [ebp - 8], ebx
je 0x4c5d82
mov ecx, dword [ebp - 0xc]
mov bl, 1
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
mov dword [edx], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
test esi, esi
je 0x4c5d8d
push esi
call fcn.004d069e
pop ecx
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c5e36
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x5520a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x84], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edi, edi
test eax, eax
je 0x4c5eaa
push str._cid
push eax
call fcn.004d3d1c
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4c5eaa
add esi, 0xa
push 0x20
push esi
call fcn.004d076e
pop ecx
pop ecx
test eax, eax
jne 0x4c5e98
push esi
call fcn.004d085a
pop ecx
lea eax, [esi + eax*2]
sub eax, esi
mov ecx, ebx
sar eax, 1
push eax
push esi
call fcn.004a7e67
jmp 0x4c5f3c
push dword [ebp - 0x80]
lea ecx, [ebp - 0x7c]
call fcn.004a6826
push 0x53e748
lea ecx, [ebp - 0x7c]
call fcn.004a6b19
push str.ProductInfo.xml
lea ecx, [ebp - 0x7c]
call fcn.004a6b19
lea ecx, [ebp - 0x78]
call fcn.004bf051
mov esi, dword [ebp - 0x7c]
lea ecx, [ebp - 0x78]
push esi
call fcn.004bf452
test eax, eax
je 0x4c5f2c
push edi
push str.packetcid
lea ecx, [ebp - 0x78]
call fcn.004bf56c
test eax, eax
je 0x4c5f07
push ebx
push 0x52ce90
lea ecx, [ebp - 0x78]
call fcn.004bf6fd
push edi
push str.packet_scid
lea ecx, [ebp - 0x78]
call fcn.004bf56c
test eax, eax
je 0x4c5f2c
push dword [ebp - 0x84]
lea ecx, [ebp - 0x78]
push str.scid
call fcn.004bf6fd
lea ecx, [ebp - 0x78]
call fcn.004baa3d
lea ecx, [esi - 0x10]
call fcn.004a7cf5
mov eax, dword [0x554fa0]
cmp dword [eax - 0xc], edi
je 0x4c5f52
push 0x554fa0
mov ecx, ebx
call fcn.004a691f
mov eax, dword [ebx]
cmp dword [eax - 0xc], edi
jne 0x4c6020
lea eax, [ebp - 0x84]
push edi
push eax
call fcn.004c57a9
mov esi, dword [ebp - 0x84]
push 0x5f
push esi
call fcn.004d0892
add esp, 0x10
test eax, eax
je 0x4c6018
sub eax, esi
sar eax, 1
mov dword [ebp - 0x80], eax
cmp eax, 0xffffffff
je 0x4c6018
call fcn.004a7389
push eax
lea ecx, [ebp - 0x7c]
call fcn.004a6766
mov ecx, dword [ebp - 0x80]
mov eax, dword [esi - 0xc]
inc ecx
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x84]
call fcn.004a7876
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x7c]
call fcn.004a691f
mov ecx, dword [ebp - 0x80]
lea ecx, [ecx - 0x10]
call fcn.004a7cf5
push edi
push str..exe
lea ecx, [ebp - 0x7c]
call fcn.004c48f4
push eax
push edi
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x7c]
call fcn.004a7876
push eax
lea ecx, [ebp - 0x7c]
call fcn.004a691f
mov ecx, dword [ebp - 0x80]
lea ecx, [ecx - 0x10]
call fcn.004a7cf5
lea eax, [ebp - 0x7c]
mov ecx, ebx
push eax
call fcn.004a691f
mov ecx, dword [ebp - 0x7c]
lea ecx, [ecx - 0x10]
call fcn.004a7cf5
lea ecx, [esi - 0x10]
call fcn.004a7cf5
mov eax, dword [ebx]
cmp dword [eax - 0xc], edi
jne 0x4c605f
push str.mktpublic
call fcn.004d1740
pop ecx
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jg 0x4c6057
lea eax, [esi + esi]
call fcn.004d2050
mov eax, esp
push 3
push esi
push str.mktpublic
push eax
call fcn.004a93e5
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a7e3e
lea esp, [ebp - 0x90]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d11b3
mov esp, ebp
pop ebp
ret
Function at 0x4c747a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp dword [esi + 0x14], 8
jb 0x4c748f
mov ecx, dword [esi]
jmp 0x4c7491
mov ecx, esi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x4c749e
mov edx, dword [edi]
jmp 0x4c74a0
mov edx, edi
push ebx
mov bl, byte [ebp + 0x10]
movzx eax, bl
push eax
push ecx
push edx
push str.LaunchProcess_exe_path:_s_str_commande_line:_s_need_uac:_d
push 0x555004
call fcn.004cd208
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.004d11d0
xor ecx, ecx
mov dword [ebp - 0x3c], 0x3c
add esp, 0x20
mov dword [ebp - 0x38], 0x40
test bl, bl
mov dword [ebp - 0x34], ecx
mov eax, str.runas
mov dword [ebp - 0x24], ecx
mov edx, str.open
mov dword [ebp - 0x20], 1
cmove eax, edx
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x30], eax
pop ebx
jb 0x4c7501
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x2c], edi
jb 0x4c750c
mov esi, dword [esi]
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x28], esi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4c7542
push str.ShellExecuteEx_success
mov edi, 0x555004
push edi
call fcn.004cd208
cmp dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
je 0x4c753e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x4c755e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LaunchProcess_fail_error:_d
mov edi, 0x555004
push edi
call fcn.004cd208
add esp, 0xc
xor eax, eax
movzx esi, al
push esi
push str.ShellExecuteEx_ret:_d
push edi
call fcn.004cd208
add esp, 0xc
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4c82dc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push 0x3000010
push 1
push 0
push 3
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
test ebx, ebx
je 0x4c830f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x4c831a
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop ebx
pop ebp
ret

Function at 0x4c8448
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5520a0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
call fcn.004d11d0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4c8496
cmp dword [ebp - 0x11c], 6
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d11b3
mov esp, ebp
pop ebp
ret

Function at 0x4c8747
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [edi], esi
je 0x4c87c9
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 8], 1
je 0x4c877b
cmp dword [ebp - 8], 2
jne 0x4c87c9
mov ecx, dword [ebp + 0xc]
call fcn.004a7155
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
shr eax, 1
inc eax
push eax
call fcn.004a7bcd
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c87bf
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, dword [ebp - 0xc]
xor esi, esi
shr eax, 1
inc esi
mov word [ecx + eax*2], dx
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
call fcn.004ad6e5
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8