joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fb20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4d4], 0
je 0x42fbee
cmp dword [ebp + 8], 0x100
jne 0x42fbb5
movzx ecx, word [ebp + 0xc]
cmp ecx, 0xd
jne 0x42fbb5
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x4da]
test eax, eax
je 0x42fb8e
mov esi, esp
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.004f4cf0
movsx ecx, ax
test ecx, ecx
jge 0x42fbb5
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x4db]
test eax, eax
jne 0x42fbb5
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x40], 0
je 0x42fbb1
push 0
push 0
push 0
push 0x59c6ac
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
call fcn.0040bb80
xor eax, eax
jmp 0x42fbf3
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x4d4]
call fcn.00432260
mov dword [ebp - 8], eax
mov esi, esp
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
call eax
cmp esi, esp
call fcn.004f4cf0
jmp 0x42fbf3
mov eax, 1
pop esi
add esp, 8
cmp ebp, esp
call fcn.004f4cf0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x466bd0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x5ddc34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x18]
test ecx, ecx
jne 0x466c1d
xor eax, eax
jmp 0x466d13
mov edx, dword [ebp - 8]
cmp dword [edx + 0x10], 0
jne 0x466c2d
xor eax, eax
jmp 0x466d13
mov esi, esp
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp esi, esp
call fcn.004f4cf0
add eax, 1
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
shl edx, 1
add edx, 0x24
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
call fcn.0050e780
mov dword [ebp - 0x24], esp
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
call fcn.004f4b70
add dword [ebp - 0x24], 0x20
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x466c9f
push str.pstr
push 0
push 0x91
push 0x5a3350
push 2
call fcn.004fc9a0
add esp, 0x14
cmp eax, 1
jne 0x466c9f
int3
cmp dword [ebp - 0x10], 0
jne 0x466ca9
xor eax, eax
jmp 0x466d13
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp esi, esp
call fcn.004f4cf0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0x10]
add ecx, 0x1b8
call fcn.00403f60
push 0
push 0
push 0
push str.textchanged
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x10]
mov edx, dword [eax]
mov esi, esp
mov eax, dword [edx + 0x1c]
call eax
cmp esi, esp
call fcn.004f4cf0
mov ecx, eax
call fcn.0040bb80
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x466d3c]
push dword [ebp - 0x18]
call fcn.004f4bb0
pop eax
pop edx
lea esp, [ebp - 0x28]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4d70
mov esp, ebp
pop ebp
ret 0x10
Function at 0x477350
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
cmp dword [ebp + 0x14], 0
push edi
mov edi, dword [ebp + 0x10]
jg 0x477371
jl 0x477369
test edi, edi
ja 0x477371
mov eax, dword [ebp + 8]
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, 1
mov dword [ebp - 0x80], 0xedb88320
mov eax, ecx
nop
mov dword [ebp + eax*4 - 0x80], ecx
inc eax
add ecx, ecx
cmp eax, 0x20
jl 0x477380
push ebx
push esi
lea ebx, [ebp - 0x80]
lea eax, [ebp - 0x100]
call fcn.00477310
lea ebx, [ebp - 0x100]
lea eax, [ebp - 0x80]
call fcn.00477310
lea ebx, [ebx]
xor esi, esi
mov eax, dword [ebp + esi - 0x80]
xor edx, edx
lea ecx, [ebp - 0x80]
test eax, eax
je 0x4773cf
nop
test al, 1
je 0x4773c6
xor edx, dword [ecx]
shr eax, 1
add ecx, 4
test eax, eax
jne 0x4773c0
mov dword [ebp + esi - 0x100], edx
add esi, 4
cmp esi, 0x80
jl 0x4773b2
mov eax, edi
and eax, 1
xor ecx, ecx
or eax, ecx
je 0x477412
mov eax, dword [ebp + 8]
xor edx, edx
lea ecx, [ebp - 0x100]
test eax, eax
je 0x47740f
jmp 0x477400
test al, 1
je 0x477406
xor edx, dword [ecx]
shr eax, 1
add ecx, 4
test eax, eax
jne 0x477400
mov dword [ebp + 8], edx
mov edx, dword [ebp + 0x14]
mov eax, edi
mov cl, 1
call fcn.005117e0
mov edi, eax
or eax, edx
je 0x4774a3
xor eax, eax
jmp 0x477430
mov ecx, dword [ebp + eax - 0x100]
xor ebx, ebx
lea esi, [ebp - 0x100]
test ecx, ecx
je 0x477453
test cl, 1
je 0x47744a
xor ebx, dword [esi]
shr ecx, 1
add esi, 4
test ecx, ecx
jne 0x477443
mov dword [ebp + eax - 0x80], ebx
add eax, 4
cmp eax, 0x80
jl 0x477430
mov ecx, edi
and ecx, 1
xor eax, eax
or ecx, eax
je 0x47748b
mov ecx, dword [ebp + 8]
xor esi, esi
lea eax, [ebp - 0x80]
test ecx, ecx
je 0x477488
test cl, 1
je 0x47747f
xor esi, dword [eax]
shr ecx, 1
add eax, 4
test ecx, ecx
jne 0x477478
mov dword [ebp + 8], esi
mov eax, edi
mov cl, 1
call fcn.005117e0
mov edi, eax
mov ecx, edi
or ecx, edx
mov dword [ebp + 0x14], edx
jne 0x4773b0
mov eax, dword [ebp + 8]
xor eax, dword [ebp + 0xc]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4a6d10
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
lea edi, [ebp - 0x11c]
mov ecx, 0x47
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x5ddc34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x48], 0x10
mov dword [ebp - 0x58], 0
xor eax, eax
mov dword [ebp - 0x54], eax
mov esi, esp
lea eax, [ebp - 0xc]
push eax
push 0x28
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.004f4cf0
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp esi, esp
call fcn.004f4cf0
test eax, eax
jne 0x4a6dc3
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004f4cf0
cmp eax, 0x78
jne 0x4a6dbc
mov al, 1
jmp 0x4a6e7b
xor al, al
jmp 0x4a6e7b
mov esi, esp
lea eax, [ebp - 0x58]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp esi, esp
call fcn.004f4cf0
test eax, eax
jne 0x4a6dfb
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004f4cf0
xor al, al
jmp 0x4a6e7b
mov dword [ebp - 0x24], 1
mov eax, 0xc
imul ecx, eax, 0
mov edx, dword [ebp - 0x58]
mov dword [ebp + ecx - 0x20], edx
mov eax, dword [ebp - 0x54]
mov dword [ebp + ecx - 0x1c], eax
mov eax, 0xc
imul ecx, eax, 0
mov dword [ebp + ecx - 0x18], 2
mov esi, esp
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x3c]
push ecx
push 0x10
lea edx, [ebp - 0x24]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp esi, esp
call fcn.004f4cf0
test eax, eax
jne 0x4a6e66
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004f4cf0
xor al, al
jmp 0x4a6e7b
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004f4cf0
mov al, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x4a6eac]
call fcn.004f4c90
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4d70
add esp, 0x11c
cmp ebp, esp
call fcn.004f4cf0
mov esp, ebp
pop ebp
ret
Function at 0x4a7650
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa24
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xa24]
mov ecx, 0x289
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x5ddc34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
push 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x504]
call fcn.004195a0
mov ecx, dword [ebp - 0xc]
add ecx, 0xfdc
call fcn.00401370
push eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x504]
call fcn.00419540
mov esi, esp
push 0x5914f4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x504]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x504]
mov edx, dword [eax + 0x2c]
call edx
cmp esi, esp
call fcn.004f4cf0
mov esi, esp
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp esi, esp
call fcn.004f4cf0
mov ecx, dword [ebp - 0xc]
add ecx, 0xfec
call fcn.00401983
mov dword [ebp - 0x548], 0
jmp 0x4a7715
mov eax, dword [ebp - 0x548]
add eax, 1
mov dword [ebp - 0x548], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xfdc
call fcn.00401370
cmp dword [ebp - 0x548], eax
jae 0x4a781e
mov eax, dword [ebp - 0x548]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xfdc
call fcn.0040173a
mov ecx, 0x104
mov esi, eax
lea edi, [ebp - 0x960]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x960]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push str._s_s
lea edx, [ebp - 0x42c]
push edx
call fcn.00401bd6
add esp, 0x10
push 0x80
push 0
lea eax, [ebp - 0x4b4]
push eax
call fcn.004f6010
add esp, 0xc
push 0x80
push 0
lea eax, [ebp - 0x53c]
push eax
call fcn.004f6010
add esp, 0xc
mov esi, esp
push str.._update.local
push 0x80
lea eax, [ebp - 0x53c]
push eax
push 0x5901d4
push 0x591528
lea ecx, [ebp - 0x960]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp esi, esp
call fcn.004f4cf0
lea eax, [ebp - 0x53c]
push eax
lea ecx, [ebp - 0x758]
push ecx
call fcn.004f7b00
add esp, 8
test eax, eax
je 0x4a7801
lea eax, [ebp - 0x960]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xfec
call fcn.0040150a
mov eax, dword [ebp - 0x548]
add eax, 1
push eax
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 0x504]
call fcn.004195a0
jmp 0x4a7706
mov ecx, dword [ebp - 0xc]
add ecx, 0xfec
call fcn.00401370
jmp 0x4a7830
push edx
mov ecx, ebp
push eax
lea edx, [0x4a7860]
call fcn.004f4c90
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4d70
add esp, 0xa24
cmp ebp, esp
call fcn.004f4cf0
mov esp, ebp
pop ebp
ret
Function at 0x4aa950
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e0
push ebx
push esi
push edi
lea edi, [ebp - 0x1e0]
mov ecx, 0x78
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x5ddc34]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.004f6010
add esp, 0xc
mov dword [ebp - 0x11c], 0x114
mov esi, esp
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp esi, esp
call fcn.004f4cf0
cmp dword [ebp - 0x118], 6
jb 0x4aa9be
mov eax, 1
jmp 0x4aa9c0
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x4aa9f0]
call fcn.004f4c90
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4d70
add esp, 0x1e0
cmp ebp, esp
call fcn.004f4cf0
mov esp, ebp
pop ebp
ret

Function at 0x4aaa40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x53c]
mov ecx, 0x14f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x5ddc34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], str.update
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0x3e8
push 0x591414
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp esi, esp
call fcn.004f4cf0
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x514], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0x104
mov ecx, dword [ebp - 0xc]
add ecx, 0x518
push ecx
push 0x5901d4
push 0x591420
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp esi, esp
call fcn.004f4cf0
mov dword [ebp - 0x24], str.list
mov eax, dword [ebp + 8]
push eax
call fcn.004019c9
add esp, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x46c], 0
jmp 0x4aaaff
mov eax, dword [ebp - 0x46c]
add eax, 1
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 8
jge 0x4aabc6
mov eax, dword [ebp - 0x46c]
push eax
push str.ServerData_d
lea ecx, [ebp - 0x58]
push ecx
call fcn.00401451
add esp, 0xc
mov esi, esp
mov eax, dword [ebp - 0x30]
push eax
push 0x400
lea ecx, [ebp - 0x460]
push ecx
push 0x58f3f5
lea edx, [ebp - 0x58]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp esi, esp
call fcn.004f4cf0
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0
jne 0x4aab61
jmp 0x4aabc6
lea eax, [ebp - 0x460]
push eax
imul ecx, dword [ebp - 0x46c], 0xd5
mov edx, dword [ebp - 0xc]
lea eax, [edx + ecx + 0x728]
push eax
call fcn.00401483
add esp, 8
push 0xd5
imul eax, dword [ebp - 0x46c], 0xd5
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + eax + 0x728]
push edx
push str.SrwhsAc5bYk2Gray
call fcn.00401b22
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x724]
add ecx, 1
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x724], ecx
jmp 0x4aaaf0
push edx
mov ecx, ebp
push eax
lea edx, [0x4aabf8]
call fcn.004f4c90
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4d70
add esp, 0x53c
cmp ebp, esp
call fcn.004f4cf0
mov esp, ebp
pop ebp
ret 4
Function at 0x4aaca0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x548
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x548]
mov ecx, 0x152
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x5ddc34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], str.main
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0
push 0x591540
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp esi, esp
call fcn.004f4cf0
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xdd0], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0x104
mov ecx, dword [ebp - 0xc]
add ecx, 0xdd4
push ecx
push 0x5901d4
push 0x591420
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp esi, esp
call fcn.004f4cf0
mov dword [ebp - 0x18], str.update
mov dword [ebp - 0x484], 0
jmp 0x4aad4d
mov eax, dword [ebp - 0x484]
add eax, 1
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x484]
cmp ecx, dword [eax + 0xdd0]
jge 0x4aae1a
push 0x410
push 0
lea eax, [ebp - 0x478]
push eax
call fcn.004f6010
add esp, 0xc
mov eax, dword [ebp - 0x484]
push eax
push str.file__d
lea ecx, [ebp - 0x60]
push ecx
call fcn.00401a46
add esp, 0xc
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0x104
lea ecx, [ebp - 0x478]
push ecx
push 0x5901d4
lea edx, [ebp - 0x60]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp esi, esp
call fcn.004f4cf0
mov eax, dword [ebp - 0x484]
push eax
push str.md5__d
lea ecx, [ebp - 0x60]
push ecx
call fcn.00401a46
add esp, 0xc
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0x104
lea ecx, [ebp - 0x270]
push ecx
push 0x5901d4
lea edx, [ebp - 0x60]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp esi, esp
call fcn.004f4cf0
lea eax, [ebp - 0x478]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xfdc
call fcn.0040150a
jmp 0x4aad3e
push edx
mov ecx, ebp
push eax
lea edx, [0x4aae4c]
call fcn.004f4c90
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4d70
add esp, 0x548
cmp ebp, esp
call fcn.004f4cf0
mov esp, ebp
pop ebp
ret 4
Function at 0x4b88d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x21a8
call fcn.005010b0
push ebx
push esi
push edi
lea edi, [ebp - 0x21a8]
mov ecx, 0x86a
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x5ddc34]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x591e40
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x7c]
push ecx
call fcn.004f9540
add esp, 0xc
test eax, eax
je 0x4b891c
xor al, al
jmp 0x4b8a02
lea eax, [ebp - 0x70]
push eax
call sub.ADVAPI32.dll_MD5Init
push 0
push 0
mov eax, dword [ebp - 0x7c]
push eax
call fcn.00502a00
add esp, 0xc
mov eax, dword [ebp - 0x7c]
push eax
call fcn.00502030
add esp, 4
test eax, eax
jne 0x4b8990
mov eax, dword [ebp - 0x7c]
push eax
push 0x2000
push 1
lea ecx, [ebp - 0x2084]
push ecx
call fcn.005027a0
add esp, 0x10
mov dword [ebp - 0x2090], eax
mov eax, dword [ebp - 0x7c]
push eax
call fcn.005020c0
add esp, 4
test eax, eax
je 0x4b8977
jmp 0x4b8990
mov eax, dword [ebp - 0x2090]
push eax
lea ecx, [ebp - 0x2084]
push ecx
lea edx, [ebp - 0x70]
push edx
call sub.ADVAPI32.dll_MD5Update
jmp 0x4b8935
mov eax, dword [ebp - 0x7c]
push eax
call fcn.004f9de0
add esp, 4
lea eax, [ebp - 0x70]
push eax
call sub.ADVAPI32.dll_MD5Final
mov dword [ebp - 0x20e4], 0
jmp 0x4b89c0
mov eax, dword [ebp - 0x20e4]
add eax, 1
mov dword [ebp - 0x20e4], eax
cmp dword [ebp - 0x20e4], 0x10
jge 0x4b8a00
mov eax, dword [ebp - 0x20e4]
movzx ecx, byte [ebp + eax - 0x18]
push ecx
push str._02x
lea edx, [ebp - 0x20d8]
push edx
call fcn.00401a46
add esp, 0xc
lea eax, [ebp - 0x20d8]
push eax
push 0x21
mov ecx, dword [ebp + 8]
push ecx
call fcn.004f6b80
add esp, 0xc
jmp 0x4b89b1
mov al, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x4b8a34]
call fcn.004f4c90
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4d70
add esp, 0x21a8
cmp ebp, esp
call fcn.004f4cf0
mov esp, ebp
pop ebp
ret
Function at 0x4b9740
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x128]
mov ecx, 0x4a
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x5ddc34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x48], 0
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x54], 0x10
mov dword [ebp - 0x64], 0
xor eax, eax
mov dword [ebp - 0x60], eax
mov esi, esp
lea eax, [ebp - 0x18]
push eax
push 0x28
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.004f4cf0
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp esi, esp
call fcn.004f4cf0
test eax, eax
jne 0x4b97fb
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004f4cf0
cmp eax, 0x78
jne 0x4b97f4
mov eax, 1
jmp 0x4b98b6
xor eax, eax
jmp 0x4b98b6
mov esi, esp
lea eax, [ebp - 0x64]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp esi, esp
call fcn.004f4cf0
test eax, eax
jne 0x4b9833
mov esi, esp
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004f4cf0
xor eax, eax
jmp 0x4b98b6
mov dword [ebp - 0x30], 1
mov eax, 0xc
imul ecx, eax, 0
mov edx, dword [ebp - 0x64]
mov dword [ebp + ecx - 0x2c], edx
mov eax, dword [ebp - 0x60]
mov dword [ebp + ecx - 0x28], eax
mov eax, 0xc
imul ecx, eax, 0
mov dword [ebp + ecx - 0x24], 2
mov esi, esp
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x48]
push ecx
push 0x10
lea edx, [ebp - 0x30]
push edx
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp esi, esp
call fcn.004f4cf0
test eax, eax
jne 0x4b989e
mov esi, esp
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004f4cf0
xor eax, eax
jmp 0x4b98b6
mov esi, esp
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004f4cf0
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x4b98e8]
call fcn.004f4c90
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4d70
add esp, 0x128
cmp ebp, esp
call fcn.004f4cf0
mov esp, ebp
pop ebp
ret
Function at 0x4bab40
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e228
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
push ebx
push esi
push edi
lea edi, [ebp - 0x138]
mov ecx, 0x4b
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x5ddc34]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004011f9
mov byte [ebp - 4], 1
mov esi, esp
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, esp
call fcn.004f4cf0
mov dword [ebp - 0x20], eax
mov esi, esp
push 5
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
cmp esi, esp
call fcn.004f4cf0
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x4bacae
mov esi, esp
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp esi, esp
call fcn.004f4cf0
mov eax, dword [ebp - 0x38]
push eax
call fcn.00401b36
add esp, 4
mov esi, esp
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp esi, esp
call fcn.004f4cf0
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x50]
call fcn.004011f9
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x44]
add eax, 1
mov esi, esp
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 1
push ecx
lea ecx, [ebp - 0x50]
call fcn.00401adc
push eax
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp esi, esp
call fcn.004f4cf0
push 0
lea ecx, [ebp + 8]
call fcn.004010b4
push eax
lea ecx, [ebp - 0x50]
call fcn.0040187f
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xffffffff
je 0x4bac85
mov byte [ebp - 0x131], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.004017da
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004017da
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004017da
mov al, byte [ebp - 0x131]
jmp 0x4bacd6
mov esi, esp
push 2
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
cmp esi, esp
call fcn.004f4cf0
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.004017da
jmp 0x4babba
mov byte [ebp - 0x125], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004017da
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004017da
mov al, byte [ebp - 0x125]
push edx
mov ecx, ebp
push eax
lea edx, [0x4bad08]
call fcn.004f4c90
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x138
cmp ebp, esp
call fcn.004f4cf0
mov esp, ebp
pop ebp
ret