joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bca30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
mov esi, ecx
mov dword [ebp - 0xc], esi
mov ebx, edx
push edi
test edx, edx
je 0x4bca5d
cmp byte [edx], al
je 0x4bca55
inc ebx
cmp byte [ebx], al
jne 0x4bca50
sub ebx, edx
and ebx, 0x3fffffff
xor edi, edi
cmp dword [esi + 0x14], eax
jle 0x4bcaff
mov ecx, edi
cmp edi, 2
jge 0x4bca77
xor ecx, 1
mov dword [ebp - 4], ecx
jmp 0x4bca7a
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x4bcace
mov edx, ecx
mov ecx, dword [esi + 0x10]
add edx, edx
mov esi, dword [ecx + edx*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x4bcab0
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x585a50]
cmp cl, byte [edx + 0x585a50]
jne 0x4bcab0
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x4bca93
movzx ecx, byte [esi]
movzx eax, byte [eax]
mov esi, dword [ebp - 0xc]
movzx ecx, byte [ecx + 0x585a50]
movzx eax, byte [eax + 0x585a50]
sub eax, ecx
jne 0x4bcaef
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x10]
add ecx, ecx
push ebx
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.0048be70
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
jne 0x4bcaff
jmp 0x4bcaf2
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
inc edi
cmp edi, dword [esi + 0x14]
jl 0x4bca68
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bcbb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor eax, eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, edx
push esi
push edi
test edx, edx
je 0x4bcbdd
cmp byte [edx], al
je 0x4bcbd5
jmp 0x4bcbd0
inc ebx
cmp byte [ebx], al
jne 0x4bcbd0
sub ebx, edx
and ebx, 0x3fffffff
mov esi, dword [ecx + 0x14]
xor edi, edi
mov dword [ebp - 0x10], esi
test esi, esi
jle 0x4bcc83
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0x14], ecx
mov eax, edi
cmp edi, 2
jge 0x4bcbfd
xor eax, 1
add eax, eax
lea esi, [ecx + eax*8]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x4bcc5b
mov esi, dword [esi]
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x4bcc40
lea esp, [esp]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x585a50]
cmp cl, byte [edx + 0x585a50]
jne 0x4bcc3d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x4bcc20
mov edx, dword [ebp - 8]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x585a50]
movzx ecx, byte [ecx + 0x585a50]
sub eax, ecx
jne 0x4bcc70
mov eax, dword [ebp - 0xc]
push ebx
lea ecx, [eax + 0x18]
call fcn.0048be70
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x4bcc83
jmp 0x4bcc73
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
inc edi
mov ecx, dword [ebp - 0x14]
cmp edi, dword [ebp - 0x10]
jl 0x4bcbf3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bcfb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov dword [esp + 0x28], edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x24], edi
test edx, edx
je 0x4bd196
test edi, edi
je 0x4bcfdb
cmp dword [edi + 0x1f0], 0
jne 0x4bcfea
mov eax, 0xffff
add word [edx + 0x20], ax
jne 0x4bd196
mov ebx, dword [edx + 0x10]
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x4bd0fa
lea esp, [esp]
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x30], eax
test edi, edi
je 0x4bd018
cmp dword [edi + 0x1f0], 0
jne 0x4bd0d5
mov esi, dword [ebx]
mov ecx, esi
mov dword [esp + 0x28], esi
test esi, esi
je 0x4bd03e
cmp byte [esi], 0
je 0x4bd036
lea esp, [esp]
inc ecx
cmp byte [ecx], 0
jne 0x4bd030
sub ecx, esi
and ecx, 0x3fffffff
mov eax, dword [ebx + 0x18]
add eax, 0x18
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov edx, dword [eax]
mov dword [esp + 0x2c], edx
test edx, edx
je 0x4bd0ab
xor ebx, ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], esi
test ecx, ecx
jle 0x4bd099
mov edi, ecx
mov ecx, esi
jmp 0x4bd070
movzx eax, byte [ecx]
lea edx, [ebx*8]
dec edi
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x585a50]
xor esi, edx
xor ebx, esi
test edi, edi
jg 0x4bd070
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov eax, ebx
xor edx, edx
div dword [esp + 0x2c]
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
jmp 0x4bd0ad
xor edx, edx
push edx
mov dword [esp + 0x14], edx
mov edx, esi
push ecx
mov ecx, eax
call fcn.0048bd60
add esp, 8
test eax, eax
je 0x4bd0d5
push dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, eax
call fcn.0048be10
add esp, 4
mov edx, dword [ebx + 0x10]
mov ecx, edi
call fcn.004887b0
mov edx, ebx
mov ecx, edi
call fcn.004887b0
mov eax, dword [esp + 0x30]
mov ebx, eax
mov dword [esp + 0x18], eax
test eax, eax
jne 0x4bd000
mov ebx, dword [esp + 0x34]
mov ecx, edi
mov edx, ebx
call fcn.004c8160
mov edx, ebx
mov ecx, edi
call fcn.004bcf30
mov edx, dword [ebx]
mov ecx, edi
call fcn.004887b0
mov edx, dword [ebx + 0x28]
mov ecx, edi
call fcn.004887b0
mov esi, dword [ebx + 0x1c]
test esi, esi
je 0x4bd13c
mov edx, esi
mov ecx, edi
call fcn.004d0410
mov edx, esi
mov ecx, edi
call fcn.004887b0
mov edx, dword [ebx + 0x2c]
mov ecx, edi
call fcn.004b4e00
test edi, edi
je 0x4bd153
cmp dword [edi + 0x1f0], 0
jne 0x4bd15c
mov edx, ebx
xor ecx, ecx
call fcn.004dd680
cmp dword [ebx + 0x3c], 0
je 0x4bd18d
xor esi, esi
cmp dword [ebx + 0x38], esi
jle 0x4bd183
lea esp, [esp]
mov edx, dword [ebx + 0x3c]
mov ecx, edi
mov edx, dword [edx + esi*4]
call fcn.004887b0
inc esi
cmp esi, dword [ebx + 0x38]
jl 0x4bd170
mov edx, dword [ebx + 0x3c]
mov ecx, edi
call fcn.004887b0
mov edx, ebx
mov ecx, edi
call fcn.004887b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bed80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5b3680]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add edx, edx
push ebx
mov ebx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
push esi
mov eax, dword [ebx]
push edi
mov dword [ebp - 0x2c], ebx
mov eax, dword [eax + 0x10]
mov esi, dword [eax + edx*8]
mov eax, 1
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], eax
lea esp, [esp]
push eax
push str.sqlite_stat_d
lea eax, [ebp - 0x1c]
push eax
push 0x18
call fcn.00489ee0
mov ecx, dword [ebx]
lea edx, [ebp - 0x1c]
add esp, 0x10
mov dword [ebp - 0x30], ecx
cmp byte [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
je 0x4bedf6
lea esp, [esp]
inc edx
cmp byte [edx], 0
jne 0x4bedf0
lea eax, [ebp - 0x1c]
xor ebx, ebx
sub edx, eax
mov dword [ebp - 0x34], ebx
mov eax, dword [ecx + 0x14]
and edx, 0x3fffffff
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x44], eax
test eax, eax
jle 0x4bef31
mov edi, ebx
cmp ebx, 2
jge 0x4bee21
xor edi, 1
test esi, esi
je 0x4bee7f
mov ecx, dword [ecx + 0x10]
mov edx, edi
add edx, edx
mov eax, esi
mov esi, dword [ecx + edx*8]
mov ecx, dword [ebp - 0x24]
mov cl, byte [ecx]
test cl, cl
je 0x4bee5d
lea ebx, [ebx]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x585a50]
cmp cl, byte [edx + 0x585a50]
jne 0x4bee5d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x4bee40
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x585a50]
movzx ecx, byte [ecx + 0x585a50]
sub eax, ecx
jne 0x4beef3
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + 0x10]
add edi, edi
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
mov dword [ebp - 0x20], ecx
cmp dword [ecx + 0xc], 0
je 0x4beecb
xor esi, esi
lea ebx, [ebp - 0x1c]
mov edi, edx
test edx, edx
jle 0x4beec0
nop
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x585a50]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x4beea0
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x34]
mov eax, esi
xor edx, edx
div dword [ecx]
jmp 0x4beecd
xor edx, edx
push edx
push dword [ebp - 0x28]
lea edx, [ebp - 0x1c]
call fcn.0048bd60
add esp, 8
test eax, eax
je 0x4beeec
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x4bef10
jmp 0x4beef6
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x4beef6
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
inc ebx
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ebx
cmp ebx, dword [ebp - 0x44]
jl 0x4bee17
test eax, eax
je 0x4bef31
push dword [ebp - 0x3c]
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x40]
mov ebx, dword [ebp - 0x2c]
push eax
push esi
push str.DELETE_FROM__Q._s_WHERE__s_Q
push ebx
call fcn.004bc990
add esp, 0x18
jmp 0x4bef34
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 3
jle 0x4bedc0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005295e2
mov esp, ebp
pop ebp
ret
Function at 0x4ec6e0
Capabilities:
Copy file
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5685c2
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x5b3680]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi - 0x14]
lea ecx, [edi - 0x14]
mov dword [ebp - 0x438], edi
mov eax, dword [eax + 4]
mov dword [eax + edi - 0x14], 0x592de4
mov eax, dword [ecx]
mov eax, dword [eax + 8]
mov dword [eax + edi - 0x14], 0x592dd8
mov eax, dword [ecx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x14]
mov dword [edx + edi - 0x18], eax
mov dword [ebp - 4], 1
call fcn.004ed4b0
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x410]
push eax
push 0x104
call esi
push str._WF.tmp
lea eax, [ebp - 0x410]
push 0x200
push eax
call fcn.0052e020
lea ecx, [ebp - 0x410]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ec781
sub ecx, edx
mov eax, 0x200
sar ecx, 1
sub eax, ecx
push eax
lea eax, [ebp - 0x410]
lea eax, [eax + ecx*2]
push 0
push eax
call fcn.00531bd0
xorps xmm0, xmm0
mov dword [ebp - 0x430], 0
movdqu xmmword [ebp - 0x42c], xmm0
lea eax, [ebp - 0x410]
add esp, 0xc
movq qword [ebp - 0x41c], xmm0
mov dword [ebp - 0x428], eax
mov eax, 0x414
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x430]
push eax
mov word [ebp - 0x414], 0
mov dword [ebp - 0x42c], 3
mov dword [ebp - 0x41e], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
lea eax, [ebp - 0x410]
push eax
push 0x104
call esi
push str._WB.tmp
lea eax, [ebp - 0x410]
push 0x200
push eax
call fcn.0052e020
lea ecx, [ebp - 0x410]
add esp, 0xc
lea edx, [ecx + 2]
jmp 0x4ec840
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ec840
sub ecx, edx
mov eax, 0x200
sar ecx, 1
sub eax, ecx
push eax
lea eax, [ebp - 0x410]
lea eax, [eax + ecx*2]
push 0
push eax
call fcn.00531bd0
xorps xmm0, xmm0
mov dword [ebp - 0x430], 0
movdqu xmmword [ebp - 0x42c], xmm0
lea eax, [ebp - 0x410]
add esp, 0xc
movq qword [ebp - 0x41c], xmm0
mov dword [ebp - 0x428], eax
mov eax, 0x414
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x430]
push eax
mov word [ebp - 0x414], 0
mov dword [ebp - 0x42c], 3
mov dword [ebp - 0x41e], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov byte [ebp - 4], 0
lea eax, [edi - 0xc]
mov dword [ebp - 0x434], eax
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [eax]
mov eax, esi
sub edx, 0x10
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4ec8f9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
lea eax, [edi - 0x10]
mov dword [ebp - 0x434], eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [eax]
sub edx, 0x10
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x4ec929
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005295e2
mov esp, ebp
pop ebp
ret
Function at 0x4ec950
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x5ba1b0]
push esi
mov esi, ecx
mov dword [0x5ba51c], eax
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov eax, dword [ecx + esi]
add ecx, esi
call dword [eax]
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov eax, dword [ecx + esi]
add ecx, esi
call dword [eax + 4]
push 0
push 0
push 0
push 0x4ec9a0
push 0
push 0
call fcn.0052cf98
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret 4
Function at 0x4ed500
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x566a53
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x5b3680]
xor eax, esp
mov dword [esp + 0xb4], eax
push ebx
push esi
mov eax, dword [0x5b3680]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
mov esi, dword [0x5ba520]
mov dword [esp + 0x20], vtable.ATL::CAcl.0
mov dword [esp + 0x24], 0
mov byte [esp + 0x28], 0
mov dword [esp + 0x2c], 2
mov dword [esp + 0xd0], 0
lea eax, [esp + 0x30]
mov dword [esp + 0x20], vtable.ATL::CDacl.0
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0xd0], 3
lea ecx, [esp + 0x5c]
call fcn.0043afd0
mov byte [esp + 0xd0], 4
sub esp, 8
lea ecx, [esp + 0x28]
push eax
call fcn.0043b240
mov byte [esp + 0xd0], 3
lea ecx, [esp + 0x5c]
call fcn.00434290
lea ecx, [esp + 0x5c]
call fcn.0043adb0
mov byte [esp + 0xd0], 5
sub esp, 8
lea ecx, [esp + 0x28]
push eax
call fcn.0043b240
mov byte [esp + 0xd0], 3
lea ecx, [esp + 0x5c]
call fcn.00434290
mov dword [esp + 0x14], vtable.ATL::CSecurityDesc.0
mov dword [esp + 0x18], 0
mov byte [esp + 0xd0], 6
lea eax, [esp + 0x20]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0043ab90
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [esi]
mov dword [esp + 0x40], 0xc
mov dword [esp + 0x48], 0
mov ecx, dword [eax + 4]
lea eax, [esp + 0x10]
add ecx, esi
push eax
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, eax
call fcn.00436c90
mov byte [esp + 0xd0], 7
mov edx, 0x58a868
push eax
lea ecx, [esp + 0x20]
call fcn.00435a70
add esp, 4
mov byte [esp + 0xd0], 8
mov ecx, dword [eax]
mov eax, dword [esi]
push ecx
push 0
mov eax, dword [eax + 8]
add esi, eax
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
xor ebx, ebx
mov dword [esi + 0x30], eax
test eax, eax
setne bl
mov byte [esp + 0xd0], 7
or esi, 0xffffffff
mov edx, dword [esp + 0x1c]
mov eax, esi
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4ed6cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0xd0], 6
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x4ed6f0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4ed702
movzx eax, ax
or eax, 0x80070000
test ebx, ebx
jne 0x4ed70c
push eax
call fcn.004027b0
mov byte [esp + 0xd0], 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], vtable.ATL::CSecurityDesc.0
call fcn.0043acd0
mov dword [esp + 0xd0], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.0043b380
mov ecx, dword [esp + 0xc8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.005295e2
mov esp, ebp
pop ebp
ret
Function at 0x4efd80
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 0x260]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4efdbf
push dword [esi + 0x260]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push 0
push 0x4eff10
push 0
push 0
call fcn.0052cf98
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x4efdd0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5b3680]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x30]
movdqu xmm0, xmmword [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
movdqu xmmword [ebp - 0x24], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
test eax, eax
je 0x4efe33
movzx eax, word [ebp - 0x16]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
divsd xmm1, qword [0x593278]
addsd xmm1, qword [ebp - 0x30]
movsd qword [ebp - 0x30], xmm1
jmp 0x4efe38
movsd xmm1, qword [ebp - 0x30]
cmp dword [0x5b5b84], 0
je 0x4efebf
movsd xmm0, qword [0x5ba538]
comisd xmm0, xmm1
ja 0x4efebf
comisd xmm1, xmmword [0x5ba540]
ja 0x4efebf
cmp dword [0x5ba534], 0
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExW]
jne 0x4efe81
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x4f0be0
push 0xd
call esi
mov dword [0x5ba534], eax
cmp dword [0x5ba548], 0
jne 0x4efea3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x4f0c40
push 0xe
call esi
mov dword [0x5ba548], eax
push 0x5ba550
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005295e2
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5ba534]
mov esi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
test eax, eax
je 0x4efedb
push eax
call esi
mov dword [0x5ba534], 0
mov eax, dword [0x5ba548]
test eax, eax
je 0x4efef1
push eax
call esi
mov dword [0x5ba548], 0
push 0x5ba550
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.005295e2
mov esp, ebp
pop ebp
ret
Function at 0x4f1380
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56907f
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x10144
call fcn.00543120
mov eax, dword [0x5b3680]
xor eax, esp
mov dword [esp + 0x10140], eax
push ebx
push esi
push edi
mov eax, dword [0x5b3680]
xor eax, esp
push eax
lea eax, [esp + 0x10158]
mov dword fs:[0], eax
mov esi, dword [0x5ba54c]
mov eax, dword [esi + 0x258]
mov eax, dword [eax]
add eax, dword [esi + 0x250]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [esi + 0x250]
mov ebx, eax
push dword [esi + 0x254]
push ebx
call fcn.00531580
mov ecx, dword [esi + 0x258]
add esp, 0xc
mov eax, dword [esi + 0x250]
add eax, ebx
push dword [ecx]
push ecx
push eax
call fcn.00531580
mov edi, dword [0x5b9c80]
add esp, 0xc
test edi, edi
jne 0x4f145b
push 0x38
call fcn.00529b2d
add esp, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0x10160], edi
test eax, eax
je 0x4f1448
mov ecx, eax
call fcn.00436db0
mov edi, eax
jmp 0x4f144a
xor edi, edi
mov dword [esp + 0x10160], 0xffffffff
mov dword [0x5b9c80], edi
lea ecx, [esp + 0x34]
call fcn.0041f010
mov dword [esp + 0x10160], 1
mov dword [esp + 0x34], vtable.CKBDLogEntry.0
mov dword [esp + 0x110], 0
mov dword [esp + 0x114], 0
mov dword [esp + 0x118], 0
mov byte [esp + 0x10160], 2
lea ecx, [esp + 0x11c]
call fcn.0041d7b0
mov dword [esp + 0x10160], 4
mov dword [esp + 0x20], 0
mov byte [esp + 0x10160], 5
lea ecx, [esp + 0x110]
mov eax, dword [esi + 0x258]
mov dword [esp + 0x18], ebx
mov eax, dword [eax]
add eax, dword [esi + 0x250]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00455ad0
mov eax, dword [esi + 0x24c]
mov dword [esp + 0x10c], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x150]
mov dword [esp + 0x18], 0x7fff
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edx, [esp + 0x14c]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4f1525
sub edx, ecx
lea eax, [esp + 0x14c]
sar edx, 1
lea ecx, [esp + 0x88]
push edx
push eax
call fcn.00402600
lea eax, [esp + 0x34]
mov ecx, edi
push eax
call fcn.004370f0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esi + 0x258]
mov dword [esi + 0x250], 0
mov dword [esi + 0x24c], 0
mov dword [esi + 0x25c], 0
push dword [eax]
push 0
push eax
call fcn.00531bd0
add esp, 0xc
mov dword [esp + 0x10160], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.00421100
mov ecx, dword [esp + 0x10158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10140]
xor ecx, esp
call fcn.005295e2
mov esp, ebp
pop ebp
ret
Function at 0x4f34c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555b1b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5b3680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
xor ebx, ebx
call fcn.00529b2d
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x4f3509
mov dword [esi], reloc.WS2_32.dll_accept
mov dword [esi + 4], ebx
jmp 0x4f350b
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4f3679
push 0
lea edi, [esi + 4]
push edi
push 0
push 3
push 0
push 0
push 0
push str.SOFTWARETCtrlTime_control_value
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4f3547
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4f365d
cmp dword [ebp + 0x10], 0
mov edi, dword [ebp + 8]
mov eax, dword [edi]
je 0x4f3590
cmp dword [eax - 4], 1
jle 0x4f3562
push dword [eax - 0xc]
mov ecx, edi
call fcn.004024c0
push dword [edi]
mov ecx, esi
push str.PrinterOptions
call fcn.004164d0
test eax, eax
je 0x4f3608
mov eax, dword [ebp + 0xc]
mov ecx, esi
movzx eax, byte [eax]
push eax
push str.PrinterLastStateEnable
call fcn.00416440
jmp 0x4f3623
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x400
or ecx, eax
jge 0x4f35b0
push 0x400
mov ecx, edi
call fcn.00402590
mov ecx, dword [edi]
cmp dword [ecx - 8], 0x400
jge 0x4f35c5
push 0x80070057
call fcn.004027b0
mov dword [ecx - 0xc], 0x400
xor edx, edx
mov eax, dword [edi]
mov dword [ebp + 8], 0x400
mov dword [ebp + 0x10], 1
mov word [eax + 0x800], dx
lea eax, [ebp + 8]
push eax
push ecx
lea eax, [ebp + 0x10]
push eax
push edx
push str.PrinterOptions
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4f3614
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
mov eax, dword [edi]
test eax, eax
jne 0x4f362e
xor ecx, ecx
jmp 0x4f3644
push dword [ebp + 0xc]
mov ecx, esi
push str.PrinterLastStateEnable
call fcn.004163f0
test eax, eax
je 0x4f3608
mov ebx, 1
jmp 0x4f360a
push dword [eax - 8]
push eax
call fcn.00529878
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x4f35bb
mov eax, dword [edi]
cmp ecx, dword [eax - 8]
jg 0x4f35bb
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi]
lea edi, [esi + 4]
mov word [eax + ecx*2], dx
mov eax, dword [edi]
test eax, eax
je 0x4f3670
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi], 0
push esi
call fcn.005295dd
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc