joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005d8e0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x38
mov edx, dword [ebx]
mov eax, dword [eax + 0xc]
test edx, edx
jne 0x1005d9a0
test al, 0x1c
jne 0x1005d8ff
test al, 3
jne 0x1005d992
mov ebx, dword [0x100794c8]
test ebx, ebx
je 0x1005d992
movsx eax, bl
mov dword [esp], eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
sub esp, 4
movzx ecx, al
cwde
mov dword [esp + 0x28], 0
mov edx, eax
mov byte [esp + 0x2a], bl
mov ebx, eax
sar edx, 4
sar ebx, 6
and edx, 0x10
sar eax, 9
mov dword [esp], ecx
and ebx, 8
and eax, 2
mov dword [esp + 0x24], 0
or edx, ebx
mov word [esp + 0x26], cx
or eax, edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], eax
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
sub esp, 8
mov word [esp + 0x28], ax
movzx eax, byte [0x100794c8]
lea edx, [esp + 0x20]
call fcn.1005d5c0
mov dword [0x100794c8], 0
add esp, 0x38
pop ebx
ret
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 6]
mov dword [esp + 8], eax
movzx eax, word [ebx + 8]
mov dword [esp + 4], eax
movsx eax, byte [ebx + 0xa]
mov dword [esp], eax
call fcn.1005d700
mov edx, dword [ebx + 0xc]
test dl, 0x1c
je 0x1005d9ef
cmp eax, 0xffffffff
je 0x1005d8ff
mov dword [0x100794c8], 0
mov edx, ebx
call fcn.1005d5c0
add esp, 0x38
pop ebx
ret
and dl, 3
je 0x1005d9d0
movzx edx, word [ebx + 6]
lea ecx, [edx - 0x60]
cmp cx, 9
ja 0x1005da24
mov ecx, dword [ebx]
test ecx, ecx
je 0x1005da1a
mov ecx, dword [0x100794c8]
lea ecx, [ecx + ecx*4]
lea edx, [edx + ecx*2 - 0x60]
mov dword [0x100794c8], edx
cmp eax, 0xffffffff
jne 0x1005d9e3
jmp 0x1005d992
cmp eax, 0xffffffff
jne 0x1005d9d9
jmp 0x1005d992

Function at 0x1005f200
Capabilities:
Get geographical location

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x1005f280
mov ebp, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ebx, 0x40
xor esi, esi
jmp 0x1005f22f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1005f2c0
add ebx, ebx
mov dword [esp], esi
mov edi, esi
mov dword [esp + 4], ebx
call sub.msvcrt.dll_realloc
mov esi, eax
test eax, eax
je 0x1005f2d4
lea eax, [ebx - 1]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call ebp
sub esp, 0x10
test eax, eax
je 0x1005f220
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov edx, 0
sub esp, 0x10
test eax, eax
cmovne edx, dword [esp + 0x38]
add esp, 0x1c
pop ebx
mov esi, edx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
xor esi, esi
call sub.msvcrt.dll_free
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call sub.msvcrt.dll_free
jmp 0x1005f26c
Function at 0x1005fae0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.1005f870
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.1005f870
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x1005fb40
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x1007c918]
test esi, esi
jle 0x1005fc40
mov eax, dword [0x1007c91c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x1005fb70
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x1005fbef
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x1005fb60
mov dword [esp], ebx
call fcn.10060290
mov edi, eax
test eax, eax
je 0x1005fc67
mov eax, dword [0x1007c91c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.100603a0
mov edx, dword [0x1007c91c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x1005fc47
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x1005fbe8
sub eax, 4
and eax, 0xfffffffb
jne 0x1005fbf6
add dword [0x1007c918], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x1007c91c]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x1005fbe8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.1005fae0
xor esi, esi
jmp 0x1005fb7a
mov eax, dword [0x1007c91c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.1005fae0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.1005fae0
lea esi, [esi]
nop
Function at 0x1005ff00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x1007c928
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x1007c920]
sub esp, 4
test ebx, ebx
je 0x1005ff55
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x1005ff4e
test esi, esi
je 0x1005ff4e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x1005ff30
mov dword [esp], 0x1007c928
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42c2f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c000]
push edi
jmp 0x42c30a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42c311
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42c300
mov eax, 1
add ebx, ebx
jne 0x42c323
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42c318
jne 0x42c334
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42c318
xor ecx, ecx
sub eax, 3
jb 0x42c348
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42c3ba
mov ebp, eax
add ebx, ebx
jne 0x42c353
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42c360
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42c384
inc ecx
add ebx, ebx
jne 0x42c370
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42c365
jne 0x42c381
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42c365
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42c3a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42c395
jmp 0x42c306
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42c3a4
add edi, ecx
jmp 0x42c306
pop esi
mov edi, esi
mov ecx, 0xc91
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42c3c2
cmp byte [edi], 9
jne 0x42c3c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42c3c7
lea edi, [esi + 0x2a000]
mov eax, dword [edi]
or eax, eax
je 0x42c436
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x32ef4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x32f30]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42c3f4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x32f38]
or eax, eax
je 0x42c430
mov dword [ebx], eax
add ebx, 4
jmp 0x42c411
call dword [esi + 0x32f34]
mov ebp, dword [esi + 0x32f3c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42c46a
sub esp, 0xffffff80
jmp 0x419fa6
Function at 0x415200
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push ebx
call fcn.00415212

Function at 0x415510
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push ebx
call fcn.00415522
Function at 0x41b4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.0041b4d7

Function at 0x41e7c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.0041e7d7

Function at 0x41f6c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.0041f6d7

Function at 0x41fbc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.0041fbd7
Function at 0x48c7d0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x48c816
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x48c811
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x48c7fb
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x48c803
cmp edx, ebx
jne 0x48c951
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x48c7d2
add eax, dword [eax + 4]
jmp 0x48c7bf
mov dword [ebp + 0xc], ebx
jmp 0x48c821
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x48c839
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x48c857
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
invalid
mov ch, 0x54

Function at 0x48c820
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x48c816
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x48c811
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x48c7fb
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x48c803
cmp edx, ebx
jne 0x48c951
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x48c7d2
add eax, dword [eax + 4]
jmp 0x48c7bf
mov dword [ebp + 0xc], ebx
jmp 0x48c821
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x48c839
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x48c857
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
invalid
mov ch, 0x54

Function at 0x492a70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.00526920
Function at 0x4a32a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb4
mov edi, edx
mov dword [ebp - 0xc0], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
movsd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
lea esi, [ebx + 0xf]
test ebx, ebx
cmovns esi, ebx
mov eax, esi
shr eax, 4
inc eax
movzx eax, ax
movzx ecx, word [ebp + 8]
push ecx
push eax
push 6
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x4a33d4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4a339b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4a3467
and esi, 0xfffffff0
sub ebx, esi
test ebx, ebx
jle 0x4a332c
movzx ecx, word [eax]
lea eax, [eax + ecx*2]
add eax, 2
dec ebx
jne 0x4a3320
movzx edx, word [eax]
test edx, edx
sete cl
add eax, 2
setne ch
or ch, cl
je 0x4a34a3
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0x1c]
mov ecx, edi
push edx
push eax
call fcn.00524290
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x4a341b
movsx eax, byte [ebp - 0x11]
test eax, eax
cmovs eax, dword [ebp - 0x18]
cmovs edi, dword [ebp - 0x1c]
test eax, eax
js 0x4a34a3
sete cl
test edi, edi
setne dl
or dl, cl
je 0x4a34a3
push 0
push esi
push eax
push edi
mov esi, dword [ebp - 0xc0]
push esi
call fcn.0069feb0
add esp, 0x14
jmp 0x4a343f
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x4a341b
call fcn.006a5890
lea edi, [ebp - 0xbc]
mov ecx, edi
push eax
push 2
push 0x3f
push str.....operadesktopwindowsl10n_handler_resource_l10n_handler.cc
call fcn.006a5a40
lea eax, [ebp - 0xb4]
push 0x15
push str.Failed_to_load_string
jmp 0x4a340b
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x4a341b
call fcn.006a5890
lea edi, [ebp - 0xbc]
mov ecx, edi
push eax
push 2
push 0x39
push str.....operadesktopwindowsl10n_handler_resource_l10n_handler.cc
call fcn.006a5a40
lea eax, [ebp - 0xb4]
push 0x15
push str.Failed_to_find_string
push eax
call fcn.005b72e0
add esp, 0xc
mov ecx, edi
call fcn.006a5aa0
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc0]
mov dword [esi + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [esi], xmm0
xorps xmm0, xmm0
movsd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
cmp byte [ebp - 0x11], 0
jns 0x4a3450
push dword [ebp - 0x1c]
call fcn.006507ee
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x4a341b
call fcn.006a5890
lea edi, [ebp - 0xbc]
mov ecx, edi
push eax
push 2
push 0x45
push str.....operadesktopwindowsl10n_handler_resource_l10n_handler.cc
call fcn.006a5a40
lea eax, [ebp - 0xb4]
push 0x15
push str.Failed_to_lock_string
jmp 0x4a340b
ud2
Function at 0x4a69a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x1c]
mov dword [ebx], 0
push ebx
push 0x4a34b0
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp eax, 1
jne 0x4a6abd
push 0x739014
push 0x86
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
mov dword [ebp - 0x1c], 0
push ebx
push 0x4a34b0
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp eax, 1
jne 0x4a6ac0
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov dword [ebp - 0x1c], 0
push ebx
push 0x4a34b0
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp eax, 1
jne 0x4a6ac3
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
js 0x4a6abb
sete cl
test edi, edi
setne dl
or dl, cl
je 0x4a6abb
push eax
push edi
push ebx
call fcn.00535b70
add esp, 0xc
movsx eax, byte [ebp - 0x11]
test eax, eax
jns 0x4a6a6a
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
test eax, eax
js 0x4a6abb
sete cl
test ebx, ebx
setne dl
or dl, cl
je 0x4a6abb
mov esi, dword [ebp + 8]
xor ecx, ecx
inc ecx
push 0
push ecx
push ecx
push 0x73901c
push eax
push ebx
push esi
call fcn.00528810
add esp, 0x1c
cmp byte [ebp - 0x11], 0
jns 0x4a6aa5
push dword [ebp - 0x1c]
call fcn.006507ee
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
ud2
int3
int3
int3
Function at 0x4badb0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x218]
mov dword [esi], 0x101
lea edi, [ebp - 0x212]
push 0x202
push 0xff
push edi
call fcn.006547d0
add esp, 0xc
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov esi, eax
test eax, eax
je 0x4bae02
mov ecx, dword [ebp + 8]
push edi
call fcn.00524400
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4bfed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x1c
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 8], eax
call fcn.004bb3f0
mov esi, eax
lea eax, [ebp - 0x17]
mov byte [eax + 2], 9
mov ecx, str.Software_
lea edx, [ebp - 0x20]
cmp edx, ecx
seta dl
cmp eax, ecx
setbe al
or al, dl
je 0x4bffb6
mov dword [ebp - 0x1c], 0x65726177
mov dword [ebp - 0x20], 0x74666f53
mov word [ebp - 0x18], 0x5c
test esi, esi
je 0x4bffb6
push esi
call fcn.0066e590
add esp, 4
lea ecx, [ebp - 0x20]
push eax
push esi
call fcn.005cd4f0
mov edx, dword [eax + 8]
lea ecx, [ebp - 0x14]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
movsx eax, byte [ecx + 0xb]
test eax, eax
cmovs eax, dword [ecx + 4]
cmovs ecx, dword [ecx]
test eax, eax
js 0x4bffb6
sete dl
test ecx, ecx
setne dh
or dh, dl
je 0x4bffb6
mov esi, dword [ebp + 8]
push eax
push ecx
push esi
call fcn.00535b70
add esp, 0xc
cmp byte [ebp - 9], 0
jns 0x4bff93
push dword [ebp - 0x14]
call fcn.006507ee
add esp, 4
cmp byte [ebp - 0x15], 0
jns 0x4bffa4
push dword [ebp - 0x20]
call fcn.006507ee
add esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 0x1c
pop esi
pop ebp
ret
ud2
Function at 0x4c1d20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov esi, esp
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esi + 0xa8], eax
pxor xmm0, xmm0
movdqu xmmword [esi + 0x74], xmm0
movdqu xmmword [esi + 0x94], xmm0
movdqu xmmword [esi + 0x84], xmm0
mov dword [esi + 0xa4], 0
mov dword [esi + 0x6c], 0x3c
mov dword [esi + 0x70], 0x40
mov dword [esi + 0x78], 0x73e8c4
xor ebx, ebx
dec ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
lea edi, [esi + 0x20]
push edi
call fcn.0053fda0
cmp byte [edi + 0xb], 0
js 0x4c1dba
mov eax, dword [esi + 0x28]
mov dword [esi + 0x68], eax
movq xmm0, qword [esi + 0x20]
movq qword [esi + 0x60], xmm0
lea ecx, [esi + 0x20]
call fcn.005e5500
cmp byte [esi + 0x6b], 0
js 0x4c1dca
lea eax, [esi + 0x60]
jmp 0x4c1dcd
lea ecx, [esi + 0x60]
push dword [esi + 0x24]
push dword [esi + 0x20]
call fcn.005cde60
jmp 0x4c1da7
mov eax, dword [esi + 0x60]
mov dword [esi + 0x7c], eax
lea edi, [esi + 0x54]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, dword [ebp + 0xc]
push edi
call fcn.00540d30
cmp byte [edi + 0xb], 0
jns 0x4c1ded
mov edi, dword [esi + 0x54]
lea eax, [esi + 0x6c]
mov dword [eax + 0x14], edi
mov dword [eax + 0x1c], 5
pcmpeqd xmm0, xmm0
lea ebx, [esi + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esi + 0x10]
push 0x17d
push str.....operadesktopwindowsos_operationsos_operations_impl.cc
push str.RunElevatedProcess
push edi
call fcn.005e4620
add esp, 0x10
mov ecx, ebx
push 0
push edi
call fcn.005d6a70
lea eax, [esi + 0x6c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [esi + 8], esp
sub esp, 0xc
mov ebx, esp
lea ecx, [ebx + 4]
test eax, eax
je 0x4c1eb8
push dword [esi + 0xa4]
call fcn.00528ff0
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov edi, dword [esi + 0xc]
mov eax, dword [edi]
mov ebx, dword [eax + 0x60]
mov ecx, ebx
call dword [0x7a29f4]
mov ecx, edi
call ebx
mov esp, dword [esi + 8]
lea ecx, [esi + 0x20]
call fcn.005d6ae0
cmp byte [esi + 0x5f], 0
jns 0x4c1e8d
push dword [esi + 0x54]
call fcn.006507ee
add esp, 4
cmp byte [esi + 0x6b], 0
jns 0x4c1e9e
push dword [esi + 0x60]
call fcn.006507ee
add esp, 4
mov ecx, dword [esi + 0xa8]
xor ecx, ebp
call fcn.00650d60
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 0
jmp 0x4c1e53
Function at 0x4c7ac0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb0
mov ebx, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], 0x732afc
cmp byte [ecx + 0x1c], 0
je 0x4c7bd0
push 0x4c
push str.....operadesktopwindowsinstaller_transactionsdelete_file_operation.cc
call fcn.005e3f60
add esp, 8
test eax, eax
jle 0x4c7b3b
lea edi, [ebp - 0xac]
mov ecx, edi
push 0xffffffffffffffff
push 0x25
push str.....operadesktopwindowsinstaller_transactionsdelete_file_operation.cc
call fcn.0053b2e0
lea eax, [ebp - 0xa4]
push 0x12
push str.Actual_removal_of
push eax
call fcn.005b72e0
add esp, 0xc
lea ecx, [ebx + 0x10]
push ecx
push eax
call fcn.00535bf0
add esp, 8
mov ecx, edi
call fcn.0053b7a0
lea esi, [ebx + 0x10]
push esi
call fcn.0052cb50
add esp, 4
test al, al
jne 0x4c7b54
push esi
call fcn.006a1880
add esp, 4
cmp byte [ebx + 0x1e], 1
jne 0x4c7bf5
xor eax, eax
dec eax
lea edi, [ebp - 0xac]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [ebp - 0xbc], ebx
lea ecx, [ebx + 4]
push edi
call fcn.005e5d30
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ebx, [ebp - 0xb8]
jmp 0x4c7bb0
mov eax, dword [ebp - 0xac]
push eax
call esi
test eax, eax
je 0x4c7bbd
mov ecx, edi
push ebx
call fcn.005e5d30
mov ecx, edi
push ebx
call fcn.005e5580
mov ecx, ebx
call fcn.005e5500
cmp byte [ebp - 0xa1], 0
mov eax, edi
jns 0x4c7b92
jmp 0x4c7b8c
lea ecx, [ebp - 0xac]
call fcn.005e5500
mov ebx, dword [ebp - 0xbc]
jmp 0x4c7bf5
cmp dword [ebx + 0x20], 0
je 0x4c7bf5
lea esi, [ebx + 0x20]
mov ecx, dword [0x7b1550]
test ecx, ecx
jne 0x4c7bef
call fcn.004c0170
mov ecx, eax
mov dword [0x7b1550], eax
push esi
call fcn.004c0ec0
mov edi, dword [ebx + 0x20]
mov dword [ebx + 0x20], 0
test edi, edi
je 0x4c7c13
mov ecx, edi
call fcn.004c1ac0
push edi
call fcn.006507ee
add esp, 4
lea ecx, [ebx + 0x10]
call fcn.005e5500
add ebx, 4
mov ecx, ebx
call fcn.005e5500
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
ret