joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d7ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6126cb
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x238], 0
mov dword [ebp - 4], 1
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.005e3180
add esp, 0xc
mov dword [ebp - 0x23c], 0x104
mov dword [ebp - 0x240], 1
push 0x69b274
lea ecx, [ebp - 0x230]
call fcn.0048c140
mov byte [ebp - 4], 2
lea edx, [ebp - 0x234]
push edx
push 0xf003f
push 0
lea ecx, [ebp + 0x10]
call fcn.0047db80
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d7d98
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x240]
push eax
push 0
lea ecx, [ebp + 0x28]
call fcn.0047db80
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d7d8b
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x230]
call fcn.0047dbc0
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x230]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0049ced0
mov edx, dword [ebp - 0x238]
or edx, 1
mov dword [ebp - 0x238], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.0047dc50
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0047dc50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x28]
call fcn.0047dc50
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret

Function at 0x4d7e00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.005e3180
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
mov dword [ebp - 0x218], 1
mov byte [ebp - 0x20d], 0
lea edx, [ebp - 0x214]
push edx
lea ecx, [ebp + 0xc]
call fcn.0047db80
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4d7eb6
lea ecx, [ebp + 0x3c]
call fcn.0047bfd0
shl eax, 1
push eax
lea ecx, [ebp + 0x3c]
call fcn.0047db80
push eax
mov ecx, dword [ebp - 0x218]
push ecx
push 0
lea ecx, [ebp + 0x24]
call fcn.0047db80
push eax
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4d7ea9
mov byte [ebp - 0x20d], 1
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cl, byte [ebp - 0x20d]
mov byte [ebp - 0x20e], cl
lea ecx, [ebp + 0xc]
call fcn.0047dc50
lea ecx, [ebp + 0x24]
call fcn.0047dc50
lea ecx, [ebp + 0x3c]
call fcn.0047dc50
mov al, byte [ebp - 0x20e]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret
Function at 0x4d8df0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6127fb
mov eax, dword fs:[0]
push eax
mov eax, 0x4044
call fcn.005ca7c0
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4048], 0
push 0x6764fe
lea ecx, [ebp - 0x403c]
call fcn.0047c100
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x4024], ax
push 0x3ffe
push 0
lea ecx, [ebp - 0x4022]
push ecx
call fcn.005e3180
add esp, 0xc
mov dword [ebp - 0x4044], 0
mov dword [ebp - 0x404c], 0
lea edx, [ebp - 0x404c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x4044], eax
cmp dword [ebp - 0x4044], 0
je 0x4d8f7c
lea ecx, [ebp - 0x4024]
push ecx
mov edx, dword [ebp - 0x4044]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4d8f7c
mov dword [ebp - 0x4040], 0
mov dword [ebp - 0x4050], 0
lea ecx, [ebp - 0x4050]
push ecx
lea edx, [ebp - 0x4040]
push edx
push 0x69b3e4
lea eax, [ebp - 0x4024]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4d8f7c
mov byte [ebp - 0x24], 0
xor ecx, ecx
mov dword [ebp - 0x23], ecx
mov dword [ebp - 0x1f], ecx
mov dword [ebp - 0x1b], ecx
mov dword [ebp - 0x17], ecx
mov word [ebp - 0x13], cx
mov byte [ebp - 0x11], cl
mov edx, dword [ebp - 0x4040]
mov eax, dword [edx + 0xc]
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x4040]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x4040]
mov eax, dword [edx + 8]
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x4040]
mov eax, dword [edx + 8]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
push str._d._d._d._d
lea edx, [ebp - 0x24]
push edx
call fcn.004daa80
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x403c]
call fcn.004a9090
lea ecx, [ebp - 0x403c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0047c080
mov edx, dword [ebp - 0x4048]
or edx, 1
mov dword [ebp - 0x4048], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x403c]
call fcn.0047c030
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret
Function at 0x4d9c20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
push 0xf003f
push 0
push str.SOFTWAREWOW6432NodeMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x4d9c94
lea ecx, [ebp - 0x214]
push ecx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x4d9c94
xor al, al
jmp 0x4d9d99
mov dword [ebp - 0x21c], 1
xor edx, edx
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.005e3180
add esp, 0xc
mov dword [ebp - 0x218], 0x104
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x21c]
push eax
push 0
push str.CurrentBuild
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x4d9d48
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push 0
push str.CurrentBuildNumber
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x4d9d48
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4d9d99
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.005f0d23
add esp, 8
call fcn.005ca9d0
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x55f0
jl 0x4d9d89
mov dword [ebp - 0x220], 1
jmp 0x4d9d93
mov dword [ebp - 0x220], 0
mov al, byte [ebp - 0x220]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret
Function at 0x4da8e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.005e3180
add esp, 0xc
xor edx, edx
mov word [ebp - 0x61c], dx
push 0x206
push 0
lea eax, [ebp - 0x61a]
push eax
call fcn.005e3180
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x414], cx
push 0x206
push 0
lea edx, [ebp - 0x412]
push edx
call fcn.005e3180
add esp, 0xc
xor eax, eax
mov word [ebp - 0x824], ax
push 0x206
push 0
lea ecx, [ebp - 0x822]
push ecx
call fcn.005e3180
add esp, 0xc
push 0x100
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0
push 0
push 0
push 0
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x104
lea ecx, [ebp - 0x61c]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.005f60d2
add esp, 0x24
mov dword [ebp - 0x828], eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push str._s_sts_downloader.cfg
lea edx, [ebp - 0x824]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4da9f1
mov al, 1
jmp 0x4da9f3
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret
Function at 0x4dc8a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x612d56
mov eax, dword fs:[0]
push eax
sub esp, 0x2c4
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2b4], ecx
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.005e3180
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
push ecx
call fcn.004d8df0
add esp, 8
mov dword [ebp - 0x2b8], eax
mov edx, dword [ebp - 0x2b8]
push edx
mov ecx, 0x6cf428
call fcn.0048c7e0
lea ecx, [ebp - 0x248]
call fcn.0047c030
call fcn.004d7c50
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0
je 0x4dc95c
mov dword [ebp - 0x2b0], str._64bit
jmp 0x4dc966
mov dword [ebp - 0x2b0], str._32bit
lea eax, [ebp - 0x278]
push eax
call fcn.004d6400
add esp, 4
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x2c0]
mov dword [ebp - 0x2c4], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x2b0]
push edx
mov eax, dword [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x260]
push ecx
call fcn.004ca3c0
add esp, 0xc
mov dword [ebp - 0x2c8], eax
mov edx, dword [ebp - 0x2c8]
push edx
mov ecx, 0x6cf410
call fcn.0048c7e0
lea ecx, [ebp - 0x260]
call fcn.0047c030
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x278]
call fcn.0047c030
lea eax, [ebp - 0x230]
push eax
call fcn.004d67d0
add esp, 4
mov dword [ebp - 4], 1
push 0
push 0x6a0bfc
lea ecx, [ebp - 0x230]
call fcn.0048c2e0
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0xffffffff
jne 0x4dca39
push 0x6a0c24
mov ecx, 0x6cf3e0
call fcn.004a9090
push str.Unknown
mov ecx, 0x6cf3c8
call fcn.004a9090
jmp 0x4dcabb
mov ecx, dword [ebp - 0x2ac]
push ecx
push 0
lea edx, [ebp - 0x290]
push edx
lea ecx, [ebp - 0x230]
call fcn.0048c260
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
push eax
mov ecx, 0x6cf3c8
call fcn.0048c7e0
lea ecx, [ebp - 0x290]
call fcn.0047c030
mov ecx, dword [0x6a5308]
push ecx
mov edx, dword [ebp - 0x2ac]
add edx, 1
push edx
lea eax, [ebp - 0x2a8]
push eax
lea ecx, [ebp - 0x230]
call fcn.0048c260
mov dword [ebp - 0x2d0], eax
mov ecx, dword [ebp - 0x2d0]
push ecx
mov ecx, 0x6cf3e0
call fcn.0048c7e0
lea ecx, [ebp - 0x2a8]
call fcn.0047c030
call sym.Setup.exe_CreateExportObj
mov dword [0x6cf15c], eax
cmp dword [0x6cf128], 0
jne 0x4dcae4
push str.UserLogMutex
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov dword [0x6cf128], eax
push 0
push 0
mov edx, dword [ebp - 0x2b4]
push edx
push 0x4dcfa0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.0047c030
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret
Function at 0x4dead0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x4e10f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x613226
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x6c6f60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0048ad20
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.0048ad20
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x30], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 0x14]
mov dword [edx + 8], eax
mov ecx, dword [ebp + 0x18]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x1c]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x20]
mov dword [ecx + 0x14], edx
cmp dword [ebp + 8], 0
je 0x4e11a2
push 0
mov ecx, dword [ebp + 8]
call fcn.004c4500
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], eax
push 1
mov ecx, dword [ebp + 8]
call fcn.004c4500
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], eax
push 2
mov ecx, dword [ebp + 8]
call fcn.004c4500
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x3c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4e4116
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
call fcn.004e4020
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.005ec346
push edi
call fcn.005eb056
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4e4165
push edi
call fcn.005f614e
pop ecx
test eax, eax
je 0x4e4165
lea ecx, [esi + 0x40]
mov dword [esi + 0x38], 5
call fcn.004e288e
lea ecx, [esi + 0x4c]
call fcn.004e288e
mov dword [esi + 0x58], ebx
jmp 0x4e41e2
push 2
push ebx
push edi
call fcn.005ec346
push edi
call fcn.005f4fd9
push 0
push 0
push edi
mov ebx, eax
call fcn.005ec346
add esp, 0x1c
cmp ebx, 0xffffffff
jne 0x4e41a5
mov dword [esi + 0x38], 5
lea ecx, [esi + 0x40]
call fcn.004e288e
lea ecx, [esi + 0x4c]
call fcn.004e288e
and dword [esi + 0x58], 0
jmp 0x4e41e2
cmp ebx, 0xffffffff
jae 0x4e4188
test ebx, ebx
jne 0x4e41b7
mov dword [esi + 0x38], 0xf
jmp 0x4e418f
lea eax, [ebx + 1]
push eax
call fcn.005c9dac
push edi
push ebx
push 1
push eax
mov dword [esi + 0x5c], eax
call fcn.005f6345
add esp, 0x14
cmp eax, ebx
jne 0x4e4188
mov eax, dword [esi + 0x5c]
mov ecx, esi
mov byte [ebx + eax], 0
call fcn.004e43aa
mov eax, dword [esi + 0x38]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4e5940
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6135cf
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6c6f60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 8]
mov dword [esi], vtable.Json::BuiltStyledStreamWriter.0
call fcn.0048ad20
lea ecx, [esi + 0x14]
call fcn.0048c940
push dword [ebp + 8]
mov byte [ebp - 4], 2
lea ecx, [esi + 0x30]
mov dword [esi + 0x2c], 0x4a
call fcn.0048c990
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x4c]
push dword [ebp + 0x10]
mov byte [ebp - 4], 3
mov dword [esi + 0x48], eax
call fcn.0048c990
push dword [ebp + 0x14]
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
call fcn.0048c990
push dword [ebp + 0x18]
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 5
call fcn.0048c990
mov cl, byte [ebp + 0x1c]
mov al, byte [esi + 0x94]
and cl, 1
and al, 0xf8
shl cl, 2
or cl, al
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x98], eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x9c], eax
mov eax, esi
mov byte [esi + 0x94], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4f9649
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x4d8], edi
je 0x4f96b3
cmp dword [ebp + 8], 0x100
jne 0x4f96a2
cmp word [ebp + 0xc], 0xd
jne 0x4f96a2
cmp byte [esi + 0x4de], 0
je 0x4f9689
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4f96a2
cmp byte [esi + 0x4df], 0
jne 0x4f96a2
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x4f969e
push edi
push edi
push edi
push str.return
push esi
call fcn.0047a000
xor eax, eax
jmp 0x4f96b6
mov eax, dword [esi + 0x4d8]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x4fb45d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4fb513
movzx eax, word [esi]
test ax, ax
je 0x4fb513
push edi
mov edi, esi
mov ecx, esi
cmp ax, 0x2f
je 0x4fb49d
cmp ax, 0x5c
jne 0x4fb49f
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x4fb491
cmp edi, esi
je 0x4fb4e6
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.005e7160
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x4fb523
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004fb45d
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.005f73e9
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.005f7378
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005c978e
mov esp, ebp
pop ebp
ret
call fcn.005c9ed8
int3

Function at 0x4fbae8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x4fbb64
cmp dword [edi + 4], 0xffffffff
jne 0x4fbb64
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push 0x61f084
push esi
call fcn.005f7378
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x4fbb36
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 1
je 0x4fbb36
mov eax, 0x2000000
jmp 0x4fbb69
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004fe003
add esp, 0x10
test eax, eax
jne 0x4fbb54
mov eax, dword [ebp - 4]
jmp 0x4fbb69
push eax
call fcn.004fe70b
mov dword [edi], eax
mov eax, dword [0x6cb9e8]
pop ecx
jmp 0x4fbb69
mov eax, 0x1000000
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4fe110
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x4fe144
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4fe13f
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4fe16b
mov edx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x14]
jbe 0x4fe154
mov esi, dword [edi + 0x14]
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.005e2c00
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x4fe2de
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4fe2ec
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x4fe3ab
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
sub edi, 1
jne 0x4fe304
pop edi
test esi, esi
je 0x4fe3c7
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
inc edx
sub esi, 1
jne 0x4fe3af
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x500288
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, ecx
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push dword [ebx + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push 7
pop ecx
push dword [ebx + 4]
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, dword [sym.imp.USER32.dll_SetFocus]
jmp 0x500337
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x50033b
cmp dword [ebp - 0x1c], 0x10
jne 0x500306
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebx + 4]
jne 0x500306
mov eax, dword [ebp - 0x18]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
lea eax, [ebp - 0x20]
push eax
call fcn.0047b850
pop ecx
test al, al
jne 0x500328
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x1c], 0x12
je 0x50033b
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x5002d3
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
cmp dword [ebp - 0x1c], 0x12
pop edi
pop esi
pop ebx
jne 0x500359
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x500360
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x500392
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8