joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4706dc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x415424]
call fcn.00405494
xor eax, eax
push ebp
push 0x470820
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x568f80], 0
jne 0x47072f
mov ecx, dword [0x569e90]
mov dl, 1
mov eax, dword [0x408548]
call fcn.0040dbd8
call fcn.004040ac
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0040313c
mov eax, ebx
call fcn.004050bc
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x470830
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.0040685c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004050cc
test eax, eax
jle 0x4707c7
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4707c0
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004049c0
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004049a8
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00409454
test eax, eax
jne 0x4707c0
mov ebx, 0x15
jmp 0x4707cc
mov ebx, 0x10
jmp 0x4707cc
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x568f80]
call fcn.00470634
mov eax, dword [ebp - 8]
call fcn.00470634
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406874
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470827
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404754
lea eax, [ebp - 0x10]
mov edx, dword [0x415424]
call fcn.00405564
ret

Function at 0x472abc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404bf0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x472b14
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x56a520]
mov dl, 1
mov eax, dword [0x4725e0]
call fcn.0040dc14
call fcn.004040ac
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004726e8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47655c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.00407f94
cmp ax, 0xffff
jne 0x47657d
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
mov dword [ebp - 8], ebx
push 6
push eax
push edi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x4765fe
push eax
push edi
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x4765fe
push eax
call sub.kernel32.dll_LockResource
mov ebx, eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x4765c4
inc eax
movzx edx, word [ebx]
add edx, edx
add ebx, edx
add ebx, 2
dec eax
jne 0x4765b7
movzx esi, word [ebx]
add ebx, 2
cmp dword [ebp - 4], 0
je 0x4765fe
cmp dword [ebp + 8], 0
jle 0x4765fe
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.0042c000
mov esi, eax
test esi, esi
jle 0x4765f5
mov ecx, esi
add ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00407fb0
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x477254
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4772b8
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004049a8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040999c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4772bf
lea eax, [ebp - 0xc]
call fcn.00404730
ret

Function at 0x47735c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4773b8
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x477387
call fcn.0040f028
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.004029c0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4773b8
call fcn.0040f028
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x4885c8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4886a0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x56bf9c], 0
jne 0x488684
lea eax, [ebp - 4]
mov edx, 0x4886b8
call fcn.004047c8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404bf0
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x488684
mov eax, ebx
call fcn.004027c4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48867d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x488667
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4886c8
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x488667
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x56bf9c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488684
mov eax, dword [ebp - 0xc]
call fcn.004027e4
ret
mov ebx, dword [0x56bf9c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4886a7
lea eax, [ebp - 4]
call fcn.00404730
ret

Function at 0x49c47c
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x56bfc0], 0
jne 0x49c49f
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x49c3f0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x56bfc0], eax
ret

Function at 0x49d620
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.00454130
test al, al
je 0x49d67b
cmp bl, 7
jne 0x49d657
push 2
lea eax, [esp + 4]
push eax
push 0x100c
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
movzx edi, byte [esp]
sub edi, 0x30
jmp 0x49d65c
mov edi, ebx
and edi, 0x7f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
je 0x49d67b
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, edi
call fcn.0042ce34
mov byte [esi + 0x220], bl
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4a80e4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4a8268
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x276]
sub al, 2
jb 0x4a824d
cmp byte [ebx + 0x268], 0
je 0x4a824d
mov eax, dword [ebp - 4]
call fcn.00479440
mov word [ebp - 6], ax
xor eax, eax
push ebp
push 0x4a8246
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp - 6]
sub ax, 8
je 0x4a818a
dec ax
je 0x4a8160
sub ax, 0x12
jne 0x4a81a4
call fcn.00404158
jmp 0x4a824d
cmp byte [ebx + 0x269], 0
je 0x4a822c
mov eax, ebx
call fcn.00435784
test al, al
je 0x4a822c
xor edx, edx
mov eax, ebx
call fcn.004357a8
jmp 0x4a822c
mov eax, dword [esi]
call fcn.004050cc
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.004052b4
jmp 0x4a822c
cmp byte [ebx + 0x269], 0
je 0x4a81c1
mov eax, ebx
call fcn.00435784
test al, al
jne 0x4a81c1
mov dl, 1
mov eax, ebx
call fcn.004357a8
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 8]
sub eax, dword [edx]
cmp eax, 0x4e2
jb 0x4a81d9
mov eax, esi
call fcn.00404e5c
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0
push 1
lea eax, [ebp - 0x10]
mov dx, word [ebp - 6]
call fcn.00404f84
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi]
lea eax, [ebp - 0xc]
call fcn.00405138
mov ecx, dword [ebp - 0xc]
mov edx, edi
mov eax, ebx
call fcn.004a7f34
test al, al
je 0x4a822c
lea eax, [ebp - 0x14]
mov dx, word [ebp - 6]
call fcn.00404f84
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.004050d8
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a824d
mov eax, dword [ebp - 4]
mov dx, word [ebp - 6]
call fcn.00479474
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a826f
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404e74
ret

Function at 0x4aeb74
Capabilities:
Set global application hook

Disassembly:
mov eax, dword [0x56a4f0]
cmp dword [eax], 2
je 0x4aeb92
mov ecx, 0x304
mov edx, 0x4aebc4
mov eax, 0x4aec0c
call fcn.0040468c
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x4aeb14
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x56bffc], eax
cmp dword [0x56bffc], 0
jne 0x4aebb9
call fcn.0040f028
ret

Function at 0x4af030
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x569f48]
cmp byte [eax], 0
jne 0x4af05e
mov ecx, 0xad
mov edx, 0x4af0ac
mov eax, 0x4af0f4
call fcn.0040468c
mov eax, ebx
call fcn.00404e5c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4af09d
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405024
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af108
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x569f48]
cmp byte [eax], 0
jne 0x4af129
mov ecx, 0xb9
mov edx, 0x4af140
mov eax, 0x4af188
call fcn.0040468c
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
pop ebx
ret
Function at 0x4d40d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d4330
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4d4133
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004d3b98
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040e3e8
cmp al, 1
jne 0x4d4133
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004d3eb0
test al, al
je 0x4d42bf
cmp dword [ebp - 8], 0
jge 0x4d4151
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004d3b98
mov eax, dword [ebp - 0x210]
call fcn.004049f8
cmp ebx, eax
jge 0x4d419b
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004d3b98
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x56a4e4]
and eax, 0xff
bt dword [edx], eax
jae 0x4d419b
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4d41af
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004d40ac
cmp ebx, dword [ebp - 8]
je 0x4d42b1
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4d41db
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403adc
and eax, 0x7f
movzx eax, word [eax*2 + 0x5694d8]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4d429e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403adc
and eax, 0x7f
movzx eax, word [eax*2 + 0x5694d8]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00453e2c
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403adc
and eax, 0x7f
movzx eax, word [eax*2 + 0x5694d8]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00453e2c
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d42a5
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4d4312
cmp dword [ebp - 8], 0
jge 0x4d42ca
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004d3b98
mov eax, dword [ebp - 0x218]
call fcn.004049f8
cmp eax, dword [ebp - 8]
jg 0x4d4304
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004d3b98
mov eax, dword [ebp - 0x21c]
call fcn.004049f8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004d40ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4337
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404754
ret
Function at 0x4e9464
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.0040a18c
mov eax, dword [ebx]
call fcn.004049f8
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4e94aa
mov eax, ebx
mov edx, 0x4e94b8
call fcn.00404a00
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e992c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.0040a18c
mov eax, dword [ebx]
call fcn.004049f8
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4e9972
mov eax, ebx
mov edx, 0x4e9980
call fcn.00404a00
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e9984
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.0040a18c
mov eax, dword [ebx]
call fcn.004049f8
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4e99ca
mov eax, ebx
mov edx, 0x4e99d8
call fcn.00404a00
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e9f00
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x74]
push eax
call sub.user32.dll_GetWindowTextA
mov edx, esi
mov eax, esp
call fcn.0040a18c
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x4ebfb4
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, edx
push 0x104
lea edx, [esp + 4]
push edx
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_GetWindowTextA
mov edx, ebx
mov eax, esp
call fcn.0040a18c
add esp, 0x104
pop ebx
ret

Function at 0x4ecd30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.0040a18c
mov eax, dword [ebx]
call fcn.004049f8
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x4ecd76
mov eax, ebx
mov edx, 0x4ecd84
call fcn.00404a00
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f15d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
lea eax, [ebp - 4]
call fcn.00405474
xor eax, eax
push ebp
push 0x4f1741
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004050bc
push eax
call sub.kernel32.dll_CreateFileW
mov esi, eax
mov dword [edi + 4], esi
cmp esi, 0xffffffff
je 0x4f16fb
push 0
lea eax, [ebp - 8]
push eax
push 0xc
lea eax, [edi + 8]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x4f1676
lea eax, [ebp - 0x10]
mov ecx, 0x4f1758
mov edx, dword [ebp - 4]
call fcn.00405138
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.004049c0
mov eax, dword [ebp - 0xc]
call fcn.004451e0
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [edi + 4], 0xffffffff
jmp 0x4f16fb
cmp dword [edi + 8], 0x20090810
je 0x4f16b4
lea eax, [ebp - 0x18]
mov ecx, 0x4f1758
mov edx, dword [ebp - 4]
call fcn.00405138
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.004049c0
mov eax, dword [ebp - 0x14]
call fcn.004451e0
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [edi + 4], 0xffffffff
jmp 0x4f16fb
push 0
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetFileSize_1
cmp eax, dword [edi + 0x10]
je 0x4f16f9
lea eax, [ebp - 0x20]
mov ecx, 0x4f1758
mov edx, dword [ebp - 4]
call fcn.00405138
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.004049c0
mov eax, dword [ebp - 0x1c]
call fcn.004451e0
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [edi + 4], 0xffffffff
jmp 0x4f16fb
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1748
lea eax, [ebp - 0x20]
call fcn.00404e5c
lea eax, [ebp - 0x1c]
call fcn.00404730
lea eax, [ebp - 0x18]
call fcn.00404e5c
lea eax, [ebp - 0x14]
call fcn.00404730
lea eax, [ebp - 0x10]
call fcn.00404e5c
lea eax, [ebp - 0xc]
call fcn.00404730
lea eax, [ebp - 4]
call fcn.00404e5c
ret
Function at 0x4f184c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x410], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f1a0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404730
cmp dword [ebx + 4], 0xffffffff
je 0x4f19e3
mov eax, dword [ebx + 0xc]
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x4f1824]
call fcn.00406060
add esp, 4
push 0
push 0
push 0xc
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xc
jne 0x4f19e3
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx + 0xc]
shl eax, 2
lea eax, [eax + eax*2]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4f19e3
mov edx, edi
mov eax, ebx
call fcn.004f1580
mov edi, eax
mov eax, dword [ebx + 0xc]
dec eax
test eax, eax
jbe 0x4f1908
mov esi, 1
lea edx, [esi + esi*2]
mov ecx, dword [ebp - 8]
cmp edi, dword [ecx + edx*4]
jb 0x4f1908
inc esi
dec eax
jne 0x4f18f9
push 0
push 0
lea eax, [esi + esi*2]
mov edx, dword [ebp - 8]
mov edi, dword [edx + eax*4 - 8]
push edi
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_SetFilePointer_1
lea edx, [esi + esi*2]
mov ecx, dword [ebp - 8]
cmp eax, edi
jne 0x4f19e3
push 0
lea eax, [ebp - 0xc]
push eax
push 0x400
lea eax, [ebp - 0x40c]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4f19e3
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x40c]
mov ecx, 0x400
call fcn.004049a8
push 0
push 0
lea eax, [esi + esi*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*4 - 4]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_SetFilePointer_1
lea edx, [esi + esi*2]
mov ecx, dword [ebp - 8]
cmp eax, dword [ecx + edx*4 - 4]
jne 0x4f19e3
push 0
lea eax, [ebp - 0xc]
push eax
push 0x400
lea eax, [ebp - 0x40c]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4f19e3
push 0x4f1a18
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
je 0x4f19e3
lea eax, [ebp - 0x410]
lea edx, [ebp - 0x40c]
mov ecx, 0x400
call fcn.004049a8
mov edx, dword [ebp - 0x410]
mov eax, dword [ebp - 4]
call fcn.00404a00
mov eax, dword [ebp - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1a11
lea eax, [ebp - 0x410]
call fcn.00404730
lea eax, [ebp - 8]
mov edx, dword [0x4f1824]
call fcn.00406180
ret
Function at 0x4f24bc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405474
xor eax, eax
push ebp
push 0x4f25ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004050bc
mov esi, eax
push esi
call sub.kernel32.dll_lstrlenW
mov edi, eax
mov ebx, 3
lea eax, [ebp - 8]
call fcn.00404e5c
lea eax, [ebp - 0xc]
mov dx, word [esi]
call fcn.00404f84
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.004050d8
lea eax, [ebp - 0x10]
mov dx, word [esi + 2]
call fcn.00404f84
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.004050d8
lea eax, [ebp - 0x14]
mov dx, word [esi + 4]
call fcn.00404f84
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
call fcn.004050d8
cmp edi, ebx
jle 0x4f2591
cmp word [esi + ebx*2], 0x5c
jne 0x4f2575
push 0
mov eax, dword [ebp - 8]
call fcn.004050bc
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4f2575
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x4f2575
xor ebx, ebx
jmp 0x4f2593
lea eax, [ebp - 0x18]
mov dx, word [esi + ebx*2]
call fcn.00404f84
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.004050d8
inc ebx
cmp edi, ebx
jg 0x4f254a
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f25b5
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404e74
ret

Function at 0x4f2700
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push edi
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4f2760
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4f2750
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4f2760
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
test eax, eax
jne 0x4f2760
mov ebx, dword [ebp + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8