joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dfc20
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push esi
lea eax, [esp + 4]
push eax
mov esi, str.Windows
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x14]
dec eax
je 0x4dfca5
dec eax
jne 0x4dfcc3
mov eax, dword [esp + 8]
cmp eax, 6
jne 0x4dfc61
mov esi, str.Windows_Vista
mov eax, esi
pop esi
add esp, 0x94
ret
cmp eax, 5
jne 0x4dfc91
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x4dfc7e
mov esi, str.Windows_XP
mov eax, esi
pop esi
add esp, 0x94
ret
test eax, eax
jne 0x4dfcc3
mov esi, str.Windows_2000
mov eax, esi
pop esi
add esp, 0x94
ret
cmp eax, 4
jne 0x4dfcc3
mov esi, str.Windows_NT
mov eax, esi
pop esi
add esp, 0x94
ret
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x4dfcbc
mov esi, str.Windows_98_ME
mov eax, esi
pop esi
add esp, 0x94
ret
jne 0x4dfcc3
mov esi, str.Windows_95
mov eax, esi
pop esi
add esp, 0x94
ret

Function at 0x4e0450
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x44
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x24]
dec eax
push 0x1c
not eax
lea ecx, [esp + 4]
lea edx, [esp + 8]
and eax, ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ecx, dword [esp + 8]
sub eax, 0x1c
neg eax
sbb eax, eax
not eax
and eax, ecx
add esp, 0x44
ret

Function at 0x4e0520
Capabilities:
Identify system language via api

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x64
cmp eax, 7
jl 0x4e0578
push esi
lea ecx, [esp + 4]
call fcn.004df120
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4e0542
call eax
jmp 0x4e0548
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x4e055e
cmp eax, 0xffffffff
je 0x4e055e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test si, si
je 0x4e0571
push esi
call fcn.004dfcd0
add esp, 4
pop esi
add esp, 0x64
ret
xor eax, eax
pop esi
add esp, 0x64
ret
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push eax
call fcn.004dfcd0
add esp, 4
add esp, 0x64
ret
Function at 0x4e2a00
Capabilities:
Create thread
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xd44]
test eax, eax
je 0x4e2a70
mov eax, dword [edi]
call dword [eax + 0xe4]
test eax, eax
jne 0x4e2a29
mov dword [edi + 0x6c8], 1
pop edi
pop esi
ret 0xc
mov esi, dword [edi + 0xd44]
mov dword [esi + 0x18], eax
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0xe8]
mov dword [esi + 0x1c], eax
mov dword [edi + 0xd44], 0
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x4e0e20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4e2a6b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret 0xc
push 0x20
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4e2a6b
mov eax, dword [esp + 0xc]
push eax
call fcn.0043a460
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esi], eax
call fcn.0043a460
mov dl, byte [esp + 0x1c]
add esp, 8
mov dword [esi + 4], eax
mov byte [esi + 8], dl
call fcn.004dfb70
mov byte [esi + 9], al
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xec]
mov dword [esi + 0x14], eax
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0xe4]
mov dword [esi + 0x18], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xe8]
mov ecx, edi
mov dword [esi + 0x1c], eax
call fcn.004e0070
test al, al
je 0x4e2ae8
mov ecx, dword [edi + 0xc6c]
mov dword [esi + 0xc], ecx
jmp 0x4e2aef
mov dword [esi + 0xc], 0
mov edx, dword [edi]
push ebx
push ebp
mov ecx, edi
call dword [edx + 0xec]
mov ebx, eax
call fcn.004dfb70
test al, al
mov ebp, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
je 0x4e2b35
call ebp
and eax, 0x3ff
mov dword [esp + 0x1c], eax
call ebp
mov ecx, dword [esp + 0x1c]
and eax, 0xfc00
or ecx, eax
push ecx
push 0x238d
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
jmp 0x4e2b5c
call ebp
and eax, 0x3ff
mov dword [esp + 0x1c], eax
call ebp
mov ecx, dword [esp + 0x1c]
and eax, 0xfc00
or ecx, eax
push ecx
push 0x238d
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
pop ebp
mov dword [esi + 0x10], eax
pop ebx
je 0x4e2a6b
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x4e2a49
mov dword [edi + 0xd44], esi
mov dword [edi + 0x6c8], 1
pop edi
pop esi
ret 0xc

Function at 0x4e3a10
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor eax, eax
test esi, esi
mov ecx, esi
je 0x4e3a43
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x4e3a43
cmp eax, 0x104
jge 0x4e3a43
inc eax
test ecx, ecx
jne 0x4e3a30
add eax, esi
pop esi
ret
Function at 0x4e4df0
Capabilities:
Get file attributes

Disassembly:
push ecx
mov eax, dword [ecx + 0x40]
push ebx
xor ebx, ebx
test eax, eax
push esi
mov dword [esp + 8], ebx
je 0x4e4e09
mov ecx, dword [esp + 0x10]
push ecx
call eax
jmp 0x4e4e25
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x14]
mov ebx, 1
call fcn.004e4c80
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test bl, 1
mov esi, eax
je 0x4e4e39
mov eax, dword [esp + 0x10]
push eax
call fcn.0043f020
add esp, 4
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x4e4e50
Capabilities:
Create directory

Disassembly:
push ecx
mov eax, dword [ecx + 0xc]
push ebx
xor ebx, ebx
test eax, eax
push esi
mov dword [esp + 8], ebx
je 0x4e4e6a
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call eax
jmp 0x4e4e88
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x14]
mov ebx, 1
call fcn.004e4c80
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test bl, 1
mov esi, eax
je 0x4e4e9c
mov eax, dword [esp + 0x10]
push eax
call fcn.0043f020
add esp, 4
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x4e4eb0
Capabilities:
Delete file

Disassembly:
push ecx
mov eax, dword [ecx + 0x18]
push ebx
xor ebx, ebx
test eax, eax
push esi
mov dword [esp + 8], ebx
je 0x4e4ec9
mov ecx, dword [esp + 0x10]
push ecx
call eax
jmp 0x4e4ee5
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x14]
mov ebx, 1
call fcn.004e4c80
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test bl, 1
mov esi, eax
je 0x4e4ef9
mov eax, dword [esp + 0x10]
push eax
call fcn.0043f020
add esp, 4
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x4e5040
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebp
push 0x8000000
push 3
push 1
push closesocket
push eax
mov byte [esp + 0x1b], 0
call fcn.004e4d70
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4e5105
push esi
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 0x18]
mov ecx, dword [esi]
push ecx
mov edi, eax
call fcn.0043f020
add esp, 4
test edi, edi
je 0x4e5095
push edi
call fcn.0043f000
add esp, 4
jmp 0x4e5097
xor eax, eax
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edi
test eax, eax
mov dword [esi], eax
mov dword [esi + 4], ecx
je 0x4e50fc
push 0
lea edx, [esp + 0x18]
push edx
push ecx
push eax
push ebp
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e50e4
mov eax, dword [esi + 4]
cmp eax, dword [esp + 0x14]
jne 0x4e50e4
push ebp
mov byte [esp + 0x13], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebp
pop ecx
ret 8
mov ecx, dword [esi]
push ecx
call fcn.0043f020
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, byte [esp + 7]
pop ebp
pop ecx
ret 8
Function at 0x4e55e0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
push esi
mov esi, ecx
mov eax, dword [esi + 0xa0]
test eax, eax
push edi
jne 0x4e56ee
mov eax, dword [esi + 0x80]
test eax, eax
je 0x4e563e
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x1a
push 0
call eax
cmp eax, 0x80070057
je 0x4e56bf
push 0x5dab2c
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.004e4cf0
mov dword [esi + 0xa0], eax
jmp 0x4e56bf
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push closesocket
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e56bf
mov byte [esp + 0x10], al
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
stosw word es:[edi], ax
push 0
push 0
stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
push str.AppData
push eax
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4e56b4
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.004e5180
mov dword [esi + 0xa0], eax
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esi + 0xa0]
test edi, edi
je 0x4e56ee
push edi
call fcn.005d2eed
add esp, 4
test eax, eax
jbe 0x4e56ee
mov cx, word [edi + eax*2 - 2]
cmp cx, 0x2f
je 0x4e56e7
cmp cx, 0x5c
jne 0x4e56ee
mov word [edi + eax*2 - 2], 0
mov eax, dword [esi + 0xa0]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4e58b0
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
push ebp
mov ebx, ecx
mov eax, dword [ebx + 0x94]
test eax, eax
push esi
push edi
je 0x4e5909
mov ecx, dword [ebx + 0x98]
test ecx, ecx
je 0x4e5909
mov ebp, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push ecx
push ebp
call eax
mov esi, eax
test esi, esi
je 0x4e5965
push esi
call fcn.0043f000
mov edi, eax
add esp, 4
test edi, edi
je 0x4e5965
push edi
push esi
push 0
push ebp
call dword [ebx + 0x98]
test eax, eax
je 0x4e5965
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov edx, dword [esp + 0x18]
push edx
lea ecx, [esp + 0x1c]
call fcn.004e4c80
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x4e595c
push esi
call fcn.0043f000
mov edi, eax
add esp, 4
test edi, edi
je 0x4e595c
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4e595c
push ebx
call fcn.0043f020
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
push ebx
call fcn.0043f020
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x4e5ed0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
push edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x17], 0
xor ebp, ebp
xor esi, esi
call fcn.004e4c80
mov eax, dword [eax]
push eax
call fcn.00440230
mov bl, al
mov eax, dword [esp + 0x20]
push eax
call fcn.0043f020
add esp, 8
test bl, bl
je 0x4e5fc8
push 0x5dab2c
push edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
call fcn.004e4cf0
mov ebp, eax
test ebp, ebp
je 0x4e5fc8
mov ax, word [ebp]
test ax, ax
mov ecx, ebp
je 0x4e5f53
cmp ax, 0x41
jb 0x4e5f47
cmp ax, 0x5a
ja 0x4e5f47
add word [ecx], 0x20
mov ax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x4e5f37
push 0x5dab2c
push str.MacromediaMutexGamma
mov ecx, edi
call fcn.004e4cf0
mov esi, eax
test esi, esi
je 0x4e5fc8
push ebp
push esi
mov ecx, edi
call fcn.004e4cf0
push esi
mov edi, eax
call fcn.0043f020
add esp, 4
push edi
lea ecx, [esp + 0x20]
mov esi, edi
call fcn.004e4c80
mov eax, dword [eax]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [esp + 0x1c]
push ecx
mov edi, eax
call fcn.0043f020
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4e5fb8
mov byte [esp + 0x13], 1
test edi, edi
je 0x4e5fc8
cmp edi, 0xffffffff
je 0x4e5fc8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0043f020
push ebp
call fcn.0043f020
mov al, byte [esp + 0x1b]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4e5ff0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x58
push ebx
push ebp
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x6c]
mov dword [esp + 0x18], eax
mov ebp, ecx
mov dword [esp + 0x1c], eax
xor esi, esi
push edi
lea ecx, [esp + 0x14]
xor bl, bl
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], eax
call fcn.004e4c80
mov eax, dword [eax]
push eax
call fcn.00440230
mov ecx, dword [esp + 0x14]
push ecx
mov byte [esp + 0x74], al
call fcn.0043f020
mov al, byte [esp + 0x74]
add esp, 8
test al, al
je 0x4e615a
push edi
mov ecx, ebp
call fcn.004e5970
mov esi, eax
test esi, esi
je 0x4e615a
mov edx, dword [ebp + 0x14]
xor eax, eax
test edx, edx
lea edi, [esp + 0x28]
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], 0x44
je 0x4e6092
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call edx
test eax, eax
setne bl
jmp 0x4e60cf
push esi
lea ecx, [esp + 0x70]
call fcn.004e4c80
mov eax, dword [eax]
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, dword [esp + 0x6c]
test eax, eax
push edx
setne bl
call fcn.0043f020
add esp, 4
test bl, bl
je 0x4e60f6
mov eax, dword [esp + 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esp + 0x18]
push edx
call edi
jmp 0x4e615a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2e4
jne 0x4e615a
mov eax, dword [ebp + 0x84]
test eax, eax
je 0x4e615a
xor eax, eax
mov ecx, 0xe
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], 0x3c
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x34], 0x5e3ac8
mov dword [esp + 0x38], esi
mov dword [esp + 0x44], 1
call dword [ebp + 0x84]
test eax, eax
setne bl
test bl, bl
jne 0x4e615a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call fcn.0043f020
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x58
ret 4
Function at 0x4e7150
Capabilities:
Get common file path

Disassembly:
sub esp, 0x410
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4e71c1
mov ecx, dword [eax + 0x54]
test ecx, ecx
je 0x4e71c1
mov ecx, dword [eax + 0x58]
test ecx, ecx
je 0x4e71c1
lea ecx, [esp + 0x20c]
push ecx
push 0x104
call dword [eax + 0x54]
test eax, eax
jbe 0x4e7213
mov edx, dword [esi + 4]
lea eax, [esp + 4]
push eax
push 0
push str.flash
lea ecx, [esp + 0x218]
push ecx
call dword [edx + 0x58]
test eax, eax
jbe 0x4e7213
mov ecx, dword [esp + 0x418]
lea edx, [esp + 4]
push edx
call fcn.00438db0
mov al, 1
pop esi
add esp, 0x410
ret 4
lea eax, [esp + 4]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jbe 0x4e7213
lea ecx, [esp + 0x20c]
push ecx
push 0
push 0x5e3dd8
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jbe 0x4e7213
mov ecx, dword [esp + 0x418]
lea eax, [esp + 0x20c]
push eax
call fcn.00438d10
mov al, 1
pop esi
add esp, 0x410
ret 4
xor al, al
pop esi
add esp, 0x410
ret 4

Function at 0x4e7156
Capabilities:
Get common file path

Disassembly:
sub esp, 0x410
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4e71c1
mov ecx, dword [eax + 0x54]
test ecx, ecx
je 0x4e71c1
mov ecx, dword [eax + 0x58]
test ecx, ecx
je 0x4e71c1
lea ecx, [esp + 0x20c]
push ecx
push 0x104
call dword [eax + 0x54]
test eax, eax
jbe 0x4e7213
mov edx, dword [esi + 4]
lea eax, [esp + 4]
push eax
push 0
push str.flash
lea ecx, [esp + 0x218]
push ecx
call dword [edx + 0x58]
test eax, eax
jbe 0x4e7213
mov ecx, dword [esp + 0x418]
lea edx, [esp + 4]
push edx
call fcn.00438db0
mov al, 1
pop esi
add esp, 0x410
ret 4
lea eax, [esp + 4]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jbe 0x4e7213
lea ecx, [esp + 0x20c]
push ecx
push 0
push 0x5e3dd8
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jbe 0x4e7213
mov ecx, dword [esp + 0x418]
lea eax, [esp + 0x20c]
push eax
call fcn.00438d10
mov al, 1
pop esi
add esp, 0x410
ret 4
xor al, al
pop esi
add esp, 0x410
ret 4

Function at 0x4e7330
Capabilities:
Get common file path

Disassembly:
mov eax, dword [ecx + 4]
sub esp, 0x230
push ebx
xor bl, bl
test eax, eax
je 0x4e7375
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x4e7375
push 0x105
lea ecx, [esp + 8]
push ecx
call dword [eax + 0x30]
test eax, eax
je 0x4e73a6
mov ecx, dword [esp + 0x238]
lea edx, [esp + 4]
push edx
call fcn.00438db0
mov al, 1
pop ebx
add esp, 0x230
ret 4
push 0x105
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4e73a6
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x23c]
call fcn.00438d10
mov al, 1
pop ebx
add esp, 0x230
ret 4
mov al, bl
pop ebx
add esp, 0x230
ret 4
Function at 0x4e73c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x68
push ebx
mov ebx, dword [esp + 0x70]
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], eax
push edi
mov ebp, ecx
mov dword [esp + 0x1c], eax
push ebx
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], eax
call fcn.00438c70
push 0
lea ecx, [esp + 0x28]
call fcn.00438ff0
mov eax, dword [ebp + 4]
test eax, eax
je 0x4e7485
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4e7485
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0x44
call fcn.004e64c0
mov esi, dword [eax]
push ebx
lea ecx, [esp + 0x80]
call fcn.004e64c0
mov eax, dword [eax]
mov edx, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x38]
push ecx
push esi
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [edx + 0x14]
mov edx, dword [esp + 0x7c]
test eax, eax
push edx
setne bl
call fcn.0043f020
mov eax, dword [esp + 0x14]
push eax
mov dword [esp + 0x84], 0
call fcn.0043f020
add esp, 8
jmp 0x4e74cd
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x3c], 0x44
call fcn.00439100
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, ebx
call fcn.00439100
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
setne bl
test bl, bl
je 0x4e74fc
mov eax, dword [esp + 0x80]
test eax, eax
jbe 0x4e74e8
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
lea ecx, [esp + 0x24]
call fcn.00438bc0
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x68
ret 8
Function at 0x4e7520
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1c]
mov byte [esp + 7], 0
call fcn.00438fa0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0xc]
push eax
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.004e6800
mov eax, dword [esp + 8]
test eax, eax
je 0x4e76b1
mov eax, dword [esi + 0xc]
test eax, eax
push ebp
push edi
je 0x4e760e
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x4e760e
mov ebp, dword [esp + 0x20]
test ebp, ebp
mov dword [esp + 0x1c], 0
je 0x4e7588
mov ecx, ebp
call fcn.00438e30
jmp 0x4e758a
xor eax, eax
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [ecx + 0x1c]
test eax, eax
jne 0x4e76a0
mov ecx, dword [esp + 0x1c]
shr ecx, 1
lea edx, [ecx + ecx + 2]
push edx
call fcn.0043f000
mov edi, eax
add esp, 4
test edi, edi
je 0x4e76a0
test ebp, ebp
je 0x4e75d3
mov ecx, ebp
call fcn.00438e30
jmp 0x4e75d5
xor eax, eax
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x1c]
push edx
push edi
lea edx, [esp + 0x28]
push edx
push 0
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [ecx + 0x1c]
test eax, eax
jne 0x4e7608
cmp dword [esp + 0x20], 1
jne 0x4e7608
mov ecx, dword [esp + 0x24]
push edi
call fcn.00438db0
mov byte [esp + 0xf], 1
push edi
jmp 0x4e7698
mov edi, dword [esp + 0x20]
test edi, edi
mov dword [esp + 0x1c], 0
je 0x4e7627
mov ecx, edi
call fcn.00439100
jmp 0x4e7629
xor eax, eax
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
push eax
push edx
call ebp
test eax, eax
jne 0x4e76a0
mov eax, dword [esp + 0x1c]
push eax
call fcn.0043f000
mov esi, eax
add esp, 4
test esi, esi
je 0x4e76a0
test edi, edi
je 0x4e7666
mov ecx, edi
call fcn.00439100
jmp 0x4e7668
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
push esi
lea edx, [esp + 0x28]
push edx
push 0
push eax
mov eax, dword [esp + 0x24]
push eax
call ebp
test eax, eax
jne 0x4e7697
cmp dword [esp + 0x20], 1
jne 0x4e7697
mov ecx, dword [esp + 0x24]
push esi
call fcn.00438d10
mov byte [esp + 0xf], 1
push esi
call fcn.0043f020
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
pop edi
pop ebp
je 0x4e76b1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 7]
pop esi
add esp, 8
ret 0x10