joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ca2da
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a4afb
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x694240]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x694240]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], ebx
mov word [esp + 0x10], ax
mov dword [esp + 0x50], ebx
push edi
call fcn.004c9064
lea edx, [esi + 0xc]
mov ecx, edi
call fcn.004cc234
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.004c9da2
mov byte [esp + 0x50], 1
lea ecx, [esp + 0x10]
cmp ecx, eax
je 0x4ca369
push 0xffffffffffffffff
push ebx
push eax
call fcn.0047980b
mov byte [esp + 0x50], bl
lea ecx, [esp + 0x28]
push ebx
push 1
call fcn.0047997f
lea edx, [esp + 0x10]
mov ecx, edi
call fcn.004cc234
mov eax, dword [esi + 8]
dec eax
je 0x4ca3a5
dec eax
jne 0x4ca3d2
add esi, 0x28
lea eax, [esp + 0x10]
cmp eax, esi
je 0x4ca3d2
push 0xffffffffffffffff
push ebx
push esi
mov ecx, eax
call fcn.0047980b
jmp 0x4ca3d2
push ecx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esi + 0x24]
call fcn.0048d2ce
mov byte [esp + 0x50], 2
lea ecx, [esp + 0x10]
push eax
call fcn.0047906a
mov byte [esp + 0x50], bl
lea ecx, [esp + 0x28]
push ebx
push 1
call fcn.0047997f
lea edx, [esp + 0x10]
mov ecx, edi
call fcn.004cc234
or dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
push ebx
push 1
call fcn.0047997f
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005712ac
mov esp, ebp
pop ebp
ret 4

Function at 0x4ca641
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a4bb6
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x694240]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x694240]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], ebx
mov word [esp + 0x10], ax
mov dword [esp + 0x50], ebx
push esi
call fcn.004c9064
lea eax, [esp + 0x28]
mov ecx, edi
push eax
call fcn.004ca7ba
mov byte [esp + 0x50], 1
mov edx, eax
mov ecx, esi
call fcn.004cc234
mov byte [esp + 0x50], bl
lea ecx, [esp + 0x28]
push ebx
push 1
call fcn.0047997f
lea edx, [edi + 0xc]
mov ecx, esi
call fcn.004cc234
or dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
push ebx
push 1
call fcn.0047997f
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005712ac
mov esp, ebp
pop ebp
ret 4
Function at 0x4ca709
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a3fb1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x694240]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x694240]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.004cc284
and dword [esp + 0x38], 0
mov ecx, edi
push eax
call fcn.004cab62
or dword [esp + 0x38], 0xffffffff
xor ebx, ebx
push 0
inc ebx
lea ecx, [esp + 0x14]
push ebx
call fcn.0047997f
mov edx, esi
lea ecx, [esp + 0x10]
call fcn.004cc284
mov dword [esp + 0x38], ebx
lea ecx, [edi + 0xc]
push eax
call fcn.0047906a
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
push 0
push ebx
call fcn.0047997f
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.005712ac
mov esp, ebp
pop ebp
ret 4

Function at 0x4cb060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a4bb6
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x694240]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x694240]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], ebx
mov word [esp + 0x10], ax
mov dword [esp + 0x50], ebx
push esi
call fcn.004c9064
lea eax, [esp + 0x28]
mov ecx, edi
push eax
call fcn.004cb247
mov byte [esp + 0x50], 1
mov edx, eax
mov ecx, esi
call fcn.004cc234
mov byte [esp + 0x50], bl
lea ecx, [esp + 0x28]
push ebx
push 1
call fcn.0047997f
lea edx, [edi + 0xc]
mov ecx, esi
call fcn.004cc234
lea edx, [edi + 0x24]
mov ecx, esi
call fcn.004cc234
lea edx, [edi + 0x3c]
mov ecx, esi
call fcn.004cc234
or dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
push ebx
push 1
call fcn.0047997f
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005712ac
mov esp, ebp
pop ebp
ret 4
Function at 0x4cb13c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a4c87
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x694240]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x694240]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.004cc284
and dword [esp + 0x38], 0
mov ecx, edi
push eax
call fcn.004cb5ef
or dword [esp + 0x38], 0xffffffff
xor ebx, ebx
push 0
inc ebx
lea ecx, [esp + 0x14]
push ebx
call fcn.0047997f
mov edx, esi
lea ecx, [esp + 0x10]
call fcn.004cc284
mov dword [esp + 0x38], ebx
lea ecx, [edi + 0xc]
push eax
call fcn.0047906a
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
push 0
push ebx
call fcn.0047997f
mov edx, esi
lea ecx, [esp + 0x10]
call fcn.004cc284
mov dword [esp + 0x38], 2
lea ecx, [edi + 0x24]
push eax
call fcn.0047906a
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
push 0
push ebx
call fcn.0047997f
mov edx, esi
lea ecx, [esp + 0x10]
call fcn.004cc284
mov dword [esp + 0x38], 3
lea ecx, [edi + 0x3c]
push eax
call fcn.0047906a
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
push 0
push ebx
call fcn.0047997f
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.005712ac
mov esp, ebp
pop ebp
ret 4

Function at 0x4cca4d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a4bb6
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x694240]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x694240]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
push esi
call fcn.004c9064
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], ebx
mov word [esp + 0x10], ax
mov dword [esp + 0x50], ebx
lea eax, [esp + 0x10]
push eax
lea edx, [edi + 8]
lea ecx, [esp + 0x2c]
call fcn.004cce9c
pop ecx
mov byte [esp + 0x50], 1
mov edx, eax
mov ecx, esi
call fcn.004cc234
mov byte [esp + 0x50], bl
lea ecx, [esp + 0x28]
push ebx
push 1
call fcn.0047997f
or dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x10]
push ebx
push 1
call fcn.0047997f
lea edx, [edi + 0xc]
mov ecx, esi
call fcn.004cc234
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005712ac
mov esp, ebp
pop ebp
ret 4
Function at 0x4d81a6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 0x10]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.004d85cb
pop ecx
pop ecx
test al, al
jne 0x4d81c4
xor al, al
jmp 0x4d8227
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x10]
test eax, eax
jne 0x4d81e7
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4d81d9
mov eax, dword [eax]
push 1
push 0x643ebc
push 1
push 0
push eax
jmp 0x4d8203
cmp dword [ecx + 0x14], 8
jb 0x4d81ef
mov ecx, dword [ecx]
mov edx, dword [ebp + 8]
cmp dword [edx + 0x14], 8
jb 0x4d81fa
mov edx, dword [edx]
add eax, eax
push eax
push ecx
push 1
push 0
push edx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
test eax, eax
je 0x4d821b
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d81c0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb al, al
inc al
mov esp, ebp
pop ebp
ret

Function at 0x4d822b
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
lea eax, [ebp - 1]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
push edi
push 0
push eax
push esi
mov edi, edx
mov bl, 1
call fcn.004d8425
add esp, 0xc
test al, al
jne 0x4d825a
xor al, al
jmp 0x4d82b8
cmp byte [ebp - 1], 0
je 0x4d8256
push 0
lea eax, [ebp - 8]
mov edx, edi
push 0xf003f
push eax
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d8612
add esp, 0xc
test al, al
je 0x4d8256
cmp dword [ebp - 8], 0
je 0x4d8256
cmp dword [esi + 0x14], 8
jb 0x4d828c
mov esi, dword [esi]
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4d82a7
push dword [ebp - 8]
call esi
xor bl, bl
push dword [ebp - 8]
call esi
xor edx, edx
movzx ecx, bl
test eax, eax
cmovne ecx, edx
mov al, cl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d833f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
mov eax, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 1]
push edi
push dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0xc], eax
push ecx
push esi
mov ecx, eax
mov edi, edx
inc ebx
call fcn.004d8425
add esp, 0xc
test al, al
jne 0x4d8376
xor al, al
jmp 0x4d841e
cmp byte [ebp - 1], 0
je 0x4d836f
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
push ebx
push eax
mov edx, edi
call fcn.004d8612
add esp, 0xc
test al, al
je 0x4d836f
cmp dword [ebp - 8], 0
je 0x4d836f
cmp dword [esi + 0x14], 8
jb 0x4d83a5
mov eax, dword [esi]
jmp 0x4d83a7
mov eax, esi
mov edi, dword [ebp + 0xc]
lea ecx, [edi + 0x1c]
push ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x4d83c8
test eax, eax
jne 0x4d8409
mov eax, dword [edi + 0x1c]
add eax, 5
push eax
push ebx
call fcn.00574c6e
mov dword [edi + 0x20], eax
pop ecx
pop ecx
test eax, eax
jne 0x4d83e2
xor bl, bl
jmp 0x4d8409
cmp dword [esi + 0x14], 8
jb 0x4d83ea
mov esi, dword [esi]
lea ecx, [edi + 0x1c]
push ecx
push eax
lea eax, [edi + 0x18]
push eax
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
movzx ebx, bl
test eax, eax
cmovne ebx, edx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
movzx ecx, bl
test eax, eax
cmovne ecx, edx
mov al, cl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d8425
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 4]
xor ebx, ebx
push 1
push eax
mov dword [ebp - 4], ebx
call fcn.004d8612
add esp, 0xc
test al, al
jne 0x4d8448
xor al, al
jmp 0x4d8489
cmp dword [ebp - 4], ebx
jne 0x4d8454
mov eax, dword [ebp + 0xc]
mov byte [eax], bl
jmp 0x4d8487
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4d845f
mov eax, dword [eax]
push ebx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov ecx, eax
mov eax, dword [ebp + 0xc]
neg ecx
sbb cl, cl
inc cl
mov byte [eax], cl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4d8444
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d84d8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x694240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x4d8505
mov al, 1
jmp 0x4d85ba
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4d852a
cmp eax, 2
sete al
jmp 0x4d85ba
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
lea esi, [edi + eax*2]
pop eax
cmp word [esi - 2], ax
je 0x4d8565
mov word [esi], ax
add esi, 2
xor eax, eax
mov word [esi], ax
jmp 0x4d8565
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.004d94d0
mov edx, edi
mov ecx, ebx
call fcn.004d84d8
test al, al
je 0x4d859a
xor ecx, ecx
mov dword [ebp - 0x218], 0x104
lea eax, [ebp - 0x220]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push ecx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4d854a
xor eax, eax
mov word [esi - 2], ax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
sbb al, al
inc al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005712ac
mov esp, ebp
pop ebp
ret

Function at 0x4d864a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x694240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edx + 0x14], 8
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10c], ebx
jb 0x4d8676
mov edx, dword [edx]
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp + 0x10]
or eax, 1
push eax
push ebx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d8708
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], bl
push ebx
push eax
call fcn.00572db0
add esp, 0xc
mov dword [ebp - 0x110], 0x104
cmp dword [esi + 0x14], 8
jb 0x4d86c2
mov esi, dword [esi]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push esi
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d86fc
cmp dword [ebp - 0x114], 4
jne 0x4d86fc
mov eax, dword [ebp - 0x108]
mov bl, 1
mov dword [edi], eax
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005712ac
mov esp, ebp
pop ebp
ret
Function at 0x4d9a9f
Capabilities:
Terminate thread

Disassembly:
push 8
mov eax, 0x5a7390
call fcn.00576dcd
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.._AV1043______________________________________.0
mov dword [ebp - 4], 3
call fcn.004da615
lea edi, [esi + 0x2c]
xor ebx, ebx
mov eax, dword [edi]
test eax, eax
je 0x4d9b03
cmp dword [eax + 0x20], ebx
je 0x4d9adf
push ebx
push ebx
push 0x12
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
cmp byte [esi + 0x54], bl
je 0x4d9af2
mov edx, 0x4e20
mov ecx, edi
call fcn.004dcd43
jmp 0x4d9b03
mov eax, dword [edi]
push ebx
mov ecx, dword [eax]
call fcn.0056fb40
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov byte [ebp - 4], 2
lea ecx, [esi + 0x34]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 2
call fcn.004da7ff
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 1
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4d9b2d
call fcn.004760d0
mov byte [ebp - 4], bl
lea eax, [esi + 0x10]
push eax
mov dword [esi + 0xc], vtable.._AV814____________________________________________.0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0048e2f4
call fcn.00576d9b
ret
Function at 0x4db319
Capabilities:
Enumerate processes

Disassembly:
push 0x23c
mov eax, 0x5a7bb6
call fcn.00576e00
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x248], ebx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4db34a
xor al, al
jmp 0x4db3d7
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x4db3c2
push 1
call fcn.0055abcf
pop ecx
mov dword [ebp - 0x244], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x244]
push eax
mov edx, ebx
lea ecx, [ebp - 0x21c]
call fcn.004db5a6
pop ecx
mov bl, al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x244]
call fcn.0047582b
test bl, bl
je 0x4db3ae
lea eax, [ebp - 0x238]
mov ecx, edi
push eax
call fcn.00498a89
lea eax, [ebp - 0x240]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov ebx, dword [ebp - 0x248]
test eax, eax
jne 0x4db364
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [edi]
xor eax, eax
cmp ecx, dword [edi + 4]
setne al
call fcn.00576daf
ret

Function at 0x4db4f3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x58]
push 0x40
xorps xmm0, xmm0
mov dword [ebp - 0x5c], ebx
push ebx
push eax
mov esi, edx
mov edi, ecx
movdqu xmmword [ebp - 0x14], xmm0
call fcn.00572db0
add esp, 0xc
cmp dword [esi + 0x10], ebx
jne 0x4db525
mov esi, ebx
jmp 0x4db52d
cmp dword [esi + 0x14], 8
jb 0x4db52d
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x4db535
mov edi, dword [edi]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp esi, 1
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4dd0fe
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x4dd118
mov ecx, dword [eax]
test ecx, ecx
je 0x4dd118
push 0
call fcn.0056fb40
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
ret
Function at 0x4deb55
Capabilities:
Get disk size

Disassembly:
push 0x64
mov eax, 0x5a8a12
call fcn.00576e00
mov esi, ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00480cdf
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00591590
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
push eax
call fcn.00480cdf
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
push 0
push ebx
call fcn.0047997f
mov byte [ebp - 4], 6
xor edi, edi
push edi
push ebx
lea ecx, [ebp - 0x28]
call fcn.0047997f
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.00480cdf
mov byte [ebp - 4], 9
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.0058f700
pop ecx
pop ecx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
push edi
push ebx
call fcn.0047997f
cmp dword [ebp + 8], edi
jne 0x4debde
cmp dword [ebp + 0xc], edi
jne 0x4dec37
mov edx, esi
lea ecx, [ebp - 0x40]
call fcn.004dee42
mov byte [ebp - 4], 0xb
cmp dword [eax + 0x14], 8
jb 0x4debf4
mov eax, dword [eax]
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x60]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp eax, ebx
jne 0x4dec13
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
jmp 0x4dec1b
xorps xmm0, xmm0
movlpd qword [ebp - 0x60], xmm0
mov ecx, dword [ebp - 0x60]
cmp ecx, dword [ebp + 0xc]
setb bl
mov byte [ebp - 4], 6
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.0047997f
test bl, bl
je 0x4dec3b
xor bl, bl
jmp 0x4dec3d
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
push 0
push 1
call fcn.0047997f
mov al, bl
call fcn.00576daf
ret

Function at 0x4dec55
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
xor edi, edi
mov dword [ebp - 8], ecx
and dword [ebp - 4], edi
test esi, esi
je 0x4dec8f
push 0
lea eax, [ebp - 4]
push eax
push esi
lea eax, [edi + ebx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4dec98
add edi, dword [ebp - 4]
mov ecx, dword [ebp - 8]
sub esi, dword [ebp - 4]
jne 0x4dec6e
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
jmp 0x4dec91
Function at 0x4deccd
Capabilities:
Get file size

Disassembly:
push 0x44
mov eax, 0x5a8a5f
call fcn.00576e00
mov dword [ebp - 0x40], edx
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 4], ebx
call fcn.00499807
test al, al
je 0x4ded23
cmp dword [esi + 0x14], 8
jb 0x4decfd
mov esi, dword [esi]
push ebx
push ebx
push 3
push ebx
push 3
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4ded36
or ebx, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.004793bc
mov eax, ebx
jmp 0x4dedf0
push edi
lea ecx, [ebp - 0x4c]
call fcn.004df203
mov dword [ebp - 0x50], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
push edi
push esi
call fcn.004e5d2c
mov byte [ebp - 4], 2
mov ecx, esi
mov edx, dword [ebp - 0x4c]
push edi
call fcn.004dedf6
pop ecx
mov byte [ebp - 0x39], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.004e5e61
mov byte [ebp - 4], bl
test esi, esi
je 0x4ded82
cmp esi, 0xffffffff
je 0x4ded82
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x39], 0
jne 0x4dedb7
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], str._697
push eax
lea ecx, [ebp - 0x38]
call fcn.004775be
mov byte [ebp - 4], 4
mov dword [ebp - 0x38], vtable.._AV1051____________________________________________________.0
mov byte [ebp - 4], bl
lea eax, [ebp - 0x38]
push 0x691400
push eax
call fcn.00572d44
mov eax, edi
lea ecx, [ebp - 0x2c]
shr eax, 1
push eax
push dword [ebp - 0x4c]
call fcn.00478fec
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x40]
push eax
call fcn.0047906a
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2c]
push ebx
push 1
call fcn.0047997f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.004793bc
mov eax, edi
call fcn.00576daf
ret

Function at 0x4dedf6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
xor edi, edi
mov dword [ebp - 8], ecx
and dword [ebp - 4], edi
test esi, esi
je 0x4dee35
push 0
lea eax, [ebp - 4]
push eax
push esi
lea eax, [edi + ebx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4dee3e
mov eax, dword [ebp - 4]
test eax, eax
je 0x4dee3e
mov ecx, dword [ebp - 8]
add edi, eax
sub esi, eax
jne 0x4dee0f
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
jmp 0x4dee37