joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a3f9
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.advapi32.dll_RegQueryInfoKeyW]
mov ebx, eax
cmp ebx, esi
jne 0x46a522
mov eax, dword [ebp - 0x10]
lea eax, [eax*4 + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.00444a2e
cmp dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
jle 0x46a51a
push edi
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
push esi
push esi
push esi
shl eax, 2
push esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 0xc]
mov dword [ebp - 8], esi
push dword [ebp + 8]
mov word [edi], si
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
mov ebx, eax
cmp ebx, esi
jne 0x46a50a
cmp word [edi], si
je 0x46a50a
mov eax, dword [ebp + 0x10]
push dword [eax]
lea ecx, [ebp - 4]
call fcn.0044df7a
push 0x4c0770
lea ecx, [ebp - 4]
call fcn.00444a7c
push edi
lea ecx, [ebp - 4]
call fcn.00444a7c
push esi
push dword [ebp + 0xc]
push esi
push esi
push 4
push 4
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_SetNamedSecurityInfoW]
lea eax, [ebp - 8]
push eax
movzx eax, word [0x4dac14]
or eax, 0xf003f
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
cmp dword [ebp - 8], esi
mov ebx, eax
je 0x46a502
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.0046a3f9
add esp, 0xc
cmp dword [ebp - 8], esi
mov ebx, eax
je 0x46a502
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea ecx, [ebp - 4]
call fcn.0043e48d
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x46a450
pop edi
lea ecx, [ebp - 0x18]
call fcn.0043e48d
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x47ac89
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, 0x4dbd30
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
push dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
call fcn.004571bf
mov ebp, dword [sym.imp.user32.dll_ShowWindow]
mov edi, dword [esp + 0x14]
xor ebx, ebx
cmp dword [esp + 0x20], ebx
je 0x47acce
push 0xfffffffffffffff0
push edi
call dword [sym.imp.user32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x47acce
push 0
push edi
inc ebx
call ebp
push dword [esp + 0x1c]
push edi
call dword [sym.imp.user32.dll_SetWindowTextW]
test ebx, ebx
je 0x47ace2
push 5
push edi
call ebp
push esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp dword [esp + 0x20], 0
je 0x47acfa
push 1
push edi
call fcn.004a960a
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x483013
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
mov eax, dword [ebp + 0x24]
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov ebx, eax
and eax, 2
and ebx, 1
mov dword [ebp + 0x24], eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov esi, eax
mov eax, 0xb4
cmp esi, eax
jle 0x483043
mov esi, eax
xor eax, eax
xor edx, edx
cmp dword [ebp + 0x24], edx
mov ecx, 0xcc
lea edi, [ebp - 0x340]
mov dword [ebp - 0x344], edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x268], eax
mov eax, dword [ebp + 8]
mov byte [ebp - 0x290], 0x40
mov byte [ebp - 0x24], dl
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xd4], edx
je 0x48309a
mov dword [ebp - 0xd4], 0x40000000
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x32c], eax
lea eax, [esi + esi]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x264]
push eax
call fcn.004143a0
and word [ebp + esi*2 - 0x264], 0
add esp, 0xc
mov esi, 0x4db8d4
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
push 0x4dac18
push 0x10000
lea eax, [ebp - 0x344]
push eax
push 0x48295c
push 0x20000
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
mov dword [ebp + 0x1c], eax
je 0x48312a
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp + 0x24], 0x270f
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 0x268], eax
jne 0x48312a
push 0
call edi
dec dword [ebp + 0x24]
jns 0x483105
jmp 0x48311f
push 1
call edi
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 0x268], eax
je 0x48311b
push esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov esi, dword [ebp + 0x1c]
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
je 0x483160
cmp esi, edi
je 0x48316b
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0x14]
mov ecx, 0x4db0e0
call fcn.00415f6a
cmp esi, edi
je 0x48316b
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
movzx eax, byte [ebp - 0xd4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x499a0e
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call dword [sym.imp.user32.dll_GetWindowTextLengthW]
mov edi, dword [esp + 0x10]
mov esi, eax
lea eax, [esi + 2]
push eax
mov ecx, edi
call fcn.00444a55
mov eax, dword [edi]
and word [eax], 0
mov edi, dword [edi]
inc esi
push esi
push edi
push dword [esp + 0x14]
call dword [sym.imp.user32.dll_GetWindowTextW]
pop edi
pop esi
ret

Function at 0x49aa44
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], 5
call dword [sym.imp.advapi32.dll_AllocateAndInitializeSid]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x49aaa1
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
call sub.advapi32.dll_CheckTokenMembership
test eax, eax
jne 0x49aa98
mov dword [ebp - 4], ebx
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_FreeSid]
mov eax, dword [ebp - 4]
pop ebx
leave
ret
Function at 0x49e3f3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push 0
mov esi, ecx
mov eax, dword [esi + 0xb0]
push 0x132f
push dword [esi + 0x18]
mov dword [ebp - 4], eax
call dword [sym.imp.user32.dll_SendMessageW]
mov ebx, dword [esi + 0xa4]
mov edi, eax
mov eax, dword [ebp - 4]
cmp edi, eax
je 0x49e4c3
test edi, edi
jl 0x49e4c3
cmp edi, dword [esi + 0xac]
jge 0x49e4c3
mov eax, dword [ebx + eax*4]
mov eax, dword [eax]
test eax, eax
je 0x49e452
push 0
push dword [eax + 0x18]
call dword [sym.imp.user32.dll_ShowWindow]
mov dword [esi + 0xb0], edi
mov eax, dword [ebx + edi*4]
mov eax, dword [eax]
test eax, eax
je 0x49e46c
push 5
push dword [eax + 0x18]
call dword [sym.imp.user32.dll_ShowWindow]
mov ebx, dword [esi + 0x18]
call dword [sym.imp.user32.dll_GetFocus]
cmp eax, ebx
je 0x49e480
push ebx
call dword [sym.imp.user32.dll_SetFocus]
push 0x4c8b70
lea ecx, [ebp - 4]
call fcn.0044df7a
push dword [esi + 0x84]
lea ecx, [ebp - 4]
call fcn.00444a7c
push str..Select
lea ecx, [ebp - 4]
call fcn.00444a7c
push dword [ebp - 4]
inc edi
push edi
push dword [esi + 0x88]
call fcn.004470b2
add esp, 0xc
lea ecx, [ebp - 4]
call fcn.0043e48d
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4a04d6
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0xfffffffffffffff0
push dword [esi + 0x18]
call dword [sym.imp.user32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x4a0501
push edi
mov edi, dword [sym.imp.user32.dll_ShowWindow]
push 0
push dword [esi + 0x18]
call edi
push 5
push dword [esi + 0x18]
call edi
pop edi
pop esi
ret
Function at 0x4a982f
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, 0x2713
xor ebx, ebx
cmp dword [ebp + 8], edi
mov esi, ecx
jne 0x4a98e3
lea eax, [ebp - 8]
push eax
call dword [sym.imp.user32.dll_GetCursorPos]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.user32.dll_GetWindowRect]
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push dword [ebp - 8]
push eax
call dword [sym.imp.user32.dll_PtInRect]
test eax, eax
jne 0x4a98c4
mov al, byte [esi + 0x75]
cmp al, bl
jle 0x4a98a5
mov byte [esi + 0x75], bl
cmp byte [esi + 0x74], bl
jle 0x4a99d9
push 1
push ebx
push dword [esi + 0x18]
call dword [sym.imp.user32.dll_InvalidateRect]
jmp 0x4a99d9
dec al
cmp al, 0x9c
mov byte [esi + 0x75], al
jge 0x4a99d9
push edi
push dword [esi + 0x18]
mov byte [esi + 0x75], bl
call dword [sym.imp.user32.dll_KillTimer]
jmp 0x4a99d9
push 1
call dword [sym.imp.user32.dll_GetAsyncKeyState]
test ah, ah
jns 0x4a99d9
cmp byte [esi + 0x75], bl
jg 0x4a99d9
mov byte [esi + 0x75], 1
jmp 0x4a988b
mov edi, 0x2711
cmp dword [ebp + 8], edi
jne 0x4a99d9
cmp byte [esi + 0x68], bl
jle 0x4a99d9
lea eax, [ebp - 8]
push eax
call dword [sym.imp.user32.dll_GetCursorPos]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.user32.dll_GetWindowRect]
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push dword [ebp - 8]
push eax
call dword [sym.imp.user32.dll_PtInRect]
test eax, eax
jne 0x4a999c
push edi
push dword [esi + 0x18]
call dword [sym.imp.user32.dll_KillTimer]
cmp word [esi + 0x6a], bx
mov byte [esi + 0x68], bl
jl 0x4a996d
mov al, byte [esi + 0x74]
cmp al, bl
mov word [esi + 0x6a], bx
jle 0x4a9958
mov cl, byte [esi + 0x6c]
and cl, 2
mov byte [esi + 0x6d], cl
cmp byte [esi + 0x69], bl
jne 0x4a9961
cmp al, bl
jle 0x4a996d
push 1
push ebx
push dword [esi + 0x18]
call dword [sym.imp.user32.dll_InvalidateRect]
push ebx
push ebx
push 0x2a3
mov dword [0x4dbe68], ebx
push dword [esi + 0x18]
call dword [sym.imp.user32.dll_PostMessageW]
mov eax, dword [esi + 0x50]
cmp eax, dword [0x4dbe3c]
jne 0x4a99d9
push 1
push dword [esi + 0x18]
call fcn.004a960a
pop ecx
pop ecx
jmp 0x4a99d9
mov al, byte [0x4d9845]
cmp al, byte [esi + 0x68]
jne 0x4a99af
push dword [esi + 0x18]
call fcn.004a1926
pop ecx
mov al, byte [esi + 0x68]
cmp al, byte [0x4d9844]
jg 0x4a99bf
inc al
mov byte [esi + 0x68], al
mov al, byte [0x4d9844]
cmp al, byte [esi + 0x68]
jne 0x4a99d9
push ebx
push ebx
push 0x2a1
push dword [esi + 0x18]
call dword [sym.imp.user32.dll_PostMessageW]
cmp byte [esi + 0x7c], bl
jge 0x4a99ef
mov eax, dword [esi]
push ebx
push dword [ebp + 8]
push 0x113
push dword [esi + 0x18]
call dword [eax + 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4ac576
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
and eax, 0xffdf
cmp ax, 0x41
je 0x4ac594
cmp ax, 0x42
je 0x4ac594
push 0xfffffffffffffffe
pop eax
leave
ret
and word [ebp - 4], 0
mov word [ebp - 8], ax
lea eax, [ebp - 8]
push eax
mov word [ebp - 6], 0x3a
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
xor ecx, ecx
cmp eax, 2
setne cl
mov eax, ecx
leave
ret

Function at 0x4ac728
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
pop ebp
ret
Function at 0x4affb6
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4cd740
call fcn.004adcb0
mov edi, 0x94
mov eax, edi
call fcn.004ad340
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4dbf44], ecx
mov eax, dword [esi + 4]
mov dword [0x4dbf50], eax
mov edx, dword [esi + 8]
mov dword [0x4dbf54], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4dbf48], esi
cmp ecx, 2
je 0x4b0016
or esi, 0x8000
mov dword [0x4dbf48], esi
shl eax, 8
add eax, edx
mov dword [0x4dbf4c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x4b0051
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b0051
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4b0069
cmp eax, 0x20b
je 0x4b0056
mov dword [ebp - 0x1c], esi
jmp 0x4b007d
cmp dword [ecx + 0x84], 0xe
jbe 0x4b0051
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4b0077
cmp dword [ecx + 0x74], 0xe
jbe 0x4b0051
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004b2845
pop ecx
test eax, eax
jne 0x4b0091
push 0x1c
call fcn.004aff92
pop ecx
call fcn.004b1d8b
test eax, eax
jne 0x4b00a2
push 0x10
call fcn.004aff92
pop ecx
call fcn.004b8d93
mov dword [ebp - 4], esi
call fcn.004b8b95
test eax, eax
jge 0x4b00bb
push 0x1b
call fcn.004aff6d
pop ecx
call fcn.004b8af6
mov dword [0x4dd914], eax
call fcn.004b898c
mov dword [0x4dbf38], eax
call fcn.004b88f6
test eax, eax
jge 0x4b00e0
push 8
call fcn.004aff6d
pop ecx
call fcn.004b86c3
test eax, eax
jge 0x4b00f1
push 9
call fcn.004aff6d
pop ecx
push 1
call fcn.004b0396
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4b0107
push eax
call fcn.004aff6d
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoW]
call fcn.004b867d
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x4b0128
movzx eax, word [ebp - 0x40]
jmp 0x4b012b
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0040917f
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x4b0149
push edi
call fcn.004b04c3
call fcn.004b04e5
jmp 0x4b017b
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004adceb
ret
Function at 0x4b0400
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4cd778
call fcn.004adcb0
push 8
call fcn.004b29e9
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x4dbf84], esi
jne 0x4b0434
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov dword [0x4dbf80], esi
mov al, byte [ebp + 0x10]
mov byte [0x4dbf7c], al
cmp dword [ebp + 0xc], edi
jne 0x4b047e
cmp dword [0x4dd90c], edi
je 0x4b046e
mov eax, dword [0x4dd908]
sub eax, 4
mov dword [0x4dd908], eax
cmp eax, dword [0x4dd90c]
jb 0x4b046e
mov eax, dword [eax]
cmp eax, edi
je 0x4b044f
call eax
jmp 0x4b044f
push 0x4d90e0
mov eax, 0x4d90d8
call fcn.004b037e
pop ecx
push 0x4d90ec
mov eax, 0x4d90e4
call fcn.004b037e
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x4b04af
cmp dword [ebp + 0x10], edi
jne 0x4b04bd
mov dword [0x4dbf84], esi
push dword [ebp + 8]
call fcn.004b033c
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x4b04bc
push 8
call fcn.004b2934
pop ecx
ret
call fcn.004adceb
ret
Function at 0x4b110c
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x4da34c]
xor ecx, ecx
xor eax, ebp
cmp dword [ebp + 0x3b4], ecx
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
jne 0x4b1148
xor eax, eax
jmp 0x4b12b2
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3ac]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x4dc7c0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x4b1186
push 2
push ecx
push ecx
push dword [ebp + 0x3ac]
call fcn.004b9247
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x4b1220
cmp dword [ebp + 0x3b4], ecx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], ecx
jbe 0x4b1283
jmp 0x4b11aa
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x4b11e5
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x4b11d6
inc dword [ebp - 0x78]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x6c]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x400
jl 0x4b11b6
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x4b1244
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x4b124d
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp + 0x3b4]
jb 0x4b11a8
jmp 0x4b124d
push ecx
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x4b1244
mov eax, dword [ebp - 0x80]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
jmp 0x4b124d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x4b12ad
cmp dword [ebp - 0x68], eax
je 0x4b1280
push 5
pop esi
cmp dword [ebp - 0x68], esi
jne 0x4b1275
call fcn.004b1087
mov dword [eax], 9
call fcn.004b1090
mov dword [eax], esi
jmp 0x4b12a8
push dword [ebp - 0x68]
call fcn.004b1099
pop ecx
jmp 0x4b12a8
mov edi, dword [ebp - 0x7c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x4b1295
cmp byte [edi], 0x1a
jne 0x4b1295
xor eax, eax
jmp 0x4b12b0
call fcn.004b1087
mov dword [eax], 0x1c
call fcn.004b1090
and dword [eax], 0
or eax, 0xffffffff
jmp 0x4b12b0
sub eax, dword [ebp - 0x78]
pop esi
pop ebx
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
pop edi
call fcn.004b919e
add ebp, 0x3a4
leave
ret
Function at 0x4b2265
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x4b2293
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x4b229a
cmp ebx, dword [eax + 4]
jae 0x4b229a
xor eax, eax
jmp 0x4b248a
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x4b22ab
xor eax, eax
inc eax
jmp 0x4b2489
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4b22c1
cmp ecx, edx
jae 0x4b2406
cmp dword [eax + 4], 0
je 0x4b22ca
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4b22b2
cmp dword [ebp + 8], 0
je 0x4b22ec
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4b2406
cmp eax, esi
jae 0x4b2406
mov eax, dword [0x4dbfb0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x4b2311
cmp dword [esi*4 + 0x4dbfb8], edi
je 0x4b240a
inc esi
cmp esi, eax
jl 0x4b22ff
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
test eax, eax
je 0x4b2486
cmp dword [ebp - 8], 0x1000000
jne 0x4b2486
test byte [ebp - 0xc], 0xcc
je 0x4b238f
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x4b2486
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4b2486
cmp word [eax + 0x18], 0x10b
jne 0x4b2486
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x4b2486
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x4b238f
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x4b238f
test byte [ecx + 0x27], 0x80
jne 0x4b2406
push 1
push 0x4dbff8
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
test eax, eax
jne 0x4b22a3
mov ecx, dword [0x4dbfb0]
test ecx, ecx
mov edx, ecx
jle 0x4b23c3
lea eax, [ecx*4 + 0x4dbfb4]
cmp dword [eax], edi
je 0x4b23c3
dec edx
sub eax, 4
test edx, edx
jg 0x4b23b7
test edx, edx
jne 0x4b23f4
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4b23d0
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4b23e8
lea eax, [edx*4 + 0x4dbfb8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4b23d6
cmp ecx, 0x10
jge 0x4b23f4
inc ecx
mov dword [0x4dbfb0], ecx
push 0
push 0x4dbff8
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
jmp 0x4b22a3
xor eax, eax
jmp 0x4b2489
test esi, esi
jle 0x4b22a3
mov ebx, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push 1
push 0x4dbff8
call ebx
test eax, eax
jne 0x4b22a3
cmp dword [esi*4 + 0x4dbfb8], edi
je 0x4b2460
mov eax, dword [0x4dbfb0]
lea esi, [eax - 1]
test esi, esi
jl 0x4b244e
cmp dword [esi*4 + 0x4dbfb8], edi
je 0x4b244a
dec esi
jns 0x4b243e
test esi, esi
jge 0x4b245e
cmp eax, 0x10
jge 0x4b2459
inc eax
mov dword [0x4dbfb0], eax
lea esi, [eax - 1]
jmp 0x4b2460
je 0x4b2478
xor ecx, ecx
test esi, esi
jl 0x4b2478
lea eax, [ecx*4 + 0x4dbfb8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4b2466
push 0
push 0x4dbff8
call ebx
jmp 0x4b22a3
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b24ef
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004ad340
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
test eax, eax
je 0x4b258a
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4dbf44]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4b258a
cmp eax, 1
je 0x4b25ab
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
test eax, eax
je 0x4b258a
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4b2557
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4b2586
xor eax, eax
inc eax
jmp 0x4b25ca
cmp edi, eax
jae 0x4b258e
xor eax, eax
jmp 0x4b25ca
cmp eax, esi
jae 0x4b2595
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov eax, dword [0x4dbf44]
jmp 0x4b25ae
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret