joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48fb30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 8], ebx
cmp dword [ebx], 0
jne 0x48fcdc
cmp dword [ebx + 4], 0xffffffff
jne 0x48fcdc
push edi
lea edi, [ebx + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48fb67
sub ecx, edx
sar ecx, 1
movzx eax, word [ebx + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x48fba3
cmp eax, 0x2f
je 0x48fba3
add edi, 0xfffffffe
jmp 0x48fb90
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x48fb90
mov eax, dword [0x4f3570]
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
push esi
cmp edi, 1
jne 0x48fbce
mov esi, dword [ebp + 8]
push edi
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x48fbe9
pop esi
pop edi
mov eax, 0x2000000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 2
je 0x48fbe6
cmp edi, 3
je 0x48fbe6
pop esi
pop edi
mov eax, 0x10000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 8]
xor ebx, ebx
xor al, al
mov byte [ebp - 1], al
mov byte [ebp + 0x13], bl
cmp edi, 1
je 0x48fc2f
cmp edi, 2
jne 0x48fc4b
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x48fc29
pop esi
pop edi
mov eax, 0x200
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov byte [ebp + 0x13], 1
jmp 0x48fc35
mov ebx, esi
mov byte [ebp + 0x13], 0
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
setne al
mov byte [ebp - 1], al
push 0x20
call fcn.004a4277
add esp, 4
mov esi, eax
cmp edi, 1
je 0x48fc86
cmp edi, 2
je 0x48fc86
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0xc]
mov word [esi], 0x100
mov byte [esi + 0x10], 0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0xc], 0
jmp 0x48fcb7
mov al, byte [ebp + 0x13]
mov byte [esi + 0x10], al
mov al, byte [ebp - 1]
mov byte [esi], 1
mov byte [esi + 1], al
mov dword [esi + 4], ebx
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
test al, al
je 0x48fcb7
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0xc], eax
push esi
call fcn.00493000
mov ecx, dword [ebp - 8]
add esp, 4
mov dword [ecx], eax
neg eax
pop esi
sbb eax, eax
and eax, 0xfffffe00
pop edi
add eax, 0x200
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x1000000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4929f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ebx
imul esi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0x492a2e
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x492a22
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x492a3f
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.004a88a0
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x492a60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x492a6e
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x492b2d
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4e42d0]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4e42d0]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4e42d0]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4e42d0]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4e42d0]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4e42d0]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4e42d0]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4e42d0]
sub edi, 1
jne 0x492a86
pop edi
test esi, esi
je 0x492b4b
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4e42d0]
sub esi, 1
jne 0x492b31
not eax
pop esi
pop ebp
ret
Function at 0x492e30
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x492fe9
cmp dword [edi + 0x18], 0
je 0x492fe9
cmp dword [edi + 0x7c], 0
je 0x492e5b
push edi
call fcn.00492b50
add esp, 4
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push edi
call fcn.004934a0
add esp, 0x10
test eax, eax
je 0x492e7e
mov eax, 0xffffff99
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call fcn.004b2c35
mov esi, eax
add esp, 4
test esi, esi
je 0x492ec1
push 0x4000
call fcn.004b2c35
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x492ecc
push esi
call fcn.004b2c1a
add esp, 4
pop esi
mov eax, 0xffffff98
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x3c]
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x54], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x40], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x492f28
lea eax, [esi + 4]
mov dword [esi + 0x24], 0
push eax
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00490fd0
add esp, 4
test eax, eax
jne 0x492f28
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov cl, byte [edi + 0x30]
mov dword [esi + 0x58], eax
and cl, 1
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x30]
shr eax, 3
mov byte [esi + 0x6c], cl
test al, 1
je 0x492f4c
mov al, byte [edi + 0x39]
jmp 0x492f4f
mov al, byte [edi + 0x3f]
mov edx, dword [ebp + 0xc]
mov byte [esi + 0x80], al
movzx eax, cl
neg eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
sbb eax, eax
mov dword [esi + 0x78], 0x34567890
and eax, 0xc
mov dword [esi + 0x7c], eax
test edx, edx
je 0x492fcb
mov edi, edi
mov al, byte [edx]
test al, al
je 0x492fcb
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4e42d0]
movzx eax, cl
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
mov dword [esi + 0x70], ecx
mov ecx, dword [esi + 0x78]
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4e42d0]
mov dword [esi + 0x78], ecx
add edx, 1
jne 0x492f80
mov eax, dword [ebp - 8]
add eax, 0x1e
mov dword [edi + 0x7c], esi
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xffffff9a
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x49fef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x49ff3f
mov esi, dword [ebp + 0x18]
lea eax, [ebp + 0x10]
push edi
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49ff3f
cmp esi, dword [ebp + 0x10]
je 0x49ff3a
push 0x4f35d4
push 1
push edi
push edi
call fcn.0049f583
jmp 0x49ff4d
xor eax, eax
inc eax
jmp 0x49ff52
mov eax, 0x4f35d4
push eax
push eax
push edi
push edi
call fcn.0049f5d0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x4a113f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4a1169
mov eax, 0x4f35d4
push eax
push eax
push 0
push 0
call fcn.0049f5d0
add esp, 0x10
xor eax, eax
pop ebp
ret
xor eax, eax
inc eax
pop ebp
ret

Function at 0x4a1eab
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x4a23ec
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x4a26ab
Capabilities:
Check mutex on windows

Disassembly:
push 0xa4
mov eax, 0x4dd4e6
call fcn.004a4fe2
mov esi, ecx
mov dword [ebp - 0xa0], esi
xor ebx, ebx
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
push 0x41
lea eax, [ebp - 0x98]
push eax
call fcn.004a2e7c
add esp, 0x14
xor eax, eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x98]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x9c], edi
test edi, edi
je 0x4a27f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4a2724
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], ebx
call fcn.004a2cdb
test eax, eax
je 0x4a2759
mov dword [esi], eax
mov eax, dword [esi]
inc dword [eax + 0x5bc]
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
jne 0x4a27f7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4a27f7
push 0x5c0
call fcn.004a29b6
pop ecx
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x4a277c
push edi
mov ecx, eax
call fcn.004a2838
jmp 0x4a277e
mov eax, ebx
mov byte [ebp - 4], bl
mov dword [esi], eax
test eax, eax
je 0x4a27ff
xor ebx, ebx
inc ebx
mov dword [ebp - 0xb0], ebx
push eax
call fcn.004a2e1b
pop ecx
test eax, eax
jne 0x4a2732
mov dword [ebp - 0xa8], 3
push 0x514edc
lea eax, [ebp - 0xa8]
jmp 0x4a2814
mov eax, esi
call fcn.004a4f34
ret
mov dword [ebp - 0xa4], 1
push 0x514edc
lea eax, [ebp - 0xa4]
push eax
call fcn.004a8ffc
int3
Function at 0x4a2838
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x4dd519
call fcn.004a4f43
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [esi], 0
lea ecx, [esi + 8]
or dword [esi + 4], 0xffffffff
call fcn.004a267c
and dword [ebp - 4], 0
and dword [esi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4a2884
mov eax, dword [ebp + 8]
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004a4f11
ret 4
push 0x514edc
lea eax, [ebp + 8]
mov dword [ebp + 8], 2
push eax
call fcn.004a8ffc
int3

Function at 0x4a2a50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebx]
add ecx, 8
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x5a8]
mov dword [ecx + 0x5b0], eax
call fcn.004a2be4
mov edi, eax
test edi, edi
je 0x4a2adb
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jne 0x4a2a8b
mov esi, edi
jmp 0x4a2ac7
push dword [edi]
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x4a2ac0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4a2ab3
mov ecx, dword [ebx]
push edi
add ecx, 8
call fcn.004a2b7f
jmp 0x4a2ac7
push 0x4e6cd8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4a2ac7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx]
add ecx, 8
call fcn.004a2be4
mov edi, eax
test edi, edi
jne 0x4a2a80
test esi, esi
jne 0x4a2af0
mov ecx, dword [ebx]
add ecx, 8
call fcn.004a2d6c
mov esi, eax
test esi, esi
je 0x4a2af0
mov eax, dword [ebp - 4]
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4a5b30
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x51a3c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2ec], ebx
push edi
test ebx, ebx
je 0x4a5d34
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4a5d34
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.004a8e20
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2e4]
add esp, 0xc
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call esi
test eax, eax
jne 0x4a5d09
xor edi, edi
mov dword [ebp - 0x2d8], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x1d0]
push eax
push edi
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4a5cf8
lea eax, [ebp - 0x2e8]
push eax
push 1
push 0
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x2e4]
call esi
test eax, eax
jne 0x4a5cc2
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2e0], 1
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2dc], 0x104
push eax
lea eax, [ebp - 0x2e0]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x2e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5cba
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.004a8e20
push 0x64
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a5d50
add esp, 0x18
test eax, eax
je 0x4a5cba
cmp byte [ebp - 0x68], 0
je 0x4a5c7c
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x4a5cba
lea ecx, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x4a5ca9
mov al, byte [esi + ecx]
test al, al
je 0x4a5ca9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4a5c90
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x2e8]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x104
push eax
lea eax, [ebp - 0x1d0]
inc edi
push eax
push edi
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4a5bd0
push dword [ebp - 0x2e4]
call ebx
mov ebx, dword [ebp - 0x2ec]
mov edi, dword [ebp + 0xc]
cmp byte [ebp - 0x68], 0
pop esi
je 0x4a5d34
lea eax, [ebp - 0x68]
push eax
push edi
push ebx
call fcn.004878a0
xor ecx, ecx
test eax, eax
pop edi
setns cl
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a44be
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.004a44be
mov esp, ebp
pop ebp
ret
Function at 0x4a5fd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x51a3c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x523210]
mov byte [ebp - 0x20d], 0x40
push ebx
mov ebx, dword [ebp + 8]
test ecx, ecx
jne 0x4a60bd
push 0x208
push ecx
lea eax, [ebp - 0x20c]
push eax
call fcn.004a8e20
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0xf5
ja 0x4a609e
push esi
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4a6036
mov eax, dword [0x4f3570]
mov dword [edi], eax
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4a6052
mov ecx, 6
lea eax, [ebp - 0x20c]
mov esi, str.Netapi32.dll
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
test eax, eax
je 0x4a609e
push str.Netbios
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x523210]
test eax, eax
cmovne ecx, eax
mov dword [0x523210], ecx
jmp 0x4a60a4
mov ecx, dword [0x523210]
test ecx, ecx
jne 0x4a60bd
mov al, byte [ebp - 0x20d]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a44be
mov esp, ebp
pop ebp
ret
push ebx
call ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004a44be
mov esp, ebp
pop ebp
ret

Function at 0x4a67d0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c10
call fcn.004a44d0
mov eax, dword [0x51a3c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c10], eax
test eax, eax
je 0x4a6932
cmp dword [ebp + 0xc], 0
je 0x4a6932
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop dword [eax]
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.00483170
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4a6915
push 0x2710
lea eax, [ebp - 0x2bfc]
mov dword [ebp - 0x2c00], 0
push 0
push eax
mov dword [ebp - 0x2c04], 0
mov dword [ebp - 0x2c0c], 0
mov dword [ebp - 0x2c08], 0
call fcn.004a8e20
add esp, 0xc
lea eax, [ebp - 0x2c00]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2bfc]
push eax
push 0xc
lea eax, [ebp - 0x2c0c]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4a690a
push 0x3e8
lea eax, [ebp - 0x4ec]
push 0
push eax
call fcn.004a8e20
lea eax, [ebp - 0x4ec]
push eax
push 1
push dword [ebp - 0x2be4]
lea eax, [ebp - 0x2bfc]
push eax
call fcn.004a7880
add esp, 0x1c
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x2c10]
call fcn.004878a0
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x4a691f
inc esi
cmp esi, 0x10
jl 0x4a6810
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a44be
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004a44be
mov esp, ebp
pop ebp
ret
Function at 0x4a6950
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x51a3c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.004a8e20
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.004a5e70
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4a69ba
mov al, byte [edi + ecx]
test al, al
je 0x4a69ba
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4a69a1
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x4a69db
inc eax
sub ecx, 1
jne 0x4a69d0
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x4a6a30
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x4a6a25
lea edi, [ebp - 0x84]
mov eax, 0x7fffffff
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x4a6a24
mov bl, byte [edi + ecx]
test bl, bl
je 0x4a6a24
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x4a6a10
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.004a8e20
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x4e0af8
push str.Software360SafeLiveup
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x4a6aea
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4a6ab4
test cl, cl
je 0x4a6ab0
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4a6ab4
add eax, 2
add esi, 2
test cl, cl
jne 0x4a6a94
xor eax, eax
jmp 0x4a6ab9
sbb eax, eax
or eax, 1
test eax, eax
je 0x4a6aea
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a6ac6
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.Software360SafeLiveup
push 0x80000002
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a6af3
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x4e0af8
push str.Software360SafeLiveup
push 0x80000002
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a44be
mov esp, ebp
pop ebp
ret
Function at 0x4bec46
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004a44d0
mov eax, dword [0x51a3c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004c4a85
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4bec88
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4bede4
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004a4900
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x523bb0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004ca0e0
mov ecx, dword [esi*4 + 0x523bb0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4beddd
cmp eax, dword [edi + ecx + 0x24]
jne 0x4beddd
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4beddd
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004ca0e0
add esp, 0x14
test edx, edx
jl 0x4beddd
jg 0x4bed53
test eax, eax
jb 0x4beddd
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4beddd
jl 0x4bed6d
cmp dword [ebp - 0x1008], eax
ja 0x4beddd
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4bed8b
test ebx, ebx
je 0x4bedc4
cmp ecx, edi
jae 0x4bedc4
mov al, byte [ecx]
cmp al, 0xd
jne 0x4beda5
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4bedb1
cmp byte [ecx + 1], 0xa
jne 0x4bedb1
inc ecx
jmp 0x4bedb1
movzx eax, al
movsx eax, byte [eax + 0x51a870]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4bed8b
cmp edx, ebx
jne 0x4bed8b
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4bede2
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004a44be
leave
ret

Function at 0x4c528a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4ea180
push 0x4ea178
push str.FlsAlloc
push 0x1e
call fcn.004c50b7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4c52be
push dword [ebp + 8]
mov ecx, esi
call dword [0x4df6bc]
call esi
jmp 0x4c52c4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4c5308
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4ea190
push 0x4ea188
push str.FlsGetValue
push 0x20
call fcn.004c50b7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4c533f
push dword [ebp + 8]
mov ecx, esi
call dword [0x4df6bc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]