joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f890
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x49f8f4
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004047c4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040940c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f8fb
lea eax, [ebp - 0xc]
call fcn.0040455c
ret

Function at 0x4a857c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a862f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4a8619
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, 0x4a8644
call fcn.00404b50
test eax, eax
jle 0x4a85e2
lea edx, [ebp - 0xc]
mov ecx, 0x400
xchg edx, eax
call fcn.00404aac
mov eax, dword [ebp - 0xc]
call fcn.00404814
mov edx, eax
test edx, edx
jle 0x4a8601
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor byte [ecx + eax - 1], 0x80
inc eax
dec edx
jne 0x4a85f5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x20]
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x4a85b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8636
lea eax, [ebp - 0xc]
call fcn.0040455c
ret
Function at 0x4ad4b4
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x78], ebx
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
call fcn.004051e0
xor eax, eax
push ebp
push 0x4ad64e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x52d53c]
cmp eax, 1
sete byte [ebp - 0xb]
test eax, eax
jne 0x4ad630
mov dword [0x52d53c], 0xffffffff
mov byte [0x52d540], 0
call sub.winmm.dll_waveInGetNumDevs
mov ebx, eax
test ebx, ebx
jle 0x4ad630
mov ax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1d]
mov ecx, dword [ebp + 0xc]
mov dx, word [ebp - 0xa]
call fcn.004ad46c
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00404f50
je 0x4ad591
mov edi, 2
dec ebx
test ebx, ebx
jl 0x4ad5af
inc ebx
xor esi, esi
push 0x54
lea eax, [ebp - 0x74]
push eax
push esi
call sub.winmm.dll_waveInGetDevCapsW
lea eax, [ebp - 0x78]
lea edx, [ebp - 0x6c]
mov ecx, 0x20
call fcn.00404dfc
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp - 8]
call fcn.00404f50
jne 0x4ad58b
push 0x30000
push 0
push 0x4ad424
lea eax, [ebp - 0x1d]
push eax
push esi
push 0x533404
call sub.winmm.dll_waveInOpen
mov edi, eax
jmp 0x4ad5af
inc esi
dec ebx
jne 0x4ad543
jmp 0x4ad5af
push 0x30000
push 0
push 0x4ad424
lea eax, [ebp - 0x1d]
push eax
push 0xffffffffffffffff
push 0x533404
call sub.winmm.dll_waveInOpen
mov edi, eax
test edi, edi
jne 0x4ad630
mov eax, dword [ebp - 4]
mov dword [0x52d54c], eax
mov esi, 5
mov ebx, 0x53340c
mov edi, 0x5334a8
movzx eax, word [ebp - 0xa]
imul eax, eax, 0x780
imul dword [ebp + 0xc]
mov ecx, 0x15888
xor edx, edx
div ecx
mov dword [ebx], eax
mov eax, edi
mov dword [ebx - 4], eax
xor eax, eax
mov dword [ebx + 0xc], eax
push 0x20
lea eax, [ebx - 4]
push eax
mov eax, dword [0x533404]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x4ad630
push 0x20
lea eax, [ebx - 4]
push eax
mov eax, dword [0x533404]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
jne 0x4ad630
add edi, 0x780
add ebx, 0x20
dec esi
jne 0x4ad5ca
mov dword [0x52d53c], 1
mov byte [ebp - 0xb], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad655
lea eax, [ebp - 0x78]
call fcn.00404c78
lea eax, [ebp - 8]
call fcn.00404c78
ret

Function at 0x4ad890
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push esp
push 0x208
call sub.kernel32.dll_GetCurrentDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.00404dfc
add esp, 0x208
pop ebx
ret

Function at 0x4af59c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x530204]
mov dword [eax], 0x3ef
mov eax, dword [ebx + 0x31c]
test eax, eax
je 0x4af5bf
cmp byte [eax + 0x57], 0
jne 0x4af5bf
call fcn.00444c98
mov eax, dword [0x5306f0]
mov eax, dword [eax]
call fcn.00447bd0
push 0
mov eax, dword [0x5306f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
call fcn.004afa4c
mov eax, dword [0x530204]
xor edx, edx
mov dword [eax], edx
pop ebx
ret
Function at 0x4b0024
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x530204]
mov dword [eax], 0x3f6
cmp dword [0x52d564], 0
jne 0x4b0058
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4ad000]
call fcn.00440a5c
mov dword [0x52d564], eax
mov eax, dword [0x52d564]
call fcn.004ad240
mov eax, dword [0x52d564]
call fcn.00444c98
mov eax, dword [0x52d564]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xc0]
mov eax, dword [0x5306f0]
mov eax, dword [eax]
call fcn.00447bd0
push 0
mov eax, dword [0x5306f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
call fcn.004afa4c
mov eax, dword [0x530204]
xor edx, edx
mov dword [eax], edx
pop ebx
ret

Function at 0x4b9384
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4b938c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b957e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4b9594
mov eax, esi
call fcn.004b7114
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004045b0
lea ecx, [ebp - 0x10]
mov edx, 0x4b95a8
mov eax, esi
call fcn.004b7114
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004045b0
lea ecx, [ebp - 0x14]
mov edx, 0x4b95c0
mov eax, esi
call fcn.004b7114
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004045b0
lea ecx, [ebp - 0x18]
mov edx, 0x4b95dc
mov eax, esi
call fcn.004b7114
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004045b0
lea ecx, [ebp - 0x1c]
mov edx, 0x4b95f8
mov eax, esi
call fcn.004b7114
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004045b0
lea ecx, [ebp - 0x24]
mov edx, 0x4b9610
mov eax, esi
call fcn.004b7114
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408fac
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.0040940c
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4b9628
mov eax, esi
call fcn.004b7114
mov eax, dword [ebp - 0x28]
call fcn.004b622c
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4b9638
mov eax, esi
call fcn.004b7114
mov eax, dword [ebp - 0x2c]
call fcn.004b622c
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4b9650
mov eax, esi
call fcn.004b7114
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.0040940c
inc eax
je 0x4b9521
lea ecx, [ebp - 0x34]
mov edx, 0x4b9650
mov eax, esi
call fcn.004b7114
mov eax, dword [ebp - 0x34]
call fcn.004093d0
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
add byte [ecx - 0x76a60609], bl
inc ebp
cld
lea ecx, [ebp - 0x40]
mov edx, 0x4b9650
mov eax, esi
call fcn.004b7114
mov eax, dword [ebp - 0x40]
call fcn.004b622c
fstp qword [ebx + 0x38]
wait
Function at 0x4c5748
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4c57a2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004c5738
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004b4e98
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004b4a98
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c57a9
lea eax, [ebp - 4]
call fcn.0040455c
ret

Function at 0x4c8c58
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049fc
xor eax, eax
push ebp
push 0x4c8d21
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov dl, 1
mov eax, dword [0x4c8aec]
call fcn.0041f128
mov ebx, eax
mov byte [ebx + 0xf], 1
lea eax, [ebx + 0x38]
mov edx, dword [ebp - 4]
call fcn.004045b0
xor eax, eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x40], esi
call sub.kernel32.dll_GetTickCount
mov edi, eax
mov byte [ebx + 0x3c], 1
mov byte [ebx + 0x3d], 0
mov eax, ebx
call fcn.0041f474
jmp 0x4c8ce8
call sub.kernel32.dll_GetTickCount
sub eax, edi
lea edx, [esi + 0x7d0]
cmp eax, edx
ja 0x4c8cee
cmp byte [ebp + 8], 0
jne 0x4c8ce1
mov eax, dword [0x5306f0]
mov eax, dword [eax]
call fcn.00447f38
push 1
call sub.kernel32.dll_Sleep
cmp byte [ebx + 0x3c], 1
je 0x4c8cbe
cmp byte [ebx + 0x3c], 2
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x4c8d07
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x34]
call fcn.004045b0
mov byte [ebx + 0x3d], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8d28
lea eax, [ebp - 4]
call fcn.0040455c
ret
Function at 0x4caf40
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb8
mov ebx, ecx
mov ebp, edx
mov esi, eax
xor edi, edi
push edi
lea eax, [esp + 8]
push eax
mov ecx, 0x4cb164
mov edx, 0x4cb168
mov eax, esi
call fcn.004cac38
test al, al
jne 0x4caf74
xor eax, eax
jmp 0x4cb158
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x9c
call fcn.00407b3c
mov word [esp + 0xd0], 0x9c
mov word [esp + 0xd2], 0
lea eax, [esp + 0xac]
push eax
mov eax, dword [0x52ddd8]
push eax
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [esp + 0xd4], 0x1c0000
test ebx, ebx
je 0x4caff8
or dword [esp + 0xd4], 0x20
mov eax, dword [ebx]
lea edx, [esp + 0xd8]
mov dword [edx], eax
mov eax, dword [ebx + 4]
lea edx, [esp + 0xd8]
mov dword [edx + 4], eax
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
mov dword [esp + 0x118], eax
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
mov dword [esp + 0x11c], eax
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x20
call fcn.0040303c
mov edx, 0x4cb178
mov eax, esi
call fcn.004cae54
mov ebx, eax
test ebx, ebx
jne 0x4cb024
xor eax, eax
jmp 0x4cb158
push 0x4cb184
push ebx
call sub.advapi32.dll_RegDeleteValueA
push 0x4cb198
push ebx
call sub.advapi32.dll_RegDeleteValueA
test ebp, ebp
je 0x4cb047
mov dword [esp], 3
jmp 0x4cb04c
xor eax, eax
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cb1a8
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4cb06d
xor eax, eax
jmp 0x4cb158
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cb1bc
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4cb095
xor eax, eax
jmp 0x4cb158
mov dword [esp], 1
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cb1d8
push ebx
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4cb0bd
xor eax, eax
jmp 0x4cb158
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov ebp, eax
xor edi, edi
test ebp, ebp
je 0x4cb0ea
push 0x2000000
push 0
push 0
call sub.user32.dll_OpenInputDesktop
mov edi, eax
test edi, edi
je 0x4cb0ea
push edi
call sub.user32.dll_SetThreadDesktop
cmp dword [esp + 0x114], 0x18
jne 0x4cb0ff
mov dword [esp + 0x114], 0x20
push 0
push 1
push 0
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
push esi
push edi
lea edi, [esi + 4]
lea esi, [esp + 0xb4]
mov ecx, 0x27
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [esi + 0xa0]
lea edx, [esp + 8]
mov ecx, 0x20
call fcn.004047c4
push ebp
call sub.user32.dll_SetThreadDesktop
test edi, edi
je 0x4cb150
push edi
call sub.user32.dll_CloseDesktop
push ebx
call sub.advapi32.dll_RegCloseKey_1
mov al, 1
add esp, 0x148
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cb1ec
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffeb8
mov ebx, eax
lea eax, [ebx + 0xa0]
call fcn.0040455c
xor esi, esi
push esi
lea eax, [esp + 8]
push eax
mov ecx, 0x4cb334
mov edx, 0x4cb338
mov eax, ebx
call fcn.004cac38
test al, al
je 0x4cb329
lea eax, [esp + 0xac]
xor ecx, ecx
mov edx, 0x9c
call fcn.00407b3c
mov word [esp + 0xd0], 0x9c
mov word [esp + 0xd2], 0
lea eax, [esp + 0xac]
push eax
mov eax, dword [0x52ddd8]
push eax
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [esp + 0xd4], 0x1c0000
mov byte [esp + 0xac], 0
mov edx, 0x4cb348
mov eax, ebx
call fcn.004cae54
mov ebx, eax
test ebx, ebx
je 0x4cb329
xor eax, eax
mov dword [esp], eax
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push 0x4cb354
push ebx
call sub.advapi32.dll_RegSetValueExA
push 0x4cb368
push ebx
call sub.advapi32.dll_RegDeleteValueA
push 0x4cb37c
push ebx
call sub.advapi32.dll_RegDeleteValueA
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov edi, eax
xor esi, esi
test edi, edi
je 0x4cb2e6
push 0x2000000
push 0
push 0
call sub.user32.dll_OpenInputDesktop
mov esi, eax
test esi, esi
je 0x4cb2e6
push esi
call sub.user32.dll_SetThreadDesktop
cmp dword [esp + 0x114], 0x18
jne 0x4cb2fb
mov dword [esp + 0x114], 0x20
push 0
push 1
push 0
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x18]
push eax
call sub.user32.dll_ChangeDisplaySettingsExA
push edi
call sub.user32.dll_SetThreadDesktop
test esi, esi
je 0x4cb323
push esi
call sub.user32.dll_CloseDesktop
push ebx
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x148
pop edi
pop esi
pop ebx
ret
Function at 0x4cb5dc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x4cb803
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x52ddf8], eax
xor eax, eax
mov dword [0x5360ac], eax
xor eax, eax
mov dword [0x5360b0], eax
xor eax, eax
mov dword [0x5360b4], eax
xor eax, eax
mov dword [0x5360b8], eax
xor eax, eax
mov dword [0x5360a8], eax
xor eax, eax
mov dword [0x5360bc], eax
xor eax, eax
mov dword [0x5360c0], eax
xor eax, eax
mov dword [0x5360c4], eax
xor eax, eax
mov dword [0x5360c8], eax
cmp dword [0x52ddfc], 0
je 0x4cb7e5
push 0x4cb810
mov eax, dword [0x52ddfc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5360ac], eax
push 0x4cb818
mov eax, dword [0x52ddfc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5360b0], eax
push 0x4cb820
mov eax, dword [0x52ddfc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5360b4], eax
push 0x4cb828
mov eax, dword [0x52ddfc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5360b8], eax
push 0x4cb830
mov eax, dword [0x52ddfc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5360a8], eax
push 0x4cb838
mov eax, dword [0x52ddfc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5360bc], eax
push 0x4cb848
mov eax, dword [0x52ddfc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5360c0], eax
push 0x4cb854
mov eax, dword [0x52ddfc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5360c4], eax
push 0x4cb864
mov eax, dword [0x52ddfc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5360c8], eax
cmp dword [0x5360ac], 0
je 0x4cb7e5
cmp dword [0x5360b0], 0
je 0x4cb7e5
cmp dword [0x5360b4], 0
je 0x4cb7e5
cmp dword [0x5360b8], 0
je 0x4cb7e5
cmp dword [0x5360a8], 0
je 0x4cb7e5
cmp dword [0x52de00], 0xffffffff
jne 0x4cb781
push 0
push 1
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x4cb880
call fcn.00404860
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404e18
mov eax, dword [ebp - 4]
mov edx, 0x4cb894
call fcn.0046bdf8
mov dword [0x52de00], eax
cmp dword [0x52de00], 2
jge 0x4cb799
push 0x58
push 0x6f401
call dword [0x5360b8]
jmp 0x4cb7ad
cmp dword [0x52de00], 2
jne 0x4cb7ad
push 0x51a7b0e
call dword [0x5360b0]
mov dword [0x52ddf8], 1
cmp dword [0x5360bc], 0
je 0x4cb7e5
cmp dword [0x5360c0], 0
je 0x4cb7e5
cmp dword [0x5360c4], 0
je 0x4cb7e5
cmp dword [0x5360c8], 0
je 0x4cb7e5
mov dword [0x52ddf8], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb80a
lea eax, [ebp - 8]
call fcn.0040455c
lea eax, [ebp - 4]
call fcn.00404c78
ret
Function at 0x4d09c0
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4d0b24
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x52eed8], 0x7d9
cmp si, 2
jne 0x4d0a1a
lea eax, [ebp - 0x20]
mov edx, dword [0x5304ec]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xc]
mov edx, 0x4d0b3c
call fcn.0046c12c
jmp 0x4d0a46
cmp si, 8
je 0x4d0a26
cmp si, 1
jne 0x4d0a46
lea eax, [ebp - 0x24]
mov edx, dword [0x5304ec]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xc]
mov edx, 0x4d0b4c
call fcn.0046c12c
cmp dword [ebp - 0xc], 0
je 0x4d0a61
push 1
lea eax, [ebp - 0xc]
call fcn.00404a64
push eax
call sub.kernel32.dll_WinExec
jmp 0x4d0af9
test si, 2
jne 0x4d0a76
test si, 1
jne 0x4d0a76
test si, 8
je 0x4d0adf
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4d0adf
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x29
call fcn.004a802c
mov eax, dword [ebp - 0x28]
call fcn.00404a0c
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x4d0ae7
or si, 4
push 0
movzx eax, si
push eax
call sub.user32.dll_ExitWindowsEx
xor eax, eax
mov dword [0x52eed8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0b2b
lea eax, [ebp - 0x28]
call fcn.0040455c
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404c90
lea eax, [ebp - 0xc]
call fcn.0040455c
ret

Function at 0x4d161c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [0x52eed8], 0x7e9
push 0
push 0x10
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4d1653
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004047c4
jmp 0x4d165a
mov eax, ebx
call fcn.0040455c
xor eax, eax
mov dword [0x52eed8], eax
add esp, 0x108
pop ebx
ret

Function at 0x4d166c
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [0x52eed8], 0x7ea
push 0
push 0x18
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x4d16a3
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.004047c4
jmp 0x4d16aa
mov eax, ebx
call fcn.0040455c
xor eax, eax
mov dword [0x52eed8], eax
add esp, 0x108
pop ebx
ret
Function at 0x4d3e78
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4d3fb9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x5374d4], 0
je 0x4d3f69
mov dl, 1
mov eax, dword [0x414a08]
call fcn.00403720
mov edi, eax
mov edx, dword [0x5374c8]
mov eax, 0x4d3fd0
call fcn.00404b50
test eax, eax
jle 0x4d3ef1
push 0x4d3fdc
push dword [0x5374c8]
push 0x4d3fe8
push dword [0x5374cc]
lea eax, [ebp - 8]
mov edx, 4
call fcn.004048d4
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4d3f1e
push 0x4d3ff4
push dword [0x5374c8]
push 0x4d3fd0
push dword [0x5374cc]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004048d4
mov edx, dword [ebp - 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [0x530810]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x4d4004
call fcn.00404860
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 1
mov eax, dword [0x5374d0]
call fcn.00404a0c
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404a0c
push eax
push 0x4d4010
mov eax, esi
call fcn.0045ca7c
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4d3f9e
push 1
mov eax, dword [0x5374d0]
call fcn.00404a0c
push eax
mov eax, dword [0x5374cc]
call fcn.00404a0c
push eax
mov eax, dword [0x5374c8]
call fcn.00404a0c
push eax
push 0x4d4010
mov eax, esi
call fcn.0045ca7c
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3fc0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404580
ret
Function at 0x4da8f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4daa0f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x52eed8], 0x808
lea edx, [ebp - 8]
mov eax, 0xfb
call fcn.004a802c
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, 0x537180
mov ecx, 0x105
call fcn.004047c4
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
pop ecx
call fcn.00404860
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404e18
mov eax, dword [ebp - 0x10]
mov dx, 0xffff
call fcn.0046c78c
mov ebx, eax
test ebx, ebx
je 0x4da9d8
mov ecx, dword [esi + 4]
sub ecx, 0x20
lea edx, [esi + 0x20]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.00403750
mov eax, 0xc8
call fcn.004d06d0
push 1
push 0x4daa1c
push 0x4daa28
push dword [ebp - 4]
push 0x4daa38
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004048d4
mov eax, dword [ebp - 0x14]
call fcn.00404a0c
push eax
lea edx, [ebp - 0x18]
mov eax, 0x62
call fcn.004a802c
mov eax, dword [ebp - 0x18]
call fcn.00404a0c
push eax
push 0x4daa3c
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
mov dword [0x52eed8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4daa16
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x10]
call fcn.00404c78
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404580
ret

Function at 0x4dc6a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4dc7b9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [0x537290], 0
jbe 0x4dc74e
mov ax, word [0x52ef10]
cmp ax, word [0x537290]
jb 0x4dc74e
mov eax, dword [0x52eee0]
mov dword [0x52ef00], eax
mov eax, dword [0x52eee4]
mov dword [0x52ef04], eax
mov word [0x52ef10], 0
cmp dword [0x537294], 0
jne 0x4dc723
mov eax, dword [0x536140]
call fcn.0049c760
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.004e0220
mov dl, 1
mov ax, 2
call fcn.004d09c0
jmp 0x4dc74e
lea eax, [ebp - 4]
mov ecx, dword [0x537294]
mov edx, 0x4dc7cc
call fcn.00404860
lea eax, [ebp - 4]
call fcn.004d181c
push 1
lea eax, [ebp - 4]
call fcn.00404a64
push eax
call sub.kernel32.dll_WinExec
cmp word [0x537298], 0
jbe 0x4dc7a3
mov ax, word [0x52ef10]
cmp ax, word [0x537298]
jb 0x4dc7a3
mov eax, dword [0x52eee0]
mov dword [0x52ef00], eax
mov eax, dword [0x52eee4]
mov dword [0x52ef04], eax
mov word [0x52ef10], 0
cmp dword [0x53729c], 0
je 0x4dc7a3
push 1
mov eax, 0x53729c
call fcn.00404a64
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc7c0
lea eax, [ebp - 4]
call fcn.0040455c
ret