joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e2265
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
test ebx, ebx
je 0x4e2327
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4e2327
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x4e2327
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x4e2327
mov dword [ebx], esi
mov dword [eax], esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ecx], esi
mov dword [edx], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4e2327
push edi
push eax
call fcn.004f046c
mov edi, eax
pop ecx
test edi, edi
je 0x4e2326
push edi
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4e231f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x559c0c
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4e231f
cmp dword [ebp - 8], esi
jbe 0x4e231c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ecx + 8]
mov dword [ebx], eax
mov eax, dword [ecx + 0xc]
mov dword [edx], eax
mov edx, dword [ebp + 0x14]
mov eax, dword [ecx + 0x10]
mov dword [edx], eax
mov eax, dword [ecx + 0x14]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
xor esi, esi
inc esi
push edi
call fcn.004f2acf
pop ecx
pop edi
test esi, esi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e250f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x581d10]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
lea edi, [ebp - 0x16]
mov word [ebp - 0x18], ax
stosd dword es:[edi], eax
push 0xa
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
push eax
push str.LIEBAO_ENABLE_UPLOAD_DUMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp word [ebp - 0x18], 0x30
pop edi
setne al
xor ecx, ebp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
Function at 0x4e3f50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x581d10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x4e3f78
mov eax, dword [esi]
jmp 0x4e3f7a
mov eax, esi
mov byte [eax], 0
lea eax, [ebp - 0x107]
push 0x103
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.004f28b0
add esp, 0xc
mov dword [ebp - 0x114], 0x104
lea eax, [ebp - 0x114]
mov dword [ebp - 0x110], 1
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x5436cc
push str.SoftwareClasses9B7A98EC_7EF9_468c_ACC8_37C793DBD7E0Implemented_CategoriesA5F7140E_4311_4ef9_AABC_F55941B5EBE5
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4e4063
cmp dword [ebp - 0x110], 1
jne 0x4e4063
cmp byte [ebp - 0x108], al
jne 0x4e3ff5
xor ecx, ecx
jmp 0x4e4009
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e4000
sub ecx, edx
push ecx
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.00417e30
cmp dword [esi + 0x10], 0
jbe 0x4e4063
push 1
push 0
lea eax, [ebp - 0x10c]
mov byte [ebp - 0x10c], 0xa
push eax
mov ecx, esi
call fcn.00420650
cmp eax, 0xffffffff
je 0x4e404f
push 1
push eax
mov ecx, esi
call fcn.00417f30
push esi
call fcn.004e5000
add esp, 4
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
Function at 0x4e4080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5362fb
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x581d10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x216]
push 0x206
push 0
push eax
call fcn.004f28b0
add esp, 0xc
mov dword [ebp - 0x2a4], 0x208
xor eax, eax
mov dword [ebp - 0x2a0], 1
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2a0]
push eax
push str.firstinstalltime
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ax, word [ebp - 0x218]
test ax, ax
je 0x4e411e
cmp ax, 0x30
jne 0x4e416c
xor eax, eax
mov dword [ebp - 0x2a0], 1
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x2a4], 0x208
push eax
lea eax, [ebp - 0x2a0]
push eax
push str.firstinstalltime
push str.SoftwareKingsoftKBROWSER
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ax, word [ebp - 0x218]
test ax, ax
je 0x4e41c6
cmp ax, 0x30
je 0x4e41c6
lea eax, [ebp - 0x298]
mov dword [ebp - 0x29c], eax
lea ecx, [ebp - 0x29c]
push 3
lea eax, [ebp - 0x218]
push eax
call fcn.0043a6f2
push dword [ebp - 0x29c]
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00425fa0
mov eax, dword [ebp - 0x29c]
lea ecx, [ebp - 0x298]
cmp eax, ecx
je 0x4e41d4
push eax
call fcn.004f1820
add esp, 4
jmp 0x4e41d4
push 1
push 0x55a3f0
mov ecx, esi
call fcn.00417e30
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
Function at 0x4e41f0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x581d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5acaac]
test al, 1
jne 0x4e423d
or eax, 1
mov dword [0x5acaa8], 7
mov dword [0x5acaac], eax
xor eax, eax
push 0x537bf0
mov dword [0x5acaa4], 0
mov word [0x5aca94], ax
call fcn.004f109b
add esp, 4
cmp dword [0x5acaa4], 0
jne 0x4e4314
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004f28b0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4e4314
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004f4f0d
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x210]
push ecx
push ecx
push ecx
push ecx
push eax
push ecx
push ecx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4e4314
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push 0x543694
push 0x104
push eax
call fcn.004378c6
add esp, 0x10
cmp word [ebp - 0x20c], 0
jne 0x4e42ea
xor ecx, ecx
jmp 0x4e4302
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e42f3
sub ecx, edx
sar ecx, 1
push ecx
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, 0x5aca94
call fcn.00417b50
mov ecx, dword [ebp - 4]
mov eax, 0x5aca94
xor ecx, ebp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
Function at 0x4e4330
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53633b
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x581d10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x216]
push 0x206
push 0
push eax
call fcn.004f28b0
add esp, 0xc
mov dword [ebp - 0x2a4], 0x208
xor eax, eax
mov dword [ebp - 0x2a0], 1
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0x538f60
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ax, word [ebp - 0x218]
test ax, ax
je 0x4e43ce
cmp ax, 0x30
jne 0x4e441c
xor eax, eax
mov dword [ebp - 0x2a0], 1
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x2a4], 0x208
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0x538f60
push str.SoftwareKingsoftKBROWSER
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ax, word [ebp - 0x218]
test ax, ax
je 0x4e4476
cmp ax, 0x30
je 0x4e4476
lea eax, [ebp - 0x298]
mov dword [ebp - 0x29c], eax
lea ecx, [ebp - 0x29c]
push 3
lea eax, [ebp - 0x218]
push eax
call fcn.0043a6f2
push dword [ebp - 0x29c]
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00425fa0
mov eax, dword [ebp - 0x29c]
lea ecx, [ebp - 0x298]
cmp eax, ecx
je 0x4e4484
push eax
call fcn.004f1820
add esp, 4
jmp 0x4e4484
push 1
push 0x55a3f0
mov ecx, esi
call fcn.00417e30
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
Function at 0x4e44a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53637b
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x581d10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004f28b0
add esp, 0xc
mov dword [ebp - 0x2a4], 0x208
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2a0], 1
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0x5390b0
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
jne 0x4e4546
push 1
push 0x55a3f0
mov ecx, esi
call fcn.00417e30
jmp 0x4e45ac
lea eax, [ebp - 0x298]
mov dword [ebp - 0x29c], eax
lea ecx, [ebp - 0x29c]
push 3
lea eax, [ebp - 0x218]
push eax
call fcn.0043a6f2
mov edx, dword [ebp - 0x29c]
mov dword [ebp - 4], 0
cmp byte [edx], 0
jne 0x4e457c
xor ecx, ecx
jmp 0x4e458a
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e4581
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00417e30
mov eax, dword [ebp - 0x29c]
lea ecx, [ebp - 0x298]
cmp eax, ecx
je 0x4e45ac
push eax
call fcn.004f1820
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret

Function at 0x4e45d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5363bb
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x581d10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004f28b0
add esp, 0xc
mov dword [ebp - 0x2a4], 0x208
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2a0], 1
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0x53b258
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
jne 0x4e4676
push 1
push 0x55a3f0
mov ecx, esi
call fcn.00417e30
jmp 0x4e46dc
lea eax, [ebp - 0x298]
mov dword [ebp - 0x29c], eax
lea ecx, [ebp - 0x29c]
push 3
lea eax, [ebp - 0x218]
push eax
call fcn.0043a6f2
mov edx, dword [ebp - 0x29c]
mov dword [ebp - 4], 0
cmp byte [edx], 0
jne 0x4e46ac
xor ecx, ecx
jmp 0x4e46ba
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e46b1
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00417e30
mov eax, dword [ebp - 0x29c]
lea ecx, [ebp - 0x298]
cmp eax, ecx
je 0x4e46dc
push eax
call fcn.004f1820
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
Function at 0x4e4ed0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53649b
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x581d10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004f28b0
add esp, 0xc
mov dword [ebp - 0x2a4], 0x208
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2a0], 1
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0x55d4ac
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
jne 0x4e4f76
push 1
push 0x55a3f0
mov ecx, esi
call fcn.00417e30
jmp 0x4e4fdc
lea eax, [ebp - 0x298]
mov dword [ebp - 0x29c], eax
lea ecx, [ebp - 0x29c]
push 3
lea eax, [ebp - 0x218]
push eax
call fcn.0043a6f2
mov edx, dword [ebp - 0x29c]
mov dword [ebp - 4], 0
cmp byte [edx], 0
jne 0x4e4fac
xor ecx, ecx
jmp 0x4e4fba
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e4fb1
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00417e30
mov eax, dword [ebp - 0x29c]
lea ecx, [ebp - 0x298]
cmp eax, ecx
je 0x4e4fdc
push eax
call fcn.004f1820
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
Function at 0x4e5090
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536508
mov eax, dword fs:[0]
push eax
mov eax, 0x1020
call fcn.004f5710
mov eax, dword [0x581d10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x102c], edi
call fcn.004c6db8
mov byte [edi + 0xc4], 0
xor ecx, ecx
mov dword [edi + 0xdc], 7
mov dword [edi + 0xd8], 0
mov dword [ebp - 4], 0
mov word [edi + 0xc8], cx
mov word [edi + 0xe0], cx
lea ecx, [edi + 0xe4]
push 6
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.h_lvse
mov byte [ebp - 4], 1
mov byte [ecx], 0
call fcn.00417e30
mov dword [ebp - 0x1024], 0
mov dword [ebp - 0x1020], 0
mov dword [ebp - 0x101c], 0
push 1
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.WS2_32.dll_accept
lea ecx, [ebp - 0x1024]
mov byte [ebp - 4], 3
mov dword [ebp - 0x1028], 0
call fcn.0043c6fa
test eax, eax
jne 0x4e5300
mov esi, dword [ebp - 0x1024]
lea eax, [ebp - 0x1014]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
lea eax, [ebp - 0x1028]
mov dword [ebp - 0x1014], 4
push eax
lea eax, [ebp - 0x1018]
push eax
push 0
push str.ProxyEnable
push esi
call ebx
test eax, eax
jne 0x4e5306
cmp dword [ebp - 0x1018], 4
jne 0x4e5306
cmp dword [ebp - 0x1028], eax
je 0x4e5306
test esi, esi
je 0x4e51de
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1024], 0
push 1
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.WS2_32.dll_accept
lea ecx, [ebp - 0x1024]
mov dword [ebp - 0x1020], 0
call fcn.0043c6fa
test eax, eax
jne 0x4e5300
push 0xffe
push eax
mov word [ebp - 0x1010], ax
lea eax, [ebp - 0x100e]
push eax
call fcn.004f28b0
mov esi, dword [ebp - 0x1024]
lea eax, [ebp - 0x1014]
add esp, 0xc
mov dword [ebp - 0x1014], 0x1000
push eax
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1018]
push eax
push 0
push str.ProxyServer
push esi
call ebx
test eax, eax
jne 0x4e5306
mov eax, dword [ebp - 0x1018]
cmp eax, 1
je 0x4e526e
cmp eax, 2
jne 0x4e5306
mov ecx, dword [ebp - 0x1014]
test ecx, ecx
je 0x4e5292
test cl, 1
jne 0x4e5306
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x1012], 0
je 0x4e529b
jmp 0x4e5306
xor eax, eax
mov word [ebp - 0x1010], ax
shr ecx, 1
add ecx, ecx
cmp ecx, 0x1000
jae 0x4e52fb
xor eax, eax
mov word [ebp + ecx - 0x1010], ax
cmp word [ebp - 0x1010], ax
jne 0x4e52be
xor ecx, ecx
jmp 0x4e52d6
lea ecx, [ebp - 0x1010]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e52c7
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x1010]
push eax
lea ecx, [edi + 0xc8]
call fcn.00417b50
cmp dword [edi + 0xd8], 0
je 0x4e5306
mov byte [edi + 0xc4], 1
jmp 0x4e5306
call fcn.004f5873
mov esi, dword [ebp - 0x1024]
test esi, esi
je 0x4e5311
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
Function at 0x4e5330
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536604
mov eax, dword fs:[0]
push eax
sub esp, 0x808
mov eax, dword [0x581d10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x3c]
mov dword [esi], 0x543a60
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x54f373
mov dword [ebp - 0x814], esi
mov byte [ecx], 0
call fcn.00417e30
lea ecx, [esi + 0x54]
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0xf
push 0
mov dword [ecx + 0x10], 0
push 0x54f373
mov byte [ecx], 0
call fcn.00417e30
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 1
mov dword [ecx + 0x14], 0xf
push 6
mov dword [ecx + 0x10], 0
push str.h_lvse
mov byte [ecx], 0
call fcn.00417e30
mov byte [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov byte [esi + 0x98], 0
mov byte [esi + 0x99], 0
mov byte [esi + 0x9a], 0
mov byte [esi + 0x9b], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xc8], 0xf
mov dword [esi + 0xc4], 0
mov byte [esi + 0xb4], 0
mov dword [esi + 0xe0], 0xf
mov dword [esi + 0xdc], 0
mov byte [esi + 0xcc], 0
mov dword [esi + 0xf8], 0xf
mov dword [esi + 0xf4], 0
mov byte [esi + 0xe4], 0
mov dword [esi + 0x110], 0xf
mov dword [esi + 0x10c], 0
mov byte [esi + 0xfc], 0
mov dword [esi + 0x128], 0xf
mov dword [esi + 0x124], 0
mov byte [esi + 0x114], 0
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x12c]
call fcn.004e5090
lea ecx, [esi + 0x228]
mov byte [ebp - 4], 0xb
call fcn.004e55d0
lea eax, [esi + 0x324]
mov byte [ebp - 4], 0xc
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp - 0x810]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [ebp - 0x810], 0
jne 0x4e558d
xor eax, eax
jmp 0x4e559f
lea eax, [ebp - 0x810]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e5596
sub eax, edx
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [esi + 0xb4]
call fcn.00417e30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret
Function at 0x4e5fd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push ebx
xor ebx, ebx
push esi
mov dword [eax], ebx
cmp dword [ebp + 0x14], ebx
jne 0x4e5fe2
int3
cmp byte [ebp + 0x10], bl
je 0x4e5ff0
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x10], ebx
ja 0x4e5ff0
int3
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x4e5ffb
mov eax, dword [eax]
push 0x559b30
push eax
call fcn.004f6da5
mov esi, eax
add esp, 8
test esi, esi
je 0x4e6099
push edi
push 2
push 0
push esi
call fcn.004f72cd
push esi
call fcn.004f76e0
push 0
push 0
push esi
mov edi, eax
call fcn.004f72cd
add esp, 0x1c
test edi, edi
jle 0x4e608f
mov dl, byte [ebp + 0x10]
test dl, dl
je 0x4e6048
mov ecx, dword [ebp + 0x1c]
lea eax, [edi + 0x18]
mov dword [ecx], eax
jmp 0x4e604f
mov eax, dword [ebp + 0x1c]
mov ecx, eax
mov dword [eax], edi
mov eax, dword [ebp + 0x18]
cmp eax, dword [ecx]
jb 0x4e608f
test dl, dl
je 0x4e607b
mov ebx, dword [ebp + 0x14]
push 0x18
push ebx
push edi
push dword [ebp + 0xc]
call fcn.004e60a0
push esi
push edi
lea eax, [ebx + 0x18]
push 1
push eax
call fcn.004f7192
add esp, 0x20
jmp 0x4e608a
push esi
push edi
push 1
push dword [ebp + 0x14]
call fcn.004f7192
add esp, 0x10
mov ebx, 1
push esi
call fcn.004f6c1e
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x4e6310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test edi, edi
jne 0x4e6322
int3
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
mov edx, esi
mov ecx, dword [eax]
sub edx, ecx
mov eax, 0x2aaaaaab
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x4e6342
int3
xor ebx, ebx
cmp ecx, esi
je 0x4e6352
add ebx, dword [ecx + 0x10]
add ecx, 0x18
cmp ecx, esi
jne 0x4e6348
test bl, 7
je 0x4e6361
shr ebx, 3
lea ebx, [ebx*8 + 8]
push ebx
call fcn.004f33b9
push ebx
mov esi, eax
push 0
push esi
call fcn.004f28b0
mov ecx, dword [ebp - 4]
add esp, 0x10
push ebx
push esi
push dword [ebp + 8]
call fcn.004e6470
push edi
push ebx
push 1
push esi
call fcn.004f892c
push edi
call fcn.004fa30f
push esi
call fcn.004f1820
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4e63b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536858
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x581d10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x4e644f
cmp dword [ebx + 0x68], 0x10
lea edi, [ebx + 0x54]
jb 0x4e63f4
mov ecx, dword [edi]
jmp 0x4e63f6
mov ecx, edi
push eax
push dword [ebx + 0x64]
push 1
push ecx
call fcn.004f892c
push dword [ebp - 0x2c]
mov esi, eax
call fcn.004fa30f
add esp, 0x14
cmp esi, 8
je 0x4e644f
push 0x54f373
lea ecx, [ebp - 0x28]
call fcn.004170e0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push edi
lea eax, [ebx + 0x3c]
mov ecx, ebx
push eax
lea eax, [ebp - 0x28]
push eax
push 6
call fcn.004eb2e0
cmp dword [ebp - 0x14], 0x10
jb 0x4e644f
push dword [ebp - 0x28]
call fcn.004b1ca1
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret 4
Function at 0x4e7060
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x581d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x288
mov dword [ebp - 0x38], eax
call fcn.004f33b9
add esp, 4
mov dword [ebp - 0x34], 0x288
mov edi, eax
lea eax, [ebp - 0x34]
push eax
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x4e70c0
push edi
call fcn.004f1820
push dword [ebp - 0x34]
call fcn.004f33b9
add esp, 8
mov edi, eax
lea eax, [ebp - 0x34]
push eax
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x4e7173
push 8
lea eax, [edi + 0x194]
mov ecx, ebx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004e7f30
mov ebx, eax
cmp esi, ebx
je 0x4e710b
cmp dword [esi + 0x14], 0x10
jb 0x4e70f2
push dword [esi]
call fcn.004b1ca1
add esp, 4
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
push ebx
mov byte [esi], 0
call fcn.00417590
cmp dword [ebp - 0x1c], 0x10
jb 0x4e711c
push dword [ebp - 0x30]
call fcn.004b1ca1
add esp, 4
push 0xa
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0
push eax
lea eax, [edi + 0x1b0]
mov word [ebp - 7], 0
xorps xmm0, xmm0
mov byte [ebp - 5], 0
push eax
movdqu xmmword [ebp - 0x17], xmm0
call dword [sym.imp.WS2_32.dll_inet_addr]
push eax
call fcn.004fd590
mov edx, eax
add esp, 0xc
cmp byte [edx], 0
jne 0x4e7159
xor ecx, ecx
jmp 0x4e7169
mov ecx, edx
lea esi, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e7160
sub ecx, esi
push ecx
mov ecx, dword [ebp - 0x38]
push edx
call fcn.00417e30
test edi, edi
je 0x4e7180
push edi
call fcn.004f1820
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f1cdb
mov esp, ebp
pop ebp
ret 8