joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6568
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404e30
test esi, 1
je 0x4a658a
mov eax, ebx
mov edx, 0x4a6814
call fcn.00405118
test esi, 2
je 0x4a659e
mov eax, ebx
mov edx, 0x4a682c
call fcn.00405118
test esi, 4
je 0x4a65b2
mov eax, ebx
mov edx, 0x4a683c
call fcn.00405118
test esi, 8
je 0x4a65c6
mov eax, ebx
mov edx, 0x4a6850
call fcn.00405118
test esi, 0x10
je 0x4a65da
mov eax, ebx
mov edx, 0x4a6868
call fcn.00405118
test esi, 0x20
je 0x4a65ee
mov eax, ebx
mov edx, 0x4a6880
call fcn.00405118
test esi, 0x40
je 0x4a6602
mov eax, ebx
mov edx, 0x4a6898
call fcn.00405118
test esi, 0x80
je 0x4a6616
mov eax, ebx
mov edx, 0x4a68a8
call fcn.00405118
test esi, 0x100
je 0x4a662a
mov eax, ebx
mov edx, 0x4a68b8
call fcn.00405118
test esi, 0x200
je 0x4a663e
mov eax, ebx
mov edx, 0x4a68d0
call fcn.00405118
test esi, 0x400
je 0x4a6652
mov eax, ebx
mov edx, 0x4a68e8
call fcn.00405118
test esi, 0x800
je 0x4a6666
mov eax, ebx
mov edx, 0x4a6900
call fcn.00405118
mov edi, esi
and edi, 0x4000
test edi, edi
je 0x4a667e
mov eax, ebx
mov edx, 0x4a6918
call fcn.00405118
test esi, 0x1000
je 0x4a6692
mov eax, ebx
mov edx, 0x4a6930
call fcn.00405118
test esi, 0x2000
je 0x4a66a6
mov eax, ebx
mov edx, 0x4a693c
call fcn.00405118
test edi, edi
je 0x4a66b6
mov eax, ebx
mov edx, 0x4a6918
call fcn.00405118
test esi, 0x8000
je 0x4a66ca
mov eax, ebx
mov edx, 0x4a694c
call fcn.00405118
test esi, 0x10000
je 0x4a66de
mov eax, ebx
mov edx, 0x4a6960
call fcn.00405118
test esi, 0x20000
je 0x4a66f2
mov eax, ebx
mov edx, 0x4a697c
call fcn.00405118
test esi, 0x40000
je 0x4a6706
mov eax, ebx
mov edx, 0x4a6994
call fcn.00405118
test esi, 0x80000
je 0x4a671a
mov eax, ebx
mov edx, 0x4a69ac
call fcn.00405118
test esi, 0x100000
je 0x4a672e
mov eax, ebx
mov edx, 0x4a69c4
call fcn.00405118
test esi, 0x200000
je 0x4a6742
mov eax, ebx
mov edx, 0x4a69d8
call fcn.00405118
test esi, 0x400000
je 0x4a6756
mov eax, ebx
mov edx, 0x4a69ec
call fcn.00405118
test esi, 0x800000
je 0x4a676a
mov eax, ebx
mov edx, 0x4a6a00
call fcn.00405118
test esi, 0x1000000
je 0x4a677e
mov eax, ebx
mov edx, 0x4a6a10
call fcn.00405118
test esi, 0x2000000
je 0x4a6792
mov eax, ebx
mov edx, 0x4a6a24
call fcn.00405118
test esi, 0x4000000
je 0x4a67a6
mov eax, ebx
mov edx, 0x4a6a3c
call fcn.00405118
test esi, 0x10000000
je 0x4a67ba
mov eax, ebx
mov edx, 0x4a6a54
call fcn.00405118
test esi, 0x20000000
je 0x4a67ce
mov eax, ebx
mov edx, 0x4a6a64
call fcn.00405118
test esi, 0x40000000
je 0x4a67e2
mov eax, ebx
mov edx, 0x4a6a80
call fcn.00405118
test esi, 0x80000000
je 0x4a67f6
mov eax, ebx
mov edx, 0x4a6a9c
call fcn.00405118
mov eax, dword [ebx]
call fcn.0040510c
mov edx, eax
dec edx
mov eax, ebx
call fcn.0040556c
pop edi
pop esi
pop ebx
ret
Function at 0x4aca14
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x4acaa5
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x104
mov eax, esi
call fcn.0040b4d0
mov ebx, eax
push esi
push ebx
call fcn.004078dc
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00405028
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, 0x4acabc
call fcn.00405164
push esi
push ebx
call fcn.0040787c
push dword [edi]
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405028
push dword [ebp - 8]
push 0x4acabc
mov eax, edi
mov edx, 3
call fcn.004051e0
mov eax, ebx
call fcn.0040b51c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acaac
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e54
ret

Function at 0x4acac0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4acb57
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040562c
mov eax, 0x104
call fcn.0040b4d0
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
call fcn.0043763c
push ebx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00437634
test eax, eax
je 0x4acb1b
mov eax, esi
mov edx, ebx
call fcn.00405758
mov eax, ebx
call fcn.0040b51c
lea eax, [ebp - 4]
push eax
call fcn.0043762c
call fcn.00408a04
test al, al
je 0x4acb41
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4acb5e
lea eax, [ebp - 4]
call fcn.00406d18
ret

Function at 0x4ada14
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov esi, eax
lea edi, [ebp - 4]
movzx ecx, byte [esi]
cmp cl, 2
jb 0x4ada31
mov cl, 2
mov byte [edi], cl
inc esi
inc edi
rep movsb byte es:[edi], byte [esi]
xor eax, eax
push ebp
push 0x4adb21
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.0040b4d0
mov dword [ebp - 0xc], eax
lea edx, [ebp - 4]
lea eax, [ebp - 0x28]
call fcn.00403568
mov edx, 0x4adb34
lea eax, [ebp - 0x28]
mov cl, 3
call fcn.00403538
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.00405094
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0040b33c
push 0x8001
call fcn.004079c4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4adb04
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4adad7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.004077cc
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4adae5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adb0b
mov eax, dword [ebp - 0xc]
call fcn.0040b51c
mov eax, dword [ebp - 0x10]
push eax
call fcn.004079c4
ret
Function at 0x4ae4cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004052cc
xor eax, eax
push ebp
push 0x4ae5b2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x4ae5c4
push 0x80000006
call fcn.0040766c
mov ebx, eax
test ebx, ebx
jne 0x4ae57f
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004052dc
mov edi, eax
push edi
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040767c
mov ebx, eax
test ebx, ebx
jne 0x4ae55e
mov eax, dword [ebp - 0xc]
call fcn.00402f10
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edi
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040767c
mov ebx, eax
mov eax, esi
call fcn.00402f44
jmp 0x4ae574
mov ecx, 0x4ae5e0
mov dl, 1
mov eax, dword [0x408d60]
call fcn.0040e930
call fcn.004047a4
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407634
jmp 0x4ae595
mov ecx, 0x4ae608
mov dl, 1
mov eax, dword [0x408d60]
call fcn.0040e930
call fcn.004047a4
test ebx, ebx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae5b9
lea eax, [ebp - 4]
call fcn.00404e30
ret

Function at 0x4ae630
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004052cc
xor eax, eax
push ebp
push 0x4ae6c9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x4ae6d8
push 0x80000006
call fcn.0040766c
mov ebx, eax
test ebx, ebx
jne 0x4ae6b0
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004052dc
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040767c
mov ebx, eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407634
test ebx, ebx
jne 0x4ae6ab
mov ebx, dword [ebp - 0x14]
jmp 0x4ae6b3
or ebx, 0xffffffff
jmp 0x4ae6b3
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae6d0
lea eax, [ebp - 4]
call fcn.00404e30
ret
Function at 0x4ae6ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004052cc
xor eax, eax
push ebp
push 0x4ae7a2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x4ae7b4
push 0x80000006
call fcn.0040766c
mov ebx, eax
test ebx, ebx
jne 0x4ae785
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004052dc
mov edi, eax
push edi
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040767c
mov ebx, eax
test ebx, ebx
jne 0x4ae77c
mov eax, dword [ebp - 0xc]
call fcn.00402f10
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edi
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040767c
mov ebx, eax
mov eax, esi
call fcn.00402f44
mov eax, dword [ebp - 0x10]
push eax
call fcn.00407634
test ebx, ebx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae7a9
lea eax, [ebp - 4]
call fcn.00404e30
ret

Function at 0x4ae873
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call fcn.004077b4
push eax
call fcn.00407624
mov ebx, eax
test ebx, ebx
jne 0x4ae80c
call fcn.0040780c
cmp eax, 0x3f0
jne 0x4ae80c
lea eax, [esp + 4]
push eax
push 8
call fcn.004077a4
push eax
call fcn.0040761c
mov ebx, eax
test ebx, ebx
je 0x4ae8b7
lea eax, [esp + 8]
push eax
push 0
push 0
push 2
mov eax, dword [esp + 0x14]
push eax
call fcn.004075d4
mov eax, dword [esp + 8]
call fcn.00402f28
mov esi, eax
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call fcn.004075d4
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call fcn.0040768c
test ebx, ebx
je 0x4ae8b0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x5ca250
call fcn.0040758c
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x4ae8a6
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call fcn.0040759c
test eax, eax
je 0x4ae8a2
mov byte [esp], 1
jmp 0x4ae8a6
inc edi
dec ebx
jne 0x4ae889
mov eax, dword [esp + 0xc]
push eax
call fcn.004075a4
mov eax, esi
call fcn.00402f44
movzx eax, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4ae8c4
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4aead7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
mov eax, dword [ebp - 4]
mov ecx, 1
mov edx, dword [0x4aa100]
call fcn.00406628
add esp, 4
lea eax, [ebp - 0xc]
push eax
push 8
push ebx
call fcn.0040761c
test eax, eax
je 0x4aeab9
xor edx, edx
push ebp
push 0x4aeab2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x1000
call fcn.00402f28
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4aea94
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
push eax
push 0x1000
mov eax, dword [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0xc]
push eax
call fcn.004075d4
test eax, eax
je 0x4aea7e
mov edi, dword [ebp - 0x10]
add edi, 4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
dec eax
test eax, eax
jl 0x4aea7e
inc eax
mov dword [ebp - 0x24], eax
xor esi, esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x124]
push eax
push edi
push 0
call fcn.00407604
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4ae9be
inc esi
cmp esi, 0xa
jg 0x4ae9c2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x124]
push eax
push edi
push 0
call fcn.00407604
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4ae99f
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x124]
push eax
push 0
call fcn.004075fc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040646c
inc eax
push eax
mov eax, dword [ebp - 4]
mov ecx, 1
mov edx, dword [0x4aa100]
call fcn.00406628
add esp, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00406474
mov edx, eax
shl eax, 7
add eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx]
lea ebx, [edx + eax*4]
lea eax, [ebp - 0x228]
lea edx, [ebp - 0x124]
mov ecx, pe_nt_image_headers32
call fcn.004050a0
mov edx, dword [ebp - 0x228]
mov eax, ebx
mov ecx, 0xff
call fcn.004050e8
lea eax, [ebp - 0x22c]
lea edx, [ebx + 0x100]
call fcn.00405094
mov edx, dword [ebp - 0x22c]
lea eax, [ebx + 0x100]
mov ecx, 0xff
call fcn.004050e8
mov eax, dword [edi + 8]
mov dword [ebx + 0x200], eax
add edi, 0xc
dec dword [ebp - 0x24]
jne 0x4ae982
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aea9b
mov eax, dword [ebp - 0x10]
call fcn.00402f44
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aeade
lea eax, [ebp - 0x22c]
mov edx, 2
call fcn.00404e54
ret
Function at 0x4af2c4
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004052cc
mov eax, dword [ebp - 8]
call fcn.004052cc
xor eax, eax
push ebp
push 0x4af395
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00404e30
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 8]
call fcn.004052dc
push eax
mov eax, dword [ebp - 4]
call fcn.004052dc
mov edi, eax
push edi
call fcn.004075ec
mov eax, dword [ebp - 0x10]
call fcn.0040b4d0
mov esi, eax
mov eax, dword [ebp - 0x14]
call fcn.00402f10
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 8]
call fcn.004052dc
push eax
push edi
call fcn.004075ec
test eax, eax
je 0x4af36c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004aefec
mov eax, esi
call fcn.0040b51c
mov eax, ebx
call fcn.00402f44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af39c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e54
ret
Function at 0x4af860
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004052cc
xor eax, eax
push ebp
push 0x4af974
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404e30
xor eax, eax
push ebp
push 0x4af957
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0042be70
test al, al
je 0x4af949
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0042bba0
movzx eax, byte [ebp - 0xc]
dec al
je 0x4af8d2
dec al
je 0x4af8e0
dec al
je 0x4af907
dec al
je 0x4af91a
jmp 0x4af949
mov ecx, esi
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0042bc70
jmp 0x4af949
mov ecx, esi
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0042bc70
push 0x401
lea eax, [ebp - 0x40d]
push eax
mov eax, dword [esi]
call fcn.004052dc
push eax
call fcn.00407714
jmp 0x4af949
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0042bce8
mov edx, esi
call fcn.0040a434
jmp 0x4af949
mov eax, esi
call fcn.00404e30
cmp dword [ebp - 8], 0xffffffff
jle 0x4af949
push 0x401
lea ecx, [ebp - 0x40d]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0042bd30
mov eax, esi
lea edx, [ebp - 0x40d]
call fcn.00405028
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af95e
ret

Function at 0x4afc74
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4afdb4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.0040b4d0
mov dword [ebp - 0x10], eax
push 0x8001
call fcn.004079c4
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4afce5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push 0xff
call fcn.00407824
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afcec
mov eax, dword [ebp - 0x14]
push eax
call fcn.004079c4
ret
Function at 0x4b002c
Capabilities:
Persist via ginadll registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4b0122
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.004af4a0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4b0100
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0042b3f8
mov edx, 0x4b013c
mov eax, dword [ebp - 8]
call fcn.0042b660
test al, al
je 0x4b00c7
mov edx, 0x4b017c
mov eax, dword [ebp - 8]
call fcn.0042be70
test al, al
je 0x4b00bf
lea ecx, [ebp - 0x10]
mov edx, 0x4b017c
mov eax, dword [ebp - 8]
call fcn.0042bc70
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00409ae4
mov edx, dword [ebp - 0xc]
mov eax, 0x4b018c
call fcn.00405428
test eax, eax
setg byte [ebp - 1]
mov eax, dword [ebp - 8]
call fcn.0042b3c8
cmp byte [ebp - 1], 0
jne 0x4b00ea
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0042b3f8
mov edx, 0x4b019c
mov eax, dword [ebp - 8]
call fcn.0042bf18
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0107
mov eax, dword [ebp - 8]
call fcn.00403ef0
ret

Function at 0x4b04c8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4b0571
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0xff
mov eax, ebx
call fcn.00402f28
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4b054f
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 8]
push eax
push 1
push 0x400
call fcn.0040781c
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405028
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x4b0588
call fcn.00405164
mov eax, dword [ebp - 0xc]
call fcn.0040a5a0
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0556
mov eax, dword [ebp - 8]
call fcn.00402f44
ret
Function at 0x4b05a4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b067a
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov ebx, 0x5d4f9c
lea eax, [ebp - 4]
lea edx, [esi + 0x61]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 4]
lea eax, [ebp - 8]
call fcn.00403568
mov edx, 0x4b0688
lea eax, [ebp - 8]
mov cl, 2
call fcn.00403538
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00405094
lea eax, [ebx + 4]
mov edx, 0x7f
call fcn.0040556c
lea eax, [ebx + 4]
call fcn.0040533c
mov edx, 0x7f
call fcn.00408390
push 0x7f
lea eax, [ebx + 4]
call fcn.0040533c
push eax
mov eax, dword [ebx]
call fcn.004052dc
push eax
call fcn.0040798c
mov eax, dword [ebx + 4]
call fcn.004052dc
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.00405028
mov eax, dword [ebp - 0xc]
call fcn.0040510c
mov edi, eax
mov dword [ebx + 8], edi
lea eax, [ebx + 4]
mov edx, edi
call fcn.0040556c
inc esi
add ebx, 0xc
cmp esi, 0x1a
jne 0x4b05c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0681
lea eax, [ebp - 0xc]
call fcn.00404e30
ret
Function at 0x4b16e8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40856c]
call fcn.00405ad4
xor eax, eax
push ebp
push 0x4b1889
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5ca270], 0
jne 0x4b1743
mov ecx, dword [0x5cefe8]
mov dl, 1
mov eax, dword [0x408d60]
call fcn.0040e9ec
call fcn.004047a4
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403684
mov eax, ebx
call fcn.004057d4
mov dword [ebp - 0x24], eax
mov esi, 0x4b1898
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406d18
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.004057e4
test eax, eax
jle 0x4b182c
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040779c
test eax, eax
je 0x4b1818
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004050a0
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x4b17be
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.004050d4
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4b17d4
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.004050d4
mov eax, dword [ebp - 0x54]
call fcn.004052dc
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004050a0
mov eax, dword [ebp - 0x58]
call fcn.004052dc
push eax
push 1
push 0x400
call fcn.00407694
sub eax, 2
test eax, eax
sete al
jmp 0x4b181a
xor eax, eax
test al, al
je 0x4b1825
mov ebx, 0x15
jmp 0x4b1831
mov ebx, 0x10
jmp 0x4b1831
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x5ca270]
call fcn.004b150c
mov eax, dword [ebp - 4]
call fcn.004b150c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406d30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1890
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404e54
lea eax, [ebp - 0xc]
mov edx, dword [0x40856c]
call fcn.00405ba4
ret