joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f0cb0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, dword [esp + 0x214]
test esi, esi
je 0x4f0dc2
push 0x103
lea eax, [esp + 9]
push 0
push eax
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0x119]
push 0
push ecx
call fcn.005dfd60
add esp, 0x18
lea edx, [esp + 4]
push edx
mov byte [esi], 0
mov byte [esp + 8], 0
mov byte [esp + 0x10c], 0
call fcn.004ef9d0
cmp eax, 1
je 0x4f0d25
lea eax, [esp + 4]
push eax
call fcn.004efb60
cmp byte [esp + 4], 0
push edi
mov edi, dword [esp + 0x21c]
je 0x4f0db2
lea ecx, [esp + 8]
push ecx
call fcn.004e24e0
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x114]
push 0x61ae90
push eax
call fcn.005dfb23
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x12c]
push 0
push ecx
call fcn.004e8950
add esp, 0x28
test eax, eax
jne 0x4f0db2
lea edx, [esp + 0x10c]
push edx
push edi
push esi
push 0x60c81c
push 0x649018
push 0x60da74
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esi], 0
je 0x4f0db7
push esi
call fcn.004e2520
push 0
push esi
call fcn.004e8c10
add esp, 0xc
cmp eax, 1
je 0x4f0db2
mov byte [esi], 0
jmp 0x4f0db7
cmp byte [esi], 0
jne 0x4f0dc1
push edi
push esi
call fcn.004ebf90
add esp, 8
pop edi
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.005dfbbe
add esp, 0x20c
ret
Function at 0x4f20a0
Capabilities:
Encrypt data using rc4 prga
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x672920
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0
je 0x4f2279
mov edi, dword [ebp + 0x10]
cmp edi, esi
je 0x4f2279
lea eax, [edi + 1]
push eax
push esi
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.005dfd60
add esp, 0xc
lea eax, [edi - 1]
mov edx, eax
and edx, 0x80000001
jns 0x4f2118
dec edx
or edx, 0xfffffffe
inc edx
cdq
jne 0x4f2121
sub eax, edx
sar eax, 1
jmp 0x4f2126
sub eax, edx
sar eax, 1
inc eax
mov dword [ebp - 0x24], eax
mov al, byte [eax + ebx]
cmp al, 0x61
jl 0x4f2138
cmp al, 0x7a
jg 0x4f2138
sub al, 0x61
jmp 0x4f213a
sub al, 0x30
movzx edi, al
mov eax, edi
cdq
mov ecx, 0xa
idiv ecx
mov bl, dl
mov dword [ebp - 0x1c], esi
cmp esi, 0x1a
jge 0x4f2185
lea ecx, [edi + esi]
cmp ecx, 0x1a
jl 0x4f216f
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x1a
sub ecx, eax
movzx eax, byte [ecx + 0x69066c]
sub eax, 0x61
lea ecx, [esi + 0x61]
mov byte [eax + 0x690650], cl
inc esi
jmp 0x4f2149
xor esi, esi
mov dword [ebp - 0x1c], esi
cmp esi, 0xa
jge 0x4f21c7
movzx ecx, bl
add ecx, esi
cmp ecx, 0xa
jl 0x4f21b1
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*4]
add edx, edx
sub ecx, edx
movzx eax, byte [ecx + 0x690644]
sub eax, 0x30
lea ecx, [esi + 0x30]
mov byte [eax + 0x690638], cl
inc esi
jmp 0x4f2187
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, dword [ebp + 0x10]
jge 0x4f2279
cmp ecx, dword [ebp - 0x24]
jne 0x4f21de
inc ecx
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 8]
mov al, byte [ecx + edx]
mov dl, al
sub dl, 0x41
cmp dl, 0x19
ja 0x4f2226
movsx eax, al
mov al, byte [eax + 0x69060f]
cmp al, 0x61
jb 0x4f2214
cmp al, 0x7a
ja 0x4f2214
movzx eax, al
sub eax, 0x20
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x20]
mov byte [esi + edx], al
inc ecx
inc dword [ebp - 0x20]
jmp 0x4f21c9
movzx eax, al
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x20]
mov byte [esi + edx], al
inc ecx
inc dword [ebp - 0x20]
jmp 0x4f21c9
mov dl, al
sub dl, 0x61
mov esi, dword [ebp + 0xc]
cmp dl, 0x19
ja 0x4f2248
movsx eax, al
mov dl, byte [eax + 0x6905ef]
mov eax, dword [ebp - 0x20]
mov byte [eax + esi], dl
inc ecx
inc dword [ebp - 0x20]
jmp 0x4f21c9
mov dl, al
sub dl, 0x30
cmp dl, 9
ja 0x4f226a
movsx eax, al
mov dl, byte [eax + 0x690608]
mov eax, dword [ebp - 0x20]
mov byte [eax + esi], dl
inc ecx
inc dword [ebp - 0x20]
jmp 0x4f21c9
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], al
inc ecx
inc dword [ebp - 0x20]
jmp 0x4f21c9
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
mov byte [ecx + eax], 0
jmp 0x4f229d
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f35d0
Capabilities:
Create thread

Disassembly:
sub esp, 0x14
cmp dword [esp + 0x28], 0
jne 0x4f35fd
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
or eax, 0x50000
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0x14
ret
push ebx
xor eax, eax
push esi
mov esi, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
test esi, esi
je 0x4f36e2
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x4f36e2
cmp byte [esi], 0
mov eax, esi
je 0x4f363e
inc eax
cmp byte [eax], 0
jne 0x4f3638
sub eax, esi
inc eax
push edi
push eax
call fcn.005e20e4
mov edi, eax
add esp, 4
test edi, edi
je 0x4f36e1
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push edi
call ebp
push ebx
call fcn.004dd6c0
inc eax
push eax
call fcn.005e20e4
mov esi, eax
add esp, 8
test esi, esi
jne 0x4f3689
push edi
call fcn.005e0865
add esp, 4
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret
push ebx
push esi
call ebp
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x10]
push edx
or ecx, 0x50000
push 0
push 0x4f3530
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], ecx
call fcn.005e07ac
add esp, 0xc
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x4f36e0
cmp dword [esp + 0x20], 0
jne 0x4f36e0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call esi
cmp dword [esp + 0x20], 0
je 0x4f36d5
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret
Function at 0x4f48a0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push ebp
xor ebp, ebp
cmp dword [0x690688], 0xffffffff
push esi
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x2c], eax
jne 0x4f48e1
push 0x690688
push 0x649660
push 0x60d9ec
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4f48e1
mov dword [0x690688], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
push esi
push ebx
push edi
mov dword [esp + 0x24], eax
call fcn.004d5820
cmp al, 1
jne 0x4f4938
mov edx, dword [esp + 0x14]
cmp edx, dword [esp + 0x2c]
jne 0x4f4938
cmp dword [0x690688], ebp
je 0x4f4a2b
push 0x649644
push ebp
call fcn.004f0f30
add esp, 8
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret 0x10
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebp
push 0x20006
push ebp
push 0x649638
push ebp
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, eax
cmp edi, ebp
je 0x4f4987
cmp dword [0x690688], ebp
je 0x4f4974
push edi
push 0x649608
push ebp
call fcn.004f0f30
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 0x10
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x30]
push edx
push 4
push ebp
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
mov eax, dword [esp + 0x10]
cmp edi, ebp
je 0x4f49c6
cmp eax, ebp
je 0x4f49b6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
cmp dword [0x690688], ebp
je 0x4f4974
push edi
push 0x6495d8
jmp 0x4f496b
cmp eax, ebp
je 0x4f49d5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
cmp dword [0x690688], ebp
je 0x4f4a2b
cmp ebx, ebp
je 0x4f4a13
cmp esi, ebp
je 0x4f4a06
mov ecx, dword [esp + 0x2c]
push ecx
push esi
push ebx
push 0x6495ac
push ebp
call fcn.004f0f30
add esp, 0x14
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret 0x10
mov edx, dword [esp + 0x2c]
push edx
push ebx
push 0x64957c
jmp 0x4f4a22
cmp esi, ebp
je 0x4f4a2b
mov eax, dword [esp + 0x2c]
push eax
push esi
push 0x64954c
push ebp
call fcn.004f0f30
add esp, 0x10
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret 0x10
Function at 0x4f4be0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xfffffffffffffffe
push 0x672cb8
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0x110]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x11c], bl
push 0x103
push ebx
lea eax, [ebp - 0x11b]
push eax
call fcn.005dfd60
mov byte [ebp], bl
push 0x103
push ebx
lea ecx, [ebp + 1]
push ecx
call fcn.005dfd60
add esp, 0x18
cmp esi, ebx
je 0x4f4db3
cmp byte [esi], bl
je 0x4f4db3
push 0x5c
push esi
call fcn.005e0940
add esp, 8
test eax, eax
jne 0x4f4d8b
call fcn.004d96c0
test eax, eax
je 0x4f4d0e
push 0x104
lea edx, [ebp - 0x11c]
push edx
call fcn.004db700
add esp, 8
cmp byte [ebp - 0x11c], bl
je 0x4f4d0e
lea ecx, [ebp - 0x11c]
lea edx, [ebp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4f4cb4
lea eax, [ebp]
push eax
call fcn.004e24e0
add esp, 4
mov eax, esi
mov edx, esi
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4f4cd0
sub eax, edx
lea edi, [ebp]
dec edi
lea ecx, [ecx]
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x4f4ce0
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], 0xfffffffe
jmp 0x4f4dbc
push 0x104
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp - 0x11c], bl
je 0x4f4d8b
lea ecx, [ebp - 0x11c]
lea edx, [ebp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4f4d31
lea eax, [ebp]
push eax
call fcn.004e24e0
add esp, 4
mov eax, esi
mov edx, esi
jmp 0x4f4d50
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4f4d50
sub eax, edx
lea edi, [ebp]
dec edi
lea ecx, [ecx]
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x4f4d60
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], 0xfffffffe
jmp 0x4f4dbc
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], 0xfffffffe
jmp 0x4f4dbc
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.005dfbbe
add ebp, 0x108
mov esp, ebp
pop ebp
ret 4
Function at 0x4f59a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x672d78
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
test esi, esi
je 0x4f5ab3
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4f5ab3
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x4f5a0f
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4f5a00
sub eax, edx
sar eax, 1
mov dword [ebp - 0x1c], eax
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4f5a17
sub eax, edx
sar eax, 1
mov ebx, eax
cmp dword [ebp - 0x1c], ebx
jl 0x4f5ab3
movzx eax, word [edi]
push eax
call fcn.005e56af
add esp, 4
movzx ecx, ax
mov dword [ebp - 0x20], ecx
xor edi, edi
mov dword [ebp - 0x24], edi
mov edx, dword [ebp - 0x1c]
sub edx, ebx
cmp edi, edx
jg 0x4f5ab3
lea esi, [esi + edi*2]
movzx eax, word [esi]
push eax
call fcn.005e56af
add esp, 4
movzx ecx, ax
cmp dword [ebp - 0x20], ecx
jne 0x4f5a95
push ebx
push esi
mov edx, dword [ebp + 0xc]
push edx
call fcn.005e38e0
add esp, 0xc
test eax, eax
jne 0x4f5a95
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc edi
mov esi, dword [ebp + 8]
jmp 0x4f5a45
mov dword [ebp - 4], 0xfffffffe
or eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f6110
Capabilities:
Check os version

Disassembly:
sub esp, 0x10c
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x108], eax
push ebp
mov ebp, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x120]
push edi
mov dword [esp + 0xc], 0
test esi, esi
je 0x4f6144
mov byte [esi], 0
cmp dword [0x74aff0], 0
jne 0x4f6209
mov edi, 1
mov dword [0x74aff0], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x4f6209
cmp al, 6
jb 0x4f6209
mov dword [0x74afec], edi
push 0
push str.SeSecurityPrivilege
call fcn.004e21c0
add esp, 8
call fcn.004f5fe0
mov edi, eax
test edi, edi
je 0x4f6224
push 0x103
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.005dfd60
mov ecx, dword [esp + 0x12c]
add esp, 0xc
push edi
push 0
push 0
push 0
push 0x18
push ecx
push ebp
call fcn.004f60c0
test eax, eax
je 0x4f621a
push eax
mov byte [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x14]
push 0x103
push edx
call fcn.004d8b50
add esp, 0xc
test esi, esi
je 0x4f6236
lea eax, [esp + 0x10]
push eax
push ebp
push str.Unable_to_SetNamedSecurityInfo_on__s__Reason:__s.
push esi
call fcn.005dfb23
add esp, 0x10
jmp 0x4f6236
cmp dword [0x74afec], 0
jne 0x4f6178
xor eax, eax
jmp 0x4f623a
mov dword [esp + 0xc], 1
jmp 0x4f6236
test esi, esi
je 0x4f6236
push str.Unable_to_get_LowIntegrity_SACL_
push esi
call fcn.005dfb23
add esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005dfbbe
add esp, 0x10c
ret 0xc
Function at 0x4f78e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x12c
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x128], eax
cmp dword [0x74ba58], 0
jne 0x4f79aa
push 0x90
lea eax, [esp + 8]
push 0
push eax
call fcn.005dfd60
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [0x74ba58], 1
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 2
cmp dword [esp + 0x10], ecx
jne 0x4f79aa
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x4f794d
jne 0x4f79aa
cmp dword [esp + 8], ecx
jb 0x4f79aa
push 0x90
lea edx, [esp + 0x9c]
push 0
push edx
mov dword [esp + 0xa0], 0
call fcn.005dfd60
add esp, 0xc
push 0
lea eax, [esp + 0x98]
push eax
call fcn.004f4a40
cmp eax, 1
jne 0x4f79aa
mov eax, dword [esp + 0x98]
cmp eax, 6
jne 0x4f799b
cmp dword [esp + 0x9c], 3
jae 0x4f79a0
jmp 0x4f79aa
cmp eax, 0xa
jb 0x4f79aa
mov dword [0x74ba54], 1
mov ecx, dword [esp + 0x128]
mov eax, dword [0x74ba54]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x12c
ret

Function at 0x4f79d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x12c
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x128], eax
cmp dword [0x74ba60], 0
jne 0x4f7a9a
push 0x90
lea eax, [esp + 8]
push 0
push eax
call fcn.005dfd60
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [0x74ba60], 1
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 2
cmp dword [esp + 0x10], ecx
jne 0x4f7a9a
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x4f7a3d
jne 0x4f7a9a
cmp dword [esp + 8], ecx
jb 0x4f7a9a
push 0x90
lea edx, [esp + 0x9c]
push 0
push edx
mov dword [esp + 0xa0], 0
call fcn.005dfd60
add esp, 0xc
push 0
lea eax, [esp + 0x98]
push eax
call fcn.004f4a40
cmp eax, 1
jne 0x4f7a9a
mov eax, dword [esp + 0x98]
cmp eax, 6
jne 0x4f7a8b
cmp dword [esp + 0x9c], 4
jae 0x4f7a90
jmp 0x4f7a9a
cmp eax, 0xa
jb 0x4f7a9a
mov dword [0x74ba5c], 1
mov ecx, dword [esp + 0x128]
mov eax, dword [0x74ba5c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x12c
ret

Function at 0x4f7ac0
Capabilities:
Check os version

Disassembly:
sub esp, 0x12c
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x128], eax
push 0x90
lea eax, [esp + 8]
push 0
push eax
call fcn.005dfd60
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x4f7bb0
cmp dword [esp + 4], 6
jne 0x4f7bb0
call fcn.004d8f30
cmp eax, 2
jle 0x4f7bb0
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x4f7b30
jne 0x4f7b96
cmp dword [esp + 8], 2
jb 0x4f7b96
push 0x90
lea edx, [esp + 0x9c]
push 0
push edx
mov dword [esp + 0xa0], 0
call fcn.005dfd60
add esp, 0xc
push 0
lea eax, [esp + 0x98]
push eax
call fcn.004f4a40
cmp eax, 1
jne 0x4f7b96
mov eax, dword [esp + 0x9c]
test eax, eax
jne 0x4f7b9a
cmp dword [esp + 0xa0], 0x44c0
sbb eax, eax
add eax, 6
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x12c
ret
mov eax, dword [esp + 8]
inc eax
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x12c
ret
mov ecx, dword [esp + 0x128]
xor ecx, esp
xor eax, eax
call fcn.005dfbbe
add esp, 0x12c
ret
Function at 0x4f89f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x928
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x924], eax
mov eax, dword [esp + 0x92c]
push ebx
push esi
xor ebx, ebx
push 0x103
lea ecx, [esp + 0x1d]
push ebx
push ecx
mov dword [esp + 0x20], eax
mov byte [esp + 0x24], bl
call fcn.005dfd60
add esp, 0xc
push str.SYSTEMCurrentControlSet_servicesSharedAccessParametersFirewallPolicyFirewallRules
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebx
lea ecx, [esp + 0x24]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x4f8c4c
push ebp
push edi
push 0x3ff
lea edx, [esp + 0x539]
push ebx
push edx
call fcn.005dfd60
push 0x40f
lea eax, [esp + 0x135]
push ebx
push eax
call fcn.005dfd60
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
add esp, 0x18
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x128]
push edx
mov edx, dword [esp + 0x20]
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x548]
push ecx
push ebx
push edx
xor edi, edi
mov byte [esp + 0x144], bl
mov byte [esp + 0x554], bl
mov dword [esp + 0x30], 0x400
mov dword [esp + 0x34], 0x410
call ebp
test eax, eax
jne 0x4f8c3b
mov eax, dword [esp + 0x1c]
push ebx
push eax
lea ecx, [esp + 0x12c]
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4f8bf0
push ebx
lea edx, [esp + 0x128]
push str.ProfilePublic
push edx
xor esi, esi
call fcn.004f5880
add esp, 0xc
push ebx
cmp eax, 0xffffffff
je 0x4f8b34
push 0x60c81c
push str.ProfilePublic
lea eax, [esp + 0x130]
push eax
jmp 0x4f8b90
lea ecx, [esp + 0x128]
push str.ProfilePrivate
push ecx
call fcn.004f5880
add esp, 0xc
push ebx
cmp eax, 0xffffffff
je 0x4f8b63
push 0x60c81c
push str.ProfilePrivate
lea edx, [esp + 0x130]
push edx
jmp 0x4f8b90
lea eax, [esp + 0x128]
push str.ProfileDomain
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4f8b9d
push ebx
push 0x60c81c
push str.ProfileDomain
lea ecx, [esp + 0x130]
push ecx
call fcn.004e1b10
add esp, 0x10
mov esi, 1
push ebx
lea edx, [esp + 0x128]
push str.EmbedCtxt
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4f8bcd
push str.EmbedCtxteScan_Security
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x4f8bd1
cmp esi, ebx
je 0x4f8bf0
lea ecx, [esp + 0x124]
push ecx
lea edx, [esp + 0x538]
push edx
lea eax, [esp + 0x28]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x128]
push edx
mov edx, dword [esp + 0x20]
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x548]
push ecx
inc edi
push edi
push edx
mov byte [esp + 0x144], bl
mov byte [esp + 0x554], bl
mov dword [esp + 0x30], 0x400
mov dword [esp + 0x34], 0x410
call ebp
test eax, eax
je 0x4f8ae3
mov eax, dword [esp + 0x18]
pop edi
pop ebp
cmp eax, ebx
je 0x4f8c4c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x92c]
pop esi
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x928
ret
Function at 0x4f9630
Capabilities:
Manipulate boot configuration
Read .ini file

Disassembly:
mov eax, 0x2a0c
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x2a08], eax
push ebp
push esi
push 0x103
lea eax, [esp + 0x111]
push 0
push eax
mov byte [esp + 0x118], 0
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0x19]
push 0
push ecx
mov byte [esp + 0x20], 0
call fcn.005dfd60
lea edx, [esp + 0x124]
push edx
call fcn.004d8a70
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x1c
lea eax, [esp + 0x10c]
push eax
lea ecx, [esp + 0xc]
push ecx
call ebp
cmp byte [esp + 8], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x4f96d1
lea eax, [esp + 8]
inc eax
cmp byte [eax], 0
jne 0x4f96b2
lea edx, [esp + 8]
sub eax, edx
je 0x4f96d1
cmp byte [esp + eax + 7], 0x5c
je 0x4f96d1
push 0x66da34
mov eax, edx
push eax
call esi
push str.BOOT.INI
lea ecx, [esp + 0xc]
push ecx
call esi
push 1
push 0
push 0
push 0
lea edx, [esp + 0x18]
push 0
push edx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x4f9838
push ebx
push edi
call fcn.004d9cc0
test al, al
jne 0x4f9714
call fcn.004d9720
test eax, eax
je 0x4f9836
lea eax, [esp + 0x10]
push eax
xor edi, edi
mov byte [esp + 0x21c], 0
call fcn.004e8b10
mov esi, eax
add esi, 0x400
push esi
call fcn.005e20e4
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4f9836
push esi
push edi
push ebx
call fcn.005dfd60
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push esi
push ebx
push str.operating_systems
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
cmp byte [ebx], 0
je 0x4f982d
mov esi, ebx
jmp 0x4f9770
push esi
lea edx, [esp + 0x21c]
push edx
call ebp
push 0
lea eax, [esp + 0x21c]
push str._safeboot
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4f97ed
mov cl, byte [esp + eax + 0x218]
lea edx, [esp + eax + 0x218]
test cl, cl
je 0x4f97c1
lea esp, [esp]
cmp cl, 0x20
je 0x4f97c1
mov cl, byte [esp + eax + 0x219]
inc eax
test cl, cl
jne 0x4f97b0
cmp byte [esp + eax + 0x218], 0x20
jne 0x4f97cc
inc eax
lea ecx, [esp + eax + 0x218]
push ecx
push edx
call ebp
lea edx, [esp + 0x218]
push edx
push esi
mov edi, 1
call fcn.004dacb0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esi + eax + 1], 0
lea esi, [esi + eax + 1]
jne 0x4f9770
test edi, edi
je 0x4f982d
lea eax, [esp + 0x10]
push eax
push ebx
push str.operating_systems
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
test eax, eax
je 0x4f982d
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push ebx
call fcn.005e0865
add esp, 4
pop edi
pop ebx
mov ecx, dword [esp + 0x2a10]
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.005dfbbe
add esp, 0x2a0c
ret