joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473eb1
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537d6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x510
mov dword [ebp - 0x51c], ecx
call fcn.004090a0
cmp dword [eax + 0x360], 0
je 0x473ee8
jmp 0x4741a6
call fcn.004090a0
cmp dword [eax + 0x34c], 1
jne 0x473efb
jmp 0x4741a6
push 0x100
lea eax, [ebp - 0x30c]
push eax
push 0x3e9
mov ecx, dword [ebp - 0x51c]
add ecx, 0x6cc
call fcn.00513178
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x50c]
push eax
lea ecx, [ebp - 0x510]
push ecx
lea edx, [ebp - 0x30c]
push edx
call fcn.004f9ec5
add esp, 0x14
movsx eax, byte [ebp - 0x30c]
test eax, eax
je 0x473f69
movsx ecx, byte [ebp - 0x510]
test ecx, ecx
je 0x473f69
movsx edx, byte [ebp - 0x10c]
test edx, edx
jne 0x473fbc
call fcn.004090a0
mov ecx, eax
add ecx, 0xdc
call fcn.00409600
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.004fa590
add esp, 8
push 0x560c94
lea ecx, [ebp - 0x30c]
push ecx
call fcn.004fa5a0
add esp, 8
lea edx, [ebp - 0x30c]
push edx
push 0x3e9
mov ecx, dword [ebp - 0x51c]
add ecx, 0x6cc
call fcn.005131aa
lea eax, [ebp - 0x30c]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004fa590
add esp, 8
lea edx, [ebp - 0x20c]
push edx
call fcn.0042561a
add esp, 4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.shlwapi.dll_PathFileExistsA]
test eax, eax
jne 0x47409f
lea ecx, [ebp - 0x514]
call fcn.004016b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20c]
push ecx
push 0xa20f
lea edx, [ebp - 0x514]
push edx
call fcn.0051c44f
call fcn.004090a0
cmp dword [eax + 0x360], 0
je 0x47403f
lea eax, [ebp - 0x20c]
push eax
call fcn.0042590c
add esp, 4
jmp 0x47408d
push 0
push 4
lea ecx, [ebp - 0x514]
call fcn.00409600
push eax
call fcn.0051c1dd
cmp eax, 6
jne 0x47406a
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0042590c
add esp, 4
jmp 0x47408d
call fcn.004090a0
mov ecx, eax
call fcn.004369b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x514]
call fcn.00513ced
jmp 0x4741a6
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x514]
call fcn.00513ced
lea edx, [ebp - 0x30c]
push edx
call fcn.004285c5
add esp, 4
test eax, eax
jne 0x474143
lea ecx, [ebp - 0x518]
call fcn.004016b0
mov dword [ebp - 4], 1
push 0xa210
lea ecx, [ebp - 0x518]
call fcn.00514c73
call fcn.004090a0
cmp dword [eax + 0x360], 0
je 0x4740fc
push 0x560ca8
lea eax, [ebp - 0x30c]
push eax
call fcn.0042548e
add esp, 8
jmp 0x474131
push 0
push 0
lea ecx, [ebp - 0x518]
call fcn.00409600
push eax
call fcn.0051c1dd
call fcn.004090a0
mov ecx, eax
call fcn.004369b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.00513ced
jmp 0x4741a6
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.00513ced
lea ecx, [ebp - 0x30c]
push ecx
call fcn.004287c3
add esp, 4
test eax, eax
jne 0x474182
lea edx, [ebp - 0x30c]
push edx
call fcn.004286fa
add esp, 4
lea eax, [ebp - 0x30c]
push eax
push 0x3e9
mov ecx, dword [ebp - 0x51c]
add ecx, 0x6cc
call fcn.005131aa
push 1
mov ecx, dword [ebp - 0x51c]
add ecx, 0x188
call fcn.00441140
mov ecx, dword [ebp - 0x51c]
add ecx, 0x188
call fcn.00433ada
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x478fff
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x21
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x20
ja case.0x479028.3
mov eax, dword [ebp - 8]
xor edx, edx
mov dl, byte [eax + 0x479080]
jmp dword [edx*4 + 0x479070]
mov ecx, dword [ebp - 4]
call fcn.00478589
mov ecx, dword [ebp - 4]
call fcn.0047795c
jmp case.0x479028.3
push 0x11
call dword [sym.imp.user32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x479058
mov ecx, dword [ebp - 4]
call fcn.004786e1
jmp case.0x479028.3
mov ecx, dword [ebp - 4]
call fcn.00478f75
mov ecx, dword [ebp - 4]
call fcn.0047795c
mov esp, ebp
pop ebp
ret 4

Function at 0x47e0b6
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
cmp dword [ebp + 8], 0
jne 0x47e0cf
mov eax, 1
jmp 0x47e2a5
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.004fa590
add esp, 8
lea edx, [ebp - 0x104]
push edx
call fcn.004fa680
add esp, 4
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 3
jl 0x47e148
movsx eax, byte [ebp - 0x104]
cmp eax, 0x41
jl 0x47e118
movsx ecx, byte [ebp - 0x104]
cmp ecx, 0x5a
jle 0x47e130
movsx edx, byte [ebp - 0x104]
cmp edx, 0x61
jl 0x47e148
movsx eax, byte [ebp - 0x104]
cmp eax, 0x7a
jg 0x47e148
movsx ecx, byte [ebp - 0x103]
cmp ecx, 0x3a
jne 0x47e148
movsx edx, byte [ebp - 0x102]
cmp edx, 0x5c
je 0x47e152
mov eax, 1
jmp 0x47e2a5
cmp dword [ebp - 0x114], 3
jne 0x47e187
cmp dword [ebp + 0xc], 0
jne 0x47e180
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.004fbc5d
add esp, 8
test eax, eax
je 0x47e180
mov eax, 2
jmp 0x47e2a5
xor eax, eax
jmp 0x47e2a5
mov dword [ebp - 0x108], 3
mov dword [ebp - 0x110], 1
mov ecx, dword [ebp - 0x108]
movsx edx, byte [ebp + ecx - 0x104]
test edx, edx
je 0x47e299
mov eax, dword [ebp - 0x108]
lea ecx, [ebp + eax - 0x104]
mov dword [ebp - 0x10c], ecx
mov edx, dword [ebp - 0x108]
movsx eax, byte [ebp + edx - 0x104]
test eax, eax
je 0x47e1fa
mov ecx, dword [ebp - 0x108]
movsx edx, byte [ebp + ecx - 0x104]
cmp edx, 0x5c
je 0x47e1fa
mov eax, dword [ebp - 0x108]
add eax, 1
mov dword [ebp - 0x108], eax
jmp 0x47e1c4
mov ecx, dword [ebp - 0x108]
movsx edx, byte [ebp + ecx - 0x104]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x110], edx
mov eax, dword [ebp - 0x108]
mov byte [ebp + eax - 0x104], 0
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.0047ddcf
add esp, 4
test eax, eax
jne 0x47e23b
mov eax, 1
jmp 0x47e2a5
cmp dword [ebp + 0xc], 0
jne 0x47e26c
push 0
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.004fbc5d
add esp, 8
test eax, eax
je 0x47e26c
mov eax, 2
jmp 0x47e2a5
cmp dword [ebp - 0x110], 0
je 0x47e277
jmp 0x47e299
mov ecx, dword [ebp - 0x108]
mov byte [ebp + ecx - 0x104], 0x5c
mov edx, dword [ebp - 0x108]
add edx, 1
mov dword [ebp - 0x108], edx
jmp 0x47e19b
xor eax, eax
cmp dword [ebp - 0x110], 0
sete al
mov esp, ebp
pop ebp
ret
Function at 0x4960da
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53894a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0045e460
test eax, eax
je 0x49616d
lea ecx, [ebp - 0x18]
call fcn.00441430
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
call fcn.004973c0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xd38]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0xd34]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x50
call fcn.0042e65d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x496158
call dword [sym.imp.user32.dll_EmptyClipboard]
mov ecx, dword [ebp - 0x10]
push ecx
push 1
call dword [sym.imp.user32.dll_SetClipboardData]
call dword [sym.imp.user32.dll_CloseClipboard]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00441450
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4b88a8
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov ax, ax
shr edi, 0x40
mov bp, bp
ja 0x4bd479
jbe 0x4af11d
cpuid
nop
ret
xchg ebp, ecx
xchg ecx, ebp
mov esi, dword [ebp + 8]
push ecx
pop ecx
mov bl, byte [esi + 0xba]
cmp bl, 1
ja 0x4bd479
xchg al, ch
xchg ch, al
jbe 0x4af13e
cwde
rcr byte [esi], cl
mov al, byte [esi + 0xbb]
push edi
jno 0x4c2a02
mov bl, bl
jo 0x4af153
inc esp
aas
pushal
jo 0x4c2a02
fstp dword [ebp + 0x52]
invalid
rcr dword [ebx + 0x1f105850], 1
jmp dword [esi]
lea esp, [esp + 4]
jne 0x4bcf9c
je 0x4b88b8
cpuid
nop
ret
je 0x4bcf9c
invalid
xchg si, ax
shl ch, 0x20
shl ax, 0x20
xchg si, ax
push ebx
js 0x4af107
jns 0x4bcfb4
cmp ebx, 0x4d890f20
and edi, edi
inc edi
leave
mov ebx, dword [esi + 8]
mov al, byte [ebp + eax]
shl ch, 0x20
lea esi, [esi + 0xc]
xor byte [ebp + ebx], al
jb 0x4b4db4
jns 0x4af107
invalid
shl bx, 0x20
mov edx, edx
xchg di, ax
xchg di, ax
call fcn.004a7998
fsqrt
mov eax, dword [esi + 4]
mov ebx, ebx
mov ebx, dword [esi + 8]
mov ebx, dword [ebp + ebx]
lea esi, [esi + 0xc]
sbb dword [ebx], eax
jmp dword [esi]
shl esi, 0x20
Function at 0x4bb7e2
Capabilities:
Encode data using xor

Disassembly:
and esi, 0x9fffffff
jb 0x4a949d
mov eax, esi
pop esi
ret
or esi, 0xc0000000
jb 0x4a94a6
mov eax, esi
push eax
pop eax
pop esi
mov di, di
ret
xchg edi, eax
push 0x4655870f
add dword [eax], eax
jbe 0x4a94a0
add eax, dword [edx]
mov al, 0xf
xchg byte [edx + 0x46], cl
add dword [eax], eax
jbe 0x4bdaf0
fpatan
dec edi
lcall 0xee85, 0x820ff688
invalid
push ss
dec edx
shl ebx, 0x20
jne 0x4b1de5
je 0x4abc40
invalid
ja 0x4b923b
jbe 0x4b803e
mov eax, dword [0xf9a0420]
xchg bh, dh
adc dword [eax], eax
add byte [edx + 0x24648dd5], al
lea esp, [esp + 4]
ja 0x4ac28d
mov al, al
shr al, 0x40
jbe 0x4b923b
je 0x4c005a
mov dword [0x5718f4], 1
call fcn.004a0af7
test eax, eax
jb 0x4abc1e
je 0x4c005a
jne 0x4bb2bf
nop
cpuid
ret 0xf089
mov eax, esi
mov dword [0x5718f0], 1
and eax, 0x1fffffff
jb 0x4abc30
lea edx, [edx]
pop esi
jmp fcn.004abbdc
push esi
call dword [sym.imp.kernel32.dll_GetVersion]
mov esi, eax
mov eax, dword [0x5718f4]
ja 0x4c0862
jbe 0x4bb7fc
cpuid
add bl, 0xf
xchg byte [eax + 0x50], ah
add byte [eax], al
jbe 0x4c0862
invalid
xchg bp, cx
xchg cx, bp
mov bx, bx
shr bl, 0x40
js 0x4b8032
jns 0x4bdb08
invalid
jns 0x4b8032
test esi, 0x80000000
jb 0x4abc46
mov ebx, ebx
mov eax, esi
je 0x4a0ac3
push dword [ebp + 4]
jne 0x4c0076
cpuid
and eax, ebx
add ch, 0x4c
sub ch, 0x4c
and eax, 0xff
jb 0x4b1e00
cmp eax, 3
ja 0x4a0ab5
xchg bh, ch
xchg ch, bh
jbe 0x4c009c
cmp byte [edx - 0x3e994eac], ch
out dx, eax
inc eax
shr di, 0x40
jne 0x4c00cb
je 0x4c00ac
cpuid
jmp 0x4c006f
mov eax, esi
and eax, 0xff00
jb 0x4a9493
cmp eax, 0xb00
ja 0x4a0ab5
jbe 0x4c00c9
adc eax, 0xf688b590
mov dh, dh
sub edi, 0
jae 0x4c00d2
inc edi
outsb dx, byte [esi]
jae 0x4a0aa1
xor eax, 0xe26ffec
iretd
test eax, eax
jb 0x4b5a1b
je 0x4bb29c
jne 0x4c0876
invalid
mov edx, edx
mov eax, dword [0x5718f0]
test eax, eax
jb 0x4b5a24
ja 0x4bb271
jbe 0x4c0891
cpuid
nop
ret
jbe 0x4bb271
xor al, 0xe9
push edx
invalid

Function at 0x4bc37f
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, dword [esi + 4]
shl ah, 0x20
call fcn.004b0482
fimul dword [ecx - 0x75]
pop ebp
inc eax
xchg dx, ax
xchg dx, ax
mov edx, dword [esi + 8]
mov si, si
mov ecx, dword [esi + 4]
lea esi, [esi + 0xc]
shl dword [ebx + edx], cl
mov si, si
jmp dword [esi]
lea esi, [esi + 4]
shr cx, 0x40
stc
jmp dword [esi]
mov edx, dword [esi + 8]
ja 0x49e698
jbe 0x4a8d72
cpuid
nop
ret
jbe 0x49e698
fst dword [esi]
mov word [esi + 0xbc], dx
xchg cx, ax
mov bl, bl
js 0x4b486b
xchg si, ax
xchg si, ax
jns 0x4bc38f
nop
cpuid
ret
jns 0x4b486b
fsub dword [eax - 0x77]
cmp al, 0xff
xchg edx, eax
js 0x49f093
jns 0x4bc3aa
cpuid
ret
jns 0x49f093
ficomp dword [ebp - 0x75]
pop ebp
inc eax
jne 0x4a8d63
shl bx, 0x20
je 0x4bc3c3
dec edi
je 0x4a8d63
invalid
Function at 0x4c3e1a
Capabilities:
Encode data using xor

Disassembly:
call fcn.004a43d6
shl edi, 0x20
mov al, byte [ebp + 0xb]
xchg dx, ax
lea ebp, [ebp]
mov cx, cx
xchg dx, ax
push esi
xchg bh, dh
shl ax, 0x20
xchg dh, bh
shr bp, 0x40
mov byte [esi + 0xba], bl
jne 0x4b8009
je 0x4acd2d
std
cpuid
ret
je 0x4b8009
xor eax, 0x44e8b96
ja 0x4a20a5
jbe 0x4b4d03
call 0xfeb615c
xchg byte [ebx + edx*8 - 0x297d0002], bl
xchg esi, ebp
jbe 0x4a20a5
adc dh, 0x87
out dx, al
xchg ebp, esi
mov byte [esi + 0xba], cl
mov byte [esi + 0xbb], 0
mov word [esi + 0xbc], dx
jno 0x4accf8
jo 0x4b4d2e
cmp cl, byte [esi]
int1
jo 0x4accf8
sub byte [esi - 0x74d3ba75], 0x5d
inc eax
shl ebx, 0x20
push 0x4b691e
ret
ja 0x49e204
jbe 0x4b8014
rol byte [edi], 1
fmul dword [edi]
xchg dl, ch
popal
invalid
jbe 0x49e204
xor al, 0x66
jmp dword [esi]
pop dword [esp - 4]
mov byte [esi + 0xba], cl
jno 0x4b4cf7
jo 0x4c3e2e
xor eax, 0xc3800fc8
push cs
invalid
jo 0x4b4cf7
and eax, 0x24448f69
cld

Function at 0x4c4420
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [esp + 8]
push ebx
and ax, 0x8000
push esi
mov dx, word [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ax, 1
sbb eax, eax
add dx, dx
inc eax
or ax, dx
mov word [esp + 0x10], ax
xor byte [esp + 0x11], al
mov ax, word [esp + 0x10]
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
mov esi, 0x55
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
mov eax, 0x58
mov dl, byte [esp + 0x10]
mov bl, byte [esp + 0x10]
and dl, 0x80
add bl, bl
shr dl, 7
add ecx, 2
or dl, bl
mov byte [esp + 0x10], dl
mov dl, byte [esp + 0x11]
and dl, 1
mov bl, byte [esp + 0x11]
shl dl, 7
shr bl, 1
or dl, bl
mov byte [esp + 0x11], dl
mov bl, byte [esp + 0x10]
xor byte [esp + 0x11], bl
mov dx, word [esp + 0x10]
not dx
mov word [esp + 0x10], dx
xor word [ecx - 2], dx
add word [esp + 0x10], si
dec eax
jne 0x4c44a3
pop esi
pop ebx
ret

Function at 0x4c5e60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov cl, byte [esp + 8]
push ebx
mov edx, dword [esp + 0x10]
push esi
xor si, si
push edi
cmp dword [esp + 0x1c], 0
push ebp
je 0x4c5e8a
movzx eax, si
inc si
xor byte [eax + edx], cl
movzx ebx, si
cmp ebx, dword [esp + 0x20]
jb 0x4c5e79
xor ax, ax
mov al, cl
and ax, 0xf
mov word [esp + 0x12], ax
mov di, word [esp + 0x20]
xor cl, cl
dec di
mov esi, edx
cmp word [esp + 0x20], 0
je 0x4c5ecc
mov al, byte [esi]
mov ebp, esi
inc esi
mov bl, cl
shl bl, 7
mov cl, al
shr al, 1
and cl, 1
or al, bl
mov byte [ebp], al
mov bp, di
dec di
test bp, bp
jne 0x4c5eab
test cl, cl
je 0x4c5ed3
or byte [edx], 0x80
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x4c5e98
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x4c6230
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
sub esp, 8
mov al, byte [esp + 0xc]
push ebx
and ax, 0xf
push esi
mov word [esp + 0xa], ax
push edi
mov eax, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
lea ecx, [eax + ebp - 1]
mov dword [esp + 0x14], ecx
xor dl, dl
mov edi, dword [esp + 0x14]
test bp, bp
lea esi, [ebp - 1]
je 0x4c6281
mov bl, byte [edi]
mov eax, edi
dec edi
mov cl, dl
mov dl, bl
add bl, bl
shr dl, 7
or bl, cl
mov byte [eax], bl
mov ax, si
dec si
test ax, ax
jne 0x4c6265
test dl, dl
je 0x4c628c
mov eax, dword [esp + 0x14]
or byte [eax], 1
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x4c6257
xor si, si
test ebp, ebp
je 0x4c62b9
mov dl, byte [esp + 0x1c]
mov eax, dword [esp + 0x20]
movzx ecx, si
inc si
xor byte [ecx + eax], dl
movzx ecx, si
cmp ecx, ebp
jb 0x4c62a2
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4ca5d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0xc
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
push ebp
add edi, 0x64
mov ebp, dword [esi]
mov eax, dword [esi + 4]
sub ebp, dword [edi]
mov edx, eax
shr edx, 7
mov ebx, ebp
and dl, 0x1f
mov cl, 0x20
sub cl, dl
sub edi, 8
shl ebx, cl
mov cl, dl
shr ebp, cl
or ebx, ebp
mov cl, 0x20
xor ebx, eax
mov eax, ebx
mov dword [esi], ebx
shr eax, 4
mov edx, dword [edi + 4]
add edx, dword [esi + 4]
and al, 0x1f
mov ebp, edx
sub cl, al
shl ebp, cl
mov cl, al
shr edx, cl
or ebp, edx
xor ebp, ebx
dec dword [esp + 0x10]
mov dword [esi + 4], ebp
jne 0x4ca5ea
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
mov ecx, dword [eax + 4]
sub dword [esi], ecx
mov edx, dword [eax]
sub dword [esi + 4], edx
pop esi
pop ebx
add esp, 4
ret

Function at 0x4cb2b0
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push 0
push eax
mov edi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x4cb2d9
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 4
ret
inc esi
push esi
call fcn.004c6140
mov dword [esp + 0x10], eax
add esp, 4
test eax, eax
jne 0x4cb2f4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [esp + 0xc]
push esi
push eax
push ebx
call edi
test eax, eax
jne 0x4cb30a
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x4cc7b9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x5427a0
push 0x80000000
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cc811
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x5427dc
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x4cc804
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
jmp 0x4cc813
xor eax, eax
pop esi
leave
ret 4

Function at 0x4cd120
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
pop edi
je 0x4cd195
mov eax, dword [esp + 0x10]
mov ecx, 2
sub eax, ecx
je 0x4cd16c
mov word [0x573ebc], cx
call fcn.004d2f20
add esp, 0x94
ret
cmp dword [esp + 4], 5
jne 0x4cd159
mov edx, dword [esp + 8]
mov eax, 1
cmp edx, eax
jb 0x4cd159
mov word [0x573ebc], ax
call fcn.004cce70
call fcn.004cd000
call fcn.004d2f20
add esp, 0x94
ret
Function at 0x4ce400
Capabilities:
Get session user name

Disassembly:
sub esp, 0x4c8
push esi
lea eax, [esp + 8]
push edi
lea ecx, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x14], 0x40
call dword [sym.imp.advapi32.dll_GetUserNameA]
cmp eax, 1
jne 0x4ce491
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x54]
push ecx
push edx
call fcn.004d88f0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4ce487
mov eax, dword [0x56a47c]
mov cx, word [0x56a480]
mov dl, byte [0x56a482]
mov dword [esp + 0x10], eax
mov word [esp + 0x14], cx
mov byte [esp + 0x16], dl
jmp 0x4ce4d8
lea edi, [esp + 0x50]
lea edx, [esp + 0x10]
jmp 0x4ce4bb
mov dx, word [0x56a480]
mov ecx, dword [0x56a47c]
mov al, byte [0x56a482]
mov word [esp + 0x14], dx
mov dword [esp + 0x10], ecx
mov byte [esp + 0x16], al
lea edi, [esp + 0x10]
lea edx, [esp + 0xd0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x90]
push ebx
push ecx
call fcn.004d7f20
lea edi, [esp + 0x98]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x2dc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xe0]
push ecx
call fcn.004d88f0
add esp, 0x10
cmp eax, 0xffffffff
pop ebx
jne 0x4ce570
mov edx, dword [0x56a4f8]
mov eax, dword [0x56a4fc]
mov ecx, dword [0x56a500]
mov dword [esp + 0xd0], edx
mov dx, word [0x56a504]
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd8], ecx
mov word [esp + 0xdc], dx
jmp 0x4ce59b
lea edi, [esp + 0x2d0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 8]
lea edi, [esp + 0xd0]
push ecx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd4]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
push ecx
push edx
call fcn.004d7e40
mov ecx, dword [esp + 0x14]
add esp, 0xc
inc eax
neg eax
sbb eax, eax
pop edi
and eax, ecx
pop esi
mov dword [0x573ec0], eax
add esp, 0x4c8
ret
Function at 0x4ced10
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x1c]
push edi
push ebx
push ebp
push eax
mov eax, dword [esp + 0x28]
push 0
push esi
push ecx
push edx
push eax
call fcn.004d1c70
add esp, 0x24
test ax, ax
je 0x4ced58
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov word [ecx + 6], ax
pop ebx
ret
cmp word [0x573ed0], 0
jne 0x4cede9
lea edx, [esp + 0x30]
lea eax, [esp + 0x34]
push edx
push 0
push eax
push fcn.004d1ba0
push 0
push 0
call fcn.004fd42c
add esp, 0x18
mov dword [0x573ecc], eax
push 0x1b58
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
jne 0x4cede9
mov ax, word [esp + 0x34]
cmp ax, 2
jne 0x4cedf1
cmp dword [esp + 0x20], 0xffffffff
jne 0x4cedbd
test esi, esi
jge 0x4cedbd
mov ecx, dword [esp + 0x28]
push edi
push ebx
push ebp
push ecx
push 2
push esi
push 0xffffffffffffffff
jmp 0x4cedca
mov ecx, dword [esp + 0x28]
push edi
push ebx
push ebp
push ecx
push 2
push esi
push 1
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
push edx
push eax
call fcn.004d1c70
mov ecx, dword [0x573ecc]
add esp, 0x24
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
ret
test ax, ax
jne 0x4cee0b
mov edx, dword [0x573ecc]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor ax, ax
pop ebx
ret
cmp dword [esp + 0x20], 1
jne 0x4cee25
test esi, esi
jle 0x4cee25
mov eax, dword [esp + 0x28]
push edi
push ebx
push ebp
push eax
push 1
push esi
push 1
jmp 0x4cee32
mov eax, dword [esp + 0x28]
push edi
push ebx
push ebp
push eax
push 1
push esi
push 0xffffffffffffffff
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push ecx
push edx
call fcn.004d1c70
mov eax, dword [esp + 0x38]
add esp, 0x24
mov word [eax + 6], 0x46
mov ecx, dword [0x573ecc]
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov ax, 0x46
pop ebx
ret