joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb6a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52cf58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
lea eax, [ebp - 0x34]
mov dword [ebp - 0x10], esp
mov esi, ecx
push eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call sub.MFC42.DLL_CString::CString_3
mov ebx, 1
push str.CStr_
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.004c1e1e
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004c2184
push 0x5a334c
lea ecx, [ebp - 0x14]
call fcn.004c2184
lea edx, [ebp - 0x34]
lea eax, [ebp - 0x14]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString_4
mov ecx, dword [esi + 0x20]
call fcn.0049de10
test eax, eax
jne 0x4bb745
lea ecx, [ebp - 0x1c]
push 0x592b28
push ecx
mov dword [ebp - 0x1c], str.General_Error_in_GetValue__
call sub.MSVCRT.dll__CxxThrowException
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x14]
push edx
call sub.MFC42.DLL_CString::operator_1
jmp 0x4bb76d
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_CString::CString_3
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 4
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea edx, [ebp - 0x18]
push str.Thread:_d____s
push edx
call sub.MFC42.DLL_CString::Format_1
mov eax, dword [ebp - 0x18]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x4bb7ce
push 0
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::GetBuffer
mov edx, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x24]
inc edx
push edx
push 0x4c9
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call sub.MFC42.DLL_CString::CString
lea edx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jge 0x4bb800
push eax
call fcn.004c2ef0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4bc5b8
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x52d0f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
mov dword [esp + 4], esi
call sub.MFC42.DLL_CCmdTarget::CCmdTarget
lea ecx, [esi + 0x30]
mov dword [esp + 0x20], 0
call fcn.004c04d0
mov ecx, esi
mov byte [esp + 0x20], 1
mov dword [esi], 0x550618
call sub.MFC42.DLL_CCmdTarget::EnableAutomation
xor ecx, ecx
xor eax, eax
push ecx
push ecx
mov dword [esi + 0x20], eax
push ecx
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x2c], eax
lea eax, [esp + 8]
push eax
mov ecx, esi
mov dword [esp + 0x14], 0
mov word [esp + 0xc], 2
call fcn.004bde20
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x4bd52a
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x52d230
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push edi
push eax
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString_3
mov ecx, dword [esp + 8]
mov byte [esp + 0x14], 1
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea edx, [esp + 0x24]
push str.Thread:_d____s_n
push edx
call sub.MFC42.DLL_CString::Format_1
mov eax, dword [esp + 0x2c]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esi + 0x28]
push 0
mov edi, dword [ecx + 0x24]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::GetBuffer
mov ecx, dword [esi + 0x28]
push eax
push edi
call fcn.004b6440
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4be480
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push edi
push 0
mov eax, dword [esi + 0x3114]
mov edi, edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4be4a1
pop edi
mov eax, 1
pop esi
ret
test edi, edi
jne 0x4be5b2
push ebx
lea ebx, [esi + 0x32ec]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esi + 4]
shl edi, 0x1d
push ebx
sar edi, 0x1f
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
pop ebx
je 0x4be4d4
pop edi
mov eax, 1
pop esi
ret
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
mov cx, word [esi + 0x3184]
push ecx
call edi
test ah, 0x80
je 0x4be546
push 0x12
call edi
mov dl, byte [esi + 0x3186]
sar eax, 0xf
shr dl, 2
and eax, 1
and edx, 1
xor eax, edx
test ax, ax
jne 0x4be546
push 0x11
call edi
mov cl, byte [esi + 0x3186]
sar eax, 0xf
shr cl, 1
and eax, 1
and ecx, 1
xor eax, ecx
test ax, ax
jne 0x4be546
push 0x10
call edi
mov dl, byte [esi + 0x3186]
sar eax, 0xf
and eax, 1
and edx, 1
xor eax, edx
test ax, ax
jne 0x4be546
pop edi
mov eax, 1
pop esi
ret
xor eax, eax
mov ax, word [esi + 0x3110]
push eax
call edi
test ah, 0x80
je 0x4be5b2
push 0x12
call edi
mov cl, byte [esi + 0x3112]
sar eax, 0xf
shr cl, 2
and eax, 1
and ecx, 1
xor eax, ecx
test ax, ax
jne 0x4be5b2
push 0x11
call edi
mov dl, byte [esi + 0x3112]
sar eax, 0xf
shr dl, 1
and eax, 1
and edx, 1
xor eax, edx
test ax, ax
jne 0x4be5b2
push 0x10
call edi
mov cl, byte [esi + 0x3112]
sar eax, 0xf
and eax, 1
and ecx, 1
xor eax, ecx
test ax, ax
jne 0x4be5b2
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x4bf960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x52d5c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
lea eax, [esp + 0x1c]
lea ecx, [esp]
push eax
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString_4
mov ecx, dword [esp]
mov byte [esp + 0x14], 1
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4bf9f7
push 0x5a1220
lea edx, [esp + 0xc]
push 0x5ae850
push edx
call sub.MFC42.DLL_operator_3
lea ecx, [esp + 0x1c]
lea edx, [esp + 4]
push ecx
push eax
push edx
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_operator_4
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x18], 3
call sub.MFC42.DLL_CString::operator_3
lea ecx, [esp + 4]
mov byte [esp + 0x14], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp]
mov ecx, dword [esp + 0x20]
push eax
call fcn.0049d560
lea ecx, [esp]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x4c3200
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x52d949
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 8]
mov dword [esp + 0x1c], 1
mov ecx, edi
call sub.MFC42.DLL_CString::CString_3
lea ebp, [esi + 0xc]
mov byte [esp + 0x1c], 2
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_3
lea ebx, [esi + 0x10]
mov byte [esp + 0x1c], 3
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x14]
mov byte [esp + 0x1c], 4
call sub.MFC42.DLL_CString::CString_3
push 0x5ad740
mov ecx, ebx
mov byte [esp + 0x20], 5
call fcn.004c1e1e
lea eax, [esp + 0x28]
lea ecx, [esi + 0x14]
push eax
call sub.MFC42.DLL_CString::operator_3
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esi + 0x1c], ecx
xor ebx, ebx
push 0x5a1220
lea ecx, [esp + 0x28]
mov dword [esi], edx
mov dword [esi + 0x18], ebx
call sub.MFC42.DLL_CString::TrimLeft_1
push 0x5c
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::Left
push eax
mov ecx, ebp
mov byte [esp + 0x20], 6
call sub.MFC42.DLL_CString::operator_3
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 5
call sub.MFC42.DLL_CString::CString
push 0x5a1220
mov ecx, ebp
call sub.MFC42.DLL_CString::TrimRight_2
mov ecx, dword [esp + 0x24]
push 0x5c
mov ebp, dword [ecx - 8]
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::ReverseFind
sub ebp, eax
lea edx, [esp + 0x2c]
push ebp
push edx
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::Right
push eax
mov ecx, edi
mov byte [esp + 0x20], 7
call sub.MFC42.DLL_CString::operator_3
mov byte [esp + 0x1c], 5
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString
push 0x5a1220
mov ecx, edi
call sub.MFC42.DLL_CString::TrimLeft_1
push 0x5a1220
mov ecx, edi
call sub.MFC42.DLL_CString::TrimRight_2
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.004c33f0
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x4c33f0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x52d998
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0xc]
lea edi, [esi + 4]
push edi
push 0x20019
push ebx
push eax
mov eax, dword [esi]
mov dword [esp + 0x28], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4c34d6
mov eax, dword [esi + 8]
lea ecx, [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push eax
mov eax, dword [edi]
push eax
mov dword [esp + 0x28], ebx
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call sub.MFC42.DLL_operatornew
add esp, 4
lea edx, [esp + 0x10]
mov ebx, eax
mov eax, dword [esi + 8]
push edx
mov edx, dword [edi]
lea ecx, [esp + 0x18]
push ebx
push ecx
push 0
push eax
push edx
call ebp
test eax, eax
push ebx
jne 0x4c34c5
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString_1
lea ebp, [esi + 0x10]
push eax
mov ecx, ebp
mov dword [esp + 0x28], 0
call sub.MFC42.DLL_CString::operator_3
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
push ebx
call sub.MFC42.DLL_operatordelete
mov eax, dword [edi]
add esp, 4
mov dword [esi + 0x18], 1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
jmp 0x4c34da
call sub.MFC42.DLL_operatordelete
mov ecx, dword [edi]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0x14
push esi
mov esi, dword [esp + 0x30]
mov ecx, esi
call sub.MFC42.DLL_CString::CString_4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4

Function at 0x4c3500
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
mov eax, dword [esi + 0xc]
mov edx, dword [esi]
lea edi, [esi + 4]
push ecx
push edi
push 0
push 0x20006
push 0
push 0x5ad740
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4c355d
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 8]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
mov eax, dword [edi]
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4c3554
mov dword [esi + 0x18], 1
mov ecx, dword [edi]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ecx
ret
Function at 0x4c46a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.NtProtectVirtualMemory
push str.NTDLL.DLL
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.ZwDeviceIoControlFile
push str.NTDLL.DLL
mov ebx, eax
call esi
push eax
call edi
push 0
push ebx
mov esi, eax
call fcn.004c4770
push 1
push esi
call fcn.004c4770
mov eax, dword [sym.imp.USER32.dll_SetCursorPos]
push 2
push eax
call fcn.004c4770
mov ecx, dword [sym.imp.USER32.dll_SendInput]
push 3
push ecx
call fcn.004c4770
mov edx, dword [sym.imp.USER32.dll_GetCursorPos]
push 4
push edx
call fcn.004c4770
mov eax, dword [sym.imp.GDI32.dll_GetPixel]
push 5
push eax
call fcn.004c4770
mov ecx, dword [sym.imp.GDI32.dll_GetDIBits]
push 6
push ecx
call fcn.004c4770
mov edx, dword [sym.imp.GDI32.dll_BitBlt]
push 7
push edx
call fcn.004c4770
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
add esp, 0x40
push 8
push eax
call fcn.004c4770
add esp, 8
lea ecx, [esp + 0xc]
push ecx
push 0x40
push 0x400
push 0x658380
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4c4b10
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x52dceb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push ebp
push esi
push edi
push str.shield.ini
lea eax, [esp + 0x10]
push 0x658370
push eax
call sub.MFC42.DLL_operator_3
mov ecx, dword [esp + 0xc]
xor edi, edi
push ecx
mov dword [esp + 0x148], edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x4c4b7a
mov edx, dword [esp + 0xc]
push edx
push edi
push str.Version
push str.SHIELD
call ebp
test eax, eax
jne 0x4c4c0d
push edi
push str.ShieldModule.dat
call fcn.004eb390
mov esi, eax
add esp, 8
cmp esi, edi
je 0x4c4c0d
mov eax, dword [0x658370]
push ebx
push eax
push esi
call fcn.004eb4f0
mov dword [esp + 0x1c], edi
mov ecx, 0x4a
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
push ecx
push 0xffffffffffffffff
push esi
call fcn.004eb3d0
mov eax, dword [esp + 0x28]
add esp, 0x14
xor edi, edi
mov ebx, eax
test eax, eax
jle 0x4c4bef
lea edx, [esp + 0x14]
push edx
push edi
push esi
call fcn.004eb3d0
add esp, 0xc
test eax, eax
jne 0x4c4bef
lea eax, [esp + 0x18]
push eax
push edi
push esi
call fcn.004eb4b0
add esp, 0xc
inc edi
cmp edi, ebx
jl 0x4c4bc8
push esi
call fcn.004eb5b0
add esp, 4
test al, al
pop ebx
push esi
je 0x4c4c05
call fcn.004eb530
jmp 0x4c4c0a
call fcn.004e6ac0
add esp, 4
push str.ShieldModule.dat
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0xc]
push ecx
push 0
push str.Version
push str.SHIELD
call ebp
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x144], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x13c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x13c
ret
Function at 0x4c5030
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call esi
mov bx, word [esp + 0xc]
mov cl, bl
sar eax, 0xf
shr cl, 2
and eax, 1
and ecx, 1
xor eax, ecx
test ax, ax
je 0x4c505b
pop esi
xor eax, eax
pop ebx
ret
push 0x11
call esi
mov dl, bl
sar eax, 0xf
shr dl, 1
and eax, 1
and edx, 1
xor eax, edx
test ax, ax
je 0x4c5078
pop esi
xor eax, eax
pop ebx
ret
push 0x10
call esi
sar eax, 0xf
and eax, 0xffff
and ebx, 0xffff
not eax
xor eax, ebx
pop esi
and eax, 1
pop ebx
ret

Function at 0x4c6340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52ddd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x5767dc
mov eax, dword [esi + 0x28]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x14], edi
je 0x4c6377
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x4c6384
mov edx, dword [eax]
push eax
call dword [edx + 0x20]
mov eax, dword [esi + 0x28]
cmp eax, edi
je 0x4c6394
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x28], edi
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x4c63a4
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x24], edi
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x4c63b4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x20], edi
mov edx, dword [esi + 0x34]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esi + 0x38]
push eax
call edi
mov ecx, dword [esi + 0x30]
push ecx
call edi
mov edx, dword [esi + 0x2c]
push edx
call edi
mov ecx, esi
call fcn.004c5210
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004c5210
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4c7c50
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [esi + 4]
push 1
push eax
call edi
mov ecx, dword [esi + 4]
push 2
push ecx
mov dword [esi + 0x18], eax
call edi
mov edx, dword [esi + 4]
push 4
push edx
mov dword [esi + 0x1c], eax
call edi
mov dword [esi + 0x20], eax
mov eax, dword [esi + 4]
push 5
push eax
call edi
mov ecx, dword [esi + 4]
push 6
push ecx
mov dword [esi + 0x24], eax
call edi
mov edx, dword [esi + 4]
push 7
push edx
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x34], eax
mov eax, dword [esi + 4]
push 9
push eax
call edi
mov ecx, dword [esi + 4]
push 0xa
push ecx
mov dword [esi + 0x2c], eax
call edi
mov edx, dword [esi + 4]
push 0xb
push edx
mov dword [esi + 0x30], eax
call edi
mov dword [esi + 0x38], eax
pop edi
pop esi
ret
Function at 0x4c94e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 4], eax
lea edi, [ecx + ecx + 2]
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4c9519
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push ebx
push esi
call dword [sym.imp.MSVCRT.dll_mbstowcs]
push esi
call dword [sym.imp.MSVCRT.dll__wcslwr]
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp + 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
cmp ecx, 1
mov eax, dword [eax + 0xc]
lea edx, [eax + 0xc]
mov dword [ebp + 8], edx
jne 0x4c955a
mov ebx, dword [edx]
mov dword [ebp + 8], edx
jmp 0x4c9580
cmp ecx, 2
jne 0x4c956b
add eax, 0x14
mov edx, eax
mov dword [ebp + 8], eax
mov ebx, dword [edx]
jmp 0x4c9580
cmp ecx, 3
jne 0x4c9576
add eax, 0x1c
mov dword [ebp + 8], eax
mov edx, dword [ebp + 8]
mov ebx, dword [edx]
jmp 0x4c9580
mov ecx, dword [ebp + 0xc]
mov esi, ebx
lea eax, [ecx*8]
sub esi, eax
mov ecx, 0x12
add esi, 8
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x250]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
lea edx, [ebp - 0x250]
push edx
call dword [sym.imp.MSVCRT.dll__wcslwr]
mov ecx, dword [ebp - 8]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 0x14
test eax, eax
je 0x4c95de
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov dword [ebp - 4], 1
mov dword [edx], eax
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [ecx + 4], edx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x50]
cmp eax, 1
je 0x4c95fb
cmp eax, 2
jne 0x4c95f3
mov ebx, dword [ebp - 0x48]
jmp 0x4c95fb
cmp eax, 3
jne 0x4c95fb
mov ebx, dword [ebp - 0x40]
cmp ebx, dword [ebp + 8]
jne 0x4c957d
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c9c00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ebp, dword [esp + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
call ebx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0
push 2
push ecx
push edx
call fcn.00522f80
push 0
push 0x3e8
push edx
push eax
call fcn.00522ed0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x20], edx
call esi
push 0
call edi
lea ecx, [esp + 0x20]
push ecx
call esi
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
sub ecx, eax
mov eax, dword [esp + 0x24]
sbb eax, edx
mov edx, dword [esp + 0x1c]
cmp eax, edx
jl 0x4c9c66
jg 0x4c9c95
cmp ecx, dword [esp + 0x18]
jb 0x4c9c66
lea edx, [esp + 0x10]
push 1
push edx
push 0x64
call fcn.004c45d0
mov ecx, eax
add ecx, 0x14
call fcn.00521080
test dword [esp + 0x10], ebp
je 0x4c9cc8
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [esp + 0x14]
cmp eax, 0x7d0
jb 0x4c9c2f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x4cd9c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52e550
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ecx
lea ecx, [esp + 0x3c]
mov eax, esp
mov dword [esp + 4], esp
lea edx, [esp + 0x2c]
push ecx
push edx
push eax
mov dword [esp + 0x2c], 5
call sub.MFC42.DLL_operator_4
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0xc], esp
push eax
mov byte [esp + 0x28], 6
call sub.MFC42.DLL_CString::CString_4
mov byte [esp + 0x24], 5
call fcn.004ce7e0
mov ecx, eax
call fcn.004cf1f0
push ecx
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 8], esp
push edx
call sub.MFC42.DLL_CString::CString_4
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 8], esp
push eax
mov byte [esp + 0x28], 8
call sub.MFC42.DLL_CString::CString_4
push ecx
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
mov byte [esp + 0x2c], 9
call sub.MFC42.DLL_CString::CString_4
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
mov byte [esp + 0x30], 0xa
call sub.MFC42.DLL_CString::CString_4
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x34], 0xb
call sub.MFC42.DLL_CString::CString_4
mov byte [esp + 0x30], 5
call fcn.004ce030
add esp, 0x14
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString
mov byte [esp + 0x1c], 1
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x34]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x38]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x4ce460
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4ce4c2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc