joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c9650
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x202]
push ecx
mov dword [ebp - 0x208], 0
mov word [ebp - 0x204], ax
call fcn.004e8ba0
add esp, 0xc
lea edx, [ebp - 0x208]
push edx
push 0x20019
push 0
push str.SystemCurrentControlSetServiceslanmanserverparameters
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c971f
push edi
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x208]
lea ecx, [ebp - 0x204]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0
push str.Srvcomment
push eax
mov dword [ebp - 0x20c], 0x200
mov dword [ebp - 0x210], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x208]
push ecx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x4c971f
lea eax, [ebp - 0x204]
mov edx, esi
mov ecx, eax
sub edx, ecx
jmp 0x4c9710
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4c9710
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e4746
mov esp, ebp
pop ebp
ret
Function at 0x4c9ff0
Capabilities:
Get common file path
Get disk information
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edx, edx
push 0x206
mov dword [ebp - 0x248], eax
push edx
lea eax, [ebp - 0x22a]
push eax
mov dword [ebp - 0x244], ecx
mov word [ebp - 0x22c], dx
call fcn.004e8ba0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, dword [ebp - 0x22c]
push edx
lea edi, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0
call fcn.004ca1a0
add esp, 4
xor eax, eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
jmp 0x4ca080
movzx ecx, word [eax + 0x526204]
mov word [ebp + eax - 0x14], cx
add eax, 2
test cx, cx
jne 0x4ca080
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov eax, 2
mov dword [ebp - 0x240], eax
add eax, 0x41
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x4ca171
mov eax, dword [0x5261d0]
mov ecx, dword [str..A:]
mov edx, dword [0x5261cc]
push 0
push 0x80
push 3
push 0
push 3
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], ecx
mov cx, word [0x5261d4]
mov dword [ebp - 0x20], edx
mov dx, word [ebp - 0x14]
push 0
lea eax, [ebp - 0x24]
push eax
or edi, 0xffffffff
mov word [ebp - 0x18], cx
mov word [ebp - 0x1c], dx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x4ca147
push 0
lea ecx, [ebp - 0x24c]
push ecx
push 0xc
lea edx, [ebp - 0x238]
push edx
push 0
push 0
push 0x2d1080
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4ca140
cmp dword [ebp - 0x24c], 0xc
jne 0x4ca140
mov edi, dword [ebp - 0x234]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
cmp edi, dword [ebp - 0x23c]
jne 0x4ca15e
mov ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x14]
push eax
push ecx
jmp 0x4ca169
mov eax, dword [ebp - 0x244]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.004e5d06
add esp, 0xc
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp eax, 0x1a
jl 0x4ca0a5
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e4746
mov esp, ebp
pop ebp
ret
Function at 0x4ca1a0
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [0x5261d0]
mov eax, dword [str..A:]
mov ecx, dword [0x5261cc]
push esi
push 0
push 0x80
push 3
push 0
push 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], eax
mov ax, word [0x5261d4]
mov dword [ebp - 0x10], ecx
mov cx, word [ebp + 8]
push 0
lea edx, [ebp - 0x14]
push edx
mov word [ebp - 8], ax
mov word [ebp - 0xc], cx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4ca22f
push 0
lea eax, [ebp - 0x24]
push eax
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0
push 0x2d1080
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4ca228
cmp dword [ebp - 0x24], 0xc
jne 0x4ca228
mov edx, dword [ebp - 0x1c]
mov dword [edi], edx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004e4746
mov esp, ebp
pop ebp
ret
Function at 0x4ca240
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcbc
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
push 0x1fe
mov ebx, ecx
lea edx, [ebp - 0x392]
xor ecx, ecx
push edi
push edx
mov dword [ebp - 0xcb8], eax
mov dword [ebp - 0xcbc], edi
mov word [ebp - 0x394], cx
call fcn.004e8ba0
push 0x18e
lea ecx, [ebp - 0x192]
xor eax, eax
push edi
push ecx
mov dword [ebp - 0xcb4], edi
mov word [ebp - 0x194], ax
call fcn.004e8ba0
push 0x11c
lea edx, [ebp - 0xcb0]
push edi
push edx
call fcn.004e8ba0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0x24
lea eax, [ebp - 0xcb0]
push eax
mov dword [ebp - 0xcb0], 0x11c
call esi
xor eax, eax
cmp dword [ebp - 0xcac], 6
jb 0x4ca300
mov edi, edi
movzx ecx, word [eax + str.SOFTWAREMICROSOFTWINDOWS_NTCURRENTVERSION]
mov word [ebp + eax - 0x194], cx
add eax, 2
cmp cx, di
jne 0x4ca2e0
jmp 0x4ca317
movzx ecx, word [eax + str.SOFTWAREMICROSOFTWINDOWSCURRENTVERSION]
mov word [ebp + eax - 0x194], cx
add eax, 2
cmp cx, di
jne 0x4ca300
call fcn.004bc0d0
test eax, eax
je 0x4ca336
lea ecx, [ebp - 0xcb4]
push ecx
push 0x101
push edi
lea edx, [ebp - 0x194]
push edx
jmp 0x4ca347
lea eax, [ebp - 0xcb4]
push eax
push 1
push edi
lea ecx, [ebp - 0x194]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x4ca38f
mov ecx, dword [ebp - 0xcb4]
lea edx, [ebp - 0xcbc]
push edx
lea eax, [ebp - 0x394]
push eax
push edi
push edi
push str.ProductId
push ecx
mov dword [ebp - 0xcbc], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0xcb4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x7fe
lea ecx, [ebp - 0xb92]
xor eax, eax
push edi
push ecx
mov word [ebp - 0xb94], ax
call fcn.004e8ba0
push 0x11c
lea edx, [ebp - 0xcb0]
push edi
push edx
call fcn.004e8ba0
add esp, 0x18
lea eax, [ebp - 0xcb0]
push eax
mov dword [ebp - 0xcb0], 0x11c
call esi
cmp dword [ebp - 0xcac], 0xa
jne 0x4ca404
cmp dword [ebp - 0xca8], edi
jne 0x4ca404
cmp byte [ebp - 0xb96], 1
jne 0x4ca404
push 0x56d988
push 0x56d808
push str._s_t_s_t_t_t_t_t_t_tO.S._t
lea ecx, [ebp - 0xb94]
push ecx
jmp 0x4ca41a
push 0x56d8c8
push 0x56d808
push str._s_t_s_t_t_t_t_t_t_tO.S._t
lea edx, [ebp - 0xb94]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [ebp - 0xcb8]
add esp, 0x10
push 0x259
lea edi, [ebp - 0xb94]
call fcn.004c2ef0
push ebx
mov ecx, esi
call fcn.004ca460
mov ecx, dword [ebp - 4]
add esp, 8
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e4746
mov esp, ebp
pop ebp
ret
Function at 0x4cc110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x88]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesWinMaster_Service
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x88], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4cc212
push esi
xor ecx, ecx
push 0x7e
push ecx
lea edx, [ebp - 0x82]
push edx
mov word [ebp - 0x84], cx
call fcn.004e8ba0
add esp, 0xc
lea eax, [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x84]
push ecx
lea edx, [ebp - 0x90]
push edx
push 0
push 0x526680
push eax
mov dword [ebp - 0x8c], 0x40
mov dword [ebp - 0x90], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x88]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x4cc212
mov edx, str.Asset
lea ecx, [ebp - 0x84]
jmp 0x4cc1d0
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4cc1f6
test ax, ax
je 0x4cc1f2
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x4cc1f6
add ecx, 4
add edx, 4
test ax, ax
jne 0x4cc1d0
xor eax, eax
jmp 0x4cc1fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4cc212
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e4746
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004e4746
mov esp, ebp
pop ebp
ret

Function at 0x4cc490
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x5682e0]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push ecx
call esi
test eax, eax
je 0x4cc4f0
mov eax, dword [0x5682e0]
mov edx, dword [eax]
mov dword [0x56dac8], edx
movzx ecx, byte [eax + 4]
mov edx, dword [0x56dad0]
mov byte [0x56dacc], cl
mov dword [eax], edx
movzx ecx, byte [0x56dad4]
lea edx, [ebp - 4]
push edx
mov byte [eax + 4], cl
mov ecx, dword [ebp - 4]
push ecx
push 5
push eax
call esi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4cc500
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x5682e0]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push ecx
call esi
test eax, eax
mov eax, dword [0x5682e0]
je 0x4cc548
mov edx, dword [0x56dac8]
mov dword [eax], edx
mov cl, byte [0x56dacc]
lea edx, [ebp - 4]
push edx
mov byte [eax + 4], cl
mov ecx, dword [ebp - 4]
push ecx
push 5
push eax
call esi
mov eax, dword [0x5682e0]
xor edx, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4cd490
Capabilities:
Create thread

Disassembly:
push 0x5682e4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, 0x56da88
mov eax, dword [ecx]
test eax, eax
je 0x4cd4b8
cmp word [eax + 0x42c], bx
jne 0x4cd4b8
cmp dword [eax + 0x428], 0
jne 0x4cd4f8
add ecx, 4
cmp ecx, 0x56dac8
jl 0x4cd4a0
push esi
xor esi, esi
cmp dword [esi*4 + 0x56da88], 0
je 0x4cd506
cmp dword [esi*4 + 0x56da8c], 0
je 0x4cd4fb
cmp dword [esi*4 + 0x56da90], 0
je 0x4cd4fe
cmp dword [esi*4 + 0x56da94], 0
je 0x4cd503
add esi, 4
cmp esi, 0x10
jl 0x4cd4c6
jmp 0x4cd506
xor eax, eax
ret
inc esi
jmp 0x4cd506
add esi, 2
jmp 0x4cd506
add esi, 3
cmp esi, 0x10
jne 0x4cd512
mov eax, 0x100
pop esi
ret
push edi
push 0x478
call fcn.004e5379
mov edi, eax
add esp, 4
test edi, edi
je 0x4cd53a
push 0x478
push 0
push edi
call fcn.004e8ba0
add esp, 0xc
mov eax, edi
jmp 0x4cd53c
xor eax, eax
push 0x478
push 0
push eax
mov dword [esi*4 + 0x56da88], eax
call fcn.004e8ba0
mov eax, dword [esi*4 + 0x56da88]
mov word [eax + 0x42c], bx
mov ecx, dword [esi*4 + 0x56da88]
mov edx, dword [0x565f28]
add esp, 0xc
mov dword [ecx + 0x46c], edx
push 0x5682e4
mov dword [0x565f2c], 0x4cd410
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi*4 + 0x56da88]
add eax, 0x470
push eax
push 1
push esi
push 0x4cd150
push 0
push 0
call fcn.004e564c
add esp, 0x18
pop edi
xor eax, eax
pop esi
ret
Function at 0x4cdfd0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x21a]
push ecx
mov word [ebp - 0x21c], ax
call fcn.004e8ba0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x21c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call fcn.004e56ec
add esp, 8
test eax, eax
je 0x4ce040
lea ecx, [ebp - 0x21c]
push 0x5c
push ecx
call fcn.004e56ec
add esp, 8
xor edx, edx
mov word [eax], dx
push esi
push edi
lea edi, [ebp - 0x21c]
add edi, 0xfffffffe
jmp 0x4ce050
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4ce050
mov ecx, 7
mov esi, 0x521318
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x21c]
push ecx
push 8
lea edx, [ebp - 0x14]
push edx
xor eax, eax
push 0x51c514
push str.AssetWait
push str.MultiIni
mov word [ebp - 0x14], ax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x4ce0bd
lea eax, [ebp - 0x14]
push eax
call fcn.004e517a
lea ecx, [eax - 1]
add esp, 4
cmp ecx, 0x12b
ja 0x4ce0bd
mov dword [0x55665c], eax
push 0x400
push 0x5682e4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push str.Ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x568318], eax
test eax, eax
je 0x4ce107
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.inet_pton
push eax
call esi
mov edx, dword [0x568318]
push str.inet_ntop
push edx
mov dword [0x5682fc], eax
call esi
mov dword [0x5682dc], eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
mov dword [0x565cb4], 0x4cd5b0
pop esi
call fcn.004e4746
mov esp, ebp
pop ebp
ret
Function at 0x4cf6a0
Capabilities:
Create process on windows
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push str._delete_pnp_
push str.Driver
xor edx, edx
xor ecx, ecx
call fcn.004a3520
xor eax, eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 0x24], 0
call fcn.004cffc0
add esp, 0x10
test eax, eax
je 0x4cf866
push ebx
push esi
push edi
push 0x103
lea ecx, [ebp - 0x127]
push 0
push ecx
mov byte [ebp - 0x128], 0
call fcn.004e8ba0
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x128]
push str.pnputil.exe__d__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, eax
xor esi, esi
lea ecx, [ecx]
lea edx, [ebp - 0x24]
push edx
call fcn.004cffc0
add esp, 4
test eax, eax
je 0x4cf796
push 0
push str._retry_delete_pnp_
push str.Driver
xor edx, edx
xor ecx, ecx
call fcn.004a3520
add esp, 0xc
push 0x7d0
call ebx
push 0
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
inc esi
mov edi, eax
cmp esi, 0x5a
jl 0x4cf750
cmp edi, 0x1f
ja 0x4cf7c6
push 0
push str._delete_pnp_fail_
push str.Driver
xor edx, edx
xor ecx, ecx
call fcn.004a3520
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e4746
mov esp, ebp
pop ebp
ret
push 0x3e8
call ebx
push 0xff
lea ecx, [ebp - 0x227]
push 0
push ecx
call fcn.004e8ba0
mov ecx, 9
mov esi, str.SYSTEMCurrentControlSetServicesSmrf
lea edi, [ebp - 0x228]
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
lea edx, [ebp - 0x22c]
push edx
push 0xf003f
push 0
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x228]
push eax
push reloc.WS2_32.dll_bind
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4cf82e
mov ecx, dword [ebp - 0x22c]
push str.PublicName
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str._delete_pnp_success_
push str.Driver
xor edx, edx
xor ecx, ecx
call fcn.004a3520
add esp, 0xc
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e4746
mov esp, ebp
pop ebp
ret
push 0
push str._cant_find_publicName_
push str.Driver
xor edx, edx
xor ecx, ecx
call fcn.004a3520
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0xc
mov al, 1
call fcn.004e4746
mov esp, ebp
pop ebp
ret
Function at 0x4cffc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x13c], eax
xor eax, eax
push edi
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x33], eax
mov dword [ebp - 0x2f], eax
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov byte [ebp - 0x14], al
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
xor edi, edi
push 0x104
lea ecx, [ebp - 0x138]
push 0
push ecx
call fcn.004e8ba0
push edi
lea edx, [ebp - 0x138]
push str.C:Windowsinfoem_i.inf
push edx
call ebx
xor eax, eax
add esp, 0x18
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x138]
push eax
push 0x20
lea ecx, [ebp - 0x34]
push ecx
push 0x51862c
push 0x54d458
push str.Strings
call esi
test eax, eax
je 0x4d00f0
lea edx, [ebp - 0x34]
push str.SunMoon_Rise
push edx
call fcn.004f7095
add esp, 8
test eax, eax
jne 0x4d00f0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x138]
push eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push 0x51862c
push str.DriverName
push str.Strings
call esi
test eax, eax
je 0x4d00f0
lea edx, [ebp - 0x14]
push str.Smrf
push edx
call fcn.004f7095
add esp, 8
test eax, eax
jne 0x4d00f0
lea eax, [ebp - 0x138]
push 0x5c
push eax
call fcn.004e7790
add esp, 8
test eax, eax
jne 0x4d0110
inc edi
cmp edi, 0x3e7
jl 0x4d0022
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e4746
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x13c]
push 0xc
inc eax
push eax
push ecx
call fcn.004e5040
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004e4746
mov esp, ebp
pop ebp
ret
Function at 0x4d0840
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe7b2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5552b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [edi], 0x54d530
mov dword [edi + 0x10], 0x54d538
mov dword [edi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 0x18]
push esi
mov dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x10], 1
call fcn.004d1c30
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + 4]
mov dword [edi + ecx + 0x10], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov dword [edi + eax], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 4
mov ecx, dword [edi]
mov edx, dword [ecx + 4]
push esi
mov dword [edi + edx], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
call fcn.004d1cd0
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], bl
mov byte [esi + 0x49], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x570394]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4d0af0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe428
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x4d0b2c
xor eax, eax
jmp 0x4d0cb1
mov eax, dword [edi + 0x24]
mov ecx, dword [eax]
test ecx, ecx
je 0x4d0b55
mov eax, dword [edi + 0x34]
mov edx, dword [eax]
add edx, ecx
cmp ecx, edx
jae 0x4d0b55
dec dword [eax]
mov edi, dword [edi + 0x24]
mov eax, dword [edi]
lea ecx, [eax + 1]
mov dword [edi], ecx
mov byte [eax], bl
mov eax, ebx
jmp 0x4d0cb1
cmp dword [edi + 0x54], 0
je 0x4d0cae
mov ecx, dword [edi + 0x10]
lea edx, [edi + 0x48]
cmp dword [ecx], edx
jne 0x4d0b7d
mov edx, dword [edi + 0x3c]
mov eax, dword [edi + 0x40]
mov dword [ecx], edx
mov ecx, dword [edi + 0x20]
mov dword [ecx], eax
mov edx, dword [edi + 0x30]
sub eax, eax
mov dword [edx], eax
cmp dword [edi + 0x44], 0
jne 0x4d0ba3
mov edi, dword [edi + 0x54]
movsx eax, bl
push edi
push eax
call fcn.004e6e08
add esp, 8
cmp eax, 0xffffffff
je 0x4d0cae
mov eax, ebx
jmp 0x4d0cb1
lea esi, [ebp - 0x2c]
mov byte [ebp - 0x2d], bl
call fcn.004d14e0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
jmp 0x4d0bc0
mov edx, eax
cmp ebx, 0x10
jae 0x4d0bcc
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x34]
push ebx
push edx
push eax
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x2d]
push edx
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x14]
call eax
test eax, eax
js 0x4d0ca6
cmp eax, 1
jg 0x4d0c60
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x4d0c0c
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x34]
sub esi, ecx
je 0x4d0c35
cmp ebx, 0x10
jae 0x4d0c1b
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.004e59b1
add esp, 0x10
cmp esi, eax
jne 0x4d0ca6
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x2d]
mov byte [edi + 0x49], 1
cmp dword [ebp - 0x38], edx
jne 0x4d0c99
test esi, esi
jne 0x4d0bc0
cmp dword [ebp - 0x1c], 0x20
jae 0x4d0ca6
push esi
lea ebx, [esi + 8]
lea esi, [ebp - 0x2c]
call fcn.004d1540
jmp 0x4d0bb5
cmp eax, 3
jne 0x4d0ca6
mov edi, dword [edi + 0x54]
movsx eax, byte [ebp - 0x2d]
push edi
push eax
call fcn.004e6e08
add esp, 8
cmp eax, 0xffffffff
je 0x4d0c8a
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
call fcn.004d02f0
mov eax, esi
jmp 0x4d0cb1
lea ecx, [ebp - 0x2c]
or esi, 0xffffffff
call fcn.004d02f0
mov eax, esi
jmp 0x4d0cb1
lea ecx, [ebp - 0x2c]
call fcn.004d02f0
mov eax, dword [ebp + 8]
jmp 0x4d0cb1
lea ecx, [ebp - 0x2c]
call fcn.004d02f0
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e4746
mov esp, ebp
pop ebp
ret 4