joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b975
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
lea eax, [ebp - 0x200]
push ebx
push esi
push edi
push eax
xor ebx, ebx
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [ebp - 0x200]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x49b99e
push 6
pop ecx
push ebx
lea eax, [ebp - 0x200]
mov esi, str.Aeroadmin_
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebp - 0x200]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x49b9cb
push 6
pop ecx
mov esi, 0x55a534
lea eax, [ebp - 0x200]
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, 0x5dea44
movsw word es:[edi], word [esi]
call fcn.0043c2b9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49b9fb
Capabilities:
Set registry value

Disassembly:
sub esp, 0x1c
lea eax, [esp + 0xc]
push ebx
push ebp
push esi
push edi
mov edi, ecx
push eax
push dword [edi + 0x10]
mov dword [edi], 0x55a4ec
call dword [sym.imp.USER32.dll_GetWindowRect]
xor ebx, ebx
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x5584a8
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 4
pop ebp
test eax, eax
jne 0x49ba9a
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
shl ecx, 0x10
movzx eax, dx
or ecx, eax
mov eax, dword [esp + 0x24]
sub eax, edx
mov dword [esp + 0x14], ecx
movzx ecx, ax
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
shl eax, 0x10
push ebp
or ecx, eax
lea eax, [esp + 0x18]
push eax
push ebp
push ebx
push str.contactsWindowPos
push dword [esp + 0x24]
mov dword [esp + 0x30], ecx
call esi
push ebp
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
push str.contactsWindowSize
push dword [esp + 0x24]
call esi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [edi + 0x27fc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [edi + 0x2800]
mov dword [0x5f1fe8], ebx
test eax, eax
je 0x49bafe
push dword [edi + 0x2804]
push eax
call fcn.0049fd37
mov ecx, dword [edi + 0x2800]
mov eax, dword [edi + 0x2808]
push ebp
push 0x3c
sub eax, ecx
pop esi
cdq
idiv esi
push esi
push eax
push ecx
call fcn.0043467a
add esp, 0x10
mov dword [edi + 0x2800], ebx
mov dword [edi + 0x2804], ebx
mov dword [edi + 0x2808], ebx
mov ecx, dword [edi + 0xac]
test ecx, ecx
je 0x49bb31
mov eax, dword [edi + 0xb4]
push ebp
sub eax, ecx
push ebp
sar eax, 2
push eax
push ecx
call fcn.0043467a
add esp, 0x10
mov dword [edi + 0xac], ebx
mov dword [edi + 0xb0], ebx
mov dword [edi + 0xb4], ebx
mov ecx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
jmp fcn.004e2558
Function at 0x49bb3f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x5584a8
push reloc.WS2_32.dll_accept
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x49bba5
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
push 0x102
cmovae eax, dword [ebp + 0xc]
inc ebx
push eax
push ebx
push 0
push str.contactsPathToFile
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp + 0xc]
mov ecx, 0x5dea5c
push eax
call fcn.0043a3bc
mov ecx, esi
call fcn.0049b8f2
jmp 0x49bbb7
push ebx
push str.AeroAdmin
push str.Cant_set_new_path_to_registry
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp + 0xc]
call fcn.0043c274
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x49bbc9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x5584a8
push reloc.WS2_32.dll_accept
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x49bc39
cmp dword [0x5dea58], 8
push edi
push 0x102
mov edi, 0x5dea44
mov eax, edi
cmovae eax, dword [0x5dea44]
push eax
push 1
push ebx
push str.contactsPathToFile
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov ecx, 0x5dea5c
call fcn.0043a3bc
mov ecx, esi
call fcn.0049b8f2
xor al, al
pop edi
jmp 0x49bc4d
push ebx
push str.AeroAdmin
push str.Cant_set_default_path_to_registry
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a1148
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
push ebx
push esi
push edi
lea eax, [ebp - 0x104]
mov esi, edx
push eax
mov edi, ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 0
and esi, 0xffff0000
lea eax, [ebp - 4]
push eax
neg esi
lea eax, [ebp - 0x104]
push eax
sbb esi, esi
neg esi
push esi
push edi
call dword [sym.imp.USER32.dll_ToAscii]
movsx ecx, byte [ebp - 4]
xor ebx, ebx
test ecx, ecx
mov esi, eax
lea eax, [ebp - 0x1cc]
cmovns ebx, ecx
push ebx
push str.return_value___d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
xor eax, eax
cmp esi, 1
cmovne ebx, eax
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a8dcd
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
xor edx, edx
inc edx
call fcn.004a69d8
test al, al
je 0x4a8e28
xor edx, edx
mov ecx, edi
inc edx
call fcn.004a69d8
test al, al
je 0x4a8e28
mov ecx, dword [esp + 0xc]
mov edx, ecx
push ebp
shr edx, 2
xor ebp, ebp
test edx, edx
je 0x4a8e18
mov ecx, edi
mov ebp, edx
push ebx
mov ebx, esi
sub ecx, esi
mov eax, dword [ecx + ebx]
xor dword [ebx], eax
lea ebx, [ebx + 4]
sub edx, 1
jne 0x4a8e06
mov ecx, dword [esp + 0x14]
pop ebx
mov eax, ebp
shl eax, 2
pop ebp
sub ecx, eax
je 0x4a8e3d
add esi, eax
add edi, eax
jmp 0x4a8e2c
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4a8e3d
sub edi, esi
mov al, byte [esi + edi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x4a8e32
pop edi
pop esi
ret

Function at 0x4a8e40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
xor edx, edx
mov dword [esp + 0x10], edi
inc edx
call fcn.004a69d8
test al, al
je 0x4a8ec7
xor edx, edx
mov ecx, edi
inc edx
call fcn.004a69d8
test al, al
je 0x4a8ec7
mov esi, dword [esp + 0x1c]
xor edx, edx
inc edx
mov ecx, esi
call fcn.004a69d8
mov ecx, dword [esp + 0x20]
test al, al
je 0x4a8ecf
mov edx, ecx
xor eax, eax
shr edx, 2
test edx, edx
je 0x4a8eb8
mov ecx, edi
mov dword [esp + 0x14], edx
mov eax, ebx
sub ecx, esi
sub eax, esi
push ebp
mov ebp, esi
mov edi, eax
mov eax, dword [ecx + ebp]
xor eax, dword [ebp]
mov dword [edi + ebp], eax
lea ebp, [ebp + 4]
sub edx, 1
jne 0x4a8e9a
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
pop ebp
shl eax, 2
sub ecx, eax
je 0x4a8ee5
add ebx, eax
add edi, eax
add esi, eax
jmp 0x4a8ecf
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
test ecx, ecx
je 0x4a8ee5
sub edi, esi
sub ebx, esi
mov al, byte [esi + edi]
xor al, byte [esi]
mov byte [esi + ebx], al
inc esi
sub ecx, 1
jne 0x4a8ed7
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x4a8eec
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
mov esi, edx
xor ebx, ebx
xor edx, edx
push edi
inc edx
mov edi, ecx
call fcn.004a69d8
test al, al
je 0x4a8f69
xor edx, edx
mov ecx, esi
inc edx
call fcn.004a69d8
test al, al
je 0x4a8f69
mov edx, dword [esp + 0x14]
mov eax, ebx
mov ecx, edx
shr ecx, 2
test ecx, ecx
je 0x4a8f43
mov edx, edi
mov dword [esp + 0xc], ecx
push ebp
mov ebp, esi
sub edx, esi
mov eax, dword [edx + ebp]
xor eax, dword [ebp]
lea ebp, [ebp + 4]
or ebx, eax
sub ecx, 1
jne 0x4a8f2a
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
pop ebp
shl eax, 2
sub edx, eax
jne 0x4a8f4e
test ebx, ebx
jmp 0x4a8f82
add edi, eax
add esi, eax
mov ecx, ebx
mov eax, ebx
shr eax, 0x10
shr ecx, 0x18
or cl, al
mov eax, ebx
shr eax, 8
or cl, al
or bl, cl
jmp 0x4a8f6d
mov edx, dword [esp + 0x14]
test edx, edx
je 0x4a8f80
sub edi, esi
mov al, byte [esi + edi]
xor al, byte [esi]
or bl, al
inc esi
sub edx, 1
jne 0x4a8f73
test bl, bl
pop edi
pop esi
sete al
pop ebx
pop ecx
ret
Function at 0x4a8ff6
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ebx
movzx edx, byte [edi + str.cw]
mov ecx, edx
mov eax, edx
shr ecx, 7
imul esi, ecx, 0x1b000000
shl eax, 0x19
imul ecx, ecx, 0x11b
xor esi, eax
mov eax, edx
shl eax, 8
or eax, edx
shl eax, 8
or esi, eax
lea eax, [edx + edx]
xor ecx, eax
xor eax, eax
xor ecx, edx
or eax, esi
or ecx, esi
mov dword [edi*8 + 0x5fe200], eax
or ecx, ebx
mov dword [edi*8 + 0x5fe204], ecx
inc edi
cmp edi, 0x100
jl 0x4a8ffd
pop edi
mov dword [0x5fea08], ebx
mov dword [0x5fea0c], ebx
mov dword [0x5fea00], ebx
mov dword [0x5fea04], ebx
pop esi
mov byte [0x5f1fd6], 1
pop ebx
ret

Function at 0x4a9071
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor edx, edx
push esi
mov dword [esp + 0x18], edx
push edi
movzx edi, byte [edx + 0x552da0]
mov dword [esp + 0x10], edi
mov eax, edi
shr eax, 5
mov esi, edi
mov edx, eax
shr esi, 6
mov ebx, eax
lea ecx, [edi + edi]
xor ecx, edi
and eax, 1
mov dword [esp + 0x14], eax
and ebx, 2
shr edi, 7
and edx, 4
imul eax, edi, 0x1b000000
lea ebp, [ecx + ecx]
mov dword [esp + 0x18], edx
xor ebp, dword [esp + 0x10]
mov edx, esi
shl ebp, 0x19
and esi, 1
shl ecx, 2
and edx, 2
xor ebp, eax
xor ecx, dword [esp + 0x10]
imul eax, dword [esp + 0x14], 0x1b000000
shl ecx, 8
xor ebp, eax
imul eax, ebx, 0x1b000000
xor ebp, eax
imul eax, esi, 0x1b000000
xor ebp, eax
imul eax, edx, 0x1b000000
xor ebp, eax
imul eax, dword [esp + 0x18], 0x1b000000
xor ebp, eax
imul eax, dword [esp + 0x14], 0x11b00
xor ecx, eax
imul eax, ebx, 0x11b00
xor ecx, eax
imul eax, esi, 0x11b00
mov esi, dword [esp + 0x18]
xor ecx, eax
imul eax, edx, 0x11b00
mov edx, dword [esp + 0x10]
xor ecx, eax
imul eax, esi, 0x11b00
xor ecx, eax
imul eax, dword [esp + 0x14], 0x11b0000
or ebp, ecx
mov ecx, dword [esp + 0x10]
shl ecx, 3
xor ecx, dword [esp + 0x10]
shl ecx, 0x10
xor ecx, eax
imul eax, ebx, 0x11b0000
xor ecx, eax
imul eax, esi, 0x11b0000
xor ecx, eax
imul eax, edi, 0x11b
or ebp, ecx
mov ecx, dword [esp + 0x10]
shl ecx, 2
xor ecx, dword [esp + 0x10]
add ecx, ecx
xor ecx, eax
imul eax, dword [esp + 0x14], 0x11b
xor ecx, eax
imul eax, ebx, 0x11b
xor ecx, eax
imul eax, esi, 0x11b
xor ecx, eax
xor eax, eax
xor ecx, edx
or edx, ebp
or ecx, ebp
or eax, edx
mov edx, dword [esp + 0x1c]
mov dword [edx*8 + 0x600a50], eax
mov dword [edx*8 + 0x600a54], ecx
inc edx
mov dword [esp + 0x1c], edx
cmp edx, 0x100
jl 0x4a907e
pop edi
pop esi
pop ebp
mov byte [0x5f1fd7], 1
pop ebx
add esp, 0x10
ret
Function at 0x4aa78d
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
movups xmm0, xmmword [eax]
lea edx, [ecx - 1]
push edi
pxor xmm0, xmmword [esi]
movups xmmword [eax], xmm0
cmp edx, 1
jbe 0x4aa7d2
add edx, 0xfffffffe
lea edi, [esi + 0x10]
shr edx, 1
inc edx
aesenc xmm0, xmmword [edi]
movups xmmword [eax], xmm0
lea edi, [edi + 0x20]
aesenc xmm0, xmmword [edi - 0x10]
movups xmmword [eax], xmm0
sub edx, 1
jne 0x4aa7b9
add ecx, ecx
pop edi
aesenc xmm0, xmmword [esi + ecx*8 - 0x10]
movups xmmword [eax], xmm0
aesenclast xmm0, xmmword [esi + ecx*8]
movups xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4aa7ed
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push esi
movups xmm1, xmmword [eax]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x1c]
movups xmm0, xmmword [eax]
pxor xmm0, xmm1
movups xmmword [eax], xmm0
movups xmm0, xmmword [ecx]
pxor xmm0, xmm1
movups xmmword [ecx], xmm0
movups xmm0, xmmword [edx]
pxor xmm0, xmm1
movups xmmword [edx], xmm0
movups xmm0, xmmword [esi]
pxor xmm0, xmm1
movups xmmword [esi], xmm0
cmp edi, 1
jbe 0x4aa88d
mov eax, dword [ebp + 0x18]
add eax, 0x10
mov dword [esp + 0xc], eax
lea eax, [edi - 1]
mov edi, dword [esp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
sub dword [esp + 8], 1
movups xmm1, xmmword [edi]
lea edi, [edi + 0x10]
movups xmm0, xmmword [eax]
aesenc xmm0, xmm1
movups xmmword [eax], xmm0
movups xmm0, xmmword [ecx]
aesenc xmm0, xmm1
movups xmmword [ecx], xmm0
movups xmm0, xmmword [edx]
aesenc xmm0, xmm1
movups xmmword [edx], xmm0
movups xmm0, xmmword [esi]
aesenc xmm0, xmm1
movups xmmword [esi], xmm0
jne 0x4aa851
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x18]
add edi, edi
movups xmm0, xmmword [eax]
movups xmm1, xmmword [esi + edi*8]
mov esi, dword [ebp + 0x14]
aesenclast xmm0, xmm1
movups xmmword [eax], xmm0
movups xmm0, xmmword [ecx]
aesenclast xmm0, xmm1
movups xmmword [ecx], xmm0
movups xmm0, xmmword [edx]
aesenclast xmm0, xmm1
movups xmmword [edx], xmm0
movups xmm0, xmmword [esi]
aesenclast xmm0, xmm1
pop edi
movups xmmword [esi], xmm0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b91d0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
and dword [esp + 8], 0
lea eax, [esp + 0x14]
and dword [esp + 0xc], 0
push esi
push 0x10
pop esi
push 1
push 0
push ecx
push ecx
push dword [ebp + 0xc]
mov dword [esp + 0x78], eax
lea eax, [esp + 0x7c]
push dword [ebp + 8]
mov dword [esp + 0x78], esi
push edx
mov edx, ecx
mov byte [esp + 0x75], 1
lea ecx, [esp + 0x24]
mov dword [esp + 0xcc], esi
mov byte [esp + 0xc5], 1
mov dword [esp + 0xd0], eax
mov dword [esp + 0x84], 0x67452301
mov dword [esp + 0x88], 0xefcdab89
mov dword [esp + 0x8c], 0x98badcfe
mov dword [esp + 0x90], 0x10325476
mov dword [esp + 0x94], 0xc3d2e1f0
mov dword [esp + 0x24], 0x55743c
call fcn.004ba71f
add esp, 0x1c
lea ecx, [esp + 8]
call fcn.00472776
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4bda07
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc0
push esi
push edi
mov edx, ecx
mov dword [esp + 0xc], edx
and dword [esp + 0x14], 0
lea eax, [esp + 0x20]
and dword [esp + 0x18], 0
push 0x10
mov dword [esp + 0x70], eax
lea edi, [esp + 0x74]
pop ecx
lea eax, [esp + 0x70]
mov dword [esp + 0x68], ecx
neg eax
mov dword [esp + 0xc0], ecx
push 8
and eax, 0xf
mov byte [esp + 0x65], 1
pop ecx
add edi, eax
mov byte [esp + 0xb9], 1
mov dword [esp + 0xc4], edi
mov esi, 0x55c2b4
rep movsd dword es:[edi], dword [esi]
push 0x20
push dword [edx + 0x34]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x55b4c4
call fcn.004c0bbd
push dword [ebp + 0xc]
lea ecx, [esp + 0x14]
push dword [ebp + 8]
call fcn.004c0bbd
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov edi, dword [esp + 0x10]
mov esi, dword [esi + 0x34]
call dword [edi + 0x1c]
push eax
push esi
lea ecx, [esp + 0x18]
call dword [edi + 0x38]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov byte [eax + 0x5c], 0
call fcn.004a73e1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4c64b0
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x37c4
call fcn.004ee940
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, edi
mov ebx, edi
push ebx
lea eax, [esp + 0x24]
push str..PhysicalDrive_d
push eax
call fcn.004c607a
add esp, 0xc
lea eax, [esp + 0x20]
push edi
push edi
push 0xffffffffffffffff
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004edb63
pop ecx
push edi
mov esi, eax
lea eax, [esp + 0x24]
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
mov word [esi + edi*2], ax
xor edi, edi
push edi
push edi
push 3
push edi
push 3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4c66ae
mov dword [esp + 0x10], edi
xor eax, eax
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
push 0x2710
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x10c4]
xor edi, edi
push edi
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call fcn.005055e0
add esp, 0xc
lea eax, [esp + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push eax
push 0x2710
lea eax, [esp + 0x10cc]
push eax
push 0xc
lea eax, [esp + 0x28]
push eax
push 0x2d1400
push esi
call edi
test eax, eax
je 0x4c669f
mov edx, dword [esp + 0x10cc]
lea eax, [esp + 0x8f0]
push eax
push 0
lea ecx, [esp + 0x10c8]
call fcn.004c636d
mov edx, dword [esp + 0x10d8]
lea eax, [esp + 0x510]
push eax
push 0
lea ecx, [esp + 0x10d0]
call fcn.004c636d
mov edx, dword [esp + 0x10e4]
lea eax, [esp + 0xce8]
push eax
push 0
lea ecx, [esp + 0x10d8]
call fcn.004c636d
mov edx, dword [esp + 0x10f0]
lea eax, [esp + 0x138]
push eax
push 1
lea ecx, [esp + 0x10e0]
call fcn.004c636d
add esp, 0x20
cmp byte [0x5fea20], 0
jne 0x4c6667
movsx eax, byte [esp + 0x120]
push eax
call fcn.00519ab6
pop ecx
test eax, eax
jne 0x4c663c
movsx eax, byte [esp + 0x133]
push eax
call fcn.00519ab6
pop ecx
test eax, eax
je 0x4c6667
xor ecx, ecx
mov al, byte [esp + ecx + 0x120]
mov byte [ecx + 0x5fea20], al
inc ecx
test al, al
jne 0x4c663e
xor ecx, ecx
mov al, byte [esp + ecx + 0x508]
mov byte [ecx + 0x5fee20], al
inc ecx
test al, al
jne 0x4c6652
xor ebp, ebp
inc ebp
push 0x2710
lea eax, [esp + 0x10c4]
push 0
push eax
call fcn.005055e0
add esp, 0xc
lea eax, [esp + 0x10]
xor ecx, ecx
push ecx
push eax
push 0x2710
lea eax, [esp + 0x10cc]
push eax
push ecx
push ecx
push 0x700a0
push esi
call edi
jmp 0x4c66a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
inc ebx
cmp ebx, 6
jl 0x4c64c4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x37c4
ret
Function at 0x4c69fa
Capabilities:
Check os version

Disassembly:
sub esp, 0x11c
push ebx
push ebp
push esi
push edi
mov esi, 0x114
lea eax, [esp + 0x14]
xor ebx, ebx
mov edi, ecx
push esi
push ebx
push eax
mov byte [0x5fea20], bl
call fcn.005055e0
add esp, 0xc
mov dword [esp + 0x14], esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x24], 2
mov ebp, 0x5fea20
jne 0x4c6aaf
call fcn.004c64b0
mov ebx, eax
test ebx, ebx
je 0x4c6a60
mov ecx, ebp
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c6a4d
sub ecx, edx
cmp ecx, 8
jb 0x4c6a60
cmp ecx, 0x14
jbe 0x4c6a67
call fcn.004c6735
mov ebx, eax
test ebx, ebx
je 0x4c6a83
mov ecx, ebp
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c6a70
sub ecx, edx
cmp ecx, 8
jb 0x4c6a83
cmp ecx, 0x14
jbe 0x4c6a8a
call fcn.004c6094
mov ebx, eax
test ebx, ebx
je 0x4c6aa6
mov ecx, ebp
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c6a93
sub ecx, edx
cmp ecx, 8
jb 0x4c6aa6
cmp ecx, 0x14
jbe 0x4c6aca
call fcn.004c6229
mov ebx, eax
jmp 0x4c6aca
mov esi, ebx
test ebx, ebx
jne 0x4c6aca
cmp byte [0x5fea20], bl
jne 0x4c6ad1
call fcn.004c66c5
inc esi
mov ebx, eax
cmp esi, 0xa
jl 0x4c6ab1
cmp byte [0x5fea20], 0
jle 0x4c6af7
push 4
push str.WD_W
push ebp
call fcn.0051c930
add esp, 0xc
mov ecx, 0x5fea25
test eax, eax
cmovne ecx, ebp
cmp byte [ecx], 0
je 0x4c6af7
add ecx, 1
jne 0x4c6aed
push str.IBM_
mov esi, 0x5fee20
push esi
call fcn.00507790
pop ecx
pop ecx
test eax, eax
jne 0x4c6b3c
push str.MAXTOR
push esi
call fcn.00507790
pop ecx
pop ecx
test eax, eax
jne 0x4c6b3c
push str.Maxtor
push esi
call fcn.00507790
pop ecx
pop ecx
test eax, eax
jne 0x4c6b3c
push str.WDC
push esi
call fcn.00507790
pop ecx
pop ecx
test ebx, ebx
je 0x4c6b5b
mov ecx, ebp
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c6b45
sub ecx, edx
cmp ecx, 8
jb 0x4c6b5b
cmp ecx, 0x14
ja 0x4c6b5b
push ebp
jmp 0x4c6b60
push 0x54ddd9
mov ecx, edi
call fcn.0043a56f
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret
Function at 0x4c7e10
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
mov eax, 0x2f14
call fcn.004ee940
push ebp
lea eax, [esp + 0x14]
mov dword [esp + 4], 0x8080808
push eax
push dword [esp + 8]
mov ebp, ecx
mov dword [esp + 0x10], ebp
call dword [sym.imp.IPHLPAPI.DLL_GetBestInterface]
test eax, eax
je 0x4c7e43
xor al, al
jmp 0x4c7f18
lea eax, [esp + 4]
mov dword [esp + 4], 0x2f00
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0xd
push 2
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
test eax, eax
jne 0x4c7e3c
push ebx
xor edx, edx
push esi
push edi
mov ebx, edx
mov dword [esp + 0x18], edx
mov edi, edx
mov word [esp + 0x1c], dx
lea esi, [esp + 0x24]
cmp dword [esi + 0x44], 1
jne 0x4c7ecc
mov eax, dword [esp + 0x20]
cmp dword [esi + 4], eax
jne 0x4c7ea7
test ebp, ebp
je 0x4c7ea2
mov ecx, edx
cmp dword [esi + 0x34], edx
jbe 0x4c7ea2
mov al, byte [esi + ecx + 0x2c]
mov byte [ecx + ebp], al
inc ecx
cmp ecx, dword [esi + 0x34]
jb 0x4c7e95
mov ebx, dword [esi + 0x34]
jmp 0x4c7ecc
mov ebp, dword [esi + 0x34]
cmp ebp, edi
jbe 0x4c7ec8
test ebp, ebp
je 0x4c7ec6
lea eax, [esi + 0x2c]
push ebp
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00505060
add esp, 0xc
xor edx, edx
mov edi, ebp
mov ebp, dword [esp + 0x14]
mov esi, dword [esi + 8]
test esi, esi
jne 0x4c7e7b
test ebp, ebp
je 0x4c7f0d
cmp edi, ebx
jbe 0x4c7f0d
mov ebx, edi
mov ecx, edx
push 6
pop esi
test edi, edi
je 0x4c7efd
push edi
lea eax, [esp + 0x1c]
push eax
push ebp
call fcn.00505060
add esp, 0xc
mov ecx, edi
cmp edi, esi
jae 0x4c7f0d
xor edx, edx
sub esi, ecx
lea eax, [ecx + ebp]
push esi
push edx
push eax
call fcn.005055e0
add esp, 0xc
lea eax, [edi + ebx]
pop edi
test eax, eax
pop esi
setne al
pop ebx
pop ebp
add esp, 0x2f14
ret
Function at 0x4c88d0
Capabilities:
Identify system language via api

Disassembly:
push esi
push edi
mov edi, 0x54e730
mov esi, ecx
push edi
call fcn.0043a56f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov ecx, 0x412
cmp eax, ecx
ja 0x4c89ab
je 0x4c89a2
add ecx, 0xfffffff8
cmp eax, ecx
ja 0x4c8957
je 0x4c894b
sub eax, 0
je 0x4c8943
sub eax, 0x401
je 0x4c8937
sub eax, 4
je 0x4c892b
dec eax
sub eax, 1
jne 0x4c8a2e
push 2
push 0x558a9c
jmp 0x4c8a27
push 2
push 0x558ae8
jmp 0x4c8a27
push 2
push 0x558b00
jmp 0x4c8a27
push 2
push edi
jmp 0x4c8a27
push 2
push 0x558acc
jmp 0x4c8a27
sub eax, 0x40b
je 0x4c8996
dec eax
sub eax, 1
je 0x4c898a
sub eax, 3
je 0x4c897e
sub eax, 1
jne 0x4c8a2e
push 2
push 0x558af8
jmp 0x4c8a27
push 2
push 0x558ad4
jmp 0x4c8a27
push 2
push 0x558af0
jmp 0x4c8a27
push 2
push 0x558ae0
jmp 0x4c8a27
push 2
push 0x558b04
jmp 0x4c8a27
mov ecx, 0x419
cmp eax, ecx
ja 0x4c89f9
je 0x4c89f0
sub eax, 0x413
je 0x4c89e7
sub eax, 1
je 0x4c89de
sub eax, 1
je 0x4c89d5
sub eax, 1
jne 0x4c8a2e
push 2
push 0x558ae4
jmp 0x4c8a27
push 2
push 0x558ad8
jmp 0x4c8a27
push 2
push 0x558adc
jmp 0x4c8a27
push 2
push 0x558ad0
jmp 0x4c8a27
push 2
push 0x558af4
jmp 0x4c8a27
cmp eax, 0x41f
je 0x4c8a20
cmp eax, 0x80c
je 0x4c8a17
cmp eax, 0xc04
jne 0x4c8a2e
push 2
push 0x558afc
jmp 0x4c8a27
push 2
push 0x558ac8
jmp 0x4c8a27
push 2
push 0x558aec
mov ecx, esi
call fcn.0043c547
pop edi
mov eax, esi
pop esi
ret