joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d7a90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6123eb
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x238], 0
mov dword [ebp - 4], 1
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.005e2ec0
add esp, 0xc
mov dword [ebp - 0x23c], 0x104
mov dword [ebp - 0x240], 1
push 0x69b460
lea ecx, [ebp - 0x230]
call fcn.0048b540
mov byte [ebp - 4], 2
lea edx, [ebp - 0x234]
push edx
push 0xf003f
push 0
lea ecx, [ebp + 0x10]
call fcn.0047ca20
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d7b88
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x240]
push eax
push 0
lea ecx, [ebp + 0x28]
call fcn.0047ca20
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d7b7b
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x230]
call fcn.0047ca60
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x230]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0049cd00
mov edx, dword [ebp - 0x238]
or edx, 1
mov dword [ebp - 0x238], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.0047caf0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0047caf0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x28]
call fcn.0047caf0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c950e
mov esp, ebp
pop ebp
ret

Function at 0x4d7bf0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.005e2ec0
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
mov dword [ebp - 0x218], 1
mov byte [ebp - 0x20d], 0
lea edx, [ebp - 0x214]
push edx
lea ecx, [ebp + 0xc]
call fcn.0047ca20
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4d7ca6
lea ecx, [ebp + 0x3c]
call fcn.0048b7c0
shl eax, 1
push eax
lea ecx, [ebp + 0x3c]
call fcn.0047ca20
push eax
mov ecx, dword [ebp - 0x218]
push ecx
push 0
lea ecx, [ebp + 0x24]
call fcn.0047ca20
push eax
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4d7c99
mov byte [ebp - 0x20d], 1
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cl, byte [ebp - 0x20d]
mov byte [ebp - 0x20e], cl
lea ecx, [ebp + 0xc]
call fcn.0047caf0
lea ecx, [ebp + 0x24]
call fcn.0047caf0
lea ecx, [ebp + 0x3c]
call fcn.0047caf0
mov al, byte [ebp - 0x20e]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c950e
mov esp, ebp
pop ebp
ret
Function at 0x4d8b00
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61251b
mov eax, dword fs:[0]
push eax
mov eax, 0x4044
call fcn.005ca540
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4048], 0
push 0x6764f7
lea ecx, [ebp - 0x403c]
call fcn.0048bf00
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x4024], ax
push 0x3ffe
push 0
lea ecx, [ebp - 0x4022]
push ecx
call fcn.005e2ec0
add esp, 0xc
mov dword [ebp - 0x4044], 0
mov dword [ebp - 0x404c], 0
lea edx, [ebp - 0x404c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x4044], eax
cmp dword [ebp - 0x4044], 0
je 0x4d8c8c
lea ecx, [ebp - 0x4024]
push ecx
mov edx, dword [ebp - 0x4044]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4d8c8c
mov dword [ebp - 0x4040], 0
mov dword [ebp - 0x4050], 0
lea ecx, [ebp - 0x4050]
push ecx
lea edx, [ebp - 0x4040]
push edx
push 0x69b5d0
lea eax, [ebp - 0x4024]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4d8c8c
mov byte [ebp - 0x24], 0
xor ecx, ecx
mov dword [ebp - 0x23], ecx
mov dword [ebp - 0x1f], ecx
mov dword [ebp - 0x1b], ecx
mov dword [ebp - 0x17], ecx
mov word [ebp - 0x13], cx
mov byte [ebp - 0x11], cl
mov edx, dword [ebp - 0x4040]
mov eax, dword [edx + 0xc]
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x4040]
mov eax, dword [edx + 0xc]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x4040]
mov eax, dword [edx + 8]
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x4040]
mov eax, dword [edx + 8]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
push 0x69b5d4
lea edx, [ebp - 0x24]
push edx
call fcn.004da790
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x403c]
call fcn.004a8ec0
lea ecx, [ebp - 0x403c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0048be10
mov edx, dword [ebp - 0x4048]
or edx, 1
mov dword [ebp - 0x4048], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x403c]
call fcn.0048bcd0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c950e
mov esp, ebp
pop ebp
ret
Function at 0x4d9930
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
push 0xf003f
push 0
push str.SOFTWAREWOW6432NodeMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x4d99a4
lea ecx, [ebp - 0x214]
push ecx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x4d99a4
xor al, al
jmp 0x4d9aa9
mov dword [ebp - 0x21c], 1
xor edx, edx
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.005e2ec0
add esp, 0xc
mov dword [ebp - 0x218], 0x104
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x21c]
push eax
push 0
push str.CurrentBuild
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x4d9a58
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push 0
push str.CurrentBuildNumber
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x4d9a58
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4d9aa9
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.005f0ae3
add esp, 8
call fcn.005ca750
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x55f0
jl 0x4d9a99
mov dword [ebp - 0x220], 1
jmp 0x4d9aa3
mov dword [ebp - 0x220], 0
mov al, byte [ebp - 0x220]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c950e
mov esp, ebp
pop ebp
ret
Function at 0x4da5f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.005e2ec0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x61c], dx
push 0x206
push 0
lea eax, [ebp - 0x61a]
push eax
call fcn.005e2ec0
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x414], cx
push 0x206
push 0
lea edx, [ebp - 0x412]
push edx
call fcn.005e2ec0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x824], ax
push 0x206
push 0
lea ecx, [ebp - 0x822]
push ecx
call fcn.005e2ec0
add esp, 0xc
push 0x100
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0
push 0
push 0
push 0
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x104
lea ecx, [ebp - 0x61c]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.005f5e92
add esp, 0x24
mov dword [ebp - 0x828], eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push str._s_sts_downloader.cfg
lea edx, [ebp - 0x824]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4da701
mov al, 1
jmp 0x4da703
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c950e
mov esp, ebp
pop ebp
ret
Function at 0x4dc5b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x612a76
mov eax, dword fs:[0]
push eax
sub esp, 0x2c4
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2b4], ecx
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.005e2ec0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
push ecx
call fcn.004d8b00
add esp, 8
mov dword [ebp - 0x2b8], eax
mov edx, dword [ebp - 0x2b8]
push edx
mov ecx, 0x6cf428
call fcn.0048bd20
lea ecx, [ebp - 0x248]
call fcn.0048bcd0
call fcn.004d7a40
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0
je 0x4dc66c
mov dword [ebp - 0x2b0], str._64bit
jmp 0x4dc676
mov dword [ebp - 0x2b0], str._32bit
lea eax, [ebp - 0x278]
push eax
call fcn.004d61f0
add esp, 4
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x2c0]
mov dword [ebp - 0x2c4], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x2b0]
push edx
mov eax, dword [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x260]
push ecx
call fcn.004ca1d0
add esp, 0xc
mov dword [ebp - 0x2c8], eax
mov edx, dword [ebp - 0x2c8]
push edx
mov ecx, 0x6cf410
call fcn.0048bd20
lea ecx, [ebp - 0x260]
call fcn.0048bcd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x278]
call fcn.0048bcd0
lea eax, [ebp - 0x230]
push eax
call fcn.004d65c0
add esp, 4
mov dword [ebp - 4], 1
push 0
push 0x6a0ccc
lea ecx, [ebp - 0x230]
call fcn.0048b6e0
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0xffffffff
jne 0x4dc749
push 0x6a0d40
mov ecx, 0x6cf3e0
call fcn.004a8ec0
push str.Unknown
mov ecx, 0x6cf3c8
call fcn.004a8ec0
jmp 0x4dc7cb
mov ecx, dword [ebp - 0x2ac]
push ecx
push 0
lea edx, [ebp - 0x290]
push edx
lea ecx, [ebp - 0x230]
call fcn.0048b660
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
push eax
mov ecx, 0x6cf3c8
call fcn.0048bd20
lea ecx, [ebp - 0x290]
call fcn.0048bcd0
mov ecx, dword [0x6a56b0]
push ecx
mov edx, dword [ebp - 0x2ac]
add edx, 1
push edx
lea eax, [ebp - 0x2a8]
push eax
lea ecx, [ebp - 0x230]
call fcn.0048b660
mov dword [ebp - 0x2d0], eax
mov ecx, dword [ebp - 0x2d0]
push ecx
mov ecx, 0x6cf3e0
call fcn.0048bd20
lea ecx, [ebp - 0x2a8]
call fcn.0048bcd0
call sym.Setup.exe_CreateExportObj
mov dword [0x6cf15c], eax
cmp dword [0x6cf128], 0
jne 0x4dc7f4
push str.UserLogMutex
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov dword [0x6cf128], eax
push 0
push 0
mov edx, dword [ebp - 0x2b4]
push edx
push 0x4dccb0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.0048bcd0
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c950e
mov esp, ebp
pop ebp
ret
Function at 0x4de7e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x4e0e00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x612f46
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x6c6f60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0048a120
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.0048a120
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x30], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 0x14]
mov dword [edx + 8], eax
mov ecx, dword [ebp + 0x18]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x1c]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x20]
mov dword [ecx + 0x14], edx
cmp dword [ebp + 8], 0
je 0x4e0eb2
push 0
mov ecx, dword [ebp + 8]
call fcn.004c4310
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], eax
push 1
mov ecx, dword [ebp + 8]
call fcn.004c4310
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], eax
push 2
mov ecx, dword [ebp + 8]
call fcn.004c4310
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x3c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4e3e26
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
call fcn.004e3d30
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.005ec0f7
push edi
call fcn.005ead89
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4e3e75
push edi
call fcn.005f5f0e
pop ecx
test eax, eax
je 0x4e3e75
lea ecx, [esi + 0x40]
mov dword [esi + 0x38], 5
call fcn.004e259e
lea ecx, [esi + 0x4c]
call fcn.004e259e
mov dword [esi + 0x58], ebx
jmp 0x4e3ef2
push 2
push ebx
push edi
call fcn.005ec0f7
push edi
call fcn.005f4d99
push 0
push 0
push edi
mov ebx, eax
call fcn.005ec0f7
add esp, 0x1c
cmp ebx, 0xffffffff
jne 0x4e3eb5
mov dword [esi + 0x38], 5
lea ecx, [esi + 0x40]
call fcn.004e259e
lea ecx, [esi + 0x4c]
call fcn.004e259e
and dword [esi + 0x58], 0
jmp 0x4e3ef2
cmp ebx, 0xffffffff
jae 0x4e3e98
test ebx, ebx
jne 0x4e3ec7
mov dword [esi + 0x38], 0xf
jmp 0x4e3e9f
lea eax, [ebx + 1]
push eax
call fcn.005c9b2c
push edi
push ebx
push 1
push eax
mov dword [esi + 0x5c], eax
call fcn.005f6105
add esp, 0x14
cmp eax, ebx
jne 0x4e3e98
mov eax, dword [esi + 0x5c]
mov ecx, esi
mov byte [ebx + eax], 0
call fcn.004e40ba
mov eax, dword [esi + 0x38]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4e5650
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6132ef
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6c6f60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 8]
mov dword [esi], vtable.Json::BuiltStyledStreamWriter.0
call fcn.0048a120
lea ecx, [esi + 0x14]
call fcn.0048bfe0
push dword [ebp + 8]
mov byte [ebp - 4], 2
lea ecx, [esi + 0x30]
mov dword [esi + 0x2c], 0x4a
call fcn.0048c030
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x4c]
push dword [ebp + 0x10]
mov byte [ebp - 4], 3
mov dword [esi + 0x48], eax
call fcn.0048c030
push dword [ebp + 0x14]
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
call fcn.0048c030
push dword [ebp + 0x18]
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 5
call fcn.0048c030
mov cl, byte [ebp + 0x1c]
mov al, byte [esi + 0x94]
and cl, 1
and al, 0xf8
shl cl, 2
or cl, al
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x98], eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x9c], eax
mov eax, esi
mov byte [esi + 0x94], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4f938f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x4d8], edi
je 0x4f93f9
cmp dword [ebp + 8], 0x100
jne 0x4f93e8
cmp word [ebp + 0xc], 0xd
jne 0x4f93e8
cmp byte [esi + 0x4de], 0
je 0x4f93cf
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4f93e8
cmp byte [esi + 0x4df], 0
jne 0x4f93e8
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x4f93e4
push edi
push edi
push edi
push str.return
push esi
call fcn.0047a070
xor eax, eax
jmp 0x4f93fc
mov eax, dword [esi + 0x4d8]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x4fb1a3
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4fb259
movzx eax, word [esi]
test ax, ax
je 0x4fb259
push edi
mov edi, esi
mov ecx, esi
cmp ax, 0x2f
je 0x4fb1e3
cmp ax, 0x5c
jne 0x4fb1e5
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x4fb1d7
cmp edi, esi
je 0x4fb22c
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.005e6ea0
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x4fb269
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004fb1a3
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.005f71a9
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.005f7138
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005c950e
mov esp, ebp
pop ebp
ret
call fcn.005c9c58
int3

Function at 0x4fb82e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x4fb8aa
cmp dword [edi + 4], 0xffffffff
jne 0x4fb8aa
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push 0x61f084
push esi
call fcn.005f7138
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x4fb87c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 1
je 0x4fb87c
mov eax, 0x2000000
jmp 0x4fb8af
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004fdd4a
add esp, 0x10
test eax, eax
jne 0x4fb89a
mov eax, dword [ebp - 4]
jmp 0x4fb8af
push eax
call fcn.004fe452
mov dword [edi], eax
mov eax, dword [0x6cb9e8]
pop ecx
jmp 0x4fb8af
mov eax, 0x1000000
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4fde57
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x4fde8b
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4fde86
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4fdeb2
mov edx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x14]
jbe 0x4fde9b
mov esi, dword [edi + 0x14]
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.005e2940
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x4fe025
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4fe033
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x4fe0f2
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
sub edi, 1
jne 0x4fe04b
pop edi
test esi, esi
je 0x4fe10e
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x61d850]
inc edx
sub esi, 1
jne 0x4fe0f6
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x4fffdd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, ecx
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push dword [ebx + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push 7
pop ecx
push dword [ebx + 4]
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, dword [sym.imp.USER32.dll_SetFocus]
jmp 0x50008c
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x500090
cmp dword [ebp - 0x1c], 0x10
jne 0x50005b
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebx + 4]
jne 0x50005b
mov eax, dword [ebp - 0x18]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
lea eax, [ebp - 0x20]
push eax
call fcn.0047b8c0
pop ecx
test al, al
jne 0x50007d
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x1c], 0x12
je 0x500090
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x500028
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
cmp dword [ebp - 0x1c], 0x12
pop edi
pop esi
pop ebx
jne 0x5000ae
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x5000b5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5000e7
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8