joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bcab0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x610f33
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x270], ecx
mov eax, dword [ebp - 0x270]
mov ecx, dword [eax + 0x560]
add ecx, 0x84
push ecx
lea ecx, [ebp - 0x28]
call fcn.0047dde0
mov dword [ebp - 4], 0
mov dword [ebp - 0x280], 0
push 0
push 2
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x254], 0x22c
lea edx, [ebp - 0x254]
push edx
mov eax, dword [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
jne 0x4bcb60
mov byte [ebp - 0x255], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0047dc50
mov al, byte [ebp - 0x255]
jmp 0x4bcd3c
mov ecx, 1
test ecx, ecx
je 0x4bcd13
mov dword [ebp - 0x254], 0x22c
lea edx, [ebp - 0x254]
push edx
mov eax, dword [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x4bcb94
jmp 0x4bcd13
lea ecx, [ebp - 0x28]
call fcn.0047db80
mov dword [ebp - 0x260], eax
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x25c], ecx
mov edx, dword [ebp - 0x25c]
mov ax, word [edx]
mov word [ebp - 0x262], ax
mov ecx, dword [ebp - 0x260]
cmp ax, word [ecx]
jne 0x4bcc14
cmp word [ebp - 0x262], 0
je 0x4bcc08
mov edx, dword [ebp - 0x25c]
mov ax, word [edx + 2]
mov word [ebp - 0x264], ax
mov ecx, dword [ebp - 0x260]
cmp ax, word [ecx + 2]
jne 0x4bcc14
add dword [ebp - 0x25c], 4
add dword [ebp - 0x260], 4
cmp word [ebp - 0x264], 0
jne 0x4bcbae
mov dword [ebp - 0x26c], 0
jmp 0x4bcc1f
sbb edx, edx
or edx, 1
mov dword [ebp - 0x26c], edx
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0
jne 0x4bcd0e
push 0
push 2
push str.bool___thiscall_InstallUIMainWnd::AppIsRunning_void_
push 0x9a8
push 0x691580
push 0x80
lea ecx, [ebp - 0x2b8]
call fcn.00486a40
mov dword [ebp - 0x278], eax
mov ecx, dword [ebp - 0x278]
mov dword [ebp - 0x27c], ecx
mov byte [ebp - 4], 1
lea edx, [ebp - 0x24c]
push edx
push 0x6915b4
lea eax, [ebp - 0x28]
push eax
push 0x69157c
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [0x6c7b98]
push edx
push 1
mov eax, dword [ebp - 0x27c]
push eax
call fcn.00486b20
add esp, 0xc
mov ecx, eax
call fcn.004ca830
mov ecx, eax
call fcn.0049bd50
mov ecx, eax
call fcn.004ca6b0
mov ecx, eax
call fcn.0049bd50
mov ecx, eax
call fcn.0049bde0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2b8]
call fcn.00486ac0
mov ecx, dword [ebp - 0x24c]
mov dword [ebp - 0x280], ecx
push 3
mov ecx, dword [ebp - 0x270]
call fcn.004bc230
mov byte [ebp - 0x256], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0047dc50
mov al, byte [ebp - 0x256]
jmp 0x4bcd3c
jmp 0x4bcb60
mov edx, dword [ebp - 0x268]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov byte [ebp - 0x257], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0047dc50
mov al, byte [ebp - 0x257]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret
Function at 0x4bcd60
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x610f70
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x40]
call fcn.0047dd90
mov dword [ebp - 4], 0
push 0x6915b0
lea ecx, [ebp - 0x28]
call fcn.0048c140
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x5c]
call fcn.004b51d0
push 2
push 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x40]
call fcn.0047db00
mov dword [ebp - 0x60], eax
mov edx, dword [ebp - 0x60]
push edx
lea ecx, [ebp - 0x28]
call fcn.0047dca0
lea ecx, [ebp - 0x58]
call fcn.0047dc50
push 0
push 0
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x28]
call fcn.0047db80
push eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x4bce34
cmp dword [ebp - 0x70], 0
ja 0x4bce0d
cmp dword [ebp - 0x74], 0x12c00000
jbe 0x4bce34
mov dword [ebp - 0x68], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0047dc50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0047dc50
mov eax, dword [ebp - 0x68]
jmp 0x4bce63
push 0xb
mov ecx, dword [ebp - 0x5c]
call fcn.004bc230
mov dword [ebp - 0x6c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0047dc50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0047dc50
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret
Function at 0x4bd0a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x610fe3
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc0], ecx
mov ecx, dword [ebp - 0xc0]
call fcn.004bcab0
movzx eax, al
test eax, eax
jne 0x4bd0eb
or eax, 0xffffffff
jmp 0x4bd2f7
mov ecx, dword [ebp - 0xc0]
call fcn.004bc6c0
movzx ecx, al
test ecx, ecx
jne 0x4bd105
or eax, 0xffffffff
jmp 0x4bd2f7
mov ecx, dword [ebp - 0xc0]
call fcn.004bce80
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 1
push 0x168
push 0x28a
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [ebp - 0xc0]
call fcn.004ffcc5
lea ecx, [ebp - 0xbc]
call fcn.004f056c
mov dword [ebp - 4], 0
sub esp, 8
xorps xmm0, xmm0
movsd qword [esp], xmm0
mov ecx, dword [ebp - 0xc0]
add ecx, 0x448
call fcn.0047db80
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004f0b06
add esp, 0x10
lea ecx, [ebp - 0xbc]
call fcn.004f0b96
push eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 0x374]
mov eax, dword [ebp - 0xc0]
mov edx, dword [edx]
mov ecx, dword [eax + 0x374]
mov eax, dword [edx + 0x2c]
call eax
push 0
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 0x494]
mov eax, dword [ebp - 0xc0]
mov edx, dword [edx]
mov ecx, dword [eax + 0x494]
mov eax, dword [edx + 0xcc]
call eax
push 0
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 0x498]
mov eax, dword [ebp - 0xc0]
mov edx, dword [edx]
mov ecx, dword [eax + 0x498]
mov eax, dword [edx + 0xcc]
call eax
push 0
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 0x4a0]
mov eax, dword [ebp - 0xc0]
mov edx, dword [edx]
mov ecx, dword [eax + 0x4a0]
mov eax, dword [edx + 0xcc]
call eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx + 0x4d0]
push edx
push str.start_app
push 0x691648
lea eax, [ebp - 0x38]
push eax
call fcn.004d9a30
add esp, 0x10
mov dword [ebp - 0xc4], eax
mov ecx, dword [ebp - 0xc4]
mov dword [ebp - 0xc8], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xc8]
call fcn.0047db80
push eax
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x4a4]
mov ecx, dword [ebp - 0xc0]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x4a4]
mov eax, dword [edx + 0x2c]
call eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.0047dc50
push 0
push 0
mov ecx, dword [ebp - 0xc0]
push ecx
push 0x4b5b20
push 0
push 0
call fcn.005e79f3
add esp, 0x18
push 0x6916e4
mov edx, dword [ebp - 0xc0]
mov ecx, dword [edx + 0x4bc]
call fcn.004707d0
mov ecx, dword [ebp - 0xc0]
call fcn.004bc330
mov dword [ebp - 0xcc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.004f065e
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret
Function at 0x4bd330
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61101b
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x23c], 0x104
mov dword [ebp - 0x240], 1
push 0x691678
lea ecx, [ebp - 0x230]
call fcn.0048c140
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x238]
mov ecx, dword [eax + 0x560]
add ecx, 0x24
push ecx
lea ecx, [ebp - 0x230]
call fcn.004c5090
lea edx, [ebp - 0x234]
push edx
push 0xf003f
push 0
lea ecx, [ebp - 0x230]
call fcn.0047db80
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4bd44d
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x240]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4bd40d
lea edx, [ebp - 0x218]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.0047dbc0
jmp 0x4bd43e
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x244], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.0047dc50
mov eax, dword [ebp - 0x244]
jmp 0x4bd493
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4bd471
mov dword [ebp - 0x248], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.0047dc50
mov eax, dword [ebp - 0x248]
jmp 0x4bd493
mov dword [ebp - 0x24c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.0047dc50
mov eax, dword [ebp - 0x24c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret 8
Function at 0x4bd4b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x611060
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], 0x104
mov dword [ebp - 0x44], 1
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [ebp - 0x28]
call fcn.0048c140
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x560]
add ecx, 0x24
push ecx
lea ecx, [ebp - 0x28]
call fcn.004c5090
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x28]
call fcn.0047db80
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4bd5c4
lea ecx, [ebp + 0xc]
call fcn.0047bfd0
shl eax, 1
push eax
lea ecx, [ebp + 0xc]
call fcn.0047db80
push eax
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4bd593
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x34], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0047dc50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0047dc50
mov eax, dword [ebp - 0x34]
jmp 0x4bd5e9
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x38], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0047dc50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0047dc50
mov eax, dword [ebp - 0x38]
jmp 0x4bd5e9
mov dword [ebp - 0x3c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0047dc50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0047dc50
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4c1e20
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61147c
mov eax, dword fs:[0]
push eax
sub esp, 0x4a4
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4a4], ecx
push 0x104
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.005e3180
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x420]
push ecx
call fcn.005e3180
add esp, 0xc
lea ecx, [ebp - 0x468]
call fcn.0047dd90
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x438]
call fcn.0047dd90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x450]
call fcn.0047dd90
mov byte [ebp - 4], 2
lea edx, [ebp - 0x480]
push edx
mov ecx, dword [ebp - 0x4a4]
call fcn.004c2050
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x4a8]
push eax
lea ecx, [ebp - 0x438]
call fcn.0047dca0
lea ecx, [ebp - 0x480]
call fcn.0047dc50
lea ecx, [ebp - 0x218]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
je 0x4c1fef
push 0x104
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLongPathNameW]
lea ecx, [ebp - 0x420]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0047dbc0
lea edx, [ebp - 0x498]
push edx
mov ecx, dword [ebp - 0x4a4]
call fcn.004c2130
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x4b0], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x4b0]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004c5100
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x498]
call fcn.0047dc50
push 0x692c1c
mov ecx, dword [ebp + 8]
call fcn.004c50e0
push 0
mov ecx, dword [ebp + 8]
call fcn.0047db80
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 0
je 0x4c1fb0
cmp dword [ebp - 0x4a0], 0x50
je 0x4c1fb0
cmp dword [ebp - 0x4a0], 0xb7
je 0x4c1fb0
jmp 0x4c1fef
mov byte [ebp - 0x499], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x450]
call fcn.0047dc50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x438]
call fcn.0047dc50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x468]
call fcn.0047dc50
mov al, byte [ebp - 0x499]
jmp 0x4c202c
mov byte [ebp - 0x49a], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x450]
call fcn.0047dc50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x438]
call fcn.0047dc50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x468]
call fcn.0047dc50
mov al, byte [ebp - 0x49a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret 4
Function at 0x4c35a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x611668
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8c], ecx
lea ecx, [ebp - 0x28]
call fcn.0047dd90
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.0047dd90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.0047dd90
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x8c]
call fcn.004c1e20
push 1
lea ecx, [ebp - 0x70]
push ecx
mov ecx, dword [ebp - 0x8c]
call fcn.004c2350
mov dword [ebp - 0x90], eax
mov edx, dword [ebp - 0x90]
push edx
lea ecx, [ebp - 0x58]
call fcn.0047dca0
lea ecx, [ebp - 0x70]
call fcn.0047dc50
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.004c5100
push 0x6937d0
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x88]
push edx
call fcn.004ca440
add esp, 0xc
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
push eax
lea ecx, [ebp - 0x40]
call fcn.0047dca0
lea ecx, [ebp - 0x88]
call fcn.0047dc50
lea ecx, [ebp - 0x28]
call fcn.0047db80
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea ecx, [ebp - 0x40]
call fcn.0047db80
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.0047dc50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.0047dc50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0047dc50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret
Function at 0x4c8640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x611a38
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x4c8680
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3e]
test edx, edx
jne 0x4c868c
mov al, 1
jmp 0x4c8834
mov dword [ebp - 0x44], 8
call fcn.004b1830
movzx eax, ax
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov word [ebp - 0x36], ax
call fcn.004b1830
mov word [ebp - 0x38], ax
lea ecx, [ebp - 0x36]
push ecx
lea edx, [ebp - 0x38]
push edx
call fcn.004b17a0
add esp, 8
movzx eax, al
test eax, eax
je 0x4c86d4
xor al, al
jmp 0x4c8834
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.0048c8d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x28]
call fcn.0048c610
mov ecx, eax
call fcn.0047eca0
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.0047bfd0
add esi, eax
push esi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x28]
call fcn.0048c610
mov ecx, eax
call fcn.0047eca0
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.00493cd0
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x4c874f
cmp dword [ebp - 0x3c], 1
je 0x4c8756
cmp dword [ebp - 0x3c], 3
je 0x4c87f0
jmp 0x4c8808
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3e], 0
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0048c610
mov ecx, eax
call fcn.0047eca0
mov edx, dword [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x34], edx
je 0x4c87b9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x28]
call fcn.0048c610
mov ecx, eax
call fcn.0047eca0
push eax
call fcn.005eb678
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x4c87b9
mov byte [ebp - 0x2d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0047c030
mov al, byte [ebp - 0x2d]
jmp 0x4c8834
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3e]
test edx, edx
jne 0x4c87dc
mov byte [ebp - 0x2e], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0047c030
mov al, byte [ebp - 0x2e]
jmp 0x4c8834
cmp dword [ebp - 0x34], 0
jne 0x4c87ee
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00491830
jmp 0x4c8820
mov byte [ebp - 0x2f], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0047c030
mov al, byte [ebp - 0x2f]
jmp 0x4c8834
mov byte [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0047c030
mov al, byte [ebp - 0x30]
jmp 0x4c8834
jmp 0x4c86e7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret
Function at 0x4d5b10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x4d5b19
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4d5b5c
mov eax, dword [ebp - 8]
jmp 0x4d5bc2
cmp dword [ebp - 0xc], 1
je 0x4d5b6f
cmp dword [ebp - 0xc], 2
je 0x4d5b6f
mov eax, 0xd
jmp 0x4d5bc2
cmp dword [ebp + 0xc], 0
je 0x4d5bb6
cmp dword [ebp - 4], 0
je 0x4d5ba5
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x4d5b9c
mov edx, dword [ebp - 4]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x4d5ba3
mov eax, 0xd
jmp 0x4d5bc2
jmp 0x4d5bb6
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax], cx
mov eax, dword [ebp - 4]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4d5bd0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
lea ecx, [ebp - 0xc]
push ecx
push 0x6a6224
push 1
push 0
push 0x6a6204
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x4d5c2a
mov edx, dword [ebp - 4]
push edx
push 0x69a1e4
call fcn.004cbdf0
add esp, 8
jmp 0x4d5c86
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 0x1c]
call ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x4d5c5a
mov edx, dword [ebp - 4]
push edx
push str.get_LocalPolicy_failed:_0x_08lx_n
call fcn.004cbdf0
add esp, 8
jmp 0x4d5c86
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx + 0x1c]
call ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x4d5c86
mov edx, dword [ebp - 4]
push edx
push str.get_CurrentProfile_failed:_0x_08lx_n
call fcn.004cbdf0
add esp, 8
cmp dword [ebp - 8], 0
je 0x4d5c9a
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx + 8]
call eax
cmp dword [ebp - 0xc], 0
je 0x4d5cae
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 8]
call ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret