joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d895c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d8a26
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x441474]
call fcn.00441574
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4d89ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00441614
xor ecx, ecx
mov edx, 0x4d8a3c
mov eax, dword [ebp - 0x10]
call fcn.0044167c
test al, al
je 0x4d89d4
lea ecx, [ebp - 0x14]
mov edx, 0x4d8a88
mov eax, dword [ebp - 0x10]
call fcn.00441bf8
mov eax, dword [ebp - 0x14]
call fcn.004d8274
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d89f1
mov eax, dword [ebp - 0x10]
call fcn.00403bec
ret

Function at 0x4d92b4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d937e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x441474]
call fcn.00441574
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4d9342
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00441614
xor ecx, ecx
mov edx, 0x4d9394
mov eax, dword [ebp - 0x10]
call fcn.0044167c
test al, al
je 0x4d932c
lea ecx, [ebp - 0x14]
mov edx, 0x4d93e0
mov eax, dword [ebp - 0x10]
call fcn.00441bf8
mov eax, dword [ebp - 0x14]
call fcn.004d8274
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9349
mov eax, dword [ebp - 0x10]
call fcn.00403bec
ret
Function at 0x4deea0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4def57
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x441474]
call fcn.00441574
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4def3a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.00441614
xor ecx, ecx
mov edx, 0x4def70
mov eax, dword [ebp - 4]
call fcn.0044167c
test al, al
je 0x4def24
lea ecx, [ebp - 8]
mov edx, 0x4defbc
mov eax, dword [ebp - 4]
call fcn.00441bf8
cmp dword [ebp - 8], 0
je 0x4def24
push edi
push 0
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004de7ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4def41
mov eax, dword [ebp - 4]
call fcn.00403bec
ret

Function at 0x4defc4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4df07b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x441474]
call fcn.00441574
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4df05e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.00441614
xor ecx, ecx
mov edx, 0x4df094
mov eax, dword [ebp - 4]
call fcn.0044167c
test al, al
je 0x4df048
lea ecx, [ebp - 8]
mov edx, 0x4df0e0
mov eax, dword [ebp - 4]
call fcn.00441bf8
cmp dword [ebp - 8], 0
je 0x4df048
push edi
push 1
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004de7ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df065
mov eax, dword [ebp - 4]
call fcn.00403bec
ret
Function at 0x4f2948
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4f2a40
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.004027dc
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x418888]
call fcn.00403bbc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4f2a11
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00404c18
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, 0x4f2a54
call fcn.00404d2c
call fcn.0040b58c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x18]
mov eax, 0x4f2a68
call fcn.0040c2f0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 8]
mov edx, 0x4f2a7c
call fcn.004ce9c0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2a18
mov eax, dword [ebp - 0x10]
call fcn.00403bec
mov eax, dword [ebp - 4]
call fcn.004027fc
ret

Function at 0x4f3d70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f3de0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
push ebx
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.0040a030
mov eax, dword [ebp - 0x104]
mov ecx, 3
xor edx, edx
call fcn.00404f40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f3de7
lea eax, [ebp - 0x104]
call fcn.00404a20
ret

Function at 0x4f3dec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f3eca
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.0040a030
mov edx, dword [ebp - 4]
mov eax, 0x4f3ee0
call fcn.00405024
dec eax
jl 0x4f3e71
lea eax, [ebp - 0x110]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404f40
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 4]
mov ecx, 0x4f3ef0
call fcn.00404d2c
jmp 0x4f3e9a
lea eax, [ebp - 0x114]
push eax
mov ecx, 3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00404f40
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x4f3f04
call fcn.00404d2c
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404a74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f3ed1
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.00404a44
lea eax, [ebp - 4]
call fcn.00404a20
ret
Function at 0x4f4640
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
call fcn.00404ed0
xor eax, eax
push ebp
push 0x4f4870
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp + 0x10]
call fcn.00404ee0
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4f483d
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov dword [ebp - 0x10], 0x3e8
mov ebx, dword [ebp - 0x18]
dec ebx
test ebx, ebx
jl 0x4f483d
inc ebx
mov dword [ebp - 0x30], 0
mov eax, dword [0x580cd8]
cmp byte [eax], 2
je 0x4f483d
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x238]
push eax
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
cmp dword [ebp + 0x10], 0
jne 0x4f4755
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x240], eax
mov byte [ebp - 0x23c], 6
lea edx, [ebp - 0x240]
xor ecx, ecx
mov eax, 0x4f4888
call fcn.0040a520
jmp 0x4f479c
push dword [ebp + 0x10]
push 0x4f4894
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x240], eax
mov byte [ebp - 0x23c], 6
lea edx, [ebp - 0x240]
xor ecx, ecx
mov eax, 0x4f4888
call fcn.0040a520
push dword [ebp - 0x244]
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00404da0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x240], eax
mov byte [ebp - 0x23c], 6
lea edx, [ebp - 0x240]
xor ecx, ecx
mov eax, 0x4f4888
call fcn.0040a520
lea edx, [ebp - 0x24c]
mov eax, esi
call fcn.00579b8c
push dword [ebp - 0x24c]
push 0x4f4894
push dword [ebp - 0x34]
lea eax, [ebp - 0x248]
mov edx, 3
call fcn.00404da0
mov edx, dword [ebp - 0x248]
mov eax, edi
call fcn.0046cef4
call fcn.0057b47c
push esi
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004f3f0c
mov dword [ebp - 0x10], 0x3e8
mov eax, dword [0x581040]
mov eax, dword [eax]
call fcn.0048d8b8
inc dword [ebp - 0x30]
dec ebx
jne 0x4f46f6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f4877
lea eax, [ebp - 0x24c]
mov edx, 3
call fcn.00404a44
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00404a44
lea eax, [ebp + 0x10]
call fcn.00404a20
ret
Function at 0x4ff474
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
call fcn.00404ed0
xor eax, eax
push ebp
push 0x4ff67c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0x10]
call fcn.0057b8ec
test al, al
jne 0x4ff653
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp + 0x10]
call fcn.00404ee0
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4ff64a
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov dword [ebp - 0x10], 0x3e8
mov ebx, dword [ebp - 0x18]
dec ebx
test ebx, ebx
jl 0x4ff64a
inc ebx
mov dword [ebp - 0x30], 0
mov eax, dword [0x581040]
mov eax, dword [eax]
call fcn.0048d8b8
mov eax, dword [0x580cd8]
cmp byte [eax], 2
je 0x4ff64a
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
cmp dword [ebp + 0x10], 0
jne 0x4ff596
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x234]
mov dword [ebp - 0x23c], eax
mov byte [ebp - 0x238], 6
lea edx, [ebp - 0x23c]
xor ecx, ecx
mov eax, 0x4ff694
call fcn.0040a520
jmp 0x4ff5dd
push dword [ebp + 0x10]
push 0x4ff6a0
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x234]
mov dword [ebp - 0x23c], eax
mov byte [ebp - 0x238], 6
lea edx, [ebp - 0x23c]
xor ecx, ecx
mov eax, 0x4ff694
call fcn.0040a520
push dword [ebp - 0x240]
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00404da0
mov eax, dword [0x581058]
inc dword [eax]
mov eax, dword [0x581058]
mov eax, dword [eax]
mov ecx, 0xc8
cdq
idiv ecx
test edx, edx
jne 0x4ff602
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 4]
call fcn.0046cef4
call fcn.0057b47c
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, esi
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004fea8c
push esi
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004ff474
mov dword [ebp - 0x10], 0x3e8
inc dword [ebp - 0x30]
dec ebx
jne 0x4ff52b
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff683
lea eax, [ebp - 0x240]
call fcn.00404a20
lea eax, [ebp - 0x34]
call fcn.00404a20
lea eax, [ebp + 0x10]
call fcn.00404a20
ret
Function at 0x5002d4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5003a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 0x43
mov eax, dword [0x581040]
mov eax, dword [eax]
call fcn.0048d8b8
mov eax, dword [0x580cd8]
cmp byte [eax], 2
je 0x50038b
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404c08
lea eax, [ebp - 0x10]
mov edx, 0x5003c0
call fcn.00404ce8
mov eax, dword [ebp - 0x10]
call fcn.00404ee0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x500381
lea eax, [ebp - 0x14]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.00403138
mov edx, 0x5003c4
lea eax, [ebp - 0x18]
mov cl, 2
call fcn.00403108
lea edx, [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00404c84
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0050062c
inc ebx
cmp bl, 0x5b
jne 0x5002fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5003ad
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404a44
ret
Function at 0x503aec
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ed0
xor eax, eax
push ebp
push 0x503b85
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404ee0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebx + 0x2f8]
call fcn.0047a1d0
mov edx, dword [ebp - 0x164]
call fcn.0042f95c
mov esi, eax
mov eax, dword [ebx + 0x2fc]
call fcn.0047a1d0
mov edx, dword [ebp - 0x164]
call fcn.0042f95c
mov eax, dword [ebp - 0x164]
push eax
call sub.user32.dll_DestroyIcon
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503b8c
lea eax, [ebp - 4]
call fcn.00404a20
ret
Function at 0x5059a0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x160], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404ed0
lea eax, [ebp - 0x15c]
mov edx, dword [0x408194]
call fcn.004053e0
xor eax, eax
push ebp
push 0x505ae8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404ee0
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
lea ecx, [ebp - 0x15c]
mov edx, 0x10
mov eax, 0x505b00
call fcn.00409a4c
jmp 0x505a9a
mov eax, dword [0x581040]
mov eax, dword [eax]
call fcn.0048d8b8
mov eax, dword [ebp - 0x150]
mov edx, 0x505b0c
call fcn.00404e2c
je 0x505a9a
mov eax, dword [ebp - 0x150]
mov edx, 0x505b18
call fcn.00404e2c
je 0x505a9a
mov eax, dword [esi + 0x22c]
call fcn.00451168
mov ebx, eax
mov edx, dword [ebp - 0x150]
mov eax, ebx
call fcn.00450c08
push dword [ebp - 4]
push 0x505b24
push dword [ebp - 0x150]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.00404da0
mov edx, dword [ebp - 0x160]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x505b30
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x505b40
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x15c]
call fcn.00409a9c
test eax, eax
je 0x505a0a
mov edx, esi
mov eax, edi
call fcn.00509d18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x505aef
lea eax, [ebp - 0x160]
call fcn.00404a20
lea eax, [ebp - 0x15c]
mov edx, dword [0x408194]
call fcn.004054b0
lea eax, [ebp - 4]
call fcn.00404a20
ret
Function at 0x507938
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x507940
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x507afd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.004027dc
mov ebx, eax
push 0xff
push ebx
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404c18
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov ecx, 0x507b14
call fcn.00404d2c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4404bc]
call fcn.0044056c
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x418888]
call fcn.00403bbc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x507ad3
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, 0x507b28
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x507ab5
inc eax
mov dword [ebp - 0x14], eax
xor esi, esi
mov edx, dword [0x578f2c]
mov eax, 8
call fcn.00405924
mov ebx, eax
mov eax, ebx
mov edx, 0x507b28
call fcn.00404a74
lea ecx, [ebp - 0x1c]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 4]
call fcn.00404a74
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
mov edx, ebx
call fcn.0041ab90
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x324]
mov eax, dword [eax + 0x22c]
call fcn.00451168
mov ebx, eax
lea ecx, [ebp - 0x20]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x20]
mov eax, ebx
call fcn.00450c08
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x28]
mov edx, 0x507b28
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 8]
mov edx, 0x507b38
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.00450dc0
mov ecx, 2
mov edx, 2
mov eax, ebx
call fcn.00450dc0
inc esi
dec dword [ebp - 0x14]
jne 0x5079e2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x507ada
mov eax, dword [ebp - 0xc]
call fcn.00403bec
mov eax, dword [ebp - 0x10]
call fcn.00403bec
ret
Function at 0x507b40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x507b48
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x507ce9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.004027dc
mov ebx, eax
push 0xff
push ebx
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404c18
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov ecx, 0x507d00
call fcn.00404d2c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4404bc]
call fcn.0044056c
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x418888]
call fcn.00403bbc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x507cbf
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, 0x507d14
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x507ca1
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov edx, dword [0x578f2c]
mov eax, 8
call fcn.00405924
mov esi, eax
mov eax, esi
mov edx, 0x507d14
call fcn.00404a74
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1c]
lea eax, [esi + 4]
call fcn.00404a74
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c4]
mov edx, esi
call fcn.0041ab90
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x324]
mov eax, dword [eax + 0x22c]
call fcn.00451168
mov esi, eax
lea ecx, [ebp - 0x20]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x20]
mov eax, esi
call fcn.00450c08
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x28]
mov edx, 0x507d14
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x24]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi + 8]
mov edx, 0x507d20
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
dec dword [ebp - 0x14]
jne 0x507bea
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x507cc6
mov eax, dword [ebp - 0xc]
call fcn.00403bec
mov eax, dword [ebp - 0x10]
call fcn.00403bec
ret
Function at 0x50d33c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
xor edx, edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50d5e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x441474]
call fcn.00441574
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x50d526
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00441614
xor ecx, ecx
mov edx, 0x50d5fc
mov eax, dword [ebp - 8]
call fcn.0044167c
test al, al
je 0x50d428
lea edx, [ebp - 0x158]
mov eax, dword [0x581040]
mov eax, dword [eax]
call fcn.0048e074
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
call fcn.00409c60
mov edx, dword [ebp - 0x154]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00441bf8
lea edx, [ebp - 0x15c]
mov eax, dword [0x581040]
mov eax, dword [eax]
call fcn.0048e074
mov edx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0xc]
call fcn.00404e2c
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x318]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebp - 8]
call fcn.004415e4
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.00441614
xor ecx, ecx
mov edx, 0x50d634
mov eax, dword [ebp - 8]
call fcn.0044167c
test al, al
je 0x50d508
mov edx, 0x50d65c
mov eax, dword [ebp - 8]
call fcn.00441e2c
test al, al
je 0x50d485
mov edx, 0x50d65c
mov eax, dword [ebp - 8]
call fcn.00441cc0
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov edx, 0x50d674
mov eax, dword [ebp - 8]
call fcn.00441e2c
test al, al
je 0x50d4b6
mov edx, 0x50d674
mov eax, dword [ebp - 8]
call fcn.00441cc0
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x324]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov edx, 0x50d688
mov eax, dword [ebp - 8]
call fcn.00441e2c
test al, al
je 0x50d4e7
mov edx, 0x50d688
mov eax, dword [ebp - 8]
call fcn.00441cc0
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov edx, 0x50d69c
mov eax, dword [ebp - 8]
call fcn.00441e2c
test al, al
je 0x50d508
lea ecx, [ebp - 0x10]
mov edx, 0x50d69c
mov eax, dword [ebp - 8]
call fcn.00441bf8
mov eax, dword [ebp - 8]
call fcn.004415e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50d52d
mov eax, dword [ebp - 8]
call fcn.00403bec
ret