joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b9990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
movzx esi, word [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp si, 0xffff
je 0x4b99df
mov edi, ecx
mov word [ebp - 0x1a], si
cmp byte [ecx + 0x2c], 0
je 0x4b99f7
lea eax, [ebp - 0x1a]
push dword [edi + 0x20]
push 1
push 2
push eax
call fcn.004a1780
add esp, 0x10
cmp eax, 1
je 0x4b99e1
xor esi, esi
dec esi
jmp 0x4b99e1
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048a678
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
lea esi, [ebp - 0x1a]
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [edi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x4b99da
mov ebx, eax
cmp eax, 3
je 0x4b9a66
cmp ebx, 1
ja 0x4b99da
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.004a1780
add esp, 0x10
cmp eax, esi
jne 0x4b99da
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x4b9a02
movzx esi, word [ebp + 8]
jmp 0x4b99e1
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.004a1780
add esp, 0x10
cmp eax, ebx
jne 0x4b99da
jmp 0x4b9a5d

Function at 0x4b9ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x4b9b0f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x4b9af1
pop esi
pop edi
pop ebp
ret 8

Function at 0x4b9b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x4b9ba1
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x4b9b81
pop esi
pop edi
pop ebp
ret 8
Function at 0x4c3020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov esi, esp
mov dword [esi + 0x88], ebp
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x90]
mov dword [eax - 4], esp
xor edx, edx
dec edx
mov dword [eax + 8], edx
mov dword [eax + 4], 0x43eb50
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
lea ecx, [esi + 0x20]
mov dword [ecx + 0x60], edx
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx + 0x50], xmm0
movdqa xmmword [ecx + 0x40], xmm0
movdqa xmmword [ecx + 0x30], xmm0
movdqa xmmword [ecx + 0x20], xmm0
movdqa xmmword [ecx + 0x10], xmm0
movdqa xmmword [ecx], xmm0
mov dword [esi + 8], ecx
mov dword [esi + 0x18], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0xc], fcn.004b3dd0
mov dword [esi + 0x14], edx
mov dword [eax + 8], 1
lea eax, [esi + 4]
mov dword [eax], edx
push eax
call fcn.0046af90
mov dword [esi + 0x98], 2
lea ecx, [esi + 4]
push 0x524658
call fcn.0046b850
mov dword [esi + 0x10], eax
mov al, byte [ebp + 0x14]
lea ecx, [esi + 0x84]
lea edx, [esi + 3]
mov byte [edx], 0
lea edi, [esi + 0x14]
lea ebx, [esi + 8]
movzx eax, al
push ecx
push edi
push ebx
push dword [esi + 0x10]
push edx
push dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push dword [ecx + 4]
lea ecx, [esi + 4]
push ecx
push eax
push dword [esi + 0x1c]
lea eax, [ebp + 0xc]
push eax
call fcn.004c2520
add esp, 0x2c
test al, al
je 0x4c316e
mov ecx, dword [ebp + 0x20]
cmp byte [ecx + 0xb], 0
js 0x4c31da
xor eax, eax
mov byte [ecx], al
mov byte [ecx + 0xb], al
cmp byte [esi + 3], 0
je 0x4c3138
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x2d
call dword [eax + 0x1c]
movsx eax, al
mov ecx, dword [ebp + 0x20]
push eax
call fcn.0046c4b0
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0x30
call dword [eax + 0x1c]
mov edx, dword [esi + 8]
mov edi, dword [esi + 0x14]
lea ecx, [edi - 1]
cmp edx, ecx
jae 0x4c315a
cmp byte [edx], al
jne 0x4c315a
inc edx
cmp ecx, edx
jne 0x4c314f
mov edx, ecx
mov dword [esi + 0x98], 2
mov ecx, dword [ebp + 0x20]
push edi
push edx
call fcn.0043e200
lea eax, [ebp + 0x10]
lea ecx, [ebp + 0xc]
push eax
call fcn.00464b50
mov edi, dword [ebp + 8]
test al, al
je 0x4c3187
mov eax, dword [ebp + 0x1c]
or byte [eax], 2
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
mov ecx, dword [esi + 4]
xor eax, eax
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x4c31a0
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
je 0x4c31c2
mov dword [esi + 0x98], 0
push eax
call dword [esi + 0xc]
mov edi, dword [ebp + 8]
add esp, 4
mov eax, dword [esi + 0x90]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
jmp 0x4c311c
Function at 0x4cb310
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 8
call fcn.00489952
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
xor ecx, ecx
push ecx
push ecx
push eax
push 0x4cb360
push ecx
push ecx
call fcn.00498690
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4cb34f
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x4cec00
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
inc edx
pop ebp
jmp fcn.004435e0

Function at 0x4cec10
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x48], eax
xor eax, eax
dec eax
lea esi, [esp + 0x10]
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x1a9
push str..._.._base_files_file_util_win.cc
push str.DeleteFileAfterReboot
push ebx
call fcn.0046e3e0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004735a0
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x4cec7a
mov ecx, dword [edi + 4]
cmp ecx, 0x103
jbe 0x4cec86
xor ebx, ebx
jmp 0x4cec9c
test al, al
jns 0x4cec8c
mov edi, dword [edi]
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
lea ecx, [esp + 0x10]
call fcn.004735e0
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0048a678
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4cf0e0
Capabilities:
Get disk information
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa90
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0xa88], eax
xor eax, eax
dec eax
lea esi, [esp + 0x40]
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x288]
push 0x2ef
push str..._.._base_files_file_util_win.cc
push str.DevicePathToDriveLetterPath
push ebx
call fcn.0046e3e0
add esp, 0x10
xor edi, edi
mov ecx, esi
push edi
push ebx
call fcn.004735a0
push 0x800
push edi
push ebx
call fcn.0048d770
add esp, 0xc
push ebx
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4cf221
lea esi, [esp + 0x80]
push 0x208
push 0xff
push esi
call fcn.0048d770
add esp, 0xc
movzx eax, word [0x50a3e4]
mov word [esp + 0x7c], ax
mov eax, dword [0x50a3e0]
mov dword [esp + 0x78], eax
movzx eax, word [esp + 0x288]
test ax, ax
je 0x4cf221
lea edi, [esp + 0x34]
mov word [esp + 0x78], ax
push 0x104
push esi
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4cf210
xor eax, eax
dec eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
push esi
call fcn.004a3276
add esp, 4
mov ecx, edi
push eax
push esi
call fcn.00440530
mov ecx, edi
mov esi, dword [ebp + 8]
push esi
call fcn.00440690
test al, al
jne 0x4cf244
mov ecx, edi
push esi
call fcn.004cb4e0
test al, al
jne 0x4cf244
mov ecx, edi
call fcn.0046d580
lea esi, [esp + 0x80]
cmp word [ebx], 0
lea ebx, [ebx + 2]
jne 0x4cf210
movzx eax, word [ebx]
test ax, ax
jne 0x4cf1a9
xor ebx, ebx
lea ecx, [esp + 0x40]
call fcn.004735e0
mov ecx, dword [esp + 0xa88]
xor ecx, ebp
call fcn.0048a678
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 0x80]
push eax
call fcn.004a3276
add esp, 4
lea edx, [esi + 0xc]
lea edi, [esp + 0xc]
mov ecx, edi
push edx
push 0xffffffffffffffff
push eax
push esi
call fcn.0043f640
xor esi, esi
mov ecx, edi
lea eax, [esp + 0x78]
push eax
push esi
call fcn.0043f700
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x18], xmm0
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
movzx eax, byte [esp + 0x23]
test al, al
jns 0x4cf2a2
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
jmp 0x4cf2a6
lea edx, [esp + 0x18]
mov esi, dword [ebp + 0xc]
lea edi, [esp + 0x28]
mov ecx, edi
push eax
push edx
call fcn.00440530
mov ecx, esi
push edi
call fcn.00440650
mov ecx, edi
call fcn.0046d580
cmp byte [esp + 0x23], 0
jns 0x4cf2d8
push dword [esp + 0x18]
call fcn.00489982
add esp, 4
cmp byte [esp + 0x17], 0
jns 0x4cf2eb
push dword [esp + 0xc]
call fcn.00489982
add esp, 4
lea ecx, [esp + 0x34]
call fcn.0046d580
mov bl, 1
jmp 0x4cf223
Function at 0x4cf300
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov ebx, dword [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x58], eax
xor esi, esi
dec esi
lea edi, [esp + 0x20]
mov dword [edi + 0x34], esi
mov dword [edi + 0x30], esi
pcmpeqd xmm0, xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea eax, [esp + 0x10]
push 0x3c1
push str..._.._base_files_file_util_win.cc
push 0x50a3ef
push eax
call fcn.0046e3e0
add esp, 0x10
xor eax, eax
mov ecx, edi
push eax
lea eax, [esp + 0x14]
push eax
call fcn.004735a0
lea eax, [esp + 0x10]
mov dword [eax], esi
cmp byte [ebx + 0xb], 0
jns 0x4cf372
mov ebx, dword [ebx]
sub esp, 0x1c
xor eax, eax
mov dword [esp + 0x18], eax
movaps xmm0, xmmword [0x504680]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea edi, [esp + 0x10]
xor ecx, ecx
mov dword [edi], ecx
mov ecx, edi
push eax
call fcn.0046d4a0
mov eax, dword [edi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x4cf3e1
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor edi, edi
dec edi
lea ebx, [esp + 0xc]
mov dword [ebx], edi
push 0
push ebx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebx]
cmp ecx, esi
cmove edi, ecx
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, edi
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 2
jb 0x4cf3f8
call fcn.0046e410
push dword [esp + 0x10]
call fcn.00470b40
add esp, 4
lea ecx, [esp + 0x20]
call fcn.004735e0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0048a678
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4cf440
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp], edx
mov esi, ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x58], eax
xor eax, eax
dec eax
lea ebx, [esp + 0x20]
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x30], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0xc4
push str..._.._base_files_file_util_win.cc
push str.DoCopyFile
push edi
call fcn.0046e3e0
add esp, 0x10
mov ecx, ebx
mov ebx, edi
mov edi, esi
push 0
push ebx
call fcn.004735a0
mov ecx, esi
call fcn.0046e130
test al, al
jne 0x4cf4be
mov esi, dword [esp]
mov ecx, esi
call fcn.0046e130
test al, al
je 0x4cf4de
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.004735e0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0048a678
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [edi + 0xb]
test al, al
jns 0x4cf4e9
mov eax, dword [edi + 4]
cmp eax, 0x103
mov ecx, 0xffffffff
ja 0x4cf4be
movzx eax, byte [esi + 0xb]
test al, al
jns 0x4cf500
mov eax, dword [esi + 4]
cmp eax, 0x103
ja 0x4cf4be
mov eax, ebx
lea ebx, [esp + 4]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], ecx
mov dword [ebx], ecx
push 0xd1
push str..._.._base_files_file_util_win.cc
push str.DoCopyFile
push eax
call fcn.0046e3e0
add esp, 0x10
mov ecx, ebx
push 0x5259d8
lea eax, [esp + 0x14]
push eax
call fcn.00450b50
cmp byte [esi + 0xb], 0
jns 0x4cf546
mov esi, dword [esi]
mov al, byte [ebp + 8]
movzx eax, al
cmp byte [edi + 0xb], 0
jns 0x4cf554
mov edi, dword [edi]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4cf597
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x4cf583
mov eax, edi
and eax, 1
je 0x4cf583
mov eax, edi
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp edi, 0xffffffff
setne bl
lea ecx, [esp + 4]
call fcn.00450c50
jmp 0x4cf4c0
xor ebx, ebx
jmp 0x4cf589
Function at 0x4cf5a0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4f8
mov ebx, edx
mov esi, ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x2a4]
push 0x294
push 0xff
push edi
call fcn.0048d770
add esp, 0xc
mov ecx, edi
mov dword [ebp - 0x504], ebx
push ebx
push 3
push 0
push esi
call fcn.004d97e0
xor eax, eax
dec eax
lea esi, [ebp - 0x500]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, edi
push esi
call fcn.0044c310
movzx eax, byte [esi + 0xb]
test al, al
jns 0x4cf60d
mov eax, dword [ebp - 0x4fc]
test eax, eax
je 0x4cf774
lea ebx, [ebp - 0x4f4]
xor esi, esi
push 0x250
push 0xff
push ebx
call fcn.0048d770
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.004d9950
mov eax, dword [ebp - 0x4f4]
test al, 1
jne 0x4cf6a2
mov ecx, ebx
call fcn.004d9770
test al, al
je 0x4cf6e9
xor edi, edi
cmp byte [ebp + 8], 0
je 0x4cf721
lea ecx, [ebp - 0x500]
mov edx, dword [ebp - 0x504]
push 1
call fcn.004cf5a0
add esp, 4
mov edi, eax
test eax, eax
jne 0x4cf721
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
js 0x4cf7a3
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, 0
jmp 0x4cf707
cmp byte [ebp + 8], 0
je 0x4cf6cd
and eax, 0xfffffffe
cmp byte [ebp - 0x4f5], 0
lea ecx, [ebp - 0x500]
jns 0x4cf6c0
mov ecx, dword [ebp - 0x500]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x4cf646
mov ecx, ebx
call fcn.004d9770
test al, al
je 0x4cf769
mov ecx, ebx
call fcn.004d9770
xor edi, edi
test al, al
jne 0x4cf721
cmp byte [ebp - 0x4f5], 0
lea eax, [ebp - 0x500]
jns 0x4cf6fe
mov eax, dword [ebp - 0x500]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
test eax, eax
jne 0x4cf721
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove edi, eax
test esi, esi
cmovne edi, esi
mov ecx, ebx
call fcn.004b3dd0
lea ecx, [ebp - 0x2a4]
push ebx
call fcn.0044c310
lea ecx, [ebp - 0x500]
push ebx
call fcn.00440650
mov ecx, ebx
call fcn.0046d580
movzx eax, byte [ebp - 0x4f5]
test al, al
jns 0x4cf75d
mov eax, dword [ebp - 0x4fc]
mov esi, edi
test eax, eax
jne 0x4cf61d
jmp 0x4cf776
mov eax, dword [ebp - 0x4f4]
jmp 0x4cf6a8
xor edi, edi
lea ecx, [ebp - 0x500]
call fcn.0046d580
lea ecx, [ebp - 0x2a4]
call fcn.004d98e0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048a678
mov eax, edi
add esp, 0x4f8
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x500]
jmp 0x4cf694
Function at 0x4cfdd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x4cfe42
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4cfe46
cmp byte [ebp + 0xc], 0
je 0x4cfe22
cmp byte [esi + 4], 0
je 0x4cfe97
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, esi
push edi
call fcn.00444b20
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048a678
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [esi]
jmp 0x4cfdf4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x4cfe6c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4cfe70
xor ebx, ebx
jmp 0x4cfe2c
mov eax, dword [esi]
jmp 0x4cfe58
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 0
je 0x4cfe9e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4cfe22
mov edi, dword [ebp - 0x14]
jmp 0x4cfe22
mov eax, dword [esi]
jmp 0x4cfe16
mov eax, dword [esi]
jmp 0x4cfe83

Function at 0x4d07d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
sete al
add esp, 0x18
pop ebp
ret 4

Function at 0x4d0800
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push eax
mov eax, dword [ebp + 8]
mov edx, dword [0x520014]
xor edx, ebp
mov dword [ebp - 8], edx
mov edx, 4
lea esi, [ebp + 0xc]
push edx
push esi
push edx
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0048a678
mov eax, esi
add esp, 4
pop esi
pop ebp
ret 8

Function at 0x4d0ac0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], eax
add ecx, 0x10
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edi, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.00437320
mov ecx, esi
push edi
call fcn.004d0ec0
cmp byte [edi + 0xb], 0
jns 0x4d0b14
push dword [ebp - 0x18]
call fcn.00489982
add esp, 4
mov ecx, esi
call fcn.004d0f70
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0048a678
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret
Function at 0x4d0ec0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x14], eax
xor eax, eax
lea edi, [esp + 8]
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], eax
mov edx, edi
call fcn.004463f0
movzx eax, byte [edi + 0xb]
mov ecx, eax
test al, al
jns 0x4d0efe
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4d0f26
mov dword [esp + 4], 0
test al, al
jns 0x4d0f12
mov edi, dword [esp + 8]
lea eax, [esp + 4]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
jne 0x4d0f4a
mov al, byte [esp + 0x13]
test al, al
jns 0x4d0f36
push dword [esp + 8]
call fcn.00489982
add esp, 4
mov ecx, dword [esp + 0x14]
xor ecx, ebp
call fcn.0048a678
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret 4
mov edi, eax
mov ecx, esi
push eax
push dword [esp + 8]
call fcn.004d1150
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4d0f22
Function at 0x4d25b0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov edx, dword [ebp + 8]
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0xb8], eax
lea esi, [esp + 0x6c]
mov dword [esi], 0xffffffff
mov ecx, esi
call fcn.004d2720
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jae 0x4d261c
xor ebx, ebx
inc eax
cmp eax, 2
jb 0x4d2604
call fcn.0046e410
push dword [esp + 0x6c]
call fcn.00470b40
add esp, 4
mov ecx, dword [esp + 0xb8]
xor ecx, ebp
call fcn.0048a678
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x70]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov dword [esi + 0x40], 0xffffffff
lea eax, [esp + 0x68]
mov dword [eax], 0x44
push eax
push esi
push 0
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x4d26b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [esp + 4]
push eax
push edi
call fcn.004b86f0
add esp, 8
lea esi, [esp + 0x10]
mov ecx, esi
push edi
push 0x5c
push str.IsUserAnAdminGroup
push 1
call fcn.004b84f0
lea ecx, [esp + 0x4c]
push 0x50ab9c
push str.CreateWellKnownSid_failed
call fcn.004b45d0
mov ecx, esi
call fcn.004b8530
cmp byte [edi + 0xb], 0
jns 0x4d26ad
push dword [esp + 4]
call fcn.00489982
add esp, 4
xor ebx, ebx
mov eax, dword [esp + 0x6c]
jmp 0x4d25ed
xor eax, eax
lea edi, [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, dword [esp + 0x6c]
mov edx, 2
push edi
call fcn.004d27e0
add esp, 4
test al, al
je 0x4d2702
mov edi, dword [esp + 0x10]
xor ebx, ebx
cmp dword [edi], 0
je 0x4d2708
push dword [edi + ebx*8 + 4]
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4d26fb
inc ebx
cmp ebx, dword [edi]
jb 0x4d26e7
test eax, eax
setne bl
jmp 0x4d2708
mov edi, dword [esp + 0x10]
xor ebx, ebx
test edi, edi
je 0x4d26af
push edi
call fcn.00489982
add esp, 4
jmp 0x4d26af
Function at 0x4d3f40
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, edx
mov edi, ecx
mov eax, dword [0x520014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x4d3f61
mov eax, dword [edi]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4d4008
mov ebx, eax
mov dword [ebp - 0x28], esi
xor eax, eax
dec eax
lea esi, [ebp - 0x1c]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push ebx
call fcn.00436220
mov eax, dword [esi]
cmp byte [edi + 0xb], 0
jns 0x4d3f96
mov edi, dword [edi]
push eax
push ebx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
xor ebx, ebx
test eax, eax
je 0x4d3ff3
lea esi, [ebp - 0x20]
mov dword [esi], ebx
lea eax, [ebp - 0x24]
mov dword [eax], ebx
push esi
push eax
push 0x503808
push dword [ebp - 0x1c]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
sete al
cmp dword [esi], 0x34
setb bl
or bl, al
jne 0x4d3ff0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x30]
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x30], ecx
movups xmm0, xmmword [eax + 0x20]
movups xmmword [edx + 0x20], xmm0
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [edx + 0x10], xmm1
movups xmmword [edx], xmm0
xor bl, 1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4d400a
mov dword [ebp - 0x18], eax
push eax
call fcn.00489982
add esp, 4
jmp 0x4d400a
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048a678
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret