joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c2720
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x408
mov eax, dword [0x572844]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
mov ebx, dword [esp + 0x414]
push esi
mov esi, dword [esp + 0x414]
push edi
mov edi, dword [esp + 0x420]
push edi
push ebx
push esi
call fcn.004c0e90
test al, al
jne 0x4c27a3
push 0x200
lea eax, [esp + 0x14]
push eax
push ebx
push esi
call fcn.004c37d0
test al, al
je 0x4c27a3
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c27a3
push edi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4c27a3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051dca8
add esp, 0x408
ret 0xc

Function at 0x4c27c0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x408
mov eax, dword [0x572844]
xor eax, esp
mov dword [esp + 0x404], eax
push esi
mov esi, dword [esp + 0x410]
push edi
mov edi, dword [esp + 0x418]
push edi
push esi
push SysReAllocString
call fcn.004c0e90
test al, al
jne 0x4c2873
movzx eax, word [esi]
cmp eax, 0x5c
je 0x4c2826
test ax, ax
mov eax, 0x542618
jne 0x4c280b
mov eax, 0x54266c
push esi
push eax
push str.SoftwareWinRAR_s_s
lea eax, [esp + 0x18]
push 0x200
push eax
call fcn.00402c90
add esp, 0x14
jmp 0x4c2839
push 0x200
lea eax, [esi + 2]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.004b0360
lea eax, [esp + 8]
push eax
push 0x20006
push 0
lea eax, [esp + 0x18]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c2873
push edi
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 8]
test eax, eax
je 0x4c2873
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x40c]
pop edi
pop esi
xor ecx, esp
call fcn.0051dca8
add esp, 0x408
ret 8

Function at 0x4c2c10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x18]
push eax
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
push SysReAllocString
call fcn.004c12e0
test al, al
jne 0x4c2ca1
push edi
push esi
push SysReAllocString
call fcn.004c3850
mov edi, eax
mov dword [esp + 8], 8
test edi, edi
je 0x4c2c91
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push dword [esp + 0x30]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4c2c91
cmp dword [esp + 8], esi
je 0x4c2c91
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop edi
pop esi
add esp, 0x10
ret 0x10
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
pop edi
pop esi
add esp, 0x10
ret 0x10
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
pop esi
add esp, 0x10
ret 0x10
Function at 0x4c2cb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
push eax
mov eax, edi
cdq
push edx
push eax
push dword [esp + 0x38]
push esi
push ebx
call fcn.004c12e0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
test al, al
je 0x4c2cee
pop edi
pop esi
mov eax, ecx
pop ebx
add esp, 0x14
ret 0x10
push esi
push ebx
call fcn.004c3850
mov ebx, eax
mov dword [esp + 0xc], 4
test ebx, ebx
je 0x4c2d36
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x3c]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4c2d36
cmp dword [esp + 0xc], esi
je 0x4c2d36
mov edi, dword [esp + 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
Function at 0x4c2d50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x572844]
xor eax, esp
mov dword [esp + 0x810], eax
mov eax, dword [esp + 0x81c]
push ebx
mov ebx, dword [esp + 0x828]
push ebp
mov ebp, dword [esp + 0x830]
push esi
mov esi, dword [esp + 0x824]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x82c]
push edi
mov edi, dword [esp + 0x83c]
mov dword [esp + 0x14], eax
call fcn.004c1570
cmp byte [0x5c2ca9], 0
je 0x4c2e6e
test esi, esi
je 0x4c2dc4
cmp esi, 0x80000001
je 0x4c2dc4
cmp esi, reloc.OLEAUT32.dll_SysReAllocString
jne 0x4c2e6e
mov eax, dword [esp + 0x10]
cmp word [eax], 0x5c
je 0x4c2e6e
test esi, esi
jne 0x4c2ddd
mov eax, 0x54266c
jmp 0x4c2def
mov eax, 0x552a20
cmp esi, 0x80000001
je 0x4c2def
mov eax, str.HKLM_
push 0x400
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004b0360
push 0x400
push dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
call fcn.004b0300
push 0x400
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
push eax
call fcn.00495090
lea eax, [esp + 0x20]
push eax
call fcn.004c1390
push edi
test eax, eax
jne 0x4c2e60
test ebp, ebp
je 0x4c2e4c
push ebp
push ebx
call fcn.0051f6b0
add esp, 0xc
xor edi, edi
mov eax, edi
jmp 0x4c2efa
push 0
push ebx
call fcn.005201d0
add esp, 0xc
xor edi, edi
mov eax, edi
jmp 0x4c2efa
push ebx
push eax
call fcn.004afe10
mov edi, eax
jmp 0x4c2efa
push edi
test ebp, ebp
je 0x4c2e7c
push ebp
push ebx
call fcn.0051f6b0
jmp 0x4c2e84
push 0
push ebx
call fcn.005201d0
add esp, 0xc
cmp byte [0x570869], 0
sete al
test al, al
je 0x4c2e99
mov eax, edi
jmp 0x4c2efa
push dword [esp + 0x10]
push esi
call fcn.004c3850
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edi
test eax, eax
je 0x4c2edf
lea ecx, [esp + 0x18]
push ecx
push ebx
lea ecx, [esp + 0x24]
push ecx
push 0
push dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4c2edf
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4c2efa
push edi
test ebp, ebp
je 0x4c2eed
push ebp
push ebx
call fcn.0051f6b0
jmp 0x4c2ef5
push 0
push ebx
call fcn.005201d0
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x820]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051dca8
add esp, 0x814
ret 0x18
Function at 0x4c2f20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0x10]
push esi
mov esi, dword [esp + 0x20]
push eax
mov eax, ebx
cdq
push edx
push eax
push dword [esp + 0x30]
push esi
push SysReAllocString
call fcn.004c12e0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], ecx
test al, al
je 0x4c2f5c
pop esi
mov eax, ecx
pop ebx
add esp, 0x14
ret 0xc
push edi
push esi
push SysReAllocString
call fcn.004c3850
mov edi, eax
mov dword [esp + 0xc], 4
test edi, edi
je 0x4c2fa9
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x38]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4c2fa9
cmp dword [esp + 0xc], esi
je 0x4c2fa9
mov ebx, dword [esp + 0x10]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x14
ret 0xc

Function at 0x4c2ff0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x818
mov eax, dword [0x572844]
xor eax, esp
mov dword [esp + 0x814], eax
mov eax, dword [esp + 0x824]
push ebx
mov ebx, dword [esp + 0x824]
push ebp
mov ebp, dword [esp + 0x834]
push esi
mov esi, dword [esp + 0x828]
push edi
mov edi, dword [esp + 0x838]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
call fcn.004c1570
cmp byte [0x5c2ca9], 0
je 0x4c30d5
test esi, esi
je 0x4c3059
cmp esi, 0x80000001
je 0x4c3059
cmp esi, reloc.OLEAUT32.dll_SysReAllocString
jne 0x4c30d5
cmp word [ebx], 0x5c
je 0x4c30d5
test esi, esi
jne 0x4c306a
mov eax, 0x54266c
jmp 0x4c307c
mov eax, 0x552a20
cmp esi, 0x80000001
je 0x4c307c
mov eax, str.HKLM_
push 0x400
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004b0360
push 0x400
push ebx
lea eax, [esp + 0x2c]
push eax
call fcn.004b0300
push 0x400
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x20]
push eax
call fcn.00495090
lea eax, [esp + 0x24]
push eax
call fcn.004c1390
test eax, eax
je 0x4c30c0
mov ebp, eax
push dword [esp + 0x840]
push ebp
push edi
call fcn.004b0360
mov al, 1
jmp 0x4c316f
mov ebx, dword [esp + 0x840]
push ebx
push ebp
push edi
call fcn.004b0360
cmp byte [0x570869], 0
sete al
test al, al
je 0x4c30f6
mov al, 1
jmp 0x4c316f
push dword [esp + 0x14]
push esi
call fcn.004c3850
mov dword [esp + 0x1c], eax
mov byte [esp + 0x13], 0
test eax, eax
je 0x4c3163
lea ecx, [ebx + ebx]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x14]
push ecx
push edi
lea ecx, [esp + 0x28]
push ecx
push 0
push dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x1c]
mov esi, eax
test esi, esi
sete byte [esp + 0x17]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4c3163
mov eax, dword [esp + 0x14]
shr eax, 1
test ebx, ebx
jne 0x4c3154
xor eax, eax
mov word [edi], ax
jmp 0x4c316b
dec ebx
cmp eax, ebx
jb 0x4c315b
mov eax, ebx
xor ecx, ecx
mov word [edi + eax*2], cx
jmp 0x4c316b
push ebx
push ebp
push edi
call fcn.004b0360
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x824]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051dca8
add esp, 0x818
ret 0x18
Function at 0x4c31c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x80c
mov eax, dword [0x572844]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
mov ebx, dword [esp + 0x818]
push esi
mov esi, dword [esp + 0x818]
push edi
call fcn.004c1570
cmp byte [0x5c2ca9], 0
je 0x4c32a9
cmp word [esi], 0x5c
je 0x4c32a9
push 0x400
push 0x552a20
lea eax, [esp + 0x1c]
push eax
call fcn.004b0360
push 0x400
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.004b0300
push 0x400
lea eax, [esp + 0x18]
push eax
push ebx
push eax
call fcn.00495090
mov esi, dword [0x5c2cac]
xor edi, edi
test esi, esi
je 0x4c32b9
mov eax, dword [esi]
lea ecx, [esp + 0x14]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4c326e
test dx, dx
je 0x4c326a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4c326e
add eax, 4
add ecx, 4
test dx, dx
jne 0x4c3248
xor eax, eax
jmp 0x4c3273
sbb eax, eax
or eax, 1
test eax, eax
je 0x4c3285
mov esi, dword [esi + 0xc]
test esi, esi
jne 0x4c3242
mov eax, edi
jmp 0x4c335f
mov ecx, dword [esi + 4]
lea edx, [ecx + 2]
jmp 0x4c3290
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c3290
sub ecx, edx
sar ecx, 1
lea edi, [ecx + 1]
mov eax, edi
jmp 0x4c335f
xor edi, edi
cmp byte [0x570869], 0
sete cl
test cl, cl
je 0x4c32c0
mov eax, edi
jmp 0x4c335f
movzx eax, word [esi]
cmp eax, 0x5c
je 0x4c32f2
test ax, ax
mov eax, 0x542618
jne 0x4c32d7
mov eax, 0x54266c
push esi
push eax
push str.SoftwareWinRAR_s_s
lea eax, [esp + 0x20]
push 0x200
push eax
call fcn.00402c90
add esp, 0x14
jmp 0x4c3305
push 0x200
lea eax, [esi + 2]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004b0360
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x5c3cb4]
or eax, 9
push eax
push 0
lea eax, [esp + 0x20]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c3359
mov edi, dword [esp + 0xc]
test edi, edi
je 0x4c3359
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg esi
sbb esi, esi
not esi
and esi, dword [esp + 0x10]
jmp 0x4c335b
xor esi, esi
shr esi, 1
mov eax, esi
mov ecx, dword [esp + 0x814]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051dca8
add esp, 0x80c
ret 8
Function at 0x4c3b00
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
push edi
push esi
push SysReAllocString
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call fcn.004c1be0
test al, al
je 0x4c3b39
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret 0x10
lea eax, [esp + 8]
push eax
push esi
push SysReAllocString
call fcn.004c2010
mov esi, eax
test esi, esi
je 0x4c3b75
push 8
lea eax, [esp + 0x10]
push eax
push 0xb
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret 0x10
mov edi, dword [esp + 8]
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret 0x10

Function at 0x4c3b90
Capabilities:
Set registry value

Disassembly:
sub esp, 0x808
mov eax, dword [0x572844]
xor eax, esp
mov dword [esp + 0x804], eax
push ebx
mov ebx, dword [esp + 0x81c]
push ebp
mov ebp, dword [esp + 0x81c]
push esi
mov esi, dword [esp + 0x818]
push edi
mov edi, dword [esp + 0x820]
call fcn.004c1570
cmp byte [0x5c2ca9], 0
je 0x4c3c4b
test esi, esi
je 0x4c3be6
cmp esi, 0x80000001
je 0x4c3be6
cmp esi, reloc.OLEAUT32.dll_SysReAllocString
jne 0x4c3c4b
cmp word [edi], 0x5c
je 0x4c3c4b
test esi, esi
jne 0x4c3bf7
mov eax, 0x54266c
jmp 0x4c3c09
mov eax, 0x552a20
cmp esi, 0x80000001
je 0x4c3c09
mov eax, str.HKLM_
push 0x400
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004b0360
push 0x400
push edi
lea eax, [esp + 0x1c]
push eax
call fcn.004b0300
push 0x400
lea eax, [esp + 0x18]
push eax
push ebp
push eax
call fcn.00495090
push 1
push ebx
lea eax, [esp + 0x1c]
push eax
call fcn.004c0bb0
xor eax, eax
jmp 0x4c3ca9
cmp byte [0x570869], 0
sete al
test al, al
je 0x4c3c5d
xor eax, eax
jmp 0x4c3ca9
lea eax, [esp + 0x10]
push eax
push edi
push esi
call fcn.004c2010
mov edi, eax
test edi, edi
je 0x4c3ca3
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c3c74
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
push 0
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4c3ca7
mov esi, dword [esp + 0x10]
mov eax, esi
mov ecx, dword [esp + 0x814]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051dca8
add esp, 0x808
ret 0x10
Function at 0x4c3cd0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x808
mov eax, dword [0x572844]
xor eax, esp
mov dword [esp + 0x804], eax
push ebp
mov ebp, dword [esp + 0x814]
push esi
mov esi, dword [esp + 0x814]
push edi
mov edi, dword [esp + 0x820]
call fcn.004c1570
cmp byte [0x5c2ca9], 0
je 0x4c3d56
cmp word [esi], 0x5c
je 0x4c3d56
push 0x400
push 0x552a20
lea eax, [esp + 0x18]
push eax
call fcn.004b0360
push 0x400
push esi
lea eax, [esp + 0x18]
push eax
call fcn.004b0300
push 0x400
lea eax, [esp + 0x14]
push eax
push ebp
push eax
call fcn.00495090
push 1
push edi
lea eax, [esp + 0x18]
push eax
call fcn.004c0bb0
xor eax, eax
jmp 0x4c3dba
cmp byte [0x570869], 0
sete al
test al, al
je 0x4c3d68
xor eax, eax
jmp 0x4c3dba
push ebx
lea eax, [esp + 0x10]
push eax
push esi
push SysReAllocString
call fcn.004c2010
mov ebx, eax
test ebx, ebx
je 0x4c3db3
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c3d84
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push 0
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4c3db7
mov esi, dword [esp + 0x10]
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x810]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0051dca8
add esp, 0x808
ret 0xc

Function at 0x4c3de0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
push 0
push eax
push dword [esp + 0x20]
mov dword [esp + 0x14], eax
push esi
push SysReAllocString
call fcn.004c1be0
test al, al
je 0x4c3e0f
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
push edi
lea eax, [esp + 8]
push eax
push esi
push SysReAllocString
call fcn.004c2010
mov edi, eax
test edi, edi
je 0x4c3e4f
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push dword [esp + 0x2c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret 0xc
mov esi, dword [esp + 8]
mov eax, esi
pop edi
pop esi
add esp, 0xc
ret 0xc
Function at 0x4c3e60
Capabilities:
Set registry value

Disassembly:
sub esp, 0x808
mov eax, dword [0x572844]
xor eax, esp
mov dword [esp + 0x804], eax
push ebp
mov ebp, dword [esp + 0x818]
push esi
mov esi, dword [esp + 0x814]
push edi
mov edi, dword [esp + 0x81c]
call fcn.004c1570
cmp byte [0x5c2ca9], 0
je 0x4c3f2f
cmp word [esi], 0x5c
je 0x4c3f2f
push ebx
push 0x400
push 0x552a20
lea eax, [esp + 0x1c]
push eax
call fcn.004b0360
push 0x400
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.004b0300
push 0x400
lea eax, [esp + 0x18]
push eax
push edi
push eax
call fcn.00495090
mov ebx, dword [esp + 0x828]
xor ecx, ecx
mov edx, 2
lea edi, [ebx*4 + 1]
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0051de7f
add esp, 4
mov esi, eax
push edi
push esi
push 0
push ebx
push ebp
call fcn.004af9f0
push 2
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.004c0bb0
push esi
call fcn.0051de88
add esp, 4
xor eax, eax
pop ebx
jmp 0x4c3f7c
cmp byte [0x570869], 0
sete al
test al, al
je 0x4c3f41
xor eax, eax
jmp 0x4c3f7c
lea eax, [esp + 0xc]
push eax
push esi
push SysReAllocString
call fcn.004c2010
mov esi, eax
test esi, esi
je 0x4c3f76
push dword [esp + 0x824]
push ebp
push 3
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4c3f7a
mov edi, dword [esp + 0xc]
mov eax, edi
mov ecx, dword [esp + 0x810]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0051dca8
add esp, 0x808
ret 0x10
Function at 0x4c3fa0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push eax
push esi
mov edi, ecx
mov dword [esp + 0x18], 0
call fcn.004c42e0
test eax, eax
je 0x4c3fcf
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 8
push ebx
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004c42e0
mov dword [edi + 0x10], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004c42e0
mov dword [edi + 0x18], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004c42e0
mov dword [edi + 0x1c], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004c42e0
mov dword [edi + 0x20], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004c42e0
mov dword [edi + 0x24], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004c42e0
push ebp
mov dword [edi + 0x28], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x100
lea eax, [edi + 0x2c]
push eax
call fcn.004c4340
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004c42e0
push ebp
mov dword [edi + 0x12c], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x100
lea eax, [edi + 0x130]
push eax
call fcn.004c4340
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004c42e0
mov dword [edi + 0x230], eax
lea eax, [esp + 0x10]
push ebp
push eax
push esi
push 0x100
lea eax, [edi + 0x234]
push eax
mov ecx, edi
call fcn.004c4340
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004c42e0
mov dword [edi + 0x334], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004c42e0
mov dword [edi + 0x338], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004c42e0
push ebp
mov dword [edi + 0x33c], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x20
lea eax, [edi + 0x340]
push eax
call fcn.004c4340
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
push 0x100
lea eax, [edi + 0x380]
push eax
call fcn.004c4340
mov ecx, dword [esp + 0x10]
xor bl, bl
xor eax, eax
test ecx, ecx
je 0x4c412a
xor bl, byte [eax + esi]
inc eax
cmp eax, ecx
jb 0x4c4122
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004c42e0
movzx ecx, bl
pop ebx
pop edi
cmp ecx, eax
pop esi
sete al
pop ebp
pop ecx
ret 8
Function at 0x4c64a0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov eax, 0x4324
call fcn.0051dcc0
mov eax, dword [0x572844]
xor eax, esp
mov dword [esp + 0x4320], eax
push esi
push edi
mov edi, dword [esp + 0x4330]
push edi
call fcn.00494860
mov esi, eax
test esi, esi
je 0x4c66b9
push 0xc8
push 0x54266c
lea eax, [esp + 0x10]
push eax
push 0x54266c
push esi
push SysReAllocString
call fcn.004c2ff0
cmp word [esp + 8], 0
je 0x4c66b9
push 0xc8
push str._shellprintcommand
lea eax, [esp + 0x10]
push eax
call fcn.004b0300
push 0x800
push 0x54266c
lea eax, [esp + 0x330]
push eax
push 0x54266c
lea eax, [esp + 0x18]
push eax
push SysReAllocString
call fcn.004c2ff0
cmp word [esp + 0x328], 0
jne 0x4c65e9
push esi
push str.SoftwareClasses_s
lea eax, [esp + 0x1a0]
push 0xc8
push eax
call fcn.00402c90
add esp, 0x10
lea eax, [esp + 8]
push 0xc8
push 0x54266c
push eax
push 0x54266c
lea eax, [esp + 0x1a8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c2ff0
cmp word [esp + 8], 0
je 0x4c66b9
lea eax, [esp + 8]
push eax
push str.SoftwareClasses_s_shellprintcommand
lea eax, [esp + 0x1a0]
push 0xc8
push eax
call fcn.00402c90
add esp, 0x10
lea eax, [esp + 0x328]
push 0x800
push 0x54266c
push eax
push 0x54266c
lea eax, [esp + 0x1a8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c2ff0
cmp word [esp + 0x328], 0
je 0x4c66b9
push 0x1000
lea eax, [esp + 0x232c]
push eax
lea eax, [esp + 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4c66b9
cmp eax, 0x1000
jae 0x4c66b9
lea eax, [esp + 0x2328]
push 0x552f14
push eax
call fcn.0052053b
add esp, 8
test eax, eax
je 0x4c66b9
lea ecx, [esp + 0x2328]
cmp eax, ecx
jbe 0x4c6665
cmp word [eax - 2], 0x22
jne 0x4c6665
xor ecx, ecx
push 0x1000
mov word [eax], cx
lea eax, [esp + 0x232c]
push edi
push eax
call fcn.004b0300
mov edi, 0x552a1c
jmp 0x4c666a
xor ecx, ecx
mov word [eax], cx
push 0x1000
lea eax, [esp + 0x232c]
push edi
push eax
call fcn.004b0300
push 0x800
lea eax, [esp + 0x132c]
push eax
lea eax, [esp + 0x2330]
push eax
call fcn.004afad0
push 8
push 0
push eax
lea eax, [esp + 0x1334]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta al
jmp 0x4c66bb
xor al, al
mov ecx, dword [esp + 0x4328]
pop edi
pop esi
xor ecx, esp
call fcn.0051dca8
add esp, 0x4324
ret 4