joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478e30
Capabilities:
Copy file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov ecx, esi
push edi
cmp dword [esi + 0x14], 8
jb 0x478e40
mov ecx, dword [esi]
mov edi, dword [esp + 0xc]
mov edx, edi
cmp dword [edi + 0x14], 8
jb 0x478e4e
mov edx, dword [edi]
xor eax, eax
cmp dword [esp + 0x14], eax
sete al
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x478e6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x478e6e
xor eax, eax
push str.boost::filesystem::copy_file
push dword [esp + 0x1c]
push esi
push edi
push eax
call fcn.00479ca0
add esp, 0x14
pop edi
pop esi
ret

Function at 0x478e90
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d04dd
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x640844]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, edi
mov esi, dword [ebp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x478ecb
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x478ef1
test esi, esi
je 0x478eed
mov dword [esi], 0
mov byte [esi + 4], 0
mov dword [esi + 8], 0x5e1888
mov al, 1
jmp 0x478f49
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x68], 0
lea eax, [ebp - 0x68]
mov byte [ebp - 0x64], 0
push eax
lea eax, [ebp - 0x70]
mov dword [ebp - 0x60], 0x5e1888
push edi
push eax
call fcn.0047a7f0
add esp, 0xc
cmp dword [ebp - 0x70], 3
jne 0x478f32
test esi, esi
je 0x478f47
mov dword [esi], 0
mov byte [esi + 4], 0
jmp 0x478f40
test esi, esi
je 0x478f65
test ebx, ebx
mov dword [esi], ebx
setne al
mov byte [esi + 4], al
mov dword [esi + 8], 0x5e1888
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed0cc
mov esp, ebp
pop ebp
ret
push str.boost::filesystem::create_directory
lea ecx, [ebp - 0x28]
call fcn.00475070
mov dword [ebp - 4], 0
call fcn.00475a50
push eax
push ebx
lea ecx, [ebp - 0x7c]
call fcn.004750b0
sub esp, 0xc
mov ecx, esp
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea eax, [ebp - 0x28]
push edi
push eax
lea ecx, [ebp - 0x5c]
call fcn.00478380
push 0x6331ac
lea eax, [ebp - 0x5c]
push eax
call fcn.004ee6eb
int3
Function at 0x47a240
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x47a253
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x47a27b
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.0047a110
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x18]
test eax, eax
je 0x47a294
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x5e1888
test ebx, 0x400
je 0x47a2ca
push esi
call fcn.00479f00
add esp, 4
test al, al
je 0x47a2bf
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
add esp, 8
ret
pop esi
mov eax, 9
pop ebx
add esp, 8
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x47a6a0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
cmp eax, 1
jne 0x47a6cd
mov eax, dword [esp + 0x14]
test eax, eax
je 0x47a756
pop edi
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x5e1888
xor al, al
pop esi
ret
cmp eax, 3
je 0x47a6ee
cmp eax, 0xb
je 0x47a6ee
mov esi, dword [esp + 0xc]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x47a6e5
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x47a703
mov esi, dword [esp + 0xc]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x47a6fc
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x47a73d
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
je 0x47a73d
cmp eax, 3
je 0x47a73d
cmp eax, 0x7b
je 0x47a73d
cmp eax, 0xf
je 0x47a73d
cmp eax, 0x15
je 0x47a73d
cmp eax, 0x57
je 0x47a73d
cmp eax, 0xa1
je 0x47a73d
cmp eax, 0x35
je 0x47a73d
call edi
jmp 0x47a73f
xor eax, eax
push str.boost::filesystem::remove
push dword [esp + 0x18]
push esi
push eax
call fcn.00479d70
add esp, 0x10
test al, al
je 0x47a75b
pop edi
xor al, al
pop esi
ret
pop edi
mov al, 1
pop esi
ret
Function at 0x47a7f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d077d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x640844]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2c], esi
cmp dword [edi + 0x14], 8
jb 0x47a831
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
jne 0x47a850
push esi
push edi
push ebx
call fcn.0047a110
add esp, 0xc
jmp 0x47a998
test eax, 0x400
je 0x47a967
cmp dword [edi + 0x14], 8
mov edx, edi
jb 0x47a865
mov edx, dword [edi]
mov ecx, edx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47a880
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0041b0d0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x34], esi
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], 0
cmp edx, 8
jb 0x47a900
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47a8f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a9b6
push edx
push ecx
call fcn.004ece5f
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp esi, 0xffffffff
jne 0x47a928
push dword [ebp - 0x2c]
push edi
push ebx
call fcn.0047a110
add esp, 0xc
jmp 0x47a998
push edi
call fcn.00479f00
add esp, 4
test al, al
jne 0x47a953
push dword [ebp - 0x30]
push edi
call fcn.00479fe0
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x47a998
push esi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
test esi, esi
je 0x47a97c
mov dword [esi], 0
mov byte [esi + 4], 0
mov dword [esi + 8], 0x5e1888
push eax
push edi
mov esi, eax
call fcn.00479fe0
xor ecx, ecx
mov dword [ebx + 4], eax
add esp, 8
and esi, 0x10
setne cl
add ecx, 2
mov dword [ebx], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed0cc
mov esp, ebp
pop ebp
ret
call fcn.004f242f
int3
Function at 0x47add0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d084d
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x640844]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
push 0
push eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x50], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, eax
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0x4c], edx
xor esi, esi
mov dword [ebp - 0x1c], ecx
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edi
test edx, edx
je 0x47ae6d
cmp edx, 0x7fffffff
ja 0x47aff0
push edx
lea ecx, [ebp - 0x1c]
call fcn.0041b070
mov esi, eax
mov eax, dword [ebp - 0x4c]
add eax, eax
mov dword [ebp - 0x1c], esi
push eax
push 0
push esi
lea edi, [eax + esi]
mov dword [ebp - 0x14], edi
call fcn.004ef230
add esp, 0xc
mov dword [ebp - 0x18], edi
mov eax, edi
mov ecx, esi
mov dword [ebp - 4], 0
cmp esi, eax
je 0x47aec8
sub eax, esi
sar eax, 1
push eax
push ecx
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x47aec8
mov ecx, esi
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47aea5
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.0041b0d0
lea ecx, [ebp - 0x40]
mov eax, 5
jmp 0x47aee5
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov eax, 6
mov dword [ebp - 0x14], 7
mov edx, dword [ebp - 0x48]
movups xmm0, xmmword [ecx]
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
movups xmmword [edx], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [edx + 0x10], xmm0
xor edx, edx
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], dx
test al, 2
je 0x47af66
mov edx, dword [ebp - 0x14]
and eax, 0xfffffffd
mov dword [ebp - 0x44], eax
cmp edx, 8
jb 0x47af66
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47af59
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47afeb
push edx
push ecx
call fcn.004ece5f
mov eax, dword [ebp - 0x44]
add esp, 8
test al, 1
je 0x47afa0
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x47afa0
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47af96
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47afeb
push edx
push ecx
call fcn.004ece5f
add esp, 8
test esi, esi
je 0x47afcd
sub edi, esi
and edi, 0xfffffffe
cmp edi, 0x1000
jb 0x47afc3
mov ecx, dword [esi - 4]
add edi, 0x23
sub esi, ecx
lea eax, [esi - 4]
cmp eax, 0x1f
ja 0x47afeb
mov esi, ecx
push edi
push esi
call fcn.004ece5f
add esp, 8
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed0cc
mov esp, ebp
pop ebp
ret
call fcn.004f242f
call fcn.00427420
int3
Function at 0x47b460
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d0948
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x640844]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x647438
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x647438
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x5de8c4
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00484ae0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47c650
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d0a9d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x640844]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x47c6a1
push ebx
push ebx
push ebx
push 2
call fcn.0047f2e0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [edi + 0x18]
test esi, esi
je 0x47c6b7
mov ecx, esi
mov esi, dword [esi + 0x28]
push 1
mov eax, dword [ecx]
call dword [eax]
test esi, esi
jne 0x47c6a8
push 2
push 0
push ebx
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0xffffffff
call fcn.004f83fd
push ebx
call fcn.004fb589
push 0
mov esi, eax
push 0
push ebx
mov dword [ebp - 0x14], esi
call fcn.004f83fd
add esp, 0x1c
test esi, esi
jg 0x47c71e
push 0
push 0
push 0
push 0xd
mov ecx, edi
call fcn.0047f2e0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x10], 0x647438
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.00484bc0
lea eax, [esi + 1]
push eax
call fcn.004ed176
push ebx
push 1
mov ebx, eax
mov dword [ebp + 8], eax
push esi
push ebx
mov byte [eax], 0
call fcn.004fadcb
add esp, 0x14
cmp eax, 1
je 0x47c777
push ebx
call fcn.004ed17f
add esp, 4
mov ecx, edi
push 0
push 0
push 0
push 2
call fcn.0047f2e0
xor bl, bl
jmp 0x47c815
mov eax, dword [ebp - 0x14]
mov ecx, ebx
mov esi, ebx
mov byte [ebx + eax], 0
mov al, byte [ebx]
test al, al
je 0x47c7df
cmp al, 0xa
jne 0x47c7a0
mov eax, esi
sub eax, ecx
inc eax
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00484a90
inc esi
mov ecx, esi
jmp 0x47c7d9
cmp al, 0xd
jne 0x47c7d8
mov eax, esi
sub eax, ecx
test eax, eax
jle 0x47c7b6
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00484a90
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xa
push eax
lea ecx, [ebp - 0x10]
call fcn.00484a90
xor eax, eax
cmp byte [esi + 1], 0xa
sete al
inc eax
add esi, eax
mov ecx, esi
jmp 0x47c7d9
inc esi
mov al, byte [esi]
test al, al
jne 0x47c788
sub esi, ecx
je 0x47c7ed
push esi
push ecx
lea ecx, [ebp - 0x10]
call fcn.00484a90
push ebx
call fcn.004ed17f
mov eax, dword [ebp - 0x10]
add esp, 4
mov edx, dword [edi]
add eax, 8
mov ecx, edi
push dword [ebp + 0xc]
push 0
push eax
call dword [edx + 8]
cmp byte [edi + 0x2c], 0
je 0x47c813
xor bl, bl
jmp 0x47c815
mov bl, 1
mov ecx, dword [ebp - 0x10]
cmp ecx, 0x647438
je 0x47c829
push ecx
call fcn.004ed17f
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x489430
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1716
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x640844]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x44], ebx
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
xor eax, eax
mov dword [ebx + 0x18], 0
mov dword [ebp - 4], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 7
mov word [ebx + 0x18], ax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], 7
mov word [ebx + 0x30], ax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], 3
mov dword [ebx + 0x48], eax
mov ecx, edx
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4894e0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0041b0d0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, edx
mov byte [ebp - 4], 4
lea edi, [ecx + eax*2]
mov eax, dword [ebp - 0x14]
cmp eax, 8
mov ecx, ebx
cmovae esi, edx
cmp esi, edi
je 0x48958f
movzx ebx, word [esi]
add esi, 2
mov edx, ebx
lea eax, [edx - 0xd800]
cmp eax, 0x3ff
ja 0x489565
cmp esi, edi
je 0x4895b7
movzx eax, word [esi]
add esi, 2
movzx ebx, ax
mov dword [ebp - 0x2c], eax
lea eax, [ebx - 0xdc00]
cmp eax, 0x3ff
ja 0x4895e9
shl edx, 0xa
add edx, 0xfca02400
add edx, ebx
jmp 0x489572
lea eax, [edx - 0xdc00]
cmp eax, 0x3ff
jbe 0x4895b7
push ecx
push edx
lea eax, [ebp - 0x48]
push eax
call fcn.004881c0
add esp, 0xc
mov ecx, dword [eax]
cmp esi, edi
jne 0x489522
mov edx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4895c4
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4895ba
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4895e4
jmp 0x4895ba
push ebx
jmp 0x4895ec
push ecx
push edx
call fcn.004ece5f
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed0cc
mov esp, ebp
pop ebp
ret 4
call fcn.004f242f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x40]
call fcn.00489060
push 0x634198
lea eax, [ebp - 0x40]
push eax
call fcn.004ee6eb
int3
Function at 0x48a800
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d178e
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x640844]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [ebp + 0x10], 0xffffffff
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], 0
jne 0x48a851
lea eax, [ebp - 0x4c]
push eax
call fcn.00489c80
jmp 0x48a8af
mov edx, dword [edi + 0x14]
cmp edx, 0x10
jb 0x48a85b
mov ecx, dword [edi]
mov eax, dword [edi + 0x10]
mov ebx, edi
add eax, ecx
cmp edx, 0x10
jb 0x48a869
mov ebx, dword [edi]
mov ecx, edi
jb 0x48a86f
mov ecx, dword [edi]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], eax
cmp ecx, ebx
jb 0x48a99f
cmp eax, ecx
jb 0x48a99f
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
add ebx, esi
je 0x48a8a9
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00439350
add esp, 8
sub ebx, 1
je 0x48a8a9
mov eax, dword [ebp - 0x1c]
jmp 0x48a892
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x24]
movq xmm0, qword [eax]
mov ecx, edi
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
movq qword [ebp - 0x34], xmm0
call fcn.00489c20
test esi, esi
je 0x48a8e4
nop dword [eax]
push dword [ebp - 0x1c]
lea eax, [ebp - 0x24]
push eax
call fcn.00439350
add esp, 8
sub esi, 1
jne 0x48a8d0
movq xmm0, qword [ebp - 0x34]
xor eax, eax
mov ecx, dword [ebp - 0x14]
sub esp, 0x10
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
mov dword [ebx + 0x18], 0
mov word [ebx + 0x18], ax
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 7
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x40], eax
mov word [ebx + 0x30], ax
mov dword [ebx + 0x44], 7
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x48], eax
mov eax, esp
mov dword [ebx + 0x5c], 3
sub esp, 0x10
mov edx, esp
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 2
movq qword [eax], xmm0
movq xmm0, qword [ebp - 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0xc], 0
movq qword [edx], xmm0
mov dword [edx + 8], ecx
mov ecx, ebx
mov dword [edx + 0xc], 0
call fcn.004882b0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed0cc
mov esp, ebp
pop ebp
ret 0xc
push str.Invalid_utf_8_iterator_position
lea ecx, [ebp - 0x38]
call fcn.004890d0
push 0x63415c
lea eax, [ebp - 0x38]
push eax
call fcn.004ee6eb
int3
Function at 0x48de90
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1d55
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x640844]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.0048daf0
mov esi, dword [ebx + 0xd4]
lea edi, [ebx + 0xd4]
mov ecx, edi
push dword [esi + 4]
push edi
call fcn.00452b30
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], esi
mov dword [edi + 4], 0
lea edi, [ebx + 4]
mov eax, dword [ebx + 0xc8]
cmp eax, reloc.WS2_32.dll_accept
jne 0x48df15
mov ecx, edi
call fcn.00489750
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
sete al
jmp 0x48dfba
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
je 0x48df23
xor al, al
jmp 0x48dfba
push str.Advapi32.dll
lea ecx, [ebp - 0x70]
call fcn.004892c0
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
mov dword [ebp - 0x78], vtable.ScopedDLL.0
call fcn.00489750
push eax
call fcn.00438170
mov esi, eax
mov dword [ebp - 0x74], esi
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.00419a70
test esi, esi
jne 0x48df7b
mov ecx, edi
call fcn.00489750
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
sete al
jmp 0x48dfba
push str.RegDeleteKeyExW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x48dfa5
mov ecx, edi
call fcn.00489750
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
sete bl
jmp 0x48dfb1
push eax
push edi
call fcn.0048f600
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed0cc
mov esp, ebp
pop ebp
ret

Function at 0x48dfe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
je 0x48e048
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x10], 0
je 0x48e048
lea eax, [ebp - 8]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0
call fcn.00489750
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48e048
cmp dword [ebp - 4], 4
jne 0x48e048
cmp dword [ebp - 8], 4
jne 0x48e048
cmp dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
setne cl
mov byte [eax], cl
mov al, 1
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x48e0b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x48e19a
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x10], 0
je 0x48e19a
lea ecx, [ebp - 4]
mov dword [ebp - 8], 3
push ecx
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
push 0
mov ecx, eax
call fcn.00489750
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48e19a
cmp dword [ebp - 8], 3
jne 0x48e19a
mov esi, dword [ebp - 4]
test esi, esi
je 0x48e19a
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 4]
mov ecx, eax
mov edx, dword [edi]
sub ecx, edx
mov dword [ebp + 8], eax
cmp esi, ecx
jae 0x48e12f
lea eax, [edx + esi]
jmp 0x48e163
jbe 0x48e166
mov eax, dword [edi + 8]
sub eax, edx
cmp esi, eax
jbe 0x48e14b
lea eax, [ebp + 0xb]
mov ecx, edi
push eax
push esi
call fcn.0043c490
mov esi, dword [ebp - 4]
jmp 0x48e166
sub esi, ecx
push esi
push 0
push dword [ebp + 8]
call fcn.004ef230
mov eax, dword [ebp + 8]
add esp, 0xc
add eax, esi
mov esi, dword [ebp - 4]
mov dword [edi + 4], eax
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push dword [edi]
lea eax, [ebp - 8]
push eax
push 0
call fcn.00489750
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
pop edi
test eax, eax
jne 0x48e19a
cmp dword [ebp - 8], 3
jne 0x48e19a
cmp dword [ebp - 4], esi
jne 0x48e19a
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48e430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
je 0x48e493
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x10], 0
je 0x48e493
lea eax, [ebp - 8]
mov dword [ebp - 4], 0xb
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 4]
mov dword [ebp - 8], 8
push eax
push 0
call fcn.00489750
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48e493
mov eax, dword [ebp - 4]
cmp eax, 0xb
je 0x48e480
cmp eax, 4
jne 0x48e493
mov eax, dword [ebp - 8]
cmp eax, 8
je 0x48e48d
cmp eax, 4
jne 0x48e493
mov al, 1
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret