joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f740
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
lea eax, [esp]
push esi
mov esi, dword [esp + 0x30]
push edi
push eax
push esi
call fcn.00458560
lea ecx, [esp + 0x10]
add esp, 8
push ecx
call fcn.004584c0
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
add esp, 4
push eax
push ecx
push esi
call fcn.004588b0
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
add esp, 0xc
cmp word [esi], 0
push edi
je 0x45f799
lea eax, [esi + 2]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.004588b0
add esp, 0xc
jmp 0x45f7a1
call fcn.00458540
add esp, 4
xor dx, dx
movsx eax, dx
shl eax, 2
inc dx
mov ecx, dword [esi + eax + 0x16]
xor ecx, dword [esp + eax + 0x1c]
xor dword [edi + eax], ecx
movsx eax, dx
cmp eax, 5
jb 0x45f7a4
pop edi
pop esi
add esp, 0x28
ret

Function at 0x45f7d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x64
lea eax, [esp + 0x28]
push ebx
push esi
push edi
push ebp
push eax
call fcn.00458540
lea eax, [esp + 0x50]
add esp, 4
push eax
call fcn.00458540
xor cx, cx
mov ebx, dword [esp + 0x80]
mov esi, dword [esp + 0x7c]
add esp, 4
movsx eax, cx
inc cx
lea edi, [eax*4]
lea eax, [edi + ebx]
lea edx, [edi + esi]
mov ebp, dword [eax]
mov eax, dword [eax + 0x14]
xor ebp, dword [edx]
xor eax, dword [edx + 0x14]
movsx edx, cx
mov dword [esp + edi + 0x38], ebp
mov dword [esp + edi + 0x4c], eax
cmp edx, 5
jb 0x45f7ff
lea eax, [esp + 0x60]
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.00458bf0
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x54]
lea eax, [esp + 0x68]
add esp, 8
push ecx
push edx
push eax
call fcn.004588b0
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x30]
add esp, 0xc
push ecx
push edx
call fcn.00458560
lea ecx, [esp + 0x18]
add esp, 8
push ecx
call fcn.004584c0
mov ecx, dword [esp + 0x88]
add esp, 4
cmp word [ecx], 0
je 0x45f8b1
xor dx, dx
mov edi, dword [esp + 0x80]
movsx eax, dx
shl eax, 2
inc dx
mov ebp, dword [eax + ecx + 2]
xor ebp, dword [eax + ebx]
xor ebp, dword [eax + esi]
xor ebp, dword [esp + eax + 0x10]
xor ebp, dword [esp + eax + 0x24]
mov dword [eax + edi], ebp
movsx eax, dx
cmp eax, 5
jb 0x45f88a
jmp 0x45f8dc
xor cx, cx
mov edi, dword [esp + 0x80]
movsx eax, cx
shl eax, 2
inc cx
mov edx, dword [eax + ebx]
xor edx, dword [eax + esi]
xor edx, dword [esp + eax + 0x10]
xor edx, dword [esp + eax + 0x24]
mov dword [eax + edi], edx
movsx eax, cx
cmp eax, 5
jb 0x45f8bb
xor dx, dx
movsx eax, dx
shl eax, 2
inc dx
mov ecx, dword [eax + edi]
xor ecx, dword [eax + esi]
mov dword [esp + eax + 0x38], ecx
movsx eax, dx
cmp eax, 5
jb 0x45f8df
lea eax, [esp + 0x10]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x38]
push eax
push ecx
push edx
call fcn.004588b0
xor dx, dx
add esp, 0xc
movsx eax, dx
inc dx
mov ebx, dword [esi + eax*4 + 0x14]
xor ebx, dword [esp + eax*4 + 0x10]
lea ecx, [eax*4]
lea eax, [ecx + edi]
xor ebx, dword [eax]
mov dword [eax + 0x14], ebx
movsx eax, dx
cmp eax, 5
jb 0x45f913
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x64
ret
Function at 0x45f940
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x64
lea eax, [esp + 0x28]
push ebx
push esi
push edi
mov esi, dword [esp + 0x74]
push eax
push esi
call fcn.00458bf0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x3c]
add esp, 8
lea eax, [esi + 0x14]
push ecx
push eax
push edx
call fcn.004588b0
xor dx, dx
add esp, 0xc
movsx eax, dx
shl eax, 2
inc dx
mov ecx, dword [eax + esi]
xor ecx, dword [esp + eax + 0xc]
mov dword [esp + eax + 0x20], ecx
movsx eax, dx
cmp eax, 5
jb 0x45f971
lea eax, [esp + 0x48]
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.00458560
lea ecx, [esp + 0x50]
add esp, 8
push ecx
call fcn.004584c0
mov edx, dword [esp + 0x80]
add esp, 4
cmp word [edx], 0
je 0x45f9e0
xor cx, cx
mov edi, dword [esp + 0x78]
movsx eax, cx
shl eax, 2
inc cx
mov ebx, dword [eax + edx + 2]
xor ebx, dword [esp + eax + 0x20]
xor ebx, dword [esp + eax + 0x48]
mov dword [eax + edi], ebx
movsx eax, cx
cmp eax, 5
jb 0x45f9bf
jmp 0x45fa02
xor dx, dx
mov edi, dword [esp + 0x78]
movsx eax, dx
shl eax, 2
inc dx
mov ecx, dword [esp + eax + 0x20]
xor ecx, dword [esp + eax + 0x48]
mov dword [eax + edi], ecx
movsx eax, dx
cmp eax, 5
jb 0x45f9e7
xor cx, cx
mov edx, 0xffffffff
movsx eax, cx
inc cx
mov dword [esp + eax*4 + 0xc], edx
movsx ebx, cx
cmp ebx, 5
jb 0x45fa0a
and dword [esp + 0xc], 0x3fffffff
xor dx, dx
movsx eax, dx
shl eax, 2
inc dx
mov ecx, dword [esp + eax + 0x20]
xor dword [esp + eax + 0xc], ecx
movsx eax, dx
cmp eax, 5
jb 0x45fa26
lea eax, [esp + 0x5c]
lea ecx, [esp + 0xc]
push eax
push edi
push ecx
call fcn.004588b0
lea ecx, [esp + 0x40]
add esp, 0xc
push ecx
push esi
call fcn.00458560
lea ecx, [esp + 0x3c]
add esp, 8
push ecx
call fcn.004584c0
xor dx, dx
add esp, 4
movsx eax, dx
shl eax, 2
inc dx
mov ecx, dword [esp + eax + 0x5c]
xor ecx, dword [esp + eax + 0x34]
mov dword [eax + edi + 0x14], ecx
movsx eax, dx
cmp eax, 5
jb 0x45fa6f
pop edi
pop esi
pop ebx
add esp, 0x64
ret

Function at 0x45faa0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
lea eax, [esp]
push esi
mov esi, dword [esp + 0x34]
push edi
push eax
push esi
xor di, di
call fcn.00458560
lea ecx, [esp + 0x24]
add esp, 8
push ecx
call fcn.00458540
add esp, 4
movsx eax, di
inc di
lea ecx, [eax*4]
mov edx, dword [esi + ecx + 0x14]
lea eax, [esi + ecx]
xor edx, dword [eax]
movsx eax, di
mov dword [esp + ecx + 0x1c], edx
cmp eax, 5
jb 0x45fac7
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 8]
push eax
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
call fcn.0045f7d0
add esp, 0x10
pop edi
pop esi
add esp, 0x28
ret
Function at 0x4665c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x4665ed
call fcn.00402d03
mov dword [eax], esi
call fcn.00402cf0
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00402c91
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x4665c9
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46661c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d16
pop ecx
call fcn.00402cf0
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x466643
test al, 1
je 0x466643
test byte [esp + 0xc], 2
je 0x466643
call fcn.00402d03
mov dword [eax], 5
call fcn.00402cf0
mov dword [eax], 0xd
jmp 0x466613
xor eax, eax
pop esi
ret
Function at 0x467875
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4678b2
cmp dword [ebp + 0x14], edi
je 0x4678b2
cmp ecx, edi
jne 0x4678b9
call fcn.00402cf0
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00402c91
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4678cd
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4678ee
cmp ebx, 0xffffffff
je 0x4678dd
push ebx
push edi
push ecx
call fcn.004054d0
add esp, 0xc
cmp esi, edi
je 0x46789a
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x46789a
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x46790a
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x467911
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x467a02
test word [esi + 0xc], 0x10c
je 0x467965
mov eax, dword [esi + 4]
test eax, eax
je 0x467965
jl 0x467a63
cmp ebx, eax
mov edi, ebx
jb 0x467936
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x467a0a
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0046e307
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4679fa
cmp ebx, dword [ebp - 0xc]
jb 0x4679d2
cmp dword [ebp - 0xc], 0
je 0x46798f
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x467984
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x46798b
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x46799a
mov eax, SysReAllocString
cmp ebx, eax
ja 0x46799a
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x467a36
push eax
push dword [ebp - 8]
push esi
call fcn.00469701
pop ecx
push eax
call fcn.0046c197
add esp, 0xc
test eax, eax
je 0x467a75
cmp eax, 0xffffffff
je 0x467a63
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4679fa
push esi
call fcn.00469973
cmp eax, 0xffffffff
pop ecx
je 0x467a67
cmp dword [ebp - 4], 0
je 0x467a36
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x467919
mov eax, dword [ebp + 0x14]
jmp 0x4678b4
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x467a21
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.004054d0
add esp, 0xc
call fcn.00402cf0
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4678aa
cmp dword [ebp + 0xc], 0xffffffff
je 0x467a4c
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004054d0
add esp, 0xc
call fcn.00402cf0
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4678aa
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4678b4
or dword [esi + 0xc], 0x10
jmp 0x467a67
Function at 0x46e4e8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x46e515
call fcn.00402d03
mov dword [eax], esi
call fcn.00402cf0
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00402c91
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x46e4f1
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x46e544
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402d16
pop ecx
call fcn.00402cf0
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x46e56b
test al, 1
je 0x46e56b
test byte [esp + 0xc], 2
je 0x46e56b
call fcn.00402d03
mov dword [eax], 5
call fcn.00402cf0
mov dword [eax], 0xd
jmp 0x46e53b
xor eax, eax
pop esi
ret
Function at 0x475da0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 1
jmp 0x475dbf
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jge 0x475e0a
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
push 0x564e04
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4]
push edx
call fcn.004043e0
add esp, 8
test eax, eax
je 0x475e08
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4]
push edx
push 0x564e0c
mov eax, dword [0x5d3d1c]
push eax
call fcn.00463647
add esp, 0xc
jmp 0x475db6
cmp dword [ebp - 8], 0
je 0x475e1c
call fcn.00475140
push 1
call fcn.0040153c
mov esp, ebp
pop ebp
ret

Function at 0x4764b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
push str.Usage:__s__n
call fcn.00463796
add eax, 0x20
push eax
call fcn.00463647
add esp, 0xc
push str._c_license_file
push 0x5651a4
call fcn.00463796
add eax, 0x20
push eax
call fcn.00463647
add esp, 0xc
push str._vendor___vendor_name_
push 0x5651c8
call fcn.00463796
add eax, 0x20
push eax
call fcn.00463647
add esp, 0xc
push str._command_
push str._____s__n
call fcn.00463796
add eax, 0x20
push eax
call fcn.00463647
add esp, 0xc
push str.D___Debug_logging_on
push 0x565204
call fcn.00463796
add eax, 0x20
push eax
call fcn.00463647
add esp, 0xc
push str.d___Debug_logging_off
push 0x56522c
call fcn.00463796
add eax, 0x20
push eax
call fcn.00463647
add esp, 0xc
push str.F___dump_feature_database_to_log_file__vendor_daemon_only_
push 0x565278
call fcn.00463796
add eax, 0x20
push eax
call fcn.00463647
add esp, 0xc
push str.daemons___dump_daemon_info_from_lmgrd_to_the_log_file
push str._________s__n
call fcn.00463796
add eax, 0x20
push eax
call fcn.00463647
add esp, 0xc
push 1
call fcn.0040153c
pop ebp
ret
Function at 0x47d9d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov dword [ebp - 4], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 2
jne 0x47da09
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [ebp - 4], edx
jmp 0x47dabe
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0xc], 1
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call fcn.00469701
add esp, 4
push eax
call fcn.0047db70
add esp, 8
test eax, eax
je 0x47da43
jmp 0x47db62
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
add ecx, 1
push ecx
call fcn.00405bab
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jne 0x47da6c
jmp 0x47db62
mov eax, dword [ebp - 0x50]
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.004054d0
add esp, 0xc
mov edx, dword [ebp - 0x50]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call fcn.00469701
add esp, 4
push eax
call fcn.0046c197
add esp, 0xc
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jle 0x47dabe
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x4c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x50]
sub ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x50], ecx
jmp 0x47da81
cmp dword [ebp - 4], 0
je 0x47db01
lea edx, [ebp - 0x48]
push edx
mov eax, dword [0x589f34]
mov ecx, dword [eax + 0xe8]
mov edx, dword [0x589f34]
mov eax, dword [edx + 0xe4]
mov ecx, dword [eax + ecx*4]
push ecx
push 0x14
push 0x568618
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x589f34]
push ecx
call fcn.0049a190
add esp, 0x1c
cmp dword [ebp - 0xc], 0
je 0x47db19
mov edx, dword [ebp - 4]
push edx
mov eax, dword [0x589f34]
push eax
call fcn.00499730
add esp, 8
cmp dword [ebp - 0x48], 0
je 0x47db4a
mov ecx, dword [ebp - 0x48]
push ecx
push str.ERRORS:__s_n
mov edx, dword [0x5d3d1c]
push edx
call fcn.00463647
add esp, 0xc
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [0x589f34]
push ecx
call fcn.00499730
add esp, 8
cmp dword [ebp - 0x44], 0
je 0x47db62
mov edx, dword [ebp - 0x44]
push edx
mov eax, dword [0x589f34]
push eax
call fcn.00499730
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x4802b0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x563a68]
xor eax, ebp
mov dword [ebp - 0xc], eax
push esi
mov byte [ebp - 0x410], 0
push 0x3ff
push 0
lea eax, [ebp - 0x40f]
push eax
call fcn.004054d0
add esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x818], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x817]
push ecx
call fcn.004054d0
add esp, 0xc
mov dword [ebp - 0x414], 0x400
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x58]
push eax
push 0x569858
lea ecx, [ebp - 0x410]
push ecx
call fcn.004633a8
add esp, 0xc
lea edx, [ebp - 8]
push edx
push 0x20007
push 0
push 0x569864
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4803e4
push str.Error:_unable_to_delete_local_borrow_info._n
mov eax, dword [0x5d3d1c]
push eax
call fcn.00463647
add esp, 8
cmp dword [0x589f34], 0
je 0x4803d3
mov ecx, dword [0x589f34]
cmp dword [ecx + 0x80], 0
je 0x480396
xor edx, edx
je 0x480396
mov eax, dword [0x589f34]
mov ecx, dword [eax + 0x80]
mov dword [ebp - 0x81c], ecx
jmp 0x4803a0
mov dword [ebp - 0x81c], 0xffffff86
mov edx, dword [0x589f34]
mov eax, dword [ebp - 0x81c]
mov dword [edx + 0x80], eax
push 0
push 0xff
push 0
push 0
push 0x24f
push 0xffffffffffffff86
mov ecx, dword [0x589f34]
push ecx
call fcn.00495fc0
add esp, 0x1c
mov edx, dword [0x589f34]
mov eax, dword [edx + 0x80]
jmp 0x4804f1
mov eax, dword [ebp - 4]
mov dword [ebp - 0x820], eax
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x818]
push edx
mov eax, dword [ebp - 0x820]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
test eax, eax
jne 0x4804e5
mov eax, dword [ebp - 0x414]
mov byte [ebp + eax - 0x818], 0
lea ecx, [ebp - 0x410]
push ecx
call fcn.004035e0
add esp, 4
push eax
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0x818]
push eax
call fcn.00408106
add esp, 0xc
test eax, eax
jne 0x4804d6
mov ecx, dword [ebp + 0xc]
add ecx, 4
push ecx
call fcn.004035e0
add esp, 4
push eax
mov edx, dword [ebp + 0xc]
add edx, 4
push edx
lea eax, [ebp - 0x818]
push eax
call fcn.004035e0
add esp, 4
mov esi, eax
mov ecx, dword [ebp + 0xc]
add ecx, 4
push ecx
call fcn.004035e0
add esp, 4
sub esi, eax
lea edx, [ebp + esi - 0x818]
push edx
call fcn.00408106
add esp, 0xc
test eax, eax
jne 0x4804d6
lea eax, [ebp - 0x818]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x5698b8
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp + 0xc]
push eax
call fcn.00480500
add esp, 4
mov dword [ebp - 0x414], 0x400
jmp 0x4803e4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0040526d
mov esp, ebp
pop ebp
ret
Function at 0x487480
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x563a68]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x58b3f0], 0
jne 0x487521
push 0x94
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.004054d0
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x487517
cmp dword [ebp - 0x90], 1
jne 0x4874e6
mov dword [0x58b3ec], 2
jmp 0x487517
cmp dword [ebp - 0x90], 2
je 0x4874f8
cmp dword [ebp - 0x9c], 6
jb 0x487504
mov dword [0x58b3ec], 1
jmp 0x487517
cmp dword [ebp - 0x90], 0
jne 0x487517
mov dword [0x58b3ec], 3
mov dword [0x58b3f0], 1
mov eax, dword [0x58b3ec]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040526d
mov esp, ebp
pop ebp
ret

Function at 0x487d10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp + 8], 0
jne 0x487d48
jmp 0x487d8c
mov eax, dword [ebp + 8]
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x487d8c
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004878e0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x487d8c
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00487db0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 0
je 0x487da5
mov edx, dword [ebp - 0x10]
push edx
call fcn.00499750
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4881a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x4881e1
cmp dword [ebp + 0xc], 0
je 0x4881e1
cmp dword [ebp + 0x10], 0
je 0x4881e1
cmp dword [ebp + 0x14], 0
jne 0x4881e6
jmp 0x4882b9
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00487540
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4882b9
cmp dword [ebp - 0x14], 0
je 0x4882b9
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4882b9
mov edx, dword [ebp - 0x14]
add edx, 1
push edx
call fcn.00405bab
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4882b9
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4882b9
mov edx, dword [ebp + 0x10]
cmp dword [edx], 1
je 0x48828f
mov eax, dword [ebp + 0x10]
cmp dword [eax], 2
jne 0x4882a4
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00487a40
add esp, 8
mov dword [ebp - 8], eax
jmp 0x4882b9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
cmp dword [ebp - 4], 0
je 0x4882d2
mov eax, dword [ebp - 4]
push eax
call fcn.00499750
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
je 0x4882eb
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00499750
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x488300
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x488341
cmp dword [ebp + 0xc], 0
je 0x488341
cmp dword [ebp + 0x10], 0
je 0x488341
cmp dword [ebp + 0x14], 0
jne 0x488346
jmp 0x488419
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00487830
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x488419
cmp dword [ebp - 0x14], 0
je 0x488419
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x488419
mov edx, dword [ebp - 0x14]
add edx, 1
push edx
call fcn.00405bab
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x488419
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x488419
mov edx, dword [ebp + 0x10]
cmp dword [edx], 1
je 0x4883ef
mov eax, dword [ebp + 0x10]
cmp dword [eax], 2
jne 0x488404
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.004878e0
add esp, 8
mov dword [ebp - 4], eax
jmp 0x488419
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
cmp dword [ebp - 8], 0
je 0x488432
mov eax, dword [ebp - 8]
push eax
call fcn.00499750
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
je 0x48844b
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00499750
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret