joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a534de8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov byte [esp + 4], cl
mov dword [esp], edx
mov edi, eax
mov ecx, edi
movzx eax, byte [esp]
mov byte [esp + 5], al
mov edx, edi
shr edx, 8
mov eax, dword [esp]
shr eax, 8
mov byte [esp + 6], al
mov eax, edi
shr eax, 0x10
mov ebx, dword [esp]
shr ebx, 0x10
mov byte [esp + 7], bl
xor esi, esi
cmp byte [esp + 4], 0
je 0x4a534e7c
movzx ebx, cl
movzx ebp, byte [esp + 5]
add ebx, ebp
cmp ebx, 0xff
jbe 0x4a534e40
inc esi
mov cl, 0xff
jmp 0x4a534e44
add cl, byte [esp + 5]
movzx ebx, dl
movzx ebp, byte [esp + 6]
add ebx, ebp
cmp ebx, 0xff
jbe 0x4a534e5b
inc esi
mov dl, 0xff
jmp 0x4a534e5f
add dl, byte [esp + 6]
movzx ebx, al
movzx ebp, byte [esp + 7]
add ebx, ebp
cmp ebx, 0xff
jbe 0x4a534e76
inc esi
mov al, 0xff
jmp 0x4a534ea9
add al, byte [esp + 7]
jmp 0x4a534ea9
cmp cl, byte [esp + 5]
jae 0x4a534e87
inc esi
xor ecx, ecx
jmp 0x4a534e8b
sub cl, byte [esp + 5]
cmp dl, byte [esp + 6]
jae 0x4a534e96
inc esi
xor edx, edx
jmp 0x4a534e9a
sub dl, byte [esp + 6]
cmp al, byte [esp + 7]
jae 0x4a534ea5
inc esi
xor eax, eax
jmp 0x4a534ea9
sub al, byte [esp + 7]
dec esi
jle 0x4a534ec0
movzx ecx, byte [esp + 4]
xor cl, 1
mov edx, dword [esp]
mov eax, edi
call fcn.4a534de8
jmp 0x4a534ed3
movzx eax, al
shl eax, 0x10
movzx edx, dl
shl edx, 8
add eax, edx
movzx edx, cl
add eax, edx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a5360b8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a5361c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x10
call fcn.4a50e138
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
sub eax, 0x2e
mov dword [esi + 8], eax
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4a536136
push 0x410
push esi
lea edx, [ebp - 4]
mov eax, ebx
call fcn.4a5362e0
mov eax, dword [ebp - 4]
call fcn.4a507ae8
push eax
lea edx, [ebp - 8]
mov eax, ebx
call fcn.4a5362e0
mov eax, dword [ebp - 8]
call fcn.4a5082f8
push eax
push edi
call sub.user32.dll_DrawTextW
jmp 0x4a536188
push 0x410
push esi
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.4a5362e0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, 0
call fcn.4a508124
mov eax, dword [ebp - 0xc]
call fcn.4a507af4
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.4a5362e0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, 0
call fcn.4a508124
mov eax, dword [ebp - 0x14]
call fcn.4a507f78
push eax
push edi
call sub.user32.dll_DrawTextA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5361ca
lea eax, [ebp - 0x18]
call fcn.4a507618
lea eax, [ebp - 0x14]
call fcn.4a50763c
lea eax, [ebp - 0x10]
call fcn.4a507618
lea eax, [ebp - 0xc]
call fcn.4a50763c
lea eax, [ebp - 8]
mov edx, 2
call fcn.4a507678
ret

Function at 0x4a53669c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a536774
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x14], 0
je 0x4a536754
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4a536709
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageW
mov edx, eax
inc edx
lea eax, [ebx + 0x50]
call fcn.4a508410
mov eax, dword [ebx + 0x50]
push eax
mov eax, dword [ebx + 0x50]
call fcn.4a507ae8
push eax
push 0xd
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageW
mov edx, eax
lea eax, [ebx + 0x50]
call fcn.4a508410
jmp 0x4a536754
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageA
mov edx, eax
inc edx
lea eax, [ebp - 4]
xor ecx, ecx
call fcn.4a5080ac
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.4a507af4
push eax
push 0xd
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageA
mov edx, eax
lea eax, [ebp - 4]
xor ecx, ecx
call fcn.4a5080ac
lea eax, [ebx + 0x50]
mov edx, dword [ebp - 4]
call fcn.4a5083c0
mov eax, esi
mov edx, dword [ebx + 0x50]
call fcn.4a5079d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a53677b
lea eax, [ebp - 4]
call fcn.4a50763c
ret
Function at 0x4a5489fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4a548a35
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.4a507780
jmp 0x4a548a3e
mov eax, ebx
mov edx, esi
call fcn.4a5079d8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4a549d64
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x4a549e89
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.4a549b6c
mov esi, eax
mov eax, dword [0x4a5ed564]
cmp byte [eax], 0
je 0x4a549e31
mov eax, dword [0x4a5ed3c4]
call fcn.4a505178
call fcn.4a504a44
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4a549d34]
call fcn.4a509478
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x4a549ea4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4a549e6d
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4a5ed38c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4a5f0c4c]
call fcn.4a509674
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a549e90
lea eax, [ebp - 4]
mov edx, dword [0x4a549d34]
call fcn.4a50959c
ret
Function at 0x4a54aef4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a54aff4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.4a507a20
lea eax, [ebp - 4]
call fcn.4a507bc0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.4a5082f8
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4a54afde
mov eax, ebx
call fcn.4a5048c0
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4a54afd7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.4a5082f8
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4a54afc1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4a54b008
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4a54afc1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a54afde
mov eax, dword [ebp - 0x10]
call fcn.4a5048dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a54affb
lea eax, [ebp - 4]
call fcn.4a507618
ret

Function at 0x4a54b930
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.4a507b00
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.4a50aef0
mov edi, eax
cmp edi, 0x104
jbe 0x4a54b8db
mov eax, edi
add eax, eax
call fcn.4a5048c0
mov esi, eax
jmp 0x4a54b8dd
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.4a50aef0
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4a54b916
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4a54b900
mov eax, esp
cmp esi, eax
je 0x4a54b923
mov eax, esi
call fcn.4a5048dc
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4a54b95c
cmp bl, 0
je 0x4a54b958
cmp bl, 0x41
jl 0x4a54b953
cmp bl, 0x5a
jg 0x4a54b953
or bl, 0x20
xor al, bl
inc esi
jmp 0x4a54b937
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4a54b89c

Function at 0x4a54bb78
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.4a5083a4
add esp, 0x800
pop ebx
ret
Function at 0x4a55268c
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x218], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a5528fa
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4a5527c8
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
jbe 0x4a552712
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.4a5083a4
jmp 0x4a552719
mov eax, ebx
call fcn.4a507618
cmp dword [ebx], 0
jne 0x4a55272c
mov ecx, ebx
xor edx, edx
mov eax, 0x1a
call fcn.4a5549dc
cmp dword [ebx], 0
je 0x4a5528b6
push 0
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_CreateDirectoryW
mov eax, dword [ebx]
call fcn.4a507ae8
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4a552760
mov eax, ebx
mov edx, 0x4a552914
call fcn.4a508490
push dword [ebx]
lea edx, [ebp - 0x218]
xor eax, eax
call fcn.4a5523d4
mov eax, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.4a512544
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
call fcn.4a552488
push dword [ebp - 0x210]
push 0x4a552924
mov eax, ebx
mov edx, 3
call fcn.4a508570
push 0
mov eax, dword [ebx]
call fcn.4a5082f8
push eax
call sub.kernel32.dll_CreateDirectoryW
mov eax, ebx
mov edx, 0x4a552914
call fcn.4a508490
jmp 0x4a5528b6
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
jbe 0x4a5528af
lea eax, [ebp - 0x21c]
lea esi, [ebp - 0x20a]
mov edx, esi
mov ecx, 0
call fcn.4a507c94
mov edx, dword [ebp - 0x21c]
mov eax, ebx
call fcn.4a5083c0
cmp dword [ebx], 0
je 0x4a5528b6
push 0
push esi
call sub.kernel32.dll_CreateDirectoryA
mov eax, dword [ebx]
call fcn.4a507ae8
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4a552834
mov eax, ebx
mov edx, 0x4a552914
call fcn.4a508490
push dword [ebx]
lea edx, [ebp - 0x228]
xor eax, eax
call fcn.4a5523d4
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x224]
call fcn.4a512544
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
call fcn.4a552488
push dword [ebp - 0x220]
push 0x4a552924
mov eax, ebx
mov edx, 3
call fcn.4a508570
push 0
lea eax, [ebp - 0x22c]
mov edx, dword [ebx]
mov ecx, 0
call fcn.4a508124
mov eax, dword [ebp - 0x22c]
call fcn.4a507f78
push eax
call sub.kernel32.dll_CreateDirectoryA
mov eax, ebx
mov edx, 0x4a552914
call fcn.4a508490
jmp 0x4a5528b6
mov eax, ebx
call fcn.4a507618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a552901
lea eax, [ebp - 0x22c]
call fcn.4a50763c
lea eax, [ebp - 0x228]
mov edx, 3
call fcn.4a507678
lea eax, [ebp - 0x21c]
call fcn.4a50763c
lea eax, [ebp - 0x218]
mov edx, 3
call fcn.4a507678
ret
Function at 0x4a55293c
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd8c
push ebx
xor eax, eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a552b8b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.4a55268c
cmp dword [ebp - 4], 0
je 0x4a552b55
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4a552a59
mov eax, dword [ebp - 4]
call fcn.4a5082f8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4a552b55
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x258]
mov ecx, 0x4a552ba4
mov edx, dword [ebp - 4]
call fcn.4a5084e8
mov eax, dword [ebp - 0x258]
call fcn.4a5082f8
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4a552a46
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.4a5083a4
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 0x25c]
mov edx, dword [ebp - 4]
call fcn.4a5084e8
mov eax, dword [ebp - 0x25c]
call fcn.4a5082f8
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4a5529f4
push ebx
call sub.kernel32.dll_FindClose_1
mov eax, dword [ebp - 4]
call fcn.4a5082f8
push eax
call sub.kernel32.dll_RemoveDirectoryW
jmp 0x4a552b55
lea eax, [ebp - 0x264]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.4a508124
mov eax, dword [ebp - 0x264]
call fcn.4a507f78
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4a552b55
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x268]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.4a508124
lea eax, [ebp - 0x268]
mov edx, 0x4a552bb8
call fcn.4a507d54
mov eax, dword [ebp - 0x268]
call fcn.4a507f78
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4a552b31
lea eax, [ebp - 0x26c]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.4a508124
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x254]
add edx, 0x2c
mov ecx, 0x104
push 0
call fcn.4a507d1c
mov edx, dword [ebp - 0x270]
pop eax
call fcn.4a507d54
mov eax, dword [ebp - 0x26c]
call fcn.4a507f78
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4a552ac8
push ebx
call sub.kernel32.dll_FindClose_1
lea eax, [ebp - 0x274]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.4a508124
mov eax, dword [ebp - 0x274]
call fcn.4a507f78
push eax
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a552b92
lea eax, [ebp - 0x274]
mov edx, 5
call fcn.4a5076a8
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.4a507678
lea eax, [ebp - 4]
call fcn.4a507618
ret
Function at 0x4a552bbc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor edx, edx
mov dword [ebp - 0x214], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a552c61
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x104
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4a552c15
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_GetComputerNameW
mov eax, ebx
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.4a5083a4
jmp 0x4a552c48
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20e]
mov ecx, 0
call fcn.4a507c94
mov edx, dword [ebp - 0x214]
mov eax, ebx
call fcn.4a5083c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a552c68
lea eax, [ebp - 0x214]
call fcn.4a50763c
ret
Function at 0x4a552c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4a552e2b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.4a507618
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4a552d4c
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call fcn.4a5082f8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a552e10
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.4a5082f8
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4a552d3e
cmp dword [ebp - 0xc], 0
je 0x4a552d3e
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4a552d38
mov eax, ebx
mov edx, esi
call fcn.4a508350
push esi
call sub.kernel32.dll_LocalFree_1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4a552e10
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x14]
mov edx, edi
mov ecx, 0
call fcn.4a508124
mov eax, dword [ebp - 0x14]
call fcn.4a507f78
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4a552e10
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.4a508124
mov eax, dword [ebp - 0x18]
call fcn.4a507f78
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4a552e07
cmp dword [ebp - 0xc], 0
je 0x4a552e07
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4a552e01
lea eax, [ebp - 0x1c]
mov edx, esi
mov ecx, 0
call fcn.4a507c94
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.4a5083c0
push esi
call sub.kernel32.dll_LocalFree_1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a552e32
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.4a5076a8
ret
Function at 0x4a552e3c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a552f8f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4a552ede
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, edi
call fcn.4a5082f8
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x4a552f6c
mov eax, dword [ebp + 8]
call fcn.4a507ae8
add eax, eax
add eax, 2
push eax
mov eax, dword [ebp + 8]
call fcn.4a5082f8
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.4a5082f8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4a552f6c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov edx, edi
mov ecx, 0
call fcn.4a508124
mov eax, dword [ebp - 0x14]
call fcn.4a507f78
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x4a552f6c
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
mov ecx, 0
call fcn.4a508124
mov eax, dword [ebp - 4]
call fcn.4a507af4
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.4a507f78
push eax
push 1
push 0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
mov ecx, 0
call fcn.4a508124
mov eax, dword [ebp - 0x18]
call fcn.4a507f78
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a552f96
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.4a5076a8
lea eax, [ebp - 4]
call fcn.4a50763c
ret
Function at 0x4a552fa4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a55308f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4a553017
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, edi
call fcn.4a5082f8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a553074
mov eax, dword [ebp - 4]
call fcn.4a5082f8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4a553074
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0xc]
mov edx, edi
mov ecx, 0
call fcn.4a508124
mov eax, dword [ebp - 0xc]
call fcn.4a507f78
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4a553074
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.4a508124
mov eax, dword [ebp - 0x10]
call fcn.4a507f78
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a553096
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.4a5076a8
ret

Function at 0x4a55375c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.4a5169c4
test eax, eax
je 0x4a55380d
cmp word [eax + 0x18], 0x20b
jne 0x4a55379a
add eax, 0x18
add eax, 0x78
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
jmp 0x4a5537ac
add eax, 0x80
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
test esi, esi
je 0x4a55380d
jmp 0x4a553807
mov eax, dword [esi + 0x10]
cmp eax, dword [ebp - 0x10]
jbe 0x4a5537c3
push ebp
call fcn.4a55359c
pop ecx
jmp 0x4a55380d
cmp dword [esi + 0x10], 0
je 0x4a553804
mov ebx, dword [ebp - 4]
add ebx, dword [esi + 0x10]
jmp 0x4a5537ff
cmp edi, dword [ebx]
jne 0x4a5537fc
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a5537fc
mov eax, dword [ebp - 8]
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
add ebx, 4
cmp dword [ebx], 0
jne 0x4a5537d1
add esi, 0x14
cmp dword [esi + 0xc], 0
jne 0x4a5537b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret