joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490150
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e01ad
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x520404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x490292
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x490292
mov eax, dword [ebp + 0x10]
mov edi, dword [eax]
mov ecx, dword [edi - 0x10]
lea esi, [edi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x4901b3
cmp ecx, dword [esi]
jne 0x4901b3
lock inc dword [eax]
jmp 0x49020d
mov eax, dword [ecx]
lea edx, [esi + 4]
push 2
push dword [edx]
mov dword [ebp + 0x14], edx
call dword [eax]
mov esi, eax
test esi, esi
je 0x4902a6
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov dword [esi + 4], eax
mov eax, dword [ecx]
lea ecx, [esi + 0x10]
inc eax
add eax, eax
je 0x49020d
test ecx, ecx
je 0x4901fd
push eax
test edi, edi
je 0x4901f2
push edi
push ecx
call fcn.004ac280
add esp, 0xc
jmp 0x49020d
push 0
push ecx
call fcn.004ac800
add esp, 0xc
call fcn.004b4a32
mov dword [eax], 0x16
call fcn.004af44f
add esi, 0x10
mov dword [ebp + 0x14], esi
mov edi, dword [esi - 0xc]
mov dword [ebp - 4], 0
test edi, edi
js 0x4902ab
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x490242
push edi
lea ecx, [ebp + 0x14]
call fcn.00478400
mov esi, dword [ebp + 0x14]
lea eax, [edi + edi]
push eax
mov eax, dword [ebp + 0xc]
push esi
push 1
push dword [eax]
mov eax, dword [ebp + 8]
push dword [eax]
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
mov dword [ebp - 4], 0xffffffff
sete bl
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x49027e
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00478690
push 0x80070057
call fcn.00477ec0
int3
Function at 0x490d30
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e030f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x520404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x528084]
test eax, eax
jne 0x490d95
push 0x4e9488
push 0x2c
call fcn.004a7f94
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x490d87
mov ecx, eax
call fcn.00484580
jmp 0x490d89
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x528084], eax
push str.deleteExtendedFileExtensionInfo
push str.App___SetupHelper
push eax
call fcn.00484be0
lea eax, [ebp - 0x14]
push eax
call fcn.00491400
add esp, 0x10
mov dword [ebp - 4], 1
call fcn.004782d0
test eax, eax
je 0x490ee4
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360GameAssistant.exe
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00477ee0
test al, al
jne 0x490df6
push 0x48
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths360GameAssistant.exe
lea ecx, [ebp - 0x10]
call fcn.00478540
mov esi, dword [ebp - 0x10]
push esi
push dword [ebp + 8]
mov byte [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
je 0x490e14
cmp eax, 2
je 0x490e14
xor bl, bl
jmp 0x490e16
mov bl, 1
or edi, 0xffffffff
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x490e30
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 0
call fcn.0047a8b0
add esp, 4
call fcn.004782d0
test eax, eax
je 0x490ee4
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.Software360GameAssistant
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00477ee0
test al, al
jne 0x490e78
push 0x19
push str.Software360GameAssistant
lea ecx, [ebp - 0x10]
call fcn.00478540
mov esi, dword [ebp - 0x10]
push esi
push dword [ebp + 8]
mov byte [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
je 0x490e96
cmp eax, 2
je 0x490e96
xor al, al
jmp 0x490e98
mov al, 1
and bl, al
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x490eb1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x490ed0
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00477ec0
int3
Function at 0x4926f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e06bf
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x520404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x492720
sub ecx, edx
xor ebx, ebx
sar ecx, 1
lea eax, [ecx + 2]
mov ecx, 2
mov dword [ebp - 0x10], eax
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.004a856a
mov esi, eax
add esp, 4
test esi, esi
je 0x492762
push ebx
push 0
push esi
call fcn.004ac800
add esp, 0xc
jmp 0x492764
xor esi, esi
mov dword [ebp - 0x14], esi
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 4], 0
lea eax, [ebx + ebx]
push eax
push 0
push esi
call fcn.004ac800
push edi
lea eax, [ebx - 1]
push eax
push esi
call fcn.004b8555
add esp, 0x18
mov dword [ebp - 0x34], 0
mov eax, 0x614
mov dword [ebp - 0x30], 3
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x2c], esi
push eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x22], 0
mov dword [ebp - 0x1e], 0
mov dword [ebp - 0x1a], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, eax
mov eax, dword [0x528084]
test eax, eax
jne 0x492804
push 0x4e9488
push 0x2c
call fcn.004a7f94
add esp, 8
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x4927f9
mov ecx, eax
call fcn.00484580
jmp 0x4927fb
xor eax, eax
mov byte [ebp - 4], 0
mov dword [0x528084], eax
push ebx
push edi
push str.path___s__ret___d
push str.App___SetupHelper
push eax
call fcn.00484be0
add esp, 0x14
test ebx, ebx
sete bl
test esi, esi
je 0x49282b
push esi
call fcn.004a3457
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492840
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e06f7
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x520404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x5282f8
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x492870
sub ecx, edx
sar ecx, 1
jne 0x492886
call fcn.00491770
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0x5282f8
call esi
test eax, eax
je 0x4928ce
lea eax, [ebp - 0x10]
push eax
call fcn.00491400
add esp, 4
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4928b3
mov byte [0x528708], 1
mov edx, dword [ebp - 0x10]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4928ce
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x528774
call fcn.00497390
test al, al
je 0x49290b
push str.runSetup_silent
push str.App___SetupHelper
call fcn.00484b60
push eax
call fcn.00484be0
add esp, 0xc
call fcn.00492a00
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push str.runSetup_window
push str.App___SetupHelper
call fcn.00484b60
push eax
call fcn.00484be0
add esp, 0xc
push 0
push str.360GameAssistantUninstWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x492968
push str.runSetup_window_already_exist
push str.App___SetupHelper
call fcn.00484b60
push eax
call fcn.00484be0
push 5
push esi
call fcn.0048b570
add esp, 0x14
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x4e9488
push 0x2c
call fcn.004a7f94
add esp, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x492990
mov ecx, eax
call fcn.00497630
mov esi, eax
jmp 0x492992
xor esi, esi
push 0
push 0
push 0x86020000
push 0x4f8bb8
push 0
push esi
push str.SetupWnd.xml
push str.SetupWnd
mov dword [ebp - 4], 0xffffffff
call fcn.004078d0
add esp, 0x20
test eax, eax
jne 0x4929df
test esi, esi
je 0x4929cd
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x14]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4950d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x520404]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x214], 0
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x218]
push edi
push edx
mov edi, dword [eax + 4]
or edi, 0x2001f
mov dword [ebp - 0x220], eax
push edi
push 0
push ecx
push dword [eax]
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x49522b
mov eax, dword [ebp - 0x214]
xor esi, esi
test eax, eax
je 0x49515c
push eax
call ebx
mov esi, eax
mov eax, dword [ebp - 0x218]
and edi, 0x300
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], edi
test esi, esi
jne 0x49522b
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x228]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x208], 0x100
push ecx
lea ecx, [ebp - 0x204]
push ecx
push esi
push eax
call edi
test eax, eax
jne 0x4951f7
lea esp, [esp]
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.004950d0
mov esi, eax
test esi, esi
jne 0x49522b
lea eax, [ebp - 0x228]
mov dword [ebp - 0x208], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
call edi
test eax, eax
je 0x4951b0
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x49520e
push eax
call ebx
mov dword [ebp - 0x214], 0
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x210], 0
call fcn.004948b0
mov esi, eax
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x495238
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7f4e
mov esp, ebp
pop ebp
ret 4
Function at 0x4953f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e0b2b
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x520404]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x49549c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x49549c
call fcn.0047f6f0
mov edi, eax
jmp 0x4955bb
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4954bf
call fcn.0047f6f0
jmp 0x4955ae
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x4954dd
call fcn.0047f6f0
jmp 0x4955ae
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x4954fe
mov edi, 0x8007000e
jmp 0x4955b0
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x4955f4
jb 0x49551c
cmp eax, 0xffffffff
ja 0x4955f4
cmp eax, 0x400
jbe 0x495531
push eax
lea ecx, [ebp - 0x418]
call fcn.00494740
jmp 0x495557
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x495557
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x49556e
mov edi, 0x8007000e
jmp 0x4955b0
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x49558e
call fcn.0047f6f0
jmp 0x4955ae
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00495250
mov edi, eax
test esi, esi
je 0x4955bb
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4955d4
lea ecx, [ebp - 0x418]
call fcn.004949e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a7f4e
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00477ec0
int3
Function at 0x4a398b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4a39da
mov esi, dword [ebp + 0x18]
lea eax, [ebp + 0x10]
push edi
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a39da
cmp esi, dword [ebp + 0x10]
je 0x4a39d5
push 0x4f8bb8
push 1
push edi
push edi
call fcn.004a301e
jmp 0x4a39e8
xor eax, eax
inc eax
jmp 0x4a39ed
mov eax, 0x4f8bb8
push eax
push eax
push edi
push edi
call fcn.004a306b
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x4a4bda
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4a4c04
mov eax, 0x4f8bb8
push eax
push eax
push 0
push 0
call fcn.004a306b
add esp, 0x10
xor eax, eax
pop ebp
ret
xor eax, eax
inc eax
pop ebp
ret

Function at 0x4a5946
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x4a5e87
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x4a6146
Capabilities:
Check mutex on windows

Disassembly:
push 0xa4
mov eax, 0x4e1856
call fcn.004a8a82
mov esi, ecx
mov dword [ebp - 0xa0], esi
xor ebx, ebx
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
push 0x41
lea eax, [ebp - 0x98]
push eax
call fcn.004a6917
add esp, 0x14
xor eax, eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x98]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x9c], edi
test edi, edi
je 0x4a6292
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4a61bf
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], ebx
call fcn.004a6776
test eax, eax
je 0x4a61f4
mov dword [esi], eax
mov eax, dword [esi]
inc dword [eax + 0x5bc]
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
jne 0x4a6292
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4a6292
push 0x5c0
call fcn.004a6451
pop ecx
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x4a6217
push edi
mov ecx, eax
call fcn.004a62d3
jmp 0x4a6219
mov eax, ebx
mov byte [ebp - 4], bl
mov dword [esi], eax
test eax, eax
je 0x4a629a
xor ebx, ebx
inc ebx
mov dword [ebp - 0xb0], ebx
push eax
call fcn.004a68b6
pop ecx
test eax, eax
jne 0x4a61cd
mov dword [ebp - 0xa8], 3
push 0x51b6ec
lea eax, [ebp - 0xa8]
jmp 0x4a62af
mov eax, esi
call fcn.004a89d4
ret
mov dword [ebp - 0xa4], 1
push 0x51b6ec
lea eax, [ebp - 0xa4]
push eax
call fcn.004ac9dc
int3
Function at 0x4a62d3
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x4e1889
call fcn.004a89e3
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [esi], 0
lea ecx, [esi + 8]
or dword [esi + 4], 0xffffffff
call fcn.004a6117
and dword [ebp - 4], 0
and dword [esi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4a631f
mov eax, dword [ebp + 8]
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004a89b1
ret 4
push 0x51b6ec
lea eax, [ebp + 8]
mov dword [ebp + 8], 2
push eax
call fcn.004ac9dc
int3

Function at 0x4a64eb
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebx]
add ecx, 8
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x5a8]
mov dword [ecx + 0x5b0], eax
call fcn.004a667f
mov edi, eax
test edi, edi
je 0x4a6576
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jne 0x4a6526
mov esi, edi
jmp 0x4a6562
push dword [edi]
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x4a655b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4a654e
mov ecx, dword [ebx]
push edi
add ecx, 8
call fcn.004a661a
jmp 0x4a6562
push 0x4eab10
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4a6562
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx]
add ecx, 8
call fcn.004a667f
mov edi, eax
test edi, edi
jne 0x4a651b
test esi, esi
jne 0x4a658b
mov ecx, dword [ebx]
add ecx, 8
call fcn.004a6807
mov esi, eax
test esi, esi
je 0x4a658b
mov eax, dword [ebp - 4]
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4a9740
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x520404]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2ec], ebx
push edi
test ebx, ebx
je 0x4a9944
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4a9944
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.004ac800
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2e4]
add esp, 0xc
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4a9919
xor edi, edi
mov dword [ebp - 0x2d8], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x1d0]
push eax
push edi
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4a9908
lea eax, [ebp - 0x2e8]
push eax
push 1
push 0
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x2e4]
call esi
test eax, eax
jne 0x4a98d2
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2e0], 1
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2dc], 0x104
push eax
lea eax, [ebp - 0x2e0]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x2e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a98ca
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.004ac800
push 0x64
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a9960
add esp, 0x18
test eax, eax
je 0x4a98ca
cmp byte [ebp - 0x68], 0
je 0x4a988c
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x4a98ca
lea ecx, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x4a98b9
mov al, byte [esi + ecx]
test al, al
je 0x4a98b9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4a98a0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x2e8]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x104
push eax
lea eax, [ebp - 0x1d0]
inc edi
push eax
push edi
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4a97e0
push dword [ebp - 0x2e4]
call ebx
mov ebx, dword [ebp - 0x2ec]
mov edi, dword [ebp + 0xc]
cmp byte [ebp - 0x68], 0
pop esi
je 0x4a9944
lea eax, [ebp - 0x68]
push eax
push edi
push ebx
call fcn.0048fe40
xor ecx, ecx
test eax, eax
pop edi
setns cl
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7f4e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.004a7f4e
mov esp, ebp
pop ebp
ret
Function at 0x4a9be0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x520404]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x529340]
mov byte [ebp - 0x20d], 0x40
push ebx
mov ebx, dword [ebp + 8]
test ecx, ecx
jne 0x4a9ccd
push 0x208
push ecx
lea eax, [ebp - 0x20c]
push eax
call fcn.004ac800
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0xf5
ja 0x4a9cae
push esi
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4a9c46
mov eax, dword [0x4f8b54]
mov dword [edi], eax
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4a9c62
mov ecx, 6
lea eax, [ebp - 0x20c]
mov esi, str.Netapi32.dll
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
test eax, eax
je 0x4a9cae
push str.Netbios
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x529340]
test eax, eax
cmovne ecx, eax
mov dword [0x529340], ecx
jmp 0x4a9cb4
mov ecx, dword [0x529340]
test ecx, ecx
jne 0x4a9ccd
mov al, byte [ebp - 0x20d]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7f4e
mov esp, ebp
pop ebp
ret
push ebx
call ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004a7f4e
mov esp, ebp
pop ebp
ret