joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f890
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x661204]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x828]
push 0x44
push 0
push eax
call fcn.005b9c20
push esi
lea eax, [ebp - 0x7d4]
mov dword [ebp - 0x828], 0x44
xorps xmm0, xmm0
push 0x5ead74
push eax
movups xmmword [ebp - 0x7e4], xmm0
call fcn.004a2fe0
add esp, 0x18
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x828]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x7d4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x49f91c
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x7e4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x7e0]
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret

Function at 0x49f950
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49f960
sub ecx, edx
sar ecx, 1
jne 0x49f978
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 1
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x49f99f
push esi
call fcn.0049f890
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49f9b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
xor esi, esi
push str.EXPLORER.EXE
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call fcn.004a0a20
add esp, 4
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x49faf0
lea eax, [ebp - 0xc]
push eax
push 0xf01ff
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x49faee
lea eax, [ebp - 4]
push eax
push 1
push 1
push esi
push 0xf01ff
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x49faee
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x49fa62
push str.WTSGetActiveConsoleSessionId
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49fa5b
call eax
push 4
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x49faee
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.005b9c20
add esp, 0xc
mov dword [ebp - 0x64], 0x44
mov eax, 5
mov dword [ebp - 0x5c], str.WinSta0Default
mov word [ebp - 0x34], ax
xorps xmm0, xmm0
lea eax, [ebp - 8]
mov dword [ebp - 0x38], 1
push 0
push dword [ebp - 4]
movups xmmword [ebp - 0x20], xmm0
push eax
mov dword [ebp - 8], 0
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x49faee
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push dword [ebp - 8]
push 0x430
push 0
push 0
push 0
push dword [ebp + 8]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x49faee
mov eax, dword [ebp - 8]
test eax, eax
je 0x49fae7
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
mov esi, 1
jmp 0x49faf0
xor esi, esi
mov eax, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x49fb05
cmp eax, 0xffffffff
je 0x49fb05
push eax
call edi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x49fb14
cmp eax, 0xffffffff
je 0x49fb14
push eax
call edi
test ebx, ebx
jne 0x49fb1b
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49fe40
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x661204]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x240], ecx
lea ecx, [ebp - 0x234]
push ecx
push eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x234], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x49feaf
push 0x5ea980
mov ecx, esi
call fcn.0049abb0
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, 2
mul edx
push edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0054c502
add esp, 4
mov edi, eax
push edi
push ebx
push 0
push dword [ebp - 0x238]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x49ff08
push 2
push edi
call fcn.0054c4f4
add esp, 8
mov ecx, esi
push 0x5ea980
call fcn.0049abb0
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x228]
mov dword [ebp - 0x22c], 0
push eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x228], 0
push eax
push 0x5eb18c
push edi
call sub.VERSION.dll_VerQueryValueW
lea eax, [ebp - 0x228]
mov dword [ebp - 0x23c], 0
push eax
lea eax, [ebp - 0x23c]
push eax
push 0x650ab8
push edi
call sub.VERSION.dll_VerQueryValueW
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005b9c20
mov ecx, dword [ebp - 0x22c]
push dword [ebp - 0x240]
mov dword [ebp - 0x230], 0
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x20c]
push str.StringFileInfo_04x_04x_s
push eax
call fcn.0049f3b0
add esp, 0x20
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x230]
test eax, eax
jne 0x49ffeb
push edi
call fcn.0054c50b
add esp, 4
mov ecx, esi
push 0x5ea980
call fcn.0049abb0
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret
push eax
lea ecx, [ebp - 0x224]
call fcn.0049abb0
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
mov word [esi], ax
lea eax, [ebp - 0x224]
push eax
call fcn.0049e3e0
lea ecx, [ebp - 0x224]
call fcn.004bdbb0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret
Function at 0x4a0360
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x661204]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x418]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x418], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4a03b4
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.005b9c20
add esp, 0xc
mov dword [ebp - 0x41c], 0x104
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], 1
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push 0
push 0x5ea980
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a04c4
push esi
push edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005b9c20
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4a0460
lea eax, [ebp - 0x20c]
mov ecx, 0x10
mov esi, str.Internet_Exploreriexplore.exe
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop esi
test eax, eax
je 0x4a03a3
lea ecx, [ebp - 0x20c]
mov eax, ecx
sub ebx, eax
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ebx + ecx - 2], ax
test ax, ax
jne 0x4a04a0
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x414]
mov eax, ecx
sub ebx, eax
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ebx + ecx - 2], ax
test ax, ax
jne 0x4a04d0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop ebx
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret
Function at 0x4a0a20
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e3c40
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x661204]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a0b8b
push eax
lea ecx, [ebp - 0x40]
call fcn.0049abb0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
call fcn.004a2230
push 0x22c
lea eax, [ebp - 0x26c]
push 0
push eax
call fcn.005b9c20
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x4a0b72
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4a0b6b
nop dword [eax + eax]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
je 0x4a0af5
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a0ae6
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.0049ee20
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.004a2230
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x14]
cmp esi, 8
mov ebx, dword [ebp - 0x28]
push ecx
push dword [ebp - 0x18]
cmovae eax, ebx
push eax
call fcn.0049e760
add esp, 0x14
test eax, eax
je 0x4a0ba7
mov byte [ebp - 4], 0
cmp esi, 8
jb 0x4a0b56
lea eax, [esi + 1]
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.0049ef70
lea eax, [ebp - 0x26c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4a0ac0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x4a0b89
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.0049ef70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x264]
lea ecx, [ebp - 0x28]
call fcn.004bdbb0
jmp 0x4a0b74
Function at 0x4a1640
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc28
mov eax, dword [0x661204]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x208
mov dword [ebp - 0xc24], eax
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0xc28], 0
mov dword [ebp - 0xc18], 0
call fcn.005b9c20
add esp, 0xc
lea eax, [ebp - 0x20c]
xor edi, edi
push 0x104
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4a1760
nop dword [eax]
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4a1743
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0xc1c], 0x104
push eax
call fcn.005b9c20
add esp, 0xc
mov dword [ebp - 0xc20], 1
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xc20]
push eax
push 0
push str.DisplayName
push dword [ebp - 0xc18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a1737
push dword [ebp - 0xc24]
lea eax, [ebp - 0x414]
push eax
call fcn.005b8fd5
add esp, 8
test eax, eax
jne 0x4a1793
push dword [ebp - 0xc18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [ebp - 0x20c]
inc edi
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4a16b0
xor eax, eax
mov dword [esi + 0x14], 7
push eax
mov dword [esi + 0x10], 0
mov word [esi], ax
push 0x5ea980
mov ecx, esi
call fcn.0049ee20
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret
push 0x800
lea eax, [ebp - 0xc14]
push 0
push eax
call fcn.005b9c20
add esp, 0xc
mov dword [ebp - 0xc1c], 0x400
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0xc20]
push eax
push 0
push str.UninstallString
push dword [ebp - 0xc18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [ebp - 0xc14], ax
jne 0x4a1806
xor ecx, ecx
lea eax, [ebp - 0xc14]
push ecx
push eax
jmp 0x4a1779
lea ecx, [ebp - 0xc14]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a1810
sub ecx, edx
lea eax, [ebp - 0xc14]
sar ecx, 1
push ecx
push eax
jmp 0x4a1779
Function at 0x4a18d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x661204]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x21c], 0
call fcn.005b9c20
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
add esp, 0xc
push eax
push 0x20019
push 0
push 0x5eaea4
push SysReAllocString
call esi
test eax, eax
je 0x4a195c
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push str.shell
push dword [ebp - 0x218]
call esi
test eax, eax
jne 0x4a194a
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push str.opencommand
push dword [ebp - 0x210]
call esi
test eax, eax
jne 0x4a194a
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x104
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x220], 1
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push 0x5ea980
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x214]
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.005c2181
push edi
push eax
call fcn.005b8fd5
mov ecx, dword [ebp - 4]
add esp, 0xc
neg eax
sbb eax, eax
xor ecx, ebp
pop edi
neg eax
pop esi
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret

Function at 0x4a1d80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x661204]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.005b9c20
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 0xa
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret

Function at 0x4a1de0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x661204]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.005b9c20
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jb 0x4a1e47
cmp dword [ebp - 0x118], 2
jb 0x4a1e47
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
cmp eax, 0xa
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret
Function at 0x4a1e60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.WS2_32.dll_accept
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a1f4e
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x4a1ed1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
call esi
test eax, eax
je 0x4a1f05
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x14]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a1f10
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a3140
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
push ebx
lea ebx, [eax + 0x210]
mov dword [ebp - 0xc], eax
push esi
mov esi, dword [ebx]
push edi
mov dword [ebp - 0x10], ebx
cmp esi, dword [eax + 0x214]
je 0x4a323d
mov ecx, dword [ebp + 8]
lea edi, [esi + 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add ecx, 0xa8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edi
nop dword [eax]
push ecx
call ebx
push 0x5eb328
call ebx
sub edi, 0xffffff80
push edi
call ebx
push 0x5eb328
call ebx
mov ecx, dword [ebp + 8]
lea eax, [ecx + 0x28]
push eax
call ebx
push 0x5eb328
call ebx
push dword [ebp - 4]
call ebx
push 0x5eb328
call ebx
mov eax, dword [ebp - 8]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x4a31d6
test cl, cl
je 0x4a31d2
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x4a31d6
add eax, 2
add edi, 2
test cl, cl
jne 0x4a31b6
xor eax, eax
jmp 0x4a31db
sbb eax, eax
or eax, 1
mov edi, dword [ebp - 4]
test eax, eax
jne 0x4a3219
mov edx, dword [ebp + 8]
mov ecx, edi
lea eax, [edx + 0x28]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4a3210
test dl, dl
je 0x4a320c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4a3210
add eax, 2
add ecx, 2
test dl, dl
jne 0x4a31f0
xor eax, eax
jmp 0x4a3215
sbb eax, eax
or eax, 1
test eax, eax
je 0x4a326e
mov eax, dword [ebp - 0xc]
add esi, 0x1b0
mov ecx, dword [ebp - 8]
add edi, 0x1b0
mov dword [ebp - 4], edi
cmp esi, dword [eax + 0x214]
jne 0x4a3180
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
lea edx, [ecx + 0xa8]
lea esi, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4a3250
sub edx, esi
je 0x4a326e
push ecx
mov ecx, ebx
call fcn.004a3dc0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a3d10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x661204]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
push 0x114
xor edi, edi
mov eax, dword [ebx + 0x210]
mov dword [ebx + 0x214], eax
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.005b9c20
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x4a3d73
mov ecx, ebx
call fcn.004a35c0
jmp 0x4a3d8a
push esi
xor esi, esi
test edi, edi
jne 0x4a3d89
mov ecx, ebx
call fcn.004a3480
inc esi
mov edi, eax
cmp esi, 0xa
jl 0x4a3d76
pop esi
mov ecx, dword [ebx + 0x214]
mov eax, 0x4bda12f7
sub ecx, dword [ebx + 0x210]
imul ecx
mov ecx, dword [ebp - 4]
sar edx, 7
xor ecx, ebp
mov eax, edx
shr eax, 0x1f
pop edi
add eax, edx
pop ebx
call fcn.0054c3c9
mov esp, ebp
pop ebp
ret

Function at 0x4a8020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e4276
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x661204]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CHttpPageClient.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
lea esi, [edi + 0x1c]
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004a7200
mov dword [esi], eax
mov dword [edi + 0x48], 0xf
mov dword [edi + 0x44], 0
mov byte [edi + 0x34], 0
push 3
mov byte [edi + 0x54], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x30], 0x3c
mov dword [edi + 0x2c], 0x1e
call fcn.0054f3b0
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a8710
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp byte [esi], 0
jne 0x4a8723
xor edx, edx
jmp 0x4a8731
mov edx, esi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4a8728
sub edx, ecx
push edx
push esi
lea ecx, [edi + 0x34]
call fcn.0049ec00
push 0x48
call fcn.0054c396
mov edx, eax
add esp, 4
mov dword [ebp + 0xc], edx
test edx, edx
je 0x4a87cb
mov dword [edx], vtable.CHttpPageRequest.0
lea eax, [edx + 8]
mov dword [eax + 0x14], 0xf
lea ecx, [edx + 0x2c]
mov dword [eax + 0x10], 0
mov byte [eax], 0
mov dword [edx + 0x20], 0
mov dword [edx + 0x24], 0
mov dword [edx + 0x28], 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
mov dword [edx + 4], 2
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x4a87a7
mov eax, dword [eax]
mov byte [eax], 0
mov eax, dword [edx + 0x20]
mov dword [edx + 0x24], eax
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x4a87bf
mov ecx, dword [ecx]
mov byte [ecx], 0
mov dword [edx + 0x44], 0
jmp 0x4a87cd
xor edx, edx
mov esi, dword [ebp + 8]
mov dword [edi + 0x4c], edx
cmp byte [esi], 0
jne 0x4a87dc
xor ecx, ecx
jmp 0x4a87ec
mov ecx, esi
push ebx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a87e2
sub ecx, ebx
pop ebx
push ecx
push esi
lea ecx, [edx + 8]
call fcn.0049ec00
mov eax, dword [edi + 0x4c]
push 0xa
push str.POST_test1
mov dword [eax + 4], 1
mov ecx, dword [edi + 0x4c]
add ecx, 0x2c
call fcn.0049ec00
lea eax, [edi + 0x24]
push eax
push 0
push edi
push 0x4a8850
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x28], eax
pop edi
pop esi
test eax, eax
je 0x4a8847
cmp eax, 0xffffffff
je 0x4a8847
mov dword [ebp + 0xc], 0xffffffff
mov dword [ebp + 8], eax
pop ebp
jmp dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop ebp
ret 8