joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467c90
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x670830
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, 1
mov dword [ebp - 0x30], edi
push ebx
lea eax, [ebp - 0x20]
push eax
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc050
add esp, 0x10
test eax, eax
jne 0x467dfc
mov byte [ebp - 0x19], bl
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x24]
push ecx
push ebx
lea edx, [ebp - 0x2c]
push edx
push ebx
push str.ForceArchiveScanOnFiles
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, 2
jne 0x467d67
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea edx, [ebp - 0x20]
push edx
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc050
add esp, 0x10
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, ebx
jne 0x467df2
lea eax, [ebp - 0x19]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea ecx, [ebp - 0x19]
push ecx
push edi
push ebx
push str.ForceArchiveScanOnFiles
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp esi, ebx
jne 0x467df2
lea eax, [ebp - 0x2c]
push eax
push str.ForceArchiveScanOnFiles
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.004dc2c0
add esp, 0xc
mov esi, eax
cmp esi, ebx
je 0x467df2
push esi
call fcn.004e1290
add esp, 4
cmp byte [esi], bl
je 0x467de9
xor edi, edi
mov dword [ebp - 0x30], edi
mov eax, dword [0x72c29c]
cmp eax, ebx
je 0x467dc2
push esi
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x467de9
mov edx, dword [0x72c29c]
push edx
call fcn.005e0865
add esp, 4
mov dword [0x72c29c], esi
cmp dword [ebp + 8], ebx
jne 0x467df2
call fcn.004501f0
push 0x733210
call fcn.005010c0
push ebx
push 1
call fcn.00441de0
add esp, 0xc
jmp 0x467df2
push esi
call fcn.005e0865
add esp, 4
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x467e32
mov eax, dword [0x72c29c]
cmp eax, ebx
je 0x467e32
push eax
call fcn.005e0865
add esp, 4
mov dword [0x72c29c], ebx
jmp 0x467e32
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468e60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.004f4f50
push eax
push str.LastNow
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x72c270], 0
jne 0x468f06
cmp dword [0x72bb6c], 0
jne 0x468f1c
push esi
push 0
push 0
push 0x450da0
call fcn.005e07ac
mov esi, eax
push 0
push esi
push str.CBD_6p
call fcn.00420720
add esp, 0x18
cmp esi, 0xffffffff
pop esi
jne 0x468f1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x108]
push str.Error:_beginthread_t__fails_with_error__d
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x108]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
push 0
push 1
push str.Scanner_in_Stopped_State._Not_reloading...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x473b10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x670a88
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x524
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x534], ebx
mov byte [ebp - 0x530], bl
push ebx
call fcn.00460150
add esp, 4
lea eax, [ebp - 0x534]
push eax
push str.RegMonitor
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [0x6b07a0], ebx
je 0x473b97
mov dword [ebp - 0x534], ebx
mov dword [0x6e9170], ebx
jmp 0x473c6b
cmp dword [ebp - 0x534], ebx
je 0x473b8c
push ebx
push ebx
push 0x4436f0
call fcn.005e07ac
mov esi, eax
push ebx
push esi
push str.CBD_7q
call fcn.00420720
add esp, 0x18
cmp esi, 0xffffffff
jne 0x473bf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_a6__fails_with_error__d
lea ecx, [ebp - 0x120]
push ecx
call fcn.005dfb23
push ebx
push 1
lea edx, [ebp - 0x120]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp dword [ebp - 0x534], ebx
je 0x473b8c
call fcn.004434e0
test eax, eax
jne 0x473b8c
push ebx
cmp dword [ebp - 0x534], 2
jne 0x473c0f
push 1
jmp 0x473c10
push ebx
push ebx
push 0x2000204
call dword [0x6e9118]
add esp, 0x10
push ebx
push 1
push str.Registry_Monitoring_Has_Been_Enabled.
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov dword [0x6e9170], 1
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x473c74
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x48adc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x670be0
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x340c0
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x340d8], edi
push 0x33fb4
push edi
lea eax, [ebp - 0x340d4]
push eax
call fcn.005dfd60
call fcn.00452a00
lea ecx, [ebp - 0x340d8]
push ecx
call fcn.0047f3c0
add esp, 0x10
test eax, eax
jne 0x48ae58
push edi
push 1
push str.Error:_Unable_To_Read_Settings_From_The_Config_Files.
push 0x6aec98
call fcn.004311c0
add esp, 0x10
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x48af24
push 1
push 0x2c
push 0x61d384
push 0x684d78
call fcn.004e56c0
cmp dword [0x74105c], edi
jne 0x48aede
mov dword [0x74105c], 1
cmp dword [0x67e110], edi
je 0x48aede
cmp dword [0x72bb6c], edi
jne 0x48aede
push edi
push edi
push 0x468fb0
call fcn.005e07ac
mov esi, eax
push edi
push esi
push str.CBD_6r
call fcn.00420720
add esp, 0x18
cmp esi, 0xffffffff
jne 0x48aede
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_v__fails_with_error__d
lea edx, [ebp - 0x120]
push edx
call fcn.005dfb23
push edi
push 1
lea eax, [ebp - 0x120]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push 0x33fb8
lea ecx, [ebp - 0x340d8]
push ecx
push 0x6e9888
call fcn.005e13c0
add esp, 0xc
jmp 0x48af18
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x49eb30
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
xor ebp, ebp
xor esi, esi
push edi
cmp eax, 2
jbe 0x49eb53
cmp byte [edx], 0x42
jne 0x49eb53
cmp byte [edx + 1], 0x4d
jne 0x49eb53
lea ebp, [esi + 1]
mov ecx, 0x400
cmp eax, 0x400
ja 0x49eb61
mov ecx, eax
mov eax, 1
lea edi, [ecx - 4]
cmp edi, eax
jbe 0x49ec61
mov bl, 0x5a
test ebp, ebp
jne 0x49ec39
test esi, esi
je 0x49eba8
mov cl, byte [eax + edx]
cmp cl, 0x50
jne 0x49eb92
cmp byte [eax + edx + 1], 0x45
je 0x49ec68
not cl
cmp cl, 0x50
jne 0x49eba8
mov cl, byte [eax + edx + 1]
not cl
cmp cl, 0x45
je 0x49ec68
mov cl, byte [eax + edx]
cmp cl, 0x4d
jne 0x49ebef
cmp byte [eax + edx + 1], bl
jne 0x49ebef
mov cl, byte [eax + edx + 2]
mov esi, 1
cmp cl, 0x90
je 0x49ebe1
cmp cl, 0xa
je 0x49ebe1
cmp cl, 0x50
je 0x49ebe1
cmp cl, 0x40
je 0x49ebe1
test cl, cl
je 0x49ebe1
cmp cl, 0x80
je 0x49ebe1
cmp cl, 0xf
jne 0x49ec58
cmp byte [eax + edx + 3], 0
jne 0x49ec58
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
not cl
cmp cl, 0x4d
jne 0x49ec58
mov cl, byte [eax + edx + 1]
not cl
cmp cl, bl
jne 0x49ec58
mov cl, byte [eax + edx + 2]
not cl
mov esi, 1
cmp cl, 0x90
je 0x49ec2d
cmp cl, 0xa
je 0x49ec2d
cmp cl, 0x50
je 0x49ec2d
cmp cl, 0x40
je 0x49ec2d
test cl, cl
je 0x49ec2d
cmp cl, 0x80
je 0x49ec2d
cmp cl, 0xf
jne 0x49ec58
mov cl, byte [eax + edx + 3]
not cl
test cl, cl
je 0x49ebe8
jmp 0x49ec58
mov cl, byte [eax + edx]
cmp cl, 0x4d
jne 0x49ec47
cmp byte [eax + edx + 1], bl
je 0x49ec68
not cl
cmp cl, 0x4d
jne 0x49ec58
mov cl, byte [eax + edx + 1]
not cl
cmp cl, bl
je 0x49ec68
inc eax
cmp eax, edi
jb 0x49eb73
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x4a0e80
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x44
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x40], eax
push esi
push edi
push 0x40
xor esi, esi
lea edi, [esp + 0xc]
mov eax, edi
push esi
push eax
call fcn.005dfd60
mov edx, dword [esp + 0x5c]
add esp, 0xc
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + edx]
test cl, cl
je 0x4a0ec1
mov byte [esp + esi + 8], cl
inc esi
cmp esi, 0x20
jg 0x4a0f01
mov cl, byte [eax + edx + 1]
test cl, cl
je 0x4a0ed3
mov byte [esp + esi + 8], cl
inc esi
cmp esi, 0x20
jg 0x4a0f01
mov cl, byte [eax + edx + 2]
test cl, cl
je 0x4a0ee5
mov byte [esp + esi + 8], cl
inc esi
cmp esi, 0x20
jg 0x4a0f01
mov cl, byte [eax + edx + 3]
test cl, cl
je 0x4a0ef7
mov byte [esp + esi + 8], cl
inc esi
cmp esi, 0x20
jg 0x4a0f01
add eax, 4
cmp eax, 0x100
jl 0x4a0eb0
cmp byte [esp + 8], 0x2f
jne 0x4a0f0c
lea edi, [esp + 9]
mov al, byte [edi]
test al, al
je 0x4a116d
cmp al, 0x3f
jne 0x4a0f48
push 4
push str._php
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4a116d
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x44
ret
cmp al, 0x53
je 0x4a1122
cmp al, 0x73
je 0x4a1122
cmp al, 0x44
je 0x4a1116
cmp al, 0x64
je 0x4a1116
cmp al, 0x48
je 0x4a10f2
cmp al, 0x68
je 0x4a10f2
cmp al, 0x50
je 0x4a10e6
cmp al, 0x70
je 0x4a10e6
cmp al, 0x4c
je 0x4a10da
cmp al, 0x6c
je 0x4a10da
cmp al, 0x62
je 0x4a10b6
cmp al, 0x42
je 0x4a10b6
cmp al, 0x49
je 0x4a1092
cmp al, 0x69
je 0x4a1092
cmp al, 0x74
je 0x4a1086
cmp al, 0x54
je 0x4a1086
cmp al, 0x66
je 0x4a1062
cmp al, 0x46
je 0x4a1062
cmp al, 0x4d
je 0x4a103e
cmp al, 0x6d
je 0x4a103e
cmp al, 0x21
jne 0x4a1002
push str._DOCTYPE
call fcn.004dd6c0
push eax
push str._DOCTYPE
push edi
call fcn.004dd670
add esp, 0x10
jmp 0x4a0f2a
cmp al, 0x2d
jne 0x4a116d
mov al, byte [edi + 1]
cmp al, 0x21
je 0x4a0f32
cmp al, 0x3f
je 0x4a0f32
cmp al, 0x3e
je 0x4a0f32
movsx ecx, al
push ecx
call fcn.0049e7f0
add esp, 4
test eax, eax
je 0x4a116d
jmp 0x4a0f32
push 5
push 0x63e6d0
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4a0f32
push 5
push str.meta_
jmp 0x4a0f21
push 5
push str.FORM
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4a0f32
push 5
push str.frame
jmp 0x4a0f21
push 5
push str.title
jmp 0x4a0f21
push 6
push str.iframe
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4a0f32
push 6
push str.INPUT
jmp 0x4a0f21
push 2
push 0x63e69c
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4a0f32
push 4
push str.body
jmp 0x4a0f21
push 4
push str.link
jmp 0x4a0f21
push 3
push 0x63e688
jmp 0x4a0f21
push 4
push str.html
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4a0f32
push 5
push str.head_
jmp 0x4a0f21
push 4
push str.div
jmp 0x4a0f21
push 5
push str.style
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4a0f32
push 6
push str.script
push edi
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x4a116d
mov al, byte [edi + 6]
cmp al, 0x61
jl 0x4a1161
cmp al, 0x7a
jg 0x4a1161
movsx eax, al
sub eax, 0x20
jmp 0x4a1164
movsx eax, al
cmp eax, 0x42
jne 0x4a0f32
mov ecx, dword [esp + 0x48]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.005dfbbe
add esp, 0x44
ret
Function at 0x4a5920
Capabilities:
Delete directory
Set file attributes

Disassembly:
sub esp, 0x408
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x404], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0
call fcn.004a5830
add esp, 4
cmp eax, 1
jne 0x4a5a62
push esi
mov esi, dword [esp + 4]
test esi, esi
je 0x4a5a61
push eax
push 0
push 0x2c
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push esi
mov dword [esp + 0x1c], 0
call fcn.004e1380
add esp, 0x18
cmp dword [esp + 4], 0xffffffff
je 0x4a5a61
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0xc], 0x21
je 0x4a5a05
push 1
lea eax, [esp + 0x10]
push eax
call fcn.00515650
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x4a59cb
lea edx, [esp + 0xc]
push edx
call fcn.004e0670
add esp, 4
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004e8c10
add esp, 8
cmp eax, 1
je 0x4a5a3c
lea ecx, [esp + 0xc]
push 0x60c81c
push ecx
call fcn.004e9050
add esp, 8
cmp eax, 1
jne 0x4a5a3c
push 0x20
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x4a5a3c
lea eax, [esp + 0xd]
push eax
lea ecx, [esp + 0x10]
push ecx
call ebx
push 1
lea edx, [esp + 0x10]
push edx
call fcn.00515650
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004e8c10
add esp, 8
cmp eax, 1
jne 0x4a5a3c
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 1
push 0
push 0x2c
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.004e1380
add esp, 0x18
cmp dword [esp + 8], 0xffffffff
jne 0x4a5990
pop ebx
pop esi
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x408
ret
Function at 0x4a6640
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1044
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x1040], eax
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1054]
xor ebx, ebx
push 0x3ff
lea eax, [esp + 0xc51]
push ebx
push eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0xc58], bl
call fcn.005dfd60
push 0x40f
lea ecx, [esp + 0x84d]
push ebx
push ecx
mov byte [esp + 0x854], bl
call fcn.005dfd60
lea edx, [esp + 0x28]
push edx
push 1
push ebx
push str.SoftwareMicroWorldFBackupExclude
mov ebp, 0x410
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x40], 0x400
mov dword [esp + 0x44], ebp
call fcn.004dc0a0
add esp, 0x2c
test eax, eax
jne 0x4a687a
push esi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x844]
push ecx
mov ecx, dword [esp + 0x1c]
push ebx
push ebx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0xc64]
push eax
push ebx
mov dword [esp + 0x38], ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push ecx
xor esi, esi
mov byte [esp + 0xc70], bl
mov byte [esp + 0x860], bl
mov dword [esp + 0x38], 0x400
call ebp
test eax, eax
jne 0x4a6879
push 0x40f
lea edx, [esp + 0x435]
push ebx
push edx
mov byte [esp + 0x43c], bl
call fcn.005dfd60
push 0x40f
lea eax, [esp + 0x31]
push ebx
push eax
mov byte [esp + 0x38], bl
call fcn.005dfd60
add esp, 0x18
xor eax, eax
jmp 0x4a6760
mov cl, byte [esp + eax + 0x840]
mov byte [esp + eax + 0x430], cl
inc eax
cmp cl, bl
jne 0x4a6760
lea ecx, [esp + 0x430]
push ecx
call fcn.004e1290
add esp, 4
cmp byte [esp + 0x430], bl
je 0x4a6824
push 1
lea edx, [esp + 0x434]
push edx
call fcn.00515650
push 0x410
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x438]
push ecx
call fcn.004e82a0
add esp, 0xc
cmp byte [esp + 0x20], bl
jne 0x4a67d1
xor eax, eax
mov cl, byte [esp + eax + 0x430]
mov byte [esp + eax + 0x20], cl
inc eax
cmp cl, bl
jne 0x4a67c1
cmp byte [esp + 0x21], 0x3a
je 0x4a67ff
cmp byte [esp + 0x22], 0x5c
je 0x4a67ff
push ebx
lea edx, [esp + 0x24]
push edx
push edi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4a6871
push edi
lea eax, [esp + 0x24]
push eax
jmp 0x4a6817
lea ecx, [esp + 0x20]
push edi
push ecx
call fcn.005e324f
add esp, 8
test eax, eax
je 0x4a6871
push edi
lea edx, [esp + 0x24]
push edx
call fcn.004e1140
add esp, 8
cmp eax, 1
je 0x4a6871
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x844]
push ecx
mov ecx, dword [esp + 0x1c]
push ebx
push ebx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0xc64]
push eax
inc esi
push esi
push ecx
mov byte [esp + 0xc70], bl
mov byte [esp + 0x860], bl
mov dword [esp + 0x38], 0x400
mov dword [esp + 0x3c], 0x410
call ebp
test eax, eax
je 0x4a6722
jmp 0x4a6879
mov dword [esp + 0x10], 1
pop esi
mov eax, dword [esp + 0x10]
pop edi
pop ebp
cmp eax, ebx
pop ebx
je 0x4a688c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1040]
mov eax, dword [esp]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x1044
ret
Function at 0x4a7110
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x1430
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x142c], eax
push ebx
push esi
lea eax, [esp + 0xc34]
push str.SOFTWAREMicroWorldFBackUpTEMP
xor ebx, ebx
push eax
xor esi, esi
mov dword [esp + 0x10], ebx
call fcn.005dfb23
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0xc48]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x1c
test eax, eax
jne 0x4a7354
push ebp
push edi
push 0x3ff
lea eax, [esp + 0x431]
push ebx
push eax
mov byte [esp + 0x438], bl
call fcn.005dfd60
push 0x40f
lea ecx, [esp + 0x83d]
push ebx
push ecx
mov byte [esp + 0x844], bl
call fcn.005dfd60
push 0x40f
lea edx, [esp + 0x39]
push ebx
push edx
mov byte [esp + 0x40], bl
call fcn.005dfd60
mov ecx, dword [esp + 0x34]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
add esp, 0x24
push 0x400
lea eax, [esp + 0x430]
push eax
push ebx
mov ebp, 0x410
push ecx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebx
call edi
test eax, eax
jne 0x4a7352
lea esp, [esp]
cmp byte [esp + 0x42c], bl
je 0x4a7352
lea edx, [esp + 0x42c]
push edx
lea eax, [esp + 0xc40]
push eax
lea ecx, [esp + 0x834]
push 0x612438
push ecx
call fcn.005dfb23
add esp, 0x10
lea edx, [esp + 0x18]
push edx
push str.RefCount
lea eax, [esp + 0x834]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [esp + 0x18], ebx
jne 0x4a72e1
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push str.FileName
lea eax, [esp + 0x838]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
cmp al, 1
jne 0x4a72a1
cmp byte [esp + 0x1c], bl
je 0x4a72a1
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1040]
push str.SOFTWAREMicroWorldFBackUp_s
push edx
call fcn.005dfb23
add esp, 0xc
push ebx
push ebx
lea eax, [esp + 0x1044]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9480
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push str.GuidFile
lea eax, [esp + 0x838]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x30], bl
mov dword [esp + 0x28], ebp
call fcn.004d5770
cmp al, 1
jne 0x4a72e1
cmp byte [esp + 0x1c], bl
je 0x4a72e1
lea ecx, [esp + 0x1c]
push ecx
call fcn.004e0670
add esp, 4
push 0x3ff
lea edx, [esp + 0x431]
push ebx
push edx
inc esi
mov byte [esp + 0x438], bl
call fcn.005dfd60
push 0x40f
lea eax, [esp + 0x83d]
push ebx
push eax
mov byte [esp + 0x844], bl
call fcn.005dfd60
push 0x40f
lea ecx, [esp + 0x39]
push ebx
push ecx
mov byte [esp + 0x40], bl
call fcn.005dfd60
mov eax, dword [esp + 0x34]
add esp, 0x24
push 0x400
lea edx, [esp + 0x430]
push edx
push esi
push eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebx
call edi
test eax, eax
je 0x4a71f0
pop edi
pop ebp
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x4a7367
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 8], ebx
push ebx
push ebx
push str.SOFTWAREMicroWorldFBackUpTEMP
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9480
mov ecx, dword [esp + 0x1434]
pop esi
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x1430
ret
Function at 0x4a7ad0
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x434]
sub esp, 0x434
push 0xfffffffffffffffe
push 0x671510
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x430], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0x43c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0x440]
mov dword [ebp - 0x2c], ecx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov byte [ebp], bl
push 0x207
push ebx
lea edx, [ebp + 1]
push edx
call fcn.005dfd60
add esp, 0xc
xor eax, eax
mov dword [ebp + 0x208], eax
mov dword [ebp + 0x20c], eax
mov dword [ebp + 0x210], eax
mov dword [ebp + 0x214], eax
mov dword [ebp + 0x218], eax
mov dword [ebp + 0x21c], eax
mov dword [ebp + 0x220], eax
mov dword [ebp + 0x224], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 1
lea eax, [ebp + 0x32c]
push eax
call fcn.00513fd0
mov dword [ebp - 0x1c], 2
lea ecx, [ebp + 0x32c]
push ecx
lea edx, [ebp + 0x228]
push edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call edi
lea eax, [ebp + 0x32c]
push eax
call fcn.004e24e0
add esp, 4
push str.up.avs
lea ecx, [ebp + 0x32c]
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
push 1
push ebx
push ebx
push ebx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp + 0x32c]
push eax
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x4a7cdb
cmp dword [ebp - 0x24], ebx
jbe 0x4a7cdb
mov dword [ebp - 0x1c], 4
lea ecx, [ebp + 0x32c]
push ecx
lea edx, [ebp]
push edx
call edi
push ebx
lea eax, [ebp]
push eax
call fcn.004f9860
test eax, eax
je 0x4a7cdb
cmp dword [ebp + 0x208], ebx
je 0x4a7cdb
mov dword [ebp - 0x1c], 5
lea ecx, [ebp + 0x228]
push ecx
call fcn.004e24e0
add esp, 4
push str.up.dat
lea edx, [ebp + 0x228]
push edx
call esi
mov dword [ebp - 0x1c], 6
push 0x61bb54
lea eax, [ebp + 0x228]
push eax
call fcn.005e00ad
add esp, 8
mov esi, eax
cmp esi, ebx
je 0x4a7cdb
mov dword [ebp - 0x1c], 7
push esi
mov ecx, dword [ebp + 0x218]
push ecx
push 1
mov edx, dword [ebp + 0x208]
push edx
call fcn.005e025d
push esi
call fcn.005dff6d
mov eax, dword [ebp + 0x208]
push eax
call fcn.005e0865
add esp, 0x18
mov dword [ebp + 0x208], ebx
mov dword [ebp - 0x1c], 8
lea ecx, [ebp + 0x228]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call edi
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
je 0x4a7ccb
lea ecx, [ebp + 0x32c]
push ecx
push eax
call edi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 9
jmp 0x4a7d02
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x4a7d0c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x430]
xor ecx, ebp
call fcn.005dfbbe
add ebp, 0x434
mov esp, ebp
pop ebp
ret