joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ca30
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x208
add eax, 0xffff9ff0
push esi
cmp eax, 4
mov esi, ecx
ja case.0x48ca4b.24595
jmp dword [eax*4 + 0x48cb40]
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x48ca77
mov edx, dword [eax + 0x24]
lea ecx, [eax + 0x24]
call dword [edx + 0x50]
test eax, eax
je 0x48ca77
mov ecx, esi
call fcn.0048c750
pop esi
add esp, 0x208
ret 4
mov ecx, esi
call fcn.0048c7b0
pop esi
add esp, 0x208
ret 4
mov eax, dword [esi + 4]
push 0
push 0
push 0x5403
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
add esp, 0x208
ret 4
mov cx, word [0x56d150]
push edi
mov word [esp + 8], cx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x58d1a4]
push str.360Start.exe
lea edx, [esp + 0xc]
push 0x103
push edx
push eax
call fcn.0043f130
lea ecx, [esp + 0x18]
push ecx
call fcn.00451430
add esp, 0x14
test eax, eax
pop edi
je case.0x48ca4b.24595
push 5
push 0
lea edx, [esp + 0xc]
push str._SafeMode
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
add esp, 0x208
ret 4
mov eax, dword [0x587dd0]
push eax
push 0
push 1
push 1
push 1
push 1
push 0
push 0xab
call fcn.0049b640
add esp, 4
mov ecx, esi
push eax
call fcn.00487ba0
pop esi
add esp, 0x208
ret 4

Function at 0x48cb60
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push esi
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
xor esi, esi
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x48cba9
lea ecx, [esp + 4]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x48cba9
xor eax, eax
pop esi
add esp, 0xc
ret 4
mov ecx, dword [esp + 4]
lea edx, [esp + 0xc]
lea eax, [esp + 8]
push edx
push eax
push 0
push 0
push str.GlobalUserOffline
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48cbe6
mov eax, dword [esp + 8]
xor edx, edx
cmp eax, 1
sete dl
xor ecx, ecx
mov esi, edx
test eax, eax
sete cl
mov dword [esp + 8], ecx
jmp 0x48cbee
mov dword [esp + 8], 1
mov eax, dword [esp + 0x14]
test eax, eax
je 0x48cc0a
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret 4
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push eax
push ecx
push 4
push 0
push str.GlobalUserOffline
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00477470
push 0xffffffffffffffff
push 0
push 1
push 8
push 0x207
call fcn.0041d0f0
mov ecx, eax
call fcn.0041d7f0
mov eax, esi
pop esi
add esp, 0xc
ret 4
Function at 0x48cda0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xa2c
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
mov ebp, dword [sym.imp.USER32.dll_LoadStringW]
rep stosd dword es:[edi], eax
mov ecx, dword [0x58d1a0]
push 0x104
stosw word es:[edi], ax
lea eax, [esp + 0x220]
push eax
push 0x1c
push ecx
call ebp
mov eax, dword [0x58d1a0]
lea edx, [esp + 0x424]
push 0x104
push edx
push 0x14
push eax
call ebp
lea ecx, [esp + 0x21c]
push ecx
call fcn.0043f750
mov eax, dword [esp + 0xa44]
lea edx, [esp + 0x18]
push 0x104
push edx
push eax
call fcn.0043fba0
push 0
push 0
push 0x80802
lea ecx, [esp + 0x30]
push 0x561928
lea edx, [esp + 0x23c]
push ecx
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x448]
push edx
mov edx, dword [0x58d1a4]
push eax
push ecx
push edx
call fcn.0043f900
add esp, 0x34
test eax, eax
je 0x48cf51
lea eax, [esp + 0x14]
push 0x5590ec
push eax
xor edi, edi
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x48cf16
push esi
push 1
lea ecx, [esp + 0x18]
push 2
push ecx
mov dword [esp + 0x20], 0xfeff
call dword [sym.imp.MSVCRT.dll_fwrite]
mov edx, dword [esp + 0xa50]
push esi
push edx
call dword [sym.imp.MSVCRT.dll_fputws]
add esp, 0x18
cmp eax, 0xffffffff
je 0x48ceac
mov edi, 1
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
test edi, edi
je 0x48cf16
lea eax, [esp + 0x14]
push eax
push 0x18
call fcn.0049b640
add esp, 4
lea ecx, [esp + 0x630]
push eax
push 0x208
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov eax, dword [ebx + 0x60]
add esp, 0x10
mov word [esp + 0xa3a], 0
mov edx, dword [eax + 0xef0]
lea ecx, [eax + 0xef0]
lea eax, [esp + 0x62c]
push 0x7d0
push eax
call dword [edx + 0xc]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa2c
ret 4
cmp word [0x56d804], 0
jne 0x48cf35
mov ecx, dword [0x58d1a0]
push 0x104
push 0x56d804
push 0x32
push ecx
call ebp
push 0x10
push 0x56d804
push 0x1d
call fcn.0049b640
mov edx, dword [ebx + 4]
add esp, 4
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa2c
ret 4
Function at 0x48d480
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
mov ecx, esi
call fcn.00418ea0
test esi, esi
je 0x48d4a9
mov eax, dword [esi + 0x560c]
cmp eax, 0xffffffff
je 0x48d4a9
mov ecx, dword [edi + 0x58]
push 1
push eax
call fcn.0050d850
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.00415fb0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
mov ecx, esi
call fcn.00415fd0
push 0
mov ecx, esi
call fcn.0041bf90
push 0
mov ecx, esi
call fcn.00416bb0
mov ecx, dword [edi + 0x58]
push 0
call fcn.0050d1b0
test eax, eax
jne 0x48d52e
cmp dword [0x5be9d8], 1
jne 0x48d512
mov ecx, dword [edi + 0x5c]
test ecx, ecx
je 0x48d52e
mov edx, dword [ecx]
call dword [edx + 0x20]
test eax, eax
je 0x48d52e
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret 0x14
mov eax, dword [0x587dd0]
push 0
push 0
push 0
push 1
push eax
push 0
push str.se:blank
mov ecx, edi
call fcn.00484ba0
pop edi
pop esi
ret 0x14

Function at 0x48d670
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1250
call fcn.0051d1f0
mov ax, word [0x56d150]
push ebx
push esi
mov ebx, ecx
push edi
mov word [esp + 0x214], ax
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x216]
push 0x8e
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.0049b640
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 4
lea ecx, [esp + 0x214]
push eax
push 0x5394a4
push 0x823
push ecx
call esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1e]
add esp, 0x10
mov word [esp + 0xc], 0
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
push str.Import.exe
push 0x56d3f4
push 0x539c6c
push 0x103
push edx
stosw word es:[edi], ax
call esi
lea eax, [esp + 0x20]
push 0
push eax
call fcn.0043f120
add esp, 0x1c
test eax, eax
je 0x48d72d
push 5
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
pop ebx
add esp, 0x1250
ret
mov edx, dword [ebx + 4]
push 0
push 0
push 0
push 0x6401
push edx
push 0x2710
push 0
push 0
push 1
push 0x56d150
lea eax, [esp + 0x23c]
push 0
push eax
call fcn.004787a0
add esp, 0x30
pop edi
pop esi
pop ebx
add esp, 0x1250
ret
Function at 0x48e750
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x2c
mov eax, dword [0x587dcc]
push ebp
push esi
mov esi, ecx
test eax, eax
push edi
mov dword [esp + 0x10], esi
je 0x48e8f1
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x48e782
mov eax, dword [esi + 0x64]
test eax, eax
mov dword [esp + 0x3c], eax
je 0x48e8f1
mov edi, eax
cmp dword [edi + 0x50], 2
jbe 0x48e8f1
mov ebp, dword [esp + 0x40]
mov dword [esp + 0xc], 0
test ebp, ebp
jne 0x48e7b8
mov eax, dword [esi + 4]
mov dword [esp + 0xc], 1
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, eax
test ebp, ebp
je 0x48e8f1
mov edx, dword [esi + 4]
lea ecx, [esp + 0x18]
push ebx
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebx, eax
push ebp
mov dword [esp + 0x48], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
push ebx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
lea edx, [esp + 0x1c]
push 6
push edx
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_FillRect]
mov edi, dword [edi + 0x562c]
test edi, edi
jne 0x48e81e
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x48e81e
call fcn.0041ca40
mov edi, eax
mov eax, dword [0x5be9e0]
test eax, eax
je 0x48e87a
test edi, edi
je 0x48e87a
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x48e87a
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x48e876
lea ecx, [esp + 0x2c]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
push 0xcc0020
push 0
push 0
push ebx
push edx
push eax
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push ebx
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ebx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x48e894
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push esi
call fcn.0048e990
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push 0xcc0020
push 0
push 0
push esi
push eax
push ecx
push 0
push 0
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x48e8c3
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
test ebx, ebx
je 0x48e8ce
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
test esi, esi
pop ebx
je 0x48e8da
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x48e8f1
mov edx, dword [esp + 0x10]
push ebp
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
add esp, 0x2c
ret 8
Function at 0x4920a0
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
push edi
push ebp
lea ebx, [esi + 0x3ab0]
push 0x5394a4
push 0x103
push ebx
mov dword [esi + 0x3ec0], eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea edi, [esi + 0x3cb8]
push ebp
push 0x5394a4
push 0x103
push edi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 1
push edi
call fcn.0043f2a0
add esp, 8
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call ebx
test eax, eax
je 0x492125
push edi
call ebx
test eax, eax
je 0x492125
mov ecx, esi
call fcn.00492010
mov ecx, esi
call fcn.00492300
pop edi
pop esi
pop ebp
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x493080
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.00492cd0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push 0x17
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
xor ebp, ebp
cmp ebx, ebp
je 0x493120
mov edx, dword [esi + 0xc]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebp
je 0x493119
mov eax, dword [esi + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x493117
mov dword [esi + 0x230], eax
mov dword [esi + 0x22c], ebp
push 0x10
mov byte [esi + 0x224], 0
call sub.gdiplus.dll_GdipAlloc
mov edi, eax
test edi, edi
je 0x49310f
lea eax, [edi + 4]
lea ecx, [esi + 0x220]
push eax
push ecx
mov dword [edi], 0x525854
mov dword [eax], 0
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [edi + 8], eax
jmp 0x493111
xor edi, edi
mov dword [esi + 0x21c], edi
xor ebp, ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edi, dword [esi + 0x21c]
mov dword [esi + 0xc], ebp
cmp edi, ebp
mov word [esi + 0x10], bp
je 0x493188
mov eax, dword [edi + 4]
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], ebp
call sub.gdiplus.dll_GdipGetImageWidth
cmp eax, ebp
je 0x49314a
mov dword [edi + 8], eax
mov ecx, dword [esp + 0x18]
mov edi, dword [esi + 0x21c]
mov dword [esi + 4], ecx
lea edx, [esp + 0x18]
mov eax, dword [edi + 4]
push edx
push eax
mov dword [esp + 0x20], ebp
call sub.gdiplus.dll_GdipGetImageHeight
cmp eax, ebp
je 0x493170
mov dword [edi + 8], eax
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esi + 8], ecx
mov ecx, dword [esi + 4]
pop edi
cmp ecx, ebp
pop esi
pop ebp
setg al
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x493e90
Capabilities:
Write file on windows

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
mov esi, 0xfa000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x493ec4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
cmp edi, 0xfa000
jae 0x493ed6
mov esi, edi
lea ecx, [esp + 0x14]
push 0
push ecx
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x493ef8
cmp esi, edi
je 0x493f06
sub edi, 0xfa000
add ebx, esi
jmp 0x493ecc
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x495d90
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5204db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
push 0x224
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
cmp esi, ebx
mov dword [esp + 0x20], ebx
je 0x495e12
mov al, byte [esp + 0x28]
mov dl, byte [esp + 0x28]
lea ecx, [esi + 0x20c]
mov byte [ecx], al
mov byte [ecx + 1], dl
mov byte [ecx + 8], bl
call fcn.00498d30
mov eax, dword [0x5381a0]
mov ecx, 0x82
mov dword [esi + 0x21c], eax
mov dword [esi], ebx
mov eax, dword [esi + 0x210]
lea edi, [esi + 4]
mov dword [esi + 0x220], eax
xor eax, eax
rep stosd dword es:[edi], eax
jmp 0x495e14
xor esi, esi
cmp esi, ebx
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0xc], esi
jne 0x495e3b
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
mov dword [ecx], esi
mov dword [esi], edx
mov esi, dword [esp + 0x2c]
push esi
call edi
add esp, 4
cmp eax, 0x103
jbe 0x495e65
mov eax, 0x103
jmp 0x495e6b
push esi
call edi
add esp, 4
push ebp
push eax
mov eax, dword [esp + 0x14]
push esi
add eax, 4
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov eax, dword [ecx]
cmp eax, 2
je 0x495f5c
cmp eax, 1
jne 0x495ea5
push ebx
push esi
call fcn.0043f120
add esp, 8
test eax, eax
je 0x495f5c
push ebx
push 0x20
push 3
push ebx
push 1
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x495eca
mov dword [esp + 0x14], 1
jmp 0x495f30
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
jbe 0x495f50
lea edx, [edi + 2]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x495f30
lea ecx, [esp + 0x34]
push ebx
push ecx
lea eax, [esi + edi]
push edi
push esi
mov dword [esp + 0x44], ebx
push ebp
mov word [eax], bx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x495f1f
cmp edi, dword [esp + 0x34]
jne 0x495f1f
mov edx, dword [esp + 0x2c]
push esi
push edx
call fcn.00495840
add esp, 8
mov dword [esp + 0x14], eax
push esi
call fcn.0051d19a
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, ebx
je 0x495f50
mov eax, dword [esp + 0x2c]
mov dword [eax], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x495f50
lea ecx, [esp + 0x10]
push ebx
push ecx
call fcn.00495f80
add esp, 8
mov dword [esp + 0x10], ebx
cmp ebp, 0xffffffff
je 0x495f5c
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x4962b0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5204f8
push eax
mov dword fs:[0], esp
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
test ebp, ebp
je 0x496438
mov esi, dword [esp + 0x28]
test esi, esi
je 0x496438
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x496438
mov eax, dword [esp + 0x30]
cmp dword [eax], 0
jbe 0x496438
mov eax, dword [ebp + 0x21c]
lea edi, [ebp + 0x21c]
push esi
push eax
lea ebx, [ebp + 0x20c]
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x496323
mov esi, dword [ebp + 0x220]
jmp 0x49638f
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov ecx, edi
call fcn.00439490
push esi
lea ecx, [esp + 0x24]
call fcn.0043de10
lea ecx, [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
push edx
mov ecx, ebx
mov dword [esp + 0x20], 0
call fcn.00498130
mov eax, dword [esp + 0x20]
mov edx, dword [0x538120]
mov esi, dword [esp + 0x28]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x496389
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x496389
mov edx, dword [esp + 0x20]
add edx, 0xfffffff4
push edx
call fcn.0051d19a
add esp, 4
mov dword [ebp + 0x220], esi
cmp esi, dword [ebx + 4]
je 0x496438
mov esi, dword [esi + 0x10]
mov ecx, dword [esp + 0x24]
cmp ecx, dword [esi + 0xc]
jae 0x496438
mov eax, dword [esi + 4]
test ecx, ecx
mov eax, dword [eax]
jle 0x4963ec
mov edx, dword [0x584c00]
mov esi, ecx
mov ecx, dword [eax + 8]
cmp ecx, edx
je 0x4963d0
mov eax, dword [ecx]
cmp eax, edx
je 0x4963e7
mov ecx, eax
mov eax, dword [ecx]
cmp eax, edx
jne 0x4963c6
jmp 0x4963e7
mov ecx, dword [eax + 4]
cmp eax, dword [ecx + 8]
jne 0x4963e2
mov eax, ecx
mov ecx, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je 0x4963d8
cmp dword [eax + 8], ecx
je 0x4963e9
mov eax, ecx
dec esi
jne 0x4963b9
mov ecx, dword [eax + 0x10]
mov esi, dword [esp + 0x30]
mov edx, dword [eax + 0xc]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
push ecx
push edx
push 0x56548c
push eax
push edi
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov ecx, dword [esi]
push edi
mov word [edi + ecx*2 - 2], 0
call dword [sym.imp.MSVCRT.dll_wcslen]
mov dword [esi], eax
add esp, 0x18
mov eax, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret
Function at 0x499af0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [ecx + 4]
sub esp, 0xc
cmp eax, 3
je 0x499b85
cmp eax, 1
jne 0x499b0a
xor eax, eax
add esp, 0xc
ret
lea eax, [esp]
mov dword [esp + 4], 0
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x499b85
mov eax, dword [esp]
test eax, eax
je 0x499b85
lea ecx, [esp + 4]
lea edx, [esp + 8]
push ecx
push edx
push 0
push 0
push str.ProxyEnable
push eax
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
test eax, eax
jne 0x499b85
xor eax, eax
add esp, 0xc
ret
mov eax, 1
add esp, 0xc
ret
Function at 0x49a890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x520716
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
mov dword [edi], 0x5285c4
mov eax, dword [edi + 0x28]
lea esi, [edi + 0x24]
push eax
mov dword [esp + 0x30], 1
mov ecx, dword [eax]
lea eax, [esp + 0x14]
push ecx
push eax
mov ecx, esi
call fcn.00413510
mov eax, dword [esi + 4]
push eax
call fcn.0051d19a
mov ebp, dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
xor ebx, ebx
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esp + 0x10]
xor esi, esi
call ebp
mov eax, dword [0x57138c]
dec eax
mov dword [0x57138c], eax
jne 0x49a911
mov esi, dword [0x571388]
mov dword [0x571388], ebx
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
cmp esi, ebx
je 0x49a928
push esi
call fcn.0051d19a
add esp, 4
mov eax, dword [edi + 0x18]
lea esi, [edi + 0x14]
push eax
mov byte [esp + 0x30], bl
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.0045a3b0
mov eax, dword [esi + 4]
push eax
call fcn.0051d19a
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esp + 0x10]
xor esi, esi
call ebp
mov eax, dword [0x57a830]
dec eax
mov dword [0x57a830], eax
jne 0x49a975
mov esi, dword [0x57a82c]
mov dword [0x57a82c], ebx
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
cmp esi, ebx
je 0x49a98c
push esi
call fcn.0051d19a
add esp, 4
mov ecx, dword [edi + 0x10]
lea esi, [edi + 4]
cmp ecx, ebx
mov dword [esp + 0x2c], 0xffffffff
mov edi, dword [esi + 4]
mov eax, dword [edi]
mov dword [esp + 0x10], eax
je 0x49a9e0
mov ecx, eax
cmp eax, ecx
jne 0x49a9e0
mov edx, dword [edi + 4]
mov ecx, esi
push edx
call fcn.00413f10
mov eax, dword [esi + 4]
mov ecx, dword [0x571388]
lea edx, [esp + 0x18]
mov dword [eax + 4], ecx
mov eax, dword [esi + 4]
mov dword [esi + 0xc], ebx
push edx
mov dword [eax], eax
mov eax, dword [esi + 4]
mov ecx, esi
mov dword [eax + 8], eax
call fcn.0049e660
jmp 0x49aa08
cmp eax, edi
je 0x49aa08
lea eax, [esp + 0x1c]
push ebx
push eax
lea ecx, [esp + 0x18]
call fcn.00459c10
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.00413ab0
cmp dword [esp + 0x10], edi
jne 0x49a9e4
mov eax, dword [esi + 4]
push eax
call fcn.0051d19a
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esp + 0x14]
xor esi, esi
call ebp
mov eax, dword [0x57138c]
dec eax
mov dword [0x57138c], eax
jne 0x49aa3b
mov esi, dword [0x571388]
mov dword [0x571388], ebx
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
cmp esi, ebx
je 0x49aa52
push esi
call fcn.0051d19a
add esp, 4
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret