joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cbd20
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x18]
push eax
push 4
push edx
push 0x4cbd90
push 0
push 0
call fcn.00496b36
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x4cbd49
pop esi
xor al, al
pop ebx
ret
mov ecx, dword [esi]
push edi
add ecx, 4
mov eax, 1
lock xadd dword [ecx], eax
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x4cbd6d
cmp eax, 0xffffffff
je 0x4cbd6d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret

Function at 0x4cd9d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x51a3d8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x56a8e0]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
mov eax, dword [0x56a8e0]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x54]
push 0
push 0x52005c
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.0040c820
push 0x28
push str.option__canonical_option__is_ambiguous
lea ecx, [esp + 0x30]
mov dword [esp + 0x54], 0
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
call fcn.0040c820
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov byte [esp + 0x54], 1
call fcn.004cdb40
cmp dword [esp + 0x3c], 0x10
jb 0x4cda85
push dword [esp + 0x28]
call fcn.00493278
add esp, 4
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
cmp dword [esp + 0x20], 0x10
mov byte [esp + 0x4c], 4
jb 0x4cdab2
push dword [esp + 0xc]
call fcn.00493278
add esp, 4
push edi
lea ecx, [esi + 0x50]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
mov dword [esi], vtable.boost::program_options::ambiguous_option.0
call fcn.004186d0
mov eax, esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00493d56
add esp, 0x44
ret 4
Function at 0x4d57f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x51b361
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x56a8e0]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56a8e0]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
push eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x70], 0
mov dword [esp + 0x2c], 1
call fcn.004d6470
push eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x78], 1
call fcn.004d54a0
add esp, 0x10
cmp dword [esp + 0x40], 0x10
mov byte [esp + 0x68], 3
jb 0x4d5893
push dword [esp + 0x2c]
call fcn.00493278
add esp, 4
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ecx, ebx
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
mov dword [esp + 0x14], eax
je 0x4d59be
xor ebp, ebp
lea eax, [esi + ebp]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.004d6370
add esp, 8
mov esi, eax
mov ecx, dword [edi + 4]
mov byte [esp + 0x68], 4
cmp esi, ecx
jae 0x4d5921
mov eax, dword [edi]
cmp eax, esi
ja 0x4d5921
sub esi, eax
mov eax, 0x2aaaaaab
imul esi
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp ecx, dword [edi + 8]
jne 0x4d5917
push 1
mov ecx, edi
call fcn.00415600
mov eax, dword [edi]
lea ecx, [esi + esi*2]
lea esi, [eax + ecx*8]
jmp 0x4d592f
cmp ecx, dword [edi + 8]
jne 0x4d592f
push 1
mov ecx, edi
call fcn.00415600
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x4d598d
mov dword [ebx + 0x14], 7
xor eax, eax
mov dword [ebx + 0x10], 0
mov word [ebx], ax
cmp dword [esi + 0x14], 8
jae 0x4d5964
mov eax, dword [esi + 0x10]
inc eax
je 0x4d596e
add eax, eax
push eax
push esi
push ebx
call fcn.00493540
add esp, 0xc
jmp 0x4d596e
mov eax, dword [esi]
mov dword [ebx], eax
mov dword [esi], 0
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov dword [esi + 0x14], 7
xor eax, eax
mov dword [esi + 0x10], 0
mov word [esi], ax
add dword [edi + 4], 0x18
cmp dword [esp + 0x58], 8
mov byte [esp + 0x68], 3
jb 0x4d59a9
push dword [esp + 0x44]
call fcn.00493278
add esp, 4
mov esi, dword [esp + 0x18]
add ebp, 0x18
dec dword [esp + 0x14]
jne 0x4d58d1
mov ebx, dword [esp + 0x1c]
test esi, esi
je 0x4d59fb
cmp esi, ebx
je 0x4d59f2
cmp dword [esi + 0x14], 0x10
jb 0x4d59d6
push dword [esi]
call fcn.00493278
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
add esi, 0x18
cmp esi, ebx
jne 0x4d59c6
mov esi, dword [esp + 0x18]
push esi
call fcn.00493278
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00493d56
add esp, 0x58
ret
Function at 0x4d5be0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x51b419
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x56a8e0]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push esi
push edi
mov eax, dword [0x56a8e0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, dword [esp + 0x88]
mov dword [esp + 0x2c], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [esp + 0x30], esi
mov word [esi], ax
mov dword [esp + 0x80], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x2c], 1
mov edx, dword [eax + 0x14]
cmp edx, 0x10
jb 0x4d5c5d
mov ecx, dword [eax]
jmp 0x4d5c5f
mov ecx, eax
mov dword [esp + 0x14], ecx
cmp edx, 0x10
jb 0x4d5c6c
mov edx, dword [eax]
jmp 0x4d5c6e
mov edx, eax
mov ebx, dword [eax + 0x10]
add ebx, edx
cmp ecx, ebx
je 0x4d5cff
jmp 0x4d5c80
lea eax, [esp + 0x34]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
push ebx
push ecx
mov ecx, dword [esp + 0xac]
lea eax, [esp + 0x34]
push eax
call dword [esp + 0xac]
cmp eax, 2
je 0x4d5d52
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x34]
cmp edi, eax
je 0x4d5d1f
mov edx, dword [esi + 0x14]
cmp edx, 8
jb 0x4d5cd2
mov ecx, dword [esi]
jmp 0x4d5cd4
mov ecx, esi
mov eax, dword [esi + 0x10]
add eax, eax
add ecx, eax
cmp edx, 8
jb 0x4d5ce4
mov edx, dword [esi]
jmp 0x4d5ce6
mov edx, esi
add eax, edx
push edi
lea edx, [esp + 0x38]
push edx
push ecx
push eax
mov ecx, esi
call fcn.004c9620
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
jne 0x4d5c80
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00493d56
add esp, 0x74
ret
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], str.character_conversion_failed
call fcn.00493bbb
mov dword [esp + 0x20], vtable.std::logic_error.0
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x84], 2
call fcn.004d5e00
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], str.character_conversion_failed
call fcn.00493bbb
mov dword [esp + 0x20], vtable.std::logic_error.0
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x84], 1
call fcn.004d5e00
int3
Function at 0x4db7d0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x51be58
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x56a8e0]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov eax, dword [0x56a8e0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
push eax
push edx
lea eax, [esp + 0x14]
push eax
call fcn.004d9540
add esp, 0xc
push eax
push esi
lea ecx, [edi + 0x18]
mov dword [esp + 0x50], 0
call fcn.004da6b0
mov ecx, eax
call fcn.004da630
cmp dword [esp + 0x38], 0x10
jb 0x4db849
push dword [esp + 0x24]
call fcn.00493278
add esp, 4
cmp dword [esp + 0x20], 0x10
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
jb 0x4db871
push dword [esp + 0xc]
call fcn.00493278
add esp, 4
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00493d56
add esp, 0x40
ret 0xc
Function at 0x4ddda0
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
je 0x4ddf02
push edi
push 0x56ed94
call fcn.004aba60
add esp, 4
cmp byte [esi], 0x20
mov edi, eax
jne 0x4dddd6
lea esp, [esp]
inc esi
cmp byte [esi], 0x20
je 0x4dddd0
mov al, byte [esi]
cmp al, 0x22
jne 0x4ddde3
mov byte [esp + 0xf], al
inc esi
jmp 0x4dddf3
cmp al, 0x27
jne 0x4dddee
mov byte [esp + 0xf], al
inc esi
jmp 0x4dddf3
mov byte [esp + 0xf], 0x20
mov al, byte [esi]
push ebx
mov ecx, esi
test al, al
je 0x4dde18
mov dl, byte [esp + 0x13]
cmp al, dl
je 0x4dde18
cmp al, 0x2f
je 0x4ddf06
cmp al, 0x5c
je 0x4dde18
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4dde00
mov bl, 0x5c
test edi, edi
je 0x4dde4b
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4dde23
sub eax, edx
push eax
push edi
push esi
call fcn.004b3107
add esp, 0xc
test eax, eax
jne 0x4dde4b
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4dde40
sub eax, edx
add esi, eax
mov al, byte [esi]
mov edi, esi
test al, al
je 0x4dde63
mov cl, byte [esp + 0x13]
cmp al, cl
je 0x4dde63
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4dde57
dec edi
mov ecx, edi
cmp edi, esi
jb 0x4dde79
lea ebx, [ebx]
cmp byte [ecx], bl
je 0x4dde79
dec ecx
cmp ecx, esi
jae 0x4dde70
mov esi, dword [esp + 0x1c]
dec esi
inc ecx
xor edx, edx
pop ebx
test esi, esi
jle 0x4ddefd
mov al, byte [ecx]
test al, al
je 0x4ddeb8
lea esp, [esp]
cmp ecx, edi
ja 0x4ddeb8
cmp al, 0x61
jl 0x4dde9c
cmp al, 0x7a
jle 0x4ddeb8
cmp al, 0x41
jl 0x4ddea4
cmp al, 0x5a
jle 0x4ddeb8
cmp al, 0x30
jl 0x4ddeac
cmp al, 0x39
jle 0x4ddeb8
cmp al, 0x2e
je 0x4ddebd
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4dde90
cmp byte [ecx], 0x2e
jne 0x4ddeea
mov al, byte [ecx + 1]
test al, al
je 0x4ddeea
cmp al, 0x65
je 0x4ddecc
cmp al, 0x45
jne 0x4ddeea
mov al, byte [ecx + 2]
test al, al
je 0x4ddeea
cmp al, 0x78
je 0x4ddedb
cmp al, 0x58
jne 0x4ddeea
mov al, byte [ecx + 3]
test al, al
je 0x4ddeea
cmp al, 0x65
je 0x4ddefd
cmp al, 0x45
je 0x4ddefd
mov al, byte [ecx]
test al, al
je 0x4ddefd
cmp ecx, edi
ja 0x4ddefd
mov byte [edx + ebp], al
inc edx
inc ecx
cmp edx, esi
jl 0x4dde86
mov byte [edx + ebp], 0
pop edi
pop esi
pop ebp
pop ecx
ret
mov bl, 0x2f
jmp 0x4dde1a

Function at 0x4de040
Capabilities:
Create directory

Disassembly:
sub esp, 0x20
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
push 1
lea eax, [esp + 0x10]
push eax
mov dword [esp + 8], 0xc
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x4de09d
push 0
push 0
push 1
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x4de09d
lea eax, [esp]
push eax
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x10]
push eax
mov dword [esp + 0xc], edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0x20
ret
xor eax, eax
push eax
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0x20
ret
Function at 0x4de0f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4de12d
push ebx
call fcn.004de040
add esp, 4
test eax, eax
jne 0x4de129
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
push esi
push str.Q_d__s
call fcn.004ddcb0
add esp, 0xc
mov eax, esi
pop esi
pop edi
ret
xor eax, eax
pop edi
ret
test al, 0x10
jne 0x4de129
push ebx
push str.L__s
call fcn.004ddcb0
add esp, 8
mov eax, 0x11
pop edi
ret

Function at 0x4de150
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, eax
mov ebx, edx
test esi, esi
je 0x4de1f6
cmp dword [esp + 0x14], 0
je 0x4de1f6
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4de172
sub eax, edx
push ebp
mov ebp, eax
cmp esi, ebx
je 0x4de191
push 0x104
push esi
push ebx
call fcn.00505930
add esp, 0xc
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4de1b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
push esi
push str.I_l__s
call fcn.004ddcb0
add esp, 0xc
jmp 0x4de1bd
and eax, 0x10
jne 0x4de1d3
push ebx
push str.J__s
call fcn.004ddcb0
add esp, 8
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x18]
mov eax, 0x104
sub eax, ebp
push eax
push ecx
push ebx
call fcn.005057f0
add esp, 0xc
mov eax, edi
call fcn.004de0f0
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
push 0x56edbc
call fcn.004ddcb0
add esp, 4
pop edi
pop esi
mov eax, 0x16
pop ebx
pop ecx
ret

Function at 0x4de210
Capabilities:
Get common file path

Disassembly:
push ecx
push esi
push edi
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, eax
test esi, esi
jne 0x4de25c
mov ecx, dword [esp + 8]
push ebx
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x4de25c
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0x56edc8
mov ecx, ebx
mov eax, edi
mov edx, ebx
call fcn.004de150
add esp, 4
pop edi
pop esi
pop ecx
ret
push esi
push str.N_x
call fcn.004ddcb0
add esp, 8
push 0x56edd8
push 0x56ede0
call fcn.004aba60
mov ecx, eax
add esp, 4
mov eax, edi
mov edx, ebx
call fcn.004de150
add esp, 4
pop edi
pop esi
pop ecx
ret
Function at 0x4de290
Capabilities:
Get common file path

Disassembly:
push ecx
push esi
push edi
mov edi, eax
lea eax, [esp + 8]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, eax
test esi, esi
jne 0x4de2dc
mov ecx, dword [esp + 8]
push ebx
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x4de2dc
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0x56ede8
mov ecx, ebx
mov eax, edi
mov edx, ebx
call fcn.004de150
add esp, 4
pop edi
pop esi
pop ecx
ret
push esi
push str.P_x
call fcn.004ddcb0
add esp, 8
push str.clp
push str.windir
call fcn.004aba60
mov ecx, eax
add esp, 4
mov eax, edi
mov edx, ebx
call fcn.004de150
add esp, 4
pop edi
pop esi
pop ecx
ret

Function at 0x4de310
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x84
mov eax, dword [0x56a8e0]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push esi
push str.PUBLIC
xor ebx, ebx
call fcn.004aba60
add esp, 4
test eax, eax
je 0x4de3b1
mov ecx, eax
lea esi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4de340
sub ecx, esi
add ecx, 0xd
cmp ecx, 0x80
jae 0x4de3b1
lea edx, [esp + 8]
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4de360
mov eax, 0x56ee10
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4de371
push edi
lea edi, [esp + 0xc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4de380
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0xc]
and ecx, 3
push 0x56ee20
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.005047a9
add esp, 8
mov esi, eax
pop edi
test esi, esi
jne 0x4de3c9
push 0x56ee24
push str.clpacct.txt
call fcn.005047a9
mov esi, eax
add esp, 8
test esi, esi
je 0x4de411
push 0x80
lea ecx, [esp + 0xc]
push 0
push ecx
call fcn.004948b0
push esi
push 0x80
lea edx, [esp + 0x1c]
push 1
push edx
call fcn.00505c17
add esp, 0x1c
test eax, eax
jle 0x4de408
lea eax, [esp + 8]
push eax
call fcn.004ab9bf
mov ebx, eax
add esp, 4
test ebx, ebx
jge 0x4de408
xor ebx, ebx
push esi
call fcn.00497adb
add esp, 4
mov ecx, dword [esp + 0x88]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00493d56
add esp, 0x84
ret
Function at 0x4de430
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
test esi, esi
je 0x4de5ef
cmp byte [esi], 0
je 0x4de5ef
test edi, edi
je 0x4de5ef
cmp byte [edi], 0
je 0x4de5ef
test ebx, ebx
je 0x4de5ef
cmp byte [ebx], 0
je 0x4de5ef
test ebp, ebp
je 0x4de5ef
cmp byte [ebp], 0
je 0x4de5ef
test eax, eax
je 0x4de5ef
cmp byte [eax], 0
je 0x4de5ef
mov ecx, str.HKEY_LOCAL_MACHINE
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4de4c3
test dl, dl
je 0x4de4bf
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4de4c3
add eax, 2
add ecx, 2
test dl, dl
jne 0x4de4a3
xor eax, eax
jmp 0x4de4c8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4de4d3
mov eax, 0x80000002
jmp 0x4de549
mov ecx, str.HKEY_CURRENT_USER
mov eax, esi
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4de500
test dl, dl
je 0x4de4fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4de500
add eax, 2
add ecx, 2
test dl, dl
jne 0x4de4e0
xor eax, eax
jmp 0x4de505
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4de510
mov eax, 0x80000001
jmp 0x4de549
mov ecx, str.HKEY_USERS
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4de537
test dl, dl
je 0x4de533
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4de537
add eax, 2
add ecx, 2
test dl, dl
jne 0x4de517
xor eax, eax
jmp 0x4de53c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4de5ef
mov eax, 0x80000003
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4de5ef
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0xc]
push edx
push eax
push eax
push eax
mov eax, dword [esp + 0x24]
push ebx
push eax
call edi
test eax, eax
jne 0x4de5e4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4de5e4
push eax
call fcn.00494940
mov edx, dword [esp + 0x18]
add esp, 4
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push ebx
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esi], 0
jne 0x4de5c6
push esi
xor edi, edi
call fcn.004934fd
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
ret
push 0
push esi
push ebp
call fcn.004dd200
add esp, 0xc
push esi
mov edi, eax
call fcn.004934fd
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
ret
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
Function at 0x4de840
Capabilities:
Copy file

Disassembly:
mov eax, dword [esi + 0x188]
mov ecx, dword [esi + 0x18c]
mov edx, eax
or edx, ecx
push ebp
mov ebp, dword [esp + 8]
je 0x4de9e7
mov edx, dword [esi + 0x50]
push edi
mov edi, dword [esi + 0x54]
push ecx
push eax
push edi
push edx
call fcn.0050504b
fcomp qword [0x535c40]
add esp, 0x10
fnstsw ax
test ah, 5
jnp 0x4de9e6
mov ecx, dword [esi + 0x18c]
mov eax, dword [esi + 0x188]
mov edi, dword [esi + 0x54]
mov edx, dword [esi + 0x50]
push ecx
push eax
push edi
push edx
call fcn.0050504b
fcomp qword [0x535c38]
add esp, 0x10
fnstsw ax
test ah, 0x41
je 0x4de9e6
mov eax, dword [esi + 0x190]
mov ecx, dword [esi + 0x194]
mov edx, eax
or edx, ecx
je 0x4de8e3
push ecx
mov ecx, dword [esi + 0x50]
push eax
mov eax, dword [esi + 0x54]
push eax
push ecx
call fcn.004dc840
fcomp qword [0x535c38]
add esp, 0x10
fnstsw ax
test ah, 5
jnp 0x4de9e6
mov eax, dword [esi + 0x198]
call fcn.004de7c0
test eax, eax
je 0x4de9e6
push ebx
push ebp
call fcn.004b3007
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4de91a
push 0x56f138
lea edi, [esi + 0x18]
call fcn.004ddcb0
add esp, 4
pop ebx
pop edi
pop ebp
ret
mov eax, ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4de920
sub eax, edx
mov edx, dword [0x56f13c]
mov dword [eax + ebx - 4], edx
mov cl, byte [0x56f140]
mov byte [eax + ebx], cl
push esi
mov ecx, ebx
call fcn.004de7f0
add esp, 4
test eax, eax
je 0x4de977
cdq
push edx
push eax
mov dword [esi + 0x194], edx
mov edx, dword [esi + 0x54]
mov dword [esi + 0x190], eax
mov eax, dword [esi + 0x50]
push edx
push eax
call fcn.004dc840
fcomp qword [0x535c30]
add esp, 0x10
fnstsw ax
test ah, 5
jnp 0x4de9e5
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4de99c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.zO_d
lea edi, [esi + 0x18]
call fcn.004ddcb0
add esp, 8
push 0
push 0x80
push 3
push 0
push 7
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4de9ca
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.004934fd
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
mov dword [esi + 0x190], ecx
mov dword [esi + 0x194], edx
add esp, 4
pop ebx
pop edi
pop ebp
ret

Function at 0x4de9f0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov eax, dword [esi + 0x148]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4dea52
push edi
test bl, 1
je 0x4dea38
push ebx
push 0x56f14c
lea edi, [esi + 0x18]
call fcn.004ddcb0
mov edx, dword [esi + 0x148]
mov ecx, ebx
and ecx, 0x3126
add esp, 8
or ecx, 0x80
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test ebx, 0xffff9758
je 0x4dea51
push ebx
push str.zK_X
lea edi, [esi + 0x18]
call fcn.004ddcb0
add esp, 8
pop edi
pop ebx
ret