joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436650
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a54e8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x6c]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4c6280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00436b70
mov ecx, dword [ebp - 0x14]
call fcn.00436860
mov ecx, dword [ebp - 0x14]
add ecx, 4
call fcn.00410760
push eax
lea ecx, [ebp - 0x34]
call fcn.00419660
mov dword [ebp - 4], 0
push str.pluginsWifiGXSetup.ini
lea ebx, [ebp - 0x34]
call fcn.0045e870
lea ecx, [ebp - 0x40]
call fcn.0040fcf0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.0045e4f0
mov esi, esp
push eax
push 0x103
push 0x104
lea ecx, [ebp - 0x40]
call fcn.00410180
push eax
push 0x4b3234
push str.Uninstall
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp esi, esp
call fcn.0049f8de
push 0xffffffffffffffff
lea ecx, [ebp - 0x40]
call fcn.004101e0
lea ecx, [ebp - 0x40]
call fcn.004101b0
movzx eax, al
test eax, eax
jne 0x43675e
lea ecx, [ebp - 0x40]
call fcn.00410760
push eax
push 0x4b34f4
mov esi, 0x4ca290
call fcn.0045f140
add esp, 8
push 0
push 0
lea ecx, [ebp - 0x40]
call fcn.00410760
xor ecx, ecx
mov edi, 0x4b3510
mov ebx, eax
call fcn.0045cbf0
add esp, 8
lea esi, [ebp - 0x64]
call fcn.0045c130
mov byte [ebp - 4], 2
push str.Quarantine_Cache
lea ebx, [ebp - 0x64]
call fcn.0045e870
push 0
lea ecx, [ebp - 0x64]
call fcn.0045e4f0
push eax
call fcn.0045bc10
add esp, 8
mov dword [ebp - 0x6c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.00419810
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0040fde0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00419810
mov eax, dword [ebp - 0x6c]
push edx
mov ecx, ebp
push eax
lea edx, [0x4367f4]
call fcn.0049f901
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047f404
add esp, 0x6c
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret
Function at 0x437430
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5468
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov eax, dword [0x4c6280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push str.SOFTWAREMicrosoftInternet_ExplorerProtocolExecute_
lea ecx, [ebp - 0x18]
call fcn.0040ff10
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.00420a90
lea ecx, [ebp - 0x18]
call fcn.00410760
mov esi, esp
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp esi, esp
call fcn.0049f8de
mov esi, esp
mov ecx, dword [ebp + 8]
push ecx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp esi, esp
call fcn.0049f8de
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040fde0
mov eax, dword [ebp - 0x20]
push edx
mov ecx, ebp
push eax
lea edx, [0x43750c]
call fcn.0049f901
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret 4

Function at 0x4385a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5468
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov eax, dword [0x4c6280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
lea ecx, [ebp - 0x18]
call fcn.0040fee0
mov dword [ebp - 4], 0
push str.TSClinicWebListener.dll
lea ecx, [ebp - 0x18]
call fcn.00425900
lea ecx, [ebp - 0x18]
call fcn.00410760
push eax
call fcn.00434240
add esp, 4
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
lea ecx, [ebp - 0x18]
call fcn.0040ffa0
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x14], 0x40
jne 0x438638
push str.QMContextUninstall64.dll
lea ecx, [ebp - 0x18]
call fcn.00425900
jmp 0x438645
push str.QMContextUninstall.dll
lea ecx, [ebp - 0x18]
call fcn.00425900
lea ecx, [ebp - 0x18]
call fcn.00410760
mov esi, esp
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp esi, esp
call fcn.0049f8de
test eax, eax
je 0x438672
lea ecx, [ebp - 0x18]
call fcn.00410760
push eax
call fcn.00434240
add esp, 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040fde0
mov eax, dword [ebp - 0x20]
push edx
mov ecx, ebp
push eax
lea edx, [0x4386b8]
call fcn.0049f901
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret
Function at 0x438830
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jne 0x438851
jmp 0x4388a8
mov esi, esp
push 0x4b1a00
mov edi, esp
push 0x4b1a14
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp edi, esp
call fcn.0049f8de
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x438895
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
cmp esi, esp
call fcn.0049f8de
jmp 0x4388a8
mov esi, esp
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, esp
call fcn.0049f8de
pop edi
pop esi
add esp, 8
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret 4

Function at 0x43f080
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.0040ee50
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43f0d5
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
cmp esi, esp
call fcn.0049f8de
test eax, eax
je 0x43f0d5
mov esi, esp
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, esp
call fcn.0049f8de
pop esi
add esp, 8
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret
Function at 0x449730
Capabilities:
Create thread
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4a0], 0
jne 0x4497f9
push 1
push 0x2bd
mov ecx, dword [ebp - 4]
call fcn.0044d200
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x4a0], 1
push str.uninstContinueimgbtn
push 0x4b0c5c
push 0xcc
mov ecx, dword [ebp - 4]
call fcn.0044d110
push 0x4b0c64
push 0x4b0c70
push 0xcc
mov ecx, dword [ebp - 4]
call fcn.0044d110
push 0x4b0c74
push 0x4b0c90
push 0x1f6
mov ecx, dword [ebp - 4]
call fcn.0044d110
push 0x4b0c98
push 0x4b0ca4
push 0x1f6
mov ecx, dword [ebp - 4]
call fcn.0044d110
push 0x4b0ca8
push 0x4b0cc0
push 0x25a
mov ecx, dword [ebp - 4]
call fcn.0044d110
jmp 0x4498f6
push 0
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00438c60
call fcn.0041a7b0
mov ecx, eax
call fcn.0041b190
mov dword [ebp - 8], eax
push 1
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00438c60
push 0
push 0x2bd
mov ecx, dword [ebp - 4]
call fcn.0044d200
cmp dword [ebp - 8], 0
je 0x449861
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x449640
push 0
push 0
call fcn.00483fdc
add esp, 0x18
mov ecx, dword [ebp - 4]
call fcn.004493e0
mov esi, esp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp esi, esp
call fcn.0049f8de
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx + 4]
je 0x4498f6
mov esi, esp
push 0
mov edi, esp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp edi, esp
call fcn.0049f8de
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 0x18], eax
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 0x1c], eax
mov esi, esp
push 1
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp esi, esp
call fcn.0049f8de
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp esi, esp
call fcn.0049f8de
mov esi, esp
push 0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp esi, esp
call fcn.0049f8de
push edx
mov ecx, ebp
push eax
lea edx, [0x449918]
call fcn.0049f901
pop eax
pop edx
pop edi
pop esi
add esp, 0x1c
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret
Function at 0x450320
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push ecx
lea edi, [ebp - 0x3c]
mov ecx, 0xf
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x340], 0
je 0x450379
mov esi, esp
call dword [sym.imp.USER32.dll_ReleaseCapture]
cmp esi, esp
call fcn.0049f8de
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x340], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x330], 0
je 0x450469
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x330]
push ecx
call fcn.0040e930
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x45045c
push 2
push 0
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 4]
call fcn.0044f2f0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x330]
cmp edx, dword [ecx + 0x32c]
jne 0x45045c
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
mov edx, dword [ebp + 0x10]
and edx, 0xffff
movzx eax, dx
shl eax, 0x10
or ecx, eax
push ecx
mov ecx, dword [ebp + 8]
push ecx
push 0x202
mov ecx, dword [ebp - 0x10]
call fcn.0040ea10
mov ecx, dword [ebp - 0x10]
call fcn.00439d90
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x45043e
mov edx, dword [ebp - 0x14]
movzx eax, word [edx]
test eax, eax
je 0x45043e
mov esi, esp
push 1
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 0x18], eax
jmp 0x45045c
mov ecx, dword [ebp - 0x10]
call fcn.00439c50
test eax, eax
je 0x45045c
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0x10]
call fcn.00439c50
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x330], 0
cmp dword [ebp - 8], 0
je 0x4504df
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00438d30
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
mov esi, esp
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
call eax
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 0x20], eax
mov esi, esp
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 0x4e
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00438ce0
mov ecx, eax
call fcn.00410760
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 0x38], eax
push edx
mov ecx, ebp
push eax
lea edx, [0x450504]
call fcn.0049f901
pop eax
pop edx
pop edi
pop esi
add esp, 0x3c
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret 0xc
Function at 0x450e60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jne 0x450e9e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c8], 0
je 0x450e9c
mov esi, esp
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x3c8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, esp
call fcn.0049f8de
jmp 0x450ed1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c4], 0
je 0x450ed1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x3c8], 0
je 0x450ed1
mov esi, esp
push 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3c8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, esp
call fcn.0049f8de
push 0
mov ecx, dword [ebp - 4]
call fcn.00451480
pop esi
add esp, 4
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret 8

Function at 0x451270
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00438c20
test eax, eax
je 0x4512e6
mov esi, esp
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.0049f8de
movsx eax, ax
test eax, eax
jl 0x4512dc
cmp dword [ebp + 8], 0x1b
jne 0x4512c2
push 0
push 2
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.004066f0
jmp 0x4512dc
cmp dword [ebp + 8], 0xd
jne 0x4512dc
push 0
push 1
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.004066f0
push 0
mov ecx, dword [ebp - 4]
call fcn.00451480
pop esi
add esp, 4
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret 0xc
Function at 0x456dd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x878
push esi
push edi
lea edi, [ebp - 0x878]
mov ecx, 0x21e
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4c6280]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x214], 0
push 0x208
push 0
lea eax, [ebp - 0x212]
push eax
call fcn.004806d0
add esp, 0xc
mov esi, esp
push 0x104
lea ecx, [ebp - 0x214]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.0049f8de
mov word [ebp - 0x428], 0
push 0x208
push 0
lea edx, [ebp - 0x426]
push edx
call fcn.004806d0
add esp, 0xc
mov word [ebp - 0x63c], 0
push 0x208
push 0
lea eax, [ebp - 0x63a]
push eax
call fcn.004806d0
add esp, 0xc
mov word [ebp - 0x850], 0
push 0x208
push 0
lea ecx, [ebp - 0x84e]
push ecx
call fcn.004806d0
add esp, 0xc
lea edx, [ebp - 0x850]
push edx
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x63c]
push ecx
lea edx, [ebp - 0x214]
push edx
call fcn.004567d0
add esp, 0x10
mov word [ebp - 0x85c], 1
mov word [ebp - 0x868], 0
mov dword [ebp - 0x874], 0
movzx eax, word [ebp - 0x428]
test eax, eax
je 0x456f1f
lea ecx, [ebp - 0x874]
push ecx
lea edx, [ebp - 0x868]
push edx
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x428]
push ecx
call fcn.00456cb0
add esp, 0x10
test eax, eax
jne 0x456f1f
mov word [ebp - 0x85c], 1
mov word [ebp - 0x868], 0
mov dword [ebp - 0x874], 0
push 0xffffffffffffffff
push 0
push 0x804
push 1
push 1
mov edx, dword [ebp - 0x874]
push edx
mov ax, word [ebp - 0x868]
push eax
mov cx, word [ebp - 0x85c]
push ecx
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp esi, esp
call fcn.0049f8de
push eax
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x63c]
push eax
push 0x4b067c
call fcn.00455cd0
add esp, 0x30
push 0x4b068c
push 0x2710
call fcn.004566e0
add esp, 8
call fcn.004565f0
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x456fb8]
call fcn.0049f901
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f404
add esp, 0x878
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret

Function at 0x457120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
xor eax, eax
jne 0x45713e
cmp dword [ebp + 0x10], 0
jne 0x45714e
lea ecx, [ebp - 0xc]
mov dword [ebp + 0x10], ecx
mov esi, esp
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x457181
call fcn.004019f0
jmp 0x457183
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x4571a8]
call fcn.0049f901
pop eax
pop edx
pop esi
add esp, 0x14
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4571d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x457202
jmp 0x45723d
mov esi, esp
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x457236
jmp 0x45723d
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
pop esi
add esp, 0xc
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret 0x10

Function at 0x457f80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push esi
push edi
push ecx
lea edi, [ebp - 0x130]
mov ecx, 0x4c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4c6280]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x128], 0
push 0x118
push 0
lea eax, [ebp - 0x124]
push eax
call fcn.004806d0
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
mov esi, esp
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jne 0x458037
push 0x11c
push 0
lea edx, [ebp - 0x128]
push edx
call fcn.004806d0
add esp, 0xc
mov dword [ebp - 0x128], 0x114
mov esi, esp
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
je 0x458050
cmp dword [ebp - 0x124], 6
sbb eax, eax
add eax, 1
jmp 0x458052
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x458080]
call fcn.0049f901
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f404
add esp, 0x130
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret
Function at 0x4581a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], 1
mov esi, esp
push str.Globalpcfix_svc_shutdown_event
push 0
push 1
call fcn.004582a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x458288
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp esi, esp
call fcn.0049f8de
mov esi, esp
push str.Globalpcfixsvc_instance_mutex
push 1
call fcn.004582a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x458275
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0049f8de
cmp eax, 0xb7
jne 0x458262
mov esi, esp
push 0x2710
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.0049f8de
cmp eax, 0x102
jne 0x458262
mov dword [ebp - 4], 0
mov esi, esp
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0049f8de
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0049f8de
mov eax, dword [ebp - 4]
pop esi
add esp, 0xc
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret

Function at 0x4583c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], 1
mov esi, esp
push str.Global_rtp_svc_shutdown_event
push 0
push 1
call fcn.004582a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4584a8
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp esi, esp
call fcn.0049f8de
mov esi, esp
push str.Global_rtpsvc_instance_mutex
push 1
call fcn.004582a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x458495
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.0049f8de
cmp eax, 0xb7
jne 0x458482
mov esi, esp
push 0x2710
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.0049f8de
cmp eax, 0x102
jne 0x458482
mov dword [ebp - 4], 0
mov esi, esp
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0049f8de
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.0049f8de
mov eax, dword [ebp - 4]
pop esi
add esp, 0xc
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret
Function at 0x4584c0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4584f2
jmp 0x45851f
mov esi, esp
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x458518
jmp 0x45851f
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
pop esi
add esp, 0xc
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret 4

Function at 0x458680
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, esp
call fcn.0049f8de
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
call fcn.0045d470
test eax, eax
je 0x4586d7
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, esp
call fcn.0049f8de
sub eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x4586d7
mov esi, esp
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.0049f8de
jmp 0x45869e
mov eax, dword [ebp + 8]
call fcn.0045d470
pop esi
add esp, 4
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret

Function at 0x458d60
Capabilities:
Unload minifilter driver

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0xcccccccc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 1
lea eax, [ebp - 8]
push eax
call fcn.00458af0
add esp, 4
test eax, eax
jne 0x458d92
xor eax, eax
jmp 0x458db3
call fcn.00458c00
push str.TFsFlt
call sub.FLTLIB.DLL_FilterUnload
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x458dae
xor eax, eax
jmp 0x458db3
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x458dd4]
call fcn.0049f901
pop eax
pop edx
add esp, 0x10
cmp ebp, esp
call fcn.0049f8de
mov esp, ebp
pop ebp
ret