joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496bc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f2842
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x536364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x53f4e0
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x496bf0
sub ecx, edx
sar ecx, 1
jne 0x496c06
call fcn.00496760
mov ecx, 0x53f4cc
call fcn.004961a0
test al, al
je 0x496d17
call fcn.00483b50
push str.run_silent
push str.Reader___UninstHelper
push eax
call fcn.00483cd0
add esp, 0xc
mov dword [0x53f4d8], 0
mov ecx, 0x53f4cc
call fcn.004961a0
test al, al
je 0x496c4c
xor edx, edx
jmp 0x496c5b
push 0
push str.SodaMSOAddinUninstWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov edx, eax
mov ecx, 0x53f4e0
mov dword [0x53f4dc], edx
lea esi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x496c70
sub ecx, esi
sar ecx, 1
jne 0x496c8c
call fcn.00496760
mov edx, dword [0x53f4dc]
test edx, edx
je 0x496cc2
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0x7e9
push edx
call esi
mov eax, dword [0x53f4d8]
mov edx, dword [0x53f4dc]
inc eax
mov dword [0x53f4d8], eax
test edx, edx
je 0x496cc2
push eax
push 0
push 0x7e8
push edx
call esi
mov ecx, 0x53f4cc
call fcn.004961a0
push 0
test al, al
je 0x496ce9
call fcn.004962f0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push fcn.004962f0
push 0
push 0
call fcn.004c9604
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00483b50
push str.run_window
push str.Reader___UninstHelper
push eax
call fcn.00483cd0
add esp, 0xc
push 0
push str.SodaMSOAddinUninstWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x496d70
push eax
call fcn.004846b0
call fcn.00483b50
push str.run_window_already_exist
push str.Reader___UninstHelper
push eax
call fcn.00483cd0
add esp, 0x10
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x53f750
push 0x30
call fcn.004a1e56
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x496d98
mov ecx, eax
call fcn.004981f0
mov esi, eax
jmp 0x496d9a
xor esi, esi
push 0
push 0
push 0x86020000
push 0x50b270
push 0
push esi
push str.UninstWnd.xml
push str.UninstWnd
mov dword [ebp - 4], 0xffffffff
call fcn.00407ca0
add esp, 0x20
test eax, eax
jne 0x496deb
test esi, esi
je 0x496d05
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x14]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x496e00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x53f4cc
mov dword [0x53f4d8], 0
call fcn.004961a0
test al, al
je 0x496e20
xor edx, edx
jmp 0x496e2f
push 0
push str.SodaMSOAddinUninstWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov edx, eax
mov ecx, 0x53f4e0
mov dword [0x53f4dc], edx
push esi
lea esi, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x496e40
sub ecx, esi
sar ecx, 1
jne 0x496e5c
call fcn.00496760
mov edx, dword [0x53f4dc]
test edx, edx
je 0x496e92
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0x7e9
push edx
call esi
mov eax, dword [0x53f4d8]
mov edx, dword [0x53f4dc]
inc eax
mov dword [0x53f4d8], eax
test edx, edx
je 0x496e92
push eax
push 0
push 0x7e8
push edx
call esi
mov ecx, 0x53f4cc
call fcn.004961a0
pop esi
push 0
test al, al
je 0x496eae
call fcn.004962f0
mov al, 1
mov esp, ebp
pop ebp
ret
push 0
push 0
push fcn.004962f0
push 0
push 0
call fcn.004c9604
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x49e025
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x49e074
mov esi, dword [ebp + 0x18]
lea eax, [ebp + 0x10]
push edi
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49e074
cmp esi, dword [ebp + 0x10]
je 0x49e06f
push 0x50b270
push 1
push edi
push edi
call fcn.0049d6b8
jmp 0x49e082
xor eax, eax
inc eax
jmp 0x49e087
mov eax, 0x50b270
push eax
push eax
push edi
push edi
call fcn.0049d705
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x49f274
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x49f29e
mov eax, 0x50b270
push eax
push eax
push 0
push 0
call fcn.0049d705
add esp, 0x10
xor eax, eax
pop ebp
ret
xor eax, eax
inc eax
pop ebp
ret

Function at 0x49ffe0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x4a0340
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x4a05ff
Capabilities:
Check mutex on windows

Disassembly:
push 0xa4
mov eax, 0x4f2c8c
call fcn.004a2b00
mov esi, ecx
mov dword [ebp - 0xa0], esi
xor ebx, ebx
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
push 0x41
lea eax, [ebp - 0x98]
push eax
call fcn.004a0dd0
add esp, 0x14
xor eax, eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x98]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x9c], edi
test edi, edi
je 0x4a074b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4a0678
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], ebx
call fcn.004a0c2f
test eax, eax
je 0x4a06ad
mov dword [esi], eax
mov eax, dword [esi]
inc dword [eax + 0x5bc]
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
jne 0x4a074b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4a074b
push 0x5c0
call fcn.004a090a
pop ecx
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x4a06d0
push edi
mov ecx, eax
call fcn.004a078c
jmp 0x4a06d2
mov eax, ebx
mov byte [ebp - 4], bl
mov dword [esi], eax
test eax, eax
je 0x4a0753
xor ebx, ebx
inc ebx
mov dword [ebp - 0xb0], ebx
push eax
call fcn.004a0d6f
pop ecx
test eax, eax
jne 0x4a0686
mov dword [ebp - 0xa8], 3
push 0x52fdbc
lea eax, [ebp - 0xa8]
jmp 0x4a0768
mov eax, esi
call fcn.004a2a4d
ret
mov dword [ebp - 0xa4], 1
push 0x52fdbc
lea eax, [ebp - 0xa4]
push eax
call fcn.004c20e0
int3
Function at 0x4a078c
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x4f2cbf
call fcn.004a2a5e
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [esi], 0
lea ecx, [esi + 8]
or dword [esi + 4], 0xffffffff
call fcn.004a05d0
and dword [ebp - 4], 0
and dword [esi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4a07d8
mov eax, dword [ebp + 8]
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004a2a27
ret 4
push 0x52fdbc
lea eax, [ebp + 8]
mov dword [ebp + 8], 2
push eax
call fcn.004c20e0
int3

Function at 0x4a09a4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebx]
add ecx, 8
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x5a8]
mov dword [ecx + 0x5b0], eax
call fcn.004a0b38
mov edi, eax
test edi, edi
je 0x4a0a2f
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jne 0x4a09df
mov esi, edi
jmp 0x4a0a1b
push dword [edi]
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x4a0a14
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4a0a07
mov ecx, dword [ebx]
push edi
add ecx, 8
call fcn.004a0ad3
jmp 0x4a0a1b
push 0x4fd148
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4a0a1b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx]
add ecx, 8
call fcn.004a0b38
mov edi, eax
test edi, edi
jne 0x4a09d4
test esi, esi
jne 0x4a0a44
mov ecx, dword [ebx]
add ecx, 8
call fcn.004a0cc0
mov esi, eax
test esi, esi
je 0x4a0a44
mov eax, dword [ebp - 4]
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4a3680
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x536364]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2ec], ebx
push edi
test ebx, ebx
je 0x4a3884
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4a3884
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.004c10f0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2e4]
add esp, 0xc
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call esi
test eax, eax
jne 0x4a3859
xor edi, edi
mov dword [ebp - 0x2d8], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x1d0]
push eax
push edi
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4a3848
lea eax, [ebp - 0x2e8]
push eax
push 1
push 0
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x2e4]
call esi
test eax, eax
jne 0x4a3812
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2e0], 1
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2dc], 0x104
push eax
lea eax, [ebp - 0x2e0]
push eax
push 0
push 0x4fcfcc
push dword [ebp - 0x2e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a380a
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.004c10f0
push 0x64
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004a38a0
add esp, 0x18
test eax, eax
je 0x4a380a
cmp byte [ebp - 0x68], 0
je 0x4a37cc
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x4a380a
lea ecx, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x4a37f9
mov al, byte [esi + ecx]
test al, al
je 0x4a37f9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4a37e0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x2e8]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x104
push eax
lea eax, [ebp - 0x1d0]
inc edi
push eax
push edi
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4a3720
push dword [ebp - 0x2e4]
call ebx
mov ebx, dword [ebp - 0x2ec]
mov edi, dword [ebp + 0xc]
cmp byte [ebp - 0x68], 0
pop esi
je 0x4a3884
lea eax, [ebp - 0x68]
push eax
push edi
push ebx
call fcn.00492240
xor ecx, ecx
test eax, eax
pop edi
setns cl
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a1e09
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.004a1e09
mov esp, ebp
pop ebp
ret
Function at 0x4a3b20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x536364]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x5402a8]
mov byte [ebp - 0x20d], 0x40
push ebx
mov ebx, dword [ebp + 8]
test ecx, ecx
jne 0x4a3c0d
push 0x208
push ecx
lea eax, [ebp - 0x20c]
push eax
call fcn.004c10f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0xf5
ja 0x4a3bee
push esi
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4a3b86
mov eax, dword [0x50b1f4]
mov dword [edi], eax
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4a3ba2
mov ecx, 6
lea eax, [ebp - 0x20c]
mov esi, str.Netapi32.dll
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
test eax, eax
je 0x4a3bee
push str.Netbios
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x5402a8]
test eax, eax
cmovne ecx, eax
mov dword [0x5402a8], ecx
jmp 0x4a3bf4
mov ecx, dword [0x5402a8]
test ecx, ecx
jne 0x4a3c0d
mov al, byte [ebp - 0x20d]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a1e09
mov esp, ebp
pop ebp
ret
push ebx
call ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004a1e09
mov esp, ebp
pop ebp
ret

Function at 0x4a4320
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c10
call fcn.004a1e20
mov eax, dword [0x536364]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c10], eax
test eax, eax
je 0x4a4482
cmp dword [ebp + 0xc], 0
je 0x4a4482
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop dword [eax]
push esi
push 0x4fcf38
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.004922b0
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4a4465
push 0x2710
lea eax, [ebp - 0x2bfc]
mov dword [ebp - 0x2c00], 0
push 0
push eax
mov dword [ebp - 0x2c04], 0
mov dword [ebp - 0x2c0c], 0
mov dword [ebp - 0x2c08], 0
call fcn.004c10f0
add esp, 0xc
lea eax, [ebp - 0x2c00]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2bfc]
push eax
push 0xc
lea eax, [ebp - 0x2c0c]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4a445a
push 0x3e8
lea eax, [ebp - 0x4ec]
push 0
push eax
call fcn.004c10f0
lea eax, [ebp - 0x4ec]
push eax
push 1
push dword [ebp - 0x2be4]
lea eax, [ebp - 0x2bfc]
push eax
call fcn.004a53d0
add esp, 0x1c
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x2c10]
call fcn.00492240
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x4a446f
inc esi
cmp esi, 0x10
jl 0x4a4360
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a1e09
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004a1e09
mov esp, ebp
pop ebp
ret
Function at 0x4a44a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x536364]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.004c10f0
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.004a39c0
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4a450a
mov al, byte [edi + ecx]
test al, al
je 0x4a450a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4a44f1
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x4a452b
inc eax
sub ecx, 1
jne 0x4a4520
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x4a4580
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x4a4575
lea edi, [ebp - 0x84]
mov eax, Ordinal_1
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x4a4574
mov bl, byte [edi + ecx]
test bl, bl
je 0x4a4574
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x4a4560
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.004c10f0
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x4fd36c
push str.Software360SafeLiveup
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x4a463a
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4a4604
test cl, cl
je 0x4a4600
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4a4604
add eax, 2
add esi, 2
test cl, cl
jne 0x4a45e4
xor eax, eax
jmp 0x4a4609
sbb eax, eax
or eax, 1
test eax, eax
je 0x4a463a
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a4616
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.Software360SafeLiveup
push 0x80000002
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a4643
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x4fd36c
push str.Software360SafeLiveup
push 0x80000002
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a1e09
mov esp, ebp
pop ebp
ret
Function at 0x4a73b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f2f23
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x536364]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x5363d8]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.004a72a0
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x4a7591
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.004c10f0
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x4f876c
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a7591
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x4a7485
cmp eax, 2
jne 0x4a7591
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x4a74a6
test cl, 1
jne 0x4a7591
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x4a74ac
jmp 0x4a7591
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x4a7591
call fcn.00483a50
mov ecx, eax
test ecx, ecx
je 0x4a75bc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.004a5a30
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x4fd500
push eax
call fcn.004a7bd0
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.004a5e40
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x4a7575
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4a7516
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.004a75d0
push dword [0x5363e0]
lea eax, [ebp - 0x74]
push dword [0x5363dc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x4a7552
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4a756e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x4a7593
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4a7591
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x4a759e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1e09
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004836b0
int3
Function at 0x4a76b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x4a76c5
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x4a76d0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a76d0
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4a7700
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f2f58
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x536364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0x202
push dword [0x5363d8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.004a72a0
mov esi, dword [ebp - 0x18]
test eax, eax
jne 0x4a77e8
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x4a779e
mov ecx, dword [edi]
test ecx, ecx
je 0x4a7809
push ecx
push eax
call fcn.004c44bc
add esp, 8
test eax, eax
je 0x4a779e
push 1
push dword [ebx]
lea ecx, [ebp - 0x18]
push str.m2_old
call fcn.004a76b0
mov edx, dword [edi]
test edx, edx
jne 0x4a77b2
mov eax, 0xd
xor ebx, ebx
test eax, eax
sete bl
jmp 0x4a77ea
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a77b7
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x4f876c
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
jmp 0x4a77ea
xor ebx, ebx
test esi, esi
je 0x4a77f5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004836b0
int3