joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484f00
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
mov esi, eax
push 0x484f74
push 0x484f78
push 0
push 0x484f74
push 0x484f88
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x484f45
mov eax, ebx
call fcn.00483058
mov edx, eax
test edx, edx
je 0x484f3b
sub edx, 0xffffffa4
mov eax, esi
call fcn.00406c0c
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError_1
push eax
push 0
push 0
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x482f74]
call fcn.004832a4
mov edx, eax
test edx, edx
je 0x484f6a
sub edx, 0xffffffa4
mov eax, esi
call fcn.00406c0c
pop esi
pop ebx
ret

Function at 0x4858e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4859db
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.0047332c
test al, al
je 0x4859c5
mov eax, dword [ebp - 4]
cmp byte [eax + 0x79], 0
jne 0x4859a7
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x54]
xor eax, eax
push ebp
push 0x4859a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x70], 0
je 0x48597c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
je 0x48597c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
mov edx, dword [eax]
call dword [edx + 0x80]
test eax, eax
je 0x48598a
mov eax, dword [ebp - 4]
push eax
push 0x4857e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x70]
mov edx, dword [eax]
call dword [edx + 0x80]
push eax
call sub.user32.dll_EnumThreadWindows
jmp 0x48598a
mov eax, dword [ebp - 4]
push eax
push 0x4857e0
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4859c5
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x58]
ret
lea eax, [ebp - 0xc]
mov edx, dword [0x4ac934]
call fcn.00404e0c
mov ecx, dword [ebp - 0xc]
mov edx, 0x30000
mov eax, dword [ebp - 4]
call fcn.00472cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4859e2
lea eax, [ebp - 0xc]
call fcn.00404c1c
ret
Function at 0x48af70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x48af78
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x48b0e7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x4c], 0
jne 0x48b0b0
mov eax, ebx
call fcn.0047332c
test al, al
je 0x48b0b0
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x80]
mov esi, eax
call sub.kernel32.dll_GetCurrentProcessId
cmp esi, eax
je 0x48afd8
lea eax, [ebp - 0x30]
call fcn.00475048
cmp byte [ebp - 0x20], 0
je 0x48afe8
cmp dword [ebx + 0x34], 0x80000000
jb 0x48afe8
mov eax, dword [ebx + 0x34]
call fcn.004759fc
mov dword [ebx + 0x4c], eax
jmp 0x48b09c
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0x30]
call fcn.00406c0c
lea ecx, [ebp - 0x10]
mov edx, 0x10
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xa8]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
je 0x48b07b
push 2
lea ecx, [ebp - 2]
mov edx, dword [ebx + 0x34]
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x104]
test al, al
je 0x48b09c
cmp word [ebp - 2], 0x5a4d
jne 0x48b09c
push 4
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x34]
add edx, 0x3c
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x104]
test al, al
je 0x48b09c
mov eax, dword [ebx + 0x34]
add eax, dword [ebp - 8]
mov dword [ebx + 0x4c], eax
push 4
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x4c]
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x104]
test al, al
je 0x48b074
cmp dword [ebp - 8], 0x4550
je 0x48b09c
xor eax, eax
mov dword [ebx + 0x4c], eax
jmp 0x48b09c
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, ebx
pop ecx
call fcn.00472cb4
cmp dword [ebx + 0x4c], 0
jne 0x48b0b0
xor ecx, ecx
mov edx, 2
mov eax, ebx
call fcn.00472cb4
mov ebx, dword [ebx + 0x4c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b0ee
lea eax, [ebp - 0x34]
call fcn.00404c1c
lea eax, [ebp - 0x30]
mov edx, dword [0x474f2c]
call fcn.00405860
lea eax, [ebp - 0x10]
call fcn.00406bf4
lea eax, [ebp - 0xc]
call fcn.00406bf4
ret
Function at 0x48e208
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x48e30a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4accbc]
mov byte [eax], 1
mov eax, 8
call fcn.004029f0
mov ebx, eax
mov dword [ebx], esi
mov eax, dword [ebp - 4]
mov dword [ebx + 4], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0x48e17c
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_CreateThread_1
mov esi, eax
test esi, esi
jne 0x48e2a7
mov edx, 8
mov eax, ebx
call fcn.00402a10
call sub.kernel32.dll_GetLastError_1
push eax
push 0
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x47cf40]
call fcn.0047f158
mov edx, eax
test edx, edx
je 0x48e29e
sub edx, 0xffffff98
mov eax, edi
call fcn.00406c0c
jmp 0x48e2ec
lea ecx, [ebp - 0x10]
mov dl, 1
mov eax, esi
call fcn.00481200
mov edx, dword [ebp - 0x10]
mov al, 5
call fcn.0047ea58
mov ebx, eax
mov byte [ebx + 0x44], 1
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x48], eax
lea eax, [ebp - 0x14]
call fcn.00494024
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x64]
call fcn.00406c0c
mov eax, edi
mov edx, ebx
test edx, edx
je 0x48e2e7
sub edx, 0xffffff98
call fcn.00406c0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e311
lea eax, [ebp - 0x14]
call fcn.00406bf4
lea eax, [ebp - 0x10]
call fcn.00406bf4
ret

Function at 0x4961a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, edx
xor eax, eax
push ebp
push 0x496241
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4aca74]
call fcn.004029f0
mov esi, eax
mov eax, dword [0x4aca74]
push eax
push esi
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
mov edx, esi
call fcn.00404e0c
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.0040e4c8
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00404c70
mov edx, dword [ebx]
lea eax, [ebp - 8]
mov ecx, 0x496258
call fcn.00404f3c
mov eax, dword [ebp - 8]
call fcn.0040ad20
test al, al
je 0x496219
mov eax, ebx
mov edx, 0x496258
call fcn.00404ef8
mov edx, dword [0x4aca74]
mov eax, esi
call fcn.00402a10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496248
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404c40
ret

Function at 0x4962a8
Capabilities:
Query service status

Disassembly:
push ebx
add esp, 0xffffffe4
mov ebx, eax
mov eax, ebx
call fcn.004962cc
test eax, eax
jne 0x4962c7
push esp
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
mov eax, dword [esp + 4]
add esp, 0x1c
pop ebx
ret
Function at 0x496320
Capabilities:
Create service

Disassembly:
push ebx
push esi
mov ebx, eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x20]
call fcn.004050e8
push eax
mov eax, dword [ebx + 0x1c]
push eax
mov eax, dword [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
push 0x34
mov eax, dword [ebx + 0x10]
call fcn.004050e8
push eax
mov eax, dword [ebx + 0xc]
call fcn.004050e8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebx + 8], eax
call sub.kernel32.dll_GetLastError_1
mov esi, eax
mov eax, ebx
call fcn.00496468
mov eax, ebx
call fcn.004962cc
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4963b0
Capabilities:
Start service

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
mov eax, ebx
call fcn.004962cc
test eax, eax
je 0x4963c4
mov esi, eax
jmp 0x496407
xor eax, eax
mov dword [esp], eax
push esp
push 0
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x496400
call sub.kernel32.dll_GetLastError_1
mov esi, eax
jmp 0x4963f2
push 0x1f4
call sub.kernel32.dll_Sleep
mov eax, ebx
call fcn.004962a8
cmp eax, 4
jne 0x4963e8
jmp 0x496407
call sub.kernel32.dll_GetLastError_1
mov esi, eax
mov eax, esi
pop edx
pop esi
pop ebx
ret
Function at 0x4969a0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x11
push 0
push 0
dec ecx
jne 0x4969a8
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x496b80
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, pe_nt_image_headers32
push esi
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x496978]
call fcn.0040641c
add esp, 4
jmp 0x4969fd
mov eax, esi
add eax, eax
mov esi, eax
push esi
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x496978]
call fcn.0040641c
add esp, 4
lea eax, [ebp - 4]
push eax
push esi
mov eax, dword [ebp - 0xc]
push eax
push 0x10
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x4969e0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
mov ecx, 4
mov edx, dword [ebp - 0x10]
call fcn.0040824c
xor eax, eax
mov dword [ebx + 0x10], eax
mov esi, dword [ebp - 8]
dec esi
test esi, esi
jb 0x496a65
inc esi
xor edi, edi
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, edi
shl eax, 4
add edx, eax
lea eax, [ebp - 0x20]
mov ecx, 0x10
call fcn.0040824c
xor eax, eax
mov al, byte [ebp - 0x1c]
cmp eax, dword [ebx + 0x14]
jne 0x496a61
inc dword [ebx + 0x10]
inc edi
dec esi
jne 0x496a3a
push 0
lea eax, [ebx + 0xc]
mov ecx, 1
mov edx, dword [0x49686c]
call fcn.0040641c
add esp, 4
mov eax, dword [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
mov ecx, 1
mov edx, dword [0x49686c]
call fcn.0040641c
add esp, 4
xor eax, eax
mov dword [ebx + 0x10], eax
mov esi, dword [ebp - 8]
dec esi
test esi, esi
jb 0x496b11
inc esi
xor edi, edi
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, edi
shl eax, 4
add edx, eax
lea eax, [ebp - 0x20]
mov ecx, 0x10
call fcn.0040824c
xor eax, eax
mov al, byte [ebp - 0x1c]
cmp eax, dword [ebx + 0x14]
jne 0x496b0d
lea ecx, [ebp - 0x88]
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00496c20
lea edx, [ebp - 0x88]
imul eax, dword [ebx + 0x10], 0xd
mov ecx, dword [ebx + 0xc]
lea eax, [ecx + eax*8]
mov ecx, dword [0x496844]
call fcn.00405a7c
imul eax, dword [ebx + 0x10], 0xd
mov edx, dword [ebx + 0xc]
mov eax, dword [edx + eax*8 + 8]
call fcn.00404ef0
test eax, eax
jle 0x496b0d
inc dword [ebx + 0x10]
inc edi
dec esi
jne 0x496aa7
cmp dword [ebx + 0x10], 1
jbe 0x496b1c
dec dword [ebx + 0x10]
jmp 0x496b34
push 0
lea eax, [ebx + 0xc]
mov ecx, 1
mov edx, dword [0x49686c]
call fcn.0040641c
add esp, 4
mov eax, ebx
call fcn.00496bb8
push 0
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x496978]
call fcn.0040641c
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496b87
lea eax, [ebp - 0x88]
mov edx, dword [0x496844]
call fcn.00405860
lea eax, [ebp - 0xc]
mov edx, dword [0x496978]
call fcn.0040653c
ret
Function at 0x4976dc
Capabilities:
Acquire debug privileges

Disassembly:
add esp, 0xffffffcc
call sub.kernel32.dll_GetCurrentProcess
push esp
push 0x28
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 8]
push eax
push 0x497768
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 0x14], 1
mov dword [esp + 0x20], 2
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
shl eax, 2
lea eax, [eax + eax*2]
add eax, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x1c]
shl eax, 2
lea eax, [eax + eax*2]
add eax, 4
push eax
lea eax, [esp + 0x20]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
add esp, 0x34
ret

Function at 0x497c60
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050d8
xor eax, eax
push ebp
push 0x497d94
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00406bf4
cmp dword [0x4b1000], 0
je 0x497d76
mov eax, dword [0x4b1000]
mov edx, dword [eax]
call dword [edx + 0x70]
xor eax, eax
push ebp
push 0x497d6f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x497d0a
mov eax, dword [0x4b0ffc]
call fcn.00406268
mov esi, eax
test esi, esi
jl 0x497d57
inc esi
xor ebx, ebx
mov eax, dword [0x4b0ffc]
mov eax, dword [eax + ebx*4]
lea edx, [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405034
jne 0x497d04
mov eax, edi
mov edx, dword [0x4b0ffc]
mov edx, dword [edx + ebx*4]
call fcn.00406c0c
jmp 0x497d57
inc ebx
dec esi
jne 0x497cd5
jmp 0x497d57
cmp dword [ebp - 8], 0
je 0x497d57
mov eax, dword [0x4b0ffc]
call fcn.00406268
mov esi, eax
test esi, esi
jl 0x497d57
inc esi
xor ebx, ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x4b0ffc]
mov eax, dword [eax + ebx*4]
mov edx, dword [eax]
call dword [edx + 0x80]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x497d53
mov eax, edi
mov edx, dword [0x4b0ffc]
mov edx, dword [edx + ebx*4]
call fcn.00406c0c
jmp 0x497d57
inc ebx
dec esi
jne 0x497d23
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497d76
mov eax, dword [0x4b1000]
mov edx, dword [eax]
call dword [edx + 0x78]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497d9b
lea eax, [ebp - 0xc]
call fcn.00404c1c
lea eax, [ebp - 4]
call fcn.00404c1c
ret
Function at 0x4981d4
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4981dc
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x498313
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0x38], 0
jne 0x4982f4
mov eax, esi
call fcn.0047332c
test al, al
je 0x4982f4
lea eax, [ebp - 0x2c]
call fcn.00475048
cmp byte [ebp - 0x1a], 0
je 0x4982e6
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [esi + 0x30]
call fcn.004050e8
push eax
push 0
call sub.advapi32.dll_LookupAccountNameA
mov eax, dword [ebp - 4]
call fcn.0040a408
mov dword [esi + 0x38], eax
lea eax, [esi + 0x34]
mov edx, dword [ebp - 8]
call fcn.00405274
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x34]
call fcn.004050e8
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x38]
push eax
mov eax, dword [esi + 0x30]
call fcn.004050e8
push eax
push 0
call sub.advapi32.dll_LookupAccountNameA
cmp eax, 1
sbb ebx, ebx
inc ebx
mov byte [esi + 8], bl
test bl, bl
je 0x4982bf
mov al, byte [ebp - 0xc]
mov byte [esi + 0x3c], al
mov eax, dword [esi + 0x34]
call fcn.004050e8
mov edx, eax
lea eax, [esi + 0x34]
call fcn.00404e0c
mov eax, esi
test eax, eax
je 0x4982b8
sub eax, 0xffffffc0
call fcn.00497b98
jmp 0x4982f4
lea eax, [esi + 0x34]
call fcn.00404c1c
mov eax, dword [esi + 0x38]
call fcn.00402a10
xor eax, eax
mov dword [esi + 0x38], eax
call sub.kernel32.dll_GetLastError_1
mov edx, eax
xor ecx, ecx
mov eax, esi
call fcn.00472cb4
jmp 0x4982f4
xor ecx, ecx
mov edx, 0x78
mov eax, esi
call fcn.00472cb4
mov ebx, dword [esi + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49831a
lea eax, [ebp - 0x2c]
mov edx, dword [0x474f2c]
call fcn.00405860
ret
Function at 0x49b0e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x10
push 0
push 0
dec ecx
jne 0x49b0e9
xchg dword [ebp - 4], ecx
push ebx
push esi
test dl, dl
je 0x49b101
add esp, 0xfffffff0
call fcn.004040cc
mov ebx, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 0x14]
call fcn.004050d8
lea eax, [ebp + 0xc]
call fcn.00405770
xor eax, eax
push ebp
push 0x49b316
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, ebx
xor edx, edx
mov eax, esi
call fcn.00472990
cmp byte [esi + 8], 0
je 0x49b2e2
cmp dword [ebp + 0x10], 0
setne al
mov byte [esi + 8], al
test al, al
je 0x49b2d4
mov eax, dword [ebp + 0x10]
sub eax, 1
je 0x49b174
sub eax, 2
je 0x49b174
lea eax, [ebp - 0x24]
call fcn.00475048
cmp byte [ebp - 0x12], 0
jne 0x49b174
xor ebx, ebx
jmp 0x49b176
mov bl, 1
mov byte [esi + 8], bl
test bl, bl
je 0x49b2c4
cmp dword [ebp + 8], 0xffffffff
je 0x49b1a7
mov eax, dword [ebp + 0xc]
xor edx, edx
call fcn.004055cc
jne 0x49b1ab
cmp dword [ebp + 8], 0
je 0x49b1a7
lea eax, [ebp - 0x44]
call fcn.00475048
cmp byte [ebp - 0x32], 0
jne 0x49b1ab
xor ebx, ebx
jmp 0x49b1ad
mov bl, 1
mov byte [esi + 8], bl
test bl, bl
je 0x49b2b4
cmp byte [0x4acab4], 0
jne 0x49b274
mov byte [0x4acab4], 1
lea eax, [ebp - 0x64]
call fcn.00475048
cmp byte [ebp - 0x52], 0
je 0x49b228
push 0x49b340
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
push 0x49b350
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4aca94], eax
push 0x49b368
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4aca98], eax
push 0x49b380
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4aca9c], eax
push 0x49b390
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acaa0], eax
jmp 0x49b274
push 0x49b3a0
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
push 0x49b3ac
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acaa4], eax
push 0x49b3c0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acaa8], eax
push 0x49b3d4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acaac], eax
push 0x49b3e4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acab0], eax
lea eax, [ebp - 0x84]
call fcn.00475048
cmp byte [ebp - 0x74], 0
je 0x49b29b
cmp dword [ebp + 0x10], 3
jne 0x49b29b
lea eax, [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov edx, 0x49b3f8
call fcn.00405568
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x30], eax
lea eax, [esi + 0x34]
mov edx, dword [ebp + 0xc]
call fcn.00405398
mov eax, dword [ebp + 8]
mov dword [esi + 0x38], eax
jmp 0x49b2e2
xor ecx, ecx
mov edx, 0x57
mov eax, esi
call fcn.00472cb4
jmp 0x49b2e2
xor ecx, ecx
mov edx, 0x78
mov eax, esi
call fcn.00472cb4
jmp 0x49b2e2
xor ecx, ecx
mov edx, 0x57
mov eax, esi
call fcn.00472cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b31d
lea eax, [ebp - 0x84]
mov edx, dword [0x474f2c]
mov ecx, 4
call fcn.00405894
lea eax, [ebp + 0xc]
call fcn.0040535c
lea eax, [ebp + 0x14]
call fcn.00404c1c
ret
Function at 0x4a04fc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004050d8
xor eax, eax
push ebp
push 0x4a0607
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.004a0498
mov esi, eax
test esi, esi
jle 0x4a05e9
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405148
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004050e8
push eax
push edi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x4a05e9
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ef0
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.00405148
cmp dword [ebp - 0xc], 0
jne 0x4a05bb
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
jmp 0x4a05e0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.004050e8
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a060e
lea eax, [ebp - 0xc]
call fcn.00404c1c
lea eax, [ebp - 4]
call fcn.00404c1c
ret
Function at 0x4a061c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004050d8
xor eax, eax
push ebp
push 0x4a0750
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.004a0498
mov esi, eax
test esi, esi
jle 0x4a0732
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405148
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0xc]
call fcn.004050e8
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4a0732
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ef0
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.00405148
cmp dword [ebp - 0xc], 0
jne 0x4a06b9
xor esi, esi
jmp 0x4a06c3
mov eax, dword [ebp - 0xc]
call fcn.004050e8
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4a0729
mov eax, dword [ebp - 0x18]
call fcn.004029f0
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4a0722
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jne 0x4a0719
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov bl, 1
jmp 0x4a0729
mov eax, edi
call fcn.00402a10
jmp 0x4a0729
mov eax, edi
call fcn.00402a10
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0757
lea eax, [ebp - 0xc]
call fcn.00404c1c
lea eax, [ebp - 4]
call fcn.00404c1c
ret