joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457c1c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x457cf4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4eb3d0], 0
jne 0x457cd8
lea eax, [ebp - 4]
mov edx, 0x457d0c
call fcn.00495a10
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00495e28
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x457cd8
mov eax, ebx
call fcn.00493bf4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x457cd1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x457cbb
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x457d1c
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x457cbb
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4eb3d0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457cd8
mov eax, dword [ebp - 0xc]
call fcn.00493c14
ret
mov ebx, dword [0x4eb3d0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457cfb
lea eax, [ebp - 4]
call fcn.00495978
ret

Function at 0x4690bc
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x4eb3f4], 0
jne 0x4690df
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x469030
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x4eb3f4], eax
ret

Function at 0x46a260
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0044a8e8
test al, al
je 0x46a2bb
cmp bl, 7
jne 0x46a297
push 2
lea eax, [esp + 4]
push eax
push 0x100c
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
movzx edi, byte [esp]
sub edi, 0x30
jmp 0x46a29c
mov edi, ebx
and edi, 0x7f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
je 0x46a2bb
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, edi
call fcn.00473f00
mov byte [esi + 0x220], bl
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x46c6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [ebp + 0x18]
test eax, eax
jbe 0x46c704
xor edx, edx
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
cmp ecx, eax
jae 0x46c704
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp - 4]
add eax, edx
xor edx, edx
div dword [ebp + 0x18]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov cl, byte [eax]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 8]
mov al, byte [eax + edx]
xor cl, al
mov edx, dword [ebp + 0xc]
mov byte [edx], cl
inc dword [ebp + 8]
inc dword [ebp + 0xc]
inc dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
cmp ecx, eax
jb 0x46c6cc
pop ecx
pop ecx
pop ebp
ret
Function at 0x46c708
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [ebp + 0x18]
test eax, eax
jbe 0x46c764
xor edx, edx
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
cmp ecx, eax
jae 0x46c764
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp - 4]
add eax, edx
xor edx, edx
div dword [ebp + 0x18]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov al, byte [eax + ecx]
mov edx, dword [ebp + 8]
mov cl, byte [edx]
xor al, cl
mov edx, dword [ebp + 0xc]
mov byte [edx], al
mov al, byte [ebp - 4]
mov ecx, dword [ebp + 0xc]
xor byte [ecx], al
inc dword [ebp + 8]
inc dword [ebp + 0xc]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
cmp eax, edx
jb 0x46c724
pop ecx
pop ecx
pop ebp
ret

Function at 0x46cc30
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
push 0
push 0
push 3
push 0
push 7
push closesocket
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileW
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, 0xffffffff
je 0x46cc9f
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, 0xffffffff
jne 0x46cc92
call sub.KERNEL32.DLL_GetLastError
push eax
push dword [ebp + 8]
push 0x4d3bd8
call fcn.0049ad5c
add esp, 0xc
xor edx, edx
mov dword [ebp - 8], edx
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 8]
jmp 0x46ccb7
call sub.KERNEL32.DLL_GetLastError
push eax
push dword [ebp + 8]
push 0x4d3c38
call fcn.0049ad5c
add esp, 0xc
xor eax, eax
pop ecx
pop ecx
pop ebp
ret

Function at 0x46ce7c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov eax, dword [0x4d3a11]
mov dword [ebp - 8], eax
mov al, byte [0x4d3a15]
mov byte [ebp - 4], al
push 0x4d3d08
push dword [ebp + 8]
call fcn.004a3278
add esp, 8
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
test edx, edx
jne 0x46cec1
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x46cebc
xor eax, eax
jmp 0x46cf07
or eax, 0xffffffff
jmp 0x46cf07
push dword [ebp - 0xc]
push 4
push 1
lea edx, [ebp - 8]
push edx
call fcn.0049fef8
add esp, 0x10
push dword [ebp - 0xc]
call fcn.0049f94c
pop ecx
push 0x4d3d13
call fcn.0049daf8
pop ecx
push eax
lea ecx, [ebp - 8]
push ecx
push 0x4d3d0e
call fcn.0049dbc4
add esp, 0xc
test eax, eax
je 0x46cf02
xor eax, eax
jmp 0x46cf07
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x46cf0c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov eax, dword [0x4d3a16]
mov dword [ebp - 8], eax
mov al, byte [0x4d3a1a]
mov byte [ebp - 4], al
push 0x4d3d18
push dword [ebp + 8]
call fcn.004a3278
add esp, 8
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
test edx, edx
jne 0x46cf51
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x46cf4c
xor eax, eax
jmp 0x46cf97
or eax, 0xffffffff
jmp 0x46cf97
push dword [ebp - 0xc]
push 4
push 1
lea edx, [ebp - 8]
push edx
call fcn.0049fef8
add esp, 0x10
push dword [ebp - 0xc]
call fcn.0049f94c
pop ecx
push 0x4d3d23
call fcn.0049daf8
pop ecx
push eax
lea ecx, [ebp - 8]
push ecx
push 0x4d3d1e
call fcn.0049dbc4
add esp, 0xc
test eax, eax
jne 0x46cf92
xor eax, eax
jmp 0x46cf97
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x46e558
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], edx
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x10325476
pop ebp
ret
Function at 0x48029c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004800f4
dec esi
jne 0x4802be
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x4813fc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4eb548
cmp dword [edi], 0
jne 0x481478
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x4eb544]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4d6d60
mov ecx, 2
call fcn.00493e58
mov edx, 0x4813d4
lea eax, [esi + 5]
call fcn.004813f4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004813f4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x48144d
mov dword [0x4eb544], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x484150
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00495e28
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
jne 0x484172
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x486ee8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x486f21
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00495a68
jmp 0x486f2a
mov eax, ebx
mov edx, esi
call fcn.004959cc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x486f34
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x486f55
mov al, byte [esp]
jmp 0x486f57
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4875dc
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x487454
mov eax, dword [0x4eb148]
cmp byte [eax], 0
je 0x487649
mov eax, dword [0x4eb14c]
call fcn.00494384
call fcn.00493dc4
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00484310
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x487690
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x48767f
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4eb000]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4eb444]
call fcn.004970c4
push eax
call sub.USER32.DLL_LoadStringA
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.USER32.DLL_MessageBoxA
add esp, 0x444
ret

Function at 0x488424
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x488488
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00495be0
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00483f18
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48848f
lea eax, [ebp - 0xc]
call fcn.00495978
ret

Function at 0x493f84
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00495978
test esi, esi
jne 0x493fba
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00495a68
jmp 0x493fd8
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00493e98
mov edi, eax
test esi, esi
je 0x493fd8
cmp dword [ebx], 0
je 0x493fd8
dec esi
jmp 0x493fc1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x494ab8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4d72a4]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x494b50
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x494b30
xor eax, eax
push ebp
push 0x494b29
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x494b6c
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494b30
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x4d72a4]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4d72a4], ax
mov esp, ebp
pop ebp
ret
Function at 0x495778
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4eb86c], 0
je 0x4957d9
cmp word [0x4eba40], 0xd7b2
jne 0x4957a1
cmp dword [0x4eba48], 0
jbe 0x4957a1
mov eax, 0x4eba3c
call dword [0x4eba58]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4d72ec
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x495800
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x4d72b4], 0
jne 0x4957f5
push 0
push 0x4d730c
push 0x4d72ec
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret

Function at 0x49592c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00493bf4
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4eb86d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4958f4
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4972b8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4974e8
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x49733b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4974e8
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x49733b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x497504
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4973c4
xor eax, eax
push ebp
push 0x4973bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00497100
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4973a2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x497524
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4973a2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4973c4
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4974de
cmp byte [ebp - 0xd], 0
jne 0x49740b
cmp byte [ebp - 0x12], 0
je 0x4974de
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x497424
dec ebx
cmp byte [ebx], 0x2e
je 0x497433
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x497423
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4974de
inc ebx
cmp byte [ebp - 0x12], 0
je 0x497470
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4974de
cmp byte [ebp - 0xd], 0
je 0x4974de
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4974de
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x497c5c
Capabilities:
Accept command line arguments

Disassembly:
sub dword [0x4ebde0], 1
jae 0x497ce2
mov byte [0x4d72a0], 2
mov dword [0x4eb830], 0x4adf3c
mov dword [0x4eb834], 0x4adf5a
mov byte [0x4eb86e], 2
mov dword [0x4eb81c], 0x4968e8
call fcn.00494a88
test al, al
je 0x497c9f
call fcn.00494ab8
call fcn.00494b7c
mov word [0x4eb874], 0xd7b0
mov word [0x4eba40], 0xd7b0
mov word [0x4ebc0c], 0xd7b0
call fcn.004967c8
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x4eb860], eax
call fcn.00492890
mov dword [0x4eb85c], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x4eb854], eax
ret
Function at 0x49aa34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0xc], edx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
xor eax, eax
mov dword [ebp - 0x14], eax
xor edx, edx
mov dword [ebp - 0x18], edx
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push dword [ebp + 8]
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x49aab3
lea edx, [ebp - 0xc]
push edx
push dword [ebp + 0x10]
lea ecx, [ebp - 8]
push ecx
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x49aaa1
mov dword [ebp - 0x18], 1
jmp 0x49aaa9
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x49aaba
mov dword [ebp - 0x18], 0xffffffff
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret

Function at 0x49aac4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 8]
push closesocket
call sub.ADVAPI32.DLL_RegCreateKeyExA
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jne 0x49ab35
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x49ab30
mov dword [ebp - 4], 1
jmp 0x49ab35
xor edx, edx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x49ab3c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 8]
push closesocket
call sub.ADVAPI32.DLL_RegCreateKeyExA
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jne 0x49abad
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 3
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x49aba8
mov dword [ebp - 4], 1
jmp 0x49abad
xor edx, edx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x49abb4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 8]
push closesocket
call sub.ADVAPI32.DLL_RegCreateKeyExA
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jne 0x49ac25
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [ebp - 0xc]
test edx, edx
jne 0x49ac20
mov dword [ebp - 4], 1
jmp 0x49ac25
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x49ac2c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 8]
push closesocket
call sub.ADVAPI32.DLL_RegCreateKeyExA
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jne 0x49ac93
push dword [ebp + 0xc]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegDeleteValueA
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x49ac8e
mov dword [ebp - 4], 1
jmp 0x49ac93
xor edx, edx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x49ac9c
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 8]
push closesocket
call sub.ADVAPI32.DLL_RegCreateKeyExA
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jne 0x49ad03
push dword [ebp + 0xc]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegDeleteKeyA
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x49acfe
mov dword [ebp - 4], 1
jmp 0x49ad03
xor edx, edx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x49ad0c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
push esi
push edi
mov esi, 0x4ddf1c
lea edi, [ebp - 0x404]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp + 8]
push 0x400
lea edx, [ebp - 0x404]
push edx
call fcn.004a1544
add esp, 0x10
lea ecx, [ebp - 0x404]
push ecx
call sub.KERNEL32.DLL_OutputDebugStringA
pop edi
pop esi
mov esp, ebp
pop ebp
ret