joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e9480
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4e949c
cmp byte [esi], 0
je 0x4e949c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi - 1], 0x5c
jne 0x4e94a2
xor eax, eax
pop esi
ret 0x10
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x4e94ae
mov byte [ebx], 0
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4e94c4
push 0
push esi
push str.Deleting_Registry_Hive__s...
call edi
add esp, 0xc
cmp dword [0x68fed4], 0xffffffff
jne 0x4e94ee
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x68fed4
call fcn.004d9f10
add esp, 0x2c
cmp dword [0x68fed4], 0
jne 0x4e953c
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
cmp edi, 2
jne 0x4e9517
push esi
call fcn.004e5120
cmp eax, 1
jne 0x4e9517
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x4e956a
test ebx, ebx
je 0x4e9534
push 0x104
push ebx
call fcn.004d8c20
add esp, 8
pop edi
pop ebx
xor eax, eax
pop esi
ret 0x10
mov ecx, dword [esp + 0x10]
push edi
push esi
push ecx
call fcn.004e1ff0
mov edi, eax
add esp, 0xc
cmp edi, 2
jne 0x4e955f
push esi
call fcn.004e5120
cmp eax, 1
jne 0x4e955f
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x4e9522
pop edi
pop ebx
mov eax, 1
pop esi
ret 0x10
Function at 0x4e9b10
Capabilities:
Get disk information

Disassembly:
cmp dword [0x74b390], 0
jne 0x4e9b49
xor eax, eax
mov dword [0x74b390], 1
mov dword [0x74b374], eax
mov dword [0x74b378], eax
mov dword [0x74b37c], eax
mov dword [0x74b380], eax
mov dword [0x74b384], eax
mov dword [0x74b388], eax
mov word [0x74b38c], ax
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
movsx eax, byte [edi]
push eax
xor esi, esi
call fcn.005e3ae6
mov bl, al
mov cl, bl
sub cl, 0x41
add esp, 4
mov byte [esp + 0x10], bl
cmp cl, 0x19
ja 0x4e9b9a
movsx esi, bl
sub esi, 0x41
cmp byte [esi + 0x74b374], 1
jne 0x4e9b9a
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, eax
cmp edi, 3
jne 0x4e9b91
pop edi
pop esi
pop ebx
ret 4
mov byte [esi + 0x74b374], 0
jmp 0x4e9ba3
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, eax
cmp edi, 3
jne 0x4e9bf0
sub bl, 0x41
cmp bl, 0x19
ja 0x4e9bf0
cmp byte [esi + 0x74b374], 0
jne 0x4e9bd0
mov edx, dword [esp + 0x10]
push edx
call fcn.004e5010
test eax, eax
setne al
inc al
mov byte [esi + 0x74b374], al
mov al, byte [esi + 0x74b374]
cmp al, 1
jne 0x4e9be7
mov edi, 3
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
cmp al, 2
jne 0x4e9bf0
mov edi, 2
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x4ea600
Capabilities:
Get file size

Disassembly:
sub esp, 0x150
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x14c], eax
mov eax, dword [esp + 0x160]
push ebx
mov ebx, dword [esp + 0x160]
push ebp
mov ebp, dword [esp + 0x160]
push esi
mov esi, dword [esp + 0x160]
push edi
mov edi, dword [esp + 0x174]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
test esi, esi
je 0x4ea733
cmp byte [esi], 0
je 0x4ea733
push 0
lea ecx, [esp + 0x20]
push ecx
push 0
push esi
call fcn.004e4d70
cmp eax, 1
jne 0x4ea6b1
test edi, edi
je 0x4ea672
mov edx, dword [esp + 0x3c]
mov dword [edi], edx
test ebp, ebp
je 0x4ea684
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [ebp], eax
mov dword [ebp + 4], ecx
test ebx, ebx
je 0x4ea695
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov dword [ebx], edx
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4ea6aa
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
jmp 0x4ea738
push 0
push 0x80
push 3
push 0
push 1
push connect
push esi
call fcn.004e0400
mov ebx, eax
add esp, 0x1c
mov dword [esp + 0x10], ebx
cmp ebx, 0xffffffff
je 0x4ea6f7
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
push ecx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x4ea70b
lea edx, [esp + 0x10]
push edx
call fcn.004dca10
push 1
push 0
push 0
push 0
push edi
push esi
call fcn.004e8950
add esp, 0x18
jmp 0x4ea738
test edi, edi
je 0x4ea71a
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi], eax
lea eax, [esp + 0x10]
push eax
call fcn.004dca10
test edi, edi
je 0x4ea6aa
cmp dword [edi], 0xffffffff
jne 0x4ea6aa
jmp 0x4ea6f7
mov eax, 1
mov ecx, dword [esp + 0x15c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x150
ret
Function at 0x4eb080
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
xor esi, esi
push edi
test ebx, ebx
je 0x4eb129
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4eb129
push ebp
mov ebp, dword [esp + 0x1c]
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
test esi, esi
jne 0x4eb124
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4eb122
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 1
jne 0x4eb0d8
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
test esi, esi
jne 0x4eb122
push esi
push esi
push esi
push esi
push ebx
call fcn.004e87b0
add esp, 0x14
test eax, eax
jne 0x4eb11a
push eax
push eax
push eax
push eax
push edi
call fcn.004e87b0
add esp, 0x14
test eax, eax
jne 0x4eb11a
push edi
call fcn.004e0740
add esp, 4
cmp eax, 1
jne 0x4eb11a
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
pop ebp
pop edi
pop esi
pop ebx
ret
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4eb820
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x104
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x100], eax
push ebp
mov ebp, dword [esp + 0x110]
push esi
mov esi, dword [esp + 0x110]
mov byte [esp + 8], 0
test ebp, ebp
je 0x4eb851
mov byte [ebp], 0
push esi
call fcn.004e0fb0
add esp, 4
cmp eax, 0xffffffff
je 0x4eb86f
test al, 7
je 0x4eb86f
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call fcn.004e0670
add esp, 4
cmp eax, 1
jne 0x4eb894
pop esi
pop ebp
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x104
ret
push ebx
push esi
mov ebx, 0x14
call fcn.004e9f40
test eax, eax
jne 0x4eb8a7
lea ebx, [eax + 1]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, edi
push 0x64
call edi
push esi
call fcn.004e0670
add esp, 4
cmp eax, 1
je 0x4eb90b
sub ebx, 1
jne 0x4eb8b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x14]
push 0x100
push eax
call fcn.004d8b50
add esp, 0xc
test ebp, ebp
je 0x4eb8f0
lea ecx, [esp + 0x10]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
mov ecx, dword [esp + 0x110]
pop edi
pop ebx
pop esi
pop ebp
xor ecx, esp
call fcn.005dfbbe
add esp, 0x104
ret
mov eax, 1
jmp 0x4eb8f2
Function at 0x4ebb50
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x210
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [esp + 0x218]
push 0x103
lea eax, [esp + 0x111]
push 0
push eax
mov byte [esp + 0x118], 0
call fcn.005dfd60
add esp, 0xc
push esi
lea ecx, [esp + 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0x10c], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x4ebbd6
lea eax, [esp + 0x10c]
inc eax
cmp byte [eax], 0
jne 0x4ebbb1
lea edx, [esp + 0x10c]
sub eax, edx
je 0x4ebbd6
cmp byte [esp + eax + 0x10b], 0x5c
je 0x4ebbd6
push 0x66da34
mov eax, edx
push eax
call esi
push str.UAGChnge.ini
lea ecx, [esp + 0x110]
push ecx
call esi
push 1
push 0
push 0
push 0
lea edx, [esp + 0x11c]
push 0
push edx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x4ebdbb
push 0x103
push eax
mov byte [esp + 0x10], al
lea eax, [esp + 0x11]
push eax
call fcn.005dfd60
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0xc
lea ecx, [esp + 0x10c]
push ecx
push 0x104
lea edx, [esp + 0x10]
push edx
push 0x60c81c
push str.EupdateIni
push str.General
mov dword [esp + 0x1c], 0
call esi
cmp byte [esp + 8], 0
je 0x4ebc89
push 1
push 0
push 0
push 0
lea eax, [esp + 0x18]
push 0
push eax
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x4ebc89
lea ecx, [esp + 8]
push ecx
push eax
push str.UserAgent
push 0x60da74
call fcn.004e0cb0
add esp, 0x10
lea edx, [esp + 0x10c]
push edx
push 0x104
lea eax, [esp + 0x10]
push eax
push 0x60c81c
push str.MailScanIni
push str.General
call esi
cmp byte [esp + 8], 0
je 0x4ebce6
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x4ebce6
lea edx, [esp + 8]
push edx
push eax
push str.UserAgent
push 0x60da74
call fcn.004e0cb0
add esp, 0x10
lea eax, [esp + 0x10c]
push eax
push 0x104
lea ecx, [esp + 0x10]
push ecx
push 0x60c81c
push str.MailScanIniBDC
push str.General
call esi
cmp byte [esp + 8], 0
je 0x4ebd5d
push 1
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x4ebd5d
lea ecx, [esp + 8]
push ecx
push eax
push str.UserAgent
push 0x60da74
call fcn.004e0cb0
add esp, 0x10
cmp dword [esp + 4], 0x400
jae 0x4ebd5d
lea edx, [esp + 8]
push edx
call fcn.004e0670
add esp, 4
lea eax, [esp + 0x10c]
push eax
push 0x104
lea ecx, [esp + 0x10]
push ecx
push 0x60c81c
push str.IupdateIni
push str.General
call esi
cmp byte [esp + 8], 0
je 0x4ebdbb
push 1
push 0
push 0
push 0
lea edx, [esp + 0x18]
push 0
push edx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x4ebdbb
lea eax, [esp + 8]
push eax
push 0
push str.UserAgent
push 0x60da74
call fcn.004e0cb0
add esp, 0x10
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
call fcn.005dfbbe
add esp, 0x210
ret
Function at 0x4ebf90
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x98
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
mov esi, dword [esp + 0xa0]
test esi, esi
je 0x4ebfb3
mov byte [esi], 0
push 0x94
lea eax, [esp + 8]
push 0
push eax
call fcn.005dfd60
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4ec02a
mov dword [esp + 8], 4
mov eax, dword [esp + 0xa4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test esi, esi
je 0x4ec00b
push 0x5c
push esi
call fcn.005e3012
add esp, 8
test eax, eax
je 0x4ec00b
mov byte [eax], 0
push esi
call fcn.004ebeb0
add esp, 4
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x98
ret
cmp dword [esp + 8], 5
jb 0x4ebfe6
push 0x648984
push 0x61bed4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4ebfe6
mov edx, dword [esp + 0xa4]
push edx
push esi
call eax
push esi
call fcn.004e2520
push esi
call fcn.004ebeb0
mov ecx, dword [esp + 0xa0]
add esp, 8
pop esi
xor ecx, esp
call fcn.005dfbbe
add esp, 0x98
ret
Function at 0x4eca90
Capabilities:
Check if file exists
Move file

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4eca9e
mov byte [edi], 0
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x4ecbf2
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4ecbf2
cmp byte [ebx], 0
je 0x4ecbf2
cmp byte [esi], 0
je 0x4ecbf2
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileA]
push esi
push ebx
call ebp
cmp eax, 1
je 0x4ecbc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4ecb01
test edi, edi
je 0x4ecafa
push eax
push 0x100
push edi
call fcn.004d8b50
add esp, 0xc
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret
cmp eax, 0xb7
jne 0x4ecb23
push esi
call fcn.004e0670
add esp, 4
cmp eax, 1
jne 0x4ecb23
push esi
push ebx
call ebp
cmp eax, 1
je 0x4ecbc5
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push esi
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x4ecb43
push esi
lea ebp, [eax + 1]
call fcn.004e5420
add esp, 4
push ebx
mov dword [esp + 0x18], 0x28
call fcn.004e9f40
test eax, eax
je 0x4ecb5f
push esi
call fcn.004e9f40
test eax, eax
jne 0x4ecb67
mov dword [esp + 0x14], 1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
push 0x28
call edi
test ebp, ebp
je 0x4ecb85
push esi
call fcn.004e0670
add esp, 4
push 0xa
call edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 1
je 0x4ecbc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4ecbcf
sub dword [esp + 0x14], 1
jne 0x4ecb70
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4ecafa
push 0x100
push eax
call fcn.004d8c20
add esp, 8
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4ecafa
push 2
push 0x100
push eax
call fcn.004d8b50
add esp, 0xc
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x4eda40
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x10c
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov esi, dword [esp + 0x118]
push edi
mov edi, dword [esp + 0x118]
test esi, esi
je 0x4edb92
lea eax, [esp + 8]
push eax
push esi
push edi
push 0x612808
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0x104
mov byte [esi], 0
call fcn.004d5770
cmp byte [esi], 0
je 0x4edb19
push esi
call fcn.004ec720
add esp, 4
test eax, eax
je 0x4edb19
call fcn.004d9b00
test eax, eax
je 0x4edb4a
push 0x61276c
push edi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4edb4a
push 0x103
push eax
lea ecx, [esp + 0x15]
push ecx
mov byte [esp + 0x18], al
call fcn.005dfd60
add esp, 0xc
push esi
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0xc]
push eax
call fcn.004e24e0
add esp, 4
push 0x612760
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0xc]
push 0
push edx
call fcn.004e8c10
add esp, 8
test eax, eax
jne 0x4edb4a
push esi
push edi
mov byte [esi], 0
call fcn.004ece10
add esp, 8
cmp byte [esi], 0
je 0x4edb92
push esi
call fcn.004ec720
add esp, 4
cmp eax, 1
jne 0x4edb4a
push esi
push edi
push 0x612808
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
cmp byte [esi], 0
je 0x4edb92
cmp dword [esp + 0x120], 0
jne 0x4edb61
push esi
call fcn.004e2520
jmp 0x4edb8f
push 0
push esi
call fcn.004e8c10
add esp, 8
test eax, eax
jne 0x4edb89
pop edi
mov byte [esi], al
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x10c
ret
push esi
call fcn.004e24e0
add esp, 4
mov ecx, dword [esp + 0x110]
pop edi
pop esi
xor ecx, esp
call fcn.005dfbbe
add esp, 0x10c
ret

Function at 0x4edd70
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
xor esi, esi
push edi
test ebx, ebx
je 0x4ede1b
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4ede1b
push ebp
mov ebp, dword [esp + 0x1c]
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
test esi, esi
jne 0x4ede16
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4ede14
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp eax, 1
jne 0x4eddc8
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
test esi, esi
jne 0x4ede14
push esi
push esi
push esi
push esi
push esi
push ebx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x4ede0c
push eax
push eax
push eax
push eax
push eax
push edi
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x4ede0c
push edi
call fcn.004e0670
add esp, 4
cmp eax, 1
jne 0x4ede0c
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop ebp
pop edi
pop esi
pop ebx
ret
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4eebe0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x210], eax
push ebp
push esi
mov esi, dword [esp + 0x220]
push edi
mov edi, dword [esp + 0x228]
push 0x103
lea eax, [esp + 0x19]
push 0
push eax
mov byte [esp + 0x20], 0
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0x129]
push 0
push ecx
mov byte [esp + 0x130], 0
call fcn.005dfd60
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x18
push edi
lea edx, [esp + 0x11c]
push edx
call ebp
lea eax, [esp + 0x118]
push eax
call fcn.004e2520
add esp, 4
call fcn.004eea00
test eax, eax
je 0x4eed07
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push 0
push str.SoftwareKasperskyLabComponents102Tasks0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x4eed07
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push edi
push edi
push str.ReportFileFolder
push ecx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x14], 0
je 0x4eed02
lea eax, [esp + 0x14]
push edi
push eax
call fcn.004e8c10
add esp, 8
test eax, eax
je 0x4eed02
lea ecx, [esp + 0x14]
push ecx
push esi
call ebp
push esi
call fcn.004e2520
add esp, 4
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x214
ret
mov byte [esp + 0x14], 0
push 0
push 0x104
lea edx, [esp + 0x1c]
push edx
push 0x60c81c
push 0x648d70
push 0x60c810
call fcn.004edfd0
add esp, 0x18
cmp byte [esp + 0x14], 0
je 0x4eed44
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004e8c10
add esp, 8
test eax, eax
jne 0x4eed67
push 0
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push 0x60c81c
push 0x648dac
push 0x60c810
call fcn.004edfd0
add esp, 0x18
cmp byte [esp + 0x14], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x4eedce
lea edx, [esp + 0x14]
push 0
push edx
call fcn.004e8c10
add esp, 8
test eax, eax
je 0x4eedce
lea eax, [esp + 0x14]
push eax
push esi
call ebp
push esi
call fcn.004e2520
push 0
push esi
call fcn.004e8c10
add esp, 0xc
test eax, eax
je 0x4eedce
push str.LOG
push esi
call edi
push 0
push esi
call fcn.004e8c10
add esp, 8
test eax, eax
jne 0x4eee1d
push 0x60c81c
push esi
call fcn.004e9050
add esp, 8
cmp eax, 1
je 0x4eee1d
lea ecx, [esp + 0x118]
push ecx
push esi
call ebp
push 0
push esi
call fcn.004e8c10
add esp, 8
test eax, eax
je 0x4eee1d
push str.LOG
push esi
call edi
push 0
push esi
call fcn.004e8c10
add esp, 8
test eax, eax
jne 0x4eee1d
push 0x60c81c
push esi
call fcn.004e9050
add esp, 8
cmp eax, 1
je 0x4eee1d
lea edx, [esp + 0x118]
push edx
push esi
call ebp
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005dfbbe
add esp, 0x214
ret
Function at 0x4ef5b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x10c
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x11c]
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
mov ebp, dword [esp + 0x11c]
push esi
mov esi, dword [esp + 0x11c]
push edi
push 0x103
lea ecx, [esp + 0x19]
push 0
push ecx
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], 0
call fcn.005dfd60
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0xc
push esi
push 0x104
lea edx, [esp + 0x1c]
push edx
push 0x615678
push 0x61726c
push str.General
call edi
cmp byte [esp + 0x14], 0x30
jne 0x4ef646
mov eax, dword [esp + 0x10]
mov dword [ebp], 0
mov dword [ebx], 0
mov dword [eax], 0
jmp 0x4ef6ca
push esi
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push 0x615678
push str.CheckForMailPhishing
push str.General
call edi
push esi
xor edx, edx
cmp byte [esp + 0x18], 0x30
push 0x104
lea eax, [esp + 0x1c]
push eax
setne dl
push 0x60cf3c
push str.ContentControlEnabled
push str.General
mov dword [ebp], edx
call edi
xor ecx, ecx
cmp byte [esp + 0x14], 0x31
push 0
push 0x104
lea edx, [esp + 0x1c]
push edx
sete cl
push 0x615678
push str.DisableAV
push 0x60cf28
mov dword [ebx], ecx
call fcn.004edfd0
mov ecx, dword [esp + 0x28]
xor eax, eax
add esp, 0x18
cmp byte [esp + 0x14], 0x30
sete al
mov dword [ecx], eax
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x10c
ret 0x10
Function at 0x4f00f0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x310
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x30c], eax
push esi
mov esi, dword [esp + 0x318]
push edi
mov edi, dword [esp + 0x320]
push 0x103
lea eax, [esp + 0x215]
push 0
push eax
mov byte [esp + 0x21c], 0
call fcn.005dfd60
add esp, 0xc
lea ecx, [esp + 0x210]
push ecx
mov byte [esi], 0
call fcn.004ef9d0
cmp eax, 1
jne 0x4f025f
push ebp
push 0x103
lea edx, [esp + 0x11]
push 0
push edx
mov byte [esp + 0x18], 0
call fcn.005dfd60
push 0x103
lea eax, [esp + 0x121]
push 0
push eax
call fcn.005dfd60
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x18
lea ecx, [esp + 0x214]
push ecx
lea edx, [esp + 0x10]
push edx
mov byte [esp + 0x118], 0
call ebp
cmp byte [esp + 0xc], 0
je 0x4f01c5
lea eax, [esp + 0xc]
inc eax
cmp byte [eax], 0
jne 0x4f01a2
lea ecx, [esp + 0xc]
sub eax, ecx
je 0x4f01c5
cmp byte [esp + eax + 0xb], 0x5c
je 0x4f01c5
push 0x66da34
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.eserv.ini
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x4f025e
test edi, edi
je 0x4f01fc
lea edx, [esp + 0xc]
push edx
push edi
call ebp
lea eax, [esp + 0xc]
push eax
push 0x104
lea ecx, [esp + 0x118]
push ecx
push 0x60c81c
push str.FTPDownloadDir
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x110], 0
je 0x4f025e
lea edx, [esp + 0x110]
push 0
push edx
call fcn.004e8c10
add esp, 8
test eax, eax
je 0x4f025e
lea eax, [esp + 0x110]
push eax
call fcn.004e2520
add esp, 4
lea ecx, [esp + 0x110]
push ecx
push esi
call ebp
pop ebp
mov ecx, dword [esp + 0x314]
pop edi
pop esi
xor ecx, esp
call fcn.005dfbbe
add esp, 0x310
ret 8
Function at 0x4f0280
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x310
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x30c], eax
push 0x103
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0x219]
push 0
push ecx
mov byte [esp + 0x220], 0
call fcn.005dfd60
push 0x103
lea edx, [esp + 0x121]
push 0
push edx
mov byte [esp + 0x128], 0
call fcn.005dfd60
mov eax, dword [0x74b6bc]
add esp, 0x24
test eax, eax
ja 0x4f03f5
push 0
push 0x104
lea eax, [esp + 8]
push eax
push 0x60c81c
push 0x6111d8
push 0x60c810
call fcn.004edfd0
add esp, 0x18
cmp byte [esp], 0
je 0x4f0341
lea ecx, [esp]
push 0x2e
push ecx
call fcn.005e0940
add esp, 8
test eax, eax
je 0x4f0330
mov byte [eax], 0
lea edx, [esp]
push edx
call fcn.005e0909
add esp, 4
mov dword [0x74b6bc], eax
cmp dword [0x74b6bc], 0
jne 0x4f03f0
lea eax, [esp + 0x208]
push eax
call fcn.004ef9d0
cmp eax, 1
jne 0x4f03f0
lea ecx, [esp + 0x208]
push ecx
lea edx, [esp + 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x104]
push eax
call fcn.004e24e0
add esp, 4
push str.verinfo.ini
lea ecx, [esp + 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x104]
push edx
push 0x104
lea eax, [esp + 8]
push eax
push 0x60c81c
push 0x6111d8
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp], 0
je 0x4f03f0
lea ecx, [esp]
push 0x2e
push ecx
call fcn.005e0940
add esp, 8
test eax, eax
je 0x4f03df
mov byte [eax], 0
lea edx, [esp]
push edx
call fcn.005e0909
add esp, 4
mov dword [0x74b6bc], eax
mov eax, dword [0x74b6bc]
mov ecx, dword [esp + 0x30c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x310
ret