joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f638
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x49f640
push ebx
push esi
mov esi, 0x550d88
xor eax, eax
push ebp
push 0x49f95b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov byte [0x551030], 1
mov eax, dword [0x55108c]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [0x551090]
mov edx, dword [eax]
call dword [edx + 0x44]
call fcn.00487788
call fcn.0049dadc
xor eax, eax
push ebp
push 0x49f8d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x551734]
call fcn.0048d280
xor eax, eax
push ebp
push 0x49f8a7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0048d384
xor eax, eax
push ebp
push 0x49f86e
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [esi]
cmp byte [eax + 0x30c], 0
je 0x49f6e6
mov al, 1
call fcn.0049f558
mov eax, dword [esi]
cmp byte [eax + 0x30c], 0
je 0x49f6e6
push ebp
call fcn.0049e568
pop ecx
and bl, al
mov eax, dword [esi]
cmp byte [eax + 0x30d], 0
je 0x49f722
mov eax, dword [esi]
cmp byte [eax + 0x30c], 0
je 0x49f707
mov eax, dword [esi]
cmp byte [eax + 0x2ee], 0
je 0x49f70e
xor eax, eax
call fcn.0049f558
mov eax, dword [esi]
cmp byte [eax + 0x30d], 0
je 0x49f722
push ebp
call fcn.0049f408
pop ecx
and bl, al
test bl, bl
jne 0x49f73b
mov eax, dword [esi]
test byte [eax + 0x331], 0x10
je 0x49f73b
mov eax, dword [0x550e54]
call fcn.00487d50
mov eax, dword [esi]
test byte [eax + 0x2f1], 2
je 0x49f7be
cmp byte [ebp - 0xd], 0
jne 0x49f7be
test bl, bl
je 0x49f788
push 0x242040
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, dword [esi]
call fcn.0044d8f0
mov eax, dword [ebp - 0x14]
call fcn.004072b0
push eax
lea ecx, [ebp - 0x18]
mov dl, 0x90
mov eax, dword [esi]
call fcn.0044d8f0
mov eax, dword [ebp - 0x18]
call fcn.004072b0
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x49f7be
push 0x242010
lea ecx, [ebp - 0x1c]
xor edx, edx
mov eax, dword [esi]
call fcn.0044d8f0
mov eax, dword [ebp - 0x1c]
call fcn.004072b0
push eax
lea ecx, [ebp - 0x20]
mov dl, 0x91
mov eax, dword [esi]
call fcn.0044d8f0
mov eax, dword [ebp - 0x20]
call fcn.004072b0
push eax
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, dword [esi]
test byte [eax + 0x331], 0x20
je 0x49f82a
test bl, bl
jne 0x49f82a
lea eax, [ebp - 0x24]
call fcn.0049e2d0
mov eax, dword [ebp - 0x24]
call fcn.004072b0
push eax
lea eax, [ebp - 0x28]
call fcn.0048cf94
mov eax, dword [ebp - 0x28]
call fcn.004072b0
push eax
call sub.kernel32.dll_MoveFileA
lea eax, [ebp - 0x38]
call fcn.0049e2d0
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
call fcn.00407c88
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00416420
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov ecx, 0
call fcn.00407cb0
mov eax, dword [ebp - 0x2c]
call fcn.0049e3a0
lea eax, [ebp - 0x40]
call fcn.0048cf94
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
call fcn.00407c88
mov eax, dword [ebp - 0x3c]
call fcn.00488b40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f875
lea eax, [ebp - 0x48]
call fcn.0048d180
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x44]
call fcn.00407c88
mov eax, dword [ebp - 0x44]
call fcn.00488b40
ret
Function at 0x4a19b4
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
push 0x4a1a58
call sub.kernel32.dll_GetModuleHandleA
mov ebx, eax
test ebx, ebx
je 0x4a1a1d
push 0x4a1a68
push ebx
call fcn.0040ca78
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4a1a1d
mov dword [ebp - 0x44], 0x40
lea eax, [ebp - 0x44]
push eax
call dword [ebp - 4]
test eax, eax
je 0x4a1a1d
mov eax, dword [ebp - 0x3c]
mov dword [edi], eax
mov eax, dword [ebp - 0x38]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esi], eax
mov eax, dword [ebp - 0x30]
mov dword [esi + 4], eax
jmp 0x4a1a4f
mov dword [ebp - 0x64], 0x20
lea eax, [ebp - 0x64]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x6c], eax
xor eax, eax
mov dword [ebp - 0x68], eax
fild qword [ebp - 0x6c]
fistp qword [edi]
wait
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x6c], eax
xor eax, eax
mov dword [ebp - 0x68], eax
fild qword [ebp - 0x6c]
fistp qword [esi]
wait
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a2aa0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a2c1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406a7c
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.004072b0
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4a2bf8
mov eax, dword [ebp - 8]
call fcn.00404214
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4a2bf1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4a2bd8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4a2c2c
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4a2bd8
push 0x4a2c54
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov edx, 4
call fcn.004159a8
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.004159a8
push dword [ebp - 0x24]
push 0x4a2c88
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00408024
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.00407cb0
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.004072b0
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4a2bd8
cmp dword [ebp - 0x10], 1
jbe 0x4a2bd8
push 0
mov ebx, dword [ebp - 0x18]
mov eax, ebx
call fcn.00416b3c
mov ecx, eax
mov eax, esi
mov edx, ebx
call fcn.00406bb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2bf8
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.00404230
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2c22
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00407a54
lea eax, [ebp - 4]
call fcn.00406a7c
ret
Function at 0x4a2ce0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004072a0
xor eax, eax
push ebp
push 0x4a2dc9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406a7c
cmp dword [ebp - 4], 0
je 0x4a2d30
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x4a2d30
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00407394
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.004072b0
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4a2db3
mov eax, ebx
xor ecx, ecx
mov edx, 0x400
call fcn.00407594
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4a2d6d
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.004072b0
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x4a2da3
mov eax, ebx
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00407594
jmp 0x4a2daa
mov eax, ebx
call fcn.00406a7c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2dd0
lea eax, [ebp - 4]
call fcn.00406a7c
ret

Function at 0x4a2dd8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004072a0
mov eax, dword [ebp - 8]
call fcn.004072a0
xor eax, eax
push ebp
push 0x4a2eae
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x4a2e2a
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x4a2e2a
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00407394
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.004072b0
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4a2e93
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004072b0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4a2e8a
cmp dword [ebp - 0x14], 4
jne 0x4a2e8a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2eb5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406aa0
ret
Function at 0x4a3a50
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a3c05
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406a7c
lea eax, [ebp - 0xc]
push eax
push 8
call fcn.00482c0c
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4a3be2
xor eax, eax
push ebp
push 0x4a3bdb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [ebp - 0x10]
call fcn.00404214
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4a3bbd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x4a3ba7
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
dec edi
test edi, edi
jl 0x4a3ba7
inc edi
xor ebx, ebx
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x14]
add edx, 4
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [edx + eax*4 + 4]
mov dword [ebp - 0x1c], ecx
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x14]
add edx, 4
mov eax, dword [edx + eax*4 + 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameW
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00407594
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.004072b0
push eax
lea eax, [ebp - 0x20]
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeNameA
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00407594
push dword [esi]
lea ecx, [ebp - 0x24]
mov edx, 0x1f
mov eax, dword [ebp - 8]
call fcn.004a39b4
push dword [ebp - 0x24]
push ebp
lea eax, [ebp - 0x28]
call fcn.004a3958
pop ecx
push dword [ebp - 0x28]
push 0x4a3c20
mov eax, esi
mov edx, 4
call fcn.0040704c
inc ebx
dec edi
jne 0x4a3afe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3bc4
mov eax, dword [ebp - 0x14]
call fcn.00404230
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3c0c
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00406aa0
lea eax, [ebp - 8]
call fcn.00406a7c
ret
Function at 0x4a91a4
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x4a92e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x548bc0]
mov eax, dword [eax]
call fcn.00488040
mov ebx, eax
test ebx, ebx
je 0x4a921e
lea eax, [ebp - 8]
mov edx, dword [ebx + 4]
call fcn.00407c88
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00416634
mov eax, dword [ebp - 4]
call fcn.00407ae8
push eax
push 0x4a92f4
call sub.kernel32.dll_SetEnvironmentVariableW
mov eax, dword [ebx + 8]
call fcn.004072b0
push eax
push 0x4a9314
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebx + 0xc]
call fcn.004072b0
push eax
push 0x4a9324
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x3c]
call fcn.004880fc
mov ebx, eax
test ebx, ebx
je 0x4a927e
lea eax, [ebp - 0x10]
mov edx, dword [ebx + 4]
call fcn.00407c88
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00416634
mov eax, dword [ebp - 0xc]
call fcn.00407ae8
push eax
push 0x4a9334
call sub.kernel32.dll_SetEnvironmentVariableW
mov eax, dword [ebx + 8]
call fcn.004072b0
push eax
push 0x4a9358
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [ebx + 0xc]
call fcn.004072b0
push eax
push 0x4a936c
call sub.kernel32.dll_SetEnvironmentVariableA
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x40]
call fcn.004a0ff0
mov eax, dword [ebp - 0x14]
call fcn.004072b0
push eax
push 0x4a9380
call sub.kernel32.dll_SetEnvironmentVariableA
mov eax, dword [0x550e54]
call fcn.004072b0
push eax
push 0x4a938c
call sub.kernel32.dll_SetEnvironmentVariableA
push 0x4a9398
push 0x4a939c
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a92ed
lea eax, [ebp - 0x14]
call fcn.00406a7c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00407a54
ret
Function at 0x4ae44c
Capabilities:
Terminate thread

Disassembly:
call fcn.0044cb04
test al, al
jne 0x4ae4a9
cmp dword [0x550e28], 0
je 0x4ae4a9
mov eax, dword [0x550e28]
call fcn.00443224
mov eax, dword [0x54bc44]
call fcn.00488110
test al, al
jne 0x4ae488
push 0xffffffffffffffff
mov eax, dword [0x550e28]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x4ae498
push 1
mov eax, dword [0x550e28]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [0x550e28]
call fcn.004056d0
xor eax, eax
mov dword [0x550e28], eax
ret

Function at 0x4af4bc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00489cf8
mov edi, eax
mov dl, 1
mov eax, dword [0x42c850]
call fcn.004056a0
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4af5d2
push dword fs:[edx]
mov dword fs:[edx], esp
mov al, 0x10
call fcn.0048beec
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4af502
mov dword [ebp - 0x14], 1
jmp 0x4af50d
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00437460
mov al, 0x13
call fcn.0048beec
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4af526
mov dword [ebp - 0xc], 1
jmp 0x4af531
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00437460
mov al, 0x11
call fcn.0048beec
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4af54a
mov dword [ebp - 0x10], 1
jmp 0x4af555
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00437460
mov esi, dword [edi]
dec esi
test esi, esi
jl 0x4af583
inc esi
xor ebx, ebx
mov eax, dword [edi + 4]
mov eax, dword [eax + ebx*8 + 4]
cmp eax, dword [ebp - 0x10]
je 0x4af57f
cmp eax, dword [ebp - 0xc]
je 0x4af57f
cmp eax, dword [ebp - 0x14]
je 0x4af57f
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00437460
inc ebx
dec esi
jne 0x4af55f
mov esi, dword [edi]
dec esi
test esi, esi
jl 0x4af5bc
inc esi
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov eax, dword [edi + 4]
lea eax, [eax + ebx*8 + 4]
call fcn.004af358
push eax
call sub.kernel32.dll_VirtualProtect
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00437620
mov edx, dword [edi + 4]
mov dword [edx + ebx*8 + 4], eax
inc ebx
dec esi
jne 0x4af58d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af5d9
mov eax, dword [ebp - 8]
call fcn.004056d0
ret
Function at 0x4af678
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
call fcn.00489cf8
mov esi, eax
mov ebx, dword [esi]
dec ebx
jmp 0x4af68b
dec ebx
test ebx, ebx
jl 0x4af698
mov eax, dword [esi + 4]
cmp dword [eax + ebx*8], 0
je 0x4af68a
mov eax, dword [esi + 4]
mov eax, dword [eax + ebx*8]
test eax, eax
je 0x4af6dd
mov dword [0x550da8], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov eax, dword [esi + 4]
lea eax, [eax + ebx*8]
call fcn.004af358
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi + 4]
lea eax, [eax + ebx*8]
call fcn.004af358
mov dword [0x550df4], eax
mov eax, 0x4af5e0
mov edx, dword [0x550df4]
mov dword [edx], eax
mov ebx, dword [esi]
dec ebx
jmp 0x4af6e3
dec ebx
test ebx, ebx
jl 0x4af6f1
mov eax, dword [esi + 4]
cmp dword [eax + ebx*8 + 4], 0
je 0x4af6e2
mov eax, dword [esi + 4]
mov eax, dword [eax + ebx*8 + 4]
test eax, eax
je 0x4af727
mov dword [0x550dac], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov eax, dword [esi + 4]
lea eax, [eax + ebx*8 + 4]
call fcn.004af358
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, 0x4af668
mov edx, dword [esi + 4]
mov dword [edx + ebx*8 + 4], eax
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4b7c84
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4b7dff
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00407ab0
mov eax, dword [ebp - 4]
call fcn.004b751c
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4b7cd6
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040827c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004b8930
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4b7db5
xor eax, eax
push ebp
push 0x4b7dae
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004b7884
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004b7e34
test al, al
je 0x4b7d8c
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00407b98
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4b7d8c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00407ae8
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004b77e4
test al, al
je 0x4b7d86
mov eax, dword [ebp - 8]
call fcn.00407ae8
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00407c18
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004b7c84
dec ebx
cmp ebx, 0xffffffff
jne 0x4b7d35
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7db5
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004b7884
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 4]
call fcn.00407ae8
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004b7870
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004b77e4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7e06
lea eax, [ebp - 0x3c]
call fcn.00407a4c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407a54
ret

Function at 0x4b880c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.004b7590
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00407ae8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.004b77e4
test al, al
jne 0x4b8874
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x548d34]
mov dl, 1
mov eax, dword [0x4b6340]
call fcn.0041b074
call fcn.0040626c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b8880
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00407ae8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.004b77e4
test al, al
jne 0x4b88e1
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x548fdc]
mov dl, 1
mov eax, dword [0x4b6340]
call fcn.0041b074
call fcn.0040626c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004b75c0
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4b8ee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b9008
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.004b7884
xor eax, eax
push ebp
push 0x4b8fe3
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004b7e34
test al, al
je 0x4b8fc7
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004b8dc0
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407b98
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x4b8fc7
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00407ae8
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004b77e4
test al, al
je 0x4b8fc3
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00407ae8
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00407c18
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004b8dc0
pop ecx
inc edi
dec ebx
jne 0x4b8f6b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8fea
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.004b7884
ret