joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d139
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x244
mov eax, dword [0x5184d0]
xor eax, esp
mov dword [esp + 0x240], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [esp + 0x24], eax
lea edi, [esp + 0x30]
mov dword [esp + 0x18], ecx
xor esi, esi
xor ecx, ecx
mov dword [esp + 0x1c], edx
mov dword [eax], ecx
inc esi
xor eax, eax
mov dword [esp + 0x10], ecx
stosd dword es:[edi], eax
mov ebx, ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x20], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
push 0x10
lea eax, [esp + 0x38]
mov edi, ecx
push eax
push 8
lea eax, [esp + 0x38]
push eax
push 0xa5
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
test eax, eax
js 0x47d1b5
movzx edi, byte [esp + 0x31]
and edi, esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x47d1d6
test edi, edi
jne 0x47d1d6
mov edi, 0x80070032
push edi
push 0x13830139
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x47d2f4
cmp dword [esp + 0x1c], ebx
je 0x47d1ee
neg esi
sbb esi, esi
and esi, 0xffff
add esi, 0x1111
jmp 0x47d1fe
neg esi
sbb esi, esi
and esi, 0xffff
add esi, 0x131
lea eax, [esp + 0x14]
xor edx, edx
push eax
push ecx
lea eax, [esp + 0x48]
xor ecx, ecx
push eax
push 0
push dword [0x518dd0]
call fcn.0043f6ce
mov edi, eax
test edi, edi
je 0x47d228
push edi
push 0x13a00139
jmp 0x47d1cb
push 7
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x24]
call dword [sym.imp.certcli.dll_Ordinal_223]
mov edi, eax
test edi, edi
je 0x47d24f
push edi
push 0x13a70139
jmp 0x47d1cb
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.CRYPT32.dll_PFXIsPFXBlob]
test eax, eax
je 0x47d284
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push esi
call fcn.004d7fcf
mov ebx, eax
test ebx, ebx
jne 0x47d2ea
call fcn.004c73cc
mov edi, eax
push edi
push 0x13b40139
jmp 0x47d1cb
mov edi, 0x8007000d
push edi
push 0x13ba0139
call dword [sym.imp.certcli.dll_Ordinal_357]
push 0
push 0x201
push 0
push 1
push 2
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
mov ebx, eax
test ebx, ebx
jne 0x47d2c0
call fcn.004c73cc
mov edi, eax
push edi
push 0x13c70139
jmp 0x47d1cb
mov esi, dword [esp + 0x18]
mov ecx, esi
mov edx, dword [esp + 0x14]
push ebx
call fcn.004a6ec1
cmp eax, 1
je 0x47d2db
mov edi, eax
test eax, eax
je 0x47d2ea
push edi
push 0x13cf0139
push esi
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x47d2f4
mov eax, dword [esp + 0x24]
mov dword [eax], ebx
xor ebx, ebx
xor edi, edi
mov ecx, 0x208
lea eax, [esp + 0x40]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x47d2fd
test ebx, ebx
je 0x47d327
cmp dword [esp + 0x1c], ecx
mov ecx, ebx
sete al
xor edx, edx
movzx eax, al
push eax
call fcn.004e5f2b
push 0
push ebx
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
cmp dword [esp + 0x10], 0
je 0x47d338
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x24c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005036b0
mov esp, ebp
pop ebp
ret 8
Function at 0x481989
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 8]
and dword [esp + 8], 0
and dword [esp + 4], 0
and dword [esp], 0
and dword [esp + 0xc], 0
push ebx
push esi
push edi
push 0
push 0x8000000
push 3
mov dword [esp + 0x28], edx
xor edx, edx
push 0
inc edx
push edx
push SysReAllocString
push ecx
mov dword [eax], edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4819ed
call fcn.004c73cc
mov esi, eax
push esi
push 0x24e30139
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x481abd
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x481a0c
call fcn.004c73cc
mov esi, eax
push esi
push 0x24ea0139
jmp 0x4819e2
lea eax, [esp + 0x18]
mov edx, ebx
push eax
mov ecx, edi
call fcn.00480116
mov esi, eax
test esi, esi
je 0x481a2e
push esi
push 0x24f00139
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x481aac
mov eax, dword [ebp + 8]
xor ecx, ecx
push ecx
push ecx
push ecx
push edi
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x481a53
call fcn.004c73cc
mov esi, eax
push esi
push 0x24f60139
jmp 0x481a26
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x1c]
call fcn.0048123a
mov esi, eax
test esi, esi
je 0x481a78
push esi
push 0x24fc0139
jmp 0x481a95
push dword [esp + 0xc]
mov edx, ebx
mov ecx, edi
push dword [esp + 0x14]
call fcn.00480f55
mov esi, eax
test esi, esi
je 0x481a9b
push esi
push 0x25010139
call dword [sym.imp.certcli.dll_Ordinal_357]
cmp dword [esp + 0x14], 0
je 0x481aac
push dword [esp + 0x14]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
cmp dword [esp + 0x18], 0
je 0x481abd
push dword [esp + 0x18]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
cmp dword [esp + 0xc], 0
je 0x481ace
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [esp + 0x10], 0
je 0x481ae1
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp edi, 0xffffffff
je 0x481aed
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4858cf
Capabilities:
Get hostname
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x100
push eax
lea eax, [ebp - 0x204]
push eax
push 4
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov edi, 0x406520
test eax, eax
jne 0x485933
call fcn.004c73cc
mov esi, eax
push esi
push 0x6a1013a
call dword [sym.imp.certcli.dll_Ordinal_357]
push 0
push esi
xor edx, edx
mov ecx, 0x41dff4
call fcn.004cfab1
jmp 0x485955
lea eax, [ebp - 0x204]
mov ecx, 0x893
push eax
call fcn.004cf8b9
push eax
call fcn.004c5942
push edi
call fcn.004c5942
add esp, 0xc
xor esi, esi
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x100
push eax
lea eax, [ebp - 0x204]
push eax
push 2
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x4859a3
call fcn.004c73cc
push esi
push 0x6b0013a
mov edi, eax
call dword [sym.imp.certcli.dll_Ordinal_357]
push 0
push edi
xor edx, edx
mov ecx, 0x41ded0
call fcn.004cfab1
test esi, esi
jne 0x4859c9
mov esi, edi
jmp 0x4859c9
lea eax, [ebp - 0x204]
mov ecx, 0x894
push eax
call fcn.004cf8b9
push eax
call fcn.004c5942
push edi
call fcn.004c5942
push edi
call fcn.004c5942
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.005036b0
leave
ret
Function at 0x48a2b8
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x505f4a
call fcn.00503d5c
mov edi, edx
mov ebx, ecx
push 0x402f38
push 0xc
call fcn.00503b69
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x48a2f1
push 0x8007000e
push 0x1052013f
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x48a38a
and dword [esi + 8], 0
push 0x402f38
push 8
mov dword [esi], ebx
mov dword [esi + 4], edi
call fcn.00503b69
pop ecx
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor edx, edx
mov dword [ebp - 4], edx
test ecx, ecx
je 0x48a331
mov dword [ecx], 0x4015f0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [ecx], 0x4015c8
mov dword [ecx + 4], eax
mov byte [ebp - 4], dl
jmp 0x48a333
mov ecx, edx
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], ecx
test ecx, ecx
jne 0x48a34a
push 0x8007000e
push 0x105b013f
jmp 0x48a36c
lea eax, [ebp - 0x14]
push eax
push edx
push esi
push fcn.00489a90
push edx
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x48a383
call fcn.004c73cc
push eax
push 0x1068013f
call dword [sym.imp.certcli.dll_Ordinal_357]
mov ecx, esi
call fcn.00485f08
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
jmp 0x48a38a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00503d18
ret 4

Function at 0x48a398
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x505f4a
call fcn.00503d5c
mov edi, edx
mov ebx, ecx
push 0x402f38
push 0xc
call fcn.00503b69
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x48a3d1
push 0x8007000e
push 0x1080013f
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x48a466
and dword [esi + 4], 0
and dword [esi + 8], 0
push 0x402f38
push 8
mov dword [esi], ebx
call fcn.00503b69
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
test eax, eax
je 0x48a40d
mov dword [eax], 0x4015f0
mov byte [ebp - 4], 1
mov dword [eax], 0x4015c8
mov dword [eax + 4], edi
mov byte [ebp - 4], cl
jmp 0x48a40f
mov eax, ecx
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], eax
test eax, eax
jne 0x48a426
push 0x8007000e
push 0x1088013f
jmp 0x48a448
lea eax, [ebp - 0x14]
push eax
push ecx
push esi
push fcn.00489dd0
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x48a45f
call fcn.004c73cc
push eax
push 0x1095013f
call dword [sym.imp.certcli.dll_Ordinal_357]
mov ecx, esi
call fcn.00485f08
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
jmp 0x48a466
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00503d18
ret
Function at 0x48a472
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x505f4a
call fcn.00503d5c
mov edi, edx
mov ebx, ecx
push 0x402f38
push 0xc
call fcn.00503b69
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x48a4ab
push 0x8007000e
push 0x10ad013f
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x48a540
and dword [esi + 4], 0
and dword [esi + 8], 0
push 0x402f38
push 8
mov dword [esi], ebx
call fcn.00503b69
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
test eax, eax
je 0x48a4e7
mov dword [eax], 0x4015f0
mov byte [ebp - 4], 1
mov dword [eax], 0x4015c8
mov dword [eax + 4], edi
mov byte [ebp - 4], cl
jmp 0x48a4e9
mov eax, ecx
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], eax
test eax, eax
jne 0x48a500
push 0x8007000e
push 0x10b5013f
jmp 0x48a522
lea eax, [ebp - 0x14]
push eax
push ecx
push esi
push fcn.0048a0b0
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x48a539
call fcn.004c73cc
push eax
push 0x10c2013f
call dword [sym.imp.certcli.dll_Ordinal_357]
mov ecx, esi
call fcn.00485f08
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
jmp 0x48a540
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00503d18
ret

Function at 0x491266
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], ecx
mov dword [eax], esi
mov ebx, edx
mov eax, dword [ebp + 0xc]
push edi
push 0x4101c4
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
jne 0x4912a9
call fcn.004c73cc
mov esi, eax
push esi
push 0x16fc013b
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x491349
push ebx
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x4912c9
call fcn.004c73cc
mov esi, eax
push esi
push 0x1705013b
jmp 0x49129e
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4912e7
call fcn.004c73cc
mov esi, eax
push esi
push 0x170e013b
jmp 0x49129e
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x491318
call fcn.004c73cc
mov esi, eax
test esi, esi
jne 0x491310
mov esi, 0x8007000d
push esi
push 0x171d013b
jmp 0x49129e
mov eax, dword [ebp + 0xc]
push edi
push esi
mov dword [eax], edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test eax, eax
jne 0x49133e
mov esi, 0x8007000e
push esi
push 0x1725013b
jmp 0x49129e
push edi
push ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x493513
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
and dword [esp], 0
push ebx
push esi
push edi
mov edi, dword [0x518ddc]
mov ebx, ecx
test edi, edi
je 0x493539
lea eax, [edi - 1]
mov dword [0x518ddc], eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 4
push 0xfffffffffffffffe
pop edx
lea ecx, [esp + 0x1c]
call fcn.004c6337
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x519960]
push 0xf003f
neg eax
push 0
sbb eax, eax
push 0x41ee90
add eax, reloc.OLEAUT32.dll_SysReAllocString
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x493594
push esi
push 0x1f7c013b
push 0x41ee90
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x4936ce
cmp dword [0x51996c], 0
mov esi, 0x41ef04
je 0x493676
cmp dword [0x519960], 0
mov eax, 0x41f2e8
mov dword [esp + 0x10], 8
jne 0x4935c1
mov eax, 0x41f2c0
push esi
push 0x41ee90
push eax
push 0x41ef20
call fcn.004c5942
add esp, 0x10
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push esi
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x493604
push eax
push 0x1f91013b
push esi
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x493644
cmp dword [esp + 0x14], 3
jne 0x493644
cmp dword [esp + 0x10], 8
jne 0x493644
mov ecx, 0x297
call fcn.004cf8b9
push eax
push 0x41ef3c
call fcn.004c5942
pop ecx
pop ecx
lea eax, [esp + 0x20]
xor edx, edx
push eax
push 0
mov cl, 1
call fcn.0045fcfa
push 0x406520
call fcn.004c5942
pop ecx
mov ecx, 0x298
call fcn.004cf8b9
push eax
push 0x41ef3c
call fcn.004c5942
pop ecx
pop ecx
lea eax, [esp + 0x18]
xor edx, edx
push eax
push 0
mov cl, 1
call fcn.0045fcfa
push 0x406520
call fcn.004c5942
pop ecx
push 8
lea eax, [esp + 0x1c]
push eax
push 3
push 0
push esi
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x4936a2
push esi
push 0x1fa8013b
push 0x41ef04
jmp 0x493589
xor ecx, ecx
lea eax, [esp + 0x14]
push ecx
push eax
push ecx
push ecx
push ecx
push ecx
push 0x400
xor edx, edx
mov ecx, ebx
call fcn.0048c7fa
mov esi, eax
test esi, esi
je 0x4936ce
push esi
push 0x1fb4013b
call dword [sym.imp.certcli.dll_Ordinal_357]
cmp dword [esp + 0xc], 0
mov dword [0x518ddc], edi
je 0x4936e5
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.004c738c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4941a1
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
xor ecx, ecx
mov edi, edx
push 0x2000000
push ecx
push 0x41f110
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ecx
mov byte [ebx], cl
mov byte [edi], cl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, 2
je 0x494268
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
mov dword [ebp - 0x10], 4
test esi, esi
je 0x494201
push esi
push 0x2218013b
push 0x41f110
jmp 0x49432b
lea eax, [ebp - 0x10]
mov esi, 0x41f180
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49425f
cmp dword [ebp - 0xc], 4
jne 0x49427a
cmp dword [ebp - 8], eax
je 0x49427a
and dword [ebp - 8], eax
lea eax, [ebp - 8]
push 4
push eax
push 4
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x49425a
push esi
push 0x222c013b
push 0x41f180
jmp 0x49432b
mov byte [ebx], 1
jmp 0x49427a
push eax
push 0x2234013b
push esi
jmp 0x494274
push 2
push 0x223a013b
push 0x41f110
call dword [sym.imp.certcli.dll_Ordinal_359]
cmp dword [ebp - 4], 0
je 0x49428d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x2000000
push 0
push 0x41f1b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, 2
je 0x49434b
xor ecx, ecx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
test esi, esi
je 0x4942d3
push esi
push 0x2251013b
push 0x41f1b0
jmp 0x49432b
lea eax, [ebp - 0x10]
mov esi, 0x40edd8
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x494342
cmp dword [ebp - 0xc], 4
jne 0x49435d
mov eax, dword [ebp - 8]
test al, 8
je 0x49435d
and eax, 0xfffffff7
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x49433d
push esi
push 0x2266013b
push 0x40edd8
call dword [sym.imp.certcli.dll_Ordinal_359]
cmp esi, 5
jne 0x49435f
mov ecx, 0xb0c
jmp 0x49436e
mov byte [edi], 1
jmp 0x49435d
push eax
push 0x226e013b
push esi
jmp 0x494357
push 2
push 0x2274013b
push 0x41f1b0
call dword [sym.imp.certcli.dll_Ordinal_359]
xor esi, esi
cmp byte [ebx], 0
jne 0x494369
cmp byte [edi], 0
je 0x494380
mov ecx, 0xb0a
call fcn.004cf8b9
push eax
push 0x405204
call fcn.004c5942
pop ecx
pop ecx
cmp dword [ebp - 4], 0
je 0x49438f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.004c738c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4943a1
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov bl, cl
xor esi, esi
mov dword [ebp - 4], esi
mov bh, dl
test bl, bl
jne 0x4943c0
test bh, bh
je 0x4944e3
push edi
mov ecx, 0xb0b
call fcn.004cf8b9
push eax
push 0x405204
call fcn.004c5942
pop ecx
pop ecx
push 4
pop edi
test bl, bl
je 0x49444c
lea eax, [ebp - 4]
push eax
push 0x2000000
push esi
push 0x41f110
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x49440a
push eax
push 0x22b0013b
push 0x41f110
jmp 0x494435
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push edi
push esi
push 0x41f180
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x49443b
push eax
push 0x22bc013b
push 0x41f180
call dword [sym.imp.certcli.dll_Ordinal_359]
mov eax, dword [ebp - 4]
test eax, eax
je 0x49444c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
test bh, bh
je 0x4944d4
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push eax
push 0x2000000
push esi
mov edi, 0x41f1b0
mov dword [ebp - 0x10], esi
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x494484
push eax
push 0x22d5013b
jmp 0x4944cd
lea eax, [ebp - 0xc]
mov edi, 0x40edd8
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4944ac
push eax
push 0x22de013b
jmp 0x4944cd
or dword [ebp - 8], 8
lea eax, [ebp - 8]
push 4
push eax
push 4
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4944d4
push eax
push 0x22e8013b
push edi
call dword [sym.imp.certcli.dll_Ordinal_359]
mov eax, dword [ebp - 4]
pop edi
test eax, eax
je 0x4944e3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
leave
ret
Function at 0x4944ed
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x2000000
push ebx
mov edi, ecx
mov dword [ebp - 4], ebx
push 0x41f110
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [edi], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, 2
je 0x4945b6
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 4
test esi, esi
je 0x494544
push esi
push 0x2312013b
push 0x41f110
jmp 0x494596
lea eax, [ebp - 0x10]
mov esi, 0x41f238
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4945ad
cmp dword [ebp - 0xc], 4
jne 0x4945c8
cmp dword [ebp - 8], ebx
je 0x4945c8
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 4
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x4945a8
push esi
push 0x2326013b
push 0x41f238
call dword [sym.imp.certcli.dll_Ordinal_359]
cmp esi, 5
jne 0x4945ca
mov ecx, 0xb34
jmp 0x4945d3
mov byte [edi], 1
jmp 0x4945c8
push eax
push 0x232e013b
push esi
jmp 0x4945c2
push 2
push 0x2334013b
push 0x41f110
call dword [sym.imp.certcli.dll_Ordinal_359]
mov esi, ebx
cmp byte [edi], bl
je 0x4945e5
mov ecx, 0xb32
call fcn.004cf8b9
push eax
push 0x405204
call fcn.004c5942
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
je 0x4945f3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.004c738c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x494605
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], esi
test cl, cl
je 0x49469a
push edi
mov ecx, 0xb33
call fcn.004cf8b9
push eax
push 0x405204
call fcn.004c5942
pop ecx
pop ecx
lea eax, [ebp - 4]
mov edi, 0x41f110
push eax
push 0x2000000
push esi
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x49465a
push eax
push 0x236f013b
push edi
jmp 0x494684
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 4
push esi
mov esi, 0x41f238
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x49468a
push eax
push 0x237b013b
push esi
call dword [sym.imp.certcli.dll_Ordinal_359]
cmp dword [ebp - 4], 0
pop edi
je 0x49469a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret
Function at 0x494c70
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edx
and dword [ebp - 4], edi
mov eax, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edi
sub eax, 5
je 0x494cbe
sub eax, 1
je 0x494cb7
sub eax, 1
je 0x494cb0
mov esi, 0x8000ffff
push esi
push 0x2547013b
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x494d65
mov ebx, 0x4068b8
jmp 0x494cc3
mov ebx, 0x406864
jmp 0x494cc3
mov ebx, 0x406844
lea eax, [ebp - 4]
mov ecx, ebx
push eax
lea edx, [ebp - 8]
call fcn.00494bc0
mov esi, eax
test esi, esi
je 0x494ce8
push esi
push 0x254e013b
call dword [sym.imp.certcli.dll_Ordinal_357]
mov edi, dword [ebp - 8]
jmp 0x494d65
mov edi, dword [ebp - 8]
xor eax, eax
mov esi, dword [ebp - 0xc]
push eax
push eax
push dword [ebp - 4]
push edi
push eax
push esi
push 0xd
call dword [sym.imp.CRYPT32.dll_I_CertProtectFunction]
test eax, eax
jne 0x494d2b
cmp esi, 7
jne 0x494d43
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x494d43
mov ecx, 0xb59
call fcn.004cf8b9
push eax
push 0x405204
call fcn.004c5942
pop ecx
pop ecx
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [eax], edi
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov eax, esi
pop esi
pop ebx
leave
ret 4
call fcn.004c73cc
mov esi, eax
xor edx, edx
push ebx
push esi
xor ecx, ecx
call fcn.004cfab1
push esi
push 0x2565013b
call dword [sym.imp.certcli.dll_Ordinal_357]
test esi, esi
je 0x494d2d
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
xor ecx, ecx
jmp 0x494d30