joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48bb10
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [0x5741b8]
push esi
push edi
test edx, edx
jne 0x48bb83
cmp byte [0x5741b4], dl
jne 0x48bb83
push str.Crypt32.dll
call fcn.0048f0c0
mov dword [0x5741b0], eax
test eax, eax
je 0x48bb6e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptProtectMemory
push eax
call esi
push str.CryptUnprotectMemory
push dword [0x5741b0]
mov dword [0x5741b8], eax
call esi
mov edx, dword [0x5741b8]
mov ecx, eax
mov dword [0x5741bc], ecx
mov byte [0x5741b4], 1
jmp 0x48bb89
mov ecx, dword [0x5741bc]
mov edx, dword [0x5741b8]
mov byte [0x5741b4], 1
jmp 0x48bb89
mov ecx, dword [0x5741bc]
mov esi, dword [esp + 0x10]
mov eax, esi
and eax, 0xf
mov edi, esi
sub edi, eax
xor eax, eax
cmp byte [esp + 0x18], al
setne al
cmp byte [esp + 0x14], 0
je 0x48bbe3
test edx, edx
je 0x48bbfa
push eax
push edi
push dword [esp + 0x14]
call edx
test eax, eax
jne 0x48bc1e
push str.CryptProtectMemory_failed
push 0x56df60
call fcn.00462d50
add esp, 8
mov ecx, 0x56df60
call fcn.00463320
push 2
mov ecx, 0x56df60
call fcn.00462d10
pop edi
pop esi
ret 0x10
test ecx, ecx
je 0x48bbfa
push eax
push edi
push dword [esp + 0x14]
call ecx
test eax, eax
jne 0x48bc1e
push str.CryptUnprotectMemory_failed
jmp 0x48bbbb
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ebx, eax
test esi, esi
je 0x48bc1d
mov edi, dword [esp + 0x10]
add bl, 0x4b
lea ecx, [edx + edi]
lea eax, [edx + ebx]
inc edx
xor byte [ecx], al
cmp edx, esi
jb 0x48bc10
pop ebx
pop edi
pop esi
ret 0x10
Function at 0x48d4f0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
ret 4

Function at 0x48d630
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, dword [edi + 0x20]
lea ebp, [edi + 0x2c]
mov ebx, dword [edi + 0x20]
and esi, 0x3f
mov ecx, dword [edi + 0x24]
shld ecx, ebx, 3
mov dword [edi + 0x28], ebp
mov byte [esi + edi + 0x2c], 0x80
inc esi
shl ebx, 3
mov dword [esp + 0x1c], ecx
cmp esi, 0x38
je 0x48d67c
and esi, 0x3f
jne 0x48d66e
push edi
call fcn.0048da90
mov byte [esi + ebp], 0
inc esi
cmp esi, 0x38
jne 0x48d663
mov ecx, dword [esp + 0x1c]
mov eax, ecx
shr eax, 0x18
shld ecx, ebx, 8
mov byte [esi + edi + 0x2c], al
shl ebx, 8
mov eax, ecx
shr eax, 0x18
shld ecx, ebx, 8
mov byte [esi + edi + 0x2d], al
shl ebx, 8
mov eax, ecx
shr eax, 0x18
shld ecx, ebx, 8
mov byte [esi + edi + 0x2e], al
mov eax, ecx
shl ebx, 8
shr eax, 0x18
shld ecx, ebx, 8
mov byte [esi + edi + 0x2f], al
mov eax, ecx
shl ebx, 8
shr eax, 0x18
shld ecx, ebx, 8
mov byte [esi + edi + 0x30], al
mov eax, ecx
shl ebx, 8
shr eax, 0x18
shld ecx, ebx, 8
mov byte [esi + edi + 0x31], al
mov eax, ecx
shr ecx, 0x10
shr eax, 0x18
push edi
mov byte [esi + edi + 0x32], al
mov byte [esi + edi + 0x33], cl
call fcn.0048da90
mov esi, dword [esp + 0x20]
xor edx, edx
mov eax, edx
mov ecx, 3
and eax, 3
sub ecx, eax
mov eax, edx
shr eax, 2
shl ecx, 3
mov eax, dword [edi + eax*4]
shr eax, cl
mov byte [edx + esi], al
inc edx
cmp edx, 0x20
jb 0x48d6f5
mov dword [edi], 0x6a09e667
mov dword [edi + 4], 0xbb67ae85
mov dword [edi + 8], 0x3c6ef372
mov dword [edi + 0xc], 0xa54ff53a
mov dword [edi + 0x10], 0x510e527f
mov dword [edi + 0x14], 0x9b05688c
mov dword [edi + 0x18], 0x1f83d9ab
mov dword [edi + 0x1c], 0x5be0cd19
push 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
call fcn.0048da90
push 0x40
push ebp
call fcn.0048bcb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8

Function at 0x48d780
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
ret 4
Function at 0x48f0c0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
lea eax, [esp + 4]
push 0x800
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x48f10c
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004ebbd8
add esp, 0x1004
ret 4
push 0x800
lea eax, [esp + 8]
push eax
push esi
push eax
call fcn.004789f0
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [esp + 0x1004]
pop esi
xor ecx, esp
call fcn.004ebbd8
add esp, 0x1004
ret 4

Function at 0x48f220
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x18
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x14], eax
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x48f27e
lea eax, [esp + 8]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push SysReAllocString
push 0xd
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004ebbd8
add esp, 0x18
ret

Function at 0x48f690
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi], ebx
jbe 0x48f70c
push ebp
push edi
lea edi, [esi + 4]
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x48f830
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
jne 0x48f6e8
push str.CreateThread_failed
push 0x56df60
call fcn.00462d50
add esp, 8
mov ecx, 0x56df60
call fcn.00463320
push 2
mov ecx, 0x56df60
call fcn.00462d10
mov dword [edi], ebp
inc dword [esi + 0x84]
mov eax, dword [0x5781d4]
test eax, eax
je 0x48f702
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc ebx
add edi, 4
cmp ebx, dword [esi]
jb 0x48f6a0
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret
Function at 0x49f300
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x5a4
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x5a0], eax
push ebx
mov ebx, dword [esp + 0x5ac]
push edi
mov edi, dword [esp + 0x5b4]
call fcn.0046bee0
test eax, eax
jne 0x49f33d
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x49f435
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
jmp 0x49f350
cmp word [edi], 0
mov dword [0x57a050], 0
je 0x49f433
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49f426
xor esi, esi
mov dword [esp + 0x10], 0xc8
lea eax, [esp + 0x18]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push esi
push dword [esp + 0x30]
call ebp
test eax, eax
jne 0x49f3fe
lea eax, [esp + 0x20]
push eax
push edi
push 0x5102f4
lea eax, [esp + 0x1bc]
push 0x200
push eax
call fcn.004028e0
add esp, 0x14
lea eax, [esp + 0x1b0]
push eax
push ebx
call fcn.0049f640
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0xc8
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
inc esi
push eax
lea eax, [esp + 0x34]
push eax
push esi
push dword [esp + 0x30]
call ebp
test eax, eax
je 0x49f3a7
mov eax, dword [esp + 0x14]
test eax, eax
je 0x49f40d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x49f426
mov eax, dword [0x57a050]
inc eax
mov dword [0x57a050], eax
jmp 0x49f42b
mov eax, dword [0x57a050]
test eax, eax
jne 0x49f350
pop esi
pop ebp
mov ecx, dword [esp + 0x5a8]
pop edi
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x5a4
ret 8
Function at 0x49f640
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x5a4
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x5a0], eax
push ebx
mov ebx, dword [esp + 0x5ac]
push esi
mov esi, dword [esp + 0x5b4]
cmp word [esi], 0
je 0x49f73a
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49f73a
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x14]
push edi
push eax
xor edi, edi
mov dword [esp + 0x14], 0xc8
push edi
push edi
push edi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push edi
push dword [esp + 0x30]
call ebp
test eax, eax
jne 0x49f717
lea esp, [esp]
lea eax, [esp + 0x20]
push eax
push esi
push 0x5102f4
lea eax, [esp + 0x1bc]
push 0x200
push eax
call fcn.004028e0
add esp, 0x14
lea eax, [esp + 0x1b0]
push eax
push ebx
call fcn.0049f640
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0xc8
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
inc edi
push eax
lea eax, [esp + 0x34]
push eax
push edi
push dword [esp + 0x30]
call ebp
test eax, eax
je 0x49f6c0
mov eax, dword [esp + 0x14]
pop edi
pop ebp
test eax, eax
je 0x49f728
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x49f73a
inc dword [0x57a050]
mov ecx, dword [esp + 0x5a8]
pop esi
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x5a4
ret 8

Function at 0x49f760
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x404
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
mov esi, dword [esp + 0x40c]
push edi
mov edi, dword [esp + 0x414]
push 0x50b8c4
push edi
push esi
call fcn.0049df00
test al, al
jne 0x49f7b5
push 0x200
lea eax, [esp + 0xc]
push eax
push edi
push esi
call fcn.004a03e0
test al, al
je 0x49f7b5
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp + 0x408]
pop edi
pop esi
xor ecx, esp
call fcn.004ebbd8
add esp, 0x404
ret 8

Function at 0x49f7d0
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x404
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
mov esi, dword [esp + 0x40c]
push 0x50b8c4
push esi
push SysReAllocString
call fcn.0049df00
test al, al
jne 0x49f855
movzx eax, word [esi]
cmp eax, 0x5c
je 0x49f832
test ax, ax
mov eax, 0x50b7f8
jne 0x49f817
mov eax, 0x50b8c4
push esi
push eax
push str.SoftwareWinRAR_s_s
lea eax, [esp + 0x10]
push 0x200
push eax
call fcn.004028e0
add esp, 0x14
jmp 0x49f845
push 0x200
lea eax, [esi + 2]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.0048e710
lea eax, [esp + 4]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp + 0x404]
pop esi
xor ecx, esp
call fcn.004ebbd8
add esp, 0x404
ret 4
Function at 0x49f870
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x408
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
mov ebx, dword [esp + 0x414]
push esi
mov esi, dword [esp + 0x414]
push edi
mov edi, dword [esp + 0x420]
push edi
push ebx
push esi
call fcn.0049df00
test al, al
jne 0x49f8f3
push 0x200
lea eax, [esp + 0x14]
push eax
push ebx
push esi
call fcn.004a03e0
test al, al
je 0x49f8f3
lea eax, [esp + 0xc]
push eax
push 0x20006
push 0
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49f8f3
push edi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x49f8f3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x408
ret 0xc

Function at 0x49fb90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x810
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
mov ebx, dword [esp + 0x81c]
lea eax, [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x824]
push esi
push edi
mov edi, dword [esp + 0x824]
push 0x400
push eax
push ebp
push ebx
push edi
call fcn.0049eaf0
test al, al
jne 0x49fc36
cmp byte [0x526b91], al
mov esi, dword [esp + 0x830]
sete al
mov dword [esp + 0x14], esi
test al, al
jne 0x49fc55
push ebx
push edi
call fcn.004a0460
mov edi, eax
mov dword [esp + 0x10], 4
test edi, edi
je 0x49fc55
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push edi
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x49fc55
cmp dword [esp + 0x10], 0
je 0x49fc55
mov esi, dword [esp + 0x14]
jmp 0x49fc55
lea eax, [esp + 0x1c]
push eax
call fcn.0049e710
test eax, eax
jne 0x49fc4d
mov esi, dword [esp + 0x830]
jmp 0x49fc55
push eax
call fcn.004919f0
mov esi, eax
mov ecx, dword [esp + 0x81c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x810
ret 0x10
Function at 0x49fc80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x28]
push eax
push ebp
push ebx
push dword [esp + 0x28]
mov dword [esp + 0x38], edi
push esi
push dword [esp + 0x28]
call fcn.0049e520
test al, al
je 0x49fcbc
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
push esi
push dword [esp + 0x18]
call fcn.004a0460
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], edi
test eax, eax
je 0x49fd02
lea ecx, [esp + 0x24]
push ecx
push ebx
lea ecx, [esp + 0x28]
push ecx
push 0
push dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x49fd02
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x49fd27
push edi
test ebp, ebp
je 0x49fd1a
push ebp
push ebx
call fcn.004edb80
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
push 0
push ebx
call fcn.004ee100
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x18

Function at 0x49fd80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x810], eax
mov ecx, dword [esp + 0x820]
lea edx, [esp + 0x10]
mov eax, dword [esp + 0x81c]
push ebx
mov ebx, dword [esp + 0x82c]
push ebp
mov ebp, dword [esp + 0x820]
push esi
mov esi, dword [esp + 0x830]
push edi
push 0x400
push edx
push ecx
push eax
push ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
call fcn.0049eaf0
test al, al
jne 0x49fe7d
mov edi, dword [esp + 0x83c]
push edi
push ebx
push esi
call fcn.0048e710
cmp byte [0x526b91], 0
sete al
test al, al
jne 0x49fe9b
push dword [esp + 0x14]
push ebp
call fcn.004a0460
mov ebp, eax
mov byte [esp + 0x13], 0
test ebp, ebp
je 0x49fe6f
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x24]
push eax
push 0
push dword [esp + 0x28]
lea ecx, [edi + edi]
push ebp
mov dword [esp + 0x2c], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebp
sete byte [esp + 0x17]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x13], 0
je 0x49fe6f
mov eax, dword [esp + 0x14]
shr eax, 1
test edi, edi
jne 0x49fe5c
xor eax, eax
mov word [esi], ax
mov al, byte [esp + 0x13]
jmp 0x49fe9d
dec edi
cmp eax, edi
jb 0x49fe63
mov eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
mov al, byte [esp + 0x13]
jmp 0x49fe9d
push edi
push ebx
push esi
call fcn.0048e710
mov al, byte [esp + 0x13]
jmp 0x49fe9d
lea eax, [esp + 0x20]
push eax
call fcn.0049e710
test eax, eax
je 0x49fe8d
mov ebx, eax
push dword [esp + 0x83c]
push ebx
push esi
call fcn.0048e710
mov al, 1
mov ecx, dword [esp + 0x820]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x814
ret 0x18
Function at 0x49fef0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [esp + 0x414]
lea ecx, [esp + 8]
push ebx
mov ebx, dword [esp + 0x41c]
push esi
mov esi, dword [esp + 0x418]
push edi
push 0x200
push ecx
push eax
push esi
call fcn.004a03e0
test al, al
je 0x49ff83
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x57a054]
or eax, 9
push eax
push 0
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49ff83
mov edi, dword [esp + 0xc]
test edi, edi
je 0x49ff83
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg esi
sbb esi, esi
not esi
and esi, dword [esp + 0x10]
mov eax, esi
jmp 0x49ff85
xor eax, eax
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x40c
ret 0xc
Function at 0x49ffe0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x5b0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x5ac], eax
push ebx
mov ebx, dword [esp + 0x5b8]
push ebp
mov ebp, dword [esp + 0x5c0]
push 0xf
push str.SoftwareWinRAR
push ebp
mov dword [esp + 0x28], ebp
call fcn.00491b00
test eax, eax
je 0x4a0020
xor al, al
jmp 0x4a01e2
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a0019
push edi
push 0x100000
call fcn.004f2e54
mov edi, eax
add esp, 4
test edi, edi
jne 0x4a005d
mov ecx, 0x56df60
call fcn.00462de0
xor al, al
jmp 0x4a01e1
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0x200
push eax
push edi
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x100000
push eax
push 0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1d0]
push eax
push 0
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4a0146
lea eax, [ebp + 0x1e]
xor ebp, ebp
mov dword [esp + 0x20], eax
mov esi, eax
cmp word [esi], 0x5c
jne 0x4a00b0
add esi, 2
mov eax, dword [esp + 0x1c]
cmp eax, 3
jne 0x4a00d1
push dword [esp + 0x18]
lea eax, [esp + 0x1c0]
push edi
push eax
push esi
push ebx
call fcn.0049edf0
mov eax, dword [esp + 0x1c]
cmp eax, 4
jne 0x4a00eb
push dword [edi]
lea eax, [esp + 0x1c0]
push eax
push esi
push ebx
call fcn.0049ed40
mov eax, dword [esp + 0x1c]
cmp eax, 1
jne 0x4a0100
push edi
lea eax, [esp + 0x1c0]
push eax
push esi
push ebx
call fcn.0049ecb0
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0x200
push eax
push edi
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x100000
push eax
push 0
lea eax, [esp + 0x20]
inc ebp
push eax
lea eax, [esp + 0x1d0]
push eax
push ebp
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
mov eax, dword [esp + 0x20]
je 0x4a00a5
mov ebp, dword [esp + 0x24]
push edi
call fcn.004f252e
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x28]
add esp, 4
mov dword [esp + 0x10], 0xc8
xor esi, esi
push eax
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x40]
push eax
push esi
push dword [esp + 0x30]
call edi
test eax, eax
jne 0x4a01cf
lea esp, [esp]
push 0x200
lea eax, [esp + 0x1c0]
push eax
lea eax, [esp + 0x34]
push eax
push ebp
call fcn.004789f0
lea eax, [esp + 0x1bc]
push eax
push ebx
call fcn.0049ffe0
lea eax, [esp + 0x24]
mov dword [esp + 0x10], 0xc8
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
inc esi
push eax
lea eax, [esp + 0x40]
push eax
push esi
push dword [esp + 0x30]
call edi
test eax, eax
je 0x4a0180
mov eax, dword [esp + 0x14]
pop esi
test eax, eax
je 0x4a01df
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop edi
mov ecx, dword [esp + 0x5b4]
pop ebp
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x5b0
ret 8
Function at 0x4a0710
Capabilities:
Set registry value

Disassembly:
sub esp, 0x808
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x804], eax
push ebx
mov ebx, dword [esp + 0x814]
lea eax, [esp + 8]
push ebp
mov ebp, dword [esp + 0x81c]
push esi
mov esi, dword [esp + 0x824]
push edi
mov edi, dword [esp + 0x81c]
push 0x400
push eax
push ebp
push ebx
push edi
call fcn.0049eaf0
test al, al
jne 0x4a07b9
cmp byte [0x526b91], al
sete al
test al, al
jne 0x4a07c6
lea eax, [esp + 0x10]
push eax
push ebx
push edi
call fcn.0049f260
mov edi, eax
test edi, edi
je 0x4a07b1
mov ecx, esi
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a0780
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4a07c8
mov esi, dword [esp + 0x10]
mov eax, esi
jmp 0x4a07c8
push 1
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.0049dcd0
xor eax, eax
mov ecx, dword [esp + 0x814]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x808
ret 0x10
Function at 0x4a0930
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push eax
push esi
mov edi, ecx
mov dword [esp + 0x18], 0
call fcn.004a0c70
test eax, eax
je 0x4a095f
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 8
push ebx
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004a0c70
mov dword [edi + 0x10], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004a0c70
mov dword [edi + 0x18], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004a0c70
mov dword [edi + 0x1c], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004a0c70
mov dword [edi + 0x20], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004a0c70
mov dword [edi + 0x24], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004a0c70
push ebp
mov dword [edi + 0x28], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x100
lea eax, [edi + 0x2c]
push eax
call fcn.004a0cd0
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004a0c70
push ebp
mov dword [edi + 0x12c], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x100
lea eax, [edi + 0x130]
push eax
call fcn.004a0cd0
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004a0c70
mov dword [edi + 0x230], eax
lea eax, [esp + 0x10]
push ebp
push eax
push esi
push 0x100
lea eax, [edi + 0x234]
push eax
mov ecx, edi
call fcn.004a0cd0
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004a0c70
mov dword [edi + 0x334], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004a0c70
mov dword [edi + 0x338], eax
mov ecx, edi
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004a0c70
push ebp
mov dword [edi + 0x33c], eax
mov ecx, edi
lea eax, [esp + 0x14]
push eax
push esi
push 0x20
lea eax, [edi + 0x340]
push eax
call fcn.004a0cd0
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
push 0x100
lea eax, [edi + 0x380]
push eax
call fcn.004a0cd0
mov ecx, dword [esp + 0x10]
xor bl, bl
xor eax, eax
test ecx, ecx
je 0x4a0aba
xor bl, byte [eax + esi]
inc eax
cmp eax, ecx
jb 0x4a0ab2
push ebp
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push esi
call fcn.004a0c70
movzx ecx, bl
xor edx, edx
pop ebx
pop edi
cmp ecx, eax
pop esi
sete al
pop ebp
pop ecx
ret 8

Function at 0x4a0d50
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
xor ecx, ecx
xor esi, esi
jmp 0x4a0d60
xor byte [esi + edi], cl
mov eax, 0xaaaaaaab
mul ecx
add ecx, 3
inc esi
shr edx, 1
add ecx, edx
and ecx, 0xffffff
cmp esi, 0x480
jb 0x4a0d60
pop edi
pop esi
ret