joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b980
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x591178
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
push esi
push edi
mov eax, dword [0x600f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x1690]
cmp dword [eax], 0
jne 0x48b9d8
lea eax, [ebp + 8]
mov dword [ebp + 8], str.A_conexao_nao_foi_preparada_para_que_o_recurso_possa_ser_obtido
push eax
lea ecx, [ebp - 0x1c]
call fcn.0053cef5
push 0x5fa2e8
lea eax, [ebp - 0x1c]
push eax
call fcn.005491a6
push 4
push str.POST
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.004085a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
mov edx, dword [ebp + 8]
call fcn.0042cf60
mov esi, eax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.0042cf60
cmp dword [esi + 0x14], 8
mov ecx, eax
jb 0x48ba26
mov esi, dword [esi]
cmp dword [ecx + 0x14], 8
jb 0x48ba2e
mov ecx, dword [ecx]
mov eax, dword [edi + 0x1690]
push 0x800100
push 0
push 0
push 0
push esi
push ecx
push dword [eax]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
cmp dword [ebp - 0x44], 8
mov esi, eax
jb 0x48ba5c
push dword [ebp - 0x58]
call fcn.0053e195
add esp, 4
xor eax, eax
mov dword [ebp - 0x44], 7
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
jb 0x48ba81
push dword [ebp - 0x40]
call fcn.0053e195
add esp, 4
xor eax, eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
jb 0x48baad
push dword [ebp - 0x28]
call fcn.0053e195
add esp, 4
test esi, esi
jne 0x48bae5
push str.Erro_ao_preparar_requisicao_HTTP
lea ecx, [ebp - 0x70]
call fcn.00407be0
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0xe4]
call fcn.0048b490
push 0x5fa2a8
lea eax, [ebp - 0xe4]
push eax
call fcn.005491a6
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x48d4a0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x15c
lea eax, [ebp - 0x16c]
mov dword [ebp - 0x170], 0
push 0
push eax
mov esi, edx
call fcn.00540250
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x48d4de
mov esi, dword [esi]
push 0x4000
push 0x160
lea eax, [ebp - 0x170]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x48d535
mov esi, dword [ebp - 0x16c]
lea eax, [ebp - 0xc]
push eax
push 0x5d9048
push 1
call dword [sym.imp.SHELL32.dll_SHGetImageList]
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
push edx
push 1
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 8]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
Function at 0x48dba0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0
lea eax, [ebp - 0x18]
mov edi, ecx
push eax
push edx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
jne 0x48dbdc
mov eax, 0xc0000034
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x60
push 1
push 1
push 0x80
lea eax, [ebp - 0x18]
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0xc]
push 0
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], 0
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x24], 0x40
push eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov ecx, dword fs:[0x18]
mov esi, eax
push dword [ebp - 0x14]
push 0
mov ecx, dword [ecx + 0x30]
push dword [ecx + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test esi, esi
js 0x48dc4e
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
Function at 0x48e3d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [ebp + 8]
push esi
push edi
movdqu xmmword [ebp - 0x460], xmm0
push 0x3fc
movdqu xmm0, xmmword [ebp + 0x18]
lea eax, [ebp - 0x404]
mov dword [ebp - 0x41c], edx
push 0
movdqu xmmword [ebp - 0x438], xmm0
push eax
movdqu xmmword [ebp - 0x450], xmm0
mov edi, ecx
mov dword [ebp - 0x40c], 0
movq xmm0, qword [ebp + 0x28]
movq qword [ebp - 0x440], xmm0
mov dword [ebp - 0x408], 0
call fcn.00540250
movdqu xmm0, xmmword [ebp - 0x438]
add esp, 0xc
movd eax, xmm0
mov dword [ebp - 0x414], eax
test eax, eax
je 0x48e609
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test edi, edi
je 0x48e609
cmp edi, 0xffffffff
je 0x48e609
test esi, esi
je 0x48e609
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0x44c]
cmp ecx, eax
ja 0x48e609
push 0
push 0
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x48e609
push 0
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 0x414]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
je 0x48e609
mov ecx, dword [ebp - 0x40c]
dec ecx
mov dword [ebp - 0x40c], ecx
cmp byte [esi + ecx], 0
jne 0x48e505
lea ecx, [ecx]
test ecx, ecx
je 0x48e609
dec ecx
mov dword [ebp - 0x40c], ecx
cmp byte [esi + ecx], 0
je 0x48e4f0
test ecx, ecx
je 0x48e609
xor edx, edx
test ecx, ecx
je 0x48e523
movzx eax, byte [edx + esi]
inc edx
inc dword [ebp + eax*4 - 0x408]
cmp edx, ecx
jb 0x48e513
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0x40c]
xor esi, esi
mov eax, edi
xorps xmm3, xmm3
shr eax, 0x1f
movapd xmm1, xmm3
movsd qword [ebp - 0x418], xmm1
movd xmm2, edi
cvtdq2pd xmm2, xmm2
addsd xmm2, qword [eax*8 + 0x5e6d70]
movsd qword [ebp - 0x430], xmm2
jmp 0x48e570
movd xmm0, dword [ebp + esi*4 - 0x408]
cvtdq2pd xmm0, xmm0
divsd xmm0, xmm2
ucomisd xmm0, xmm3
movsd qword [ebp - 0x428], xmm0
lahf
test ah, 0x44
jnp 0x48e5dc
call fcn.00585940
movsd qword [ebp - 0x410], xmm0
movsd xmm0, qword [0x5e6d30]
call fcn.00585940
movsd xmm1, qword [ebp - 0x410]
xorps xmm3, xmm3
divsd xmm1, xmm0
movsd xmm2, qword [ebp - 0x430]
mulsd xmm1, qword [ebp - 0x428]
addsd xmm1, qword [ebp - 0x418]
movsd qword [ebp - 0x418], xmm1
inc esi
cmp esi, 0x100
jl 0x48e570
mov eax, dword [ebp - 0x41c]
xorpd xmm1, xmmword [0x5e6da0]
movapd xmm0, xmm1
mov dword [eax], edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
pop edi
xor ecx, ebp
pop esi
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
Function at 0x48f120
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 8], 0
test esi, esi
je 0x48f1db
cmp esi, 0xffffffff
je 0x48f1db
lea eax, [ebp - 8]
xor edx, edx
push eax
lea eax, [ebp - 0x48]
push 0x40
push eax
call fcn.0048e730
add esp, 0xc
test eax, eax
jne 0x48f192
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str.ReadFileS:__d
call fcn.0053e0bf
add esp, 8
call esi
test eax, eax
setne al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x140]
mov ecx, esi
push 0xf8
push eax
call fcn.0048e730
add esp, 0xc
test eax, eax
je 0x48f166
mov eax, 0x5a4d
cmp word [ebp - 0x48], ax
jne 0x48f1ca
cmp dword [ebp - 0x140], 0x4550
je 0x48f1db
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0053cd12
mov esp, ebp
pop ebp
ret

Function at 0x48f2e8
Capabilities:
Set registry value

Disassembly:
push 0xf4
mov eax, 0x591464
call fcn.005692da
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0xf4], eax
test eax, eax
jne 0x48f335
test ebx, ebx
je 0x48f335
lea eax, [ebp - 0xf4]
mov dword [ebp - 0xf4], str.Nao_se_pode_escrever_dados_a_partir_de_ponteiro_nulo
push eax
lea ecx, [ebp - 0x1c]
call fcn.0053cef5
push 0x5fa2e8
lea eax, [ebp - 0x1c]
push eax
call fcn.005491a6
cmp dword [edx + 0x14], 0x10
jb 0x48f33d
mov edx, dword [edx]
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0xf8]
push eax
xor eax, eax
push eax
push 0xf003f
push eax
push eax
push eax
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
je 0x48f397
push str.Nao_foi_possivel_abrir_o_registro_para_escrita.
lea ecx, [ebp - 0x28]
call fcn.00407be0
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push ecx
push esi
push eax
lea ecx, [ebp - 0xf0]
call fcn.004958a6
push 0x5fa010
lea eax, [ebp - 0xf0]
jmp 0x48f32f
mov esi, dword [ebp - 0xf8]
mov dword [ebp - 0xfc], esi
xor eax, eax
inc eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x48f3ff
cmp dword [edi + 0x14], 0x10
jb 0x48f3b5
mov edi, dword [edi]
push ebx
push dword [ebp - 0xf4]
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test edi, edi
je 0x48f3ff
push str.Nao_foi_possivel_escrever_no_registro.
lea ecx, [ebp - 0x40]
call fcn.00407be0
push ecx
push edi
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x98]
call fcn.004958a6
push 0x5fa010
lea eax, [ebp - 0x98]
jmp 0x48f32f
test esi, esi
je 0x48f40a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00569289
ret
Function at 0x48f410
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5914b8
mov eax, dword fs:[0]
push eax
sub esp, 0x100
mov eax, dword [0x600f80]
xor eax, esp
mov dword [esp + 0xf8], eax
push ebx
push esi
push edi
mov eax, dword [0x600f80]
xor eax, esp
push eax
lea eax, [esp + 0x110]
mov dword fs:[0], eax
mov esi, edx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x48f48c
test ebx, ebx
je 0x48f48c
lea eax, [esp + 0x10]
mov dword [esp + 0x10], str.Nao_se_pode_escrever_dados_a_partir_de_ponteiro_nulo
push eax
lea ecx, [esp + 0x28]
call fcn.0053cef5
push 0x5fa2e8
lea eax, [esp + 0x28]
push eax
call fcn.005491a6
lea eax, [esp + 0x14]
push eax
push 0x20006
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov dword [esp + 0x10], eax
test eax, eax
je 0x48f4d8
push str.Nao_foi_possivel_abrir_current_user
lea ecx, [esp + 0x28]
call fcn.00407be0
and dword [esp + 0x118], 0
lea eax, [esp + 0x24]
push ecx
push dword [esp + 0x14]
lea ecx, [esp + 0x5c]
push eax
call fcn.004958a6
push 0x5fa010
lea eax, [esp + 0x58]
jmp 0x48f486
cmp dword [esi + 0x14], 0x10
jb 0x48f4e0
mov esi, dword [esi]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
xor eax, eax
push eax
push 0x20006
push eax
push eax
push eax
push esi
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
je 0x48f547
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Nao_foi_possivel_abrir_o_registro_para_escrita.
lea ecx, [esp + 0x28]
call fcn.00407be0
push ecx
push esi
lea eax, [esp + 0x2c]
mov dword [esp + 0x120], 1
push eax
lea ecx, [esp + 0x60]
call fcn.004958a6
push 0x5fa010
lea eax, [esp + 0x58]
jmp 0x48f486
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], esi
mov dword [esp + 0x118], 2
test ebx, ebx
je 0x48f5c1
cmp dword [edi + 0x14], 0x10
jb 0x48f566
mov edi, dword [edi]
push ebx
push dword [esp + 0x20]
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test edi, edi
je 0x48f5c1
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Nao_foi_possivel_escrever_no_registro.
lea ecx, [esp + 0x40]
call fcn.00407be0
push ecx
push edi
lea eax, [esp + 0x44]
mov byte [esp + 0x120], 3
push eax
lea ecx, [esp + 0xb8]
call fcn.004958a6
push 0x5fa010
lea eax, [esp + 0xb0]
jmp 0x48f486
push dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
test esi, esi
je 0x48f5d4
push esi
call edi
mov ecx, dword [esp + 0x110]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf8]
xor ecx, esp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
Function at 0x48f5f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x59151d
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x600f80]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
push esi
push edi
mov eax, dword [0x600f80]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov esi, edx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
push eax
push 0x20006
mov dword [esp + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov ebx, eax
test ebx, ebx
je 0x48f69e
push str.Nao_foi_possivel_abrir_current_user
lea ecx, [esp + 0x30]
call fcn.00407be0
and dword [esp + 0x120], 0
lea eax, [esp + 0x2c]
push ecx
push ebx
push eax
lea ecx, [esp + 0x68]
call fcn.004958a6
push 0x5fa010
lea eax, [esp + 0x60]
push eax
call fcn.005491a6
cmp dword [esi + 0x14], 0x10
jb 0x48f6a6
mov esi, dword [esi]
lea eax, [esp + 0x20]
xor ebx, ebx
push eax
inc ebx
push ebx
push 0
push esi
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
je 0x48f6f2
push str.Nao_foi_possivel_abrir_o_registro_para_leitura.
lea ecx, [esp + 0x30]
call fcn.00407be0
push ecx
push esi
lea eax, [esp + 0x34]
mov dword [esp + 0x128], ebx
push eax
lea ecx, [esp + 0x68]
call fcn.004958a6
push 0x5fa010
lea eax, [esp + 0x60]
jmp 0x48f698
mov esi, dword [esp + 0x20]
mov dword [esp + 0x28], esi
mov dword [esp + 0x120], 2
cmp dword [edi + 0x14], 0x10
jb 0x48f70f
mov eax, dword [edi]
jmp 0x48f711
mov eax, edi
push dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
push 0
push ecx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
test ebx, ebx
je 0x48f769
cmp ebx, 2
je 0x48f7e5
push str.Nao_foi_possivel_ler_o_tamanho_do_registro.
lea ecx, [esp + 0x30]
call fcn.00407be0
push ecx
push ebx
lea eax, [esp + 0x34]
mov byte [esp + 0x128], 3
push eax
lea ecx, [esp + 0x68]
call fcn.004958a6
push 0x5fa010
lea eax, [esp + 0x60]
jmp 0x48f698
mov ebx, dword [esp + 0x1c]
push dword [ebx]
call fcn.0053eb1f
mov edx, dword [esp + 0x18]
mov ecx, dword [edx]
push ecx
mov dword [edx], eax
call fcn.0053e16e
cmp dword [edi + 0x14], 0x10
mov eax, dword [esp + 0x1c]
pop ecx
pop ecx
jb 0x48f790
mov edi, dword [edi]
push ebx
push dword [eax]
lea eax, [esp + 0x20]
push eax
push 0
push edi
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
je 0x48f7e5
push str.Nao_foi_possivel_ler_o_registro.
lea ecx, [esp + 0x48]
call fcn.00407be0
push ecx
push edi
lea eax, [esp + 0x4c]
mov byte [esp + 0x128], 4
push eax
lea ecx, [esp + 0xc0]
call fcn.004958a6
push 0x5fa010
lea eax, [esp + 0xb8]
jmp 0x48f698
test esi, esi
je 0x48f7f0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
Function at 0x48f814
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xf8
mov eax, 0x59156e
call fcn.005692da
mov esi, edx
mov dword [ebp - 0xf8], ecx
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov edi, dword [ebp + 8]
inc ebx
cmp byte [ebp + 0x18], 0
mov dword [ebp - 0x104], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xfc], eax
je 0x48f85e
call fcn.00425c8b
mov ecx, 0x101
test al, al
cmovne ebx, ecx
mov ecx, dword [ebp - 0xf8]
cmp dword [esi + 0x14], 0x10
jb 0x48f866
mov esi, dword [esi]
lea eax, [ebp - 0x100]
push eax
push ebx
xor ebx, ebx
push ebx
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
je 0x48f8b1
push str.Nao_foi_possivel_abrir_o_registro_para_leitura.
lea ecx, [ebp - 0x2c]
call fcn.00407be0
push ecx
mov dword [ebp - 4], ebx
push esi
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x9c]
call fcn.004958a6
push 0x5fa010
lea eax, [ebp - 0x9c]
push eax
call fcn.005491a6
mov esi, dword [ebp - 0x100]
mov dword [ebp - 0xf8], esi
mov dword [ebp - 4], 1
cmp dword [edi + 0x14], 0x10
jb 0x48f8ce
mov eax, dword [edi]
jmp 0x48f8d0
mov eax, edi
push dword [ebp - 0xfc]
lea ecx, [ebp + 0xc]
push ebx
push ecx
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
test ebx, ebx
je 0x48f908
cmp ebx, 2
je 0x48f983
push str.Nao_foi_possivel_ler_o_tamanho_do_registro.
lea ecx, [ebp - 0x2c]
call fcn.00407be0
push ecx
mov byte [ebp - 4], 2
push ebx
jmp 0x48f891
mov ebx, dword [ebp - 0xfc]
push dword [ebx]
call fcn.0053eb1f
mov edx, dword [ebp - 0x104]
mov ecx, dword [edx]
push ecx
mov dword [edx], eax
call fcn.0053e16e
cmp dword [edi + 0x14], 0x10
pop ecx
pop ecx
jb 0x48f92f
mov edi, dword [edi]
mov eax, dword [ebp - 0x104]
push ebx
push dword [eax]
lea eax, [ebp + 0xc]
push eax
push 0
push edi
push dword [ebp - 0x100]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
je 0x48f983
push str.Nao_foi_possivel_ler_o_registro.
lea ecx, [ebp - 0x44]
call fcn.00407be0
push ecx
push edi
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0xf4]
call fcn.004958a6
push 0x5fa010
lea eax, [ebp - 0xf4]
jmp 0x48f8ab
test esi, esi
je 0x48f98e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00569289
ret
Function at 0x48fae5
Capabilities:
Delete registry key

Disassembly:
push 0xec
mov eax, 0x59161a
call fcn.005692da
mov edi, ecx
mov esi, 0x20007
call fcn.00425c8b
test al, al
mov ecx, 0x20107
lea eax, [ebp - 0xf4]
cmovne esi, ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov esi, eax
test esi, esi
je 0x48fb5d
push dword [ebp - 0xf4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Nao_foi_possivel_abrir_o_registro_para_leitura.
lea ecx, [ebp - 0x28]
call fcn.00407be0
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push ecx
push esi
push eax
lea ecx, [ebp - 0x98]
call fcn.004958a6
push 0x5fa010
lea eax, [ebp - 0x98]
push eax
call fcn.005491a6
mov esi, dword [ebp - 0xf4]
mov dword [ebp - 0xf8], esi
mov dword [ebp - 4], 1
cmp dword [edi + 0x14], 0x10
jb 0x48fb78
mov edi, dword [edi]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 0xf4]
mov edi, eax
test edi, edi
je 0x48fbc1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Nao_foi_possivel_apagar_chave_do_registro.
lea ecx, [ebp - 0x40]
call fcn.00407be0
push ecx
push edi
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0xf0]
call fcn.004958a6
push 0x5fa010
lea eax, [ebp - 0xf0]
jmp 0x48fb57
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
test esi, esi
je 0x48fbd0
push esi
call edi
call fcn.00569289
ret

Function at 0x48fbd6
Capabilities:
Delete registry value

Disassembly:
push 0xf0
mov eax, 0x591665
call fcn.005692da
mov edi, edx
mov esi, ecx
mov ebx, 0xf003f
call fcn.00425c8b
test al, al
mov ecx, 0xf013f
lea eax, [ebp - 0xf8]
cmovne ebx, ecx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov dword [ebp - 0xf4], eax
test eax, eax
je 0x48fc4d
push str.Nao_foi_possivel_abrir_a_chave__HKEY_CURRENT_USER__para_leitura.
lea ecx, [ebp - 0x28]
call fcn.00407be0
and dword [ebp - 4], 0
push ecx
push dword [ebp - 0xf4]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x98]
call fcn.004958a6
push 0x5fa010
lea eax, [ebp - 0x98]
push eax
call fcn.005491a6
cmp dword [esi + 0x14], 0x10
jb 0x48fc55
mov esi, dword [esi]
lea eax, [ebp - 0xfc]
push eax
push ebx
push 0
push esi
push dword [ebp - 0xf8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
je 0x48fc8a
push str.Nao_foi_possivel_abrir_o_registro_para_leitura.
lea ecx, [ebp - 0x28]
call fcn.00407be0
push ecx
mov dword [ebp - 4], 1
push esi
jmp 0x48fc2d
mov esi, dword [ebp - 0xfc]
mov dword [ebp - 0xf4], esi
mov dword [ebp - 4], 2
cmp dword [edi + 0x14], 0x10
jb 0x48fca5
mov edi, dword [edi]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, eax
test edi, edi
je 0x48fce5
push str.Nao_foi_possivel_apagar_valor_do_registro.
lea ecx, [ebp - 0x40]
call fcn.00407be0
push ecx
push edi
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0xf0]
call fcn.004958a6
push 0x5fa010
lea eax, [ebp - 0xf0]
jmp 0x48fc47
test esi, esi
je 0x48fcf0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00569289
ret
Function at 0x48fd34
Capabilities:
Encode data using xor

Disassembly:
push 0xec
mov eax, 0x5916ae
call fcn.00569346
mov esi, ecx
mov dword [ebp - 0xe8], esi
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xe4], esi
push eax
call fcn.00490009
and dword [ebp - 4], 0
lea eax, [ebp - 0x98]
push 0x80
push 0
push eax
call fcn.00540250
add esp, 0xc
mov byte [ebp - 4], 1
lea eax, [ebp - 0xe0]
push eax
call fcn.0043f790
mov edi, eax
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 2
push eax
call fcn.0043f560
push ecx
push edi
push eax
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 3
call fcn.0048f994
add esp, 0xc
lea ecx, [ebp - 0xc8]
call fcn.00407cb0
lea ecx, [ebp - 0xe0]
call fcn.00407cb0
push 0x19
lea edi, [ebp - 0x7f]
pop ebx
push 0x42
pop ecx
xor edx, edx
mov dword [ebp - 0xe4], ecx
mov eax, dword [ebp - 0xf4]
shl edx, 8
push 0x18
mov esi, dword [ebp - 0xf4]
movzx eax, byte [eax + ecx]
xor eax, edx
pop ecx
cdq
idiv ecx
mov ecx, dword [ebp - 0xe4]
mov byte [esi + ecx], al
dec ecx
mov esi, dword [ebp - 0xe8]
mov dword [ebp - 0xe4], ecx
cmp ecx, 0x34
jge 0x48fdd5
dec edi
lea eax, [ebp - 0xb0]
cmp dword [ebp - 0x9c], 0x10
cmovae eax, dword [ebp - 0xb0]
mov al, byte [eax + edx]
mov byte [edi], al
dec ebx
jne 0x48fdca
lea ecx, [ebp - 0xf4]
call fcn.0040b940
jmp 0x48fe41
lea eax, [ebp - 0x98]
push eax
push 0x104
push esi
call fcn.0054630a
add esp, 0xc
lea ecx, [ebp - 0xb0]
call fcn.00407cb0
call fcn.00569298
ret