joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49fbc4
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x57c074]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x519526
call fcn.004da733
mov eax, dword [ebp + 0x214]
mov ebx, 0x104
mov esi, dword [ebp + 0x21c]
mov edi, dword [ebp + 0x218]
mov dword [ebp - 0x10], eax
lea eax, [ebp]
push eax
push ebx
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x49fc1b
xor al, al
jmp 0x49fced
mov edx, dword [edi]
xor ecx, ecx
inc ecx
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, ebx
or eax, ecx
jge 0x49fc36
push ebx
mov ecx, edi
call fcn.0040d80a
mov edx, dword [edi]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
push edx
push ebx
push dword [eax]
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x49fc14
push 0xffffffffffffffff
mov ecx, edi
call fcn.00410dd4
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x2e
push dword [edi]
call fcn.004dde17
pop ecx
pop ecx
test eax, eax
je 0x49fcd5
sub eax, dword [edi]
sar eax, 1
js 0x49fcd5
inc eax
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00406df5
mov dword [ebp - 4], ebx
mov edx, dword [eax]
mov ecx, dword [edi]
sub ecx, 0x10
mov dword [ebp - 0x14], ecx
lea eax, [edx - 0x10]
mov dword [ebp - 0x10], eax
cmp eax, ecx
je 0x49fcc9
cmp dword [ecx + 0xc], ebx
jl 0x49fcbe
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x49fcbe
mov ecx, dword [ebp - 0x10]
call fcn.00407162
mov ecx, dword [ebp - 0x14]
mov esi, eax
call fcn.0040d743
lea eax, [esi + 0x10]
mov esi, dword [ebp - 0x18]
mov dword [edi], eax
jmp 0x49fcc9
push dword [edx - 0xc]
mov ecx, edi
push edx
call fcn.0040d9ac
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040d22d
test esi, esi
je 0x49fce2
push esi
call fcn.004dfc45
pop ecx
mov ebx, eax
push ebx
push esi
mov ecx, edi
call fcn.0041107c
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.004d9b30
lea esp, [ebp + 0x20c]
pop ebp
ret 0xc
Function at 0x49fd12
Capabilities:
Write file on windows

Disassembly:
push 0xc
mov eax, 0x519556
call fcn.004da733
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push ebx
push 0x40000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x18], 0x532e68
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
cmp esi, 0xffffffff
jne 0x49fd52
or esi, eax
jmp 0x49fd90
push ebx
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], 0xfeff
push eax
push 2
lea eax, [ebp - 0x10]
mov dword [ebp + 0xc], ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49fd90
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push ebx
push edx
mov ecx, dword [eax]
mov eax, dword [ecx - 0xc]
add eax, eax
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49fd90
mov bl, 1
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0x532e68
test esi, esi
je 0x49fdaa
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x14], 0
mov al, bl
call fcn.004da6fc
ret 8

Function at 0x49fdb4
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x10
mov eax, 0x519581
call fcn.004da733
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x1c], 0x532e68
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], ebx
cmp edi, 0xffffffff
je 0x49fe6d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x49fe6b
xor esi, esi
mov dword [ebp + 8], esi
push ebx
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00494578
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp + 8]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49fe5a
mov edx, dword [ebp - 0x10]
mov ecx, esi
call fcn.004d4ea0
cmp eax, 4
jne 0x49fe46
lea eax, [ebx - 2]
shr eax, 1
push eax
lea eax, [esi + 2]
push eax
jmp 0x49fe4f
cmp eax, 5
jne 0x49fe5a
shr ebx, 1
push ebx
push esi
mov ecx, dword [ebp - 0x14]
add ecx, 4
call fcn.0040d9ac
xor ebx, ebx
push esi
mov byte [ebp - 4], bl
call fcn.004da275
pop ecx
mov dword [ebp + 8], ebx
jmp 0x49fe6d
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x532e68
test edi, edi
je 0x49fe86
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], ebx
call fcn.004da6fc
ret 4
Function at 0x49fe8e
Capabilities:
Read file on windows

Disassembly:
push 0xc
mov eax, 0x519556
call fcn.004da733
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x18], 0x532e68
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
cmp esi, 0xffffffff
jne 0x49fed4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
or esi, esi
jmp 0x49fef5
push ebx
lea eax, [ebp - 0x10]
push eax
push 4
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x49fef3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x49fef5
mov edi, ebx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0x532e68
test esi, esi
je 0x49ff0e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], ebx
mov eax, edi
call fcn.004da6fc
ret 4

Function at 0x49ff18
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x5195ac
call fcn.004da733
mov ebx, ecx
lea ecx, [ebp - 0x14]
call fcn.0040cf67
and dword [ebp - 4], 0
mov edi, 0x100
push 0x200
call fcn.004da27a
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [ebx + 4]
push edi
push esi
push dword [ebp - 0x14]
push dword [eax]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 0xff
jne 0x49ffba
push esi
add edi, edi
mov byte [ebp - 4], 0
call fcn.004da275
and dword [ebp - 0x10], 0
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004da27a
pop ecx
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [ebx + 4]
push edi
push esi
push dword [ebp - 0x14]
push dword [eax]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [edi - 1]
cmp eax, ecx
je 0x49ff6a
test esi, esi
jne 0x49ffc2
xor eax, eax
jmp 0x49ffc9
push esi
call fcn.004dfc45
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push esi
call fcn.0040d9ac
push esi
mov byte [ebp - 4], 0
call fcn.004da275
and dword [ebp - 0x10], 0
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x14]
call fcn.0040d22d
call fcn.004da6fc
ret 0xc
Function at 0x49fff6
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x5195d7
call fcn.004da733
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 0x200
mov esi, 0x100
call fcn.004da27a
mov edi, eax
pop ecx
mov dword [ebp - 0x14], edi
and dword [ebp - 4], 0
push dword [ebx + 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov ebx, eax
cmp ebx, 0xfe
jne 0x4a007d
or dword [ebp - 4], 0xffffffff
add esi, esi
push edi
call fcn.004da275
and dword [ebp - 0x14], 0
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004da27a
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 0x14], edi
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov ebx, eax
lea eax, [esi - 2]
cmp ebx, eax
je 0x4a0035
mov ecx, dword [ebp + 8]
call fcn.00456e1f
lea ecx, [ebp - 0x10]
call fcn.0040cf67
mov byte [ebp - 4], 1
xor esi, esi
movzx eax, word [edi + esi*2]
test ax, ax
je 0x4a00a7
push eax
lea ecx, [ebp - 0x10]
call fcn.004769b0
jmp 0x4a00c4
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x4a00bc
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004701a0
lea ecx, [ebp - 0x10]
call fcn.0040d70e
inc esi
cmp esi, ebx
jbe 0x4a0093
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.0040d22d
or dword [ebp - 4], 0xffffffff
push edi
call fcn.004da275
and dword [ebp - 0x14], 0
pop ecx
call fcn.004da6fc
ret 4

Function at 0x4a01e3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51693c
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x57c074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x20]
mov dword [esi], 0x543860
cmp dword [eax - 0xc], 0
je 0x4a021f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi + 0x34]
call fcn.0040d22d
lea ecx, [esi + 0x30]
call fcn.0040d22d
lea ecx, [esi + 0x28]
call fcn.0040d22d
lea ecx, [esi + 0x24]
call fcn.0040d22d
lea ecx, [esi + 0x20]
call fcn.0040d22d
lea ecx, [esi + 8]
call fcn.0040d22d
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a033c
Capabilities:
Copy file

Disassembly:
push ebp
sub esp, 0x9c
lea ebp, [esp - 4]
mov eax, dword [0x57c074]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push 0xc
mov eax, 0x5196aa
call fcn.004da733
mov esi, ecx
push 0x54354c
lea ecx, [ebp - 0x10]
call fcn.0040da2c
and dword [ebp - 4], 0
lea edx, [esi + 0x20]
lea ecx, [ebp - 0x10]
call fcn.00479510
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040d22d
lea ebx, [esi + 8]
mov edx, ebx
lea ecx, [ebp - 0x14]
call fcn.00498486
mov dword [ebp - 4], 1
lea edi, [esi + 0x20]
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x4a03c3
push 0
push dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
jmp 0x4a0481
push 0x57ce30
push esi
lea ecx, [ebp]
call fcn.0049cb24
push edi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.0049d215
mov ecx, dword [esi + 4]
mov edi, eax
mov cl, byte [ecx + 0x39]
test cl, cl
je 0x4a03f2
xor bl, bl
jmp 0x4a0475
test edi, edi
je 0x4a0472
cmp byte [0x57f5ec], 0
je 0x4a0470
push ecx
mov edx, edi
lea ecx, [ebp - 0x18]
call fcn.00476460
pop ecx
mov esi, eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0040cf67
mov ebx, str.Downloading_of_updates_failed._Error:
mov byte [ebp - 4], 4
mov esi, dword [esi]
push ebx
call fcn.004dfc45
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x10]
call fcn.0041107c
test esi, esi
je 0x4a044a
push esi
call fcn.004dfc45
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.0041107c
lea eax, [ebp - 0x10]
mov ecx, 0x57f5b8
push eax
call fcn.004a12ac
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.0040d22d
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.0040d22d
test edi, edi
sete bl
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.0048c5eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040d22d
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.004d9b30
lea esp, [ebp + 0xa0]
pop ebp
ret
Function at 0x4a13dc
Capabilities:
Write file on windows

Disassembly:
push 0x214
mov eax, 0x51992b
call fcn.004da767
mov esi, ecx
cmp dword [esi + 0x30], 0
jne 0x4a1564
lea edi, [esi + 0x24]
xor ebx, ebx
mov eax, dword [edi]
cmp dword [eax - 0xc], ebx
jne 0x4a1494
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4a143d
add eax, eax
cmp eax, 0x208
jae 0x4a156a
xor ecx, ecx
lea ebx, [ebp - 0x218]
mov word [ebp + eax - 0x218], cx
jmp 0x4a1442
mov ebx, str.Logger
push ebx
call fcn.004dfc45
pop ecx
push eax
push ebx
mov ecx, edi
call fcn.0040d9ac
push 0x2e
push dword [edi]
call fcn.004dde17
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x4a147b
mov eax, dword [edi]
sub ecx, eax
sar ecx, 1
test ecx, ecx
jle 0x4a147b
mov eax, dword [eax - 0xc]
sub eax, ecx
push eax
push ecx
mov ecx, edi
call fcn.00473770
mov ebx, str..log
push ebx
call fcn.004dfc45
pop ecx
push eax
push ebx
mov ecx, edi
call fcn.0041107c
mov eax, dword [edi]
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea edi, [esi + 0x2c]
push eax
mov ecx, edi
call fcn.0040e16d
cmp dword [esi + 0x30], 0xffffffff
je 0x4a155c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4a14e6
cmp dword [esi + 0x30], 0
je 0x4a1564
push 2
push ebx
push ebx
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4a1524
test eax, eax
jne 0x4a155c
cmp dword [esi + 0x30], eax
je 0x4a155c
push 2
pop ecx
push ebx
lea eax, [ebp - 0x220]
mov dword [ebp - 0x21c], 0xfeff
push eax
push ecx
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x220], ecx
push eax
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [esi + 0x30], 0
je 0x4a1564
lea eax, [esi + 0x28]
mov ecx, esi
push eax
call fcn.004a1570
lea ecx, [ebp - 0x21c]
call fcn.004a159f
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.004a1570
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.0040d22d
jmp 0x4a1564
push ebx
mov ecx, edi
call fcn.0040e16d
call fcn.004da711
ret
call fcn.004da3a6
int3

Function at 0x4a1570
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
mov esi, ecx
mov edx, dword [eax]
lea eax, [ebp + 8]
push eax
mov eax, dword [edx - 0xc]
add eax, eax
push eax
push edx
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop esi
pop ebp
ret 4
Function at 0x4a270c
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
sub esp, 0x190
lea ebp, [esp - 4]
mov eax, dword [0x57c074]
xor eax, ebp
mov dword [ebp + 0x190], eax
push 0x10
mov eax, 0x519b82
call fcn.004da733
mov dword [ebp - 0x1c], edx
mov esi, ecx
xor ebx, ebx
lea eax, [ebp - 0x14]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4a2760
xor al, al
jmp 0x4a28a3
mov edi, dword [esi]
mov eax, dword [edi - 0xc]
cmp eax, 0x4f
jle 0x4a2773
lea edi, [edi + eax*2]
add edi, 0xffffff62
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0xc8
push eax
lea eax, [ebp]
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
jne 0x4a27a1
cmp dword [ebp - 0x18], 0xc8
jbe 0x4a2895
lea ecx, [ebp - 0x10]
call fcn.0040cf67
mov eax, dword [ebp - 0x1c]
and dword [ebp - 4], 0
push 0x20
pop ebx
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x4a27ff
push 0
mov ecx, esi
call fcn.004738e0
push 0x22
pop ecx
cmp ax, cx
je 0x4a27ff
push 0
push ebx
mov ecx, esi
call fcn.00476930
cmp eax, 0xffffffff
je 0x4a27ff
push 0x22
lea ecx, [ebp - 0x10]
call fcn.004769b0
mov eax, dword [esi]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.0041107c
push 0x22
lea ecx, [ebp - 0x10]
call fcn.004769b0
jmp 0x4a283f
mov edx, dword [esi]
mov ebx, dword [ebp - 0x10]
add ebx, 0xfffffff0
lea ecx, [edx - 0x10]
cmp ecx, ebx
je 0x4a283c
cmp dword [ebx + 0xc], 0
jl 0x4a2830
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x4a2830
call fcn.00407162
mov ecx, ebx
mov esi, eax
call fcn.0040d743
lea eax, [esi + 0x10]
mov dword [ebp - 0x10], eax
jmp 0x4a283c
push dword [edx - 0xc]
lea ecx, [ebp - 0x10]
push edx
call fcn.0040d9ac
push 0x20
pop ebx
mov esi, dword [ebp - 0x1c]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x4a2861
push 0
mov ecx, esi
call fcn.004738e0
cmp ax, bx
je 0x4a2861
push ebx
lea ecx, [ebp - 0x10]
call fcn.004769b0
mov eax, dword [esi]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.0041107c
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push 0
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0040d22d
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
call fcn.004d9b30
lea esp, [ebp + 0x194]
pop ebp
ret
Function at 0x4a2998
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push esi
push edi
push eax
push 0xf003f
xor esi, esi
mov edi, ecx
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4a29c6
xor al, al
jmp 0x4a2a1c
mov edi, dword [edi]
mov eax, dword [edi - 0xc]
cmp eax, 0x4f
jle 0x4a29d9
lea edi, [edi + eax*2]
add edi, 0xffffff62
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x4a2a02
cmp esi, 0xea
jne 0x4a2a0e
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a2a90
Capabilities:
Reference sql statements

Disassembly:
push 0xc
mov eax, 0x519c21
call fcn.004da733
mov edi, ecx
cmp dword [edi], 0
jne 0x4a2aaa
xor al, al
jmp 0x4a2b67
lea ecx, [ebp - 0x18]
call fcn.0040cf67
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [eax]
lea eax, [ebp - 0x18]
push str.SELECT__Value__FROM__Property__WHERE__Property____s
push eax
call fcn.0041186f
add esp, 0xc
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
mov esi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
cmp dword [ebp - 0x10], ebx
je 0x4a2ae4
push dword [ebp - 0x10]
call esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push dword [ebp - 0x18]
push dword [edi]
call dword [sym.imp.msi.dll_MsiEnumClientsA]
test eax, eax
jne 0x4a2b4a
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x4a2b4a
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], eax
je 0x4a2b19
push dword [ebp - 0x14]
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jne 0x4a2b3b
push dword [ebp + 0xc]
push ecx
push dword [ebp - 0x14]
call fcn.004a2c9a
mov bl, al
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 0
je 0x4a2b4a
push dword [ebp - 0x14]
call esi
mov byte [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x4a2b59
push dword [ebp - 0x10]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040d22d
mov al, bl
call fcn.004da6fc
ret 8
Function at 0x4a2fe6
Capabilities:
Create pipe

Disassembly:
push 4
mov eax, 0x516a39
call fcn.004da733
mov edi, ecx
cmp byte [edi], 0
je 0x4a3000
mov al, 1
jmp 0x4a30b7
mov al, byte [ebp + 8]
lea ecx, [edi + 4]
mov byte [edi + 1], al
mov eax, dword [ebp + 0xc]
mov ebx, dword [ecx]
sub ebx, 0x10
mov edx, dword [eax]
lea esi, [edx - 0x10]
cmp esi, ebx
je 0x4a3047
cmp dword [ebx + 0xc], 0
jl 0x4a303e
mov eax, dword [esi]
cmp eax, dword [ebx]
jne 0x4a303e
mov ecx, esi
call fcn.00407162
mov ecx, ebx
mov esi, eax
call fcn.0040d743
lea eax, [esi + 0x10]
mov dword [edi + 4], eax
jmp 0x4a3047
push dword [edx - 0xc]
push edx
call fcn.0040d9ac
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.004a34a7
xor ecx, ecx
mov dword [ebp - 4], ecx
mov al, byte [edi + 1]
test al, al
je 0x4a3089
push ecx
push 0x1388
mov eax, 0x7f90
push eax
push eax
push 0xff
push 6
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [edi + 8], eax
xor ecx, ecx
mov al, byte [edi + 1]
test al, al
jne 0x4a30a0
push ecx
push ecx
push 3
push ecx
push ecx
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 8], eax
cmp dword [edi + 8], 0xffffffff
lea ecx, [ebp + 8]
setne bl
or dword [ebp - 4], 0xffffffff
mov byte [edi], bl
call fcn.0040d22d
mov al, bl
call fcn.004da6fc
ret 8

Function at 0x4a339d
Capabilities:
Connect pipe
Read file on windows

Disassembly:
push 4
mov eax, 0x515de4
call fcn.004da733
mov esi, ecx
cmp byte [ebp + 0x10], 0
jne 0x4a33d3
push 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x4a33d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x4a33d3
cmp byte [esi + 0x11], 0
je 0x4a3425
push 0
lea eax, [ebp + 0x10]
push eax
push 0x7f90
push dword [esi + 0xc]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x10]
xor edi, edi
mov edx, dword [esi + 0xc]
shr ecx, 1
mov word [edx + ecx*2], di
test eax, eax
je 0x4a3425
cmp dword [ebp + 0x10], edi
je 0x4a3425
push dword [esi + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040da2c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
and dword [ebp - 4], edi
push eax
call fcn.004071bb
lea ecx, [ebp - 0x10]
call fcn.0040d22d
jmp 0x4a342d
mov ecx, dword [ebp + 8]
call fcn.0040cf67
mov eax, dword [ebp + 8]
call fcn.004da6fc
ret 0xc

Function at 0x4a3438
Capabilities:
Write file on windows

Disassembly:
push 4
mov eax, 0x50196c
call fcn.004da733
mov esi, ecx
xor ebx, ebx
cmp dword [ebp + 0xc], 0xffffffff
mov dword [ebp - 0x10], ebx
jne 0x4a345b
mov ecx, dword [ebp + 8]
call fcn.0040cf67
jmp 0x4a3492
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x10]
push ebx
push edx
mov ecx, dword [eax]
mov eax, dword [ecx - 0xc]
add eax, eax
push eax
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4a3483
mov ecx, dword [ebp + 8]
call fcn.0040cf67
jmp 0x4a3492
push 1
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.004a339d
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 8]
call fcn.004da6fc
ret 0xc