joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45af10
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5b2178
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push edi
mov esi, ecx
mov al, byte [esp + 0x30]
mov dword [esp + 0x24], 0
test al, al
jne 0x45afa7
mov eax, dword [esp + 0x2c]
push 0
push 0x8000080
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x45af84
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], eax
call fcn.0058df3f
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 0xc
mov edx, dword [esi + 0x2c0]
mov eax, dword [esi + 0x2bc]
lea ecx, [esp + 0xc]
push 0
push ecx
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x2c4]
test eax, eax
je 0x45afc4
push eax
call fcn.005923bb
add esp, 4
mov dword [esi + 0x2c4], 0
mov ecx, dword [esp + 0x34]
lea edi, [esi + 0x2cc]
push ecx
lea ebp, [esi + 0x2c8]
push edi
push ebp
push ecx
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x40], esp
push edx
call fcn.0058dcb4
call fcn.0046d7d0
add esp, 0x10
mov dword [esi + 0x2c4], eax
test eax, eax
jne 0x45b021
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call fcn.0058df3f
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 0xc
mov ecx, dword [edi]
mov edx, dword [ebp]
push ecx
push edx
push eax
call fcn.0046e2a0
mov eax, dword [edi]
mov edx, dword [esi + 0x2c4]
push eax
mov eax, dword [ebp]
lea ecx, [eax + eax*2]
push ecx
push edx
call fcn.0046e190
add esp, 0x18
lea ecx, [esp + 0x14]
call fcn.004088e0
mov eax, dword [edi]
mov ecx, dword [ebp]
mov edx, dword [esi + 0x2c4]
push eax
push ecx
lea eax, [esp + 0x38]
push edx
push eax
mov byte [esp + 0x34], 1
call fcn.0048a380
mov ecx, esp
mov dword [esp + 0x20], esp
push str.filePhoneAssit_TempContactEdit.bmp
push eax
push ecx
mov byte [esp + 0x40], 2
call fcn.0058e1d4
lea ecx, [esp + 0x24]
call fcn.00409240
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 1
call fcn.0058df3f
mov eax, dword [esi + 0x2c4]
test eax, eax
je 0x45b0b8
push eax
call fcn.005923bb
add esp, 4
mov dword [esi + 0x2c4], 0
mov edx, dword [esp + 0x14]
push 0x6193e4
push edx
call fcn.00568a52
add esp, 8
test eax, eax
je 0x45b119
mov al, byte [esp + 0x34]
test al, al
je 0x45b119
mov eax, dword [esp + 0x14]
push 0
push 0x10
push eax
call fcn.00599231
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 0
call fcn.0058df3f
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call fcn.0058df3f
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 0xc
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 0
call fcn.0058df3f
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call fcn.0058df3f
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebp
add esp, 0x1c
ret 0xc
Function at 0x45bd01
Capabilities:
Create process on windows

Disassembly:
push ecx
push esi
mov esi, ecx
push 2
push 0xffffffffffffffff
mov eax, dword [esi + 0x244c]
push 0x100c
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x45bd51
push 1
lea ecx, [esp + 8]
push eax
push ecx
lea ecx, [esi + 0x2430]
call fcn.00589ec4
mov edx, dword [eax]
push 1
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 4]
call fcn.0058df3f
pop esi
pop ecx
ret
Function at 0x46f180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b4c2f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x63b4a0]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
movsx edx, word [esp + 0x20]
push edx
lea eax, [esp + 8]
push 0x61e85c
push eax
push 8
push 2
push 0xd
push ecx
mov dword [esp + 0x30], 1
call fcn.005a53ac
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.0058dcb4
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.0058df3f
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x470e10
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5b4f50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x114]
mov esi, dword [esp + 0x228]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [esi - 8]
lea edi, [esp + 0x114]
mov eax, ecx
mov edx, dword [esp + 0x224]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x21c], 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 8]
push ecx
push 0xf003f
push 0
push edx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x120]
push 0
push eax
push ecx
mov dword [esp + 0x24], 0xff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x61e9a0
mov ecx, 0x651b74
call fcn.00588181
pop edi
pop esi
test eax, eax
jl 0x470eec
push 0x61e9a0
jmp 0x470ef3
mov edx, dword [0x651b74]
push edx
mov ecx, dword [esp + 0x228]
lea eax, [esp + 0x10]
push eax
push str._s_s.lnk
push ecx
call fcn.00569261
add esp, 0x10
lea ecx, [esp + 0x21c]
mov byte [esp + 0x214], 0
call fcn.0058df3f
lea ecx, [esp + 0x220]
mov dword [esp + 0x214], 0xffffffff
call fcn.0058df3f
mov ecx, dword [esp + 0x20c]
mov dword fs:[0], ecx
add esp, 0x218
ret
Function at 0x470f50
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5b4f6b
push eax
mov dword fs:[0], esp
sub esp, 0x214
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp]
push eax
push 0x5e6db0
push 1
push 0
push 0x5e6da0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x470fa7
xor eax, eax
mov ecx, dword [esp + 0x214]
mov dword fs:[0], ecx
add esp, 0x220
ret
mov eax, dword [esp]
mov edx, dword [esp + 0x224]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
lea eax, [esp + 8]
push eax
call fcn.0048a380
add esp, 4
mov ecx, dword [esp]
mov eax, dword [eax]
push eax
push ecx
mov edx, dword [ecx]
mov dword [esp + 0x224], 0
call dword [edx + 0x24]
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0058df3f
mov eax, dword [esp]
lea edx, [esp + 4]
push edx
push 0x5e6dc0
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jge 0x471020
xor eax, eax
mov ecx, dword [esp + 0x214]
mov dword fs:[0], ecx
add esp, 0x220
ret
mov ecx, dword [esp + 0x228]
lea eax, [esp + 0xc]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 4]
lea ecx, [esp + 0xc]
push 2
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x214]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x220
ret
Function at 0x474a20
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5b5483
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push esi
push edi
mov eax, dword [0x63b4a0]
xor ebx, ebx
mov ecx, 0xc
mov esi, str.SoftwareMicrosoftMSSQLServerClientConnectTo
lea edi, [esp + 0x18]
mov dword [esp + 0x150], ebx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x15c]
mov edx, dword [esp + 0x158]
push ecx
push edx
lea eax, [esp + 0x14]
push str.DBMSSOCN__s__d
push eax
mov byte [esp + 0x160], 1
call fcn.00588507
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push 0xf003f
push ebx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x474ad4
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
push ebx
push 0xf003f
push ebx
push 0x645010
lea edx, [esp + 0x30]
push ebx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x474b20
mov eax, dword [esp + 0xc]
lea edi, [esp + 0x48]
mov esi, eax
mov ecx, dword [eax - 8]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax - 8]
mov byte [esp + ecx + 0x48], bl
mov eax, dword [eax - 8]
mov ecx, dword [esp + 0x158]
push eax
lea eax, [esp + 0x4c]
push eax
push 1
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
mov byte [esp + 0x150], bl
call fcn.0058df3f
lea ecx, [esp + 0x158]
mov dword [esp + 0x150], 0xffffffff
call fcn.0058df3f
mov ecx, dword [esp + 0x148]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret

Function at 0x47cce0
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5b6108
push eax
mov dword fs:[0], esp
push esi
push edi
mov eax, dword [esp + 0x18]
push 0
push 1
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x47cd4e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.0058df3f
mov eax, edi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.0058df3f
mov ecx, dword [esp + 8]
pop edi
or eax, 0xffffffff
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret
Function at 0x486520
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5b7f76
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24c
push esi
push edi
mov ecx, 0xd
mov esi, 0x628090
lea edi, [esp + 0x1c]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
push eax
push 0xf003f
lea ecx, [esp + 0x24]
push 0
push ecx
push reloc.WSOCK32.dll_accept
movsw word es:[edi], word [esi]
mov dword [esp + 0x24], 0x10
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4865a9
lea edx, [esp + 0x18]
lea eax, [esp + 8]
push edx
push eax
push 0
push 0xf003f
push 0
push 0x645010
lea ecx, [esp + 0x34]
push 0
push ecx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x48666e
mov edx, dword [0x63b4a0]
mov dword [esp + 0xc], edx
lea eax, [esp + 0x14]
mov dword [esp + 0x25c], 0
push eax
call fcn.0048a380
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push ecx
push str._sfileMakeCall.htm
push edx
mov byte [esp + 0x26c], 1
call fcn.00588507
add esp, 0x10
lea ecx, [esp + 0x14]
mov byte [esp + 0x25c], 0
call fcn.0058df3f
mov eax, dword [esp + 0xc]
lea edi, [esp + 0x54]
mov esi, eax
mov ecx, dword [eax - 8]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [esp + ecx + 0x54], 0
mov eax, dword [eax - 8]
mov ecx, dword [esp + 8]
push eax
lea eax, [esp + 0x58]
push eax
push 1
push 0
push 0x645010
push ecx
call esi
mov eax, dword [esp + 8]
lea edx, [esp + 0x10]
push 4
push edx
push 4
push 0
push str.Contexts
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
mov dword [esp + 0x25c], 0xffffffff
call fcn.0058df3f
mov ecx, dword [esp + 0x254]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x258
ret
Function at 0x486690
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5b7f96
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24c
push esi
push edi
mov ecx, 0xd
mov esi, str.SoftwareMicrosoftInternet_ExplorerMenuExt_
lea edi, [esp + 0x1c]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
push eax
push 0xf003f
lea ecx, [esp + 0x24]
push 0
push ecx
push reloc.WSOCK32.dll_accept
movsw word es:[edi], word [esi]
mov dword [esp + 0x24], 0x10
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x486719
lea edx, [esp + 0x18]
lea eax, [esp + 8]
push edx
push eax
push 0
push 0xf003f
push 0
push 0x645010
lea ecx, [esp + 0x34]
push 0
push ecx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4867de
mov edx, dword [0x63b4a0]
mov dword [esp + 0xc], edx
lea eax, [esp + 0x14]
mov dword [esp + 0x25c], 0
push eax
call fcn.0048a380
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push ecx
push str._sfileWebContact.htm
push edx
mov byte [esp + 0x26c], 1
call fcn.00588507
add esp, 0x10
lea ecx, [esp + 0x14]
mov byte [esp + 0x25c], 0
call fcn.0058df3f
mov eax, dword [esp + 0xc]
lea edi, [esp + 0x54]
mov esi, eax
mov ecx, dword [eax - 8]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [esp + ecx + 0x54], 0
mov eax, dword [eax - 8]
mov ecx, dword [esp + 8]
push eax
lea eax, [esp + 0x58]
push eax
push 1
push 0
push 0x645010
push ecx
call esi
mov eax, dword [esp + 8]
lea edx, [esp + 0x10]
push 4
push edx
push 4
push 0
push str.Contexts
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
mov dword [esp + 0x25c], 0xffffffff
call fcn.0058df3f
mov ecx, dword [esp + 0x254]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x258
ret
Function at 0x488b40
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x160
push ebx
push ebp
push esi
mov esi, dword [esp + 0x170]
push edi
mov ecx, 0xc
mov ebp, dword [esi - 8]
xor eax, eax
lea edi, [esp + 0x14]
xor bl, bl
rep stosd dword es:[edi], eax
mov ecx, ebp
push 0
stosw word es:[edi], ax
mov eax, ecx
lea edi, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 2
and ecx, 3
mov byte [esp + 0x1b], bl
rep movsb byte es:[edi], byte [esi]
mov esi, 0x128
mov dword [esp + 0x50], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x488bf0
lea ecx, [esp + 0x48]
push ecx
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x488bf0
mov dword [esp + 0x48], esi
xor esi, esi
test ebp, ebp
jle 0x488bd3
movsx edx, byte [esp + esi + 0x6c]
push edx
call fcn.005690f7
mov ebx, eax
movsx eax, byte [esp + esi + 0x18]
push eax
call fcn.005690f7
add esp, 8
cmp ebx, eax
jne 0x488bd3
inc esi
cmp esi, ebp
jl 0x488baf
cmp esi, ebp
je 0x488be8
lea ecx, [esp + 0x48]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x488bec
jmp 0x488ba9
mov bl, 1
jmp 0x488bf0
mov bl, byte [esp + 0x13]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
test bl, bl
pop ebx
je 0x488c1a
mov edx, dword [esp + 0x40]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0x164]
call fcn.0058df3f
add esp, 0x160
ret
Function at 0x48a510
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5b8f40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push esi
push edi
mov dword [esp + 0x118], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x10]
mov esi, dword [esp + 0x128]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [esi - 8]
lea edi, [esp + 0x10]
mov eax, ecx
mov edx, dword [esp + 0x124]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x120]
lea ecx, [esp + 8]
push ecx
push 0xf003f
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x48a5b7
mov edx, dword [esp + 0x124]
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x645010
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x48a5e0
mov edx, dword [esp + 8]
lea eax, [esp + 0x12c]
push 4
push eax
push 4
lea ecx, [esp + 0x1c]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x124]
mov byte [esp + 0x118], 0
call fcn.0058df3f
lea ecx, [esp + 0x128]
mov dword [esp + 0x118], 0xffffffff
call fcn.0058df3f
mov ecx, dword [esp + 0x110]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x114
ret
Function at 0x48abc0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5b8f88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x208
push ebx
push esi
push edi
xor ebx, ebx
mov dword [esp + 0x21c], ebx
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x114]
mov esi, dword [esp + 0x22c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [esi - 8]
lea edi, [esp + 0x114]
mov eax, ecx
mov edx, dword [esp + 0x228]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x224]
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push ebx
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x48ac68
mov edx, dword [esp + 0x228]
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push ecx
push ebx
push 0xf003f
push ebx
push 0x645010
push ebx
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x48acb7
mov eax, dword [esp + 0x230]
lea edi, [esp + 0x14]
mov esi, eax
mov ecx, dword [eax - 8]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax - 8]
mov byte [esp + ecx + 0x14], bl
mov eax, dword [eax - 8]
push eax
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x120]
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x228]
mov byte [esp + 0x21c], 1
call fcn.0058df3f
lea ecx, [esp + 0x22c]
mov byte [esp + 0x21c], bl
call fcn.0058df3f
lea ecx, [esp + 0x230]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0058df3f
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x214
ret
Function at 0x48ad10
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5b8fe0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
push esi
push edi
mov dword [esp + 0x10], 0
mov ebx, 1
mov dword [esp + 0x22c], ebx
mov eax, dword [0x63b4a0]
mov dword [esp + 0xc], eax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x24]
mov esi, dword [esp + 0x240]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [esi - 8]
lea edi, [esp + 0x24]
mov edx, ecx
lea eax, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x238]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x240]
push 0xf003f
push 0
push ecx
push edx
mov byte [esp + 0x240], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x124]
lea edx, [esp + 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
lea ecx, [esp + 0x124]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0x30]
push 0
push eax
push ecx
mov dword [esp + 0x30], 0xff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x124]
lea ecx, [esp + 0x1c]
push eax
call fcn.0058dfad
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x230], 4
call fcn.0058e078
lea ecx, [esp + 0x1c]
mov byte [esp + 0x22c], 3
call fcn.0058df3f
mov ecx, dword [esp + 0xc]
push 0x645010
push ecx
call fcn.00568a52
add esp, 8
test eax, eax
jne 0x48aec7
mov edx, dword [esp + 0x240]
push str.BUSYTONE1
push edx
call fcn.00568a52
add esp, 8
test eax, eax
jne 0x48ae6b
mov esi, dword [esp + 0x234]
push 0x62a2e4
mov ecx, esi
call fcn.0058dfad
mov dword [esp + 0x10], ebx
jmp 0x48aede
mov eax, dword [esp + 0x240]
push str.BUSYTONE2
push eax
call fcn.00568a52
add esp, 8
test eax, eax
jne 0x48ae99
mov esi, dword [esp + 0x234]
push 0x619fac
mov ecx, esi
call fcn.0058dfad
jmp 0x48aeda
mov ecx, dword [esp + 0x240]
push str.LogUser
push ecx
call fcn.00568a52
add esp, 8
test eax, eax
jne 0x48aec7
mov esi, dword [esp + 0x234]
push str.admin
mov ecx, esi
call fcn.0058dfad
jmp 0x48aeda
mov esi, dword [esp + 0x234]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.0058dcb4
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0xc]
mov byte [esp + 0x22c], 2
call fcn.0058df3f
lea ecx, [esp + 0x23c]
mov byte [esp + 0x22c], bl
call fcn.0058df3f
lea ecx, [esp + 0x240]
mov byte [esp + 0x22c], 0
call fcn.0058df3f
mov ecx, dword [esp + 0x224]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x224
ret
Function at 0x48b200
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x5b9017
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebp
push esi
lea eax, [esp + 0x1c]
push edi
lea ecx, [esp + 0x28]
push eax
mov eax, dword [0x649cac]
lea edx, [esp + 0x1c]
push ecx
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [0x63b4a0]
mov dword [esp + 0xc], eax
mov dword [esp + 0x48], 1
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov ecx, 0x14
mov eax, esi
mov edx, edi
mov byte [esp + 0x48], 2
call fcn.005697b0
mov ebp, eax
mov eax, dword [0x64a174]
test eax, eax
jne 0x48b28a
mov eax, dword [0x628340]
push 0
cmp eax, 1
push 0x36ee800
jmp 0x48b291
push 0
push 0x36ee80
push edi
push esi
call fcn.00569740
mov esi, eax
lea ecx, [esp + 0xc]
push esi
push ebp
push 0x62a350
push ecx
call fcn.00588507
mov eax, dword [0x64a744]
mov edx, dword [esp + 0x1c]
add esp, 0x10
lea ecx, [eax + 0xa34]
push edx
call fcn.00592059
mov edx, dword [0x64a744]
lea ecx, [esp + 0x30]
push ecx
mov eax, dword [edx + 0xa50]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [0x64a744]
call fcn.0059688d
mov eax, dword [0x64a744]
lea edx, [esp + 0x30]
push 1
push edx
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov al, byte [0x652444]
test al, al
jne 0x48b342
cmp esi, 0xa
jae 0x48b342
push esi
lea edx, [esp + 0x14]
push 0x62a300
push edx
mov byte [0x652444], 1
call fcn.00588507
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x646a4c]
add esp, 0xc
push 0x30
push 0x61df70
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [esp + 0x50]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.0058dcb4
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 1
call fcn.0058df3f
lea ecx, [esp + 0xc]
mov byte [esp + 0x48], 0
call fcn.0058df3f
mov ecx, dword [esp + 0x40]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x40
ret

Function at 0x48b3c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 8]
pop edi
cmp eax, 6
setae al
add esp, 0x9c
ret