joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476ad0
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x525dd8
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
xor esi, esi
push 0xffffffffffffffff
push esi
mov ecx, edi
call fcn.005065f7
mov ebx, dword [esp + 0x20]
cmp ebx, esi
jne 0x476b16
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [0x569c90]
mov dword [esp + 0x20], 0x100
mov dword [esp + 0x24], eax
push esi
push esi
push esi
lea ecx, [esp + 0x2c]
push esi
push ecx
push 0x100
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], esi
call fcn.0050816a
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push ebx
call ebp
test eax, eax
jne 0x476bbf
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push edx
call fcn.005081b9
mov eax, dword [edi + 8]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, edi
call fcn.005067be
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call fcn.00507d3a
mov edx, dword [0x569c90]
inc esi
mov dword [esp + 0x20], 0x100
mov dword [esp + 0x24], edx
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push 0
push eax
push 0x100
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0
call fcn.0050816a
push eax
push esi
push ebx
call ebp
test eax, eax
je 0x476b51
push 0
lea ecx, [esp + 0x28]
call fcn.005081b9
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret

Function at 0x476c00
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret

Function at 0x476c20
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 0xc]
push 8
push eax
push 0xb
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret

Function at 0x476c40
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
push edi
mov edi, dword [esp + 0x1c]
xor eax, eax
push ecx
lea edx, [esp + 0x24]
push eax
push edx
push eax
push edi
push ebx
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x28], eax
call ebp
test eax, eax
jne 0x476ca4
mov eax, dword [esp + 0x20]
cmp eax, 4
je 0x476c93
cmp eax, 0xb
je 0x476c93
pop edi
pop esi
pop ebp
mov eax, 0xd
pop ebx
pop ecx
ret
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push esi
push ecx
push 0
push edi
push ebx
call ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x476d10
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 8]
push edi
mov edi, dword [esp + 0x14]
push eax
push 0
push 0
push 0
push esi
push edi
mov dword [esp + 0x24], 0
call ebx
test eax, eax
jne 0x476d65
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x20]
cmp ecx, eax
je 0x476d53
pop edi
pop esi
mov eax, 0xd
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
push 0
push 0
push esi
push edi
call ebx
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x476e50
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x478030
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, 0x20000
je 0x478043
mov eax, 1
test ch, 4
je 0x47804a
or al, 2
test ecx, 0x200000
je 0x478054
or al, 4
test cl, 8
je 0x47805b
or al, 8
test ecx, ecx
jns 0x478061
or al, 0x10
test ch, ch
jns 0x478067
or al, 0x20
test ecx, 0x800000
je 0x478071
or al, 0x40
test cl, 2
je 0x478078
or al, 0x80
test ecx, 0x8000000
je 0x478083
or ah, 1
test ch, 0x40
je 0x47808b
or ah, 2
test ecx, 0x2000000
je 0x478096
or ah, 4
test ecx, 0x40000000
je 0x4780a1
or ah, 8
test cl, cl
jns 0x4780a8
or ah, 0x10
test ch, 2
je 0x4780b0
or ah, 0x20
test ch, 0x10
je 0x4780b8
or ah, 0x40
test ecx, 0x80000
je 0x4780c3
or ah, 0x80
test ch, 1
je 0x4780cd
or eax, 0x10000
test cl, 0x10
je 0x4780d7
or eax, 0x20000
test ecx, 0x400000
je 0x4780e4
or eax, 0x40000
test ecx, 0x10000
je 0x4780f1
or eax, 0x80000
test ecx, 0x10000000
je 0x4780fe
or eax, 0x100000
test cl, 0x20
je 0x478108
or eax, 0x200000
test ecx, 0x4000000
je 0x478115
or eax, 0x400000
test ch, 8
je 0x47811f
or eax, 0x800000
test cl, 1
je 0x478129
or eax, 0x1000000
test ecx, 0x1000000
je 0x478136
or eax, 0x2000000
test ecx, 0x100000
je 0x478143
or eax, 0x4000000
test ecx, 0x40000
je 0x478150
or eax, 0x8000000
test ecx, 0x20000000
je 0x47815d
or eax, 0x10000000
test cl, 4
je 0x478167
or eax, 0x20000000
test cl, 0x40
je 0x478171
or eax, 0x40000000
test ch, 0x20
je 0x47817b
or eax, 0x80000000
ret
Function at 0x478180
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
test cl, 1
je 0x478190
mov eax, 0x20000
test cl, 2
je 0x478198
or ah, 4
test cl, 4
je 0x4781a2
or eax, 0x200000
test cl, 8
je 0x4781a9
or al, 8
test cl, 0x10
je 0x4781b3
or eax, 0x80000000
test cl, 0x20
je 0x4781bb
or ah, 0x80
test cl, 0x40
je 0x4781c5
or eax, 0x800000
test cl, cl
jns 0x4781cb
or al, 2
test ch, 1
je 0x4781d5
or eax, 0x8000000
test ch, 2
je 0x4781dd
or ah, 0x40
test ch, 4
je 0x4781e7
or eax, 0x2000000
test ch, 8
je 0x4781f1
or eax, 0x40000000
test ch, 0x10
je 0x4781f8
or al, 0x80
test ch, 0x20
je 0x478200
or ah, 2
test ch, 0x40
je 0x478208
or ah, 0x10
test ch, ch
jns 0x478211
or eax, 0x80000
test ecx, 0x10000
je 0x47821c
or ah, 1
test ecx, 0x20000
je 0x478226
or al, 0x10
test ecx, 0x40000
je 0x478233
or eax, 0x400000
test ecx, 0x80000
je 0x478240
or eax, 0x10000
test ecx, 0x100000
je 0x47824d
or eax, 0x10000000
test ecx, 0x200000
je 0x478257
or al, 0x20
test ecx, 0x400000
je 0x478264
or eax, 0x4000000
test ecx, 0x800000
je 0x47826f
or ah, 8
test ecx, 0x1000000
je 0x478279
or al, 1
test ecx, 0x2000000
je 0x478286
or eax, 0x1000000
test ecx, 0x4000000
je 0x478293
or eax, 0x100000
test ecx, 0x8000000
je 0x4782a0
or eax, 0x40000
test ecx, 0x10000000
je 0x4782ad
or eax, 0x20000000
test ecx, 0x20000000
je 0x4782b7
or al, 4
test ecx, 0x40000000
je 0x4782c1
or al, 0x40
test ecx, ecx
jns 0x4782c8
or ah, 0x20
ret

Function at 0x478970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x525f03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi], method.CCommandLineInfo.virtual_0
mov eax, dword [0x569c90]
lea ecx, [esi + 0x10]
mov dword [esp + 0x18], edi
mov dword [ecx], eax
mov ebx, 1
push str.user_anonymous.com
mov byte [esp + 0x1c], bl
mov dword [esi], method.CCommandLineInfo.virtual_0
mov dword [esi + 8], 0xc
mov dword [esi + 0xc], 4
call fcn.00507ec3
mov ecx, dword [esp + 0x10]
mov eax, 0x1e
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x34], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x478d60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x525f20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push esi
push edi
push 0x400
lea ecx, [esp + 0xc]
call fcn.00511eb1
push 0
push 0x1000
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x8c], 0
call fcn.0050ed7b
mov ecx, dword [esp + 0x8c]
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x80], 1
mov edx, dword [ecx]
call dword [edx + 8]
lea ecx, [esp + 0x30]
call fcn.0050eedf
lea ecx, [esp + 8]
call fcn.0050cb3a
lea ecx, [esp + 8]
mov edi, eax
call fcn.00511f64
mov ecx, dword [esp + 0x88]
mov edx, dword [esp + 0x84]
mov esi, eax
push edi
push esi
push ecx
push edx
call fcn.004763d0
push esi
mov edi, eax
call fcn.004f2cd7
add esp, 0x14
lea ecx, [esp + 0x30]
mov byte [esp + 0x7c], 0
call fcn.0050ee57
lea ecx, [esp + 8]
mov dword [esp + 0x7c], 0xffffffff
call fcn.00511f76
mov ecx, dword [esp + 0x74]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x78
ret 0xc

Function at 0x478ed0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x525f40
push eax
mov dword fs:[0], esp
sub esp, 0x7c
lea eax, [esp]
push ebp
push esi
push edi
push eax
mov ebp, ecx
mov ecx, dword [esp + 0x9c]
push 0x20019
push 0
push str.AutoRenaming
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edi, [ebp + 0xc]
mov esi, eax
mov ecx, edi
call fcn.005076fe
test esi, esi
jne 0x47903a
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push esi
push str.AutoRenameRulesInfo
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x479002
mov edx, dword [esp + 0x10]
push edx
call fcn.0050c4a3
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x14]
push ecx
push esi
push str.AutoRenameRulesInfo
push edx
mov dword [esp + 0x28], eax
call fcn.004763f0
add esp, 0x14
test eax, eax
jne 0x478ff9
test esi, esi
je 0x478ff9
push eax
mov eax, dword [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x28]
call fcn.00511efd
push 0
push 0x1000
lea ecx, [esp + 0x24]
push 1
push ecx
lea ecx, [esp + 0x54]
mov dword [esp + 0xa0], 0
call fcn.0050ed7b
mov edx, dword [edi]
lea eax, [esp + 0x44]
push eax
mov ecx, edi
mov byte [esp + 0x94], 1
call dword [edx + 8]
lea ecx, [esp + 0x44]
call fcn.0050eedf
lea ecx, [esp + 0x1c]
call fcn.0051215d
lea ecx, [esp + 0x44]
mov byte [esp + 0x90], 0
call fcn.0050ee57
lea ecx, [esp + 0x1c]
mov dword [esp + 0x90], 0xffffffff
call fcn.00511f76
push esi
call fcn.0050c4cc
add esp, 4
mov edx, dword [esp + 0xc]
lea ecx, [ebp + 8]
push 4
push ecx
push str.UseAutoRenameScheme
push edx
call fcn.004762f0
mov eax, dword [esp + 0x1c]
add ebp, 0x28
push 4
push ebp
push str.NumerateStyle
push eax
call fcn.004762f0
mov ecx, dword [esp + 0x2c]
add esp, 0x20
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x88]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x88
ret 4
Function at 0x479990
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x526000
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
lea eax, [esp]
push edi
push eax
mov edi, ecx
mov ecx, dword [esp + 0x94]
push 0x20019
push 0
push str.FileTypes
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x479acc
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
push eax
lea eax, [esp + 0x18]
push eax
push 0
push str.ASCIIFileExts
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x479ac1
mov edx, dword [esp + 8]
push esi
push edx
call fcn.0050c4a3
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x10]
push ecx
push esi
push str.ASCIIFileExts
push edx
mov dword [esp + 0x24], eax
call fcn.004763f0
add esp, 0x14
test eax, eax
jne 0x479ab7
test esi, esi
je 0x479ab7
push eax
mov eax, dword [esp + 0x14]
push eax
push esi
lea ecx, [esp + 0x24]
call fcn.00511efd
push 0
push 0x1000
lea ecx, [esp + 0x20]
push 1
push ecx
lea ecx, [esp + 0x50]
mov dword [esp + 0x9c], 0
call fcn.0050ed7b
mov edx, dword [edi + 8]
lea ecx, [edi + 8]
lea eax, [esp + 0x40]
mov byte [esp + 0x8c], 1
push eax
call dword [edx + 8]
lea ecx, [esp + 0x40]
call fcn.0050eedf
lea ecx, [esp + 0x18]
call fcn.0051215d
lea ecx, [esp + 0x40]
mov byte [esp + 0x8c], 0
call fcn.0050ee57
lea ecx, [esp + 0x18]
mov dword [esp + 0x8c], 0xffffffff
call fcn.00511f76
push esi
call fcn.0050c4cc
add esp, 4
pop esi
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x80]
pop edi
mov dword fs:[0], ecx
add esp, 0x88
ret 4
Function at 0x479ce0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x526060
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
lea eax, [esp]
push edi
push eax
mov edi, ecx
mov ecx, dword [esp + 0x94]
push 0x20019
push 0
push str.ModeZ
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x479e34
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
push eax
lea eax, [esp + 0x18]
push eax
push 0
push str.ModeZFileExts
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x479e11
mov edx, dword [esp + 8]
push esi
push edx
call fcn.0050c4a3
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x10]
push ecx
push esi
push str.ModeZFileExts
push edx
mov dword [esp + 0x24], eax
call fcn.004763f0
add esp, 0x14
test eax, eax
jne 0x479e07
test esi, esi
je 0x479e07
push eax
mov eax, dword [esp + 0x14]
push eax
push esi
lea ecx, [esp + 0x24]
call fcn.00511efd
push 0
push 0x1000
lea ecx, [esp + 0x20]
push 1
push ecx
lea ecx, [esp + 0x50]
mov dword [esp + 0x9c], 0
call fcn.0050ed7b
mov edx, dword [edi + 8]
lea ecx, [edi + 8]
lea eax, [esp + 0x40]
mov byte [esp + 0x8c], 1
push eax
call dword [edx + 8]
lea ecx, [esp + 0x40]
call fcn.0050eedf
lea ecx, [esp + 0x18]
call fcn.0051215d
lea ecx, [esp + 0x40]
mov byte [esp + 0x8c], 0
call fcn.0050ee57
lea ecx, [esp + 0x18]
mov dword [esp + 0x8c], 0xffffffff
call fcn.00511f76
push esi
call fcn.0050c4cc
add esp, 4
pop esi
mov ecx, dword [esp + 4]
add edi, 0x1c
push 4
push edi
push str.MODE_Z
push ecx
call fcn.004762f0
mov edx, dword [esp + 0x14]
add esp, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x80]
pop edi
mov dword fs:[0], ecx
add esp, 0x88
ret 4
Function at 0x47a450
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x526119
push eax
mov dword fs:[0], esp
sub esp, 0xec
lea eax, [esp]
push esi
push eax
mov esi, ecx
mov ecx, dword [esp + 0x104]
push 0x20019
push 0
push str.IndexFiles
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47a6b2
mov eax, dword [esp + 4]
push ebx
push edi
lea edx, [esi + 0xc]
push 4
push edx
push str.AutoLoadIndex
push eax
call fcn.004762f0
mov edx, dword [esp + 0x1c]
lea ecx, [esi + 8]
push 4
push ecx
push str.MaxIndexSize
push edx
call fcn.004762f0
mov edx, dword [esp + 0x2c]
add esp, 0x20
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push 0
push ecx
push 0
push str.IndexMasks
push edx
call ebx
test eax, eax
jne 0x47a5b3
mov eax, dword [esp + 0x10]
push eax
call fcn.0050c4a3
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
mov edi, eax
mov eax, dword [esp + 0x10]
push edx
push edi
push str.IndexMasks
push eax
mov dword [esp + 0x28], ecx
call fcn.004763f0
add esp, 0x14
test eax, eax
jne 0x47a5aa
test edi, edi
je 0x47a5aa
mov ecx, dword [esp + 0x14]
push eax
push ecx
push edi
lea ecx, [esp + 0x54]
call fcn.00511efd
push 0
push 0x1000
lea edx, [esp + 0x50]
push 1
push edx
lea ecx, [esp + 0x80]
mov dword [esp + 0x110], 0
call fcn.0050ed7b
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x10]
lea edx, [esp + 0x70]
mov byte [esp + 0x100], 1
push edx
call dword [eax + 8]
lea ecx, [esp + 0x70]
call fcn.0050eedf
lea ecx, [esp + 0x48]
call fcn.0051215d
lea ecx, [esp + 0x70]
mov byte [esp + 0x100], 0
call fcn.0050ee57
lea ecx, [esp + 0x48]
mov dword [esp + 0x100], 0xffffffff
call fcn.00511f76
push edi
call fcn.0050c4cc
add esp, 4
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push 0
push ecx
push 0
push str.IndexNotMasks
push edx
call ebx
test eax, eax
jne 0x47a6a5
mov eax, dword [esp + 0x10]
push eax
call fcn.0050c4a3
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
mov edi, eax
mov eax, dword [esp + 0x10]
push edx
push edi
push str.IndexNotMasks
push eax
mov dword [esp + 0x2c], ecx
call fcn.004763f0
add esp, 0x14
test eax, eax
jne 0x47a69c
test edi, edi
je 0x47a69c
mov ecx, dword [esp + 0x18]
push eax
push ecx
push edi
lea ecx, [esp + 0x2c]
call fcn.00511efd
push 0
push 0x1000
lea edx, [esp + 0x28]
mov ebx, 2
push 1
push edx
lea ecx, [esp + 0xc4]
mov dword [esp + 0x110], ebx
call fcn.0050ed7b
mov eax, dword [esi + 0x24]
lea ecx, [esi + 0x24]
lea edx, [esp + 0xb4]
mov byte [esp + 0x100], 3
push edx
call dword [eax + 8]
lea ecx, [esp + 0xb4]
call fcn.0050eedf
lea ecx, [esp + 0x20]
call fcn.0051215d
lea ecx, [esp + 0xb4]
mov byte [esp + 0x100], bl
call fcn.0050ee57
lea ecx, [esp + 0x20]
mov dword [esp + 0x100], 0xffffffff
call fcn.00511f76
push edi
call fcn.0050c4cc
add esp, 4
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [esp + 0xf0]
pop esi
mov dword fs:[0], ecx
add esp, 0xf8
ret 4
Function at 0x47b0a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x526180
push eax
mov dword fs:[0], esp
sub esp, 0x7c
lea eax, [esp]
push esi
push eax
mov esi, ecx
mov ecx, dword [esp + 0x94]
push 0x20019
push 0
push str.SmartKeepAlive
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47b29a
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
push eax
lea eax, [esp + 0x18]
push eax
push 0
push str.CommandsInfo
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47b1c9
mov edx, dword [esp + 8]
push edi
push edx
call fcn.0050c4a3
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x10]
push ecx
push edi
push str.CommandsInfo
push edx
mov dword [esp + 0x24], eax
call fcn.004763f0
add esp, 0x14
test eax, eax
jne 0x47b1bf
test edi, edi
je 0x47b1bf
push eax
mov eax, dword [esp + 0x14]
push eax
push edi
lea ecx, [esp + 0x24]
call fcn.00511efd
push 0
push 0x1000
lea ecx, [esp + 0x20]
push 1
push ecx
lea ecx, [esp + 0x50]
mov dword [esp + 0x9c], 0
call fcn.0050ed7b
mov edx, dword [esi + 0x28]
lea ecx, [esi + 0x28]
lea eax, [esp + 0x40]
mov byte [esp + 0x8c], 1
push eax
call dword [edx + 8]
lea ecx, [esp + 0x40]
call fcn.0050eedf
lea ecx, [esp + 0x18]
call fcn.0051215d
lea ecx, [esp + 0x40]
mov byte [esp + 0x8c], 0
call fcn.0050ee57
lea ecx, [esp + 0x18]
mov dword [esp + 0x8c], 0xffffffff
call fcn.00511f76
push edi
call fcn.0050c4cc
add esp, 4
pop edi
mov edx, dword [esp + 4]
lea ecx, [esi + 0x1c]
push 4
push ecx
push str.EnableAutoReconnect
push edx
call fcn.004762f0
mov ecx, dword [esp + 0x14]
lea eax, [esi + 8]
push 4
push eax
push str.KeepAlive
push ecx
call fcn.004762f0
mov eax, dword [esp + 0x24]
lea edx, [esi + 0x24]
push 4
push edx
push str.NewIP
push eax
call fcn.004762f0
mov edx, dword [esp + 0x34]
lea ecx, [esi + 0x20]
push 4
push ecx
push str.DelayTime
push edx
call fcn.004762f0
mov ecx, dword [esp + 0x44]
add esp, 0x40
lea eax, [esi + 0x14]
push 4
push eax
push str.LeftTimeSend
push ecx
call fcn.004762f0
mov eax, dword [esp + 0x14]
lea edx, [esi + 0x10]
push 4
push edx
push str.MaintainTime
push eax
call fcn.004762f0
mov edx, dword [esp + 0x24]
lea ecx, [esi + 0x18]
push 4
push ecx
push str.RightTimeSend
push edx
call fcn.004762f0
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0xc]
push 4
push eax
push str.StartTime
push ecx
call fcn.004762f0
mov edx, dword [esp + 0x44]
add esp, 0x40
add esi, 0x3c
push 4
push esi
push str.EnableSKALog
push edx
call fcn.004762f0
mov eax, dword [esp + 0x14]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x80]
pop esi
mov dword fs:[0], ecx
add esp, 0x88
ret 4
Function at 0x47c330
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x526280
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
lea eax, [esp + 8]
push edi
xor ebx, ebx
push eax
mov edi, ecx
mov ecx, dword [esp + 0x34]
push 0x20019
push ebx
push str.Sounds
push ecx
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, edi
mov esi, eax
call fcn.0047c170
cmp esi, ebx
jne 0x47c4e9
mov eax, dword [esp + 0xc]
lea edx, [edi + 8]
push 4
push edx
push str.UseSounds
push eax
call fcn.004762f0
mov eax, dword [0x569c90]
add esp, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], eax
mov bl, 2
mov esi, 0x563aa8
mov byte [esp + 0x28], bl
mov ecx, dword [esi]
lea edx, [esp + 0x30]
push ecx
push str.SoundID_
push str._s_d
push edx
call fcn.005054dc
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
push ecx
push edx
call fcn.00476360
mov eax, dword [esi]
lea ecx, [esp + 0x4c]
push eax
push str.EventID_
push str._s_d
push ecx
call fcn.005054dc
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x3c]
push edx
push eax
push ecx
call fcn.00476360
add esp, 0x38
test eax, eax
push ecx
mov ecx, esp
jne 0x47c440
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], esp
push edx
call fcn.00507aaf
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x34], 3
call fcn.00507aaf
mov ecx, dword [esi]
push ecx
jmp 0x47c467
mov dword [esp + 0x20], esp
push 0x56e1f4
call fcn.00507da8
push ecx
mov byte [esp + 0x30], 4
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x56e1f4
call fcn.00507da8
mov edx, dword [esi]
push edx
mov ecx, edi
mov byte [esp + 0x34], bl
call fcn.0047c550
push 0x56e1f4
lea ecx, [esp + 0x34]
call fcn.00507ec3
push 0x56e1f4
lea ecx, [esp + 0x14]
call fcn.00507ec3
add esi, 4
cmp esi, 0x563adc
jl 0x47c3b7
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 1
call fcn.00507d3a
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.00507d3a
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4
mov esi, 0x563aa8
mov ebx, 5
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x56e1f4
call fcn.00507da8
push ecx
mov dword [esp + 0x30], ebx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x56e1f4
call fcn.00507da8
mov ecx, dword [esi]
mov dword [esp + 0x30], 0xffffffff
push ecx
mov ecx, edi
call fcn.0047c550
add esi, 4
cmp esi, 0x563adc
jl 0x47c4f3
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 4
Function at 0x47c770
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5262df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov dword [esp + 0x10], 0
mov eax, dword [0x569c90]
mov ebx, 1
mov dword [esp + 0x1c], ebx
mov dword [esp + 8], eax
push 0x105
push 0x105
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 2
call fcn.0050816a
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.005081b9
push 0x5c
lea ecx, [esp + 0xc]
call fcn.0050558b
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x10]
call fcn.00507aaf
push 0x5c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 3
call fcn.00505681
push 0x55cfa4
lea ecx, [esp + 0x10]
call fcn.00508116
lea edx, [esp + 0x28]
lea ecx, [esp + 0xc]
push edx
call fcn.00508152
mov eax, dword [esp + 0xc]
push eax
call fcn.00422830
add esp, 4
test eax, eax
je 0x47c83a
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00507aaf
mov dword [esp + 0x10], ebx
jmp 0x47c86a
push str._system32_
lea ecx, [esp + 0xc]
call fcn.00508116
lea edx, [esp + 0x28]
lea ecx, [esp + 8]
push edx
call fcn.00508152
mov esi, dword [esp + 0x24]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.00507aaf
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call fcn.00507d3a
lea ecx, [esp + 8]
mov byte [esp + 0x1c], bl
call fcn.00507d3a
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call fcn.00507d3a
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret