joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f8740
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x778]
test eax, eax
je 0x4f878c
mov eax, dword [esi + 0x408]
mov dword [esi + 0x768], 0x7540
mov ecx, dword [0x5bb508]
push 1
push eax
push ecx
push 0x7540
lea ecx, [esi + 0x20]
call fcn.004fdd80
push 2
mov ecx, esi
call fcn.004f9050
mov eax, dword [esi + 0x778]
test eax, eax
jne 0x4f88ea
mov eax, dword [esi + 0x768]
test eax, eax
jne 0x4f88e2
mov al, byte [esi + 0x76c]
test al, al
je 0x4f87b8
mov edx, dword [esi + 0x418]
mov eax, dword [esi + 0x41c]
or edx, eax
jne 0x4f87b8
push 0
jmp 0x4f87ba
push 3
mov ecx, esi
call fcn.004f9050
mov eax, dword [esi + 0x54]
test eax, eax
je 0x4f87e0
mov eax, dword [esi + 0x1c0]
test eax, eax
jne 0x4f87e0
push 1
mov ecx, esi
call fcn.004f8c50
jmp 0x4f88e2
mov eax, dword [esi + 0x77c]
test eax, eax
jne 0x4f87f4
mov al, byte [esi + 0x76c]
test al, al
je 0x4f87ff
lea ecx, [esi + 0x42c]
call fcn.004c97e0
mov eax, dword [esi + 0x1c0]
test eax, eax
je 0x4f8827
mov eax, dword [esi + 4]
test eax, eax
jne 0x4f8827
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x54]
lea eax, [esi + 0x42c]
push eax
push ecx
push edx
call fcn.004fb960
add esp, 0xc
lea eax, [esi + 0xbc]
push str..m3u
push eax
call fcn.00524fd0
add esp, 8
test eax, eax
jne 0x4f885c
mov eax, dword [esi + 0x1c0]
test eax, eax
je 0x4f88e2
mov ecx, esi
call fcn.004fcc70
test al, al
jne 0x4f8988
mov eax, dword [esi + 0x1c0]
test eax, eax
je 0x4f88e2
mov eax, dword [esi + 4]
test eax, eax
jne 0x4f88e2
mov eax, dword [esi + 8]
test eax, eax
jne 0x4f88e2
mov ecx, esi
call fcn.004fbd60
test eax, eax
je 0x4f88e2
mov eax, dword [esi + 0x428]
test eax, eax
je 0x4f88db
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4f88db
mov ecx, dword [esi + 0x428]
call fcn.00446ba0
mov ecx, dword [esi + 0x428]
push 0x43
push 0
push 0
push 0
push 0
push 0x5bd0b8
call fcn.005371b7
mov ecx, dword [esi + 0x428]
push 1
call fcn.00537206
mov edx, dword [esi + 0x428]
push 0
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.004f8990
mov eax, dword [esi + 0x778]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
jne 0x4f8948
mov eax, dword [esi + 0x768]
test eax, eax
je 0x4f8932
mov eax, dword [esi + 0x790]
test eax, eax
jne 0x4f8932
mov al, byte [esi + 0x788]
test al, al
jne 0x4f8932
mov eax, dword [esi + 4]
cmp eax, 4
je 0x4f8924
cmp eax, 5
je 0x4f8924
mov eax, 1
jmp 0x4f8926
xor eax, eax
push 0
push 1
push eax
mov ecx, esi
call fcn.004f7790
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4f8948
push 0
push 0x138a
push 0x111
push eax
call edi
mov eax, dword [esi + 0x770]
test eax, eax
je 0x4f8988
mov ecx, dword [esi + 0x774]
cmp ecx, 0xfffffffb
je 0x4f896e
push ecx
push 0x138a
push 0x111
push eax
call edi
pop edi
pop esi
ret
push esi
push 0
push 0x1411
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
ret
Function at 0x4f9480
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a468
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
lea edi, [esi + 0x20]
mov dword [ebp - 0x10], esp
push eax
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.004ff850
test eax, eax
jne 0x4f95ea
mov eax, dword [esi + 0x408]
test eax, eax
je 0x4f9568
mov ecx, dword [esi + 0x3c8]
test ecx, ecx
jne 0x4f94e3
push eax
mov ecx, edi
call fcn.004ffed0
mov ebx, dword [esi + 0x3c8]
test ebx, ebx
je 0x4f9568
mov edx, dword [esi + 0x54]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
push str.LocalNameForSave
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call ebx
mov ecx, dword [0x5b5ecc]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edx
push 0x597ddc
push eax
mov byte [ebp - 4], 1
call fcn.0053091a
mov ecx, dword [ebp - 0x14]
add esp, 0xc
push ecx
call fcn.004fd720
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esi + 0x3c8]
push eax
push eax
push str.EncLNFS
push edx
call ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00537b04
cmp dword [esi + 0x644], 3
jne 0x4f95b9
cmp dword [esi + 0x1c4], 2
jne 0x4f95b0
lea edi, [esi + 0x20]
mov ecx, edi
call fcn.004ffc00
test eax, eax
je 0x4f95b0
mov eax, dword [esi + 0x28]
mov ecx, dword [0x5bb4e4]
push 0x50004
push eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4f95b0
mov ecx, edi
call fcn.004ffca0
test eax, eax
jne 0x4f95ea
push 1
mov ecx, esi
call fcn.004f8c50
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4fb1e0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a540
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb0
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x14], esi
mov eax, dword [esi + 0x3c8]
mov dword [ebp - 0x10], esp
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x4fb225
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 0x3c8], ebx
mov eax, dword [esi + 0x408]
lea ecx, [ebp - 0x3c]
push eax
push str.SoftwareDownloadManager_ldChList
push ecx
call fcn.0051d0e8
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add esp, 0xc
lea edx, [ebp - 0x3c]
push edx
push 0x80000001
call edi
cmp eax, ebx
je 0x4fb27d
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0xbc]
push str.Can_not_delete_subkey__s_from_registry__error_code___ld_n
push ecx
call fcn.0051d0e8
add esp, 0x10
lea edx, [ebp - 0xbc]
lea ecx, [esi + 0x42c]
push edx
call fcn.004c96f0
mov eax, dword [esi + 0x408]
lea ecx, [ebp - 0x3c]
push eax
push str.SoftwareDownloadManager_ld
push ecx
call fcn.0051d0e8
add esp, 0xc
lea edx, [ebp - 0x3c]
push edx
push 0x80000001
call edi
cmp eax, ebx
je 0x4fb2cf
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0xbc]
push str.Can_not_delete_subkey__s_from_registry__error_code___ld_n
push ecx
call fcn.0051d0e8
add esp, 0x10
lea edx, [ebp - 0xbc]
lea ecx, [esi + 0x42c]
push edx
call fcn.004c96f0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fb4a0
Capabilities:
Get geographical location

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
push 0
push 0x400
push esi
push edi
call fcn.0051e2c0
mov dword [esp + 0x10], eax
mov ecx, esi
cdq
mov ebp, eax
mov eax, edi
sub eax, ebp
push 0
sbb ecx, edx
push 0x400
push ecx
push eax
mov dword [esp + 0x30], edx
call fcn.0051e210
mov ebx, eax
and ebx, 0x800003ff
jns 0x4fb4f0
dec ebx
or ebx, 0xfffffc00
inc ebx
mov eax, ebx
mov ecx, edi
shl eax, 0xa
cdq
sub ecx, eax
mov eax, esi
sbb eax, edx
sub ecx, ebp
mov ebp, dword [esp + 0x20]
push 0
sbb eax, ebp
push 0x100000
push eax
push ecx
call fcn.0051e210
mov ebp, eax
and ebp, 0x800003ff
jns 0x4fb526
dec ebp
or ebp, 0xfffffc00
inc ebp
push 0
push 0x40000000
push esi
push edi
call fcn.0051e210
lea ecx, [esp + 0x1c]
push 3
push ecx
mov esi, eax
push 0xe
push 0x400
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x4fb57a
mov edi, 0x59a5b0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x4fb61a
cmp ebp, 0x3e7
jg 0x4fb61a
test ebp, ebp
jne 0x4fb5f2
cmp ebx, 0x3e7
jg 0x4fb5f2
test ebx, ebx
je 0x4fb5ca
mov eax, dword [esp + 0x10]
mov ecx, dword [0x5bafd8]
push ecx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
and edx, 0x3ff
add eax, edx
lea edx, [esp + 0x20]
sar eax, 0xa
push eax
push edx
push ebx
jmp 0x4fb642
mov ecx, dword [0x5bafd4]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
push ecx
push edx
push str._d___s
push eax
call fcn.0051d0e8
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
lea eax, [ebx + ebx*4]
mov ecx, dword [0x5bafdc]
push ecx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
and edx, 0x3ff
add eax, edx
lea edx, [esp + 0x20]
sar eax, 0xa
push eax
push edx
push ebp
jmp 0x4fb642
lea ebp, [ebp + ebp*4]
mov ecx, dword [0x5bafe0]
push ecx
lea eax, [ebp + ebp*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
and edx, 0x3ff
add eax, edx
lea edx, [esp + 0x20]
sar eax, 0xa
push eax
push edx
push esi
mov eax, dword [esp + 0x34]
push str._d_s_03d___s
push eax
call fcn.0051d0e8
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x4fbd20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [0x5ba8bc]
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push ecx
push 0
push 0
push str.PrgrDlgVisiblity
push edx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
neg eax
sbb eax, eax
not eax
and eax, ecx
add esp, 8
ret

Function at 0x4fbd60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [0x5ba8bc]
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push ecx
push 0
push 0
push str.ComplDlgShowing
push edx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, 1
jne 0x4fbd98
mov eax, dword [esp + 4]
add esp, 8
ret
Function at 0x4fd720
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
test ecx, ecx
jle 0x4fd746
push ebx
mov bl, byte [eax + edx]
xor bl, 0xf
mov byte [eax + edx], bl
inc eax
cmp eax, ecx
jl 0x4fd737
pop ebx
ret
Function at 0x4fdc40
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push ebx
push esi
mov esi, ecx
push eax
call fcn.0051dd2e
lea ecx, [esp + 0xc]
push ecx
call fcn.0051f070
add esp, 8
lea edx, [eax + 0x14]
add eax, 4
lea ebx, [esi + 0x3c]
push edx
push eax
push str._.15s__.4s
push ebx
call fcn.0051d0e8
mov eax, dword [esi + 0x19c]
add esp, 0x10
test eax, eax
je 0x4fdc94
push eax
call fcn.005380ca
add esp, 4
mov dword [esi + 0x19c], 0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4fdce8
mov ecx, dword [esi + 0x3a8]
test ecx, ecx
jne 0x4fdcb2
push eax
mov ecx, esi
call fcn.004ffed0
test al, al
je 0x4fdce8
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push ebx
push 1
push eax
mov eax, dword [esi + 0x3a8]
push str.lastTryDate
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esi + 0x3a8]
push str.lastResult
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x4fdcf0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push ebx
push esi
mov esi, ecx
push eax
call fcn.0051dd2e
lea ecx, [esp + 0xc]
push ecx
call fcn.0051f070
add esp, 8
lea edx, [eax + 0x14]
add eax, 4
lea ebx, [esi + 0x6c]
push edx
push eax
push str._.15s__.4s
push ebx
call fcn.0051d0e8
mov eax, dword [esp + 0x28]
add esp, 0x10
test eax, eax
je 0x4fdd69
mov ecx, dword [esi + 0x3a8]
test ecx, ecx
jne 0x4fdd45
push eax
mov ecx, esi
call fcn.004ffed0
test al, al
je 0x4fdd69
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push ebx
push 1
push eax
mov eax, dword [esi + 0x3a8]
push str.dateAdded
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x4fdd80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a790
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x83c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
test ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
je 0x4fde30
mov eax, dword [esi + 0x19c]
test eax, eax
je 0x4fddca
push eax
call fcn.005380ca
add esp, 4
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.005380a1
mov edx, eax
add esp, 4
test edx, edx
mov dword [esi + 0x19c], edx
jne 0x4fde0e
push str.URL::set_lastResult__:_Not_enough_memory__n
mov ecx, esi
call fcn.004fdc20
mov eax, 0x753b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4fdf66
push eax
lea edx, [ebp - 0x48]
push str.SoftwareDownloadManager_ld
push edx
call fcn.0051d0e8
mov eax, dword [ebp + 0x14]
add esp, 0xc
test eax, eax
je 0x4fde9f
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x48]
push eax
push 0xf003f
push 0
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x4fdec6
lea edx, [ebp - 0x18]
lea eax, [ebp + 0xc]
push edx
push eax
push 0
push 0xf003f
push 0
push 0x5ba440
lea ecx, [ebp - 0x48]
push 0
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4fdf66
test ebx, ebx
je 0x4fdf3d
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x7ff
jbe 0x4fdf18
push 0x7ff
lea edx, [ebp - 0x848]
push ebx
push edx
call fcn.0051ca70
mov ecx, dword [ebp + 0xc]
add esp, 0xc
lea eax, [ebp - 0x848]
mov byte [ebp - 0x49], 0
push 0x801
push eax
push 1
push 0
push str.lastResult
push ecx
jmp 0x4fdf37
mov edx, dword [esi + 0x19c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [ebp + 0xc]
push 1
push eax
push str.lastResult
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0x10]
push 4
push ecx
push 4
push 0
push str.dwnlrs
push edx
mov dword [ebp + 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4fed60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a7e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x10], esp
test eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
je 0x4fed9d
push eax
call fcn.005380ca
add esp, 4
mov esi, dword [ebp + 8]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x4fedc4
mov dword [ebx + 0x20], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.005380a1
mov edx, eax
add esp, 4
test edx, edx
mov dword [ebx + 0x20], edx
jne 0x4fee05
push str.URL::set_LastModified__:_Not_enough_memory__n
mov ecx, ebx
call fcn.004fdc20
mov eax, 0x753b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 0xc]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jne 0x4fee3e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebx + 0x3a8]
test ecx, ecx
jne 0x4fee6c
push eax
mov ecx, ebx
call fcn.004ffed0
test al, al
jne 0x4fee6c
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebx + 0x20]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebx + 0x3a8]
push edx
push 1
push eax
push str.LastModified
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ff380
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a810
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x3a8]
mov dword [ebp - 0x10], esp
test eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
jne 0x4ff3df
mov eax, dword [ebp + 8]
push eax
call fcn.004ffed0
test al, al
jne 0x4ff3df
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0x3a8]
lea ecx, [ebp + 8]
lea edx, [ebp - 0x118]
push ecx
push edx
push 0
push 0
push str.LocalPath
push eax
mov dword [ebp + 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4ff423
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x118]
push ecx
call fcn.0051f193
add esp, 4
test eax, eax
je 0x4ff44e
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x4ff45e
push eax
call fcn.005380ca
add esp, 4
lea edi, [ebp - 0x118]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.005380a1
mov edx, eax
add esp, 4
test edx, edx
mov dword [ebx + 0x2c], edx
jne 0x4ff4a3
push str.URL::set_localPath__:_Not_enough_memory__n
mov ecx, ebx
call fcn.004fdc20
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edi, [ebp - 0x118]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x118]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x3a8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp + 8]
mov edi, 0x104
push ecx
push edx
push 0
push 0
push str.LocalFileName
push eax
mov dword [ebp + 8], edi
call esi
test eax, eax
je 0x4ff50d
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x118]
push ecx
mov ecx, ebx
call fcn.004ff9c0
test eax, eax
je 0x4ff537
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebx + 0x3a8]
lea edx, [ebp + 8]
lea eax, [ebp - 0x118]
push edx
push eax
push 0
push 0
push str.LogFileName
push ecx
mov dword [ebp + 8], edi
call esi
test eax, eax
je 0x4ff573
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebx + 0x3a0]
lea edi, [ebp - 0x118]
or ecx, 0xffffffff
xor eax, eax
add edx, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x500000
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi + 0x318], eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x500059
mov ecx, dword [esi + 0x3a8]
test ecx, ecx
jne 0x50002b
push eax
mov ecx, esi
call fcn.004ffed0
test al, al
je 0x500059
mov edx, dword [esi + 0x318]
mov eax, dword [esi + 0x3a8]
xor ecx, ecx
push 4
test edx, edx
lea edx, [esp + 0xc]
push edx
push 4
push 0
push str.needER
setne cl
push eax
mov dword [esp + 0x20], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 8
Function at 0x500330
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x198
push ebx
push esi
lea eax, [esp + 8]
push edi
mov ebx, ecx
push eax
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x5004cd
mov eax, dword [esp + 0x1c]
cmp eax, 2
jne 0x50036d
lea edx, [esp + 0xa0]
mov edi, str.security.dll
jmp 0x500382
cmp eax, 1
jne 0x5004cd
lea edx, [esp + 0xa0]
mov edi, str.secur32.dll
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebx + 0x1f0]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jne 0x5003bd
lea ecx, [esp + 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebx + 0x1f0], eax
mov eax, dword [ebx + 0x1f0]
test eax, eax
je 0x5004cd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FreeCredentialsHandle
push eax
call esi
mov edx, dword [ebx + 0x1f0]
push str.QuerySecurityPackageInfoA
push edx
mov dword [ebx + 0x1f4], eax
call esi
mov dword [ebx + 0x1fc], eax
mov eax, dword [ebx + 0x1f0]
push str.AcquireCredentialsHandleA
push eax
call esi
mov ecx, dword [ebx + 0x1f0]
push str.FreeContextBuffer
push ecx
mov dword [ebx + 0x1f8], eax
call esi
mov edx, dword [ebx + 0x1f0]
push str.InitializeSecurityContextA
push edx
mov dword [ebx + 0x200], eax
call esi
mov dword [ebx + 0x204], eax
mov eax, dword [ebx + 0x1f0]
push str.CompleteAuthToken
push eax
call esi
mov ecx, dword [ebx + 0x1f0]
push str.EnumerateSecurityPackagesA
push ecx
mov dword [ebx + 0x208], eax
call esi
mov edx, dword [ebx + 0x1f0]
push str.DeleteSecurityContext
push edx
mov dword [ebx + 0x20c], eax
call esi
mov dword [ebx + 0x210], eax
mov eax, dword [ebx + 0x1f4]
test eax, eax
je 0x5004b6
mov eax, dword [ebx + 0x1fc]
test eax, eax
je 0x5004b6
mov eax, dword [ebx + 0x1f8]
test eax, eax
je 0x5004b6
mov eax, dword [ebx + 0x200]
test eax, eax
je 0x5004b6
mov eax, dword [ebx + 0x204]
test eax, eax
je 0x5004b6
mov eax, dword [ebx + 0x20c]
test eax, eax
je 0x5004b6
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x198
ret
mov eax, dword [ebx + 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebx + 0x1f0], 0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x198
ret