joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f81e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x170
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
xor ebx, ebx
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jb 0x4f8243
call fcn.004f97a0
test eax, eax
je 0x4f82ad
mov eax, dword [0x5bbc68]
shr eax, 2
and eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052151a
add esp, 0x170
ret
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 1
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
je 0x4f82ad
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 3
call fcn.004faaa0
test eax, eax
je 0x4f82a6
cmp dword [esp + 0x2c], ebx
je 0x4f82a6
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x174]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0052151a
add esp, 0x170
ret

Function at 0x4f82d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x170
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
xor ebx, ebx
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jb 0x4f8333
call fcn.004f97a0
test eax, eax
je 0x4f839d
mov eax, dword [0x5bbc68]
shr eax, 3
and eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052151a
add esp, 0x170
ret
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 1
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
je 0x4f839d
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 2
call fcn.004faaa0
test eax, eax
je 0x4f8396
cmp dword [esp + 0x2c], ebx
je 0x4f8396
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x174]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0052151a
add esp, 0x170
ret
Function at 0x4f83c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
jae 0x4f8409
mov eax, DirectSoundEnumerateW
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0052151a
add esp, 0x118
ret 8
cmp dword [0x5b7090], 0
push esi
mov esi, DirectSoundEnumerateW
jne 0x4f8462
mov eax, 0x5b6df8
lea ecx, [ecx]
mov dword [eax], 0
add eax, 8
cmp eax, 0x5b6e98
jl 0x4f8420
mov dword [0x5bbc94], 0x4f8550
mov dword [0x5bbccc], 0
call fcn.004f9f00
mov dword [0x5bbd30], 0x4f86f0
mov dword [0x5bbd60], 0
call fcn.004fa9f0
xor eax, eax
cmp dword [eax*8 + 0x5b6df8], 0
je 0x4f8478
add eax, 1
cmp eax, 0x14
jl 0x4f8464
jmp 0x4f849d
mov ecx, dword [esp + 0x120]
mov edx, dword [esp + 0x124]
add dword [0x5b7090], 1
mov dword [eax*8 + 0x5b6df8], ecx
mov dword [eax*8 + 0x5b6dfc], edx
xor esi, esi
mov ecx, dword [esp + 0x118]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0052151a
add esp, 0x118
ret 8

Function at 0x4f84c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
mov eax, DirectSoundEnumerateW
jb 0x4f853a
xor edx, edx
xor ecx, ecx
cmp dword [ecx*8 + 0x5b6df8], esi
je 0x4f851c
add ecx, 1
cmp ecx, 0x14
jl 0x4f84f6
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0052151a
add esp, 0x118
ret
sub dword [0x5b7090], 1
mov dword [ecx*8 + 0x5b6df8], edx
jne 0x4f8538
mov dword [0x5bbc94], edx
mov dword [0x5bbd30], edx
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0052151a
add esp, 0x118
ret

Function at 0x4f8740
Capabilities:
Check os version

Disassembly:
sub esp, 0x170
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
xor ebx, ebx
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jb 0x4f87a0
call fcn.004f97a0
test eax, eax
je 0x4f8803
mov eax, dword [0x5bbc68]
and eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052151a
add esp, 0x170
ret
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 1
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
je 0x4f8803
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], ebx
call fcn.004faaa0
test eax, eax
je 0x4f87fc
cmp dword [esp + 0x2c], ebx
je 0x4f87fc
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x174]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0052151a
add esp, 0x170
ret
Function at 0x4f8820
Capabilities:
Check os version

Disassembly:
sub esp, 0x170
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
xor ebx, ebx
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jb 0x4f8882
call fcn.004f97a0
test eax, eax
je 0x4f88e8
mov eax, dword [0x5bbc68]
shr eax, 1
and eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052151a
add esp, 0x170
ret
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 1
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
je 0x4f88e8
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], edi
call fcn.004faaa0
test eax, eax
je 0x4f88e1
cmp dword [esp + 0x2c], ebx
je 0x4f88e1
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x174]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0052151a
add esp, 0x170
ret

Function at 0x4f8910
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x16c
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jae 0x4f89c3
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 1
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
je 0x4f89ac
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], ebx
call fcn.004faaa0
test eax, eax
je 0x4f89a5
cmp dword [esp + 0x30], ebx
je 0x4f89a5
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052151a
mov esp, ebp
pop ebp
ret
mov al, byte [0x5bbc68]
mov ecx, dword [esp + 0x174]
and al, 1
neg al
pop edi
pop esi
pop ebx
sbb eax, eax
and eax, dword [0x5bbc54]
xor ecx, esp
call fcn.0052151a
mov esp, ebp
pop ebp
ret
Function at 0x4f89f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x16c
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jae 0x4f8aa3
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, 1
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
je 0x4f8a8c
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], esi
call fcn.004faaa0
test eax, eax
je 0x4f8a85
cmp dword [esp + 0x30], ebx
je 0x4f8a85
mov ebx, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052151a
mov esp, ebp
pop ebp
ret
mov al, byte [0x5bbc68]
mov ecx, dword [esp + 0x174]
and al, 2
neg al
pop edi
pop esi
pop ebx
sbb eax, eax
and eax, dword [0x5bbc58]
xor ecx, esp
call fcn.0052151a
mov esp, ebp
pop ebp
ret

Function at 0x4f8ad0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x16c
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jae 0x4f8b8b
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 1
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
je 0x4f8b74
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 3
call fcn.004faaa0
test eax, eax
je 0x4f8b6d
cmp dword [esp + 0x30], ebx
je 0x4f8b6d
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052151a
mov esp, ebp
pop ebp
ret
mov al, byte [0x5bbc68]
mov ecx, dword [esp + 0x174]
and al, 4
neg al
pop edi
pop esi
pop ebx
sbb eax, eax
and eax, dword [0x5bbc5c]
xor ecx, esp
call fcn.0052151a
mov esp, ebp
pop ebp
ret
Function at 0x4f8bc0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x16c
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push esi
push edi
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jae 0x4f8c7b
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..AndreaFilterRealtek
mov dword [esp + 0x28], vtable.CDriverCtrl.0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 1
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
je 0x4f8c64
lea ecx, [esp + 0x24]
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 2
call fcn.004faaa0
test eax, eax
je 0x4f8c5d
cmp dword [esp + 0x30], ebx
je 0x4f8c5d
mov ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0052151a
mov esp, ebp
pop ebp
ret
mov al, byte [0x5bbc68]
mov ecx, dword [esp + 0x174]
and al, 8
neg al
pop edi
pop esi
pop ebx
sbb eax, eax
and eax, dword [0x5bbc60]
xor ecx, esp
call fcn.0052151a
mov esp, ebp
pop ebp
ret

Function at 0x4f8cb0
Capabilities:
Check os version

Disassembly:
sub esp, 0x174
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x16c], eax
push esi
push edi
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jae 0x4f8d66
xor edi, edi
push edi
push edi
push 3
push edi
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x40], edi
je 0x4f8d4d
push edi
lea ecx, [esp + 0x10]
push ecx
push edi
push edi
push 0x34
lea edx, [esp + 0x24]
push edx
push 0x222000
push esi
mov dword [esp + 0x2c], 0x34
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [0x5bbd64]
push edi
push edi
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x16c]
xor ecx, esp
call fcn.0052151a
add esp, 0x174
ret
test byte [0x5bbc68], 1
je 0x4f8d8e
mov ecx, 0x11
mov esi, 0x5bbc50
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x10]
mov dword [esp + 0x14], ebx
call fcn.004f94b0
jmp 0x4f8d90
xor eax, eax
mov ecx, dword [esp + 0x174]
neg eax
sbb eax, eax
pop edi
and eax, 0x80000000
pop esi
xor ecx, esp
add eax, 0x80000000
call fcn.0052151a
add esp, 0x174
ret
Function at 0x4f8dc0
Capabilities:
Check os version

Disassembly:
sub esp, 0x158
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x154], eax
push esi
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x40], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x40], 6
jae 0x4f8e7a
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 8], 1
mov dword [esp + 0x14], edi
je 0x4f8e62
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x34
lea edx, [esp + 0x1c]
push edx
push 0x222000
push esi
mov dword [esp + 0x24], 0x34
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [0x5bbd64]
push 0
push 0
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x154]
xor ecx, esp
call fcn.0052151a
add esp, 0x158
ret
mov eax, edi
call fcn.004f9410
mov ecx, dword [esp + 0x158]
neg eax
sbb eax, eax
and eax, 0x80000000
pop esi
xor ecx, esp
add eax, 0x80000000
call fcn.0052151a
add esp, 0x158
ret

Function at 0x4f8eb0
Capabilities:
Check os version

Disassembly:
sub esp, 0x158
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x154], eax
push esi
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x40], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x40], 6
jae 0x4f8f6a
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 8], 3
mov dword [esp + 0x14], edi
je 0x4f8f52
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x34
lea edx, [esp + 0x1c]
push edx
push 0x222000
push esi
mov dword [esp + 0x24], 0x34
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [0x5bbd64]
push 0
push 0
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x154]
xor ecx, esp
call fcn.0052151a
add esp, 0x158
ret
mov eax, edi
call fcn.004f9460
mov ecx, dword [esp + 0x158]
neg eax
sbb eax, eax
and eax, 0x80000000
pop esi
xor ecx, esp
add eax, 0x80000000
call fcn.0052151a
add esp, 0x158
ret
Function at 0x4f8fa0
Capabilities:
Check os version

Disassembly:
sub esp, 0x174
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x16c], eax
push esi
push edi
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x5c], 6
jae 0x4f905c
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..AndreaFilterRealtek
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], 2
mov dword [esp + 0x1c], ebx
je 0x4f9043
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x34
lea edx, [esp + 0x24]
push edx
push 0x222000
push esi
mov dword [esp + 0x2c], 0x34
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [0x5bbd64]
push 0
push 0
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x16c]
xor ecx, esp
call fcn.0052151a
add esp, 0x174
ret
test byte [0x5bbc68], 8
je 0x4f9084
mov ecx, 0x11
mov esi, 0x5bbc50
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x10]
mov dword [esp + 0x20], ebx
call fcn.004f94b0
jmp 0x4f9086
xor eax, eax
mov ecx, dword [esp + 0x174]
neg eax
sbb eax, eax
pop edi
and eax, 0x80000000
pop esi
xor ecx, esp
add eax, 0x80000000
call fcn.0052151a
add esp, 0x174
ret
Function at 0x4f9260
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x94
push esi
lea eax, [esp + 8]
push eax
push 0x20119
xor esi, esi
push esi
push 0x5844bc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4f9403
push edi
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push esi
push str.CapProperties
mov edi, 0x44
push ecx
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4f92d7
cmp dword [esp + 8], edi
jne 0x4f92d7
cmp dword [esp + 0x14], 0xaeaeaeae
jne 0x4f92d7
test dword [esp + 0x2c], 0xfffffee0
jne 0x4f92d7
lea esi, [edi - 0x43]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4f9402
mov ecx, 0x11
mov esi, ebx
lea edi, [esp + 0x58]
rep movsd dword es:[edi], dword [esi]
push 0
mov ecx, 0x11
lea esi, [esp + 0x18]
mov edi, ebx
push 0xffffffffffffffff
rep movsd dword es:[edi], dword [esi]
push str.LoadFiltersInfo_successful
mov ecx, ebx
call fcn.004f9870
cmp dword [esp + 0xa0], 0
je 0x4f9402
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x4f9402
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x5c]
je 0x4f9340
mov edx, dword [ebx + 0x7c]
push edx
push ecx
push 0
call eax
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x60]
je 0x4f9356
mov ecx, dword [ebx + 0x7c]
mov edx, dword [ebx + 0x44]
push ecx
push eax
push 1
call edx
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x64]
je 0x4f936c
mov ecx, dword [ebx + 0x7c]
mov edx, dword [ebx + 0x44]
push ecx
push eax
push 2
call edx
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x68]
je 0x4f9382
mov ecx, dword [ebx + 0x7c]
mov edx, dword [ebx + 0x44]
push ecx
push eax
push 3
call edx
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x6c]
je 0x4f9398
mov ecx, dword [ebx + 0x7c]
mov edx, dword [ebx + 0x44]
push ecx
push eax
push 4
call edx
mov eax, dword [esp + 0x34]
cmp eax, dword [esp + 0x78]
je 0x4f93ae
mov ecx, dword [ebx + 0x7c]
mov edx, dword [ebx + 0x44]
push ecx
push eax
push 6
call edx
mov eax, dword [esp + 0x38]
cmp eax, dword [esp + 0x7c]
je 0x4f93c4
mov ecx, dword [ebx + 0x7c]
mov edx, dword [ebx + 0x44]
push ecx
push eax
push 7
call edx
mov eax, dword [esp + 0x3c]
cmp eax, dword [esp + 0x80]
je 0x4f93e9
mov esi, ebx
call fcn.004f9e70
test eax, eax
je 0x4f93e9
mov ecx, dword [ebx + 0x7c]
mov edx, dword [ebx + 0x44]
push ecx
push 0
push 8
call edx
mov eax, dword [esp + 0x40]
cmp eax, dword [esp + 0x84]
je 0x4f9402
mov ecx, dword [ebx + 0x7c]
mov edx, dword [ebx + 0x44]
push ecx
push eax
push 9
call edx
pop edi
pop esi
add esp, 0x94
ret 4
Function at 0x4f94b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
xor esi, esi
mov dword [edi], 0xaeaeaeae
cmp dword [0x5bbca4], esi
jne 0x4f94d4
mov ecx, edi
call fcn.004f9560
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea eax, [esp + 8]
push eax
push 0
push 0x102
push 0
push 0
push 0
push 0x5844bc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4f9542
mov ecx, dword [esp + 4]
push 0x44
push edi
push 3
push eax
push str.CapProperties
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4f9519
lea esi, [eax + 1]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4f9542
push 0
push 0xffffffffffffffff
push str.WriteRegistry_successful
mov ecx, 0x5bbc50
call fcn.004f9870
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0xffffffffffffffff
push str.WriteRegistry_failed
mov ecx, 0x5bbc50
call fcn.004f9870
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4f9560
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x9c
mov eax, dword [0x5ab720]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push ebp
push esi
push edi
push 1
push 0xffffffffffffffff
mov esi, ecx
push str.Start_WriteService
mov ecx, 0x5bbc50
xor ebp, ebp
call fcn.004f9870
call fcn.004f9640
mov ebx, eax
test ebx, ebx
jne 0x4f95ad
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004f9640
mov ebx, eax
test ebx, ebx
je 0x4f9607
push 0
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x20], 0xae0ae0ae
mov dword [esp + 0x24], 1
mov ecx, 0x11
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
push 0x88
lea ecx, [esp + 0x24]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4f95f1
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x4f9607
push 0
push 0xffffffffffffffff
push str.WriteService_successful
jmp 0x4f9610
push 0
push 0xffffffffffffffff
push str.WriteService_failed
mov ecx, 0x5bbc50
call fcn.004f9870
mov ecx, dword [esp + 0xa4]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.0052151a
add esp, 0x9c
ret