joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5089f0
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52467b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x53120c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x208
lea eax, [ebp - 0x218]
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x508a30
push ecx
push 0x2a
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x508b71
mov ebx, 0x531150
nop dword [eax]
call fcn.005048a0
test eax, eax
je 0x508b8d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x21c]
call fcn.00506850
test al, al
jne 0x508ac5
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x508aa3
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00504b10
push 0x1a
push str.VAIOVAIO_Control_Center_
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 1
call fcn.00506760
mov edx, dword [ebx]
test edx, edx
jne 0x508ae8
xor eax, eax
jmp 0x508aff
mov eax, edx
lea esi, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x508af0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x21c]
call fcn.00506760
mov esi, dword [ebp - 0x21c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x508b43
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push str.DllRegisterServer
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x508b38
call eax
test edi, edi
je 0x508b43
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x508b62
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 4
cmp ebx, 0x5311b0
jl 0x508a60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050f225
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.005046e0
int3
Function at 0x508ba0
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5246d6
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x53120c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x208
lea eax, [ebp - 0x218]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x508be0
push ecx
push 0x2a
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x508d48
call fcn.005048a0
mov ecx, eax
test ecx, ecx
je 0x508d63
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x21c]
call fcn.00506850
test al, al
jne 0x508c69
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x508c47
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00504b10
push 0x24
push str.VAIOVAIO_Control_CenterVESMgr.exe
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 1
call fcn.00506760
mov esi, dword [ebp - 0x21c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
or edi, 0xffffffff
test eax, eax
je 0x508d2c
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push str._c__
push eax
call fcn.005065d0
add esp, 0xc
push 1
push 0x526e98
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 2
call fcn.00506760
push 9
push str.__Service
lea ecx, [ebp - 0x220]
call fcn.00506760
push 0xb
push str.__AutoStart
lea ecx, [ebp - 0x220]
call fcn.00506760
push 0
push 0
push dword [ebp - 0x220]
push 0x526ec8
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x220]
mov eax, edi
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x508d2c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x508d48
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050f225
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.005046e0
int3
Function at 0x508d70
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52471b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x53120c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x208
lea eax, [ebp - 0x218]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x508db0
push ecx
push 0x2a
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x508ea8
call fcn.005048a0
mov ecx, eax
test ecx, ecx
je 0x508ec3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x21c]
call fcn.00506850
test al, al
jne 0x508e39
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x508e17
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00504b10
push 0x38
push str.Common_FilesVAIO_SharedVAIO_UtilitiesVSLProxyCOM.dll
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 1
call fcn.00506760
mov esi, dword [ebp - 0x21c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x508e89
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push str.DllRegisterServer
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x508e7e
call eax
test edi, edi
je 0x508e89
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x508ea8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050f225
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.005046e0
int3
Function at 0x508ee0
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5246d6
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x53120c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x208
lea eax, [ebp - 0x218]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x508f20
push ecx
push 0x2a
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x509076
call fcn.005048a0
mov ecx, eax
test ecx, ecx
je 0x509091
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x21c]
call fcn.00506850
test al, al
jne 0x508fa9
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x508f87
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00504b10
push 0x3b
push str.VAIOVAIO_Control_CenterNetworkSettingNetworkSupport.exe
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 1
call fcn.00506760
mov esi, dword [ebp - 0x21c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
or edi, 0xffffffff
test eax, eax
je 0x50905a
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push str._c__
push eax
call fcn.005065d0
add esp, 0xc
push 1
push 0x526e98
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 2
call fcn.00506760
push 9
push str.__Service
lea ecx, [ebp - 0x220]
call fcn.00506760
push 0
push 0
push dword [ebp - 0x220]
push 0x526ec8
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x220]
mov eax, edi
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x50905a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x509076
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050f225
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.005046e0
int3
Function at 0x5090a0
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524631
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x53120c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.005048a0
mov ecx, eax
test ecx, ecx
je 0x509297
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
push 0x526e30
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0
call fcn.00506850
test al, al
jne 0x509118
push 0xd
push 0x526e30
lea ecx, [ebp - 0x220]
call fcn.00504b10
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
mov ecx, 0x208
nop word [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x509130
push ecx
push 0x2a
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
or ebx, 0xffffffff
test eax, eax
je 0x509259
mov edi, 0x5311b0
nop dword [eax]
call fcn.005048a0
test eax, eax
je 0x509297
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x21c]
call fcn.00506850
test al, al
jne 0x5091c2
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5091a0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00504b10
push 0x1a
push str.VAIOVAIO_Control_Center_
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 3
call fcn.00506760
mov edx, dword [edi]
test edx, edx
jne 0x5091e2
xor eax, eax
jmp 0x5091f6
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5091e7
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x21c]
call fcn.00506760
push 0
push 0x525a80
lea ecx, [ebp - 0x21c]
call fcn.00506760
mov esi, dword [ebp - 0x21c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x50922f
push esi
call fcn.00512e3d
add esp, 4
mov byte [ebp - 4], 1
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x50924a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 4
cmp edi, 0x5311b8
jl 0x509160
mov edx, dword [ebp - 0x220]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x50927b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050f225
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.005046e0
int3
Function at 0x50a880
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa14
mov eax, dword [0x53120c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov ebx, ecx
mov dword [ebp - 0xa14], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x50a8eb
push 1
lea ecx, [ebx + 0x40]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x50a8db
push eax
mov dword [ebp - 0xa14], 1
call esi
push edi
call esi
cmp dword [ebp - 0xa14], 0
jne 0x50aa35
push 0x104
lea eax, [ebp - 0x20e]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x50a9a6
cmp eax, 0x104
je 0x50a9a6
mov ecx, 0x22
mov word [ebp - 0x210], cx
mov word [ebp + eax*2 - 0x20e], cx
lea eax, [eax*2 + 4]
cmp eax, 0x20c
jae 0x50aa4b
xor ecx, ecx
push 0xf003f
push ecx
push ecx
mov word [ebp + eax - 0x210], cx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x50a9b9
push 0x400
lea eax, [ebp - 0xa10]
push eax
push 0xd80a
call fcn.0050a080
add esp, 0xc
test eax, eax
jne 0x50a991
push str.Could_not_open_Service_Manager
lea eax, [ebp - 0xa10]
push 0x400
push eax
call fcn.005156dd
push eax
call fcn.00504640
add esp, 0x10
push 0
lea eax, [ebx + 0x40]
push eax
lea eax, [ebp - 0xa10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050f225
mov esp, ebp
pop ebp
ret
push 0
push 0
push str.RPCSS
push 0
push 0
lea eax, [ebp - 0x210]
add ebx, 0x40
push eax
push 1
push 3
push 0x10
push 0xf01ff
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x50aa2f
push edi
call esi
push 0x400
lea eax, [ebp - 0xa10]
push eax
push 0xd80b
call fcn.0050a080
add esp, 0xc
test eax, eax
jne 0x50aa27
push str.Could_not_start_service
lea eax, [ebp - 0xa10]
push 0x400
push eax
call fcn.005156dd
push eax
call fcn.00504640
add esp, 0x10
push 0
push ebx
jmp 0x50a997
push eax
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050f225
mov esp, ebp
pop ebp
ret
call fcn.0050f49b
int3
Function at 0x50aa60
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x53120c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push 0xff
push 0x100
push eax
call fcn.00509410
push dword [eax + 4]
push dword [eax]
call fcn.0051550a
xor eax, eax
add esp, 0x20
cmp dword [esi + 0x260], 0
mov word [ebp - 6], ax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
jne 0x50aac7
push eax
call fcn.005158ff
add esp, 4
lea eax, [esi + 0x40]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x50aafc
push 0
lea eax, [ebp - 0x208]
push eax
push 0
push 1
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0050f225
mov esp, ebp
pop ebp
ret

Function at 0x50b6a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x53120c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov dword [ebp - 0x210], 0
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x218]
push edi
push edx
mov edi, dword [eax + 4]
or edi, 0x2001f
mov dword [ebp - 0x220], eax
push edi
push 0
push ecx
push dword [eax]
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [ebp - 0x210]
test esi, esi
jne 0x50b801
xor esi, esi
test eax, eax
je 0x50b72c
push eax
call ebx
mov esi, eax
mov eax, dword [ebp - 0x218]
and edi, 0x300
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x20c], edi
test esi, esi
jne 0x50b801
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x228]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], 0x100
push ecx
lea ecx, [ebp - 0x204]
push ecx
push esi
push eax
call edi
test eax, eax
jne 0x50b7c7
nop dword [eax]
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x210]
call fcn.0050b6a0
mov esi, eax
test esi, esi
jne 0x50b7fb
lea eax, [ebp - 0x228]
mov dword [ebp - 0x214], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x210]
call edi
test eax, eax
je 0x50b780
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x50b7de
push eax
call ebx
mov dword [ebp - 0x210], 0
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x20c], 0
call fcn.0050a790
mov esi, eax
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x50b808
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050f225
mov esp, ebp
pop ebp
ret 4
Function at 0x50b820
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, ecx
call fcn.0050cad0
test eax, eax
jne 0x50b83e
mov eax, 0x80004005
pop edi
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], str.APPID
push eax
push 1
push 0x65
push dword [0x531e48]
mov dword [ebp - 0x18], str.187621eb_d0b5_425f_9bb2_8db3e9c8cfa1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.0050cfd0
test eax, eax
js 0x50b96d
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20006
push 0
push str.AppID
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x50b95f
mov ebx, dword [ebp - 4]
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.187621eb_d0b5_425f_9bb2_8db3e9c8cfa1
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x50b92f
mov esi, dword [ebp - 8]
push str.LocalService
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [ebp + 8], 0
jne 0x50b8e5
xor edi, edi
jmp 0x50b93c
lea edx, [edi + 0x40]
test edx, edx
je 0x50b91d
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 8], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x50b8f4
sub ecx, dword [ebp + 8]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.LocalService
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, edi
call fcn.0050a880
test eax, eax
jne 0x50b8e1
mov edi, 0x80004005
jmp 0x50b93c
push eax
call fcn.0050a060
add esp, 4
mov edi, eax
xor esi, esi
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x50b94d
push esi
call eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
test ebx, ebx
je 0x50b96a
push ebx
call eax
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
push eax
call fcn.0050a060
add esp, 4
mov edi, eax
mov eax, edi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x50bb20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52489b
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x53120c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x50bbcc
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x50bbcc
call fcn.0050a040
mov edi, eax
jmp 0x50bceb
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x50bbef
call fcn.0050a040
jmp 0x50bcde
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x50bc0d
call fcn.0050a040
jmp 0x50bcde
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x50bc2e
mov edi, 0x8007000e
jmp 0x50bce0
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x50bd24
jb 0x50bc4c
cmp eax, 0xffffffff
ja 0x50bd24
cmp eax, 0x400
jbe 0x50bc61
push eax
lea ecx, [ebp - 0x418]
call fcn.00509d00
jmp 0x50bc87
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x50bc87
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x50bc9e
mov edi, 0x8007000e
jmp 0x50bce0
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x50bcbe
call fcn.0050a040
jmp 0x50bcde
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0050b980
mov edi, eax
test esi, esi
je 0x50bceb
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x50bd04
lea ecx, [ebp - 0x418]
call fcn.0050a870
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0050f225
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.005046e0
int3
Function at 0x50c880
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x53120c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push str.AppID
push SysReAllocString
mov esi, ecx
mov dword [ebp - 0x214], 0
call edi
test eax, eax
jne 0x50ca5e
push ebx
mov ebx, dword [ebp - 0x214]
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x218]
push eax
push 0x20019
push 0
push str.187621eb_d0b5_425f_9bb2_8db3e9c8cfa1
push ebx
call edi
mov edi, eax
test edi, edi
jne 0x50ca2d
mov edi, dword [ebp - 0x218]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], edi
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x21c], 0x208
push eax
push 0
push str.LocalService
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x50c964
mov eax, dword [ebp - 0x220]
cmp eax, 1
je 0x50c943
cmp eax, 2
jne 0x50c95e
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x50c9b8
test al, 1
jne 0x50c95e
shr eax, 1
cmp word [ebp + eax*2 - 0x20e], 0
je 0x50c9c1
mov dword [ebp - 0x210], edi
push 0
push 0
mov dword [esi + 0x260], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov edi, eax
test edi, edi
jns 0x50c9a0
cmp edi, 0x80010106
jne 0x50c995
push str.Mscoree.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x50c9a4
mov eax, dword [ebp - 0x210]
jmp 0x50ca35
mov byte [esi + 0x3e], 1
push dword [ebp + 8]
mov ecx, esi
call fcn.0050e4c0
mov edi, eax
mov eax, dword [ebp - 0x210]
jmp 0x50ca2f
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [esi + 0x40]
mov dword [esi + 0x260], 0
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 0x210], edi
mov dword [esi + 0x260], 1
mov dword [ebp - 0x22c], 0x50d3b0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x50ca1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x250], eax
mov edi, dword [esi + 0x250]
mov eax, dword [ebp - 0x210]
jmp 0x50ca35
xor eax, eax
mov dword [esi + 0x250], edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x50ca42
push eax
call esi
test ebx, ebx
je 0x50ca49
push ebx
call esi
pop ebx
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050f225
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 0x250], eax
xor ecx, ebp
pop esi
call fcn.0050f225
mov esp, ebp
pop ebp
ret 4