joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c460
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4d2afc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x210], eax
je 0x48c4b1
mov ecx, dword [0x4c6444]
mov edx, dword [0x4c6448]
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], edx
mov dword [0x4c6444], 0x20119
mov dword [0x4c6448], 0x20106
push ebx
push esi
push edi
push 0x104
push str.Shell
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
lea ecx, [ebp - 0x108]
mov edx, 0x80000002
xor ebx, ebx
call fcn.0048e050
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x20c]
call fcn.00401000
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x108]
push ecx
call edi
test eax, eax
jle 0x48c571
xor ecx, ecx
test eax, eax
jle 0x48c56c
mov bl, 0x20
nop
cmp byte [ebp + ecx - 0x108], bl
je 0x48c520
inc ecx
cmp ecx, eax
jl 0x48c510
jmp 0x48c56c
lea edx, [ecx + 1]
cmp eax, edx
jne 0x48c538
lea eax, [ebp - 0x108]
mov byte [ebp + ecx - 0x108], 0
push eax
jmp 0x48c557
lea esi, [ebp + ecx - 0x107]
push esi
call edi
xor ecx, ecx
test eax, eax
jle 0x48c56c
cmp byte [ecx + esi], bl
jne 0x48c554
inc ecx
cmp ecx, eax
jl 0x48c548
jmp 0x48c56c
add ecx, esi
push ecx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x20c]
call fcn.00401000
mov ebx, 1
mov eax, dword [ebp - 0x210]
lea esi, [ebp - 0x20c]
mov edx, 0x104
sub esi, eax
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x48c59d
mov cl, byte [esi + eax]
test cl, cl
je 0x48c59d
mov byte [eax], cl
inc eax
dec edx
jne 0x48c584
jmp 0x48c5a1
test edx, edx
jne 0x48c5a2
dec eax
cmp dword [0x4d2afc], 0
mov byte [eax], 0
je 0x48c5c5
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x214]
mov dword [0x4c6444], edx
mov dword [0x4c6448], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
Function at 0x48dae0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
xor esi, esi
lea eax, [ebp - 0x11f]
push esi
push eax
mov dword [ebp - 0x344], 1
mov byte [ebp - 0x120], 0
call fcn.004a3190
add esp, 0xc
mov dword [ebp - 0x33c], 0x104
mov dword [ebp - 0x340], esi
cmp dword [0x4cd388], esi
je 0x48db3b
call fcn.0048ddc0
lea ecx, [ebp - 0x328]
push ecx
push 0x20019
push esi
push str.SoftwareBillP_StudiosWinPatrolNuts
push 0x80000001
mov dword [0x4cd388], esi
mov dword [ebp - 0x32c], 0x200
mov dword [ebp - 0x334], 0x10
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
je 0x48db89
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x360]
push edx
lea eax, [ebp - 0x350]
push eax
lea ecx, [ebp - 0x34c]
push ecx
lea edx, [ebp - 0x354]
push edx
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x358]
push ecx
lea edx, [ebp - 0x348]
push edx
lea eax, [ebp - 0x340]
push eax
mov eax, dword [ebp - 0x328]
push esi
lea ecx, [ebp - 0x33c]
push ecx
lea edx, [ebp - 0x120]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x330], esi
je 0x48dcce
mov dword [ebp - 0x324], esi
nop
lea ecx, [ebp - 0x334]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x344]
push eax
mov eax, dword [ebp - 0x324]
push 0
lea ecx, [ebp - 0x32c]
push ecx
mov ecx, dword [ebp - 0x328]
lea edx, [ebp - 0x320]
push edx
push eax
push ecx
mov dword [ebp - 0x32c], 0x200
mov dword [ebp - 0x334], 0x10
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edx, esi
inc esi
mov dword [ebp - 0x338], esi
cmp edx, dword [ebp - 0x330]
ja 0x48dcce
cmp eax, 0x103
je 0x48dcce
test eax, eax
jne 0x48dbf0
lea eax, [ebp - 0x14]
push eax
call fcn.004a02f9
add esp, 4
push 0x204
push 0x42
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
lea ecx, [ebp - 0x320]
push ecx
mov edx, 0x7ffffffe
mov eax, 0x200
mov ecx, edi
call fcn.00401000
mov edx, dword [0x4cd388]
mov dword [edi + 0x200], ebx
push esi
mov dword [edx*4 + 0x4c74a8], esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [ebp - 0x338]
mov eax, 1
add dword [0x4cd388], eax
add dword [ebp - 0x324], eax
jmp 0x48dbf0
mov eax, dword [ebp - 0x328]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [0x4cd388]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
Function at 0x48de00
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x11f]
push ebx
push eax
mov dword [ebp - 0x33c], 1
mov byte [ebp - 0x120], bl
call fcn.004a3190
add esp, 0xc
lea ecx, [ebp - 0x324]
push ecx
push 0x20019
push ebx
push str.SoftwareBillP_StudiosWinPatrolNuts
push 0x80000001
mov dword [ebp - 0x340], 0x104
mov dword [ebp - 0x338], ebx
mov dword [ebp - 0x32c], 0x200
mov dword [ebp - 0x334], 0x10
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x48df93
lea edx, [ebp - 0x35c]
push edx
lea eax, [ebp - 0x344]
push eax
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp - 0x350]
push edx
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x354]
push ecx
lea edx, [ebp - 0x34c]
push edx
lea eax, [ebp - 0x338]
push eax
mov eax, dword [ebp - 0x324]
push ebx
lea ecx, [ebp - 0x340]
push ecx
lea edx, [ebp - 0x120]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x330], ebx
je 0x48df86
mov dword [ebp - 0x328], ebx
xor esi, esi
mov edi, edi
lea ecx, [ebp - 0x334]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x33c]
push eax
mov eax, dword [ebp - 0x328]
push 0
lea ecx, [ebp - 0x32c]
push ecx
mov ecx, dword [ebp - 0x324]
lea edx, [ebp - 0x320]
push edx
push eax
push ecx
mov dword [ebp - 0x32c], 0x200
mov dword [ebp - 0x334], 0x10
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edx, esi
inc esi
cmp edx, dword [ebp - 0x330]
ja 0x48df86
cmp eax, 0x103
je 0x48df86
test eax, eax
jne 0x48def0
lea eax, [ebp - 0x14]
push eax
call fcn.004a02f9
add esp, 4
cmp eax, 2
jne 0x48df7b
lea eax, [ebp - 0x320]
mov edi, str.SoftwareBillP_StudiosWinPatrolNuts
mov ebx, 0x80000001
call fcn.0048e230
jmp 0x48def0
inc dword [ebp - 0x328]
jmp 0x48def0
mov ecx, dword [ebp - 0x324]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
Function at 0x48e050
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x80c]
push eax
push 0x20019
push 0
mov esi, edx
mov edx, dword [0x4c6444]
push edi
push esi
mov dword [ebp - 0x808], ecx
mov dword [ebp - 0x814], edx
mov byte [ebp - 0x404], 0
mov byte [ebp - 0x804], 0
mov dword [0x4c6444], 0x20019
call ebx
test eax, eax
je 0x48e10b
mov eax, dword [0x4c6444]
lea ecx, [ebp - 0x80c]
push ecx
or eax, 0x100
push eax
push 0
push edi
push esi
mov dword [0x4c6444], eax
call ebx
test eax, eax
je 0x48e10b
mov edx, dword [ebp - 0x808]
push 0x4b17de
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x814]
pop edi
pop esi
mov dword [0x4c6444], eax
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x814]
lea edx, [ebp - 0x81c]
push edx
mov edx, dword [ebp - 0x818]
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 0x80c]
mov dword [0x4c6444], ecx
lea ecx, [ebp - 0x810]
push ecx
push 0
push edx
push eax
mov dword [ebp - 0x81c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x48e182
mov ecx, dword [ebp - 0x80c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x808]
push 0x4b17de
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x810], 2
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
jne 0x48e1ba
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x804]
push ecx
call edi
push 0x3ff
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp dword [ebp - 0x810], 4
jne 0x48e1ca
mov byte [ebp - 0x404], 0
mov ecx, dword [ebp - 0x80c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jle 0x48e20c
mov eax, dword [ebp - 0x808]
push 0x4b17de
push eax
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x808]
lea ecx, [ebp - 0x404]
push ecx
push edx
call edi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
Function at 0x48e230
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jge 0x48e25f
mov esi, str.NULL
push str.RegDeleteValue_FALSE
call fcn.0047fb10
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [0x4d2afc], 0
je 0x48e316
lea eax, [esp + 4]
push eax
push 0xf023f
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48e2c1
mov ecx, dword [esp + 4]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x48e2b6
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.RegDeleteValue_KEY_WOW64_32KEY_TRUE
call fcn.0047fb10
add esp, 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 4]
push ecx
push 0xf013f
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48e36f
mov edx, dword [esp + 4]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x48e30f
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.RegDeleteValue_KEY_WOW64_64KEY_TRUE
call fcn.0047fb10
add esp, 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 4]
push ecx
jmp 0x48e369
mov eax, dword [0x4c6448]
lea edx, [esp + 4]
push edx
or eax, 2
push eax
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48e36f
mov ecx, dword [esp + 4]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x48e364
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.RegDeleteValue_KEY_SET_VALUE_TRUE
call fcn.0047fb10
add esp, 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.RegDeleteValue_FALSE
call fcn.0047fb10
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48e390
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x110], eax
mov eax, dword [0x4c6448]
mov edi, edx
lea edx, [ebp - 0x10c]
push edx
mov ebx, eax
or eax, 0xf003f
push eax
push 0
push esi
push edi
mov dword [ebp - 0x118], ecx
mov dword [0x4c6448], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x48e42f
mov edx, dword [0x4c6448]
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0
push edx
push 0
push 0
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x48e47e
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x4c6448]
lea eax, [ebp - 0x10c]
push eax
push ecx
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [ebp - 0x118]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x10c]
inc eax
push eax
push edi
mov edi, dword [ebp - 0x110]
push 1
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x48e4c9
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push edi
push esi
push str.RegSetValueEx___FAIL__key_s_s_gwsflag_x_
push 0x100
lea ecx, [ebp - 0x108]
push ecx
jmp 0x48e498
mov ecx, dword [ebp - 0x110]
push ebx
push ecx
push esi
push str.RegOpenKeyEx___FAIL__key_s_s_gwsflag_x_
push 0x100
lea edx, [ebp - 0x108]
push edx
mov dword [0x4c6448], ebx
call fcn.00402830
push str.SetRegValue
lea esi, [ebp - 0x108]
call fcn.0047fb10
add esp, 0x1c
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [0x4c6448], ebx
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
Function at 0x48e590
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x4c6448]
sub esp, 0xc
push edi
lea eax, [ebp - 4]
push eax
push ecx
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x48e600
mov edi, str.MyError:__SetRegDWORDValue_RegOpenKeyEx
call fcn.0049a100
mov ecx, dword [0x4c6448]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 8]
push eax
push 0
push ecx
push 0
push 0
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x48e628
mov edx, dword [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
mov ecx, dword [0x4c6448]
lea eax, [ebp - 4]
push eax
push ecx
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x48e606
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push 4
push edx
push 4
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x48e62f
mov edx, dword [ebp - 4]
push edx
call edi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call edi
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x48e690
Capabilities:
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe14
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x200
lea eax, [ebp - 0xa0c]
push eax
mov esi, ecx
push 0x4b17de
push esi
push str.windows
mov dword [ebp - 0xe14], esi
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
lea ecx, [ebp - 0xa0c]
push 0x4b1c70
xor ebx, ebx
push ecx
mov byte [ebp - 0xe0c], bl
call fcn.004a1f0d
mov edx, eax
add esp, 8
mov dword [ebp - 0xe10], edx
cmp edx, ebx
je 0x48e882
push edi
jmp 0x48e706
mov edx, dword [ebp - 0xe10]
lea eax, [ebp - 0x308]
mov ecx, eax
xor edi, edi
mov esi, 0x304
sub edx, ecx
jmp 0x48e720
lea ecx, [esi + 0x7ffffcfa]
test ecx, ecx
je 0x48e739
mov cl, byte [edx + eax]
cmp cl, bl
je 0x48e739
mov byte [eax], cl
inc eax
dec esi
jne 0x48e720
jmp 0x48e73d
cmp esi, ebx
jne 0x48e743
dec eax
mov edi, 0x8007007a
mov byte [eax], bl
cmp edi, ebx
jl 0x48e83b
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x60c]
mov ecx, eax
xor edi, edi
mov esi, 0x304
sub edx, ecx
lea ecx, [esi + 0x7ffffcfa]
test ecx, ecx
je 0x48e77a
mov cl, byte [edx + eax]
cmp cl, bl
je 0x48e77a
mov byte [eax], cl
inc eax
dec esi
jne 0x48e761
jmp 0x48e77e
cmp esi, ebx
jne 0x48e784
dec eax
mov edi, 0x8007007a
mov byte [eax], bl
cmp edi, ebx
jl 0x48e83b
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [ebp - 0x308]
push edx
call edi
mov esi, eax
cmp esi, ebx
jne 0x48e7b3
mov word [ebp - 0x308], 0x20
mov esi, 1
jmp 0x48e7c1
push esi
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffA]
lea ecx, [ebp - 0x60c]
push ecx
call edi
mov edi, eax
cmp edi, ebx
jne 0x48e7e0
mov word [ebp - 0x60c], 0x20
mov edi, 1
jmp 0x48e7ee
push edi
lea edx, [ebp - 0x60c]
push edx
call dword [sym.imp.USER32.dll_CharUpperBuffA]
xor ecx, ecx
cmp edi, esi
jle 0x48e800
or ecx, 0xffffffff
mov byte [ebp + esi - 0x60c], bl
jmp 0x48e816
jge 0x48e812
mov ecx, 1
mov esi, edi
mov byte [ebp + edi - 0x308], bl
jmp 0x48e816
cmp esi, edi
jne 0x48e83b
xor eax, eax
cmp esi, ebx
jle 0x48e835
lea esp, [esp]
mov dl, byte [ebp + eax - 0x308]
cmp dl, byte [ebp + eax - 0x60c]
jne 0x48e83b
inc eax
cmp eax, esi
jl 0x48e820
cmp ecx, ebx
jg 0x48e83b
jge 0x48e85f
mov eax, dword [ebp - 0xe10]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push eax
lea ecx, [ebp - 0xe0c]
push ecx
call esi
push 0x4b1c70
lea edx, [ebp - 0xe0c]
push edx
call esi
push 0x4b1c70
push ebx
call fcn.004a1f0d
add esp, 8
mov dword [ebp - 0xe10], eax
cmp eax, ebx
jne 0x48e700
mov esi, dword [ebp - 0xe14]
pop edi
push 0x80
lea eax, [ebp - 0xa0c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.win.ini
lea ecx, [ebp - 0xa0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0xa0c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0xa0c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xe0c]
push ecx
push esi
push str.windows
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
Function at 0x48e8f0
Capabilities:
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x200
lea eax, [ebp - 0x404]
push eax
push 0x4b17de
push esi
push str.windows
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
push 0x4b1c70
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call ebx
lea edx, [ebp - 0x404]
push edx
mov dword [ebp - 0x808], eax
call ebx
mov ecx, dword [ebp - 0x808]
add ecx, eax
pop ebx
cmp ecx, 0x400
jge 0x48e96a
push edi
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x200
lea ecx, [ebp - 0x804]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.win.ini
lea edx, [ebp - 0x804]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0xfffffffe
push eax
lea ecx, [ebp - 0x804]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x404]
push edx
push esi
push str.windows
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
Function at 0x48f3b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4d2afc], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
je 0x48f47d
push str.Advapi32.dll
mov dword [ebp - 0x114], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x48f489
push str.RegDeleteKeyExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48f419
push 0
push 0x100
push edi
push ebx
call eax
mov dword [ebp - 0x114], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x114], 0
je 0x48f489
cmp dword [0x4d2afc], 0
mov dword [ebp - 0x114], 0
je 0x48f49f
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x48f475
push str.RegDeleteKeyExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48f46e
push 0
push 0x200
push edi
push ebx
call eax
mov dword [ebp - 0x114], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x114]
jmp 0x48f485
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x48f49f
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4c6444]
lea eax, [ebp - 0x118]
push eax
push ecx
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x48f4d6
xor edx, edx
cmp eax, 2
sete dl
mov eax, edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [edi + eax - 1], 0x5c
lea esi, [edi + eax]
je 0x48f4ee
mov byte [esi], 0x5c
inc esi
mov byte [esi], 0
lea eax, [ebp - 0x124]
push eax
mov eax, dword [ebp - 0x118]
push 0
push 0
push 0
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x110]
push edx
push 0
push eax
mov dword [ebp - 0x11c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x48f57a
lea ecx, [ebp - 0x110]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push ebx
call fcn.0048f3b0
add esp, 8
test eax, eax
je 0x48f57a
lea edx, [ebp - 0x124]
push edx
mov edx, dword [ebp - 0x118]
push 0
push 0
push 0
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x110]
push ecx
push 0
push edx
mov dword [ebp - 0x11c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x48f526
mov byte [esi - 1], 0
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4d2afc], 0
je 0x48f5a5
push 0x100
push edi
push ebx
call fcn.0048dfb0
add esp, 0xc
jmp 0x48f5ad
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor ecx, ecx
test eax, eax
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
Function at 0x48f620
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
lea ecx, [ebp - 0x230]
push ecx
push 0x20106
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48f6f4
mov dword [ebp - 0x20], eax
movzx edx, byte [ebp - 0x1d]
movzx ecx, byte [ebp - 0x1f]
push edx
movzx edx, byte [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
movzx eax, byte [ebp - 0x1e]
push eax
movzx eax, byte [ebp - 0x21]
push ecx
movzx ecx, byte [ebp - 0x22]
push edx
movzx edx, byte [ebp - 0x23]
push eax
movzx eax, byte [ebp - 0x24]
push ecx
movzx ecx, byte [ebp - 0x25]
push edx
movzx edx, byte [ebp - 0x26]
push eax
movzx eax, byte [ebp - 0x27]
push ecx
push edx
push eax
push 2
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun
push 0
lea ecx, [ebp - 0x22c]
push str.Status:__d___Key:__s___Title:__s___02x__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x
push ecx
mov byte [ebp - 0x28], 2
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x44
push edi
lea esi, [ebp - 0x22c]
call fcn.0047fb10
mov eax, dword [ebp - 0x230]
add esp, 4
push 0xc
lea edx, [ebp - 0x28]
push edx
push 3
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x48f706
mov ecx, dword [ebp - 0x230]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x230]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
movzx eax, byte [ebp - 0x28]
xor ecx, ebp
pop esi
call fcn.004a01d6
mov esp, ebp
pop ebp
ret