joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fb70
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x50
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x58]
push ebx
push ebp
mov ebp, dword [esp + 0x5c]
mov ecx, ebp
or ecx, eax
push edi
je 0x46fc03
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [esi + 0x20]
push ebp
mov edx, 0x40
mov ecx, esi
call eax
test al, al
jne 0x46fc03
mov ecx, 0x5a4d
cmp word [esp + 0x10], cx
jne 0x46fc03
mov edi, dword [esp + 0x4c]
mov eax, dword [esi + 0x20]
xor ebx, ebx
add edi, ebp
adc ebx, dword [esp + 0x64]
and edi, dword [esi + 0xc8]
and ebx, dword [esi + 0xcc]
lea edx, [esp + 0xc]
push edx
push ebx
push edi
mov edx, 4
mov ecx, esi
call eax
test al, al
jne 0x46fc03
cmp dword [esp + 0xc], 0x4550
jne 0x46fc03
mov eax, edi
mov edx, ebx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.005078c8
add esp, 0x50
ret 8
mov ecx, dword [esp + 0x54]
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
xor edx, edx
call fcn.005078c8
add esp, 0x50
ret 8
Function at 0x477e20
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x16c
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x164], eax
push ebx
mov ebx, dword [esp + 0x178]
push ebp
mov ebp, dword [esp + 0x178]
push esi
push edi
lea eax, [esp + 0x130]
push eax
push ebx
push ebp
mov edx, 0x40
mov dword [esp + 0x28], ecx
call fcn.00485310
cmp al, 0xa
ja 0x478028
mov ecx, 0x5a4d
cmp word [esp + 0x130], cx
jne 0x477ec3
mov esi, dword [esp + 0x16c]
mov ecx, dword [esp + 0x1c]
xor edi, edi
add esi, ebp
adc edi, ebx
lea edx, [esp + 0x28]
push edx
push edi
xor ebp, ebp
push esi
lea edx, [ebp + 0x18]
xor ebx, ebx
call fcn.00485310
cmp al, 0xa
ja 0x478028
cmp dword [esp + 0x28], 0x4550
jne 0x477ec3
movzx eax, word [esp + 0x2c]
add esi, 0x18
adc edi, ebx
cmp eax, 0x14c
je 0x477f2c
cmp eax, 0x8664
je 0x477ecd
mov eax, 0xc000007b
jmp 0x47802d
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x40]
push eax
push edi
push esi
mov edx, 0xf0
call fcn.00485310
cmp al, 0xa
ja 0x478028
mov ecx, 0x20b
cmp word [esp + 0x40], cx
jne 0x477ec3
cmp dword [esp + 0xac], 5
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
jbe 0x477f8d
mov ebx, dword [esp + 0xd8]
mov ecx, dword [esp + 0xdc]
xor ebp, ebp
add ebx, dword [esp + 0x180]
adc ebp, dword [esp + 0x184]
jmp 0x477f8f
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x40]
push edx
push edi
push esi
mov edx, 0xe0
call fcn.00485310
cmp al, 0xa
ja 0x478028
mov eax, 0x10b
cmp word [esp + 0x40], ax
jne 0x477ec3
mov eax, dword [esp + 0x5c]
xor edx, edx
cmp dword [esp + 0x9c], 5
jbe 0x477f89
mov ebx, dword [esp + 0xc8]
mov ecx, dword [esp + 0xcc]
xor ebp, ebp
add ebx, dword [esp + 0x180]
adc ebp, dword [esp + 0x184]
jmp 0x477f8f
mov ecx, edx
jmp 0x477f8f
mov ecx, ebx
mov esi, dword [esp + 0x180]
mov edi, dword [esp + 0x184]
sub esi, eax
sbb edi, edx
mov edx, esi
or edx, edi
je 0x47800a
mov eax, ebx
or eax, ebp
je 0x47800e
test ecx, ecx
je 0x47800e
xor edx, edx
add ecx, ebx
mov eax, ebp
adc edx, ebp
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], edx
mov ebp, ecx
jmp 0x477fd0
mov edx, dword [esp + 0x184]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x184]
push edi
push esi
push edx
push ecx
mov ecx, dword [esp + 0x30]
push eax
push ebx
call fcn.00477990
test eax, eax
jl 0x47802d
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x24]
ja 0x47800a
mov ebx, dword [esp + 0x10]
jb 0x477fd0
cmp ebx, ebp
jb 0x477fd0
xor eax, eax
jmp 0x47802d
mov edx, 0x14c
cmp word [esp + 0x2c], dx
jne 0x47800a
test byte [esp + 0x3e], 1
je 0x47800a
mov eax, 0xc0000018
jmp 0x47802d
mov eax, 0xc0000005
mov ecx, dword [esp + 0x174]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005078c8
add esp, 0x16c
ret 8
Function at 0x47f6d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x12c
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0x130]
push ebx
push ebp
mov ebp, dword [esp + 0x13c]
mov dword [esp + 0x60], edx
mov dl, byte [esp + 0x14c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x140]
and dl, 1
push esi
add eax, ebp
push edi
mov dword [esp + 0x34], ebp
mov byte [esp + 0x10], dl
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov edi, dword [esp + 0x1c]
mov bl, byte [edi]
inc edi
mov dword [esp + 0x1c], edi
test bl, bl
je 0x47f7c8
cmp bl, 0x25
jne 0x47f7ae
mov bl, byte [edi]
movsx eax, bl
or edx, 0xffffffff
inc edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], edx
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 4
mov byte [esp + 0x12], 0
mov dword [esp + 0x1c], edi
cmp eax, 0x78
ja 0x47f7ae
jmp 0x47f770
movzx eax, byte [eax + 0x480340]
jmp dword [eax*4 + 0x4802d4]
mov byte [ebp], bl
inc ebp
cmp byte [esp + 0x10], 0
je 0x47f7be
mov byte [ebp], 0
inc ebp
cmp ebp, dword [esp + 0x20]
jb 0x47f721
cmp byte [esp + 0x10], 0
mov byte [ebp], 0
je 0x47f7d7
mov byte [ebp + 1], 0
sub ebp, dword [esp + 0x34]
mov edx, dword [esp + 0x68]
mov dword [edx], ebp
xor al, al
mov ecx, dword [esp + 0x134]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005078c8
add esp, 0x12c
ret 0x18
Function at 0x4a1a60
Capabilities:
Parse pe header

Disassembly:
cmp edx, 0x61
jb 0x4a1a89
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x4a1a89
mov eax, dword [ecx + 0x3c]
test al, 3
jne 0x4a1a89
add edx, 0xfffffffc
cmp eax, edx
ja 0x4a1a89
cmp dword [eax + ecx], 0x4550
jne 0x4a1a89
mov al, 1
ret
xor al, al
ret
Function at 0x4df5f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x2024
call fcn.0051bb00
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x2020], eax
push ebp
push esi
mov esi, ecx
movzx ecx, byte [esp + 0x2038]
push edi
mov edi, 0x1000
shl edi, cl
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
cmp edi, esi
jbe 0x4df62a
mov edi, esi
mov ecx, dword [esp + 0x2038]
mov edx, dword [esp + 0x2034]
lea eax, [esp + 0x28]
push eax
mov eax, dword [ebx + 0x20]
push ecx
push edx
mov edx, edi
mov ecx, ebx
call eax
test al, al
jne 0x4df7d0
cmp byte [esp + 0x203c], al
je 0x4df668
shr edi, 1
lea ecx, [esp + 0x28]
mov eax, edi
mov edx, ecx
call fcn.00455e60
mov ecx, 0x5a4d
cmp word [esp + 0x28], cx
jne 0x4df7d0
mov eax, dword [esp + 0x64]
test al, 3
jne 0x4df7d0
lea edx, [edi - 4]
cmp eax, edx
ja 0x4df7d0
shr eax, 2
cmp dword [esp + eax*4 + 0x28], 0x4550
jne 0x4df7d0
mov ebp, dword [ebx + 0x44]
mov dword [esp + 0x24], ebp
cmp edi, 0x1f0
jb 0x4df6c0
lea edx, [esp + 0x28]
call fcn.0045e6a0
test al, al
jne 0x4df7d0
push 0
push ebp
mov edi, 0x4b
call fcn.00455360
mov eax, dword [ebp + 0x110]
cmp esi, eax
jbe 0x4df6d9
mov esi, eax
mov ecx, dword [esp + 0x18]
mov eax, esi
shr eax, cl
push ebp
mov ecx, eax
mov dword [esp + 0x24], eax
call fcn.00463810
mov dword [esp + 0x10], eax
test eax, eax
je 0x4df7cc
mov dword [esp + 0x14], 0
mov edi, dword [esp + 0x1c]
cmp edi, esi
jbe 0x4df70b
mov edi, esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x2034]
mov ebp, edi
shr ebp, cl
mov ecx, dword [esp + 0x2038]
lea eax, [esp + 0x28]
push eax
mov eax, dword [ebx + 0x20]
push ecx
push edx
mov edx, edi
mov ecx, ebx
call eax
test al, al
jne 0x4df769
cmp byte [esp + 0x203c], al
je 0x4df74d
lea ecx, [esp + 0x28]
mov eax, ebp
shr eax, 1
mov edx, ecx
call fcn.00455e60
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx + 0x2c]
push 0
push 0
push ebp
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x24]
push 0
push eax
call edx
add dword [esp + 0x2034], edi
adc dword [esp + 0x2038], 0
add dword [esp + 0x14], ebp
sub esi, edi
jne 0x4df701
mov esi, dword [esp + 0x24]
push ebx
push ebx
push 0x44
call fcn.0048aaf0
xor ecx, ecx
cmp eax, ecx
je 0x4df7c0
mov edx, dword [esp + 0x10]
mov dword [eax + 0x24], edx
mov edx, dword [esp + 0x20]
mov dword [eax + 0x18], 0x45e7f0
mov dword [eax + 0x20], str.membuf.bin
mov dword [eax + 0x28], edx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], 0x80000200
mov al, 1
jmp 0x4df7d2
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov al, 1
jmp 0x4df7d2
xor al, al
mov ecx, dword [esp + 0x202c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005078c8
add esp, 0x2024
ret 0xc
Function at 0x4df609
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x2024
call fcn.0051bb00
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x2020], eax
push ebp
push esi
mov esi, ecx
movzx ecx, byte [esp + 0x2038]
push edi
mov edi, 0x1000
shl edi, cl
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
cmp edi, esi
jbe 0x4df62a
mov edi, esi
mov ecx, dword [esp + 0x2038]
mov edx, dword [esp + 0x2034]
lea eax, [esp + 0x28]
push eax
mov eax, dword [ebx + 0x20]
push ecx
push edx
mov edx, edi
mov ecx, ebx
call eax
test al, al
jne 0x4df7d0
cmp byte [esp + 0x203c], al
je 0x4df668
shr edi, 1
lea ecx, [esp + 0x28]
mov eax, edi
mov edx, ecx
call fcn.00455e60
mov ecx, 0x5a4d
cmp word [esp + 0x28], cx
jne 0x4df7d0
mov eax, dword [esp + 0x64]
test al, 3
jne 0x4df7d0
lea edx, [edi - 4]
cmp eax, edx
ja 0x4df7d0
shr eax, 2
cmp dword [esp + eax*4 + 0x28], 0x4550
jne 0x4df7d0
mov ebp, dword [ebx + 0x44]
mov dword [esp + 0x24], ebp
cmp edi, 0x1f0
jb 0x4df6c0
lea edx, [esp + 0x28]
call fcn.0045e6a0
test al, al
jne 0x4df7d0
push 0
push ebp
mov edi, 0x4b
call fcn.00455360
mov eax, dword [ebp + 0x110]
cmp esi, eax
jbe 0x4df6d9
mov esi, eax
mov ecx, dword [esp + 0x18]
mov eax, esi
shr eax, cl
push ebp
mov ecx, eax
mov dword [esp + 0x24], eax
call fcn.00463810
mov dword [esp + 0x10], eax
test eax, eax
je 0x4df7cc
mov dword [esp + 0x14], 0
mov edi, dword [esp + 0x1c]
cmp edi, esi
jbe 0x4df70b
mov edi, esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x2034]
mov ebp, edi
shr ebp, cl
mov ecx, dword [esp + 0x2038]
lea eax, [esp + 0x28]
push eax
mov eax, dword [ebx + 0x20]
push ecx
push edx
mov edx, edi
mov ecx, ebx
call eax
test al, al
jne 0x4df769
cmp byte [esp + 0x203c], al
je 0x4df74d
lea ecx, [esp + 0x28]
mov eax, ebp
shr eax, 1
mov edx, ecx
call fcn.00455e60
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx + 0x2c]
push 0
push 0
push ebp
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x24]
push 0
push eax
call edx
add dword [esp + 0x2034], edi
adc dword [esp + 0x2038], 0
add dword [esp + 0x14], ebp
sub esi, edi
jne 0x4df701
mov esi, dword [esp + 0x24]
push ebx
push ebx
push 0x44
call fcn.0048aaf0
xor ecx, ecx
cmp eax, ecx
je 0x4df7c0
mov edx, dword [esp + 0x10]
mov dword [eax + 0x24], edx
mov edx, dword [esp + 0x20]
mov dword [eax + 0x18], 0x45e7f0
mov dword [eax + 0x20], str.membuf.bin
mov dword [eax + 0x28], edx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], 0x80000200
mov al, 1
jmp 0x4df7d2
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov al, 1
jmp 0x4df7d2
xor al, al
mov ecx, dword [esp + 0x202c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005078c8
add esp, 0x2024
ret 0xc
Function at 0x4f7f50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x53756b
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
mov eax, dword [0x984164]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
lea eax, [esp + 0x24]
mov esi, ecx
mov ebx, edx
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
call fcn.0041cfe0
xor edi, edi
mov dword [esp + 0x280], edi
cmp esi, edi
je 0x4f8154
cmp ebx, edi
je 0x4f8154
cmp word [ebx], di
je 0x4f8154
cmp dword [esi], edi
je 0x4f8154
push ebx
mov dword [esp + 0x3c], 3
call fcn.0041c0f0
add esp, 4
push edi
push 0x80
push 4
push edi
mov esi, eax
push edi
push 0xc0100000
test esi, esi
je 0x4f800c
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
push esi
mov dword [esp + 0x40], eax
call fcn.00507bce
add esp, 4
jmp 0x4f8017
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [esp + 0x3c], eax
or ebx, 0xffffffff
cmp dword [esp + 0x3c], ebx
jne 0x4f803b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.0041c040
mov edi, eax
mov dword [esp + 0x10], eax
test edi, edi
jl 0x4f813e
mov dword [esp + 0x10], edi
test edi, edi
jne 0x4f813e
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x28]
call fcn.0041caa0
mov ecx, dword [esp + 0x20]
test ecx, ecx
jl 0x4f8094
mov eax, dword [esp + 0x1c]
jg 0x4f806a
cmp eax, 0x200
jbe 0x4f8094
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
sub eax, 0x200
sbb ecx, 0
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
test ecx, ecx
jg 0x4f8094
jl 0x4f808c
test eax, eax
jae 0x4f8094
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], esi
mov edx, dword [esp + 0x18]
mov esi, dword [edx]
test esi, esi
je 0x4f80e1
mov bl, 1
mov eax, dword [esp + 0x14]
push eax
lea edi, [esi + 0xc]
push edi
call fcn.00507f2e
add esp, 8
test eax, eax
je 0x4f80d8
lea ecx, [esp + 0x24]
push ecx
mov ecx, edi
call fcn.004f7af0
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4f80de
test byte [esi + 4], bl
je 0x4f80d8
mov eax, edi
call fcn.004fcab0
mov esi, dword [esi]
test esi, esi
jne 0x4f80a0
or ebx, 0xffffffff
push 0x200
lea edx, [esp + 0x70]
push 0
push edx
call fcn.0051c1b0
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
add esp, 0xc
push 0
push 0
push 0x200
lea eax, [esp + 0x78]
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
mov edx, dword [eax + 0x2c]
lea ecx, [esp + 0x3c]
call edx
test eax, eax
jl 0x4f812b
add dword [esp + 0x2c], 0x200
adc dword [esp + 0x30], 0
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x4f813a
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x280], ebx
lea ecx, [esp + 0x24]
call fcn.0041d060
mov eax, dword [esp + 0x10]
jmp 0x4f816d
mov dword [esp + 0x280], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.0041d060
mov eax, 0xe0010002
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.005078c8
mov esp, ebp
pop ebp
ret
Function at 0x4f8750
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x614
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x610], eax
push ebp
xor ebp, ebp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
cmp word [0x9871d0], bp
jne 0x4f8783
push 0x103
push 0x9871d0
call esi
movzx eax, word [0x9871d0]
push str.autoexec
push eax
push str._c:_s.bat
lea edx, [esp + 0x14]
call fcn.00401bb0
add esp, 0xc
cmp word [0x9871d0], bp
jne 0x4f87b6
push 0x103
push 0x9871d0
call esi
movzx ecx, word [0x9871d0]
push str.autoexec
push ecx
push str._c:_s.rmv
lea edx, [esp + 0x41c]
call fcn.00401bb0
add esp, 0xc
push 0
lea edx, [esp + 0x414]
push edx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
jne 0x4f8800
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebp, eax
test ebp, ebp
jne 0x4f88a1
lea ecx, [esp + 8]
push 0x978674
push ecx
call fcn.0050b321
mov esi, eax
add esp, 8
test esi, esi
jne 0x4f881f
mov ebp, 0x3eb
jmp 0x4f8894
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4f8824
sub eax, edx
sar eax, 1
push edi
mov edi, eax
push esi
lea eax, [esp + 0x218]
call fcn.004f8680
add esp, 4
test eax, eax
jl 0x4f887a
lea ebx, [ebx]
push edi
lea edx, [esp + 0x218]
push ebx
push edx
call fcn.00507a59
add esp, 0xc
test eax, eax
je 0x4f8893
push esi
lea eax, [esp + 0x218]
call fcn.004f8680
add esp, 4
test eax, eax
jge 0x4f8850
push 2
push 0
push esi
call fcn.0050b415
push ebx
push str._n_s_n
push esi
call fcn.0050b49a
add esp, 0x18
pop edi
test esi, esi
je 0x4f88a1
push esi
call fcn.0050b62f
add esp, 4
mov ecx, dword [esp + 0x618]
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.005078c8
add esp, 0x614
ret
Function at 0x4f88c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x14
movzx eax, word [ecx]
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x14], ecx
cmp ax, di
je 0x4f88ff
movzx eax, ax
lea esp, [esp]
cmp ax, 0x5c
je 0x4f88ec
cmp ax, 0x2f
jne 0x4f88f3
lea eax, [ecx + 2]
mov dword [esp + 0x14], eax
movzx eax, word [ecx + 2]
add ecx, 2
cmp ax, di
jne 0x4f88e0
lea ecx, [esp + 0xc]
push ecx
push 3
push edi
push str.SystemCurrentControlSetControlSession_Manager
push 0x80000002
mov dword [esp + 0x2c], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x4f89ec
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebp
lea edx, [esp + 0x14]
push edx
push edi
push edi
push edi
push str.BootExecute
push eax
call esi
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
cmp eax, edi
je 0x4f898b
push eax
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x4f89a4
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edi
lea edx, [esp + 0x28]
push edx
push 0
push str.BootExecute
push eax
call esi
mov esi, eax
test esi, esi
jne 0x4f89cc
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push edx
push edi
call fcn.004188e0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4f89ab
mov esi, 8
jmp 0x4f89cc
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
add eax, eax
push eax
mov eax, dword [esp + 0x24]
push ebx
push eax
push 0
push str.BootExecute
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp ebx, edi
je 0x4f89d9
push ebx
call fcn.00507bce
add esp, 4
test edi, edi
je 0x4f89e9
push edi
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
xor edi, edi
pop ebp
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x4f89fb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x4f8a40
Capabilities:
Get common file path

Disassembly:
sub esp, 0x41c
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push edi
mov edx, esi
call fcn.0041bd70
cmp word [0x9871d0], 0
mov ebx, dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov edi, eax
jne 0x4f8a7b
push 0x103
push 0x9871d0
call ebx
movzx eax, word [0x9871d0]
push edi
push eax
push str._c:_rm_s.exe
lea edx, [esp + 0x14]
call fcn.00401bb0
add esp, 0xc
lea ecx, [esp + 8]
push 0x6c
push ecx
call fcn.004ff770
add esp, 8
test eax, eax
jne 0x4f8b0a
cmp word [0x9871d0], ax
jne 0x4f8abd
push 0x103
push 0x9871d0
call ebx
movzx edx, word [0x9871d0]
push edi
push edx
push str._c:_rm_s.lst
lea edx, [esp + 0x21c]
call fcn.00401bb0
add esp, 0xc
mov eax, esi
call fcn.0041be60
test eax, eax
jne 0x4f8b0a
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
lea edx, [esp + 0x218]
push edx
call fcn.004fd8f0
add esp, 0xc
test eax, eax
jne 0x4f8b0a
lea ebx, [esp + 8]
call fcn.004f8750
mov ecx, dword [esp + 0x41c]
pop edi
pop ebx
xor ecx, esp
call fcn.005078c8
add esp, 0x41c
ret
Function at 0x4f8b30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x420
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x418], eax
cmp word [0x9873d8], 0
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
jne 0x4f8b61
push 0x103
push 0x9873d8
call edi
push 0x9873d8
push str._sVMM32loader.exe
lea edx, [esp + 0x10]
call fcn.00401bb0
add esp, 8
cmp word [0x9873d8], 0
jne 0x4f8b8d
push 0x103
push 0x9873d8
call edi
push 0x9873d8
push str._sVMM32loader.lst
lea edx, [esp + 0x218]
call fcn.00401bb0
lea eax, [esp + 0x10]
push 0x6c
push eax
call fcn.004ff770
add esp, 0x10
test eax, eax
jne 0x4f8bd9
mov eax, esi
call fcn.0041be60
test eax, eax
jne 0x4f8bd9
mov ecx, dword [esi + 0x24]
mov edx, dword [esi + 0x1c]
push ecx
push edx
lea eax, [esp + 0x218]
push eax
call fcn.004fd8f0
add esp, 0xc
mov ecx, dword [esp + 0x41c]
pop edi
xor ecx, esp
call fcn.005078c8
add esp, 0x420
ret

Function at 0x4f8bf0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x424
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x41c], eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edx, esi
call fcn.0041bd70
mov ebx, eax
mov eax, dword [0x9855f4]
mov dword [esp + 0x14], 0
cmp eax, 0xffffffff
jne 0x4f8c36
mov eax, dword [str.Kernel32.dll]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov dword [0x9855f4], eax
test eax, eax
je 0x4f8c4a
push str.MoveFileExW
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [esp + 0x14], eax
call fcn.004fec70
mov ebp, dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
xor ecx, ecx
cmp eax, 0x20
setne cl
add ecx, 0x6e
cmp word [0x9873d8], 0
mov edi, ecx
jne 0x4f8c78
push 0x103
push 0x9873d8
call ebp
push ebx
push 0x9873d8
push str._s_rm_s.nt
lea edx, [esp + 0x24]
call fcn.00401bb0
add esp, 0xc
lea edx, [esp + 0x18]
push edi
push edx
call fcn.004ff770
add esp, 8
test eax, eax
jne 0x4f8d66
cmp word [0x9873d8], ax
jne 0x4f8cba
push 0x103
push 0x9873d8
call ebp
push ebx
push 0x9873d8
push str._s_rm_s.lst
lea edx, [esp + 0x22c]
call fcn.00401bb0
add esp, 0xc
mov eax, esi
call fcn.0041be60
test eax, eax
jne 0x4f8d66
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
lea edx, [esp + 0x228]
push edx
call fcn.004fd8f0
add esp, 0xc
test eax, eax
jne 0x4f8d66
lea ecx, [esp + 0x18]
call fcn.004f88c0
mov ebx, eax
test ebx, ebx
jne 0x4f8d64
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4f8d64
push 4
push eax
lea eax, [esp + 0x20]
push eax
call edi
mov ebp, dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x4f8d2e
call ebp
mov ebx, eax
lea eax, [esp + 0x18]
mov esi, str..lst
call fcn.00418bc0
lea esp, [esp]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x4f8d40
push 4
push 0
lea ecx, [esp + 0x20]
push ecx
call edi
test eax, eax
jne 0x4f8d64
call ebp
jmp 0x4f8d66
mov eax, ebx
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005078c8
add esp, 0x424
ret
Function at 0x4f8e60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x228
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [esp + 0x230]
push ebp
mov ebp, dword [esp + 0x230]
push esi
push edi
push eax
push str.SYSTEMCurrentControlSetServicesAvgAVG_u
lea edx, [esp + 0x28]
mov dword [esp + 0x1c], 0
mov byte [esp + 0x1b], 0
call fcn.00401bb0
add esp, 8
lea ecx, [esp + 0x18]
push ecx
push 1
push 0
lea edx, [esp + 0x2c]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4f8fdd
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push str.AvgDir
push ecx
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4f8fd2
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
je 0x4f8fd2
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push edi
push 0
push 0
push str.AvgDir
push eax
call esi
test eax, eax
jne 0x4f8fc2
mov eax, ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4f8f30
mov ecx, dword [esp + 0x14]
sub eax, edx
sar eax, 1
shr ecx, 1
lea edx, [ecx + eax + 2]
cmp edx, 0x104
jae 0x4f8fc2
mov edx, ebp
mov eax, edi
sub edx, edi
jmp 0x4f8f60
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4f8f60
mov edi, ebp
call fcn.00418af0
mov eax, ebx
mov edx, ebx
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4f8f80
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4f8f90
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
call fcn.004fc600
mov edi, dword [esp + 0x20]
add esp, 4
test al, al
je 0x4f8fc2
mov byte [esp + 0x13], 1
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005078c8
add esp, 0x228
ret