joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472c70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [esi], eax
mov edi, eax
je 0x472cce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
mov ebx, eax
inc ecx
cmp ecx, 2
jb 0x472cb6
call fcn.0040e440
push dword [esi]
call fcn.0040f9e0
add esp, 4
mov dword [esi], 0
mov eax, edi
inc eax
cmp eax, 2
jb 0x472cc5
mov dword [esi], edi
call fcn.0040e440
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi]
lea eax, [edi + 1]
cmp eax, 2
jae 0x472ce2
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 0x10]
mov ebx, dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0
push 0x100002
push esi
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x472cd6
mov esi, dword [ebp + 0xc]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [esi], eax
mov edi, eax
je 0x472d5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
mov ebx, eax
inc ecx
cmp ecx, 2
jb 0x472d44
call fcn.0040e440
push dword [esi]
call fcn.0040f9e0
add esp, 4
mov dword [esi], 0
mov eax, edi
inc eax
cmp eax, 2
jb 0x472d53
mov dword [esi], edi
call fcn.0040e440
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi]
lea eax, [edi + 1]
cmp eax, 2
jb 0x472cd6
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 0x14]
mov ebx, dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0
push 0x100002
push esi
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
setne al
jmp 0x472cd8

Function at 0x472fb0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x20c
mov eax, dword [0x6ccc30]
lea esi, [ebp - 0x214]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0x208
push 0
push esi
call fcn.0061e8c0
add esp, 0xc
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x101
ja 0x472ffc
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov bl, 1
test eax, eax
jne 0x472ffe
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005ce525
mov eax, ebx
add esp, 0x20c
pop esi
pop ebx
pop ebp
ret
Function at 0x473130
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, ecx
mov edi, dword [eax]
mov dword [eax], 0
lea ebx, [edi + 1]
cmp ebx, 2
jae 0x473152
cmp dword [esi], edi
jne 0x47315b
jmp 0x473175
call fcn.0040e440
cmp dword [esi], edi
je 0x473175
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jae 0x4731ab
cmp ebx, 2
jae 0x4731cb
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov byte [edi + 4], 0
mov eax, dword [edi]
inc eax
cmp eax, 2
jb 0x47319f
call fcn.0040e440
push dword [edi]
call fcn.0040f9e0
add esp, 4
mov dword [edi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], eax
call fcn.0040e440
push dword [esi]
call fcn.0040f9e0
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
cmp ebx, 2
jb 0x47316e
mov dword [esi], edi
mov edi, eax
call fcn.0040e440
mov eax, edi
jmp 0x47316e
Function at 0x482210
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x424
mov ecx, dword [0x6d301c]
mov edx, dword fs:[0x2c]
mov eax, dword [0x6d2758]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4823e7
mov ebx, dword [ebp + 8]
cmp byte [0x6d273c], 0
jne 0x482326
lea eax, [ebp - 0x10]
mov byte [0x6d273c], 1
mov dword [ebp - 0x10], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAeDebug
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x482326
lea esi, [ebp - 0x430]
mov dword [ebp - 0x20], 0
push 0x410
push 0
push esi
call fcn.0061e8c0
add esp, 0xc
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x410
lea ecx, [ebp - 0x20]
push eax
push esi
push ecx
push 0
push str.Debugger
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48231d
push esi
call fcn.005d3244
add esp, 4
mov edi, eax
mov eax, dword [0x6d2754]
cmp eax, edi
jae 0x4822f0
sub esp, 0xc
mov al, byte [ebp - 0x14]
mov ecx, 0x6d2740
mov byte [esp + 4], al
mov dword [esp + 8], esi
mov dword [esp], edi
call fcn.00405590
jmp 0x48231d
cmp eax, 7
mov ecx, 0x6d2740
jbe 0x482300
mov ecx, dword [0x6d2740]
mov eax, edi
mov dword [0x6d2750], edi
add eax, edi
push eax
push esi
push ecx
mov esi, ecx
call fcn.0061e340
add esp, 0xc
mov word [esi + edi*2], 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [0x6d2750]
cmp dword [0x6d2754], 7
mov edx, 0x6d2740
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
jbe 0x48234e
mov edx, dword [0x6d2740]
cmp esi, 7
ja 0x48236c
movsd xmm0, qword [edx]
movsd xmm1, qword [edx + 8]
mov edi, 7
movsd qword [ebx + 8], xmm1
movsd qword [ebx], xmm0
jmp 0x4823d4
mov edi, esi
mov ecx, 0x7ffffffe
mov dword [ebp - 0x18], edx
or edi, 7
cmp edi, 0x7ffffffe
cmovb ecx, edi
lea eax, [ecx + ecx]
cmp ecx, 0x7ff
jb 0x4823b2
cmp ecx, 0x7fffffee
jae 0x48243d
add eax, 0x25
push eax
call fcn.005d0220
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x4823be
add eax, 2
push eax
call fcn.005d0220
add esp, 4
mov ebx, dword [ebp + 8]
lea ecx, [esi + esi + 2]
mov dword [ebx], eax
push ecx
push dword [ebp - 0x18]
push eax
call fcn.0061e340
add esp, 0xc
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], edi
mov eax, ebx
add esp, 0x424
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x6d2758
call fcn.005d3d07
add esp, 4
cmp dword [0x6d2758], 0xffffffff
jne 0x48223d
mov dword [0x6d2754], 7
mov dword [0x6d2750], 0
mov word [0x6d2740], 0
push 0x50f890
call fcn.005cf77c
add esp, 4
push 0x6d2758
call fcn.005d3d59
add esp, 4
jmp 0x48223d
call fcn.005e8c60
int3
Function at 0x489060
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x404
mov eax, dword [0x6ccc30]
mov esi, dword [ebp + 8]
mov bl, 1
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [esi - 0x403]
cmp eax, 0x2a
ja case.default.0x489086
jmp dword [eax*4 + 0x65e168]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ce525
mov eax, ebx
add esp, 0x404
pop esi
pop edi
pop ebx
pop ebp
ret
cmp esi, 0x804
je case.0x489086.1027
cmp esi, 0xc0a
je case.0x489086.1027
lea edi, [ebp - 0x410]
push 0x400
push 0
push edi
call fcn.0061e8c0
add esp, 0xc
push 0x200
push edi
push 3
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
setne bl
jmp case.0x489086.1027

Function at 0x4894e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x6ccc30]
mov edi, dword [ebp + 0xc]
xor eax, ebp
test edi, edi
mov dword [ebp - 0x10], eax
je 0x489520
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x489520
cmp dword [0x6d2904], 0
je 0x489520
mov esi, ecx
push ebx
push edi
call fcn.00489200
add esp, 8
test al, al
je 0x489520
cmp dword [esi + 0x1c], 0
je 0x489534
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ce525
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 0x20]
inc eax
cmp eax, 1
ja 0x489520
cmp dword [esi + 0x18], 0
jne 0x489520
xchg dword [esi + 0x1c], edi
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
xchg dword [esi + 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebx + 4]
cmp dword [eax], 0
je 0x489520
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
mov ecx, edi
mov edi, eax
mov eax, dword [ebx + 4]
mov ebx, dword [eax]
call ecx
lea ecx, [ebp - 0x14]
push 0
push 0
push 0x410
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x489520
mov ebx, dword [ebp - 0x14]
cmp dword [esi + 0x20], ebx
je 0x489520
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 0x20]
mov edi, eax
inc ecx
cmp ecx, 2
jb 0x4895bb
call fcn.0040e440
push dword [esi + 0x20]
call fcn.0040f9e0
add esp, 4
mov dword [esi + 0x20], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4895cb
mov dword [esi + 0x20], ebx
call fcn.0040e440
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x489520
Function at 0x48ad50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x56ac80
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [esi + 0x28], 0
je 0x48adb6
mov al, byte [esi + 0x29]
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x20], al
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov al, byte [ebp - 0x20]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov edx, dword [ebp + 8]
mov al, byte [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov byte [esi + 0x28], 1
test edx, edx
mov byte [esi + 0x2a], al
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x34], 0
je 0x48ad8c
mov dword [ebp - 0x10], 1
push 0
push 0
push 0
push 0
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x2c], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, dword [ebp - 0x20]
test eax, eax
mov dword [esi + 0x30], eax
je 0x48ad8c
cmp dword [esi + 0x2c], 0
je 0x48ad8c
mov dword [esi + 0x20], 0
lea eax, [esi + 0x20]
mov ecx, 0x48afd0
mov edx, 0x569c20
cmp byte [esi + 0x2a], 0
cmove edx, ecx
push eax
push 0
push esi
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [ebp - 0x20]
test eax, eax
mov dword [esi + 0x24], eax
je 0x48ad8c
cmp dword [esi + 0x20], 0
je 0x48ad8c
mov byte [esi + 0x29], 1
jmp 0x48ad8c
Function at 0x48dc00
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
cmp byte [ecx + 0x24], 0
jne 0x48dc84
mov esi, ecx
push 0x68d9cc
call fcn.00436bb0
add esp, 4
test eax, eax
mov dword [esi + 0x20], eax
je 0x48dc80
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DwmInvalidateIconicBitmaps
push eax
call edi
mov dword [esi + 4], eax
push str.DwmSetIconicThumbnail
push dword [esi + 0x20]
call edi
mov dword [esi + 8], eax
push str.DwmSetIconicLivePreviewBitmap
push dword [esi + 0x20]
call edi
mov dword [esi + 0xc], eax
push str.DwmSetWindowAttribute
push dword [esi + 0x20]
call edi
mov dword [esi + 0x10], eax
push str.DwmGetWindowAttribute
push dword [esi + 0x20]
call edi
mov dword [esi + 0x14], eax
push str.DwmExtendFrameIntoClientArea
push dword [esi + 0x20]
call edi
mov dword [esi + 0x18], eax
push str.DwmDefWindowProc
push dword [esi + 0x20]
call edi
mov dword [esi + 0x1c], eax
mov byte [esi + 0x24], 1
pop esi
pop edi
pop ebp
ret
Function at 0x493720
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4938e0
mov esi, ecx
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
je 0x493788
mov eax, 0x6812a0
mov dword [esi], 0x6812a0
mov dword [esi + 0x58], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x50], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
jmp 0x49378a
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [esi]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x50]
mov dword [esi + eax - 4], ecx
lea eax, [esi + 4]
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
mov dword [esi + ecx], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
lea edx, [ecx - 8]
mov dword [esi + ecx - 4], edx
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x10], 1
add ecx, esi
push 0
push eax
mov dword [ebp - 0x20], esi
call fcn.004938f0
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov eax, dword [eax + 4]
mov dword [edx + eax], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [edx]
mov eax, dword [eax + 4]
lea ecx, [eax - 0x50]
mov dword [edx + eax - 4], ecx
mov dword [edx + 4], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
push 8
call fcn.005d0220
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 0
push 1
call fcn.005dd08e
add esp, 4
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x38], ecx
lea ecx, [eax + 8]
mov dword [eax + 0x10], ecx
lea ecx, [eax + 0xc]
mov dword [eax + 0x14], ecx
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea ecx, [eax + 0x1c]
mov dword [eax + 0x24], ecx
lea ecx, [eax + 0x28]
mov dword [eax + 0x30], ecx
lea ecx, [eax + 0x2c]
mov dword [eax + 0x34], ecx
mov dword [eax + 0xc], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 8], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x28], 0
mov dword [eax + 4], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x40], 4
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x495ee0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x495fd0
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
test byte [esi + 0x3c], 1
je 0x495f5c
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x495f23
lea ecx, [esi + 0x30]
jmp 0x495f2b
mov eax, dword [esi + 0x1c]
lea ecx, [esi + 0x2c]
mov eax, dword [eax]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
lea eax, [eax + ecx*2]
mov ecx, dword [esi + 0xc]
mov ecx, dword [ecx]
sub eax, ecx
cmp eax, 0x1000
jb 0x495f52
mov edx, ecx
mov ecx, dword [ecx - 4]
add edx, 0xfffffffc
sub edx, ecx
cmp edx, 0x20
jae 0x495fae
add eax, 0x23
push eax
push ecx
call fcn.005d319e
add esp, 8
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov dword [esi + 0x38], 0
and byte [esi + 0x3c], 0xfe
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
call fcn.006207e0
nop word [eax + eax]
push ebp
sub esp, 8
add ebp, 0xc
call fcn.0061de80
int3
Function at 0x499110
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4c0400
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
test eax, eax
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], 0
je 0x499251
mov dword [ebp - 0x10], 1
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x499251
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 0x20]
inc edx
xor ecx, ecx
cmp edx, 2
jb 0x4991a1
mov dword [ebp - 0x28], eax
call fcn.0040e440
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x499251
lea edi, [ebp - 0x232]
push 0x20a
push 0
push edi
call fcn.0061e8c0
add esp, 0xc
mov dword [ebp - 0x10], 2
push 0x105
push edi
push 0
push esi
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
je 0x499239
lea ebx, [ebp - 0x232]
push ebx
call fcn.005d3244
add esp, 4
mov ecx, dword [ebp + 8]
mov esi, eax
mov eax, dword [ecx + 0x14]
cmp eax, esi
jae 0x499218
sub esp, 0xc
mov al, byte [ebp - 0x24]
mov byte [esp + 4], al
mov dword [esp + 8], ebx
mov dword [esp], esi
call fcn.00405590
jmp 0x499239
cmp eax, 7
mov edi, ecx
jbe 0x499221
mov edi, dword [ecx]
mov eax, esi
mov dword [ecx + 0x10], esi
add eax, esi
push eax
push ebx
push edi
call fcn.0061e340
add esp, 0xc
mov word [edi + esi*2], 0
mov dword [ebp - 0x10], 0
call fcn.0040e440
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040f9e0
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49a0e0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x50d4a0
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], ecx
lea ecx, [ecx + 0xd4]
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], esi
lea edx, [ebp - 0x2c]
push eax
push edx
call fcn.00466e00
mov eax, dword [ebp - 0x2c]
mov esi, dword [eax + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x20], esi
cmp ecx, eax
jne 0x49a149
cmp byte [ebp + 8], 0
je 0x49a16a
mov edx, dword [ebp - 0x20]
sub eax, ecx
sar eax, 2
imul ecx, eax, 0xbefbefbf
mov dword [ebp - 0x30], ecx
cmp ecx, dword [edx + 0x24]
ja 0x49a16a
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [eax + 0x28]
jbe 0x49a18d
mov dword [ebp - 0x10], 2
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov dword [ebp - 0x10], 0
push 1
push str.ADC4330735
call fcn.005dff30
add esp, 8
test ax, ax
lea eax, [ebp - 0x2c]
je 0x49a1f1
mov dword [ebp - 0x2c], 0
push eax
push 0x10009
push 0
push str.SoftwareAdobeAcrobat_ReaderDCAVGeneral
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49a22e
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 0x64], 8
lea eax, [ecx + 0x50]
jb 0x49a1dc
mov eax, dword [eax]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x49a22e
lea ecx, [ebp - 0x2c]
push 0x20006
push str.SoftwareAdobeAcrobat_ReaderDCAVGeneral
push 0x80000001
call fcn.004098d0
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 0x64], 8
lea eax, [ecx + 0x50]
jb 0x49a216
mov eax, dword [eax]
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x2c]
push eax
call fcn.0049a2c0
lea ecx, [ebp - 0x2c]
call fcn.004080a0
xor eax, eax
cmp eax, dword [ebp - 0x30]
jae 0x49a16a
nop dword [eax]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x10], 0
push dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
push eax
call fcn.0049a800
mov eax, dword [ebp - 0x38]
inc eax
cmp eax, dword [ebp - 0x30]
jb 0x49a240
jmp 0x49a16a
Function at 0x49b090
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, ecx
push ebx
call fcn.005d3244
add esp, 4
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x49b0f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push eax
mov edx, dword [0x6ccc30]
mov eax, dword [ebp + 8]
xor edx, ebp
mov dword [ebp - 8], edx
lea edx, [ebp + 0xc]
push 4
push edx
push 4
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 8]
mov esi, eax
xor ecx, ebp
call fcn.005ce525
mov eax, esi
add esp, 4
pop esi
pop ebp
ret 8
Function at 0x4a04d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x6ccc30]
mov edi, dword [ebp + 8]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x4a04f6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4a04f8
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4a051a
cmp byte [ebp + 0xc], 0
mov bl, 1
je 0x4a0571
cmp byte [esi + 4], 0
je 0x4a0552
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4a0554
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x4a052e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4a0530
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4a0544
xor ebx, ebx
jmp 0x4a0571
cmp byte [esi + 4], 0
je 0x4a0562
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4a0564
mov eax, dword [esi]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4a0571
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ce525
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4a19a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov edx, dword [0x6ccc30]
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x210]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x218], 0x100
lea edx, [ebp - 0x218]
push 0
push 0
push 0
push 0
push edx
push edi
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test eax, eax
jne 0x4a1a36
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x218]
mov eax, dword [ecx + 0x14]
cmp eax, ebx
jae 0x4a1a14
sub esp, 0xc
mov al, byte [ebp - 0x214]
mov byte [esp + 4], al
mov dword [esp + 8], edi
mov dword [esp], ebx
call fcn.00405590
jmp 0x4a1a36
cmp eax, 8
mov edx, ecx
jb 0x4a1a1d
mov edx, dword [ecx]
lea eax, [ebx + ebx]
mov dword [ecx + 0x10], ebx
push eax
push edi
push edx
mov edi, edx
call fcn.0061e340
add esp, 0xc
mov word [edi + ebx*2], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ce525
mov eax, esi
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 8