joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push ebx
mov edx, 0x38e38e39
sub esp, 0x254
mov ecx, dword [esp + 0x268]
lea ebx, [esp + 0xe8]
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x20], 0x64
mov dword [esp + 0x1c], 0x2d
mov dword [esp + 0x18], 0x48
mov dword [esp + 0x10], 0x2b
lea eax, [ecx + 0xe1f]
mov dword [esp + 0xc], 0x45
mov dword [esp + 8], str._c_c1_d6_c36_c_c8_d6P_c_c
mov dword [esp + 4], 0x168
mov dword [esp], ebx
mov dword [esp + 0x24], eax
mov eax, ecx
sar ecx, 0x1f
imul edx
mov dword [esp + 0x3b], 0x4829452b
mov dword [esp + 0x3f], 0x2e642d25
mov dword [esp + 0x43], 0x3d323a2f
mov dword [esp + 0x47], 0x5f405028
mov byte [esp + 0x4b], 0
mov dword [esp + 0x2c], 0x5f
sar edx, 3
sub edx, ecx
mov dword [esp + 0x14], edx
call fcn.004401f0
mov edx, ebx
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x44132c
mov ecx, eax
lea esi, [esp + 0x4c]
mov dword [esp + 4], ebx
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
mov dword [esp], esi
cmove edx, ecx
mov ecx, eax
add cl, al
sbb edx, 3
sub edx, ebx
mov dword [esp + 8], edx
call fcn.00440220
lea eax, [esp + 0x6c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileA]
sub esp, 4
test eax, eax
lea ecx, [esp + 0x3b]
je 0x4413cb
lea ebx, [esp + 0x70]
mov edx, ebx
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x441390
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
mov ecx, eax
add cl, al
lea ecx, [esp + 0x3b]
sbb edx, 3
sub edx, ebx
cmp edx, 0x26
je 0x441400
mov eax, dword [esp + 0x264]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ecx
mov dword [esp], 2
mov dword [esp + 8], eax
mov eax, dword [esp + 0x260]
mov dword [esp + 4], eax
call fcn.00441080
add esp, 0x254
xor eax, eax
pop ebx
pop esi
ret
xor eax, eax
movzx edx, byte [ebx + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x10
jne 0x441402
movzx eax, byte [esp + 0x94]
mov byte [esp + 0x3b], al
movzx eax, byte [esp + 0x89]
mov byte [esp + 0x3f], al
movzx eax, byte [esp + 0x8c]
mov byte [esp + 0x41], al
movzx eax, byte [esp + 0x90]
mov byte [esp + 0x44], al
movzx eax, byte [esp + 0x84]
mov byte [esp + 0x49], al
jmp 0x4413cb
Function at 0x446070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
test al, 0x10
mov ecx, dword [esp + 0x70]
mov esi, dword [esp + 0x78]
lea ebx, [esp + 0x3c]
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x34], 0
lea ebx, [edx + 0x30]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x38], ecx
je 0x4460ee
mov dword [esp], ecx
call fcn.004cd3c0
mov dword [esp + 8], 0x4f1f56
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004cdfb0
test al, al
jne 0x446110
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp], ebx
call fcn.004cd0b0
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.004cd3c0
mov dword [esp + 8], 0x4f1f56
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004cdfb0
test al, al
je 0x4460ee
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.004cd3c0
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.004cd3c0
mov ebp, eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.004cd3c0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x4460ee
mov eax, dword [esp + 0x4c]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x4460ee
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4460ee
cmp byte [ebp], 0
jne 0x4461b3
add ebp, 1
jmp 0x4461a9
add ebp, 1
cmp byte [ebp - 1], 0
jne 0x4461b3
sub ecx, 1
jne 0x4461a0
jmp 0x4460ee
cmp edx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], edx
jae 0x4460ee
call fcn.004cebd0
lea edi, [eax + 0xc]
mov ebp, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], esi
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.004cce90
mov ecx, dword [esp + 0x1c]
mov dword [esp], edi
mov dword [esp + 4], ecx
mov dword [esp + 0x14], ecx
call fcn.004ccfa0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 8], 0
mov dword [esp], edi
sub ecx, edx
mov dword [esp + 4], ecx
call fcn.004cceb0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.004ccea0
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.004cd0f0
jmp 0x4460fe
Function at 0x45d0d0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
xor edx, edx
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov eax, dword [esi + 8]
mov dword [esi + 4], 0
test eax, eax
jne 0x45d106
jmp 0x45d170
test edi, edi
mov edx, dword [esi + 4]
mov eax, dword [esi + 8]
je 0x45d140
add edx, edi
cmp edx, eax
mov dword [esi + 4], edx
jae 0x45d140
sub eax, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 1
mov dword [esp + 8], eax
add edx, dword [esi]
mov dword [esp], edx
call sub.msvcrt.dll_fread
mov dword [esp], ebx
mov edi, eax
call sub.msvcrt.dll_ferror
test eax, eax
je 0x45d0f3
add esp, 0x10
mov eax, 2
pop ebx
pop esi
pop edi
ret
cmp eax, edx
je 0x45d170
xor eax, eax
mov ecx, dword [esi]
mov dword [esi + 0x14], edx
lea edx, [esi + 0xc]
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], edx
mov dword [esi + 0xc], ecx
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], ebx
call sub.msvcrt.dll_fgetc
cmp eax, 0xffffffff
mov edx, dword [esi + 4]
setne al
movzx eax, al
jmp 0x45d146
Function at 0x481f90
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x481fa3
mov eax, dword [eax]
mov dword [esp + 4], eax
jmp fcn.004d49d0
xor eax, eax
ret

Function at 0x482ac0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov eax, 1
push esi
push ebx
sub esp, 0x43c
call fcn.00481b40
cmp eax, 0xffffffff
je 0x482b36
mov esi, eax
lea ebp, [esp + 0x2c]
lea ebx, [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x482b06
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x482b2a
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [esp + 0x450]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x400
mov dword [esp + 4], ebx
mov dword [esp], esi
call edi
sub esp, 0x14
test eax, eax
jne 0x482af0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
add esp, 0x43c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x482b50
Capabilities:
Write file on windows

Disassembly:
push ebx
mov eax, 2
sub esp, 0x38
call fcn.00481b40
cmp eax, 0xffffffff
je 0x482b9d
mov ebx, eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
add esp, 0x38
pop ebx
ret
Function at 0x48b3c0
Capabilities:
Create pipe

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x38
mov eax, dword [eax]
cmp dl, 1
lea edx, [esp + 0x24]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x1000
mov dword [esp + 0x28], eax
sbb eax, eax
mov dword [esp + 0x1c], edx
and eax, 0xfff80000
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0xff
add eax, 0x40080003
mov dword [esp + 8], 8
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
sub esp, 0x20
cmp eax, 0xffffffff
mov dword [ebx + 0xc], eax
setne al
add esp, 0x38
pop ebx
ret

Function at 0x48b440
Capabilities:
Connect pipe

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x20
test dl, dl
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x48b481
mov eax, dword [ebx + 0x28]
mov esi, dword [ebx + 0xc]
mov edx, dword [eax]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x48b540
mov dword [esp], eax
call dword [edx + 0x10]
test eax, eax
jne 0x48b511
xor edx, edx
mov eax, ebx
call fcn.0048b3c0
test al, al
je 0x48b4b3
lea eax, [ebx + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
sub esp, 8
test eax, eax
jne 0x48b452
call edi
cmp eax, 0x3e5
mov esi, eax
je 0x48b50a
test eax, eax
je 0x48b452
cmp eax, 0x217
jne 0x48b4b7
jmp 0x48b452
call edi
mov esi, eax
mov dword [esp], esi
call fcn.004d5ed0
mov dword [esp], str.Error_while_listening_to_named_pipe:__s
mov dword [esp + 4], eax
call fcn.004cc080
mov edi, eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.0048a280
mov edx, dword [ebx + 0x28]
mov ecx, dword [edx]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], edx
call dword [ecx]
mov dword [esp], edi
call fcn.004cd6d0
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x48b474
Function at 0x48c270
Capabilities:
Create thread

Disassembly:
push esi
push ebx
sub esp, 0x34
mov dword [esp + 8], 0
mov dword [esp + 4], 0x102c
mov dword [esp], 1
call fcn.004cd640
mov ebx, eax
mov dword [eax], 0
mov eax, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 4], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x10
mov dword [ebx + 0x10], eax
cmp dword [0x4df0ec], 0xffffffff
mov eax, dword [esp + 0x44]
mov byte [ebx + 0x16], 0
mov byte [ebx + 0x14], 0
mov byte [ebx + 0x15], 0
mov dword [ebx + 0x1028], eax
mov eax, dword [esp + 0x48]
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0x4c]
mov dword [ebx + 0x1c], eax
je 0x48c350
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x48bbe0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x14], eax
lea eax, [ebx + 4]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
test eax, eax
je 0x48c341
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov byte [ebx + 0x17], 1
add esp, 0x34
mov eax, ebx
pop ebx
pop esi
ret
mov dword [0x521f78], 0x521f78
mov dword [0x521f7c], 0x521f78
mov dword [esp], 0x521f60
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x10
mov dword [0x4df0ec], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x48c0a0
mov dword [esp], eax
call fcn.0043ff10
jmp 0x48c2fa
Function at 0x48c3c0
Capabilities:
Create thread

Disassembly:
push esi
push ebx
sub esp, 0x34
mov dword [esp + 8], 0
mov dword [esp + 4], 0x102c
mov dword [esp], 1
call fcn.004cd640
mov ebx, eax
mov dword [eax], 1
mov eax, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 4], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x10
mov dword [ebx + 0x10], eax
mov byte [ebx + 0x17], 0
mov eax, dword [esp + 0x48]
mov byte [ebx + 0x16], 0
mov byte [ebx + 0x14], 0
mov byte [ebx + 0x15], 0
mov dword [ebx + 0x18], eax
lea eax, [ebx + 0x30]
mov dword [esp], eax
call fcn.004c9530
mov eax, dword [esp + 0x44]
cmp dword [0x4df0ec], 0xffffffff
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x4c], ebx
mov dword [ebx + 0x48], eax
mov eax, dword [esp + 0x4c]
mov dword [ebx + 0x1c], eax
je 0x48c4b0
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x48be50
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x14], eax
lea eax, [ebx + 4]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
test eax, eax
je 0x48c4a7
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
add esp, 0x34
mov eax, ebx
pop ebx
pop esi
ret
mov dword [0x521f78], 0x521f78
mov dword [0x521f7c], 0x521f78
mov dword [esp], 0x521f60
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x10
mov dword [0x4df0ec], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x48c0a0
mov dword [esp], eax
call fcn.0043ff10
jmp 0x48c460
Function at 0x49ac30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x64]
mov ebx, dword [esp + 0x70]
mov ebp, dword [esp + 0x68]
mov esi, dword [esp + 0x74]
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x88]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x90]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x8c]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov edi, dword [esp + 0x78]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], edx
call fcn.004cea60
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x80], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x78], eax
mov dword [esp + 0x60], ebp
mov dword [esp + 0x7c], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x74], ecx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x70], edx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x64], edx
add esp, 0x4c
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0049a0d0

Function at 0x49ad20
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
mov ecx, 0x10624dd3
push esi
push ebx
mov esi, 1
mov ebx, 1
sub esp, 0x4c
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
imul edx, dword [esp + 0x68], 0x3e8
mov eax, edx
mul ecx
shr edx, 6
mov dword [esp + 0x3c], edx
jmp 0x49ad7b
mov eax, ebx
not eax
cmp eax, esi
jb 0x49ae16
mov eax, dword [esp + 0x98]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004ceb00
lea eax, [esi + ebx]
mov esi, ebx
mov ebx, eax
call edi
mov ebp, eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x98]
mov dword [esp], eax
call fcn.004cea60
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x90]
mov edx, dword [esp + 0x94]
mov ecx, dword [esp + 0x64]
mov dword [esp], ebx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x8c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x7c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x70]
call fcn.0049a0d0
call edi
sub eax, ebp
cmp dword [esp + 0x3c], eax
ja 0x49ad51
mov eax, dword [esp + 0x6c]
mov dword [eax], ebx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4c8f20
Capabilities:
Encode data using base64

Disassembly:
push esi
push ebx
xor edx, edx
sub esp, 0x10
mov ecx, dword [esp + 0x1c]
movsx eax, byte [ecx + edx]
lea ebx, [eax - 0x41]
cmp bl, 0x19
ja 0x4c8fe0
sub eax, 0x41
mov dword [esp + edx*4], eax
add edx, 1
cmp edx, 4
jne 0x4c8f2b
mov edx, dword [esp]
cmp edx, 0xffffffff
je 0x4c8fd0
mov ecx, dword [esp + 4]
cmp ecx, 0xffffffff
je 0x4c8fd0
mov ebx, dword [esp + 8]
mov esi, dword [esp + 0xc]
cmp ebx, 0xffffffff
je 0x4c9020
xor eax, eax
cmp esi, 0xffffffff
setne al
shl ecx, 0xc
shl edx, 0x12
or edx, ecx
and esi, 0x3f
shl ebx, 6
or edx, esi
and ebx, 0xfc0
mov esi, dword [esp + 0x20]
or edx, ebx
add eax, 2
mov ecx, edx
shr ecx, 0x10
cmp eax, 3
mov byte [esi + 1], dh
mov byte [esi], cl
jne 0x4c9050
mov esi, dword [esp + 0x20]
mov byte [esi + 2], dl
add esp, 0x10
pop ebx
pop esi
ret
lea ebx, [eax - 0x30]
cmp bl, 9
jbe 0x4c8ff0
cmp al, 0x2b
je 0x4c9010
cmp al, 0x2f
je 0x4c9041
cmp al, 0x3d
je 0x4c9000
lea esi, [esi]
lea edi, [edi]
xor eax, eax
add esp, 0x10
pop ebx
pop esi
ret
lea ebx, [eax - 0x61]
cmp bl, 0x19
ja 0x4c8fb2
sub eax, 0x47
jmp 0x4c8f3e
add eax, 4
jmp 0x4c8f3e
mov eax, 0xffffffff
jmp 0x4c8f3e
mov eax, 0x3e
jmp 0x4c8f3e
cmp esi, 0xffffffff
jne 0x4c8fd0
mov eax, dword [esp + 0x20]
shl edx, 0x12
shl ecx, 0xc
or edx, ecx
shr edx, 0x10
mov byte [eax], dl
add esp, 0x10
mov eax, 1
pop ebx
pop esi
ret
mov eax, 0x3f
jmp 0x4c8f3e
mov eax, 2
jmp 0x4c8fd2
Function at 0x4d4150
Capabilities:
Get session user name

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x52218c], 0
mov eax, dword [0x522188]
je 0x4d41f0
test eax, eax
je 0x4d42e0
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], 0
mov dword [esp + 4], 0
mov dword [esp], 8
mov dword [esp + 8], esi
call eax
sub esp, 0xc
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.004cd640
mov dword [esp + 8], esi
mov ebx, eax
mov dword [esp + 4], eax
mov dword [esp], 8
call dword [0x522188]
sub esp, 0xc
test al, al
je 0x4d4240
mov dword [esp + 4], 0x40
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x4d41e5
mov byte [eax], 0
add esp, 0x20
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov dword [esp], str.secur32.dll
call fcn.004d4420
mov dword [esp], str.sspicli.dll
mov ebx, eax
call fcn.004d4420
test ebx, ebx
je 0x4d42c0
mov dword [esp + 4], str.GetUserNameExA
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x52218c], 1
sub esp, 8
mov dword [0x522188], eax
jmp 0x4d4168
mov dword [esp], ebx
call fcn.004cd6d0
mov dword [esp + 0x1c], 0
mov dword [esp + 4], esi
mov dword [esp], 0
mov edi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call edi
sub esp, 8
test eax, eax
je 0x4d42b0
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.004cd640
mov dword [esp + 4], esi
mov ebx, eax
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
jne 0x4d41e5
mov dword [esp], ebx
xor ebx, ebx
call fcn.004cd6d0
add esp, 0x20
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0x1c], 0x100
mov eax, 0x100
jmp 0x4d426e
mov dword [0x522188], 0
mov byte [0x52218c], 1
lea esi, [esp + 0x1c]
jmp 0x4d4248
lea esi, [esp + 0x1c]
jmp 0x4d4248

Function at 0x4d4830
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
sub esp, 8
add esp, 0x1c
ret

Function at 0x4d4850
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [esp + 8], 0
mov dword [esp + 4], 1
lea ebp, [esp + 0x2c]
mov dword [esp], 0x105
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x54]
mov dword [esp + 0x2c], 0x105
call fcn.004cd640
mov ebx, eax
jmp 0x4d48c5
cmp eax, 0xea
jne 0x4d48f0
mov eax, dword [esp + 0x2c]
mov dword [esp], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 8], 1
mov dword [esp + 4], ebp
mov dword [esp + 0xc], eax
call fcn.004cd6f0
mov ebx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
mov dword [esp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
sub esp, 0x10
test eax, eax
jne 0x4d4890
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
xor ebx, ebx
call fcn.004cd6d0
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4d4910
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x3c
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 4
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor edx, edx
sub esp, 0x18
test eax, eax
jne 0x4d4960
cmp dword [esp + 0x2c], 4
je 0x4d4970
mov eax, edx
add esp, 0x3c
ret
cmp dword [esp + 0x28], 4
sete dl
add esp, 0x3c
mov eax, edx
ret

Function at 0x4d4980
Capabilities:
Set registry value

Disassembly:
sub esp, 0x2c
lea eax, [esp + 0x38]
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
test eax, eax
sete al
add esp, 0x2c
ret

Function at 0x4d49d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
xor esi, esi
sub esp, 0x4c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x64]
lea ebp, [esp + 0x3c]
lea edi, [esp + 0x38]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
jne 0x4d4a86
cmp dword [esp + 0x38], 1
jne 0x4d4a86
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
lea ecx, [eax + 1]
mov dword [esp], ecx
mov dword [esp + 0x2c], ecx
call fcn.004cd640
mov dword [esp + 0x10], eax
mov esi, eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x14], ebp
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
jne 0x4d4ab2
cmp dword [esp + 0x38], 1
mov ecx, dword [esp + 0x2c]
jne 0x4d4ab2
mov eax, dword [esp + 0x3c]
cmp eax, ecx
jae 0x4d4a90
mov byte [esi + eax], 0
add esp, 0x4c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x6c
mov dword [esp + 4], str._MoTTY_windows_utils_registry.c
mov dword [esp], str.size___allocsize
call fcn.004d8b40
mov eax, dword [esp + 0x3c]
jmp 0x4d4a82
mov dword [esp], esi
xor esi, esi
call fcn.004cd6d0
add esp, 0x4c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4d4ad0
Capabilities:
Set registry value

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x38]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
add eax, 1
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
test eax, eax
sete al
add esp, 0x28
pop ebx
ret