joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46db0d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi]
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
xor ebx, ebx
cmp byte [edi + 0x49], 4
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], eax
jne 0x46db38
mov eax, dword [edi + 0x44]
jmp 0x46dcc3
mov ecx, dword [edi + 0x3c]
push edi
call fcn.0046d3c5
pop ecx
cmp eax, ebx
jne 0x46dcc3
cmp dword [edi + 0x10], ebx
jne 0x46db8f
push ebx
push dword [ebp + 0x10]
mov eax, esi
push dword [ebp + 0xc]
call fcn.0043cd52
add esp, 0xc
test byte [edi + 0x48], 2
je 0x46db8f
cmp dword [ebp + 0x10], ebx
jl 0x46db8f
jg 0x46db72
cmp dword [ebp + 0xc], ebx
jbe 0x46db8f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [edi + 0x18]
sub eax, 1
sbb ecx, ebx
cmp edx, eax
jne 0x46db8f
mov eax, dword [edi + 0x1c]
cmp eax, ecx
jne 0x46db8f
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 4], ebx
jne 0x46dbb5
push dword [ebp + 0x20]
lea ecx, [ebp - 4]
push dword [ebp + 0x10]
mov esi, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0046d3fd
add esp, 0x10
cmp eax, ebx
jne 0x46dcc3
movsx eax, word [edi + 0x4c]
mov esi, dword [edi + eax*4 + 0x78]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x50]
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
mov eax, esi
call fcn.00466129
add esp, 0x20
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x46dcc3
movsx eax, word [edi + 0x4c]
lea eax, [edi + eax*2 + 0x4e]
movzx ecx, word [eax]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 4], ebx
jne 0x46dc6a
mov eax, dword [esi + 0x44]
call fcn.0045751f
cmp eax, ebx
jne 0x46dcc3
mov eax, dword [esi + 0x40]
mov ecx, dword [ebp - 0xc]
lea ecx, [eax + ecx*2]
movzx eax, byte [ecx]
movzx ecx, byte [ecx + 1]
shl eax, 8
or eax, ecx
movzx ecx, word [esi + 0x14]
and eax, ecx
add eax, dword [esi + 0x38]
cmp byte [esi + 5], bl
jne 0x46dc3f
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
mov dword [edx], ecx
lea ecx, [ebp - 4]
push ecx
mov ecx, esi
call fcn.00466009
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
movzx eax, word [ebp - 4]
push eax
push dword [ebp - 0xc]
call fcn.0044ab6f
mov eax, dword [ebp - 8]
add esp, 0x10
cmp eax, ebx
jne 0x46dcc3
jmp 0x46dc81
jge 0x46dc81
cmp word [esi + 0x12], bx
jbe 0x46dc81
inc word [eax]
movsx eax, word [edi + 0x4c]
movzx eax, word [edi + eax*2 + 0x4e]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push ebx
push ebx
push dword [ebp - 0x10]
mov ecx, esi
push dword [ebp - 0x14]
call fcn.004579e3
xor eax, eax
mov word [edi + 0x2c], ax
mov eax, dword [ebp - 8]
add esp, 0x14
cmp eax, ebx
jne 0x46dcc3
cmp byte [esi + 1], bl
je 0x46dcc3
and byte [edi + 0x48], 0xfd
call fcn.0046a297
movsx ecx, word [edi + 0x4c]
mov ecx, dword [edi + ecx*4 + 0x78]
mov byte [ecx + 1], bl
mov byte [edi + 0x49], bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46dcc8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [edi]
movsx ebx, word [edi + 0x4c]
mov ecx, dword [edi + ebx*4 + 0x78]
mov dx, word [edi + ebx*2 + 0x4e]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
xor eax, eax
inc eax
mov dword [ebp - 0x1c], ebx
cmp dx, word [ecx + 0x12]
jae 0x46de99
cmp byte [edi + 0x49], al
jne 0x46de99
mov esi, ecx
mov ecx, dword [esi + 0x40]
movzx eax, dx
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [ecx]
movzx ecx, byte [ecx + 1]
shl eax, 8
or eax, ecx
movzx ecx, word [esi + 0x14]
and eax, ecx
add eax, dword [esi + 0x38]
cmp byte [esi + 5], 0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
jne 0x46dd4d
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push edi
call fcn.0046dac2
pop ecx
pop ecx
test eax, eax
jne 0x46de99
mov ecx, dword [edi + 0x3c]
mov eax, dword [ebp - 0xc]
push edi
call fcn.0046d3c5
pop ecx
test eax, eax
jne 0x46de99
cmp dword [edi + 0x10], eax
jne 0x46dd79
push eax
push dword [edi + 0x1c]
mov eax, dword [ebp - 4]
push dword [edi + 0x18]
call fcn.0043cd52
add esp, 0xc
mov eax, dword [esi + 0x44]
call fcn.0045751f
test eax, eax
jne 0x46de99
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov ecx, esi
call fcn.00466009
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
movzx eax, word [ebp - 4]
push eax
push dword [ebp - 0x10]
call fcn.0044ab6f
mov eax, dword [ebp - 8]
add esp, 0x10
test eax, eax
jne 0x46de99
cmp byte [esi + 5], al
jne 0x46de55
movsx eax, word [edi + 0x4c]
mov esi, dword [edi + eax*4 + 0x78]
mov eax, dword [edi + ebx*4 + 0x7c]
mov eax, dword [eax + 0x48]
mov ecx, dword [esi + 0x40]
mov dword [ebp - 0x14], eax
movzx eax, word [esi + 0x12]
lea eax, [ecx + eax*2]
movzx ebx, byte [eax - 2]
movzx eax, byte [eax - 1]
shl ebx, 8
or ebx, eax
movzx eax, word [esi + 0x14]
and ebx, eax
add ebx, dword [esi + 0x38]
mov edx, esi
push ebx
call fcn.0043cef7
movzx eax, ax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x44]
call fcn.0045751f
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
mov eax, dword [ebp - 4]
push dword [ebp - 0xc]
add eax, 4
push eax
mov eax, dword [ebp - 0x10]
add ebx, 0xfffffffc
push ebx
call fcn.004579e3
lea eax, [ebp - 8]
push eax
movzx eax, word [esi + 0x12]
push dword [ebp - 4]
dec eax
push eax
call fcn.0044ab6f
mov eax, dword [ebp - 8]
add esp, 0x24
test eax, eax
jne 0x46de99
mov ebx, dword [ebp - 0x1c]
call fcn.0046a297
mov esi, eax
test esi, esi
jne 0x46de97
movsx eax, word [edi + 0x4c]
cmp eax, ebx
jle 0x46de90
movzx ecx, word [edi + 0x4c]
movsx eax, cx
mov eax, dword [edi + eax*4 + 0x78]
dec ecx
mov word [edi + 0x4c], cx
call fcn.004648c7
movsx eax, word [edi + 0x4c]
cmp eax, ebx
jg 0x46de68
call fcn.0046a297
mov esi, eax
test esi, esi
jne 0x46de97
mov eax, edi
call fcn.00469236
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4833a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a9bf1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4d9114]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0xc], 0
call fcn.00485e50
mov dword [esp + 0x24], 1
push 0x4c2ce4
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00403e3d
mov byte [esp + 0x30], 2
mov edx, dword [esp + 0x3c]
push edx
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00403e3d
mov byte [esp + 0x3c], 3
mov esi, dword [esp + 0x44]
push 0x4bcbac
push eax
push esi
call fcn.00403e3d
add esp, 0x28
mov dword [esp + 8], 1
mov byte [esp + 0x20], 2
lea ecx, [esp + 0xc]
call fcn.00403910
mov byte [esp + 0x20], 1
lea ecx, [esp + 0x10]
call fcn.00403910
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x14]
call fcn.00403910
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret

Function at 0x483460
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a9bf1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4d9114]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0xc], 0
call fcn.00485e50
mov dword [esp + 0x24], 1
push 0x4c2ce4
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00403e3d
mov byte [esp + 0x30], 2
mov edx, dword [esp + 0x3c]
push edx
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00403e3d
mov byte [esp + 0x3c], 3
mov esi, dword [esp + 0x44]
push str.rsp.dat
push eax
push esi
call fcn.00403e3d
add esp, 0x28
mov dword [esp + 8], 1
mov byte [esp + 0x20], 2
lea ecx, [esp + 0xc]
call fcn.00403910
mov byte [esp + 0x20], 1
lea ecx, [esp + 0x10]
call fcn.00403910
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x14]
call fcn.00403910
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret
Function at 0x4836f0
Capabilities:
Delete file
Delete registry key
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4a9ca0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d9114]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
xor ebp, ebp
mov esi, 0x400
push 0x800
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], esi
mov byte [esp + 0x2c], 1
call fcn.00488f5f
mov ebx, eax
add esp, 4
cmp ebx, ebp
je 0x48374d
push 0x800
push ebp
push ebx
call fcn.00489de0
add esp, 0xc
mov dword [esp + 0x20], ebx
mov dword [esp + 0x4c], ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x800
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], esi
mov byte [esp + 0x44], 1
call fcn.00488f5f
mov edi, eax
add esp, 4
cmp edi, ebp
je 0x48378c
push 0x800
push ebp
push edi
call fcn.00489de0
add esp, 0xc
mov dword [esp + 0x38], edi
mov byte [esp + 0x4c], 1
push 0x800
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], esi
mov byte [esp + 0x38], 1
call fcn.00488f5f
mov esi, eax
add esp, 4
cmp esi, ebp
je 0x4837c4
push 0x800
push ebp
push esi
call fcn.00489de0
add esp, 0xc
mov dword [esp + 0x2c], esi
mov byte [esp + 0x4c], 2
mov ebp, dword [esp + 0x54]
push edi
push ebp
push ebx
call fcn.004825a0
push esi
push ebp
call fcn.00482670
add esp, 0x14
lea eax, [esp + 0x14]
push eax
push 0x20006
push 0
push str.SYSTEMCurrentControlSet_services
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48382d
mov ecx, dword [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
call fcn.0041ccc7
mov byte [esp + 0x4c], 3
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [esp + 0x58], 0
je 0x48389b
lea ecx, [esp + 0x58]
push ebp
push ecx
call fcn.004833a0
mov byte [esp + 0x54], 4
mov eax, dword [eax]
push eax
call fcn.00485000
add esp, 0xc
mov byte [esp + 0x4c], 3
lea ecx, [esp + 0x58]
call fcn.00403910
lea edx, [esp + 0x58]
push ebp
push edx
call fcn.00483460
mov byte [esp + 0x54], 5
mov eax, dword [eax]
push eax
call fcn.00485000
add esp, 0xc
mov byte [esp + 0x4c], 3
lea ecx, [esp + 0x58]
call fcn.00403910
mov byte [esp + 0x4c], 2
lea ecx, [esp + 0x18]
call fcn.0041ccf6
mov byte [esp + 0x4c], 1
xor ebp, ebp
cmp esi, ebp
je 0x4838c1
push esi
call fcn.00488e42
add esp, 4
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov byte [esp + 0x4c], 0
cmp edi, ebp
je 0x4838db
push edi
call fcn.00488e42
add esp, 4
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x4c], 0xffffffff
cmp ebx, ebp
je 0x4838f8
push ebx
call fcn.00488e42
add esp, 4
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x483a20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a9d08
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
mov eax, dword [0x4d9114]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push str.SYSTEMCurrentControlSet_services
lea ecx, [esp + 0x14]
call fcn.00403c71
mov dword [esp + 0x1c], 0
push 0x4c2ce4
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00403e3d
mov byte [esp + 0x28], 1
mov ecx, dword [esp + 0x30]
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.00403e3d
mov byte [esp + 0x34], 2
mov eax, dword [eax]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004850c0
add esp, 0x24
mov bl, al
mov byte [esp + 0x1c], 1
lea ecx, [esp + 8]
call fcn.00403910
mov byte [esp + 0x1c], 0
lea ecx, [esp + 0xc]
call fcn.00403910
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00403910
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x18
ret
Function at 0x484e70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9f3b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4d9114]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x20], ebx
xor esi, esi
mov dword [ebp - 4], esi
lea edi, [ebx + 4]
push edi
push esi
push esi
push esi
push esi
push str.FopdMonPort
call sub.FLTLIB.DLL_FilterConnectCommunicationPort
test eax, eax
jne 0x484fa7
push 4
push esi
push esi
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [ebx + 8], eax
cmp eax, esi
je 0x484fa7
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x18], esi
mov edi, edi
cmp dword [ebp - 0x18], 2
jae 0x484f8b
push 0x2c
call fcn.00488856
add esp, 4
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x484f0a
mov ecx, eax
call fcn.00484300
mov esi, eax
jmp 0x484f0c
xor esi, esi
mov byte [ebp - 4], 0
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp + 8]
mov dword [esi + 0x28], ecx
mov eax, dword [esi]
lea edx, [eax + 0x220]
push edx
push 0x220
push eax
mov eax, dword [edi]
push eax
call sub.FLTLIB.DLL_FilterGetMessage
cmp eax, 0x800703e5
jne 0x484f7a
mov ecx, dword [edi]
mov dword [esi + 0xc], ecx
mov edx, dword [ebx + 8]
mov dword [esi + 8], edx
mov ecx, esi
call fcn.00484750
push 0
push 0
push esi
push 0x484d40
push 0
push 0
call fcn.00488169
add esp, 0x18
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebx + 0xc]
call fcn.00484500
mov byte [ebp - 0x11], 1
inc dword [ebp - 0x18]
jmp 0x484ee0
push 1
mov ecx, esi
call fcn.004844e0
inc dword [ebp - 0x18]
jmp 0x484ee0
cmp byte [ebp - 0x11], 0
je 0x484fa7
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0xffffffff
jmp 0x484fc0
mov ecx, ebx
call fcn.00484620
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x485000
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
pop esi
ret
Function at 0x485170
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a9fa0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x4d9114]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea ecx, [esp + 0x14]
call fcn.0041ccc7
mov dword [esp + 0x24], 0
mov eax, dword [esp + 0x2c]
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x10], esi
mov byte [esp + 0x24], 1
cmp esi, 0xffffffff
je 0x485206
mov eax, dword [esp + 0x34]
test eax, eax
jle 0x485204
mov edx, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
push edx
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x485206
cmp dword [esp + 0xc], 0
je 0x485206
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov bl, 1
mov byte [esp + 0x24], 0
cmp esi, 0xffffffff
je 0x485217
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0041ccf6
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x485240
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4a9fc8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d9114]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebx, ebx
mov byte [esp + 0x17], bl
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], ebx
cmp byte [0x4eb6e8], bl
je 0x485288
mov edi, 0x102
cmp byte [esp + 0x3c], bl
jne 0x48528d
mov edi, 2
mov esi, dword [esp + 0x38]
mov ebp, dword [esp + 0x2c]
cmp esi, ebx
je 0x4852c3
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4852ac
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], ebx
push ebx
lea eax, [esp + 0x1c]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x485317
mov edi, dword [esp + 0x34]
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4852d0
mov ecx, dword [esp + 0x18]
sub eax, edx
sar eax, 1
cmp esi, ebx
jne 0x4852e9
mov ecx, ebp
lea edx, [eax + eax]
mov eax, dword [esp + 0x30]
push edx
push edi
push 1
push eax
push ebx
push ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, ebx
jne 0x485317
mov eax, dword [esp + 0x18]
cmp esi, ebx
jne 0x48530b
mov eax, ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov byte [esp + 0x17], 1
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x48532e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x485350
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4a9fc8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d9114]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebx, ebx
mov byte [esp + 0x17], bl
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], ebx
cmp byte [0x4eb6e8], bl
je 0x485398
mov esi, 0x102
cmp byte [esp + 0x3c], bl
jne 0x48539d
mov esi, 2
mov edi, dword [esp + 0x38]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x4853db
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4853ba
push eax
call ebp
mov dword [esp + 0x18], ebx
push ebx
lea eax, [esp + 0x1c]
push eax
push ebx
push esi
mov esi, dword [esp + 0x3c]
push ebx
push ebx
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x48540f
mov eax, dword [esp + 0x18]
jmp 0x4853e1
mov esi, dword [esp + 0x2c]
mov eax, esi
mov edx, dword [esp + 0x30]
push 4
lea ecx, [esp + 0x38]
push ecx
push 4
push edx
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, ebx
jne 0x48540f
cmp edi, ebx
je 0x485403
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov byte [esp + 0x17], 1
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x485422
push eax
call ebp
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x485500
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4aa038
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d9114]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
mov eax, ebp
lea edx, [eax + 2]
xor ebx, ebx
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x485532
sub eax, edx
sar eax, 1
add eax, 4
lea edi, [eax + eax]
push edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], 1
call fcn.00488f5f
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x48556e
push edi
push ebx
push esi
call fcn.00489de0
add esp, 0xc
mov dword [esp + 0x14], esi
mov dword [esp + 0x28], ebx
mov edx, esi
mov eax, ebp
sub edx, ebp
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x485580
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push edi
push esi
push 7
push eax
push ebx
push ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [esp + 0x28], 0xffffffff
cmp esi, ebx
je 0x4855bd
push esi
call fcn.00488e42
add esp, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x485630
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4aa0b1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4d9114]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
push 0x4c2ce4
lea eax, [esi + 0x250]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x14], 0
call fcn.00403e3d
mov dword [esp + 0x24], 1
add esi, 0x2c
push esi
mov esi, dword [esp + 0x30]
push eax
push esi
call fcn.00403e3d
add esp, 0x18
mov dword [esp + 8], 1
mov byte [esp + 0x18], 0
lea ecx, [esp + 0xc]
call fcn.00403910
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 4

Function at 0x4857b0
Capabilities:
Get common file path
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4aa0f1
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4d9114]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x14], ebx
mov edi, dword [esp + 0x34]
mov ecx, edi
call fcn.0040387f
mov dword [esp + 0x2c], ebx
push 0x800
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0x400
mov byte [esp + 0x24], 1
call fcn.00488f5f
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x48582e
push 0x800
push ebx
push esi
call fcn.00489de0
add esp, 0xc
mov dword [esp + 0x18], esi
mov dword [esp + 0x2c], 1
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x20]
push ecx
push ebx
push ebx
xor eax, eax
push esi
mov word [esi + 6], ax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov cl, byte [esp + 0x10]
movzx edx, byte [esp + 0x11]
movzx eax, cl
add eax, edx
movzx edx, byte [esp + 0x12]
add eax, edx
movzx edx, byte [esp + 0x13]
add eax, edx
movzx edx, byte [esp + 0x13]
push eax
mov byte [esp + 0x14], dl
movzx edx, byte [esp + 0x16]
mov byte [esp + 0x17], cl
mov cl, byte [esp + 0x15]
push 0x4c39cc
push edi
mov byte [esp + 0x1d], dl
mov byte [esp + 0x1e], cl
call fcn.004120c7
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x44]
push eax
push 0x4c39cc
push ecx
call fcn.004120c7
mov byte [esp + 0x44], bl
push esi
call fcn.00488e42
add esp, 0x1c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret