joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49bbb0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da513
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x624
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp + 8]
lea ecx, [edi + 0xc]
mov dword [edi], vtable.CSynDeviceGestureActionService.0
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
call fcn.0042a590
mov dword [edi + 0xc], eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x230]
mov dword [ebp + 8], 0x101
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x34]
test ecx, ecx
jne 0x49bc2a
lea ecx, [eax + 0x40]
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push ebx
push edx
push 0x10000101
push ecx
call dword [eax + 0xc]
or ecx, 0xffffffff
test eax, eax
lea eax, [ebp - 0x230]
cmove ecx, dword [ebp - 0x10]
push ecx
push eax
push str..pipe_sC01BC476_A852_4dfd_B33F_E308F3497BF4_li
lea eax, [ebp - 0x630]
push 0x200
push eax
call fcn.004a6937
push 0x4dbeb4
push 0x4e4aa0
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.0049f140
add esp, 0x24
cmp dword [eax + 0x10], 0
setne bl
cmp dword [ebp - 0x14], 8
jb 0x49bc91
push dword [ebp - 0x28]
call fcn.004a46e7
add esp, 4
test bl, bl
pop ebx
je 0x49bce2
push 0x4dbeb4
push 0x4e4aa0
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.0049f140
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x49bcb6
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x630]
push eax
push str._s_s
push 0x200
push eax
call fcn.004a6937
add esp, 0x14
cmp dword [ebp - 0x14], 8
jb 0x49bce2
push dword [ebp - 0x28]
call fcn.004a46e7
add esp, 4
lea eax, [ebp - 0x630]
push 0x3d
push eax
call fcn.004024f0
add esp, 8
mov dword [edi + 8], eax
test eax, eax
je 0x49bd02
push edi
mov ecx, eax
call fcn.00401bc0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x49cbd0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4da660
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
call fcn.0049c290
test eax, eax
je 0x49cdcb
push 0x4ea910
push eax
call fcn.004aaa0d
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x49cdcb
mov ecx, dword [str.SoftwareSynaptics]
mov edi, 0x510934
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49cc21
mov eax, dword [0x517d80]
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 3]
mov dword [ebp - 0x10], esi
test eax, eax
jne 0x49cd0a
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x4db8b8
call fcn.00406df0
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x4db8b8
call fcn.00406df0
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x4db8b8
call fcn.00406df0
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x4db8b8
call fcn.00406df0
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
push str.SynSaveUserRegistryMutex
call fcn.00406df0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.0049e920
add esp, 0x7c
cmp dword [eax + 0x14], 8
jb 0x49ccc8
mov eax, dword [eax]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp dword [ebp - 0x28], 8
mov dword [0x517d80], eax
jb 0x49ccee
push dword [ebp - 0x3c]
call fcn.004a46e7
mov eax, dword [0x517d80]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x2c], 0
mov word [ebp - 0x3c], cx
test eax, eax
je 0x49cdc2
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x49cda0
mov ecx, dword [0x510934]
test ecx, ecx
je 0x49cd92
jmp 0x49cd30
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49cd33
sub ecx, edx
mov edx, 2
sar ecx, 1
lea eax, [ecx + esi]
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a3ac6
push dword [edi]
mov esi, eax
push dword [0x510930]
push 0x4e01f8
push esi
call fcn.004a6894
push esi
push SysReAllocString
push ebx
call fcn.0049ca90
push esi
call fcn.004a6088
mov ecx, dword [edi + 4]
add edi, 4
mov esi, dword [ebp - 0x10]
add esp, 0x24
test ecx, ecx
jne 0x49cd30
push dword [0x517d80]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x49cdc2
push dword [0x517d80]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x517d80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x517d80], 0
push ebx
call fcn.004a8f94
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49ded0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da6ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x517dd8]
mov dword [ebp - 0x10], 0
test al, 1
jne 0x49df4d
or eax, 1
mov dword [0x517dd8], eax
xor eax, eax
mov dword [ebp - 4], 0
push eax
push 0x4db8b8
mov ecx, 0x517dc0
mov dword [0x517dd4], 7
mov dword [0x517dd0], 0
mov word [0x517dc0], ax
call fcn.00405410
push 0x4dad70
call fcn.004a5b6e
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [0x517dbc], 0
push esi
jne 0x49dfac
push 1
push 0x23
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x218], 0
jne 0x49df78
xor ecx, ecx
jmp 0x49df90
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49df81
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, 0x517dc0
push eax
call fcn.00405410
mov dword [0x517dbc], 1
mov esi, dword [ebp + 8]
xor eax, eax
push 0xffffffffffffffff
push 0
push 0x517dc0
mov dword [esi + 0x14], 7
mov ecx, esi
mov dword [esi + 0x10], 0
mov word [esi], ax
call fcn.004052f0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x49dff0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push 0x206
push eax
mov word [ebp - 0x228], ax
xor esi, esi
lea eax, [ebp - 0x226]
mov dword [ebx], 1
push eax
call fcn.004a4860
add esp, 0xc
mov dword [ebp - 8], 0x104
lea eax, [ebp - 8]
mov dword [ebp + 8], esi
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x49e0e1
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0043dda0
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x49e062
mov eax, dword [eax]
push edi
lea ecx, [ebp + 8]
push ecx
push 1
push eax
push 0
call sub.NETAPI32.dll_NetUserGetInfo
cmp dword [ebp - 0xc], 8
mov edi, eax
jb 0x49e084
push dword [ebp - 0x20]
call fcn.004a46e7
add esp, 4
test edi, edi
je 0x49e0c9
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push 1
push 0
call sub.NETAPI32.dll_NetWkstaUserGetInfo
mov edi, eax
test edi, edi
jne 0x49e0b3
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push 1
push dword [eax]
push dword [eax + 0xc]
call sub.NETAPI32.dll_NetUserGetInfo
mov edi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x49e0c0
push eax
call sub.NETAPI32.dll_NetApiBufferFree
test edi, edi
je 0x49e0c9
mov ecx, dword [ebp + 8]
jmp 0x49e0d6
mov ecx, dword [ebp + 8]
mov esi, 1
mov eax, dword [ecx + 0xc]
mov dword [ebx], eax
pop edi
test ecx, ecx
je 0x49e0e1
push ecx
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49e130
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x22c], 0x22c
cmp esi, 0xffffffff
je 0x49e1bb
lea eax, [ebp - 0x22c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x49e1b4
push edi
mov edi, dword [ebp + 8]
jmp 0x49e170
cmp dword [ebp - 0x224], edi
je 0x49e199
lea eax, [ebp - 0x22c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x49e170
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004a6546
add esp, 0xc
mov ebx, 1
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49f950
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x49f9b7
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [ebp + 8]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x49f9b7
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x49f9b7
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x49f9b7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ebp
ret
mov eax, 1
pop esi
pop ebp
ret
Function at 0x4a0b40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x25c]
sub esp, 0x25c
sub edx, eax
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x4a0b54
push 0x44
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.004a4860
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
add esp, 0xc
mov word [ebp - 0x24], ax
mov eax, dword [ebp + 0x10]
test eax, eax
mov dword [ebp - 0x54], 0x44
cmovne ecx, eax
lea eax, [ebp - 0x54]
push ecx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x25c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esp, ebp
pop ebp
ret

Function at 0x4a0d70
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
test edi, edi
je 0x4a0e4c
mov edx, edi
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4a0d95
sub edx, esi
sar edx, 1
je 0x4a0e4c
lea eax, [ebp + 0xc]
push eax
push 0x10008
push 0
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a0e4c
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, edi
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x200
push eax
lea eax, [ebp - 0x408]
push eax
push 0
push dword [ebp + 0xc]
call ebx
mov esi, eax
cmp esi, 0x103
je 0x4a0e27
test esi, esi
jne 0x4a0e33
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x408]
push eax
push dword [ebp + 0xc]
call fcn.004a0d70
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffffc0e
add esi, 0x3f2
je 0x4a0dd0
jmp 0x4a0e33
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop ebx
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4a0ea0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 8]
push edi
test eax, eax
je 0x4a0f0d
mov edi, dword [ebp + 8]
test edi, edi
je 0x4a0f0d
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp + 8], eax
test esi, esi
je 0x4a0ee9
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4a0ee6
pop esi
xor eax, eax
pop edi
pop ebp
ret 8
mov eax, dword [ebp + 8]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
test esi, esi
je 0x4a0f00
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop esi
sete al
pop edi
pop ebp
ret 8
xor eax, eax
pop edi
pop ebp
ret 8
Function at 0x4a0f90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, ecx
xor ecx, ecx
push esi
push edi
cmp dword [ebp + 8], ecx
je 0x4a1048
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4a1048
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4a1048
mov eax, dword [eax + 8]
push ebx
test eax, eax
je 0x4a1021
mov ebx, dword [ebp + 0x18]
mov ecx, dword [edi]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], ecx
test ebx, ebx
je 0x4a0fe9
lea ecx, [ebp + 0xc]
push ecx
push 0x20019
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a101e
mov eax, dword [ebp + 0xc]
push edi
push esi
lea ecx, [ebp + 0x18]
push ecx
push 0
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test ebx, ebx
je 0x4a100a
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x4a101e
xor eax, eax
cmp dword [ebp + 0x18], 3
pop ebx
pop edi
sete al
pop esi
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4a103f
push ecx
push eax
push esi
call fcn.004a4960
add esp, 0xc
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
ret 0x14
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x14
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x14

Function at 0x4a1050
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
test esi, esi
je 0x4a1062
mov ebx, dword [esi]
cmp dword [ebp + 8], 0
je 0x4a10e2
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4a10e2
mov eax, dword [ecx + 8]
test eax, eax
je 0x4a10ed
mov ecx, dword [ebp + 0x14]
mov dword [ebp + 0x10], eax
test ecx, ecx
je 0x4a109a
lea edx, [ebp + 0x10]
push edx
push 0x20019
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a10ed
mov eax, dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], 4
push ecx
push edi
lea ecx, [ebp - 4]
push ecx
push 0
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp + 0x14], 0
mov dword [ebp + 8], eax
je 0x4a10cb
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4a10ed
mov eax, dword [ebp - 4]
cmp eax, 4
je 0x4a10f3
cmp eax, 3
jne 0x4a10e2
cmp dword [ebp + 0xc], 4
je 0x4a10f3
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test esi, esi
je 0x4a10e2
mov dword [edi], ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a1110
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
push esi
push edi
test ebx, ebx
je 0x4a1225
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4a1225
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4a1225
mov eax, dword [ecx + 8]
test eax, eax
je 0x4a1233
mov ecx, dword [edi]
mov edi, dword [ebp + 0x18]
mov dword [ebp + 8], eax
mov dword [ebp - 4], ecx
test edi, edi
je 0x4a1177
lea ecx, [ebp + 8]
push ecx
push 0x20019
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a1230
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
push esi
push ecx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp + 0x18], eax
test edi, edi
je 0x4a1199
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0xc]
cmp ecx, 2
jne 0x4a1210
mov ebx, dword [ebp - 4]
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a3ac6
mov edi, eax
add esp, 4
test edi, edi
je 0x4a120d
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, esi
mov ecx, edi
sub edx, edi
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4a11d4
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a11f0
mov eax, dword [ebp + 0x10]
sub ecx, edx
sar ecx, 1
push edi
mov dword [eax], ecx
call fcn.004a46e7
add esp, 4
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x18], 0
jne 0x4a1230
cmp ecx, 1
je 0x4a1272
cmp ecx, 7
je 0x4a1272
cmp ecx, 2
je 0x4a1272
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x4a1225
mov edx, ecx
lea ebx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4a1240
sub edx, ebx
sar edx, 1
lea edx, [edx*2 + 2]
cmp edx, dword [ebp - 4]
ja 0x4a1225
sub esi, ecx
lea ecx, [ecx]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x4a1260
mov dword [edi], edx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4a14b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 8]
push edi
test eax, eax
je 0x4a152e
mov edi, dword [ebp + 8]
test edi, edi
je 0x4a152e
cmp dword [ebp + 0x10], 0
je 0x4a152e
push esi
mov esi, dword [ebp + 0x18]
mov dword [ebp + 8], eax
test esi, esi
je 0x4a14ff
lea ecx, [ebp + 0x18]
push ecx
lea ecx, [ebp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4a14fc
pop esi
xor eax, eax
pop edi
pop ebp
ret 0x14
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test esi, esi
je 0x4a1521
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop esi
sete al
pop edi
pop ebp
ret 0x14
xor eax, eax
pop edi
pop ebp
ret 0x14
Function at 0x4a2090
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, ecx
push 0x820
push 0
lea eax, [edi + 0x1c]
push eax
call fcn.004a4860
add esp, 0xc
mov dword [edi + 0x83c], 0
mov dword [edi + 0x840], 0
mov dword [edi + 0x844], 0
mov dword [edi + 0x848], 0
push str.DXVA2.DLL
mov dword [edi + 0x84c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 4], eax
test eax, eax
je 0x4a2155
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetNumberOfPhysicalMonitorsFromHMONITOR
push eax
call esi
push str.GetPhysicalMonitorsFromHMONITOR
push dword [edi + 4]
mov dword [edi + 8], eax
call esi
push str.DestroyPhysicalMonitors
push dword [edi + 4]
mov dword [edi + 0xc], eax
call esi
push str.GetMonitorBrightness
push dword [edi + 4]
mov dword [edi + 0x10], eax
call esi
push str.SetMonitorBrightness
push dword [edi + 4]
mov dword [edi + 0x14], eax
call esi
cmp dword [edi + 8], 0
mov dword [edi + 0x18], eax
pop esi
je 0x4a214d
cmp dword [edi + 0xc], 0
je 0x4a214d
cmp dword [edi + 0x10], 0
je 0x4a214d
cmp dword [edi + 0x14], 0
je 0x4a214d
test eax, eax
jne 0x4a2155
mov ecx, edi
pop edi
jmp fcn.004a21e0
pop edi
ret

Function at 0x4a2970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004a29c0
Function at 0x4a29c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da97b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x511760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push 0x4ecf80
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x4a2a14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push eax
push esi
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
push 0
push 0
push 0x4ecf88
mov dword [ebp - 0x18], eax
call fcn.004c9870
push eax
mov dword [ebp + 8], eax
call fcn.004ca650
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push 0x4a2990
push eax
push dword [ebp + 8]
call fcn.004cf520
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004c9e50
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004cf570
movzx eax, al
add esp, 0x30
sub eax, 2
je 0x4a2a93
dec eax
jne 0x4a2aa5
push dword [ebp + 8]
call fcn.004cefb0
push 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004cf5d0
add esp, 0x10
test eax, eax
jne 0x4a2aa5
push 1
push 0xff
push dword [ebp + 8]
call fcn.004cf430
add esp, 0xc
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004ca5b0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004cf5b0
push dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call fcn.004cf590
xor ecx, ecx
mov ebx, eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a3ac6
add esp, 0x1c
xor esi, esi
mov edi, eax
test ebx, ebx
je 0x4a2b09
mov eax, dword [ebp - 0x10]
shl eax, 2
mov dword [ebp - 0x14], eax
push eax
call fcn.004a3ac6
mov dword [edi + esi*4], eax
add esp, 4
mov eax, dword [ebp - 0x14]
inc esi
cmp esi, ebx
jb 0x4a2af5
push edi
push dword [ebp + 8]
call fcn.004c9de0
push 0x18
call fcn.004a46ec
add esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4a2b41
push dword [ebp + 0x14]
mov ecx, eax
push dword [ebp + 0x10]
push ebx
push dword [ebp - 0x10]
push edi
call fcn.004a2f70
mov dword [ebp + 0x14], eax
jmp 0x4a2b48
mov dword [ebp + 0x14], 0
xor esi, esi
test ebx, ebx
je 0x4a2b60
mov edi, edi
push dword [edi + esi*4]
call fcn.004a6088
inc esi
add esp, 4
cmp esi, ebx
jb 0x4a2b50
push edi
call fcn.004a6088
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.004c9a80
mov eax, dword [ebp + 0x14]
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10