joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0d30
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5816d0
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x5fb61c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x3d0], 0
jne 0x4a0f40
call fcn.004a09c0
mov dword [esi + 0x324], eax
call fcn.004a0b10
mov dword [esi + 0x328], eax
lea eax, [ebp - 0x44]
push eax
mov ecx, 0x5ff680
call fcn.004788d0
push str.office6ksomisc.exe
push eax
lea ecx, [ebp - 0x48]
push ecx
mov dword [ebp - 4], 0
call fcn.004221d0
add esp, 0xc
mov ecx, dword [eax]
xor edx, edx
mov eax, ecx
mov byte [ebp - 4], 1
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], dx
lea edi, [eax + 2]
jmp 0x4a0dd0
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4a0dd0
sub eax, edi
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.00437a20
mov eax, dword [ebp - 0x48]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4a0e0c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x44]
add eax, 0xfffffff0
mov byte [ebp - 4], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4a0e2f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x40
lea ecx, [ebp - 0x90]
push 0
push ecx
mov dword [ebp - 0x94], 0x44
call fcn.005336c0
xor ecx, ecx
mov dword [esi + 0x3d4], ecx
lea eax, [esi + 0x3d4]
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, dword [0x5a8f9c]
mov edx, dword [str.__other]
mov dword [ebp - 0x20], ecx
mov ecx, dword [0x5a8fa4]
mov dword [ebp - 0x24], edx
mov edx, dword [0x5a8fa0]
mov edi, 8
add esp, 0xc
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x2c], edi
jae 0x4a0e9e
lea ecx, [ebp - 0x40]
push eax
lea edx, [ebp - 0x94]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4a0eeb
mov ecx, dword [esi + 0x3d8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esi + 4]
push 0
push 0x1f4
push 0x403
push edx
mov byte [esi + 0x3d0], 1
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x5ffc18], 0
jne 0x4a0f2f
push ecx
mov ecx, esp
mov dword [ebp - 0x50], esp
push 0x591ff8
call fcn.00422540
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 0x591ff8
mov byte [ebp - 4], 5
call fcn.00422540
push 6
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.004a03c0
mov dword [0x5ffc18], 1
cmp dword [ebp - 0x2c], edi
jb 0x4a0f40
mov eax, dword [ebp - 0x40]
push eax
call int.0042bfd0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005332ca
mov esp, ebp
pop ebp
ret
Function at 0x4a1840
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4a189a
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4a1890
mov eax, dword [ebp + 8]
cmp eax, 0x1b
jne 0x4a1878
mov ecx, dword [esi + 4]
push 0
push 2
push 0x111
push ecx
jmp 0x4a188a
cmp eax, 0xd
jne 0x4a1890
mov edx, dword [esi + 4]
push 0
push 1
push 0x111
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi + 0x300], 0
pop esi
pop ebp
ret 0xc
Function at 0x4a66d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x581d86
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x5fb61c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5fcb00]
mov edx, dword [eax + 0xc]
mov esi, ecx
mov ecx, 0x5fcb00
mov dword [ebp - 0x230], esi
call edx
add eax, 0x10
mov dword [esi], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x22c], ebx
mov byte [ebp - 4], 1
call fcn.004b6fb0
mov edi, eax
mov eax, dword [ebp - 0x22c]
cmp eax, ebx
je 0x4a6741
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x22c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SOFTWAREKingsoftOffice6.0Common
push edi
mov dword [ebp - 0x22c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4a6832
push esi
push str.infoGUID
lea ecx, [ebp - 0x22c]
call fcn.00439630
mov ecx, dword [esi]
cmp dword [ecx - 0xc], ebx
jne 0x4a6817
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
js 0x4a6817
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x218], ax
call fcn.005336c0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea ecx, [ebp - 0x218]
push ecx
mov ecx, esi
call fcn.00422390
mov ebx, dword [ebp - 0x22c]
mov edx, dword [esi]
test ebx, ebx
je 0x4a682a
mov eax, edx
lea edi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a67f0
sub eax, edi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
push 1
push 0
push str.infoGUID
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
mov eax, dword [ebp - 0x22c]
cmp eax, ebx
je 0x4a682c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4a682c
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov ecx, dword [esi]
cmp dword [ecx - 0xc], ebx
jne 0x4a6847
push 0x26
push str.BEE0D90A_11F1_4E60_9C6B_8FFD17FE3F24
mov ecx, esi
call fcn.00422120
mov ecx, 0x5ff680
call fcn.0047ff40
mov ecx, 0x5ff680
mov dword [esi + 4], eax
call fcn.00481090
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x22c]
cmp eax, ebx
je 0x4a6872
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005332ca
mov esp, ebp
pop ebp
ret
Function at 0x4a75e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
lea edx, [ebp - 4]
push edx
push eax
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4a763d
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0xc]
mov dword [ebp - 8], 4
test ecx, ecx
je 0x4a764b
lea edx, [ebp - 8]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a763d
cmp dword [ebp - 0xc], 4
jne 0x4a763d
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4a764b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a7650
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x14]
je 0x4a76bd
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4a76af
mov eax, dword [esi + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4a76bd
mov edx, dword [esi + 0xc]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4a76bd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a7730
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
cmp dword [eax - 0xc], 0
je 0x4a77b4
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4a77b9
mov edx, dword [esi + 0x10]
push ebx
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4a77b3
mov eax, edx
push edi
lea edi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a7780
mov ecx, dword [esi + 0xc]
sub eax, edi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
push 1
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 4]
pop edi
test eax, eax
je 0x4a77b3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test eax, eax
je 0x4a77b4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a8bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4a8c15
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4a8c15
mov eax, dword [ecx]
cmp eax, 0xffffffff
jne 0x4a8bf3
mov eax, 0x80004005
pop esi
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
push 0
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop esi
pop ebp
ret 0xc
mov eax, 0x80070057
pop esi
pop ebp
ret 0xc

Function at 0x4a8c20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push edi
mov dword [ebp - 4], ecx
je 0x4a8cbe
cmp dword [ebp + 0xc], 0
je 0x4a8cbe
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4a8cbe
cmp dword [ecx], 0xffffffff
jne 0x4a8c54
mov eax, 0x80004005
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push esi
mov dword [edi], 0
xor ebx, ebx
jmp 0x4a8c63
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
push 0
lea eax, [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
push edx
lea edx, [ebx + eax]
mov eax, dword [ecx]
push edx
push eax
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
add dword [edi], ecx
test esi, esi
jne 0x4a8c9c
cmp eax, 0xea
jne 0x4a8ca5
sub dword [ebp + 0xc], ecx
add ebx, ecx
test esi, esi
je 0x4a8c60
mov eax, esi
neg eax
sbb eax, eax
pop esi
and eax, 0x7fffbffb
pop ebx
add eax, 0x80004005
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x80070057
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4aa480
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57838b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5fb61c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_unsigned_short_int__struct_std::char_traits_unsigned_short_int__.0
call fcn.00556c68
push 4
mov dword [ebp - 4], 0
call fcn.0042bfa0
mov edi, eax
add esp, 4
test edi, edi
je 0x4aa500
call fcn.0055656f
mov dword [edi], eax
call fcn.0055632e
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00556263
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4aa4f6
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0055628b
jmp 0x4aa502
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4aa910
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x68], 8
lea eax, [esi + 0x54]
jb 0x4aa91e
mov eax, dword [eax]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [esi], eax
test eax, eax
je 0x4aa9d9
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.dc_Init
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi]
push str.dc_Uninit
push eax
call edi
mov ecx, dword [esi]
push str.dc_SendAppStartInfoc
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi]
push str.dc_SendAppEndInfoc
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi]
push str.dc_UpdateAccountID
push eax
call edi
mov ecx, dword [esi]
push str.dc_CreateDataHandle
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi]
push str.dc_CloseDataHandle
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
push str.dc_AddKeyValue
push eax
call edi
mov ecx, dword [esi]
push str.dc_SendCommonEventInfoc
push ecx
mov dword [esi + 0x20], eax
call edi
mov edx, dword [esi]
push str.dc_SendCountEventInfoc
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi]
push str.dc_CheckABTestTagExist
push eax
call edi
mov ecx, dword [esi]
push str.dc_SetInfocCallback
push ecx
mov dword [esi + 0x2c], eax
call edi
mov dword [esi + 0x30], eax
mov byte [esi + 0x34], 1
pop edi
pop esi
ret
Function at 0x4adae0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00536300
mov eax, dword [0x5fb61c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
lea edx, [ebp - 0x1008]
push edx
push 0x20219
xor edi, edi
push edi
push ecx
push eax
mov dword [ebp - 0x1008], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4adbd4
push 0xffe
push eax
lea ecx, [ebp - 0x1002]
push ecx
mov dword [ebp - 0x100c], edi
mov word [ebp - 0x1004], ax
call fcn.005336c0
add esp, 0xc
lea edx, [ebp - 0x1010]
push edx
mov edx, dword [ebp - 0x1008]
lea eax, [ebp - 0x1004]
push eax
lea ecx, [ebp - 0x100c]
push ecx
push edi
push esi
push edx
mov dword [ebp - 0x1010], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x1008]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4adb97
cmp dword [ebp - 0x100c], 1
jne 0x4adbd4
lea eax, [ebp - 0x1004]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4adba0
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x1004]
push ecx
mov ecx, ebx
call fcn.00437a20
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005332ca
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005332ca
mov esp, ebp
pop ebp
ret

Function at 0x4ae280
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x5fb61c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0xb8], edi
cmp eax, edi
ja 0x4ae2be
cmp esi, edi
jne 0x4ae2b3
xor eax, eax
jmp 0x4ae2be
push 0xffffffffffffffff
push esi
call fcn.00535558
add esp, 8
push eax
push esi
lea ecx, [ebp - 0xb4]
mov byte [ebp - 0x4c], 0
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xb4], 0x67452301
mov dword [ebp - 0xb0], 0xefcdab89
mov dword [ebp - 0xac], 0x98badcfe
mov dword [ebp - 0xa8], 0x10325476
call fcn.004aa9e0
cmp byte [ebp - 0x4c], 0
jne 0x4ae318
lea ecx, [ebp - 0xb4]
mov byte [ebp - 0x4c], 1
call fcn.004aaaa0
push 0x40
lea ecx, [ebp - 0x46]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x48], ax
call fcn.005336c0
add esp, 0xc
xor esi, esi
lea edi, [ebp - 0x48]
movzx edx, byte [ebp + esi - 0x5c]
push edx
push str._02x
push 3
push 3
push edi
call fcn.0053459e
inc esi
add esp, 0x14
add edi, 4
cmp esi, 0x10
jl 0x4ae332
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov word [ebx], ax
lea eax, [ebp - 0x48]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4ae370
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, ebx
call fcn.00437a20
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.005332ca
mov esp, ebp
pop ebp
ret
Function at 0x4b0550
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5829c2
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x5fb61c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x280], eax
xor ecx, ecx
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], eax
mov dword [ebp - 0x288], ebx
mov word [ebx], cx
mov dword [ebp - 4], eax
mov dword [ebp - 0x280], 1
cmp dword [ebx + 0x10], eax
jne 0x4b06a1
mov edx, dword [str.userid]
mov dword [ebp - 0x20], edx
mov edx, dword [0x5a9fa0]
mov dword [ebp - 0x18], edx
lea edx, [ebp - 0x278]
push edx
push 0x20019
push eax
mov ecx, 0x12
mov esi, str.Softwarekingsoftwpsclouduserinfo
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x5a9f9c]
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x1c], ecx
mov cx, word [0x5a9fa4]
push eax
push 0x80000001
mov word [ebp - 0x14], cx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b06a1
xor ecx, ecx
push 0x208
push ecx
lea edx, [ebp - 0x272]
push edx
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x284], 0x208
mov word [ebp - 0x274], cx
call fcn.005336c0
add esp, 0xc
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x274]
push ecx
mov ecx, dword [ebp - 0x278]
lea edx, [ebp - 0x27c]
push edx
push 0
lea eax, [ebp - 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b0694
lea eax, [ebp - 0x274]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b0676
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x274]
push edx
mov ecx, ebx
call fcn.00437a20
mov eax, dword [ebp - 0x278]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005332ca
mov esp, ebp
pop ebp
ret 4
Function at 0x4b0d50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x582ac2
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x5fb61c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x248], ebx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov dword [ebp - 0x24c], esi
mov word [esi], ax
lea ecx, [ebp - 0x238]
push ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x248], 1
mov dword [ebp - 0x23c], ebx
call fcn.004b0260
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x4b0dc8
mov eax, dword [eax]
lea edx, [ebp - 0x23c]
push edx
push 0x20019
push ebx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x224], 8
mov edi, eax
jb 0x4b0dfb
mov eax, dword [ebp - 0x238]
push eax
call int.0042bfd0
add esp, 4
cmp edi, ebx
jne 0x4b0e91
push 0x208
lea edx, [ebp - 0x21a]
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x244], 0x208
mov word [ebp - 0x21c], cx
call fcn.005336c0
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x23c]
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x240]
push edx
push ebx
push str.infoGUID
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x4b0e84
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4b0e66
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, esi
call fcn.00437a20
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005332ca
mov esp, ebp
pop ebp
ret

Function at 0x4b2ca0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push edx
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4b2cd6
xor al, al
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x14]
cmp ecx, 8
jb 0x4b2ce5
mov edx, dword [eax]
jmp 0x4b2ce7
mov edx, eax
push esi
cmp ecx, 8
jb 0x4b2cf1
mov esi, dword [eax]
jmp 0x4b2cf3
mov esi, eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b2e20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5fb61c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
xor eax, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov word [ebp - 0x20], ax
mov eax, edx
push esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], 0
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b2e60
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x20]
call fcn.00437a20
mov eax, dword [ebp - 0x20]
mov esi, 8
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0xc], esi
jae 0x4b2e90
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
push ecx
push 0x20219
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4b2eaf
cmp dword [ebp - 0xc], esi
jmp 0x4b2f1d
mov ecx, dword [ebp + 0x18]
lea edx, [ecx + ecx]
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x24]
push ecx
mov dword [ebp - 0x34], edx
lea edx, [ebp - 0x28]
push edx
push 0
push ebx
push eax
mov dword [ebp - 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x24]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4b2f19
mov eax, dword [ebp - 0x28]
cmp eax, 1
je 0x4b2ef5
cmp eax, 2
jne 0x4b2f19
cmp dword [ebp - 0xc], 8
jb 0x4b2f07
mov edx, dword [ebp - 0x20]
push edx
call int.0042bfd0
add esp, 4
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005332ca
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xc], 8
jb 0x4b2f2b
mov eax, dword [ebp - 0x20]
push eax
call int.0042bfd0
add esp, 4
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 0x80004005
pop ebx
call fcn.005332ca
mov esp, ebp
pop ebp
ret