joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5263f2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x569c90]
push ebx
xor ebx, ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x24]
lea ecx, [esp + 8]
push ecx
push 0x20019
push ebx
push str.Socks
push edx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x47d672
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00507d3a
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
mov ecx, dword [esp + 8]
push esi
push edi
lea eax, [ebp + 0x1c]
push 4
push eax
push str.CurIndex
push ecx
call fcn.004762f0
lea edx, [ebp + 0x20]
mov esi, eax
mov eax, dword [esp + 0x20]
push 4
push edx
push 0x564a7c
push eax
call fcn.004762f0
add esp, 0x20
cmp esi, ebx
jne 0x47d735
xor edi, edi
push edi
lea ecx, [esp + 0x18]
push str.SocksInfo_d
push ecx
call fcn.005054dc
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], ebx
push edx
push 0x20019
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x47d735
push 0x1c
call fcn.0050c4a3
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 1
je 0x47d705
mov ecx, eax
call fcn.004602f0
mov esi, eax
jmp 0x47d707
xor esi, esi
mov edx, dword [esp + 0x2c]
mov ecx, esi
push edx
mov byte [esp + 0x28], bl
call fcn.004606a0
mov eax, dword [ebp + 0x10]
lea ecx, [ebp + 8]
push esi
push eax
call fcn.00506bb8
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
jmp 0x47d6ad
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x47f500
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x526960
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push edi
mov ebp, ecx
lea edi, [ebp + 0x590]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], edi
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push ebx
push ecx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push edx
push reloc.WSOCK32.dll_accept
mov byte [esp + 0x40], 1
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
je 0x47f573
mov eax, dword [edi]
mov ecx, edi
mov byte [esp + 0x1c], bl
call dword [eax + 0x14]
jmp 0x47f5f7
push esi
mov esi, dword [esp + 0x28]
cmp esi, 0xffffffff
je 0x47f581
cmp esi, ebx
jne 0x47f591
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [ebp + 0x308]
call fcn.0047cbe0
cmp esi, 0xffffffff
je 0x47f59b
cmp esi, 1
jne 0x47f5ab
mov edx, dword [esp + 0x10]
lea ecx, [ebp + 0x2c4]
push edx
call fcn.0047d860
cmp esi, 0xffffffff
je 0x47f5b5
cmp esi, 2
jne 0x47f5c5
mov eax, dword [esp + 0x10]
lea ecx, [ebp + 0xd0]
push eax
call fcn.00479430
cmp esi, 0xffffffff
je 0x47f5cf
cmp esi, 3
jne 0x47f5dc
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [ebp + 4]
call fcn.00478a60
mov eax, dword [esp + 0x10]
pop esi
cmp eax, ebx
je 0x47f5ec
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [edi]
mov ecx, edi
mov byte [esp + 0x1c], bl
call dword [edx + 0x14]
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00507d3a
mov ecx, dword [esp + 0x14]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x488700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5276bf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
mov esi, ecx
mov ecx, dword [esp + 0x40]
push eax
push 1
push ecx
push 0x6a
mov ecx, esi
mov dword [esp + 0x1c], esi
call fcn.00498c30
lea ebx, [esi + 0x6c]
xor edi, edi
mov ecx, ebx
mov dword [esp + 0x18], edi
call fcn.00508d40
mov dword [ebx], vtable.CStatic.0
lea ebx, [esi + 0xa8]
mov byte [esp + 0x18], 1
mov ecx, ebx
call fcn.00508d40
mov dword [ebx], vtable.CStatic.0
mov edx, dword [0x569c90]
lea ecx, [esi + 0xe4]
mov dword [ecx], edx
mov eax, dword [esp + 0x24]
mov dword [esi + 0xf8], edi
mov dword [esi + 0xfc], edi
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x108], edi
mov dword [esi + 0x10c], edi
push eax
mov byte [esp + 0x1c], 3
mov dword [esi], method.CDialog.virtual_0
call fcn.00507ec3
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0xe8], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0xf0], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0xec], edx
mov dword [esi + 0xf4], ecx
pop edi
mov edx, dword [eax]
mov dword [esi + 0xf8], edx
mov ecx, dword [eax + 4]
mov dword [esi + 0xfc], ecx
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x38]
mov dword [esi + 0x100], edx
mov ecx, dword [eax]
mov dword [esi + 0x104], ecx
mov edx, dword [eax + 4]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x108], edx
mov eax, dword [eax + 8]
mov dword [esi + 0x10c], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x24

Function at 0x489330
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, dword [ecx + 0x3c]
mov dword [ecx + 0x40], 0
test eax, eax
jne 0x48935f
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx + 4]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_getsockname]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8
cmp eax, 1
je 0x489369
cmp eax, 2
jne 0x489386
mov edx, dword [esp + 4]
add ecx, 0x18
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
xor eax, eax
ret 8

Function at 0x489400
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [ecx + 4]
push edx
push eax
mov dword [ecx + 0x40], 0
call dword [sym.imp.WSOCK32.dll_setsockopt]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 0x10
Function at 0x489790
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.004f3240
add eax, dword [esi + 0x10]
push eax
mov eax, dword [esi + 4]
push 1
push eax
call fcn.0048ab60
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
add esp, 0xc
mov dword [esi + 0x40], 0
push ecx
mov ecx, dword [esi + 4]
push edx
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov edx, dword [esi + 4]
push 0
push 0
push edx
mov edi, eax
call fcn.0048ab60
add esp, 0xc
test eax, eax
jne 0x4897f3
or eax, 0xffffffff
mov dword [esi + 0x40], 0x7d0
mov dword [esi + 4], eax
pop edi
pop esi
ret 0xc
test edi, edi
jle 0x489804
mov eax, edi
cdq
push edx
push eax
call fcn.00489810
add esp, 8
mov eax, edi
pop edi
pop esi
ret 0xc

Function at 0x489850
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.004f3240
add eax, dword [esi + 0x10]
push eax
mov eax, dword [esi + 4]
push 1
push eax
call fcn.0048ab60
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
add esp, 0xc
mov dword [esi + 0x40], 0
push ecx
mov ecx, dword [esi + 4]
push edx
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_send]
mov edx, dword [esi + 4]
push 0
push 0
push edx
mov edi, eax
call fcn.0048ab60
add esp, 0xc
test eax, eax
jne 0x4898b3
or eax, 0xffffffff
mov dword [esi + 0x40], 0x7d0
mov dword [esi + 4], eax
pop edi
pop esi
ret 0xc
test edi, edi
jle 0x4898c4
mov eax, edi
cdq
push edx
push eax
call fcn.004898d0
add esp, 8
mov eax, edi
pop edi
pop esi
ret 0xc
Function at 0x48b560
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x527ac3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x5369c4
mov eax, dword [edi + 0xbc]
mov dword [esp + 0x1c], 4
test eax, eax
je 0x48b5a9
mov eax, dword [edi + 0xc8]
push eax
call dword [edi + 0xd4]
add esp, 4
mov ecx, edi
call fcn.0048d580
mov eax, dword [edi + 0x78]
lea ebx, [edi + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea esi, [edi + 0x90]
mov dword [esp + 0x10], esi
lea ecx, [esi + 0x24]
mov byte [esp + 0x1c], 0xd
call fcn.00507d3a
lea ecx, [esi + 0x20]
mov byte [esp + 0x1c], 0xc
call fcn.00507d3a
lea ecx, [esi + 0x1c]
mov byte [esp + 0x1c], 0xb
call fcn.00507d3a
lea ecx, [esi + 0x18]
mov byte [esp + 0x1c], 0xa
call fcn.00507d3a
lea ecx, [esi + 0x14]
mov byte [esp + 0x1c], 9
call fcn.00507d3a
lea ecx, [esi + 0x10]
mov byte [esp + 0x1c], 8
call fcn.00507d3a
lea ecx, [esi + 0xc]
mov byte [esp + 0x1c], 7
call fcn.00507d3a
lea ecx, [esi + 8]
mov byte [esp + 0x1c], 6
call fcn.00507d3a
lea ecx, [esi + 4]
mov byte [esp + 0x1c], 5
call fcn.00507d3a
mov ecx, esi
mov byte [esp + 0x1c], 3
call fcn.00507d3a
lea ecx, [edi + 0x7c]
mov byte [esp + 0x1c], 2
call fcn.00507d3a
mov ecx, ebx
mov byte [esp + 0x1c], 1
call fcn.00507d3a
lea eax, [edi + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, edi
mov dword [esp + 0x1c], 0xffffffff
call fcn.00489090
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x48db80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x527f4f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [esp], 0
mov ecx, dword [esp + 0x18]
test ecx, ecx
push esi
jge 0x48dbc9
mov esi, dword [esp + 0x18]
push 0x5623c8
mov ecx, esi
call fcn.00507da8
mov eax, esi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov eax, dword [0x569c90]
push ebp
mov dword [esp + 0x20], eax
mov eax, 0x91a2b3c5
mov ebp, 0x3c
imul ecx
add edx, ecx
mov dword [esp + 0x14], 1
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov esi, edx
mov ecx, 0x3c
cdq
idiv ecx
mov ecx, edx
cdq
idiv ebp
push ecx
push edx
push esi
lea edx, [esp + 0x2c]
push str._d:_02d:_02d
push edx
call fcn.005054dc
mov esi, dword [esp + 0x30]
add esp, 0x14
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.00507aaf
lea ecx, [esp + 0x20]
mov dword [esp + 8], 1
mov byte [esp + 0x14], 0
call fcn.00507d3a
mov ecx, dword [esp + 0xc]
pop ebp
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x48e1b0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x52800f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
mov dword [esp + 4], 0
mov ebp, dword [esp + 0x1c]
push esi
push edi
push ebp
call fcn.0048d700
mov edi, eax
add esp, 4
test edi, edi
jne 0x48e208
mov esi, dword [esp + 0x20]
push 0x56e1f4
mov ecx, esi
call fcn.00507da8
mov eax, esi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea eax, [edi + 1]
push eax
call fcn.0050c4a3
mov esi, eax
add esp, 4
mov edx, esi
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x48e21c
xor eax, eax
test edi, edi
jle 0x48e23a
mov cl, byte [eax + esi]
xor cl, 0xc8
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jl 0x48e22c
push esi
lea ecx, [esp + 0x28]
mov byte [eax + esi], 0
call fcn.00507da8
mov edi, 1
push esi
mov dword [esp + 0x1c], edi
call fcn.0050c4cc
mov esi, dword [esp + 0x24]
add esp, 4
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.00507aaf
lea ecx, [esp + 0x24]
mov dword [esp + 0xc], edi
mov byte [esp + 0x18], 0
call fcn.00507d3a
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x490e10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x528333
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
lea eax, [esp + 4]
push edi
mov esi, ecx
push eax
mov dword [esp + 0x10], esi
call fcn.005057fa
mov ecx, dword [0x569c90]
mov dword [esi + 0x18], ecx
mov edx, dword [esp + 8]
xor edi, edi
lea eax, [esp + 0x10]
mov dword [esi], edi
push eax
mov dword [esp + 0x20], edi
mov dword [esi + 4], edx
call fcn.005057fa
mov ecx, dword [eax]
or eax, 0xffffffff
mov dword [esi + 8], ecx
mov ecx, 1
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov eax, dword [0x565d7c]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x1c], ecx
mov ecx, eax
inc eax
mov dword [0x565d7c], eax
mov eax, dword [esp + 0x2c]
mov dword [esi], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0xc], eax
lea eax, [esp + 0x28]
push eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], edx
call fcn.005057fa
mov ecx, dword [eax]
mov edx, dword [esp + 0x24]
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x1c], edx
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0x14
Function at 0x491b20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x528458
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x20], esi
lea ebx, [esi + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0xc]
lea edi, [esi + 0x2c]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, edi
mov dword [esp + 0x34], 0
mov dword [esp + 0x14], eax
call fcn.00492160
mov eax, dword [esi + 0x30]
mov ecx, dword [esp + 0x10]
cmp ecx, eax
je 0x491c2b
lea eax, [ecx + 0x10]
mov dword [esp + 0x1c], eax
mov ecx, dword [eax + 0x24]
test ecx, ecx
jne 0x491c2b
mov ecx, 1
mov dword [eax + 0x24], ecx
mov dword [esi + 0x3c], ecx
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x491c03
push ebp
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
push 0x32
mov ecx, esi
call fcn.00491830
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x38]
mov ebp, dword [esi + 0x30]
lea edx, [esp + 0x10]
mov dword [esp + 0x10], ecx
push edx
mov ecx, edi
call fcn.00492860
mov ecx, dword [edi + 4]
mov dword [esp + 0x18], eax
cmp eax, ecx
je 0x491beb
mov edx, dword [esp + 0x10]
cmp edx, dword [eax + 0xc]
jl 0x491beb
lea eax, [esp + 0x18]
jmp 0x491bf3
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x1c]
cmp dword [eax], ebp
je 0x491c02
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x28]
test ecx, ecx
jne 0x491ba3
pop ebp
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x2c], 0xffffffff
call dword [edx + 0x14]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 4
mov eax, dword [esi]
mov ecx, esi
mov dword [esp + 0x2c], 0xffffffff
call dword [eax + 0x14]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x494e20
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
sub esp, 0xc
mov eax, dword [0x570e50]
push str..DEFAULTSoftwareGlobalSCAPECuteFTP_8_Professional
push str.SoftwareGlobalSCAPECuteFTP_8_Professional
push str.SoftwareGlobalSCAPECuteFTP_8_Professional
mov ecx, 0x570e58
mov dword [eax + 0x3c], 1
call fcn.0046e490
lea ecx, [esp]
mov dword [esp], 0
push ecx
push 0x20019
push 0
push str..DEFAULTSoftwareGlobalSCAPECuteFTP_8_ProfessionalLauncher
push reloc.WSOCK32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x494e93
push eax
lea edx, [esp + 0xc]
push eax
push edx
push eax
mov eax, dword [esp + 0x10]
push str.GUICmdLine
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x494e93
cmp dword [esp + 8], 1
je 0x494ea0
mov ecx, dword [0x570e50]
mov dword [ecx + 0x20], 1
mov eax, dword [esp]
test eax, eax
je 0x494eaf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
mov ecx, 0x570e58
mov dword [esp + 4], 0
call fcn.004702c0
test eax, eax
jne 0x494f61
push 1
mov ecx, 0x571288
call fcn.004702c0
test eax, eax
jne 0x494f61
push 1
mov ecx, 0x5716b8
call fcn.004702c0
test eax, eax
jne 0x494f61
push 1
mov ecx, 0x571ae8
call fcn.004702c0
test eax, eax
jne 0x494f61
mov ecx, dword [0x570e50]
lea edx, [esp + 4]
push edx
mov dword [esp + 8], eax
call fcn.0046e970
test eax, eax
jne 0x494f61
mov eax, dword [esp + 4]
test eax, eax
je 0x494f6a
call fcn.0050d046
test eax, eax
je 0x494f6a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
je 0x494f6a
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x494f6a
call fcn.0050d046
test eax, eax
je 0x494f4e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
jne 0x494f52
xor eax, eax
jmp 0x494f55
mov eax, dword [eax + 0x1c]
mov ecx, dword [0x570e50]
push eax
call fcn.00470da0
mov eax, 1
add esp, 0xc
ret
mov eax, dword [0x570e50]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x494f7c
xor eax, eax
add esp, 0xc
ret
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4954b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5289c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ecx
mov dword [ebp - 0x10], esp
lea eax, [edi + edi*2]
xor ebx, ebx
shl eax, 2
push eax
mov dword [ebp - 0x18], esi
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], ebx
mov dword [ebp - 4], ebx
call fcn.0050c4a3
mov ecx, eax
add esp, 4
cmp ecx, ebx
mov dword [ebp - 0x14], ecx
je 0x49551e
mov eax, edi
mov edx, 0xc
dec eax
js 0x495513
mov dword [ecx + 8], ebx
add ecx, edx
jmp 0x495509
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x8c], eax
jmp 0x495536
xor eax, eax
mov dword [esi + 0x8c], eax
jmp 0x495536
mov eax, dword [esi + 0x8c]
mov dword [ebp - 4], 0xffffffff
cmp eax, ebx
jne 0x49555f
mov eax, 0x8007000e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp edi, ebx
jle 0x495596
mov ebx, dword [ebp + 0x14]
xor edi, edi
mov ecx, dword [esi + 0x8c]
lea eax, [ecx + edi]
push eax
push 0
push eax
push 0x495670
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [esi + 0x8c]
add edi, 0xc
dec ebx
mov dword [edx + edi - 8], eax
jne 0x495568
xor ebx, ebx
push 0x566008
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x56e1c0], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x70], 0x565944
mov dword [0x56f3d8], esi
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x1c]
push ecx
mov dword [esi], 0x84
mov dword [esi + 0x64], 0x300
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 4], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
call edi
lea edx, [esi + 0x34]
push edx
call edi
lea eax, [esi + 0x4c]
push eax
call edi
mov edi, dword [esi + 0x10]
mov dword [esi + 0x68], ebx
cmp edi, ebx
mov byte [esi + 0x6c], 1
mov dword [esi + 0x74], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x80], ebx
je 0x495627
cmp dword [edi], ebx
je 0x495627
push 1
call dword [edi + 0x20]
cmp dword [esi], 0x64
jne 0x495620
add edi, 0x1c
jmp 0x495623
add edi, 0x24
cmp dword [edi], ebx
jne 0x495611
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x495651
mov ecx, dword [eax]
mov dword [0x57084c], ecx
mov edx, dword [eax + 4]
mov dword [0x570850], edx
mov ecx, dword [eax + 8]
mov dword [0x570854], ecx
mov edx, dword [eax + 0xc]
mov dword [0x570858], edx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x497000
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x528a5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], edi
mov edx, dword [esp + 0x134]
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], edi
push ecx
push 0x2001f
push edi
push edx
push eax
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0xc]
mov esi, eax
cmp esi, edi
jne 0x497076
xor eax, eax
cmp ecx, edi
je 0x497068
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, edi
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x497084
cmp ecx, edi
je 0x49711f
push ecx
jmp 0x497119
lea eax, [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push edi
push edi
lea edx, [esp + 0x1c]
push edi
lea eax, [esp + 0x34]
push edx
push eax
push edi
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x4970ea
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x10]
call fcn.00497000
mov ebx, eax
cmp ebx, edi
jne 0x49713b
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x34]
push eax
push ecx
push edi
push edx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x4970ac
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x4970fd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x134]
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x49711f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret 4
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x49714a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x497121