joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c520
Capabilities:
Get common file path
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x506e0c], 0
push esi
push edi
je 0x48c560
mov esi, dword [0x4f8b78]
mov edi, dword [0x4f8b7c]
mov dword [0x4f8b78], 0x20119
mov dword [0x4f8b7c], 0x20106
jmp 0x48c56c
mov esi, dword [ebp - 0x134]
mov edi, dword [ebp - 0x134]
push 0x104
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, 0x104
lea eax, [ebp - 0x130]
lea esp, [esp]
cmp byte [eax], 0
je 0x48c59b
inc eax
dec edx
jne 0x48c590
jmp 0x48c5c3
test edx, edx
je 0x48c5c3
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.Userinit.exe_
lea ecx, [ebp + ecx - 0x130]
mov edx, 0x7fffffff
call fcn.004010b0
push str.Userinit
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
lea ecx, [ebp - 0x130]
mov edx, CreateStatusWindowA
call fcn.004c0250
push 0xfa
push 0x4e8d64
lea ecx, [ebp - 0x24]
push 0x20
push ecx
call fcn.00402ee0
lea edx, [ebp - 0x130]
push edx
push str.SoftwareBillP_StudiosWinPatrolRun
lea ecx, [ebp - 0x24]
mov edx, CreateStatusWindowA
call fcn.004c0250
add esp, 0x20
cmp dword [0x506e0c], 0
je 0x48c623
mov dword [0x4f8b78], esi
mov dword [0x4f8b7c], edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret

Function at 0x48c640
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x506e0c], 0
push esi
push edi
je 0x48c67d
mov esi, dword [0x4f8b78]
mov edi, dword [0x4f8b7c]
mov dword [0x4f8b78], 0x20119
mov dword [0x4f8b7c], 0x20106
jmp 0x48c683
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x28]
push str.Shell
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov ecx, str.Explorer.exe
mov edx, CreateStatusWindowA
call fcn.004c0250
push 0xfb
push 0x4e8d64
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.00402ee0
push str.Explorer.exe
push str.SoftwareBillP_StudiosWinPatrolRun
lea ecx, [ebp - 0x24]
mov edx, CreateStatusWindowA
call fcn.004c0250
add esp, 0x20
cmp dword [0x506e0c], 0
je 0x48c6e0
mov dword [0x4f8b78], esi
mov dword [0x4f8b7c], edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
Function at 0x48c6f0
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x506e0c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x210], eax
je 0x48c741
mov ecx, dword [0x4f8b78]
mov edx, dword [0x4f8b7c]
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], edx
mov dword [0x4f8b78], 0x20119
mov dword [0x4f8b7c], 0x20106
push ebx
push esi
push edi
push 0x104
push str.UserInit
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
lea ecx, [ebp - 0x108]
mov edx, CreateStatusWindowA
xor ebx, ebx
call fcn.004bff10
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x20c]
call fcn.004010b0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x108]
push ecx
call edi
xor ecx, ecx
test eax, eax
jle 0x48c835
mov dl, 0x2c
nop
cmp byte [ebp + ecx - 0x108], dl
je 0x48c7b3
inc ecx
cmp ecx, eax
jl 0x48c7a0
jmp 0x48c835
lea edx, [ecx + 1]
cmp eax, edx
jne 0x48c7df
lea eax, [ebp - 0x108]
mov byte [ebp + ecx - 0x108], bl
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x20c]
call fcn.004010b0
jmp 0x48c830
lea esi, [ebp + ecx - 0x107]
push esi
call edi
xor ecx, ecx
test eax, eax
jle 0x48c830
nop
cmp byte [ecx + esi], 0x20
jne 0x48c7fd
inc ecx
cmp ecx, eax
jl 0x48c7f0
jmp 0x48c830
lea edx, [ecx + esi]
lea eax, [ebp - 0x20c]
mov ecx, eax
mov esi, 0x104
sub edx, ecx
nop
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x48c829
mov cl, byte [edx + eax]
test cl, cl
je 0x48c829
mov byte [eax], cl
inc eax
dec esi
jne 0x48c810
jmp 0x48c82d
test esi, esi
jne 0x48c82e
dec eax
mov byte [eax], bl
mov ebx, 1
mov eax, dword [ebp - 0x210]
lea esi, [ebp - 0x20c]
mov edx, 0x104
sub esi, eax
jmp 0x48c850
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x48c869
mov cl, byte [esi + eax]
test cl, cl
je 0x48c869
mov byte [eax], cl
inc eax
dec edx
jne 0x48c850
jmp 0x48c86d
test edx, edx
jne 0x48c86e
dec eax
cmp dword [0x506e0c], 0
mov byte [eax], 0
je 0x48c891
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x214]
mov dword [0x4f8b78], edx
mov dword [0x4f8b7c], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
Function at 0x48c8b0
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x506e0c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x210], eax
je 0x48c901
mov ecx, dword [0x4f8b78]
mov edx, dword [0x4f8b7c]
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], edx
mov dword [0x4f8b78], 0x20119
mov dword [0x4f8b7c], 0x20106
push ebx
push esi
push edi
push 0x104
push str.Shell
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
lea ecx, [ebp - 0x108]
mov edx, CreateStatusWindowA
xor ebx, ebx
call fcn.004bff10
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x20c]
call fcn.004010b0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x108]
push ecx
call edi
test eax, eax
jle 0x48c9c1
xor ecx, ecx
test eax, eax
jle 0x48c9bc
mov bl, 0x20
nop
cmp byte [ebp + ecx - 0x108], bl
je 0x48c970
inc ecx
cmp ecx, eax
jl 0x48c960
jmp 0x48c9bc
lea edx, [ecx + 1]
cmp eax, edx
jne 0x48c988
lea eax, [ebp - 0x108]
mov byte [ebp + ecx - 0x108], 0
push eax
jmp 0x48c9a7
lea esi, [ebp + ecx - 0x107]
push esi
call edi
xor ecx, ecx
test eax, eax
jle 0x48c9bc
cmp byte [ecx + esi], bl
jne 0x48c9a4
inc ecx
cmp ecx, eax
jl 0x48c998
jmp 0x48c9bc
add ecx, esi
push ecx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x20c]
call fcn.004010b0
mov ebx, 1
mov eax, dword [ebp - 0x210]
lea esi, [ebp - 0x20c]
mov edx, 0x104
sub esi, eax
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x48c9ed
mov cl, byte [esi + eax]
test cl, cl
je 0x48c9ed
mov byte [eax], cl
inc eax
dec edx
jne 0x48c9d4
jmp 0x48c9f1
test edx, edx
jne 0x48c9f2
dec eax
cmp dword [0x506e0c], 0
mov byte [eax], 0
je 0x48ca15
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x214]
mov dword [0x4f8b78], edx
mov dword [0x4f8b7c], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
Function at 0x493700
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a4
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x505890], 0
push ebx
push esi
push edi
mov ecx, 0x12
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
lea edi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
je 0x493735
call fcn.004c2580
xor edi, edi
mov dword [0x505890], 0
mov dword [ebp - 0x684], edi
cmp dword [0x506e0c], edi
je 0x49375a
mov eax, dword [0x4f8b78]
mov dword [ebp - 0x694], eax
xor esi, esi
mov dword [ebp - 0x688], esi
cmp esi, 1
jne 0x49377e
cmp dword [0x506e0c], 0
je 0x4938e5
mov dword [0x4f8b78], 0x20119
mov edx, dword [0x4f8b78]
lea ecx, [ebp - 0x68c]
push ecx
push edx
push 0
lea eax, [ebp - 0x58]
push eax
push CreateStatusWindowA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4938ba
mov dword [ebp - 0x690], eax
mov esi, dword [ebp - 0x690]
mov eax, 0x100
lea ecx, [ebp - 0x6a4]
push ecx
mov dword [ebp - 0x698], eax
mov dword [ebp - 0x69c], eax
lea edx, [ebp - 0x698]
push edx
lea eax, [ebp - 0x578]
push eax
mov eax, dword [ebp - 0x68c]
push 0
lea ecx, [ebp - 0x69c]
push ecx
lea edx, [ebp - 0x268]
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc esi
mov dword [ebp - 0x690], esi
test eax, eax
jne 0x493896
lea ecx, [ebp - 0x160]
push ecx
lea ecx, [ebp - 0x478]
lea edx, [ebp - 0x268]
call fcn.004c0d10
add esp, 4
test eax, eax
je 0x4937ab
xor ebx, ebx
xor esi, esi
cmp dword [ebp - 0x684], ebx
jle 0x493862
nop
lea edi, [ebp - 0x370]
call fcn.004c22f0
mov edx, edi
push edx
lea eax, [ebp - 0x160]
push eax
call fcn.00483650
test eax, eax
jne 0x493851
lea esi, [eax + 1]
inc ebx
cmp ebx, dword [ebp - 0x684]
jl 0x493830
test esi, esi
jne 0x4937ab
push 0
push 0x384
lea ecx, [ebp - 0x680]
push ecx
lea edx, [ebp - 0x268]
push edx
lea edx, [ebp - 0x478]
lea ecx, [ebp - 0x160]
call fcn.004c1eb0
add esp, 0x10
inc dword [ebp - 0x684]
jmp 0x4937ab
cmp eax, 0x103
jne 0x4937ab
mov eax, dword [ebp - 0x68c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x688]
mov edi, dword [ebp - 0x684]
inc esi
mov dword [ebp - 0x688], esi
cmp esi, 2
jl 0x493762
cmp dword [0x506e0c], 0
mov dword [0x505890], edi
je 0x4938e5
mov ecx, dword [ebp - 0x694]
mov dword [0x4f8b78], ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
Function at 0x493900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1b5c
call fcn.004d9280
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0xb
mov esi, str.SOFTWAREMicrosoftInternet_ExplorerToolbar
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1b58]
push eax
push 0x20019
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x34]
push ecx
push CreateStatusWindowA
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x493a4f
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x1b54], ebx
mov ecx, dword [ebp - 0x1b58]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x1b5c]
push edx
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov dword [ebp - 0x1b5c], 0x100
call esi
inc ebx
test eax, eax
jne 0x493a20
lea edx, [ebp - 0x350]
push edx
lea ecx, [ebp - 0x248]
lea edx, [ebp - 0x140]
call fcn.004c0d10
add esp, 4
test eax, eax
je 0x493962
push 0x1400
lea eax, [ebp - 0x1b50]
push 0
push eax
call fcn.004d29c0
lea ecx, [ebp - 0x248]
push ecx
lea ecx, [ebp - 0x1b50]
call fcn.004c0890
add esp, 0x10
lea edx, [ebp - 0x1350]
push edx
lea eax, [ebp - 0x750]
push eax
call edi
push 0
push 0x384
lea ecx, [ebp - 0x750]
push ecx
lea edx, [ebp - 0x140]
push edx
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x350]
call fcn.004c1eb0
add esp, 0x10
inc dword [ebp - 0x1b54]
jmp 0x493962
cmp eax, 0x103
jne 0x493962
mov eax, dword [ebp - 0x1b58]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1b54]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
Function at 0x493a70
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0xb
mov esi, str.SoftwareMicrosoftInternet_ExplorerMenuExt
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
movsb byte es:[edi], byte [esi]
cmp dword [0x505890], ebx
je 0x493aa5
call fcn.004c2580
lea eax, [ebp - 0x550]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x80000001
mov dword [0x505890], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x493bd5
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x54c], ebx
mov eax, 0x100
mov dword [ebp - 0x558], eax
mov dword [ebp - 0x554], eax
lea edx, [ebp - 0x560]
push edx
lea eax, [ebp - 0x558]
push eax
lea ecx, [ebp - 0x548]
push ecx
mov ecx, dword [ebp - 0x550]
push 0
lea edx, [ebp - 0x554]
push edx
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
call edi
inc ebx
test eax, eax
jne 0x493bb5
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4e28bc
lea ecx, [ebp - 0x448]
push ecx
call esi
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x448]
push eax
call esi
push 0x104
lea ecx, [ebp - 0x448]
push 0x4e27f8
push ecx
lea ecx, [ebp - 0x248]
mov edx, 0x80000001
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x493ae2
push 0
push 0
lea edx, [ebp - 0x140]
push 0x4e27f8
push edx
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x140]
call fcn.004c1eb0
add esp, 0x10
inc dword [ebp - 0x54c]
jmp 0x493ae2
cmp eax, 0x103
jne 0x493ae2
mov eax, dword [ebp - 0x550]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x54c]
jmp 0x493bd8
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [0x505890], eax
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
Function at 0x493bf0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0xc
mov esi, str.SOFTWAREMicrosoftInternet_ExplorerExtensions
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
cmp dword [0x505890], esi
je 0x493c24
call fcn.004c2580
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [0x505890], esi
mov dword [ebp - 0x64c], esi
mov edx, dword [esi*4 + 0x4f8b54]
lea eax, [ebp - 0x650]
push eax
push 0x20019
xor edi, edi
push edi
lea ecx, [ebp - 0x34]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x493e57
mov eax, 0x100
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x654], eax
lea eax, [ebp - 0x660]
push eax
lea ecx, [ebp - 0x658]
push ecx
lea edx, [ebp - 0x648]
push edx
mov edx, dword [ebp - 0x650]
push 0
lea eax, [ebp - 0x654]
push eax
lea ecx, [ebp - 0x348]
push ecx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc edi
test eax, eax
jne 0x493e3f
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x548]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4e28bc
lea edx, [ebp - 0x548]
push edx
call ebx
lea eax, [ebp - 0x348]
push eax
lea ecx, [ebp - 0x548]
push ecx
call ebx
push 0x104
lea edx, [ebp - 0x548]
push str.script
push edx
mov edx, dword [esi*4 + 0x4f8b54]
lea ecx, [ebp - 0x240]
call fcn.004bff10
add esp, 0xc
test eax, eax
jne 0x493d4a
mov edx, dword [esi*4 + 0x4f8b54]
push 0x104
lea eax, [ebp - 0x548]
push str.exec
push eax
lea ecx, [ebp - 0x240]
call fcn.004bff10
add esp, 0xc
test eax, eax
jne 0x493d4a
lea ecx, [ebp - 0x138]
push ecx
lea ecx, [ebp - 0x240]
lea edx, [ebp - 0x348]
call fcn.004c0d10
add esp, 4
lea edx, [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x493c5f
cmp esi, 1
jne 0x493d72
push str.__HKCU_
lea eax, [ebp - 0x240]
push eax
call ebx
mov edx, dword [esi*4 + 0x4f8b54]
push 0x100
lea ecx, [ebp - 0x548]
push str.ButtonText
push ecx
lea ecx, [ebp - 0x138]
call fcn.004bff10
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x493dbb
push str._no_name_
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 1
lea ecx, [ebp - 0x348]
push 0x4e27f8
push ecx
lea edx, [ebp - 0x240]
lea ecx, [ebp - 0x138]
call fcn.004c1eb0
inc dword [ebp - 0x64c]
push 0x100
lea edx, [ebp - 0x548]
push str.MenuText
push edx
mov edx, dword [esi*4 + 0x4f8b54]
lea ecx, [ebp - 0x138]
call fcn.004bff10
add esp, 0x1c
test eax, eax
je 0x493c5f
push 0
push 2
lea eax, [ebp - 0x348]
push 0x4e27f8
push eax
lea edx, [ebp - 0x240]
lea ecx, [ebp - 0x138]
call fcn.004c1eb0
add esp, 0x10
inc dword [ebp - 0x64c]
jmp 0x493c5f
cmp eax, 0x103
jne 0x493c5f
mov ecx, dword [ebp - 0x650]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp esi, 2
jl 0x493c36
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x64c]
pop edi
pop esi
xor ecx, ebp
mov dword [0x505890], eax
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
Function at 0x493e80
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x56c
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0xd
mov esi, str.SOFTWAREMicrosoftInternet_ExplorerPluginsExtension
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
cmp dword [0x505890], esi
je 0x493eb7
call fcn.004c2580
lea eax, [ebp - 0x558]
push eax
push 0x20019
push esi
lea ecx, [ebp - 0x3c]
push ecx
push CreateStatusWindowA
mov dword [0x505890], esi
mov dword [ebp - 0x554], esi
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x493fe9
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, 0x100
mov dword [ebp - 0x560], eax
mov dword [ebp - 0x55c], eax
lea edx, [ebp - 0x568]
push edx
lea eax, [ebp - 0x560]
push eax
lea ecx, [ebp - 0x550]
push ecx
mov ecx, dword [ebp - 0x558]
push 0
lea edx, [ebp - 0x55c]
push edx
lea eax, [ebp - 0x250]
push eax
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc edi
test eax, eax
jne 0x493fd8
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 0x450]
push eax
call ebx
push 0x4e28bc
lea ecx, [ebp - 0x450]
push ecx
call esi
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x450]
push eax
call esi
push 0x104
lea ecx, [ebp - 0x450]
push str.Location
push ecx
lea ecx, [ebp - 0x148]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea edx, [ebp - 0x148]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x493ef5
push 0
push 0
lea eax, [ebp - 0x250]
push 0x4e27f8
push eax
lea edx, [ebp - 0x148]
mov ecx, eax
call fcn.004c1eb0
add esp, 0x10
inc dword [ebp - 0x554]
mov byte [ebp - 0x148], 0
jmp 0x493ef5
cmp eax, 0x103
jne 0x493ef5
mov esi, dword [ebp - 0x554]
mov ecx, dword [ebp - 0x558]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov dword [0x505890], esi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
Function at 0x494010
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x774
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0xe
mov esi, str.SOFTWAREMicrosoftCode_Store_DatabaseDistribution_Units
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
cmp dword [0x505890], esi
je 0x494046
call fcn.004c2580
lea eax, [ebp - 0x760]
push eax
push 0x20019
push esi
lea ecx, [ebp - 0x40]
push ecx
push CreateStatusWindowA
mov dword [0x505890], esi
mov dword [ebp - 0x75c], esi
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x4941a4
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, 0x100
mov dword [ebp - 0x764], eax
mov dword [ebp - 0x768], eax
lea edx, [ebp - 0x770]
push edx
lea eax, [ebp - 0x764]
push eax
lea ecx, [ebp - 0x758]
push ecx
mov ecx, dword [ebp - 0x760]
push 0
lea edx, [ebp - 0x768]
push edx
lea eax, [ebp - 0x148]
push eax
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc edi
test eax, eax
jne 0x494193
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x450]
push eax
call ebx
push 0x4e28bc
lea ecx, [ebp - 0x450]
push ecx
call esi
lea edx, [ebp - 0x148]
push edx
lea eax, [ebp - 0x450]
push eax
call esi
push str.DownloadInformation
lea ecx, [ebp - 0x450]
push ecx
call esi
lea edx, [ebp - 0x550]
push edx
lea ecx, [ebp - 0x658]
lea edx, [ebp - 0x148]
call fcn.004c0d10
push 0x104
lea eax, [ebp - 0x450]
push str.CODEBASE
push eax
lea ecx, [ebp - 0x250]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0x10
lea ecx, [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x494084
push 0
push 0
lea edx, [ebp - 0x148]
push edx
lea eax, [ebp - 0x658]
push eax
lea edx, [ebp - 0x250]
lea ecx, [ebp - 0x550]
call fcn.004c1eb0
add esp, 0x10
inc dword [ebp - 0x75c]
mov byte [ebp - 0x250], 0
jmp 0x494084
cmp eax, 0x103
jne 0x494084
mov esi, dword [ebp - 0x75c]
mov ecx, dword [ebp - 0x760]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov dword [0x505890], esi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
Function at 0x4941d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x11
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
movsw word es:[edi], word [esi]
cmp dword [0x505890], ebx
je 0x494206
call fcn.004c2580
lea eax, [ebp - 0x3f0]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x50]
push ecx
push CreateStatusWindowA
mov dword [0x505890], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x494324
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x3ec], ebx
mov edi, 0x100
mov ecx, dword [ebp - 0x3f0]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x3f4]
push edx
lea eax, [ebp - 0x2e0]
push eax
push ebx
push ecx
mov dword [ebp - 0x3f4], edi
call esi
inc ebx
test eax, eax
jne 0x494304
push 0x80
lea edx, [ebp - 0x2e0]
push edx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0xd0]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x494242
lea ecx, [ebp - 0x3e8]
push ecx
lea ecx, [ebp - 0x1d8]
lea edx, [ebp - 0xd0]
call fcn.004c0d10
add esp, 4
test eax, eax
je 0x494242
lea edx, [ebp - 0x1d8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x494242
push 0
push 0
lea eax, [ebp - 0x2e0]
push eax
lea ecx, [ebp - 0xd0]
push ecx
lea edx, [ebp - 0x1d8]
lea ecx, [ebp - 0x3e8]
call fcn.004c1eb0
add esp, 0x10
inc dword [ebp - 0x3ec]
mov byte [ebp - 0x1d8], 0
jmp 0x494242
cmp eax, 0x103
jne 0x494242
mov edx, dword [ebp - 0x3f0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x3ec]
jmp 0x494327
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [0x505890], eax
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
Function at 0x494340
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x11
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor ebx, ebx
movsb byte es:[edi], byte [esi]
cmp dword [0x505890], ebx
je 0x494377
call fcn.004c2580
lea eax, [ebp - 0x3f0]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x50]
push ecx
push CreateStatusWindowA
mov dword [0x505890], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x494495
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x3ec], ebx
mov edi, 0x100
mov ecx, dword [ebp - 0x3f0]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x3f4]
push edx
lea eax, [ebp - 0x1d8]
push eax
push ebx
push ecx
mov dword [ebp - 0x3f4], edi
call esi
inc ebx
test eax, eax
jne 0x494475
push 0x80
lea edx, [ebp - 0x1d8]
push edx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0xd0]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x4943b3
lea ecx, [ebp - 0x3e8]
push ecx
lea ecx, [ebp - 0x2e0]
lea edx, [ebp - 0x1d8]
call fcn.004c0d10
add esp, 4
test eax, eax
je 0x4943b3
lea edx, [ebp - 0x2e0]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4943b3
push 0
push 0
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x1d8]
push ecx
lea edx, [ebp - 0x2e0]
lea ecx, [ebp - 0x3e8]
call fcn.004c1eb0
add esp, 0x10
inc dword [ebp - 0x3ec]
mov byte [ebp - 0x2e0], 0
jmp 0x4943b3
cmp eax, 0x103
jne 0x4943b3
mov edx, dword [ebp - 0x3f0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x3ec]
jmp 0x494498
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [0x505890], eax
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret