joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d61c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x48d678
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x48d647
call fcn.0040f690
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402d68
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x48d678
call fcn.0040f690
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x4930ac
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x493123
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.004049dc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0040a580
mov eax, dword [ebp - 4]
call fcn.00492fec
test al, al
je 0x4930f3
mov byte [ebp - 5], 1
jmp 0x493108
mov eax, dword [ebp - 0xc]
call fcn.00404c14
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49312a
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404768
ret

Function at 0x493420
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x49347a
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x52dc38]
mov edx, dword [ebp - 0x10]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x493448
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x49362c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x493689
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov al, byte [eax]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0xc]
call fcn.0049357c
xor al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
mov edx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
call fcn.004934e4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
mov byte [eax], dl
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x49364e
mov esp, ebp
pop ebp
ret
Function at 0x4936e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x12345678
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0x23456789
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0x34567890
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 4]
call fcn.00404a14
dec eax
test eax, eax
jl 0x49375a
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
call fcn.00404c14
add eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 8]
call fcn.004934e4
inc dword [ebp - 0x10]
dec dword [ebp - 0x18]
jne 0x49373d
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
call fcn.0049357c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov byte [ebp - 0x11], al
mov edx, dword [ebp - 8]
mov al, byte [ebp - 0x11]
call fcn.004934e4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0x11]
mov byte [eax + edx], cl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x49375f
mov esp, ebp
pop ebp
ret
Function at 0x49ff00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49ffc1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x113]
mov edx, 0x49ffd4
call fcn.0040a8ac
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
xor edx, edx
call fcn.004051e0
je 0x49ff68
lea eax, [ebp - 0x21c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
call fcn.004049dc
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x108]
call fcn.0040a8ac
jmp 0x49ff79
lea eax, [ebp - 0x108]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x218]
mov ecx, 0x105
call fcn.00405004
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ffc8
lea eax, [ebp - 0x21c]
call fcn.00404744
ret

Function at 0x4a5674
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a57af
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
mov eax, ebx
call fcn.00404c14
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00402b10
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4a5785
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4a576c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4a57c0
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4a576c
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebx + 8]
call fcn.00407f4c
movzx eax, ax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, word [ebx + 8]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x30]
push eax
push 0x4a57cc
lea eax, [ebp - 0x38]
mov edx, dword [0x5357d4]
mov dl, byte [edx]
call fcn.0040492c
push dword [ebp - 0x38]
push 0x4a57cc
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00404ad4
mov eax, dword [ebp - 0x34]
mov ecx, 1
pop edx
call fcn.0040af5c
mov eax, dword [ebp - 0x20]
call fcn.0040bc6c
fstp qword [ebp - 8]
wait
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a578c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.00402b40
ret
Function at 0x4b64d8
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x40
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404da4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404c14
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4b6519
mov edx, dword [ebp - 8]
dec edx
mov eax, dword [ebp - 4]
call fcn.00404da4
jmp 0x4b6535
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
jne 0x4b6528
dec dword [ebp - 8]
jmp 0x4b64e8
mov edx, dword [ebp - 4]
mov eax, dword [0x5351c8]
call fcn.00406c48
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b8bbc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a14
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00404da4
mov eax, dword [ebp - 4]
call fcn.00404a14
test eax, eax
jle 0x4b8c3b
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0xc]
call fcn.00404c6c
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
mov cl, byte [ecx + ebx - 1]
mov ebx, dword [ebp - 8]
shr ebx, 8
xor cl, bl
mov byte [eax + edx - 1], cl
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
movzx eax, byte [eax + edx - 1]
add eax, dword [ebp - 8]
imul eax, eax, 0xce6d
add eax, 0x58bf
mov dword [ebp - 8], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x4b8bf4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b8c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a14
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00404da4
mov eax, dword [ebp - 4]
call fcn.00404a14
test eax, eax
jle 0x4b8cbd
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0xc]
call fcn.00404c6c
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
mov cl, byte [ecx + ebx - 1]
mov ebx, dword [ebp - 8]
shr ebx, 8
xor cl, bl
mov byte [eax + edx - 1], cl
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
movzx eax, byte [eax + edx - 1]
add eax, dword [ebp - 8]
imul eax, eax, 0xce6d
add eax, 0x58bf
mov dword [ebp - 8], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x4b8c78
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c03d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00404da4
push 0x104
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404c14
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404da4
pop ecx
pop ecx
pop ebp
ret
Function at 0x4c0410
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00404da4
push 0x104
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404c14
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404da4
pop ecx
pop ecx
pop ebp
ret

Function at 0x4c0450
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov dword [ebp - 4], eax
lea eax, [ebp - 0x109]
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathA
test eax, eax
jne 0x4c0489
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.004049c4
jmp 0x4c0491
mov eax, dword [ebp - 4]
call fcn.00404744
mov esp, ebp
pop ebp
ret

Function at 0x4c0498
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov dword [ebp - 4], eax
lea eax, [ebp - 0x109]
push eax
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathA
test eax, eax
jne 0x4c04d1
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.004049c4
jmp 0x4c04d9
mov eax, dword [ebp - 4]
call fcn.00404744
mov esp, ebp
pop ebp
ret

Function at 0x4c04e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [0x4c0524]
mov byte [ebp - 1], al
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4c04fc
or byte [ebp - 1], 2
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4c050c
or byte [ebp - 1], 4
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4c051c
or byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret

Function at 0x4caed4
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and eax, 1
test al, al
je 0x4caf03
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x4caf06
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x4caeea
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x53854c], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x4caedf
mov byte [0x53894c], 1
mov esp, ebp
pop ebp
ret
Function at 0x4caf34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp byte [0x53894c], 0
jne 0x4caf57
call fcn.004caed4
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x4caf96
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x14]
and eax, 0xff
mov eax, dword [eax*4 + 0x53854c]
mov edx, dword [ebp - 0x14]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x4caf6a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4e1df0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 8
test byte [ebp - 0xc], 1
je 0x4e1e1d
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
jmp 0x4e1e20
shr dword [ebp - 0xc], 1
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x4e1e08
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax*4 + 0x5389b8], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x100
jne 0x4e1dfb
mov esp, ebp
pop ebp
ret

Function at 0x4e2468
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c04
xor eax, eax
push ebp
push 0x4e25e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404a14
test eax, eax
jne 0x4e24f0
lea eax, [ebp - 4]
mov edx, 0x105
call fcn.00404da4
mov eax, dword [ebp - 4]
call fcn.00404c14
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, dword [ebp - 4]
call fcn.00404c14
lea edx, [ebp - 0x28]
call fcn.0040aa44
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.004e23e0
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.004047dc
mov eax, dword [0x5356e4]
cmp byte [eax], 0
je 0x4e2589
lea eax, [ebp - 0x20]
push eax
call sub.ole32.dll_CoCreateGuid_1
lea eax, [ebp - 0xc]
mov edx, 0x27
call fcn.0040542c
mov eax, dword [ebp - 0xc]
call fcn.004050c4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004050b4
push eax
lea eax, [ebp - 0x20]
push eax
call sub.ole32.dll_StringFromGUID2
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004049dc
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
call fcn.004097b8
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
call fcn.004047dc
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404a14
mov ecx, eax
sub ecx, 2
mov edx, 2
mov eax, dword [ebp - 0x10]
call fcn.00404c78
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404a60
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
call fcn.0040ed9c
jmp 0x4e25b6
mov eax, dword [ebp - 8]
mov edx, 0x105
call fcn.00404da4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404c14
push eax
push 0
push 0x4e25f4
mov eax, dword [ebp - 4]
call fcn.00404c14
push eax
call sub.kernel32.dll_GetTempFileNameA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e25f0
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00404768
lea eax, [ebp - 0x10]
call fcn.00404744
lea eax, [ebp - 0xc]
call fcn.00404e64
lea eax, [ebp - 4]
call fcn.00404744
ret
Function at 0x4e4564
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404c04
mov eax, dword [ebp - 0xc]
call fcn.00404c04
xor eax, eax
push ebp
push 0x4e46b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x88], 0
je 0x4e466b
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x74]
call fcn.004047dc
cmp dword [ebp - 0xc], 0
jne 0x4e45e5
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004e5bd0
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004e5ca8
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
call fcn.004047dc
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004e53dc
test al, al
je 0x4e4658
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404c14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4e4652
mov eax, dword [ebp - 0x18]
dec eax
sub eax, 2
jb 0x4e463a
je 0x4e4634
dec eax
je 0x4e4640
sub eax, 3
je 0x4e4646
jmp 0x4e464c
mov byte [ebp - 0xd], 5
jmp 0x4e465c
mov byte [ebp - 0xd], 3
jmp 0x4e465c
mov byte [ebp - 0xd], 2
jmp 0x4e465c
mov byte [ebp - 0xd], 4
jmp 0x4e465c
mov byte [ebp - 0xd], 0
jmp 0x4e465c
mov byte [ebp - 0xd], 0
jmp 0x4e465c
mov byte [ebp - 0xd], 0
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004e53dc
jmp 0x4e4691
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x30]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4e468d
mov eax, dword [ebp - 0x14]
mov al, byte [eax + 0x10]
mov byte [ebp - 0xd], al
jmp 0x4e4691
mov byte [ebp - 0xd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e46c0
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00404768
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404768
ret
Function at 0x4e5f88
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404c04
mov eax, dword [ebp - 0xc]
call fcn.00404c04
xor eax, eax
push ebp
push 0x4e60df
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x88], 0
je 0x4e605b
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x74]
call fcn.004047dc
mov byte [ebp - 0xd], 0
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004e53dc
test al, al
je 0x4e604c
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404c14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4e604c
cmp dword [ebp - 0x20], 3
jne 0x4e604c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404c14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 0xd]
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004e53dc
jmp 0x4e60bc
mov byte [ebp - 0xd], 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x30]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4e60bc
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x10], 5
jne 0x4e60bc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
cmp eax, dword [edx + 0x18]
jge 0x4e6099
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 0x18]
mov dword [eax], edx
jmp 0x4e60bc
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x18]
call fcn.00402d68
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 0x18]
mov dword [eax], edx
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e60e6
lea eax, [ebp - 0x18]
call fcn.00404744
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404768
ret
Function at 0x4e60f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404c04
mov eax, dword [ebp - 0xc]
call fcn.00404c04
xor eax, eax
push ebp
push 0x4e6255
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x88], 0
je 0x4e61db
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x74]
call fcn.004047dc
mov byte [ebp - 0xd], 0
mov eax, dword [ebp + 8]
mov dl, byte [ebp + 0xc]
mov byte [eax], dl
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004e53dc
test al, al
je 0x4e61cc
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404c14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4e61cc
cmp dword [ebp - 0x20], 4
jne 0x4e61cc
cmp dword [ebp - 0x1c], 4
jne 0x4e61cc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404c14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 0xd]
cmp dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
setne byte [eax]
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004e53dc
jmp 0x4e6232
mov byte [ebp - 0xd], 0
mov eax, dword [ebp + 8]
mov dl, byte [ebp + 0xc]
mov byte [eax], dl
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x30]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4e6232
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x10], 1
jne 0x4e6218
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov dl, byte [edx + 0x11]
mov byte [eax], dl
mov byte [ebp - 0xd], 1
jmp 0x4e6232
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x10], 2
jne 0x4e6232
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x14], 0
mov eax, dword [ebp + 8]
setne byte [eax]
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e625c
lea eax, [ebp - 0x18]
call fcn.00404744
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404768
ret