joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1a60
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x4b1a8c
cmp byte [esi], 0
je 0x4b1a8c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4b1a8c
test al, 0x50
jne 0x4b1a8c
test ah, 0x11
jne 0x4b1a8c
and eax, 0xfffffff8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
ret

Function at 0x4b1a90
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0x2f
push 0x5a98a0
call fcn.00570260
add esp, 8
test eax, eax
je 0x4b1ab9
push 0x2f
push 0x5a98a0
mov byte [eax], 0x5c
call fcn.00570260
add esp, 8
test eax, eax
jne 0x4b1aa3
push 0x5a15c8
push 0x5a14c8
push 0x5a13c8
push 0x5a13c0
push 0x5a98a0
call fcn.005706cf
mov al, byte [0x5a98a0]
add esp, 0x14
cmp al, 0x5c
jne 0x4b1b20
cmp byte [0x5a98a1], 0x5c
jne 0x4b1b20
mov al, byte [0x5a14c8]
test al, al
jne 0x4b1b8e
mov al, byte [0x5a15c8]
test al, al
jne 0x4b1b8e
push 0x5a9798
push str._smirc.ini
push 0x5a98a0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x4b1b85
mov al, byte [0x5a14c8]
test al, al
jne 0x4b1b32
mov al, byte [0x5a15c8]
test al, al
je 0x4b1b06
mov al, byte [0x5a13c0]
test al, al
jne 0x4b1b85
mov al, byte [0x5a13c8]
test al, al
push 0x5a15c8
push 0x5a14c8
je 0x4b1b6d
push 0x5a13c8
push 0x5a9798
push str._s_s_s_s
push 0x5a98a0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
jmp 0x4b1b85
push 0x5a9798
push str._s_s_s
push 0x5a98a0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov al, byte [0x5a98a0]
test al, al
je 0x4b1bb6
push 0x5a98a0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4b1bb6
test al, 0x50
jne 0x4b1bb6
test ah, 0x11
jne 0x4b1bb6
and eax, 0xfffffff8
push eax
push 0x5a98a0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret
Function at 0x4b6310
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x440
push esi
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x38]
xor esi, esi
push eax
mov edx, str.main
xor ecx, ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call fcn.004feda0
cmp dword [0x5b3c00], esi
mov edi, 3
je 0x4b6375
mov ecx, dword [0x5b4314]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4b6375
mov dword [esp + 8], edi
jmp 0x4b63a7
mov edx, dword [0x5b4314]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4b6390
mov dword [esp + 8], 1
jmp 0x4b63a7
mov eax, dword [0x5b4314]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
neg eax
sbb eax, eax
and eax, 2
mov dword [esp + 8], eax
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x4b6441
mov dword [esp + 8], edi
mov ecx, dword [0x5b4314]
lea eax, [esp + 0x34]
push eax
push ecx
mov dword [esp + 0x3c], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x58]
mov esi, dword [esp + 0x54]
mov ecx, dword [esp + 0x5c]
mov edi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x10]
push edi
sub ecx, esi
push ecx
sub eax, edx
push esi
push eax
push edx
mov dword [esp + 0x3c], edx
lea edx, [esp + 0x7c]
push str._d__d__d__d__d__d__d
push edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], esi
mov dword [esp + 0x30], ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
push 0x5a98a0
lea eax, [esp + 0x64]
push eax
mov edx, str.main
mov ecx, str.windows
call fcn.004b1bc0
pop edi
pop esi
add esp, 0x440
ret
cmp dword [esp + 8], esi
jne 0x4b63bb
mov edx, dword [0x5b4314]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
jmp 0x4b63e5
Function at 0x4bec60
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x104
push ebp
push esi
mov esi, dword [esp + 0x110]
push edi
mov edi, ecx
mov ecx, esi
mov ebp, edx
call fcn.004e2760
test eax, eax
je 0x4bedd1
test ebp, ebp
jne 0x4becb0
mov al, byte [esi + 0x840]
test al, al
je 0x4becb0
mov eax, dword [esi + 0x908]
test eax, eax
je 0x4bed4f
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x104
ret 4
test edi, edi
je 0x4bee73
cmp byte [edi], 0
je 0x4bee73
push 0x40
push edi
call fcn.00570260
add esp, 8
test eax, eax
je 0x4bed4b
mov cl, byte [eax + 1]
inc eax
test cl, cl
je 0x4bed4b
push eax
mov edx, 0x104
lea ecx, [esp + 0x10]
call fcn.0041ee40
lea eax, [esp + 0xc]
push 0x20
push eax
call fcn.00570260
add esp, 8
test eax, eax
je 0x4becfd
mov byte [eax], 0
mov al, byte [esp + 0xc]
test al, al
je 0x4bed4b
lea ecx, [esp + 0xc]
push 0x2e
push ecx
call fcn.00570980
mov edi, eax
add esp, 8
test edi, edi
je 0x4bed4b
mov al, byte [edi + 1]
inc edi
test al, al
je 0x4bed3f
movzx edx, byte [edi]
push edx
call fcn.00570f0a
add esp, 4
test eax, eax
je 0x4bed3c
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4bed22
jmp 0x4bed3f
mov byte [edi], 0
mov al, byte [esp + 0xc]
test al, al
jne 0x4beddf
test ebp, ebp
jne 0x4bedca
mov cl, byte [esi + 0x840]
test cl, cl
lea eax, [esi + 0x840]
je 0x4bed8f
mov ecx, dword [esi + 0x908]
test ecx, ecx
jne 0x4beeac
mov ecx, dword [esi]
push 5
push 0
push eax
mov edx, 0x583b74
call fcn.00470c10
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x104
ret 4
mov ecx, dword [esi + 0xf28]
mov eax, dword [esi]
imul ecx, ecx, 0x64
push 0
push 0
push 0xa
push 0
push eax
push 0
push 5
push 0
push 0
lea ecx, [ecx + esi + 0xdfc]
xor edx, edx
call fcn.0053c4d0
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x104
ret 4
mov ecx, esi
call fcn.0054ac40
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x104
ret 4
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esi + 0x908], eax
jne 0x4bee1f
lea eax, [esp + 0xc]
lea edi, [esi + 0x840]
push eax
mov edx, 0x64
mov ecx, edi
mov dword [esi + 0x908], 0
mov byte [esi + 0x8a4], 0
call fcn.0041ee40
jmp 0x4bee4a
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
lea ecx, [esp + 0xc]
lea edi, [esi + 0x8a4]
push ecx
mov edx, 0x64
mov ecx, edi
mov dword [esi + 0x908], eax
call fcn.0041ee40
mov byte [esi + 0x840], 0
mov ecx, edi
call fcn.00524fb0
mov ecx, dword [esi]
push 5
push 0
push edi
mov edx, 0x583b74
call fcn.00470c10
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x104
ret 4
test ebp, ebp
jne 0x4beeac
mov eax, dword [esi + 0xf28]
mov edx, dword [esi]
imul eax, eax, 0x64
push ebp
push ebp
push 0xa
push ebp
push edx
push ebp
push 5
push ebp
push ebp
lea ecx, [eax + esi + 0xdfc]
xor edx, edx
call fcn.0053c4d0
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x104
ret 4
mov ecx, esi
call fcn.0054ac40
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x104
ret 4
Function at 0x4c12d0
Capabilities:
Capture screenshot
Get graphical window text

Disassembly:
push esi
mov esi, ecx
call fcn.004e2760
test eax, eax
je 0x4c12ed
mov ecx, dword [esi]
call fcn.00542c90
xor edx, edx
mov ecx, eax
pop esi
jmp fcn.004c0b60
xor ecx, ecx
pop esi
jmp fcn.00527d80
Function at 0x4c72d0
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
push edi
lea eax, [esp + 8]
push eax
push 0x589038
push reloc.WSOCK32.dll_accept
mov esi, edx
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x4c72f6
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, esi
lea edx, [eax + 1]
jmp 0x4c7300
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c7300
mov ecx, dword [esp + 8]
sub eax, edx
inc eax
push eax
push esi
push 1
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov edx, dword [esp + 8]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
pop ecx
ret

Function at 0x4c7340
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
push edi
lea eax, [esp + 8]
push eax
push 0x589038
mov esi, edx
push reloc.WSOCK32.dll_accept
mov edi, ecx
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4c736d
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push esi
push edi
push edx
mov dword [esp + 0x1c], 0x64
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
add esp, 8
ret

Function at 0x4c73b0
Capabilities:
Delete registry key

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0x589038
push reloc.WSOCK32.dll_accept
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4c73d2
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [esp + 4]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ecx
ret
Function at 0x4c7400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xa4
push ebx
push ebp
push esi
mov esi, 0xb
mov eax, 0xa
push edi
mov edi, ecx
mov ecx, 0xe
mov dword [esp + 0x14], esi
mov ebp, 6
mov ebx, 0x10
mov dword [esp + 0x3c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x70], esi
mov esi, 8
mov dword [esp + 0x10], edx
mov edx, 0xc
mov dword [esp + 0x28], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], ecx
mov ecx, 4
mov dword [esp + 0x74], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0xa4], eax
mov eax, edi
mov dword [esp + 0x78], esi
mov dword [esp + 0x88], esi
mov dword [esp + 0xa0], esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], 0x11
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], 5
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x40], ebp
mov dword [esp + 0x4c], 4
mov dword [esp + 0x54], ebp
mov dword [esp + 0x60], ecx
mov dword [esp + 0x68], 9
mov dword [esp + 0x6c], edx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], ebp
mov dword [esp + 0x98], edx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], 0
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4c7518
sub eax, esi
cmp eax, ecx
jae 0x4c7532
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa4
ret
mov ebx, dword [esp + 0x10]
push 0x2d
push ebx
call fcn.00570260
mov esi, eax
add esp, 8
test esi, esi
je 0x4c7525
push ebx
mov byte [esi], 0
call fcn.00570543
add esp, 4
mov byte [esi], 0x2d
inc esi
mov ebp, eax
cmp byte [esi], 0
je 0x4c7525
push esi
call fcn.00570543
mov ecx, edi
add esp, 4
mov dword [esp + 0x10], eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c7570
sub ecx, edx
mov esi, 3
xor edx, edx
xor ebx, ebx
cmp ecx, esi
jle 0x4c75a8
jmp 0x4c7590
movzx eax, byte [esi + edi]
imul eax, dword [esp + edx*4 + 0x14]
add ebx, eax
inc edx
cmp edx, 0x26
jle 0x4c75a3
xor edx, edx
inc esi
cmp esi, ecx
jl 0x4c7590
cmp ebp, ebx
jne 0x4c7525
mov esi, 3
xor edx, edx
xor ebx, ebx
cmp ecx, esi
jle 0x4c75e0
lea ecx, [ecx]
movzx eax, byte [esi + edi - 1]
movzx ebp, byte [esi + edi]
imul eax, ebp
imul eax, dword [esp + edx*4 + 0x14]
add ebx, eax
inc edx
cmp edx, 0x26
jle 0x4c75db
xor edx, edx
inc esi
cmp esi, ecx
jl 0x4c75c0
mov ecx, dword [esp + 0x10]
pop edi
pop esi
xor eax, eax
cmp ecx, ebx
pop ebp
sete al
pop ebx
add esp, 0xa4
ret
Function at 0x4c76e0
Capabilities:
Delete registry key

Disassembly:
push ecx
mov edx, 0x5a07e0
mov ecx, str.date
call fcn.004c7340
test eax, eax
je 0x4c781c
mov edx, 2
mov ecx, 0x5a07e0
call fcn.004795f0
mov edx, 0x5a07e0
mov ecx, str.DateUsed
call fcn.004c72d0
lea eax, [esp]
push eax
push 0x589038
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4c774a
mov ecx, dword [esp]
push str.date
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x5a07e0
mov ecx, str.name
call fcn.004c7340
test eax, eax
je 0x4c77c4
mov edx, 0x5a0bc8
mov ecx, str.code
call fcn.004c7340
test eax, eax
je 0x4c77b0
mov edx, 2
mov ecx, 0x5a0bc8
call fcn.004795f0
mov edx, 0x5a0bc8
mov ecx, 0x5a07e0
call fcn.004c7600
test eax, eax
je 0x4c77b0
mov edx, 0x5a07e0
mov ecx, str.UserName
call fcn.004c72d0
mov edx, 0x5a0bc8
mov ecx, str.License
call fcn.004c72d0
mov ecx, str.name
call fcn.004c73b0
mov ecx, str.code
call fcn.004c73b0
mov edx, 0x5a07e0
mov ecx, str.lock
call fcn.004c7340
test eax, eax
je 0x4c77f0
mov edx, 0x5a07e0
mov ecx, str.LockOptions
call fcn.004c72d0
mov ecx, str.lock
call fcn.004c73b0
mov edx, 0x5a07e0
mov ecx, str.channels
call fcn.004c7340
test eax, eax
je 0x4c781c
mov ecx, str.channels
call fcn.004c73b0
mov edx, 0x5a07e0
mov ecx, 0x589048
call fcn.004c72d0
pop ecx
ret

Function at 0x4c79b0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x5a9e18]
mov ecx, dword [0x5a9e14]
push eax
push ecx
push str._ld__ld
push 0x5a07e0
mov dword [0x5a9e0c], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, 0x5a07e0
mov ecx, str.LastRun
jmp fcn.004c72d0
Function at 0x4c94e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
mov edi, ecx
cmp byte [edi], 0
mov ebx, edx
jne 0x4c94f0
pop edi
xor eax, eax
pop ebx
ret
push esi
push 0x5b
push edi
call fcn.00570260
mov esi, eax
add esp, 8
test esi, esi
je 0x4c954f
inc esi
push 0x5d
push esi
call fcn.00570260
add esp, 8
test eax, eax
je 0x4c954f
mov byte [eax], 0
cmp byte [esi], 0
je 0x4c954f
push 0x2e
push esi
call fcn.00570260
add esp, 8
test eax, eax
je 0x4c954f
push esi
call fcn.005705cb
add esp, 4
test eax, eax
jg 0x4c95c7
cmp byte [edi], 9
mov eax, edi
jne 0x4c954a
mov cl, byte [eax + 1]
inc eax
cmp cl, 9
je 0x4c9541
cmp byte [eax], 0x2a
je 0x4c95c7
cmp byte [edi], 9
mov esi, edi
jne 0x4c955e
mov al, byte [esi + 1]
inc esi
cmp al, 9
je 0x4c9556
cmp byte [esi], 0x2a
jne 0x4c95b5
mov eax, dword [0x5a5504]
push eax
xor edx, edx
mov ecx, 0xe11
call fcn.0041d620
mov ecx, dword [ebx]
mov edx, eax
call fcn.00503ad0
pop esi
pop edi
xor eax, eax
pop ebx
ret
push str.__.server__s
push 0x5aa640
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebx]
add esp, 0xc
push ebx
push 0
push 0
push 0
push 0
mov edx, 0x5aa640
call fcn.0043e080
pop esi
pop edi
mov eax, 1
pop ebx
ret
push 0x20
push esi
call fcn.00570260
add esp, 8
test eax, eax
je 0x4c957e
mov byte [eax], 0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
push esi
jns 0x4c9584
push str.__.server__m__s
jmp 0x4c9589
Function at 0x4c9860
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x34
test eax, eax
push esi
push edi
mov edi, edx
mov esi, ecx
je 0x4c987a
push 8
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, edi
dec eax
je 0x4c999f
dec eax
je 0x4c98f3
mov ecx, esi
call fcn.004c9810
mov ebx, eax
test ebx, ebx
jle 0x4c9a4f
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
cdq
idiv ebx
mov ebp, 2
mov dword [esp + 0x10], eax
lea esp, [esp]
lea edx, [esp + 0x24]
push edx
push ebx
xor eax, eax
mov ecx, 8
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x18]
push 0x101a
push esi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], ecx
call dword [sym.imp.USER32.dll_SendMessageA]
dec ebx
jns 0x4c98c0
jmp 0x4c9a4f
xor eax, eax
mov ecx, 8
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
sub eax, ecx
mov dword [esp + 0x10], eax
mov ebp, 2
mov dword [esp + 0x24], ebp
fild dword [esp + 0x10]
fmul qword [0x5890c8]
call fcn.0056fe50
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x24]
push ecx
push 0
push 0x101a
push esi
mov dword [esp + 0x3c], eax
call ebx
xor eax, eax
mov ecx, 8
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edx, edi
sub edx, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], ebp
fild dword [esp + 0x10]
fmul qword [0x5890c8]
call fcn.0056fe50
sub edi, eax
sub edi, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
push 1
push 0x101a
push esi
mov dword [esp + 0x3c], edi
call ebx
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
push ecx
jmp 0x4c9a3a
mov ebx, dword [esp + 0x14]
xor eax, eax
mov ecx, 8
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1c]
sub ecx, ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 0x55555556
imul ecx
lea ecx, [esp + 0x24]
push ecx
mov eax, edx
push 0
shr eax, 0x1f
push 0x101a
add edx, eax
mov ebp, 2
push esi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], edx
call ebx
xor eax, eax
mov ecx, 8
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
mov edx, ecx
sub edx, edi
mov eax, 0x55555556
imul edx
mov eax, edx
shr eax, 0x1f
add edx, eax
sub ecx, edx
sub ecx, edi
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x24]
push ecx
push 1
push 0x101a
push esi
mov dword [esp + 0x34], ebp
call ebx
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x24]
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
push edx
push ebp
push 0x101a
push esi
mov dword [esp + 0x3c], 0
mov dword [esp + 0x34], ebp
call ebx
mov eax, dword [esp + 0x48]
test eax, eax
pop ebp
pop ebx
je 0x4c9a62
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
add esp, 0x34
ret 4
Function at 0x4ca420
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x5a9e28]
mov ecx, dword [0x5a9e24]
push ebx
push eax
push ecx
push str._lu__d
push 0x5a0bc8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, 0x5a0bc8
mov ecx, str.LockOptions
call fcn.004c72d0
mov ebx, dword [0x5a9e2c]
test ebx, ebx
mov byte [0x5a0bc8], 0
je 0x4ca4f2
push ebp
mov bp, word [0x583ea0]
push esi
push edi
nop
mov eax, 0x5a0bc8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ca478
sub eax, edx
mov edx, eax
mov eax, dword [ebx]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ca488
sub eax, esi
add eax, edx
cmp eax, 0x3b5
ja 0x4ca4ef
mov al, byte [0x5a0bc8]
test al, al
je 0x4ca4bb
mov edi, 0x5a0bc8
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4ca4b0
mov word [edi], bp
mov eax, dword [ebx]
mov edx, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ca4c0
mov edi, 0x5a0bc8
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4ca4d0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x4ca470
pop edi
pop esi
pop ebp
mov edx, 0x5a0bc8
mov ecx, 0x589048
pop ebx
jmp fcn.004c72d0
Function at 0x4cacd0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
push ebx
push esi
mov esi, edx
mov ebx, ecx
call fcn.00542ed0
test eax, eax
jne 0x4cacee
pop esi
pop ebx
add esp, 0x108
ret
mov eax, dword [ebx + 0x6b4]
cmp eax, 0xffffffff
je 0x4cad00
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 0x6b0]
test eax, eax
mov dword [ebx + 0x6b4], 0xffffffff
jne 0x4cad31
lea ecx, [ebx + 0x4a0]
mov edx, 1
call fcn.0041fd10
neg eax
sbb eax, eax
add eax, 2
mov dword [ebx + 0x6b0], eax
mov eax, dword [0x5a9e64]
test eax, eax
je 0x4cad45
lea ecx, [ebx + 0x4a0]
call fcn.004caa90
push ebp
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
lea eax, [ebx + 0x4a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4cad82
pop ebp
pop esi
mov dword [ebx + 0x6b0], 0
xor eax, eax
pop ebx
add esp, 0x108
ret
push 2
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
je 0x4caec0
mov dl, byte [0x583b72]
mov cx, word [0x583b70]
lea eax, [esp + 0x10]
mov byte [esp + 0x12], dl
mov word [esp + 0x10], cx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cadb4
sub eax, edx
push 0
mov esi, eax
call fcn.00570bc6
add esp, 4
mov ecx, eax
call fcn.0052d0c0
push eax
xor edx, edx
mov ecx, 0xe75
call fcn.0041d620
push eax
lea eax, [esp + esi + 0x18]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x1c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cadf3
push 0
lea ecx, [esp + 0x10]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x1c]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 0x10]
mov ecx, 0xe7d
call fcn.0041d620
cmp dword [ebx + 0x708], 2
jne 0x4cae50
mov eax, dword [ebx + 0x70c]
cmp eax, 3
je 0x4cae37
cmp eax, 4
jne 0x4cae50
lea esi, [ebx + 8]
push 0x20
push esi
call fcn.00570260
add esp, 8
test eax, eax
jne 0x4cae4d
mov eax, esi
jmp 0x4cae53
inc eax
jmp 0x4cae53
lea eax, [ebx + 8]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cae55
push edi
lea edi, [esp + 0x14]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4cae64
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4cae81
mov ax, word [0x583b70]
mov cl, byte [0x583b72]
mov word [edi], ax
lea eax, [esp + 0x14]
mov byte [edi + 2], cl
lea edx, [eax + 1]
pop edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4caea3
sub eax, edx
push 0
lea edx, [esp + 0x10]
push edx
push eax
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x5a9e50]
test eax, eax
jne 0x4caed1
mov dword [ebx + 0x6b4], ebp
jmp 0x4caee2
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x6b4], 0xffffffff
pop ebp
mov eax, 1
pop esi
mov dword [ebx + 0x6a8], eax
pop ebx
add esp, 0x108
ret
Function at 0x4caf00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x110
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.00542ed0
test eax, eax
je 0x4cb047
cmp dword [esi + 0x6b4], 0xffffffff
mov dword [esi + 0x6a8], 0
jne 0x4caf67
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
lea eax, [esi + 0x4a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x6b4], eax
je 0x4cb047
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
je 0x4cafc3
push 0
call fcn.00570bc6
add esp, 4
mov ecx, eax
call fcn.0052d0c0
push eax
xor edx, edx
mov ecx, 0xe76
call fcn.0041d620
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x20]
add esp, 0xc
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cafa0
mov ecx, dword [esi + 0x6b4]
sub eax, edx
push 0
lea edx, [esp + 0x14]
push edx
push eax
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esi + 0x6b4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x6b0]
mov eax, 2
cmp ecx, eax
mov dword [esi + 0x6b4], 0xffffffff
jne 0x4cb047
cmp dword [esi + 0x708], eax
jne 0x4cb047
cmp dword [esi + 0x70c], 1
jne 0x4cb047
lea eax, [esp + 8]
push eax
push esi
lea edi, [esi + 0x4a0]
push 3
mov edx, 0x32
mov ecx, edi
mov dword [esp + 0x14], 0
call fcn.004c8a00
test eax, eax
mov dword [esp + 0xc], eax
jne 0x4cb03e
mov eax, dword [esp + 8]
test eax, eax
jne 0x4cb03e
push edi
call fcn.005725fc
add esp, 4
pop edi
pop esi
add esp, 0x110
ret
lea ecx, [esp + 0xc]
call fcn.004c8280
pop edi
pop esi
add esp, 0x110
ret