joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418b90
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x7a1008
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x418bc1
push 0x769ca0
call fcn.00531ef0
add esp, 4
call sub.WS2_32.dll_WSACleanup
xor al, al
mov esp, ebp
pop ebp
ret
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push 0x769c94
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x769c8c
push eax
mov dword [0x7a1198], eax
call edi
mov dword [0x7a1220], eax
mov eax, dword [0x7a1198]
push 0x769c84
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [fcn.007a11a0], eax
mov eax, dword [0x7a1220]
test eax, eax
jne 0x418c24
push 0
push 0x769c6c
push 0x769c4c
push 0
mov dword [0x7a1220], 0x7036b0
call ebx
mov eax, dword [fcn.007a11a0]
test eax, eax
jne 0x418c47
push 0
push 0x769c6c
push 0x769c2c
push 0
mov dword [fcn.007a11a0], 0x7036aa
call ebx
mov al, byte [0x7a119c]
test al, 1
jne 0x418c72
mov dl, al
mov ecx, 0x7a11a8
or dl, 1
mov byte [0x7a119c], dl
call fcn.00418dd0
push 0x4191c0
call fcn.00711de7
add esp, 4
push 0x769c94
mov dword [ebp - 0x1c], 0x769c24
mov dword [ebp - 0x18], 0x769c18
mov dword [ebp - 0x14], 0x769c8c
mov dword [ebp - 0x10], 0x769c10
call esi
test eax, eax
mov dword [ebp - 8], eax
je 0x418ce5
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], ecx
jmp 0x418cae
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esi, dword [edx]
push esi
push eax
call edi
mov ebx, eax
mov eax, dword [0x7a1198]
push esi
push eax
call edi
cmp ebx, eax
jne 0x418cee
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
inc eax
add edx, 4
cmp eax, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
jb 0x418cab
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ac70
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
ret
Function at 0x41eb50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x725d78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
call fcn.0070475e
lea ecx, [ebp - 0x14]
mov dword [esi + 0x34], eax
call fcn.007039a1
mov edi, dword [0x83ece4]
lea ecx, [ebp - 0x10]
call fcn.007039a1
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x41eb9c
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00703a3d
lea ecx, [ebp - 0x14]
call fcn.00703a3d
lea eax, [esi + 4]
lea ecx, [esi + 0x14]
lea edx, [esi + 0x18]
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
lea eax, [esi + 8]
lea ecx, [esi + 0x24]
lea edx, [esi + 0x28]
mov dword [esi + 0x10], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], edx
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov edx, dword [esi + 0xc]
mov dword [edx], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov ecx, dword [esi + 0x2c]
mov dword [ecx], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push 2
push 0
push edx
push eax
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.std::strstreambuf.0
call fcn.007041d7
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x430520
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x2aaaaaab
sub ecx, ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, edx
cmp eax, 0x10
jle 0x4306d5
push esi
push edi
jmp 0x430552
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea edi, [ebp - 0x1c]
cdq
sub eax, edx
lea esi, [ecx - 0x18]
sar eax, 1
mov ecx, 6
lea edx, [eax + eax*2]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebx + edx*8]
mov ecx, 6
lea edi, [ebp - 0x4c]
mov dx, word [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, ebx
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
mov ax, word [ebp - 0x28]
mov cx, word [ebp - 0x40]
cmp ax, cx
jae 0x4305a6
cmp cx, dx
jb 0x4305b8
cmp ax, dx
lea esi, [ebp - 0x1c]
jb 0x4305bb
lea esi, [ebp - 0x34]
jmp 0x4305bb
cmp ax, dx
jae 0x4305b0
lea esi, [ebp - 0x34]
jmp 0x4305bb
cmp cx, dx
lea esi, [ebp - 0x1c]
jb 0x4305bb
lea esi, [ebp - 0x4c]
mov eax, dword [ebp + 0xc]
mov ecx, 6
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
mov cx, word [ebp - 0x58]
cmp word [ebx + 0xc], cx
jae 0x4305db
add ebx, 0x18
cmp word [ebx + 0xc], cx
jb 0x4305d2
sub eax, 0x18
mov dword [ebp - 4], eax
cmp cx, word [eax + 0xc]
jae 0x4305f3
sub eax, 0x18
cmp cx, word [eax + 0xc]
jb 0x4305e7
mov dword [ebp - 4], eax
cmp eax, ebx
jbe 0x43065b
mov ecx, 6
mov esi, ebx
lea edi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
mov cx, word [eax]
mov word [ebx], cx
mov dx, word [eax + 2]
mov word [ebx + 2], dx
mov cx, word [eax + 4]
mov word [ebx + 4], cx
mov dx, word [eax + 6]
mov word [ebx + 6], dx
mov cx, word [eax + 8]
mov word [ebx + 8], cx
mov dx, word [eax + 0xa]
mov word [ebx + 0xa], dx
mov cx, word [eax + 0xc]
mov word [ebx + 0xc], cx
mov edx, dword [eax + 0x10]
mov dword [ebx + 0x10], edx
mov ecx, dword [eax + 0x14]
lea edx, [ebp - 0x7c]
mov dword [ebx + 0x14], ecx
push edx
mov ecx, eax
call fcn.004306e0
mov eax, dword [ebp - 4]
add ebx, 0x18
jmp 0x4305c8
mov edi, dword [ebp + 0xc]
mov eax, 0x2aaaaaab
mov ecx, edi
mov esi, dword [ebp + 8]
sub ecx, ebx
push 0
imul ecx
mov ecx, edx
mov edx, ebx
sar ecx, 2
mov eax, ecx
sub edx, esi
shr eax, 0x1f
add ecx, eax
mov eax, 0x2aaaaaab
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp ecx, edx
jg 0x4306a4
push edi
push ebx
call fcn.00430520
add esp, 0xc
mov dword [ebp + 0xc], ebx
mov edi, ebx
jmp 0x4306b3
push ebx
push esi
call fcn.00430520
add esp, 0xc
mov dword [ebp + 8], ebx
mov esi, ebx
mov ecx, edi
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov eax, edx
cmp eax, 0x10
jg 0x43054f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a6f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
mov ebx, ecx
mov edx, dword [0x770b48]
lea eax, [ebp - 0xc]
lea ecx, [ebp - 4]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push reloc.ijl15.dll_Ordinal_2
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x45a7fe
mov eax, dword [ebx + 0x6c]
push esi
test eax, eax
push edi
je 0x45a789
mov ecx, dword [ebx + 0x60]
call fcn.0043ee00
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x60]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x2c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x7c1a4c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x45a795
mov ecx, 0xd
xor eax, eax
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
mov ebx, dword [ebx + 0x6c]
mov byte [ebp - 0x2e], 0
test ebx, ebx
mov dword [ebp - 8], ebx
mov edi, 1
je 0x45a7ab
mov dword [ebp - 8], edi
mov edx, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x60]
push 0x33
push ecx
push edi
push 0
push 0x76b148
push edx
call esi
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push 4
push eax
push 4
push 0
push 0x76b13c
push ecx
call esi
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10]
push 4
push edx
push 4
push 0
push 0x76b134
push eax
mov dword [ebp - 0x10], edi
call esi
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push esi
lea eax, [ebp - 0x14]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, ecx
push eax
mov ecx, dword [0x770b48]
push 1
push 0
push ecx
push reloc.ijl15.dll_Ordinal_2
call edi
test eax, eax
jne 0x45b2e0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x770b48]
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push ecx
push reloc.ijl15.dll_Ordinal_2
call edi
test eax, eax
jne 0x45b300
mov eax, 4
lea edx, [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x10]
push edx
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 8]
push eax
push ecx
push 0
push 0x76b13c
push edx
call ebx
cmp dword [ebp - 0x10], 1
je 0x45b21e
mov dword [ebp - 0x10], 0
lea eax, [ebp - 4]
lea ecx, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
push ecx
push edx
push 0
push 0x76b134
push eax
call ebx
mov ecx, 0xd
xor eax, eax
lea edi, [ebp - 0x68]
lea edx, [ebp - 0x34]
rep stosd dword es:[edi], eax
mov ecx, 6
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0x19
stosw word es:[edi], ax
push ecx
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
push edx
push eax
push 0
mov edi, 1
push 0x76b24c
push ecx
mov dword [ebp - 8], edi
call ebx
lea edx, [ebp - 4]
lea eax, [ebp - 0x68]
push edx
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 8]
push eax
push ecx
push 0
push 0x76b148
push edx
mov byte [ebp - 0x1c], 0
mov dword [ebp - 8], edi
mov dword [ebp - 4], 0x33
call ebx
mov eax, dword [ebp - 0x10]
mov byte [ebp - 0x36], 0
test eax, eax
mov byte [ebp - 0x1c], 0
mov dword [esi + 0x6c], eax
pop ebx
je 0x45b2d0
mov ecx, dword [esi + 0x60]
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ecx]
call dword [eax + 0x9c]
mov ecx, dword [esi + 0x64]
push 0x7c1a4c
mov eax, dword [ecx]
call dword [eax + 0x9c]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x60]
push 0x7c1a4c
mov edx, dword [ecx]
call dword [edx + 0x9c]
mov ecx, dword [esi + 0x64]
push 0x7c1a4c
mov eax, dword [ecx]
call dword [eax + 0x9c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45d3e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
lea eax, [ebp - 8]
push edi
mov esi, ecx
mov ecx, dword [0x770b48]
push eax
xor edi, edi
push 1
push edi
push ecx
push reloc.ijl15.dll_Ordinal_2
call ebx
cmp eax, edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
jne 0x45d49b
mov edx, dword [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
mov ecx, dword [0x770b48]
lea eax, [ebp - 4]
push eax
push 1
push 0
push ecx
push reloc.ijl15.dll_Ordinal_2
call ebx
test eax, eax
jne 0x45d49b
mov eax, 4
lea edx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push edx
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x10]
push eax
push ecx
push 0
push 0x76b3f0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 4]
push eax
call edi
mov edi, dword [ebp - 0x14]
mov eax, 0xaaaaaaab
mul edi
mov ecx, edx
mov eax, edi
xor edx, edx
mov edi, 3
div edi
mov eax, dword [esi + 0x7c]
shr ecx, 1
cmp ecx, eax
mov dword [esi + 0x74], ecx
mov dword [esi + 0x78], edx
jge 0x45d494
test ecx, ecx
jge 0x45d49b
mov dword [esi + 0x74], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x477f40
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7293e9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
call fcn.00457be0
mov al, byte [ebp - 0xd]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [esi + 0x60], al
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov cl, byte [ebp - 0xd]
mov dword [esi + 0x74], ebx
mov byte [esi + 0x70], cl
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dl, byte [ebp - 0xd]
lea edi, [esi + 0x88]
mov dword [ebp - 0x18], edi
mov byte [edi + 0x2c], dl
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov al, byte [ebp - 0xd]
lea ecx, [edi + 0x3c]
push ebx
mov byte [ebp - 4], 3
mov byte [ecx], al
call fcn.00420200
mov ecx, 0x18
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x73e054
mov byte [esi + 0xe8], bl
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x490740
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov edi, dword [0x770b48]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x214]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x214]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0x76ba2c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [ebp - 0x214]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x76a664
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0x83e158]
test edi, edi
jne 0x4907e3
mov edi, 0x73a7f4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x214]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [ebp - 0x214]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x76a664
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x83a9e0
call fcn.006e7350
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x214]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [ebp - 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 1
lea ecx, [ebp - 0x214]
push 0
push ecx
push reloc.ijl15.dll_Ordinal_2
call esi
mov ecx, 1
test eax, eax
mov dword [ebp - 4], ecx
jne 0x490905
mov edx, dword [ebp - 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
lea eax, [ebp - 8]
lea ecx, [ebp - 0x214]
push eax
push 1
push 0
push ecx
push reloc.ijl15.dll_Ordinal_2
call esi
test eax, eax
jne 0x4908f9
mov eax, 4
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push edx
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4908f3
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 8]
push ecx
call edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b86e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72ca08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x314
push ebx
push esi
push edi
xor ebx, ebx
lea esi, [ecx + 0x8c]
mov ecx, dword [esi]
mov eax, dword [ecx]
cmp eax, ecx
mov dword [ebp - 0x14], eax
je 0x4b8781
lea edi, [ebx + 1]
mov eax, dword [eax + 0x14]
lea ecx, [ebp - 0x14]
push eax
call fcn.004be940
mov ecx, dword [eax + 4]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004be940
mov ecx, eax
add ecx, 0x1c
call fcn.0049ad90
push eax
lea ecx, [ebp - 0x14]
call fcn.004be940
mov edx, dword [eax]
lea eax, [ebp - 0xd]
push edx
push edi
push 0x76dce8
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x2c], esp
push eax
push 0x76dcd4
call fcn.004448b0
mov ecx, dword [0x83e3c4]
push ecx
call fcn.0057f810
add esp, 0x2c
lea ecx, [ebp - 0x14]
call fcn.004c07e0
mov ecx, dword [esi]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
jne 0x4b8717
inc ebx
add esi, 0x10
cmp ebx, 3
jl 0x4b8709
mov dl, byte [ebp - 0xd]
push 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x28], dl
call fcn.00420200
mov edi, 0x7c1a4c
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea ecx, [ebp - 0x28]
push ebx
call fcn.004219e0
test al, al
je 0x4b87e0
mov edi, dword [ebp - 0x24]
mov ecx, ebx
mov eax, ecx
mov esi, 0x7c1a4c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ebx
mov byte [ecx + ebx], 0
mov edi, 0x76dcc0
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 4], 0
mov ebx, ecx
lea ecx, [ebp - 0x28]
push ebx
call fcn.004219e0
test al, al
je 0x4b8829
mov edi, dword [ebp - 0x24]
mov ecx, ebx
mov edx, ecx
mov esi, 0x76dcc0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], ebx
mov byte [eax + ebx], 0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4b88c9
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x4b8840
mov eax, 0x73a7f4
push eax
push 0x76dcbc
sub esp, 0x10
lea edx, [ebp - 0x15]
mov ecx, esp
mov dword [ebp - 0x2c], esp
push edx
push 0x76dcac
call fcn.004448b0
mov eax, dword [0x83e3c4]
push eax
call fcn.0057f810
add esp, 0x1c
lea ecx, [ebp - 0x12c]
push ecx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x4b8888
mov eax, 0x73a7f4
lea edx, [ebp - 0x12c]
push eax
push edx
push 0x6ab
call fcn.00581bb0
add esp, 4
push eax
lea eax, [ebp - 0x320]
push eax
call fcn.00711e28
add esp, 0x10
lea ecx, [ebp - 0x320]
push 0
push 1
push 0xffff
push ecx
push 1
mov ecx, 0x7dabc0
call fcn.00512f20
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x4b88fb
mov al, byte [ecx - 1]
test al, al
je 0x4b88f1
cmp al, 0xff
je 0x4b88f1
dec al
mov byte [ecx - 1], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
push ecx
call fcn.00703996
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f5450
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72f94b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, ecx
push esi
xor ecx, ecx
xor edx, edx
mov eax, dword [eax + 0x9c]
push edi
mov dword [ebp - 0x10], ecx
mov esi, dword [eax]
cmp esi, eax
je 0x4f548e
mov edi, dword [ebp + 0xc]
cmp edi, edx
je 0x4f54c3
mov esi, dword [esi]
inc edx
cmp esi, eax
jne 0x4f5483
mov eax, dword [ebp + 8]
mov dl, byte [ebp + 0xb]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 0xc], dl
mov dl, byte [ebp + 0xb]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov byte [eax + 0x1c], dl
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp + 8]
mov eax, dword [esi + 8]
push ebx
push ecx
mov dword [edi], eax
mov edx, dword [esi + 0xc]
mov dword [edi + 4], edx
mov eax, dword [esi + 0x10]
mov dword [edi + 8], eax
mov dl, byte [esi + 0x14]
lea ebx, [edi + 0xc]
mov ecx, ebx
mov byte [ebx], dl
call fcn.00420200
mov eax, dword [0x73a7f0]
mov ecx, ebx
push eax
lea eax, [esi + 0x14]
push 0
push eax
call fcn.0041fed0
mov cl, byte [esi + 0x24]
lea ebx, [edi + 0x1c]
push 0
mov dword [ebp - 4], 0
mov byte [ebx], cl
mov ecx, ebx
call fcn.00420200
mov edx, dword [0x73a7f0]
lea eax, [esi + 0x24]
push edx
push 0
push eax
mov ecx, ebx
call fcn.0041fed0
mov eax, dword [esi + 0x34]
pop ebx
mov dword [edi + 0x2c], eax
mov ecx, dword [esi + 0x38]
mov dword [edi + 0x30], ecx
mov edx, dword [esi + 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x34], edx
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x505880
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
push edi
mov edi, dword [0x770b48]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x270]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x270]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0x76e96c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [ebp - 0xc]
and ecx, 3
xor ebx, ebx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 8]
push eax
push ecx
push ebx
push 0xf003f
push ebx
push ebx
lea edx, [ebp - 0x270]
push ebx
push edx
push reloc.ijl15.dll_Ordinal_2
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x505a1b
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, 1
push esi
mov ecx, 0x83a9e0
call fcn.006db8b0
mov dword [ebp - 4], eax
mov eax, dword [0x83be50]
push eax
push esi
call fcn.00543ec0
add esp, 4
lea ecx, [ebp - 0x70]
push eax
push 0x76feb4
push ecx
call fcn.00711e28
mov ecx, dword [ebp - 8]
add esp, 0x10
lea edx, [ebp - 4]
lea eax, [ebp - 0x70]
push 4
push edx
push 4
push ebx
push eax
push ecx
call edi
inc esi
cmp esi, 0x9ea
jl 0x505924
mov esi, 0x1f40
push esi
mov ecx, 0x83a9e0
call fcn.006db950
mov edx, dword [0x83be50]
mov dword [ebp - 4], eax
push edx
push esi
call fcn.00543ec0
add esp, 4
push eax
lea eax, [ebp - 0x70]
push 0x76feb4
push eax
call fcn.00711e28
mov eax, dword [ebp - 8]
add esp, 0x10
lea ecx, [ebp - 4]
lea edx, [ebp - 0x70]
push 4
push ecx
push 4
push ebx
push edx
push eax
call edi
inc esi
cmp esi, 0x1f6d
jl 0x505974
mov esi, 0x2008
push esi
mov ecx, 0x83a9e0
call fcn.006db9a0
mov ecx, dword [0x83be50]
mov dword [ebp - 4], eax
push ecx
push esi
call fcn.00543ec0
add esp, 4
lea edx, [ebp - 0x70]
push eax
push 0x76feb4
push edx
call fcn.00711e28
mov edx, dword [ebp - 8]
add esp, 0x10
lea eax, [ebp - 4]
lea ecx, [ebp - 0x70]
push 4
push eax
push 4
push ebx
push ecx
push edx
call edi
inc esi
cmp esi, 0x20fb
jl 0x5059c5
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret