joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4524af
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x27c
mov eax, 0x4923b4
call fcn.00458f67
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
call fcn.0045b1d0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
push str.Program_FilesCommon_FilesMcAfeePlatformCore_trusted.js
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
je 0x452553
lea eax, [ebp - 0x218]
push eax
call fcn.00451f9f
pop ecx
test eax, eax
je 0x452553
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
je 0x452544
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.004506a5
jmp 0x452553
lea ecx, [ebp - 0x218]
push ecx
push eax
mov ecx, edi
call fcn.004507bf
mov byte [ebp - 0x27c], 0
lea eax, [ebp + 0xc]
push dword [ebp - 0x27c]
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.00450637
add esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x278]
call fcn.0040beea
push 0x4a6b30
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 1
call fcn.00450940
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x4525a7
mov esi, dword [esi]
push esi
mov dword [ebp - 0x27c], esi
call ebx
test eax, eax
je 0x4525e6
push esi
call fcn.00451f9f
pop ecx
test eax, eax
je 0x4525e6
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
je 0x4525d7
lea eax, [ebp - 0x27c]
mov ecx, edi
push eax
call fcn.0045067b
jmp 0x4525e6
lea ecx, [ebp - 0x27c]
push ecx
push eax
mov ecx, edi
call fcn.004506cf
lea eax, [ebp - 0x288]
push eax
call fcn.004526e3
pop ecx
mov esi, dword [ebp - 0x288]
mov byte [ebp - 4], 2
jmp 0x4526b0
and dword [ebp - 0x220], 0
lea ecx, [ebp - 0x230]
and dword [ebp - 0x21c], 0
push esi
call fcn.00403c5b
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x230]
call fcn.0040beea
push 0x4a6b30
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 4
call fcn.00450940
mov ebx, eax
cmp dword [ebx + 0x14], 8
jb 0x452650
mov ebx, dword [ebx]
push ebx
mov dword [ebp - 0x27c], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x452693
push ebx
call fcn.00451f9f
pop ecx
test eax, eax
je 0x452693
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
je 0x452684
lea eax, [ebp - 0x27c]
mov ecx, edi
push eax
call fcn.0045067b
jmp 0x452693
lea ecx, [ebp - 0x27c]
push ecx
push eax
mov ecx, edi
call fcn.004506cf
lea ecx, [ebp - 0x248]
call fcn.00403bdf
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.00403bdf
add esi, 0x18
cmp esi, dword [ebp - 0x284]
jne 0x452602
lea ecx, [ebp - 0x288]
call fcn.0045232e
lea ecx, [ebp - 0x260]
call fcn.00403bdf
lea ecx, [ebp - 0x278]
call fcn.00403bdf
call fcn.00458f11
ret
Function at 0x453869
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x4925c8
call fcn.00458f67
mov edi, ecx
mov dword [ebp - 0x21c], edi
mov ebx, dword [ebp + 8]
lea esi, [edi + 0x18]
xor eax, eax
mov dword [ebp - 0x220], edi
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
push esi
mov dword [ebp - 0x21c], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.00453029
pop ecx
mov dword [esi], eax
xor ecx, ecx
lea esi, [edi + 0x24]
mov dword [edi + 0x20], ecx
xor eax, eax
mov dword [ebp - 4], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 1
test ebx, ebx
je 0x4538d8
push ebx
jmp 0x453925
push 0x208
push ecx
lea eax, [ebp - 0x218]
push eax
call fcn.0045b1d0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
push str.Program_FilesCommon_FilesMcAfeePlatformCore_trusted.js
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.0040575c
mov eax, edi
call fcn.00458f11
ret 4
Function at 0x454cfb
Capabilities:
Check if file exists
Copy file
Create directory
Move file

Disassembly:
push 0x234
mov eax, 0x492756
call fcn.00458f67
mov edi, ecx
mov dword [ebp - 0x21c], edi
mov eax, dword [ebp + 8]
lea esi, [edi + 0x14]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], esi
test esi, esi
je 0x454d2f
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
add edi, 0x24
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x454d41
mov eax, dword [edi]
push 1
push eax
lea ecx, [ebp - 0x240]
call fcn.00453936
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0045b1d0
add esp, 0xc
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x454d6e
mov eax, dword [edi]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.00401380
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push str.trusted.tmp
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x454e37
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x454dd0
mov eax, dword [edi]
mov ebx, dword [ebp - 0x21c]
push eax
add ebx, 0x24
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x454e03
cmp dword [ebx + 0x14], 8
jb 0x454dec
mov ebx, dword [ebx]
xor eax, eax
push eax
push eax
push 2
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
jmp 0x454e19
cmp dword [ebx + 0x14], 8
jb 0x454e0b
mov ebx, dword [ebx]
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x454e57
cmp dword [edi + 0x14], 8
jb 0x454e25
mov edi, dword [edi]
push 4
push edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor ebx, ebx
lea ecx, [ebp - 0x240]
call fcn.00453c9a
test esi, esi
je 0x454e4d
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, ebx
call fcn.00458f11
ret 4
lea ecx, [ebp - 0x240]
call fcn.00453c9a
push str.67136527_5D6B_4AC9_865B_3E392E982420
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov ecx, dword [ebp - 0x21c]
call fcn.0045440e
mov ecx, dword [ebp - 0x21c]
call fcn.0045470b
mov ebx, eax
jmp 0x454e42
Function at 0x454e87
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4c143c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x454ee4
cmp byte [esi + 0x3e], bl
je 0x454ee4
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
cmp di, ax
je 0x454f1d
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, ebx
je 0x454ef5
sub eax, 1
je 0x454ef8
dec eax
sub eax, 1
jne 0x454f1d
mov byte [esi + 0x3e], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00458eeb
leave
ret
mov byte [esi + 0x3e], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x454f15
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00472525
add esp, 0x10
cmp edi, eax
jne 0x454f1d
cmp byte [esi + 0x3e], bl
sete al
jmp 0x454ee6
xor al, al
jmp 0x454ee6

Function at 0x4558f1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4c143c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
mov esi, ecx
cmp bx, di
jne 0x45591a
xor eax, eax
jmp 0x4559e6
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x455946
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x455946
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x4559e6
cmp dword [esi + 0x4c], 0
je 0x4559e3
mov ecx, esi
call fcn.004552ff
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x455972
push dword [esi + 0x4c]
push edi
call fcn.004531eb
pop ecx
pop ecx
test al, al
je 0x4559e3
movzx ebx, di
jmp 0x4559e3
movzx eax, di
mov dword [ebp - 0x28], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x4559e3
cmp eax, 1
jle 0x4559b1
cmp eax, 3
jne 0x4559e3
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x455962
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x4559d4
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.00472525
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x4559e3
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x34], eax
mov ax, di
jne 0x4559e6
mov ax, bx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00458eeb
leave
ret 4
Function at 0x4562a0
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x4a8
mov eax, 0x492865
call fcn.00458f67
mov edi, ecx
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 0x10], esi
jne 0x4562c2
xor eax, eax
jmp 0x456459
lea ecx, [ebp - 0x2a4]
push 3
mov dword [ebp - 0x2a8], ecx
lea ecx, [ebp - 0x2a8]
push eax
call fcn.0040b59c
mov ebx, 0x104
mov dword [ebp - 4], esi
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0045b1d0
push ebx
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.0045b1d0
add esp, 0x18
push dword [ebp - 0x2a8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
call fcn.00416bd4
push dword [ebp - 0x2a8]
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.00416bd4
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x494bbc
push ebx
lea eax, [ebp - 0x114]
push eax
call fcn.0040e304
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x224]
push ecx
push 0xffffffffffffffff
push 0x412469
push 0x41244e
push 0x412472
push 0x412460
push 0x412457
push fcn.00409f7f
push 0x409e8f
call eax
mov ebx, eax
add esp, 0x24
test ebx, ebx
je 0x45643d
push 0x108
lea eax, [ebp - 0x4b4]
push esi
push eax
call fcn.0045b1d0
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x4b4]
push ecx
push esi
push 0x456461
push esi
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push ebx
call eax
mov eax, dword [edi + 0xc]
push ebx
call eax
add esp, 0x2c
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x45643d
cmp dword [ebp - 0x4b4], 0
je 0x456430
lea eax, [ebp - 0x3a8]
mov dword [ebp - 0x3ac], eax
lea ecx, [ebp - 0x3ac]
push 3
lea eax, [ebp - 0x4b0]
push eax
call fcn.0040b4de
push dword [ebp - 0x3ac]
mov byte [ebp - 4], 1
call fcn.0045138d
mov esi, eax
lea eax, [ebp - 0x3a8]
pop ecx
cmp dword [ebp - 0x3ac], eax
je 0x456430
push dword [ebp - 0x3ac]
call fcn.0045f1d9
pop ecx
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x2a4]
cmp dword [ebp - 0x2a8], eax
je 0x456457
push dword [ebp - 0x2a8]
call fcn.0045f1d9
pop ecx
mov eax, esi
call fcn.00458f11
ret 4

Function at 0x47c126
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047bdd7

Function at 0x47c131
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047bf61
Function at 0x486750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [ebp + 8]
mov dword [ebp - 4], esi
call fcn.0040c0dc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
push ebx
push dword [edi]
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, 0xea
jne 0x4867c1
push dword [edi]
call fcn.00458ee6
mov dword [edi], 0
push 0x4a8236
push dword [ebx]
call fcn.00459ae8
add esp, 0xc
mov dword [edi], eax
push ebx
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp - 4]
push 0
push dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov edx, dword [ebp + 8]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4867dc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4867f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492b05
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4c143c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48693a
mov ebx, dword [ebp + 0x14]
cmp ebx, 1
jb 0x48693a
xor esi, esi
mov dword [ebp - 0x10], 0
mov dword [ebp + 0x14], esi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], esi
cmp ecx, 1
jne 0x48688f
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
mov ecx, edx
call fcn.00486160
mov ebx, eax
test ebx, ebx
jne 0x4868ab
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x10]
mov dword [ebp + 0x10], esi
lea eax, [ebx + 0x20]
push eax
mov dword [ebp - 0x10], eax
call fcn.00458edd
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
test edi, edi
jne 0x4868cd
lea ebx, [eax + 8]
jmp 0x486912
cmp ecx, 7
jne 0x48686b
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
mov ecx, edx
call fcn.00485fa0
mov ebx, eax
test ebx, ebx
je 0x486862
mov esi, dword [ebp + 0x14]
push esi
call fcn.00458ee6
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x14]
lea eax, [ebx + 0x20]
push eax
push edi
push dword [ebp + 0xc]
push ebx
push dword [ebp + 0x10]
call fcn.00486370
mov ebx, eax
test ebx, ebx
jne 0x486912
push dword [ebp + 8]
lea ecx, [ebp + 0x10]
call fcn.0040c0dc
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
push edi
push 3
push ebx
push dword [ebp + 0x10]
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp + 0x10]
mov ebx, eax
call fcn.0040c133
push edi
call fcn.00458ee6
add esp, 4
push esi
call fcn.00458ee6
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x57
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x48a2e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x48a305
xor ecx, ecx
cmp cx, word [eax]
je 0x48a305
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x48a305
test al, 0x10
je 0x48a305
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x48ac50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492085
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4c143c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call fcn.00448270
mov ecx, eax
test ecx, ecx
je 0x48ada9
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor edi, edi
mov dword [ebp - 4], 1
nop word [eax + eax]
lea edx, [edi + 1]
test edx, edx
js 0x48ad9f
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x48acd8
push edx
lea ecx, [ebp - 0x10]
call fcn.004486b0
mov esi, dword [ebp - 0x10]
cmp dword [esi - 4], 1
jle 0x48acec
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.004480f0
mov esi, dword [ebp - 0x10]
push esi
push dword [esi - 8]
call ebx
mov edi, eax
test edi, edi
je 0x48ad39
push dword [esi - 8]
push esi
call fcn.0045f029
add esp, 8
test eax, eax
js 0x48ad9f
cmp eax, dword [esi - 8]
jg 0x48ad9f
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp edi, dword [esi - 0xc]
ja 0x48acb0
add esi, 0xfffffff0
push esi
call fcn.00447f70
mov edi, dword [ebp + 8]
add esp, 4
add eax, 0x10
mov dword [edi], eax
jmp 0x48ad76
call fcn.00448270
mov ecx, eax
test ecx, ecx
je 0x48adb3
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
push 0x4b5990
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.004871f0
test al, al
jne 0x48ad73
push 0
push 0x4b5990
mov ecx, edi
call fcn.00448750
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x48ad8b
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.0040b4a6
push 0x80004005
call fcn.0040b4a6
push 0x80004005
call fcn.0040b4a6
int3

Function at 0x48ae30
Capabilities:
Delete registry key

Disassembly:
mov dword [ecx], vtable.CoreTech::internal::CRegKeyImpl.0
jmp fcn.0048ae60

Function at 0x48ae60
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x48ae9a
cmp byte [esi + 0xc], 0
je 0x48ae83
push 0x4b5990
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, dword [esi + 4]
mov byte [esi + 0xc], 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
ret
xor eax, eax
mov dword [esi + 8], eax
pop esi
ret
Function at 0x48bb40
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4c143c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x214], ecx
push ebx
mov dword [ebp - 0x210], eax
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
cmp dword [ebp + 0x14], 0
je 0x48bc50
test eax, eax
jne 0x48bc50
push edi
xor edi, edi
push esi
nop word [eax + eax]
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.0045b1d0
add esp, 0xc
mov dword [ebp - 0x20c], 0x100
lea eax, [ebp - 0x20c]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x204]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x48bc26
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x208]
push eax
push 0xf003f
push esi
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48bc2e
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x214]
push dword [ebp - 0x210]
push dword [ebp + 0xc]
push dword [ebp - 0x208]
call fcn.0048bb40
push dword [ebp - 0x208]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48bc2e
cmp esi, 0x103
je 0x48bc4c
inc edi
test esi, esi
je 0x48bb90
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00458eeb
mov esp, ebp
pop ebp
ret 0x10
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00458eeb
mov esp, ebp
pop ebp
ret 0x10

Function at 0x48c4e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret
Function at 0x48cd40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49339d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c143c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4c3be0]
mov esi, dword [eax + ecx*4]
mov eax, dword [0x4c474c]
cmp eax, dword [esi + 4]
jg 0x48ce39
mov eax, dword [0x4c473c]
cmp eax, dword [esi + 4]
jg 0x48ce8b
mov eax, dword [0x4c4720]
mov eax, dword [eax + 0xc]
cmp eax, method.ATL::CAtlStringMgr.virtual_12
jne 0x48cdb2
lock inc dword [0x4c4734]
mov eax, 0x4c4728
jmp 0x48cdb9
mov ecx, 0x4c4720
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 1
sub ecx, 0
je 0x48ce0f
sub ecx, 1
je 0x48cde6
sub ecx, 1
je 0x48cddf
mov eax, str._s__d_:__UNKNOWN_:___s_:__s_n
jmp 0x48cdeb
mov eax, str._s__d_:__ERROR_:___s_:__s_n
jmp 0x48cdeb
mov eax, 0x4b42cc
mov esi, dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004481b0
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x10]
lea edx, [eax - 0x10]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48ce27
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
push 0x4c474c
call fcn.004593b6
add esp, 4
cmp dword [0x4c474c], 0xffffffff
jne 0x48cd84
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x493463
mov dword [0x4c4740], 0x494790
mov dword [0x4c4744], eax
mov byte [0x4c4748], 0
call fcn.0045926e
push 0x4c474c
call fcn.0045936c
add esp, 8
jmp 0x48cd84
push 0x4c473c
call fcn.004593b6
add esp, 4
cmp dword [0x4c473c], 0xffffffff
jne 0x48cd95
xor eax, eax
mov dword [0x4c4720], 0x4947a8
push 0x493460
mov dword [0x4c4724], 0x4c4740
mov dword [0x4c4734], 2
mov dword [0x4c472c], 0
mov dword [0x4c4730], 0
mov dword [0x4c4738], eax
mov dword [0x4c4728], 0x4c4720
call fcn.0045926e
push 0x4c473c
call fcn.0045936c
add esp, 8
jmp 0x48cd95