joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484ab0
Capabilities:
Check http status code

Disassembly:
push 0x434
mov eax, 0x5d032d
call fcn.00506e69
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x434], edi
mov dword [ebp - 0x428], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
call fcn.0041279d
push eax
mov ecx, edi
call fcn.00411d94
push ebx
push ebx
push ebx
push ebx
push str.GetWeb
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x428], esi
mov byte [ebp - 4], 2
call fcn.00450b18
push 0x400000
push 0xffffffffffffffff
push ebx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 3
push dword [ebp - 0x43c]
call fcn.00450960
push ebx
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x430]
mov dword [ebp - 0x42c], 4
push eax
push 0x20000013
lea ecx, [ebp - 0x424]
call fcn.004c922a
cmp dword [ebp - 0x430], 0xc8
jne 0x484b9a
push 0x401
lea eax, [ebp - 0x418]
push ebx
push eax
call fcn.0056b050
add esp, 0xc
push 0x400
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x424]
call fcn.004c92a9
test eax, eax
je 0x484b9a
lea eax, [ebp - 0x418]
mov ecx, edi
push eax
call fcn.00439162
jmp 0x484b6f
mov eax, dword [ebp - 0x420]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
je 0x484bb5
push eax
call esi
mov eax, ebx
mov dword [ebp - 0x420], eax
mov ecx, dword [ebp - 0x43c]
test ecx, ecx
je 0x484bd0
push ecx
call esi
mov eax, dword [ebp - 0x420]
mov ecx, ebx
mov dword [ebp - 0x43c], ecx
mov dword [ebp - method.CInternetHandle.virtual_0], vtable.CInternetHandle.0
test eax, eax
je 0x484bed
push eax
call esi
mov ecx, dword [ebp - 0x43c]
mov dword [ebp - 0x420], ebx
mov dword [ebp - method.CInternetHandle.virtual_0], vtable.CInternetHandle.0
test ecx, ecx
je 0x484c0c
push ecx
call esi
jmp 0x484c0c
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, edi
call fcn.00506db6
ret 8

Function at 0x485399
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 8
mov edi, ecx
call fcn.00506ecd
mov edx, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
push 4
push eax
mov dword [eax + 4], edx
xor edx, edx
push 0x4e8d86
push edx
mov dword [eax], edi
push edx
mov dword [ebp - 4], edx
call fcn.005a2a64
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x4853e0
push esi
mov ecx, edi
call fcn.0045f364
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x48979d
Capabilities:
Get memory capacity

Disassembly:
push 0x58
mov eax, 0x5d0d1e
call fcn.00506dfb
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x54], esi
call fcn.0041279d
push eax
mov ecx, ebx
call fcn.00411d94
lea eax, [ebp - 0x50]
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x50], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov esi, dword [ebp - 0x48]
mov ebx, dword [ebp - 0x44]
call fcn.00489831
mov ecx, eax
cmp ebx, edx
jb 0x4897fd
ja 0x4897f9
cmp esi, ecx
jbe 0x4897fd
mov ecx, esi
mov edx, ebx
mov edi, ecx
mov eax, edx
sub edi, esi
sbb eax, ebx
mov dword [ebp - 0x60], eax
jne 0x489812
cmp edi, 0x200
jbe 0x489816
mov ecx, esi
mov edx, ebx
mov esi, dword [ebp - 0x58]
push edx
push ecx
push 0x6048c0
push esi
call fcn.00412690
add esp, 0x10
mov eax, esi
call fcn.00506da5
ret
Function at 0x48aa43
Capabilities:
Check os version

Disassembly:
push pe_nt_image_headers32
mov eax, 0x5d0fd4
call fcn.00506dfb
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x12c]
mov esi, 0x11c
push esi
push 0
push eax
call fcn.0056b050
add esp, 0xc
mov dword [ebp - 0x12c], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x12c]
push eax
call esi
test eax, eax
je 0x48aa9e
push dword [ebp - 0x120]
push dword [ebp - 0x124]
push dword [ebp - 0x128]
push 0x60347c
jmp 0x48aad0
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x114
push eax
call esi
test eax, eax
je 0x48abe4
push dword [ebp - 0x120]
push dword [ebp - 0x124]
push dword [ebp - 0x128]
push 0x6034d4
push edi
call fcn.00412690
add esp, 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x6034f4
call fcn.00413f09
and dword [ebp - 4], 0
push ecx
mov ecx, esp
push 0x603530
call fcn.00413f09
or dword [ebp - 4], 0xffffffff
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
call fcn.004c9775
add esp, 8
mov esi, eax
mov ecx, esp
mov dword [ebp - 0x138], esp
push 0x603594
call fcn.00413f09
push ecx
mov ecx, esp
mov dword [ebp - 4], 1
push 0x6035f0
call fcn.00413f09
or dword [ebp - 4], 0xffffffff
push ebx
call fcn.004c9775
add esp, 8
mov ebx, eax
mov ecx, esp
mov dword [ebp - 0x138], esp
push 0x60365c
call fcn.00413f09
push ecx
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x603688
mov dword [ebp - 4], 2
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
push 0x6036e8
call fcn.00413f09
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x130]
push eax
call fcn.004c9629
add esp, 0x10
mov dword [ebp - 4], 4
cmp esi, 0xa
jne 0x48abb1
push dword [ebp - 0x130]
push ebx
push esi
push 0x60375c
jmp 0x48abc8
push dword [ebp - 0x120]
push dword [ebp - 0x124]
push dword [ebp - 0x128]
push str._d._d._d
push edi
call fcn.00412690
mov ecx, dword [ebp - 0x130]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.00412ac4
xor eax, eax
inc eax
jmp 0x48abe6
xor eax, eax
call fcn.00506da5
ret
Function at 0x48ac04
Capabilities:
Check if file exists

Disassembly:
push 0x48
mov eax, 0x5d1065
call fcn.00506dc7
xor esi, esi
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
call fcn.0042ca82
push ecx
xor ebx, ebx
mov dword [ebp - 0x1c], esp
mov ecx, esp
inc ebx
push 0x6012b0
mov dword [ebp - 4], ebx
call fcn.00413f09
push ecx
push esp
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.0043944c
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x54]
push edi
mov byte [ebp - 4], bl
call fcn.00434114
push dword [edi]
mov dword [ebp - 0x18], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x48ade7
lea ecx, [ebp - 0x3c]
call fcn.0042ca82
push 0x6012ec
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00413f09
mov byte [ebp - 4], 4
call fcn.00430f47
test eax, eax
je 0x48ac99
push 0x601340
lea ecx, [ebp - 0x10]
call fcn.0041421f
push esi
push ecx
mov esi, esp
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00412393
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x3c]
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esi], eax
call fcn.0043fb03
test eax, eax
je 0x48adc9
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x6013c8
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 5
push 0x6013d4
call fcn.00413f09
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x3c]
call fcn.00434880
push eax
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.00411f3a
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.00412ac4
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x48adc9
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x601408
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 7
push 0x601410
call fcn.00413f09
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x3c]
call fcn.00434880
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 8
cmp dword [eax - 0xc], 0
jne 0x48ad66
mov ecx, edi
call fcn.004124d1
jmp 0x48adbe
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x20], esp
mov esi, esp
push eax
mov dword [ebp - 0x1c], esi
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
mov eax, dword [edi]
mov esi, esp
sub eax, 0x10
mov byte [ebp - 4], 9
push eax
mov dword [ebp - 0x24], esi
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x1c]
pop ecx
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 8
call fcn.00434114
push eax
mov ecx, edi
mov byte [ebp - 4], 0xa
call fcn.00411f3a
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x3c]
call fcn.0042e60b
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x54]
call fcn.0042e60b
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, edi
call fcn.00506d90
ret
Function at 0x48b728
Capabilities:
Get disk information
Get disk size

Disassembly:
push 0x38
mov eax, 0x5d1211
call fcn.00506dfb
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x28], ebx
call fcn.0041279d
push eax
mov ecx, edi
call fcn.00411d94
mov eax, dword [0x604b90]
mov dword [ebp - 0x18], eax
mov eax, dword [0x604b94]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x41
pop ebx
mov dword [ebp - 0x1c], eax
mov esi, ebx
mov dword [ebp - 0x24], ebx
test al, 1
je 0x48b812
lea eax, [ebp - 0x18]
mov word [ebp - 0x18], bx
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x48b80f
call fcn.0041279d
push eax
lea ecx, [ebp - 0x20]
call fcn.00411d94
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push dword [ebp - 0x2c]
lea eax, [ebp - 0x20]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push esi
push 0x604bf0
push eax
call fcn.00412690
mov eax, dword [edi]
add esp, 0x1c
cmp dword [eax - 0xc], 0
je 0x48b7f2
push 0x604c20
mov ecx, edi
call fcn.0042e473
mov esi, dword [ebp - 0x20]
mov ecx, edi
push dword [esi - 0xc]
push esi
call fcn.00412114
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 0
call fcn.00412ac4
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
inc ebx
shr eax, 1
inc esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], esi
cmp bx, 0x5a
jbe 0x48b77a
mov eax, edi
call fcn.00506da5
ret
Function at 0x48b87c
Capabilities:
Get file version info

Disassembly:
push 0x34
mov eax, 0x5d1266
call fcn.00506dc7
xor ebx, ebx
mov dword [ebp - 0x28], ebx
push ebx
push 0x605b04
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], ebx
call fcn.0042ea61
test eax, eax
jle 0x48b900
lea ecx, [ebp - 0x40]
call fcn.0042ca82
push ecx
mov esi, esp
mov byte [ebp - 4], 1
mov dword [ebp - 0x24], esi
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x24]
push eax
call fcn.00489084
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.00411f3a
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.0042e60b
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push ebx
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x48ba6f
push esi
call fcn.0059b115
pop ecx
mov ebx, eax
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x24], ebx
push esi
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x48b942
push ebx
call fcn.00576006
mov dword [esp], 0x605b5c
jmp 0x48ba74
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], esi
push eax
push 0x605b9c
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x48ba68
call fcn.0041279d
push eax
lea ecx, [ebp - 0x20]
call fcn.00411d94
mov byte [ebp - 4], 3
call fcn.0041279d
push eax
lea ecx, [ebp - 0x14]
call fcn.00411d94
mov byte [ebp - 4], 4
call fcn.0041279d
push eax
lea ecx, [ebp - 0x18]
call fcn.00411d94
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 5
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x20]
push 0x605be8
push eax
call fcn.00412690
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push edi
push 0x605c10
push eax
call fcn.00412690
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
add esp, 0x1c
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
call sub.VERSION.dll_VerQueryValueW
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push 0x605c5c
push eax
call fcn.00412690
mov ebx, dword [ebp - 0x18]
add esp, 0xc
cmp dword [ebx - 0xc], 0
jne 0x48ba34
push edi
lea eax, [ebp - 0x14]
push 0x605c90
push eax
call fcn.00412690
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
add esp, 0xc
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp - 0x24]
call sub.VERSION.dll_VerQueryValueW
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push 0x605cf4
push eax
call fcn.00412690
mov ebx, dword [ebp - 0x18]
add esp, 0xc
push dword [ebp - 0x24]
call fcn.00576006
add ebx, 0xfffffff0
push ebx
call fcn.00412393
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
add eax, 0x10
mov dword [ecx], eax
mov ecx, ebx
call fcn.00412ac4
lea ecx, [esi - 0x10]
call fcn.00412ac4
lea ecx, [edi - 0x10]
call fcn.00412ac4
jmp 0x48ba7c
push ebx
call fcn.00576006
pop ecx
push 0x605d38
mov ecx, dword [ebp + 8]
call fcn.00413f09
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, dword [ebp + 8]
call fcn.00506d90
ret
Function at 0x48ba90
Capabilities:
Get file version info

Disassembly:
push 0x224
mov eax, 0x5d128c
call fcn.00506dfb
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x230], ebx
call fcn.0041279d
push eax
lea ecx, [ebp - 0x21c]
call fcn.00411d94
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x218]
test esi, esi
jne 0x48bada
push 0x208
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x48bae2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], ebx
push eax
lea eax, [ebp - 0x218]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x48bbbb
and dword [ebp - 0x224], 0
and dword [ebp - 0x228], 0
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x48bbbb
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
lea eax, [ebp - 0x218]
push esi
push ebx
push dword [ebp - 0x220]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
push 0x605068
push esi
call sub.VERSION.dll_VerQueryValueW
cmp dword [ebp - 0x224], 0
je 0x48bbbb
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x48bbbb
mov si, word [eax + 0x12]
mov dx, word [eax + 0x10]
mov cx, word [eax + 0x16]
mov ax, word [eax + 0x14]
movzx eax, ax
push eax
movzx eax, cx
push eax
movzx eax, dx
push eax
movzx eax, si
push eax
lea eax, [ebp - 0x21c]
push 0x6050f0
push eax
call fcn.00412690
mov esi, dword [ebp - 0x22c]
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, dword [ebp - 0x21c]
add esi, 0xfffffff0
push esi
call fcn.00412393
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00412ac4
mov eax, edi
call fcn.00506da5
ret
Function at 0x48dcdd
Capabilities:
Create thread
Resume thread

Disassembly:
push 4
mov eax, 0x5d17d5
call fcn.00506dc7
mov edi, ecx
xor ebx, ebx
push 0x204
mov dword [ebp - 4], ebx
call fcn.00506ecd
pop ecx
push dword [ebp + 8]
mov esi, eax
lea ecx, [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp + 0xc]
push 8
mov dword [esi], ecx
call fcn.00506ecd
lea ecx, [ebp - 0x10]
push ecx
push 4
push eax
push 0x4e8dfe
push ebx
mov dword [eax], edi
mov dword [eax + 4], esi
push ebx
mov dword [ebp - 0x10], ebx
call fcn.005a2a64
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x48dd49
push esi
mov ecx, edi
call fcn.0045f364
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
call fcn.00506d90
ret 8

Function at 0x48e689
Capabilities:
Create thread
Resume thread

Disassembly:
push 8
mov eax, 0x5d1926
call fcn.00506dc7
mov ebx, ecx
push 0x210
mov dword [ebp - 4], 1
call fcn.00506ecd
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, eax
pop ecx
push dword [ebp + 8]
mov dword [ebp - 0x10], edi
lea ecx, [edi + 8]
push ecx
call esi
push dword [ebp + 0x10]
lea ecx, [edi + 0x108]
push ecx
call esi
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x18]
push ecx
mov dword [edx + 0x208], eax
push ecx
mov dword [edx], edi
mov esi, esp
mov dword [edx + 4], ecx
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
mov dword [ebp + 0x14], esp
mov dword [ebp + 0xc], esi
push eax
mov dword [ebp + 0xc], eax
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
push edi
mov edi, dword [ebp + 8]
push ecx
mov esi, esp
mov byte [ebp - 4], 2
add edi, 0xfffffff0
mov dword [ebp + 0x18], esi
push edi
call fcn.00412393
pop ecx
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
mov byte [ebp - 4], 1
call fcn.0049ca32
test al, al
je 0x48e741
mov ecx, dword [ebp - 0x10]
push ecx
push 1
push 0x7f1
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x48e780
push 8
call fcn.00506ecd
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x14]
push ecx
push 4
push eax
push 0x4e8e3a
push edx
mov dword [eax], ebx
push edx
mov dword [ebp - 0x14], edx
call fcn.005a2a64
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x48e780
push esi
mov ecx, ebx
call fcn.0045f364
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, edi
call fcn.00412ac4
mov ecx, dword [ebp + 0xc]
call fcn.00412ac4
call fcn.00506d90
ret 0x14
Function at 0x48f12d
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x814
mov eax, 0x5d1aa5
call fcn.00506dfb
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x818]
push eax
mov eax, dword [ecx + 4]
or eax, 0x20019
push eax
push 0
push dword [ecx + 0x10]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x48f168
xor eax, eax
jmp 0x48f21e
xor edi, edi
call fcn.0041279d
push eax
lea ecx, [ebp - 0x820]
call fcn.00411d94
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x814]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x810]
mov dword [ebp - 4], ecx
push eax
push ecx
jmp 0x48f1e7
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00413f09
lea eax, [ebp - 0x81c]
mov byte [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.0042e1b5
mov ecx, dword [ebp - 0x81c]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00412ac4
inc edi
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push dword [ebp - 0x818]
mov dword [ebp - 0x814], 0x80
call esi
test eax, eax
je 0x48f19b
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x820]
neg eax
sbb esi, esi
add ecx, 0xfffffff0
call fcn.00412ac4
lea eax, [esi + 1]
call fcn.00506da5
ret 4
Function at 0x48fe5b
Capabilities:
Create thread
Resume thread

Disassembly:
push 4
mov eax, 0x5d1c95
call fcn.00506dc7
mov ebx, ecx
push 0x210
mov dword [ebp - 4], 1
call fcn.00506ecd
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, eax
pop ecx
push dword [ebp + 8]
mov dword [ebp - 0x10], edi
lea ecx, [edi + 8]
push ecx
call esi
push dword [ebp + 0x10]
lea ecx, [edi + 0x108]
push ecx
call esi
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x18]
push ecx
mov dword [edx + 0x208], eax
push ecx
mov dword [edx], edi
mov esi, esp
mov dword [edx + 4], ecx
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
mov dword [ebp + 0xc], esp
mov dword [ebp + 0x14], esi
push eax
mov dword [ebp + 0x14], eax
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
mov eax, dword [ebp + 8]
push edi
push ecx
add eax, 0xfffffff0
mov byte [ebp - 4], 2
mov esi, esp
push eax
mov dword [ebp + 0x18], esi
call fcn.00412393
pop ecx
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
mov byte [ebp - 4], 1
call fcn.0049cebe
test al, al
je 0x48ff1c
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x208], 1
jne 0x48ff77
push eax
push 1
push 0x7fc
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x48ff77
push 8
call fcn.00506ecd
mov esi, eax
mov dword [esp], str.bendizhuti
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 8]
mov dword [esi], ebx
mov dword [esi + 4], eax
call fcn.0042e69b
xor ecx, ecx
test eax, eax
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ecx
push eax
push 4
push esi
jne 0x48ff53
push 0x4e8dc2
jmp 0x48ff58
push 0x4e8e76
push ecx
push ecx
call fcn.005a2a64
mov esi, eax
add esp, 0x18
test esi, esi
je 0x48ff77
push esi
mov ecx, ebx
call fcn.0045f364
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp + 0x14]
call fcn.00412ac4
call fcn.00506d90
ret 0x14
Function at 0x490e19
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 8
mov edi, ecx
call fcn.00506ecd
lea ecx, [ebp - 4]
xor edx, edx
push ecx
push 4
push eax
push 0x4e8ee7
push edx
mov dword [eax], edi
push edx
mov dword [ebp - 4], edx
call fcn.005a2a64
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x490e5a
push esi
mov ecx, edi
call fcn.0045f364
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x490e60
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 8
mov edi, ecx
call fcn.00506ecd
lea ecx, [ebp - 4]
xor edx, edx
push ecx
push 4
push eax
push 0x4e8eb2
push edx
mov dword [eax], edi
push edx
mov dword [ebp - 4], edx
call fcn.005a2a64
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x490ea1
push esi
mov ecx, edi
call fcn.0045f364
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x492921
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
xor ecx, ecx
push ecx
push esi
push 0x4e8f18
push ecx
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x288], eax
pop esi
mov esp, ebp
pop ebp
ret