joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462856
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x664340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ebx
test edi, edi
je 0x4629b7
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], ebx
push eax
push 9
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4629b7
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0046cf80
add esp, 0xc
mov dword [ebp - 0x420], ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4629a3
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x46297d
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x424], 0x104
push eax
call fcn.0046cf80
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x428]
push eax
push 0
push 0x5d6b6c
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x462971
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.0046d467
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
push dword [ebp - 0x41c]
call ebx
test esi, esi
jne 0x4629ab
mov eax, dword [ebp - 0x420]
lea ecx, [ebp - 0x20c]
push 0x104
inc eax
push ecx
push eax
push dword [ebp - 0x418]
mov dword [ebp - 0x420], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4628e8
push dword [ebp - 0x418]
call ebx
mov eax, esi
jmp 0x4629b9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044a851
leave
ret 4

Function at 0x4634f6
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x664340]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
jne 0x46351b
xor eax, eax
jmp 0x4635ae
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
push esi
push eax
call fcn.0046cf80
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x109
push esi
push str.SYSTEMCurrentControlSetServices_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4635ac
push ebx
push 0x104
lea eax, [ebp - 0x20c]
mov ebx, esi
push eax
push esi
jmp 0x46358a
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0047a2e7
pop ecx
pop ecx
test eax, eax
je 0x46359c
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x463569
jmp 0x46359f
xor esi, esi
inc esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044a851
leave
ret 4
Function at 0x46396e
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x83c
mov eax, 0x5d29c9
call fcn.0044ac5a
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x628]
push 0x208
xor edi, edi
push edi
push eax
call fcn.0046cf80
add esp, 0xc
lea eax, [ebp - 0x628]
push edi
push 0x1a
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x848]
call fcn.00403040
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
mov dword [ebp - 4], edi
call fcn.0047bb55
pop ecx
push eax
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
lea ecx, [ebp - 0x848]
call fcn.004058f0
push esi
call fcn.0047bb55
pop ecx
push eax
push esi
lea ecx, [ebp - 0x848]
call fcn.004058f0
mov esi, 0x5d6ca4
push esi
call fcn.0047bb55
pop ecx
push eax
push esi
lea ecx, [ebp - 0x848]
call fcn.004058f0
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x848]
push eax
call esi
test eax, eax
je 0x463aee
push 0x208
lea eax, [ebp - 0x830]
push edi
push eax
call fcn.0046cf80
push 0x208
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.0046cf80
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
cmovae eax, dword [ebp - 0x848]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.0047bb33
add esp, 0x20
lea eax, [ebp - 0x420]
mov ecx, ebx
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.00462108
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.0046cf80
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x218]
push eax
call fcn.0047bb55
pop ecx
test eax, eax
jne 0x463ade
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0047bb33
pop ecx
pop ecx
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
je 0x463aee
xor edi, edi
inc edi
lea ecx, [ebp - 0x848]
call fcn.00402fe0
mov eax, edi
call fcn.0044ac04
ret 4

Function at 0x463b03
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x664340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [0x6698c8]
test bl, bl
jne 0x463b9a
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0046cf80
add esp, 0xc
lea eax, [ebp - 0x20c]
xor ebx, ebx
inc ebx
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x463b94
lea eax, [ebp - 0x20c]
push eax
call fcn.0047a632
lea eax, [ebp - 0x20c]
mov dword [esp], 0x5dcf84
push eax
call fcn.0046d467
pop ecx
pop ecx
test eax, eax
jne 0x463b8c
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.0046d467
pop ecx
pop ecx
test eax, eax
je 0x463b94
mov byte [0x6698c8], bl
jmp 0x463b9a
mov bl, byte [0x6698c8]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0044a851
leave
ret
Function at 0x464611
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x664340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
push 0x208
xor esi, esi
mov edi, ecx
push esi
push eax
call fcn.0046cf80
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0x17
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x46467c
lea eax, [ebp - 0x20c]
push 0x5d4d80
push eax
call fcn.0047bbfb
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00463ba9
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044a851
leave
ret 4

Function at 0x464883
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
push edi
push str.kernel32.dll
mov esi, ecx
call ebx
mov dword [esi], eax
test eax, eax
je 0x464904
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5dcd28
push eax
call edi
push str.IsWow64Process
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.Wow64DisableWow64FsRedirection
push dword [esi]
mov dword [esi + 0xc], eax
call edi
push str.Wow64RevertWow64FsRedirection
push dword [esi]
mov dword [esi + 0x18], eax
call edi
push 0x5de01c
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push str.advapi32.dll
mov dword [esi + 0x10], eax
call ebx
mov dword [esi + 4], eax
test eax, eax
je 0x464904
mov ebx, str.Wow64RevertWow64FsRedirection
push ebx
push eax
call edi
push ebx
push dword [esi + 4]
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x1c], eax
xor eax, eax
inc eax
jmp 0x464906
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x464963
Capabilities:
Check if file exists
Get file version info

Disassembly:
push 0x110
mov eax, 0x5d2b42
call fcn.0044ac5a
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x108]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x110], ebx
push esi
mov dword [ebp - 0x10c], esi
call fcn.00403040
xor ecx, ecx
mov dword [ebp - 0xdc], 7
xor eax, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0xe0], ecx
mov word [ebp - 0xf0], ax
push 0xc8
push ecx
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 1
push eax
call fcn.0046cf80
add esp, 0xc
cmp dword [ebp - 0xf8], 0
je 0x464ad6
cmp dword [ebp - 0xf4], 8
lea eax, [ebp - 0x108]
cmovae eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x464ad6
xor eax, eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x118]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x464a31
xor eax, eax
mov byte [ebp - 0x10c], al
push dword [ebp - 0x10c]
jmp 0x464ae4
lea eax, [edi + 1]
push eax
call fcn.0044a885
mov esi, eax
mov dword [ebp - 0x110], esi
pop ecx
test esi, esi
je 0x464a1e
push esi
push edi
push 0
push dword [ebp - 0x10c]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x464a63
push esi
call fcn.0044a88e
pop ecx
jmp 0x464a1e
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x114]
push eax
push 0x5d4d80
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x464a5a
mov eax, dword [ebp - 0x114]
push dword [ebp - 0x110]
mov edi, dword [eax + 8]
movzx esi, word [eax + 0xe]
call fcn.0044a88e
push esi
push 1
movzx eax, di
push eax
shr edi, 0x10
lea eax, [ebp - 0xd8]
push edi
push 0x5de038
push eax
call fcn.00405db0
lea eax, [ebp - 0xd8]
push eax
call fcn.0047bb55
add esp, 0x20
lea ecx, [ebp - 0xf0]
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.00403240
xor eax, eax
mov byte [ebp - 0x110], al
push dword [ebp - 0x110]
mov dword [ebx + 0x10], eax
mov ecx, ebx
mov dword [ebx + 0x14], eax
lea eax, [ebp - 0xf0]
push eax
call fcn.0044651c
lea ecx, [ebp - 0xf0]
call fcn.00402fe0
lea ecx, [ebp - 0x108]
call fcn.00402fe0
mov eax, ebx
call fcn.0044ac04
ret

Function at 0x464b16
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x464b80
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, dword [ebp + 0x18]
push eax
mov dword [ebx], eax
call fcn.0044a885
mov edi, eax
pop ecx
test edi, edi
je 0x464b80
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebx]
push eax
push edi
call fcn.0046c480
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
mov al, 1
jmp 0x464b82
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x464e62
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x244
mov eax, 0x5d2b80
call fcn.0044ac5a
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x218]
push ebx
push eax
mov dword [ebp - 0x24c], ebx
call fcn.0046cf80
add esp, 0xc
lea eax, [ebp - 0x218]
mov edi, ebx
push 0x104
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x464f52
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x464f44
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00403040
and dword [ebp - 4], 0
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00456304
pop ecx
pop ecx
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
call fcn.00402fe0
cmp dword [ebp - 0x21c], 0x10
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push dword [ebp - 0x250]
call fcn.004547f1
pop ecx
pop ecx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00403100
push 0x104
lea eax, [ebp - 0x218]
inc edi
push eax
push edi
push esi
call ebx
test eax, eax
je 0x464eb4
call fcn.0044ac04
ret
Function at 0x464f63
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x838
mov eax, 0x5d0a07
call fcn.0044ac5a
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x828]
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x840], edi
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00403040
xor ecx, ecx
lea eax, [ebp - 0x830]
push eax
push 0x20119
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.WS2_32.dll_closesocket
mov dword [ebp - 4], ecx
mov dword [ebp - 0x830], ecx
mov dword [ebp - 0x83c], ecx
mov dword [ebp - 0x838], ecx
mov dword [ebp - 0x834], ecx
call esi
test eax, eax
je 0x465005
xor eax, eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov byte [ebp - 0x82c], al
push dword [ebp - 0x82c]
mov ecx, edi
lea eax, [ebp - 0x828]
push eax
call fcn.0044651c
jmp 0x465155
lea eax, [ebp - 0x83c]
push eax
push 0x20119
push 0
push str.SoftWare
push dword [ebp - 0x830]
call esi
test eax, eax
je 0x465032
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x464fde
lea eax, [ebp - 0x838]
push eax
push 0x20119
push 0
push ebx
push dword [ebp - 0x83c]
call esi
test eax, eax
je 0x465068
push dword [ebp - 0x83c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
jmp 0x464fde
lea eax, [ebp - 0x834]
xor ebx, ebx
push eax
push 0x20119
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x838]
call esi
test eax, eax
je 0x4650b8
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x838]
call esi
push dword [ebp - 0x830]
call esi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov byte [ebp - 0x82c], bl
jmp 0x464fec
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.0046cf80
add esp, 0xc
mov dword [ebp - 0x844], 0x400
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x840]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x838]
call esi
push dword [ebp - 0x83c]
call esi
push dword [ebp - 0x830]
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.0047bb55
pop ecx
mov ecx, edi
test eax, eax
jne 0x465149
mov byte [ebp - 0x840], bl
push dword [ebp - 0x840]
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
jmp 0x464ff4
lea eax, [ebp - 0x810]
push eax
call fcn.00403040
lea ecx, [ebp - 0x828]
call fcn.00402fe0
mov eax, edi
call fcn.0044ac04
ret
Function at 0x465168
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x834
mov eax, 0x5d2bb3
call fcn.0044ac5a
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x828]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x83c], edi
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x18]
push eax
call fcn.00403040
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x838]
push eax
xor ecx, ecx
push 0x20119
push ecx
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], ecx
mov dword [ebp - 0x834], ecx
mov dword [ebp - 0x830], ecx
call esi
test eax, eax
je 0x465206
and dword [edi + 0x10], 0
and dword [edi + 0x14], 0
mov byte [ebp - 0x82c], 0
push dword [ebp - 0x82c]
mov ecx, edi
lea eax, [ebp - 0x828]
push eax
call fcn.0044651c
jmp 0x46531a
lea eax, [ebp - 0x834]
push eax
push 0x20119
push 0
push ebx
push dword [ebp - 0x838]
call esi
test eax, eax
je 0x46523d
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov byte [ebp - 0x82c], al
jmp 0x4651ed
lea eax, [ebp - 0x830]
xor ebx, ebx
push eax
push 0x20119
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x834]
call esi
test eax, eax
je 0x465285
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov byte [ebp - 0x82c], bl
jmp 0x4651ed
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.0046cf80
add esp, 0xc
mov dword [ebp - 0x840], 0x400
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x83c]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x834]
call esi
push dword [ebp - 0x838]
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.0047bb55
pop ecx
mov ecx, edi
test eax, eax
jne 0x46530e
mov byte [ebp - 0x83c], bl
push dword [ebp - 0x83c]
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
jmp 0x4651f5
lea eax, [ebp - 0x810]
push eax
call fcn.00403040
lea ecx, [ebp - 0x828]
call fcn.00402fe0
mov eax, edi
call fcn.0044ac04
ret
Function at 0x46532d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x82c
mov eax, 0x5d2be6
call fcn.0044ac5a
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x828]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x838], edi
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.00403040
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x830]
push eax
xor ecx, ecx
push 0x20119
push ecx
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ecx
mov dword [ebp - 0x830], ecx
mov dword [ebp - 0x834], ecx
call esi
test eax, eax
je 0x4653bc
and dword [edi + 0x10], 0
and dword [edi + 0x14], 0
mov byte [ebp - 0x82c], 0
mov ecx, edi
push dword [ebp - 0x82c]
lea eax, [ebp - 0x828]
push eax
call fcn.0044651c
jmp 0x46547c
lea eax, [ebp - 0x834]
push eax
push 0x20119
push 0
push ebx
push dword [ebp - 0x830]
call esi
test eax, eax
je 0x4653f3
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov byte [ebp - 0x82c], al
jmp 0x4653a3
push 0x800
xor ebx, ebx
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.0046cf80
add esp, 0xc
mov dword [ebp - 0x838], 0x400
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.0047bb55
pop ecx
mov ecx, edi
test eax, eax
jne 0x465470
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov byte [ebp - 0x82c], bl
jmp 0x4653a5
lea eax, [ebp - 0x810]
push eax
call fcn.00403040
lea ecx, [ebp - 0x828]
call fcn.00402fe0
mov eax, edi
call fcn.0044ac04
ret
Function at 0x46548f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d2c19
mov eax, dword fs:[0]
push eax
mov eax, 0x2030
call fcn.0044a8a0
mov eax, dword [0x664340]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x2028]
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x203c], edi
mov dword [ebp - 0x202c], eax
mov eax, dword [ebp + 0x18]
push eax
call fcn.00403040
xor ecx, ecx
lea eax, [ebp - 0x2038]
push eax
push 0xf013f
push ecx
push str.SoftWare
push reloc.WS2_32.dll_accept
mov dword [ebp - 4], ecx
mov dword [ebp - 0x2038], ecx
mov dword [ebp - 0x2034], ecx
mov dword [ebp - 0x2030], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x465547
xor eax, eax
mov ecx, edi
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov byte [ebp - 0x202c], al
push dword [ebp - 0x202c]
lea eax, [ebp - 0x2028]
push eax
call fcn.0044651c
jmp 0x465647
xor ecx, ecx
lea eax, [ebp - 0x2034]
push ecx
push eax
push ecx
push 0xf013f
push ecx
push ecx
push ecx
push esi
push dword [ebp - 0x2038]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
call esi
test eax, eax
je 0x46557b
push dword [ebp - 0x2038]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x465520
xor ecx, ecx
lea eax, [ebp - 0x2030]
push ecx
push eax
push ecx
push 0xf013f
push ecx
push ecx
push ecx
push ebx
push dword [ebp - 0x2034]
call esi
test eax, eax
je 0x4655b6
push dword [ebp - 0x2034]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2030]
call esi
jmp 0x465520
push 0x2000
xor ebx, ebx
lea eax, [ebp - 0x2010]
push ebx
push eax
call fcn.0046cf80
add esp, 0xc
mov dword [ebp - 0x203c], 0x1000
lea eax, [ebp - 0x203c]
push eax
lea eax, [ebp - 0x2010]
push eax
push ebx
push ebx
push dword [ebp - 0x202c]
push dword [ebp - 0x2030]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x2030]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2034]
call esi
push dword [ebp - 0x2038]
call esi
lea eax, [ebp - 0x2010]
push eax
call fcn.0047bb55
pop ecx
mov ecx, edi
test eax, eax
jne 0x46563b
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov byte [ebp - 0x202c], bl
jmp 0x465530
lea eax, [ebp - 0x2010]
push eax
call fcn.00403040
lea ecx, [ebp - 0x2028]
call fcn.00402fe0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044a851
leave
ret