joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455410
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
xor ebx, ebx
test esi, esi
je 0x455518
cmp dword [ebp + 8], ebx
je 0x455518
push 7
push 0x422408
push esi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x455449
add esi, 0xe
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, reloc.ADVAPI32.dll_TraceMessage
jne 0x455491
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x45547a
push 0x57
pop esi
test esi, esi
jle 0x455536
and esi, 0xffff
or esi, 0x80070000
jmp 0x455536
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 4], esi
cmp esi, reloc.ADVAPI32.dll_TraceMessage
jne 0x4554c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x4554b5
push 0x57
pop esi
test esi, esi
jle 0x45551d
and esi, 0xffff
or esi, 0x80070000
jmp 0x45551d
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4554a4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4554a4
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4554a4
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov esi, eax
test esi, esi
js 0x45551d
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [eax]
push 0
push dword [ebp - 4]
push eax
call dword [ecx + 0x18]
mov esi, eax
jmp 0x45551d
mov esi, 0x80004003
cmp ebx, reloc.ADVAPI32.dll_TraceMessage
je 0x455529
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x455536
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edi, edi
test esi, esi
jns 0x455545
test edi, edi
je 0x455545
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x45583e
Capabilities:
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov esi, ecx
test eax, eax
je 0x455a0e
test esi, esi
je 0x455a0e
xor ecx, ecx
push 0x5c
push esi
mov word [eax], cx
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x45588b
mov ebx, esi
jmp 0x45588e
add ebx, 2
mov edi, 0x104
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4558c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4558b4
push 0x57
pop eax
test eax, eax
jle 0x455a13
and eax, 0xffff
or eax, 0x80070000
jmp 0x455a13
mov eax, edi
push 0x422418
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c8f1
push ebx
mov eax, 0x104
call fcn.0042c8f1
mov eax, edi
push eax
call fcn.00440bc3
xor edi, edi
push 4
pop ecx
test eax, eax
je 0x4559dd
push esi
push 0x422480
mov esi, ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
call fcn.00440126
pop ecx
pop ecx
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push 3
push edi
push edi
push edi
push 0x4224c8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4559ac
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push ebx
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x455987
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
jne 0x455987
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
setne al
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
push 4
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 4
push edi
push ebx
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
je 0x4559dd
test ebx, ebx
je 0x4559f5
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov edi, 0x103
mov edx, 0x422534
mov eax, edi
call fcn.0042c88c
mov eax, edi
push ebx
mov edi, esi
call fcn.0042c8f1
xor edi, edi
jmp 0x4559fa
test ebx, ebx
je 0x4559f5
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov edx, ebx
mov eax, 0x103
call fcn.0042c88c
jmp 0x4559fa
mov edi, 0x80004005
push edi
push 0x42253c
push 4
pop esi
call fcn.00440126
pop ecx
pop ecx
mov eax, edi
jmp 0x455a13
mov eax, 0x8007000e
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 4
Function at 0x456513
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
mov esi, eax
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
call fcn.00455fa4
cmp dword [ebp - 0x10], edi
mov dword [ebp + 8], edi
mov edi, dword [ebp - 0x14]
je 0x4565d8
cmp dword [ebp - 8], 0
je 0x4565d8
lea eax, [ebp + 8]
push eax
push 3
xor ebx, ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4565db
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x14], 1
push dword [ebp + 8]
mov dword [ebp - 0x10], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4565a7
cmp dword [ebp - 0x14], 1
jne 0x4565a7
inc ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x4565db
mov edx, esi
call fcn.00440b2f
test eax, eax
je 0x4565db
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x18]
jne 0x4565c4
sub ecx, edx
sar ecx, 1
jne 0x4565ee
jmp 0x4565db
mov ebx, dword [ebp - 4]
test edi, edi
je 0x4565ee
mov edx, edi
mov eax, 0x104
call fcn.0042c88c
xor ebx, ebx
inc ebx
cmp dword [ebp - 8], 0
mov esi, dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
je 0x456600
push dword [ebp - 8]
call esi
pop ecx
cmp dword [ebp - 0xc], 0
je 0x45660c
push dword [ebp - 0xc]
call esi
pop ecx
test edi, edi
je 0x456614
push edi
call esi
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x4579c2
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov eax, dword [ebp + 0xc]
inc edi
test eax, eax
jne 0x4579f2
mov eax, 0x404a10
push 1
push 0x404a00
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea ecx, reloc.ADVAPI32.dll_TraceMessage
xor edx, edx
call fcn.00455c5a
test eax, eax
je 0x457b6c
mov eax, dword [0x468600]
xor edi, edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
test eax, eax
je 0x457a6c
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x457a6c
push 0x100
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x26d7
push dword [0x4683ec]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x457a6c
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push 0x5c5
push dword [0x468600]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call fcn.00455afc
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
test eax, eax
je 0x457b6c
push 0x41e9d8
push eax
jmp 0x457b4d
push ebx
push 0x422d50
push 4
pop esi
call fcn.00440126
pop ecx
pop ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push ebx
push dword [ebp - 0x210]
call fcn.0044d924
test eax, eax
je 0x457b47
push ebx
push dword [ebp - 0x210]
xor esi, esi
inc esi
call fcn.0044d83f
mov ebx, eax
push ebx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ebx
call fcn.0043f6bb
cmp ebx, esi
jb 0x457b47
mov edi, ebx
push esi
call fcn.0043f83d
lea eax, reloc.ADVAPI32.dll_TraceMessage
inc esi
push eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
call fcn.00455afc
mov ebx, eax
test ebx, ebx
je 0x457b2b
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edx, ebx
call fcn.00440b2f
push ebx
push 0x422d74
push 4
pop esi
call fcn.00440126
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
add esp, 0xc
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push eax
call dword [sym.imp.SETUPAPI.dll_SetupFindNextLine]
test eax, eax
je 0x457b41
cmp esi, edi
jbe 0x457ae0
mov edi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
push 0x41e9d8
push edi
call dword [sym.imp.msvcrt.dll_wcstok]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x457a91
push dword [ebp - 0x218]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 8
Function at 0x45b53c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
push eax
push 1
xor ebx, ebx
push ebx
push 0x401478
push 0x80000001
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45b5a7
push esi
push 4
pop esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x423bc8
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45b59d
cmp dword [ebp - 8], esi
jne 0x45b59d
cmp dword [ebp - 0xc], 1
sete bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x45b8e2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
mov dword [ebp - 4], esi
test ebx, ebx
jne 0x45b8fe
mov eax, 0x80070057
jmp 0x45b9c5
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push reloc.KERNEL32.dll_EnterCriticalSection
push 0x80000000
mov dword [ebx], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45b9a8
mov eax, dword [ebp - 4]
push edi
lea ecx, [ebp - 8]
push ecx
push esi
lea ecx, [ebp - 0xc]
push ecx
push esi
push esi
push eax
mov dword [ebp - 0x10], eax
mov edi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45b96f
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov edi, eax
pop ecx
test edi, edi
je 0x45b96f
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x10]
test eax, eax
mov eax, dword [ebp - 0xc]
jne 0x45b97c
mov eax, dword [ebp - 0x10]
mov esi, edi
test edi, edi
je 0x45b9a7
cmp eax, 1
jne 0x45b9a7
push edi
call dword [sym.imp.msvcrt.dll__strlwr]
push dword [ebp + 8]
mov esi, eax
push esi
call dword [sym.imp.msvcrt.dll_strstr]
add esp, 0xc
test eax, eax
je 0x45b9a7
mov dword [ebx], 1
pop edi
cmp dword [ebp - 4], 0
je 0x45b9b7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x45b9c3
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
xor eax, eax
pop esi
leave
ret 4
Function at 0x45bf59
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
xor esi, esi
inc edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
test ecx, ecx
je 0x45c058
test eax, eax
je 0x45c058
push eax
push ecx
push 0x423fe0
mov eax, 0x121
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c95b
add esp, 0xc
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x20019
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45c076
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45c06a
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
je 0x45c01d
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 2
jne 0x45c06a
lea eax, reloc.ADVAPI32.dll_TraceMessage
call fcn.0045b9dc
test eax, eax
je 0x45c06a
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov esi, edi
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call fcn.0045b9f3
test eax, eax
jne 0x45c06a
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004655f1
leave
ret 4
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x45c05a
Function at 0x45c07f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
push esi
xor esi, esi
inc esi
test edi, edi
jne 0x45c0aa
xor eax, eax
jmp 0x45c1b3
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x20019
push 0
push edi
push 0x80000000
call ebx
test eax, eax
jne 0x45c1b0
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x20019
push 0
push 0x424014
push dword [ebp - 0x10c]
call ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x45c1a8
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
push 0
push dword [ebp - 0x108]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x100
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45c14e
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
jne 0x45c14e
lea eax, reloc.ADVAPI32.dll_TraceMessage
call fcn.0045b9dc
test eax, eax
jne 0x45c190
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ecx
push dword [ebp - 0x108]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x80
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x45c190
push 0x7f
mov edx, 0x42225c
pop eax
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042ca38
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov ecx, edi
call fcn.0045bf59
push dword [ebp - 0x108]
mov esi, eax
call ebx
push dword [ebp - 0x10c]
call ebx
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004655f1
leave
ret
Function at 0x45c53a
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [reloc.ADVAPI32.dll_TraceMessage]
cmp eax, reloc.ADVAPI32.dll_TraceMessage
je 0x45c571
test eax, eax
je 0x45c6ef
mov cx, word [0x46927c]
mov word [0x468a64], cx
jmp 0x45c6ef
push ebx
xor ebx, ebx
mov dword [reloc.ADVAPI32.dll_TraceMessage], ebx
call fcn.0045c700
mov word [0x46927c], ax
test ax, ax
je 0x45c5be
push 0x10
lea ecx, [ebp - 0x30]
push ecx
movzx eax, ax
push 0x58
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x45c681
test dword [ebp - 0x22], reloc.ADVAPI32.dll_TraceMessage
je 0x45c681
xor eax, eax
inc eax
mov dword [reloc.ADVAPI32.dll_TraceMessage], eax
jmp 0x45c686
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x45c681
push edi
xor eax, eax
mov byte [ebp - 0x10], bl
lea edi, [ebp - 0xf]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x34]
push eax
push 0x20019
push ebx
push 0x424180
push 0x80000001
mov dword [ebp - 0x38], EventRegister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
test eax, eax
jne 0x45c681
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x34]
mov byte [ebp - 5], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x10]
lea edx, [ebp - 0x10]
mov ecx, ebx
jmp 0x45c65c
shl ecx, 4
cmp al, 0x30
jl 0x45c63c
cmp al, 0x39
jg 0x45c63c
add ecx, 0xffffffd0
jmp 0x45c654
cmp al, 0x41
jl 0x45c649
cmp al, 0x46
jg 0x45c649
add ecx, 0xffffffc9
jmp 0x45c654
cmp al, 0x61
jl 0x45c659
cmp al, 0x66
jg 0x45c659
add ecx, 0xffffffa9
movsx eax, al
add ecx, eax
inc edx
mov al, byte [edx]
test al, al
jne 0x45c62c
and ecx, 0x3ff
cmp ecx, 1
je 0x45c670
cmp ecx, 0xd
jne 0x45c681
xor eax, eax
inc eax
mov dword [reloc.ADVAPI32.dll_TraceMessage], eax
mov word [0x46927c], cx
jmp 0x45c686
mov eax, dword [reloc.ADVAPI32.dll_TraceMessage]
test eax, eax
jne 0x45c6e0
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x4241a8
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45c6d6
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x400000
je 0x45c6cf
mov dword [reloc.ADVAPI32.dll_TraceMessage], 1
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [reloc.ADVAPI32.dll_TraceMessage]
pop esi
test eax, eax
je 0x45c6ee
mov cx, word [0x46927c]
mov word [0x468a64], cx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004655f1
leave
ret
Function at 0x45c74f
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x4241e0
push 0x80000002
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x45c798
push 0x41c368
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x424248
push 0x80000002
call ebx
test eax, eax
jne 0x45c7c2
push 0x41c368
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x4242b8
push 0x80000002
call ebx
test eax, eax
jne 0x45c7ec
push 0x41c368
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x45c7f6
Capabilities:
Enumerate devices by category

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov eax, dword [0x467fd0]
cmp eax, 0x467fd0
je 0x45c829
test byte [eax + 0x44], 2
je 0x45c829
cmp byte [eax + 0x41], 7
jb 0x45c829
push 0x424330
push reloc.ole32.dll_CoRegisterClassObject
push dword [eax + 0x3c]
push dword [eax + 0x38]
call fcn.00459c86
lea eax, [ebp - 8]
push eax
push 0x401384
push 1
xor edi, edi
push edi
push 0x424380
mov dword [ebp - 8], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jns 0x45c861
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x45c8f0
mov edx, dword [ecx]
push ecx
call dword [edx + EventUnregister]
jmp 0x45c8f0
mov eax, dword [ebp - 8]
push edi
lea edx, [ebp - 4]
push edx
push 0x424370
mov dword [ebp - 4], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jns 0x45c88c
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x45c8e3
mov edx, dword [ecx]
push ecx
call dword [edx + EventUnregister]
jmp 0x45c8e3
mov eax, dword [ebp - 4]
cmp esi, 1
jne 0x45c8b2
test eax, eax
je 0x45c89e
mov ecx, dword [eax]
push eax
call dword [ecx + EventUnregister]
mov eax, dword [ebp - 8]
test eax, eax
je 0x45c8ab
mov ecx, dword [eax]
push eax
call dword [ecx + EventUnregister]
mov eax, 0x80004005
jmp 0x45c8f2
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov ecx, dword [ebp - 4]
mov esi, eax
test esi, esi
js 0x45c880
call fcn.0045ca33
mov esi, eax
test esi, esi
js 0x45c8d1
cmp esi, 1
jne 0x45c8d6
mov esi, 0x80004002
mov eax, dword [ebp - 4]
test eax, eax
je 0x45c8e3
mov ecx, dword [eax]
push eax
call dword [ecx + EventUnregister]
mov eax, dword [ebp - 8]
test eax, eax
je 0x45c8f0
mov ecx, dword [eax]
push eax
call dword [ecx + EventUnregister]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x45cb60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 8], 3
mov ecx, dword [ebp - 4]
jne 0x45cb9a
test ecx, ecx
jne 0x45cb9a
push 2
pop eax
test eax, eax
jne 0x45cbd4
shr ecx, 1
push ecx
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov dword [esi], eax
test eax, eax
je 0x45cbd4
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45cbcf
mov al, 1
jmp 0x45cbd6
call fcn.0046359c
xor al, al
pop esi
pop ebx
leave
ret 8

Function at 0x45d4f7
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea ecx, [ebp - 0x10]
mov esi, eax
xor ebx, ebx
call fcn.004636d2
mov edx, 0x4060e0
call fcn.0045db8b
test al, al
je 0x45d5b3
mov edx, dword [esi + 0x28]
call fcn.004648ae
test al, al
je 0x45d532
push 4
jmp 0x45d5c3
mov byte [ebp - 1], bl
test edx, edx
je 0x45d543
xor eax, eax
cmp word [edx], bx
setne al
jmp 0x45d545
mov eax, ebx
test al, al
je 0x45d56a
mov ecx, edx
movzx eax, byte [ecx]
cmp ax, word [ecx]
jne 0x45d56a
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
mov al, byte [eax + 0x469280]
test al, al
je 0x45d56a
movzx ebx, al
jmp 0x45d5c4
push edi
push edx
push 3
pop eax
lea edi, [ebp - 0x10]
call fcn.004637f0
pop edi
test eax, eax
js 0x45d5c4
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ebx, eax
cmp ebx, 2
jne 0x45d5a7
mov ecx, dword [ebp - 0x10]
call fcn.0045f812
cmp eax, 0x15e
je 0x45d5a2
cmp eax, 0x20d
jne 0x45d5a7
mov ebx, 0x80
movzx eax, byte [ebp - 1]
mov byte [eax + 0x469280], bl
jmp 0x45d5c4
mov edx, 0x4060a8
call fcn.0045db8b
test al, al
je 0x45d5c4
push 5
pop ebx
lea eax, [ebp - 0x10]
call fcn.00463afc
pop esi
mov eax, ebx
pop ebx
leave
ret