joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4476e4
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x447782
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xc]
je 0x447746
cmp byte [ebx + 0x10], 0
jne 0x447746
cmp byte [ebx + 0x3c], 0
jne 0x447746
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x447767
lea edx, [ebp - 4]
mov eax, dword [0x4bf754]
call fcn.0040a574
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x439808]
call fcn.00421f9c
call fcn.004061a0
jmp 0x447767
lea edx, [ebp - 8]
mov eax, dword [0x4bf754]
call fcn.0040a574
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x439808]
call fcn.00421f9c
call fcn.004061a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447789
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b88
ret

Function at 0x447aa0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x447aee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0044761c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x447b07
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x447b10
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0044761c
dec esi
jne 0x447b32
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x44d438
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x44d4d4
push 0
mov eax, ebx
call fcn.00407794
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x44d4af
mov ebx, esi
test ebx, ebx
je 0x44d481
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.00407794
push eax
push 1
push 0
mov eax, edi
call fcn.00407794
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x44d4ca
mov ecx, dword [0x4bf580]
mov dl, 1
mov eax, dword [0x44b8a0]
call fcn.00422058
call fcn.004061a0
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x44d4f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00406b28
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, esi
call fcn.00407794
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x44d5ac
xor eax, eax
push ebp
push 0x44d5a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00407918
mov eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.00407794
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407794
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x44d587
mov edx, dword [ebp - 8]
shr edx, 1
dec edx
mov eax, ebx
call fcn.00407918
jmp 0x44d58e
mov eax, ebx
call fcn.00406b28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d5ac
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x450928
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x45097a
test eax, edx
je 0x45097d
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x45093d
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x450963
add ecx, 4
js 0x450953
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x450960
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x450989
test edx, edx
jne 0x450930
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x456068
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebx + 4]
call fcn.00407794
push eax
push 0x800
lea eax, [ebp - 0x1000]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00407794
push eax
mov eax, edi
call fcn.00407794
push eax
mov eax, esi
call fcn.00407794
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
mov ecx, eax
lea edx, [ebp - 0x1000]
mov eax, dword [ebp + 8]
call fcn.00406cb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x456c2c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x456d02
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x456cd5
push dword fs:[esi]
mov dword fs:[esi], esp
test dl, dl
je 0x456c86
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00407890
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0041b864
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004072b8
jmp 0x456c95
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.00407404
mov eax, 1
mov edx, dword [ebp - 4]
test edx, edx
je 0x456ca6
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x456cc8
mov ecx, 1
imul eax, eax, 0x5517e877
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx - 1]
xor eax, dword [ebx*4 + 0x4bde4c]
inc ecx
dec edx
jne 0x456caf
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x456cdf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456d09
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00406be8
lea eax, [ebp - 4]
call fcn.00406b4c
ret
Function at 0x456d14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x456e34
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor ecx, ecx
push ebp
push 0x456e07
push dword fs:[ecx]
mov dword fs:[ecx], esp
test dl, dl
je 0x456d7f
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00407890
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041b864
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004072b8
jmp 0x456d8e
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.00407404
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x456da8
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x456df1
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00408588
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x4be254]
mov eax, dword [eax*8 + 0x4be250]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x456db3
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x456e11
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456e3b
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00406be8
lea eax, [ebp - 4]
call fcn.00406b4c
ret
Function at 0x459edc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406c0c
mov eax, dword [ebp - 8]
call fcn.00406c0c
xor eax, eax
push ebp
push 0x459fef
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor ebx, ebx
mov eax, dword [0x4bf484]
cmp byte [eax], 0
je 0x459f42
call fcn.0040a878
cmp byte [eax + 0x15], 0
je 0x459f2f
mov ebx, pe_nt_image_headers32
jmp 0x459f42
call fcn.0040a878
cmp byte [eax + 0x14], 0
je 0x459f42
mov ebx, 0x200
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
or ebx, 0x20006
push ebx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407794
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x459fd4
cmp dword [ebp - 8], 0
jne 0x459f9d
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
jmp 0x459fc5
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00407794
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
push ebx
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459ff6
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b88
ret
Function at 0x45a004
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00406c0c
mov eax, dword [ebp - 8]
call fcn.00406c0c
xor eax, eax
push ebp
push 0x45a144
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
xor ebx, ebx
mov eax, dword [0x4bf484]
cmp byte [eax], 0
je 0x45a07a
call fcn.0040a878
cmp byte [eax + 0x15], 0
je 0x45a067
mov ebx, pe_nt_image_headers32
jmp 0x45a07a
call fcn.0040a878
cmp byte [eax + 0x14], 0
je 0x45a07a
mov ebx, 0x200
lea eax, [ebp - 0x18]
push eax
or ebx, 0x20019
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00407794
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x45a129
cmp dword [ebp - 8], 0
jne 0x45a0ab
xor ebx, ebx
jmp 0x45a0b5
mov eax, dword [ebp - 8]
call fcn.00407794
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x45a120
mov eax, dword [ebp - 0x20]
call fcn.004044d8
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x45a118
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x45a10e
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
mov byte [ebp - 0xd], 1
jmp 0x45a120
mov eax, dword [ebp - 0x1c]
call fcn.004044f4
jmp 0x45a120
mov eax, dword [ebp - 0x1c]
call fcn.004044f4
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a14b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b88
ret

Function at 0x45a42c
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov edi, edx
mov esi, eax
mov byte [esp], 0
xor ebx, ebx
mov eax, dword [0x4bf484]
cmp byte [eax], 0
je 0x45a471
call fcn.0040a878
cmp byte [eax + 0x15], 0
je 0x45a45e
mov ebx, pe_nt_image_headers32
jmp 0x45a471
call fcn.0040a878
cmp byte [eax + 0x14], 0
je 0x45a471
mov ebx, 0x200
lea eax, [esp + 4]
push eax
or ebx, 0x20006
push ebx
push 0
mov eax, edi
call fcn.00407794
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x45a4bb
mov eax, ebp
call fcn.00407794
push eax
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete byte [esp]
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
movzx eax, byte [esp]
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45a4c8
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x4bf484]
cmp byte [eax], 0
jne 0x45a4fa
mov eax, dword [ebp - 8]
call fcn.00407794
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov ebx, eax
jmp 0x45a57b
xor eax, eax
push ebp
push 0x45a55d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x4bf484]
cmp byte [eax], 0
je 0x45a53c
call fcn.0040a878
cmp byte [eax + 0x15], 0
je 0x45a529
mov ebx, pe_nt_image_headers32
jmp 0x45a53c
call fcn.0040a878
cmp byte [eax + 0x14], 0
je 0x45a53c
mov ebx, 0x200
push 0
push ebx
mov eax, dword [ebp - 8]
call fcn.00407794
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a57b
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x45a698
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0x11], cl
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45a888
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov eax, 0x45a8a4
call fcn.00407d0c
test eax, eax
je 0x45a865
cmp byte [ebp - 0x11], 0
je 0x45a858
xor edx, edx
push ebp
push 0x45a84e
push dword fs:[edx]
mov dword fs:[edx], esp
xor esi, esi
mov eax, dword [0x4bf484]
cmp byte [eax], 0
je 0x45a726
call fcn.0040a878
cmp byte [eax + 0x15], 0
je 0x45a713
mov esi, pe_nt_image_headers32
jmp 0x45a726
call fcn.0040a878
cmp byte [eax + 0x14], 0
je 0x45a726
mov esi, 0x200
lea eax, [ebp - 0x18]
push eax
or esi, 0x2000f
push esi
push 0
mov eax, dword [ebp - 0x10]
call fcn.00407794
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
xor edx, edx
push ebp
push 0x45a83d
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x45a81c
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x45a81c
mov esi, dword [ebp - 0x20]
dec esi
cmp esi, 0
jl 0x45a81c
mov eax, dword [0x4beab8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00407918
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.004070dc
push eax
push esi
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x45a812
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00407918
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.004230bc
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.004079f0
movzx ecx, byte [ebp - 0x11]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0045a698
test al, al
jne 0x45a812
call fcn.00406294
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a865
dec esi
cmp esi, 0xffffffff
jne 0x45a796
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a844
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407918
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0045a584
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a88f
lea eax, [ebp - 0x24]
call fcn.00406b28
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b88
ret
Function at 0x45abd8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov byte [ebp - 1], 6
xor edx, edx
push ebp
push 0x45acbb
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
mov eax, dword [ebp - 0x110]
cmp eax, 2
jne 0x45ac76
mov byte [ebp - 1], 4
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jb 0x45ac52
mov byte [ebp - 1], 9
cmp byte [ebp - 6], 1
jne 0x45ac3f
cmp dword [ebp - 0x118], 1
jb 0x45acb1
mov byte [ebp - 1], 0xc
jmp 0x45acb1
mov byte [ebp - 1], 0xa
cmp dword [ebp - 0x118], 1
jb 0x45acb1
mov byte [ebp - 1], 0xb
jmp 0x45acb1
cmp eax, 5
jb 0x45acb1
mov byte [ebp - 1], 5
cmp dword [ebp - 0x118], 1
jb 0x45acb1
cmp byte [ebp - 6], 1
jne 0x45ac70
mov byte [ebp - 1], 6
jmp 0x45acb1
mov byte [ebp - 1], 8
jmp 0x45acb1
cmp eax, 1
jne 0x45acad
mov byte [ebp - 1], 0
cmp dword [ebp - 0x11c], 4
jne 0x45ac95
cmp dword [ebp - 0x118], 0xa
jne 0x45ac95
mov byte [ebp - 1], 1
cmp dword [ebp - 0x11c], 4
jne 0x45acb1
cmp dword [ebp - 0x118], 0x5a
jne 0x45acb1
mov byte [ebp - 1], 2
jmp 0x45acb1
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45acc5
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b628
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406c0c
xor eax, eax
push ebp
push 0x45b787
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406b28
mov edx, dword [ebp - 4]
mov eax, 0x45b7a4
call fcn.00407d0c
test eax, eax
jne 0x45b6f7
lea eax, [ebp - 8]
mov edx, 1
call fcn.00407918
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00407794
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407794
mov edi, eax
push edi
push 0
call sub.kernel32.dll_SearchPathW
mov ebx, eax
inc ebx
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00407918
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00407794
push eax
push ebx
push 0
push edi
push 0
call sub.kernel32.dll_SearchPathW
test eax, eax
je 0x45b6eb
mov eax, dword [ebp - 8]
call fcn.00407794
call fcn.00407040
lea edx, [ebp - 8]
xchg edx, eax
call fcn.00407918
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00406f08
jmp 0x45b76c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406f08
jmp 0x45b76c
lea eax, [ebp - 8]
mov edx, 1
call fcn.00407918
push 0
mov eax, dword [ebp - 8]
call fcn.00407794
push eax
mov eax, dword [ebp - 4]
call fcn.00407794
mov edi, eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
inc ebx
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00407918
push ebx
mov eax, dword [ebp - 8]
call fcn.00407794
push eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x45b762
mov eax, dword [ebp - 8]
call fcn.00407794
call fcn.00407040
lea edx, [ebp - 8]
xchg edx, eax
call fcn.00407918
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00406f08
jmp 0x45b76c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406f08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b78e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b88
ret

Function at 0x45bc60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45bd2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406b28
xor edx, edx
push ebp
push 0x45bd0c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x45bd02
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.004077ec
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x45bcd2
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x45bce8
mov eax, ebx
mov edx, 0x45bd4c
call fcn.00407998
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0045bc10
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00406f08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45bd16
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bd36
lea eax, [ebp - 0x208]
call fcn.00406b28
ret
Function at 0x45bd50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45be44
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406b28
xor edx, edx
push ebp
push 0x45be1c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x45be12
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.004077ec
lea edx, [ebp - 0x204]
mov eax, dword [ebx]
call fcn.0045cf00
mov edx, dword [ebp - 0x204]
mov eax, ebx
call fcn.00406f08
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0045bc10
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00406f08
mov eax, dword [ebx]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x45bdfc
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x45be12
mov eax, ebx
mov edx, 0x45be60
call fcn.00407998
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45be26
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45be4b
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.00406b88
ret