joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462810
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c850
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
cmp byte [ebp + 0xc], 0
mov eax, dword [ebp + 8]
je 0x462854
movdqu xmm0, xmmword [eax]
movdqu xmmword [ebp - 0x20], xmm0
jmp 0x46286d
mov eax, dword [eax]
xorps xmm0, xmm0
mov dword [ebp - 0x20], eax
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
movdqu xmm0, xmmword [ebp - 0x20]
push ebx
movdqu xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x38], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add ebx, 0x1c
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x30], ebx
push eax
mov ecx, ebx
call fcn.00463790
mov ecx, dword [ebx]
cmp eax, ecx
je 0x4628ed
lea edi, [eax + 0x10]
mov ebx, 0xc
lea esi, [ebp - 0x20]
mov edx, dword [esi]
cmp edx, dword [edi]
jne 0x4628ba
add esi, 4
add edi, 4
sub ebx, 4
jae 0x4628a5
xor ebx, ebx
jmp 0x4628e6
movzx ebx, dl
movzx edx, byte [edi]
sub ebx, edx
jne 0x4628e6
movzx ebx, byte [esi + 1]
movzx edx, byte [edi + 1]
sub ebx, edx
jne 0x4628e6
movzx ebx, byte [esi + 2]
movzx edx, byte [edi + 2]
sub ebx, edx
jne 0x4628e6
movzx ebx, byte [esi + 3]
movzx edx, byte [edi + 3]
sub ebx, edx
mov dword [ebp - 0x28], eax
test ebx, ebx
jns 0x4628f0
mov dword [ebp - 0x28], ecx
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x28]
mov eax, dword [eax]
cmp eax, dword [esi]
je 0x462919
lea ecx, [eax + 0x20]
call fcn.0046a870
push dword [ebp - 0x2c]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
jmp 0x4629ce
movdqu xmm0, xmmword [ebp - 0x4c]
push 0x490c20
movdqu xmmword [ebp - 0x24], xmm0
call fcn.0046a680
push eax
push 0x490c20
call fcn.0046a810
add esp, 0xc
mov dword [ebp - 0x14], eax
movzx eax, byte [0x4c3580]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.00462550
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x46296b
call fcn.0046a850
mov edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x2c]
add edi, 0x20
push ebx
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x1c
call fcn.0046f006
add esp, 4
lea ecx, [ebx + 0x18]
mov esi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov al, byte [ebp + 0xc]
movdqu xmm0, xmmword [ebp - 0x4c]
mov byte [esi + 0x14], al
lea eax, [ebp - 0x3c]
push eax
push 0
push esi
push 0x462b70
push 0
push 0
mov dword [esi], ebx
movdqu xmmword [esi + 4], xmm0
mov dword [esi + 0x18], edi
call fcn.00472eb0
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046f8ce
mov esp, ebp
pop ebp
ret 8
Function at 0x4629f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c890
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4bc1dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
movzx esi, byte [ebp + 0xc]
movzx eax, word [ebp + 8]
shl esi, 0x10
push ebx
or esi, eax
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x1c]
mov edx, eax
mov dword [ebp - 4], 0
mov ecx, dword [eax + 4]
cmp byte [ecx + 0xd], 0
jne 0x462a64
lea esp, [esp]
cmp dword [ecx + 0x10], esi
jae 0x462a5a
mov ecx, dword [ecx + 8]
jmp 0x462a5e
mov edx, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x462a50
cmp edx, eax
je 0x462a70
mov dword [ebp - 0x10], edx
cmp esi, dword [edx + 0x10]
jae 0x462a73
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [ebx + 0x1c]
je 0x462aa9
lea ecx, [eax + 0x14]
call fcn.0046a870
push dword [ebp - 0x18]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x490c20
mov dword [ebp - 0x1c], esi
call fcn.0046a680
push eax
push 0x490c20
call fcn.0046a810
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x18], esi
movzx edx, byte [0x4c3580]
lea eax, [ebp - 0x1c]
push edx
push eax
push 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebx + 0x1c]
call fcn.00462440
mov byte [ebp - 4], 0
test esi, esi
je 0x462af6
mov ecx, esi
call fcn.0046a850
mov edi, dword [ebp - 0x14]
push ebx
add edi, 0x14
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0xc
call fcn.0046f006
add esp, 4
lea ecx, [ebx + 0x18]
mov esi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ax, word [ebp + 8]
mov word [esi + 4], ax
mov al, byte [ebp + 0xc]
mov byte [esi + 6], al
lea eax, [ebp - 0x24]
push eax
push 0
push esi
push 0x462d80
push 0
push 0
mov dword [esi], ebx
mov dword [esi + 8], edi
call fcn.00472eb0
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x464470
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4c3530], 0
mov dword [ebp - 0x230], 0x4a7e48
mov dword [ebp - 0x22c], 0x463f80
mov dword [ebp - 0x228], 0x4a7e54
mov dword [ebp - 0x224], 0x464220
mov dword [ebp - 0x220], 0x4a7e60
mov dword [ebp - 0x21c], fcn.00463f30
jne 0x4645f2
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4645e8
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004738d5
push 0x4a7e70
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.0047392a
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x464548
push 0x4a7e48
push edi
call ebx
test eax, eax
jne 0x46459d
push edi
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004738d5
push 0x4a7e78
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.0047392a
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4645e5
push 0x4a7e48
push edi
call ebx
test eax, eax
jne 0x46459d
push edi
call esi
jmp 0x4645e5
xor esi, esi
nop
push dword [ebp + esi*8 - 0x230]
push edi
call ebx
mov dword [ebp + esi*8 - 0x22c], eax
test eax, eax
je 0x4645de
inc esi
cmp esi, 3
jl 0x4645a0
mov eax, dword [ebp - 0x22c]
mov dword [0x4bc19c], eax
mov eax, dword [ebp - 0x224]
mov dword [0x4bc1a4], eax
mov eax, dword [ebp - 0x21c]
mov dword [fcn.00463f30], eax
jmp 0x4645e5
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov dword [0x4c3530], 1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
movzx eax, ax
xor ecx, ebp
mov eax, dword [eax*8 + 0x4bc19c]
call fcn.0046f8ce
mov esp, ebp
pop ebp
ret 4
Function at 0x464880
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push edi
mov edi, dword [ebp + 0x1c]
push dword [ebp + 8]
mov dword [edi], 0
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x46490e
cmp word [ebx + 8], 2
push esi
jne 0x4648e2
cmp word [ebx + 0xa], 4
jne 0x4648e2
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x4648e2
jmp 0x4648c0
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004647b0
mov dword [edi], eax
test eax, eax
je 0x464902
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x4648c0
push 0x400
push dword [ebx]
push 0x401
push dword [ebp + 0x18]
call fcn.0047398d
add esp, 0x10
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
pop esi
pop edi
mov eax, 8
pop ebx
pop ebp
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x46491e.11001
jmp dword [eax*4 + 0x464948]
pop edi
mov eax, 0x2af9
pop ebx
pop ebp
ret 0x18
pop edi
mov eax, 0x2afa
pop ebx
pop ebp
ret 0x18
pop edi
mov eax, 0x2afb
pop ebx
pop ebp
ret 0x18

Function at 0x464fc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi]
test eax, eax
je 0x46502d
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push 0
push 0
push 0
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46504a
push esi
push dword [ebp - 4]
call fcn.0046efa9
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
push 0
push 0
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
push esi
call fcn.0046a620
push esi
call fcn.0047017a
add esp, 4
mov al, 1
pop esi
pop edi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 4]
test eax, eax
je 0x46504a
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.00464c20
add esp, 0xc
pop edi
mov esp, ebp
pop ebp
ret 8
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x465060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48b238
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4bc1dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx]
test eax, eax
je 0x4650ba
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 4]
test eax, eax
je 0x465158
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
push ecx
push dword [ebp + 8]
push eax
call fcn.00464c20
mov esi, dword [ebp - 0x10]
add esp, 0xc
test al, al
je 0x46512e
test esi, esi
je 0x465119
mov ecx, esi
call fcn.00406130
mov esi, dword [ebp - 0x10]
mov edi, eax
test esi, esi
je 0x46511b
mov ecx, esi
call fcn.0046a770
mov esi, dword [ebp - 0x10]
push edi
push eax
push dword [ebp + 0xc]
call fcn.004709a0
add esp, 0xc
mov bl, 1
jmp 0x465130
xor edi, edi
xor eax, eax
push edi
push eax
push dword [ebp + 0xc]
call fcn.004709a0
add esp, 0xc
mov bl, 1
jmp 0x465130
xor bl, bl
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x465142
mov ecx, esi
call fcn.0046a850
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x465ad0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x465b1e
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi]
test ecx, ecx
je 0x465aef
call fcn.00406130
mov ebx, eax
jmp 0x465af1
xor ebx, ebx
mov ecx, dword [edi]
test ecx, ecx
je 0x465afe
call fcn.0046a770
jmp 0x465b00
xor eax, eax
push ebx
push eax
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
pop ebp
ret 0xc
cmp dword [esi + 4], 0
je 0x465b5e
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi]
test ecx, ecx
je 0x465b36
call fcn.00406130
mov ebx, eax
jmp 0x465b38
xor ebx, ebx
mov ecx, dword [edi]
test ecx, ecx
je 0x465b45
call fcn.0046a770
jmp 0x465b47
xor eax, eax
push ebx
push eax
push dword [ebp + 8]
push dword [esi + 4]
call fcn.00464cf0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0xc
Function at 0x465b70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, edx
push esi
lea esi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x465b80
mov eax, dword [ebp + 8]
sub ecx, esi
sar ecx, 1
add ecx, ecx
mov esi, dword [eax]
test esi, esi
je 0x465bb2
push ecx
push edx
push 1
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop esi
sete al
pop ebp
ret
mov eax, dword [eax + 4]
test eax, eax
je 0x465bca
push ecx
push edx
push dword [ebp + 0xc]
push eax
call fcn.00464cf0
add esp, 0x10
pop esi
pop ebp
ret
xor al, al
pop esi
pop ebp
ret

Function at 0x465d30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cwde
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
test ecx, ecx
je 0x465d5e
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
pop ebp
ret
mov eax, dword [eax + 4]
test eax, eax
je 0x465d79
push 4
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
push eax
call fcn.00464cf0
add esp, 0x10
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x465d80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
test ecx, ecx
je 0x465da7
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
pop ebp
ret
mov eax, dword [eax + 4]
test eax, eax
je 0x465dc2
push 4
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
push eax
call fcn.00464cf0
add esp, 0x10
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x465dd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
test ecx, ecx
je 0x465df7
push 8
lea eax, [ebp + 0x10]
push eax
push 3
push 0
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
pop ebp
ret
mov eax, dword [eax + 4]
test eax, eax
je 0x465e12
push 8
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
push eax
call fcn.00464cf0
add esp, 0x10
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x465e20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x5c]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x58
push 0
push eax
mov dword [ebp - 0x60], 0
call fcn.00470180
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
push 0x5c
push esi
call dword [sym.imp.GDI32.dll_GetObjectW]
push dword [0x4bd898]
push 0x48
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [ebp - 0x60], eax
mov eax, dword [edi]
test eax, eax
je 0x465ea4
push 0x5c
lea ecx, [ebp - 0x60]
push ecx
push 3
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
test eax, eax
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046f8ce
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 4]
test eax, eax
je 0x465ecc
push 0x5c
lea ecx, [ebp - 0x60]
push ecx
push ebx
push eax
call fcn.00464cf0
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046f8ce
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046f8ce
mov esp, ebp
pop ebp
ret

Function at 0x465ee0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
movzx eax, al
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
test ecx, ecx
je 0x465f10
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
pop ebp
ret
mov eax, dword [eax + 4]
test eax, eax
je 0x465f2b
push 4
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
push eax
call fcn.00464cf0
add esp, 0x10
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x465f30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
test ecx, ecx
je 0x465f54
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 3
push 0
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov al, 1
pop ebp
ret
mov eax, dword [eax + 4]
test eax, eax
je 0x465f6d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.00464cf0
add esp, 0x10
mov al, 1
pop ebp
ret
Function at 0x465f80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
lea ebx, [edi + edi]
mov eax, ebx
mov dword [ebp - 0xc], ebx
call fcn.00473ce0
mov eax, esp
mov dword [ebp - 8], eax
test edi, edi
je 0x465fd5
mov ebx, dword [ebp + 0x10]
mov esi, eax
sub ebx, eax
push dword [0x4bd894]
movzx eax, word [ebx + esi]
push 0x60
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov word [esi], ax
lea esi, [esi + 2]
dec edi
jne 0x465fb3
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
test edx, edx
je 0x465ff0
push ebx
push eax
push 3
push 0
push dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x466005
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x466005
push ebx
push eax
push dword [ebp + 0xc]
push ecx
call fcn.00464cf0
add esp, 0x10
mov al, 1
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046f8ce
mov esp, ebp
pop ebp
ret
Function at 0x4664d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48cd1c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4bc1dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 5
push eax
call fcn.00467870
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.004690a0
cmp byte [ebx + 0x580], 0
je 0x46653c
lea ecx, [ebp - 0x10]
call fcn.0046a870
test eax, eax
je 0x46653c
lea ecx, [ebp - 0x10]
call fcn.0046a2c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebx + 0x584]
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [ebx + 0x584]
mov dword [eax + 4], eax
mov dword [ebx + 0x588], 0
cmp ecx, dword [ebx + 0x584]
je 0x466576
mov esi, dword [ecx]
push ecx
call fcn.0046f057
add esp, 4
mov ecx, esi
cmp esi, dword [ebx + 0x584]
jne 0x466561
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x466586
call fcn.0046a850
mov eax, dword [ebx + 0x584]
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [ebx + 0x584]
mov dword [eax + 4], eax
mov dword [ebx + 0x588], 0
cmp ecx, dword [ebx + 0x584]
je 0x4665c5
jmp 0x4665b0
mov esi, dword [ecx]
push ecx
call fcn.0046f057
add esp, 4
mov ecx, esi
cmp esi, dword [ebx + 0x584]
jne 0x4665b0
push dword [ebx + 0x584]
call fcn.0046f057
mov eax, dword [ebx + 0x574]
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x4665f6
push 0x4000
lea eax, [eax + eax*4]
push eax
push dword [ebx + 0x568]
call esi
jmp 0x46660e
push dword [ebx + 0x568]
call fcn.0047055c
add esp, 4
mov dword [ebx + 0x568], 0
cmp dword [ebx + 0x574], 0
mov dword [ebx + 0x56c], 0
mov dword [ebx + 0x570], 0
je 0x46663a
push 0x8000
push 0
push dword [ebx + 0x568]
call esi
lea ecx, [ebx + 0x51c]
mov byte [ebp - 4], 2
call fcn.004158e0
mov eax, dword [ebx + 0x504]
lea edi, [ebx + 0x4ec]
push eax
lea ecx, [edi + 0x18]
push dword [eax]
lea eax, [ebp - 0x18]
push eax
call fcn.0045e2f0
push dword [edi + 0x18]
call fcn.0046f057
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [ebx + 0x4b8]
mov byte [ebp - 4], 0
call fcn.0040db10
lea ecx, [ebx + 0x3b0]
mov dword [ebp - 4], 0xffffffff
call fcn.00415980
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4683d0
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
lea eax, [ebp - 0x2c]
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
mov esi, dword [edi + 0x3c8]
neg eax
mov ecx, dword [edi + 0x3cc]
cdq
and edx, dword [edi + 0x25c]
mov ebx, eax
and ebx, dword [edi + 0x258]
sub esi, ebx
mov dword [ebp - 4], ecx
push esi
push ebx
push edx
push 4
push dword [edi + 0x3c0]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [edi + 0x550], ecx
test ecx, ecx
jne 0x468436
mov dword [edi + 0x554], eax
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x258]
sub ecx, ebx
add eax, ecx
lea ecx, [edi + 0x4ec]
push eax
mov dword [edi + 0x554], eax
call fcn.004429c0
mov eax, dword [edi + 0x260]
lea ecx, [edi + 0x4b8]
sub eax, dword [edi + 0x258]
add eax, dword [edi + 0x554]
push eax
call fcn.0040df80
mov eax, dword [edi + 0x268]
lea ecx, [edi + 0x51c]
sub eax, dword [edi + 0x258]
add eax, dword [edi + 0x554]
push eax
call fcn.0042d720
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46c380
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x4c37e4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x4c3774], esi
je 0x46c3f9
cmp dword [0x4c3780], esi
je 0x46c3f9
push 0x12237
call dword [0x4c3788]
push esi
push esi
push edi
call dword [0x4c3774]
cmp dword [0x4c37cc], 0
mov esi, eax
je 0x46c3f9
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0x4a9cb8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x804]
push eax
push edi
call dword [0x4c37cc]
push 0x4c37e4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
setne al
xor ecx, ebp
pop esi
call fcn.0046f8ce
mov esp, ebp
pop ebp
ret

Function at 0x46c420
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 8]
xor bl, bl
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
push esi
call fcn.00470594
add esp, 4
mov dword [ebp - 4], eax
push eax
push esi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
mov eax, dword [ebp - 4]
je 0x46c470
cmp dword [eax + 0x30], 0x60000
mov ecx, 1
movzx ebx, bl
cmovae ebx, ecx
push eax
call fcn.0047055c
add esp, 4
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e050
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
xor bl, bl
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x46e0d7
push esi
push edi
call fcn.00470594
add esp, 4
mov esi, eax
push esi
push edi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x46e0cd
push 0x4aa170
push esi
call fcn.0046e1b0
mov ecx, dword [ebp + 0x14]
add esp, 8
push eax
call fcn.0046a240
push 0x498c14
push esi
call fcn.0046e1b0
mov ecx, dword [ebp + 0x10]
add esp, 8
push eax
call fcn.0046a240
push 0x4971ac
push esi
call fcn.0046e1b0
mov ecx, dword [ebp + 0xc]
add esp, 8
push eax
call fcn.0046a240
mov bl, 1
push esi
call fcn.0047055c
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret