joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4460b4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4460cb
add esp, 0xfffffff0
call fcn.0040318c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004169e4
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40eaa4]
call fcn.00402e1c
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x40eaa4]
call fcn.00402e1c
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x41883c]
call fcn.0041f954
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x446240
mov eax, dword [0x45f2e8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041fd24
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x447c54
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45f2e8]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c204
test eax, eax
je 0x4461be
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408b54
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c22c
test eax, eax
je 0x4461d2
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403d44
mov eax, dword [0x45f1d8]
cmp byte [eax], 0
jne 0x446203
mov eax, ebx
call fcn.0044632c
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x446235
call fcn.004031e4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44659c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4607c8]
cmp dword [eax + 0x24], 0
je 0x44663f
cmp dword [ebx + 0x84], 0
jne 0x446639
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44652c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x446639
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x446602
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x446639
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.0041049c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x446611
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x44704c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x447081
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403bfc
jmp 0x44708b
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403b68
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x447fc8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x448000
mov eax, esi
call fcn.0042fc90
test al, al
je 0x448000
mov eax, dword [ebx + 0x74]
call fcn.0042f994
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x448000
push 0
mov eax, dword [ebx + 0x74]
call fcn.0042f994
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x44b3b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x44b415
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_LockResource
mov esi, eax
mov dword [ebx + 0xc], esi
test esi, esi
jne 0x44b3ff
lea ecx, [ebp - 4]
mov edx, 2
mov eax, dword [0x460844]
call fcn.0044b21c
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x44afe8]
call fcn.0040b554
call fcn.004035e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b41c
lea eax, [ebp - 4]
call fcn.00403b14
ret

Function at 0x44b424
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x44b55d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
mov ecx, 0xff
mov edx, dword [ebp - 4]
call fcn.00408bd4
mov eax, ebx
call fcn.00405344
mov ebx, eax
push 0xa
lea eax, [ebp - 0x104]
push eax
push ebx
call sub.KERNEL32.DLL_FindResourceA
mov esi, eax
test esi, esi
jne 0x44b4ea
mov ebx, dword [0x4604d8]
push 0xa
lea eax, [ebp - 0x104]
push eax
push ebx
call sub.KERNEL32.DLL_FindResourceA
mov esi, eax
test esi, esi
jne 0x44b53f
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10c], eax
mov byte [ebp - 0x108], 0xb
lea eax, [ebp - 0x10c]
push eax
push 0
lea ecx, [ebp - 0x110]
mov edx, 3
mov eax, dword [0x460844]
call fcn.0044b21c
mov ecx, dword [ebp - 0x110]
mov dl, 1
mov eax, dword [0x44afe8]
call fcn.0040b590
call fcn.004035e4
jmp 0x44b53f
push esi
push ebx
call sub.KERNEL32.DLL_LoadResource
mov dword [edi + 8], eax
cmp dword [edi + 8], 0
jne 0x44b53f
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10c], eax
mov byte [ebp - 0x108], 0xb
lea eax, [ebp - 0x10c]
push eax
push 0
lea ecx, [ebp - 0x114]
mov edx, 4
mov eax, dword [0x460844]
call fcn.0044b21c
mov ecx, dword [ebp - 0x114]
mov dl, 1
mov eax, dword [0x44afe8]
call fcn.0040b590
call fcn.004035e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b564
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.00403b38
ret
Function at 0x44f518
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f48
xor eax, eax
push ebp
push 0x44f5b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0044f770
test al, al
jne 0x44f55f
lea eax, [ebp - 0x20c]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
jmp 0x44f56d
lea eax, [ebp - 0x20c]
mov edx, dword [ebp - 4]
call fcn.00408bb0
lea eax, [ebp - 0x108]
push eax
xor bl, 1
xor eax, eax
mov al, bl
push eax
push 0x44f5c0
lea eax, [ebp - 0x20c]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
mov edx, esi
lea eax, [ebp - 0x108]
call fcn.00408cd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f5b7
lea eax, [ebp - 4]
call fcn.00403b14
ret

Function at 0x44f5cc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f48
xor eax, eax
push ebp
push 0x44f66b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004089f8
mov edx, dword [ebp - 0x10]
mov eax, 0x44f684
call fcn.00404080
mov esi, eax
test esi, esi
jle 0x44f64d
mov eax, dword [ebp - 0x10]
call fcn.00403d94
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
lea eax, [ebp - 0x10]
call fcn.00403fdc
mov eax, dword [ebp - 0x10]
call fcn.00403d94
mov ecx, eax
lea eax, [ebp - 9]
mov edx, dword [ebp - 0x10]
call fcn.00408bd4
lea eax, [ebp - 9]
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f672
lea eax, [ebp - 0x10]
call fcn.00403b14
lea eax, [ebp - 4]
call fcn.00403b14
ret

Function at 0x44f688
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f48
xor eax, eax
push ebp
push 0x44f749
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.004089f8
mov edx, dword [ebp - 0x20]
mov eax, 0x44f760
call fcn.00404080
mov ebx, eax
test ebx, ebx
jle 0x44f72b
mov eax, dword [ebp - 0x20]
call fcn.00403d94
mov ecx, eax
sub ecx, ebx
lea edx, [ebx + 1]
lea eax, [ebp - 0x20]
call fcn.00403fdc
lea eax, [ebp - 0x20]
mov edx, 0x44f76c
call fcn.00403d9c
mov eax, dword [ebp - 0x20]
call fcn.00403d94
mov ecx, eax
lea eax, [ebp - 0x19]
mov edx, dword [ebp - 0x20]
call fcn.00408bd4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x19]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
mov esi, dword [ebp - 8]
imul esi, dword [ebp - 0xc]
imul esi, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f750
lea eax, [ebp - 0x20]
call fcn.00403b14
lea eax, [ebp - 4]
call fcn.00403b14
ret
Function at 0x44f770
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, eax
xor ebx, ebx
mov edx, esi
mov eax, 0x44f7cc
call fcn.00404080
test eax, eax
jne 0x44f7b6
mov edx, esi
mov eax, 0x44f7d8
call fcn.00404080
test eax, eax
jne 0x44f7b6
mov eax, esp
mov edx, esi
call fcn.00408bb0
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x44f7b6
test al, 0x10
je 0x44f7b6
mov bl, 1
mov eax, ebx
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x450638
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, dword [eax]
movzx ecx, cx
dec ecx
test ecx, ecx
jl 0x450667
inc ecx
mov ebx, esi
xor bl, byte [edx]
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x45eb08]
shr esi, 8
and esi, 0xffffff
xor ebx, esi
mov esi, ebx
inc edx
dec ecx
jne 0x450645
mov dword [eax], esi
pop esi
pop ebx
ret

Function at 0x455054
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov edi, ecx
dec edi
test edi, edi
jl 0x4550ca
inc edi
mov esi, edx
mov ax, word [ebx + 0xc]
or ax, 2
movzx edx, ax
xor ax, 1
movzx eax, ax
imul edx, eax
shr edx, 8
xor byte [esi], dl
mov edx, dword [ebx + 4]
mov al, byte [esi]
call fcn.0045066c
mov ebp, eax
mov dword [ebx + 4], ebp
and ebp, 0xff
add dword [ebx + 8], ebp
imul eax, dword [ebx + 8], 0x8088405
inc eax
mov dword [ebx + 8], eax
shr eax, 0x18
xor al, byte [ebx + 0xc]
and eax, 0xff
mov edx, dword [0x45f1d0]
mov eax, dword [edx + eax*4]
mov edx, dword [ebx + 0xc]
shr edx, 8
and edx, 0xffffff
xor eax, edx
mov dword [ebx + 0xc], eax
inc esi
dec edi
jne 0x455064
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x45515c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, eax
mov eax, dword [edi + 0x38]
mov eax, dword [eax]
call fcn.00412280
mov dword [esp + 4], eax
xor ebx, ebx
mov byte [esp], 0
jmp 0x4551f9
mov eax, edi
call fcn.00455118
mov eax, dword [edi + 0x38]
mov eax, dword [eax]
xor ecx, ecx
mov edx, dword [esp + 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [edi + 0x10]
mov eax, dword [edi + 0x38]
mov eax, dword [eax]
mov ecx, 0xc
mov ebx, dword [eax]
call dword [ebx + 4]
xor esi, esi
mov eax, edi
call fcn.004550d0
xor byte [edi + esi + 0x10], al
lea edx, [edi + 4]
mov al, byte [edi + esi + 0x10]
call fcn.00455228
inc esi
cmp esi, 0xc
jne 0x4551a5
cmp byte [edi + 0x20], 0
je 0x4551d3
mov al, byte [edi + 0x1b]
cmp al, byte [edi + 0x1f]
sete bl
jmp 0x4551e9
mov al, byte [edi + 0x1b]
cmp al, byte [edi + 0x1f]
jne 0x4551e3
mov al, byte [edi + 0x1a]
cmp al, byte [edi + 0x1e]
je 0x4551e7
xor ebx, ebx
jmp 0x4551e9
mov bl, 1
test bl, bl
jne 0x4551f6
lea edx, [edi + 0x30]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx]
inc byte [esp]
test bl, bl
jne 0x455209
mov al, byte [esp]
cmp al, byte [edi + 0x34]
jb 0x45517a
test bl, bl
jne 0x45521e
mov dl, 1
mov eax, dword [0x44bc18]
call fcn.0044c814
call fcn.004035e4
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x455228
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
mov edx, dword [edi]
mov eax, ebx
call fcn.0045066c
mov esi, eax
mov dword [edi], esi
and esi, 0xff
add dword [edi + 4], esi
imul esi, dword [edi + 4], 0x8088405
inc esi
mov dword [edi + 4], esi
mov eax, esi
shr eax, 0x18
mov edx, dword [edi + 8]
call fcn.0045066c
mov dword [edi + 8], eax
pop edi
pop esi
pop ebx
ret

Function at 0x459e44
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403f58
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x459e5d
test al, 0x10
jne 0x459e61
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x45ac74
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45addd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403bac
mov eax, dword [ebp - 0x10]
call fcn.0045a8c4
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x45acc6
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00403fdc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0045b354
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x45ad9b
xor eax, eax
push ebp
push 0x45ad94
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0045aa70
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0045ae0c
test al, al
je 0x45ad72
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403bfc
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x45ad72
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00403f58
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x45ad6c
mov eax, dword [ebp - 0x14]
call fcn.00403f58
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00403ccc
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0045ac74
dec ebx
cmp ebx, 0xffffffff
jne 0x45ad25
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ad9b
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0045aa70
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00403f58
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.0045aa5c
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ade4
lea eax, [ebp - 0x3c]
call fcn.00403b14
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403b38
ret
Function at 0x45ae0c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402b64
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x45f568]
cmp byte [edx + 8], 0
je 0x45ae70
mov edx, dword [0x45f564]
cmp dword [edx], 2
jne 0x45ae70
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret

Function at 0x45ae74
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x45af2c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0045ae0c
test al, al
je 0x45af0e
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00403bfc
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x45af0e
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403f58
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00403f58
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00403ccc
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x45aec7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45af33
lea eax, [ebp - 0x2c]
call fcn.00403b14
lea eax, [ebp - 0xc]
call fcn.00403b14
ret
Function at 0x45af3c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x45aff4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0045ae0c
test al, al
je 0x45afd6
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00403bfc
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x45afd6
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403f58
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.00403f58
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00403ccc
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x45af8f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45affb
lea eax, [ebp - 0x2c]
call fcn.00403b14
lea eax, [ebp - 0xc]
call fcn.00403b14
ret

Function at 0x45b268
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0045a8d8
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403f58
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x45b2c6
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x45f3d0]
mov dl, 1
mov eax, dword [0x45a6b4]
call fcn.0040b64c
call fcn.004035e4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45b2d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403f58
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45b328
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x45f574]
mov dl, 1
mov eax, dword [0x45a6b4]
call fcn.0040b64c
call fcn.004035e4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0045a908
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100010a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10001164
cmp dword [ebp - 4], 0x50000000
jb 0x100010e1
cmp dword [ebp - 4], 0x80000000
ja 0x100010e1
mov dword [ebp - 4], 0x4fff0000
jmp 0x100010ba
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100d44a0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10001107
jmp 0x10001164
cmp dword [ebp - 0x14], 0x10000
jne 0x1000114a
cmp dword [ebp - 0x18], 0x10000
jb 0x1000114a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000113d
mov eax, dword [ebp - 8]
jmp 0x10001166
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000115f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100010ba
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10001170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000122c
cmp dword [ebp - 4], 0x50000000
jb 0x100011ac
cmp dword [ebp - 4], 0x80000000
ja 0x100011ac
mov dword [ebp - 4], 0x80010000
jmp 0x10001185
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100d44a0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100011d2
jmp 0x1000122c
cmp dword [ebp - 0x14], 0x10000
jne 0x10001215
cmp dword [ebp - 0x18], 0x10000
jb 0x10001215
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10001208
mov eax, dword [ebp - 8]
jmp 0x1000122e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10001227
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10001185
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100019a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100019b5
xor eax, eax
jmp 0x10001a2a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100019e2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10001a25
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10001a23
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10001a1f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10001a23
xor eax, eax
jmp 0x10001a2a
jmp 0x100019d9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1054a060]
mov dword [ebp - 4], eax
jmp 0x10001c09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001c26
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10001c00
mov esp, ebp
pop ebp
ret