joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, 0xd
mov ebx, ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0xc], esi
mov edx, dword [ecx]
push edi
call dword [edx + 0x34]
mov edi, eax
lea eax, [esp + 0x10]
push eax
push 0x4718e8
mov ecx, edi
call fcn.00409ec0
mov ecx, dword [esp + 0x10]
mov eax, 1
cmp ecx, eax
jne 0x414777
cmp dword [esp + 0x18], eax
je 0x4147a1
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x414790
mov eax, dword [eax + 4]
cmp dword [eax + 8], esi
je 0x414790
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx]
call dword [edx + 0x20]
jmp 0x414793
or eax, 0xffffffff
push 0x4718d4
push eax
call fcn.00401070
add esp, 8
lea ecx, [esp + 0x10]
call fcn.00423a50
lea eax, [esp + 0x30]
push eax
push 0x4718cc
mov ecx, edi
call fcn.00409ec0
cmp dword [esp + 0x30], 6
je 0x41481c
lea ecx, [esp + 0x20]
call fcn.00423a50
lea ecx, [esp + 0x30]
call fcn.00423a50
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x414802
mov eax, dword [eax + 4]
cmp dword [eax + 8], esi
je 0x414802
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx]
call dword [edx + 0x20]
push 0x4718b4
push eax
call fcn.00401070
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
or eax, 0xffffffff
push 0x4718b4
push eax
call fcn.00401070
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor esi, esi
mov edi, edi
cmp dword [esp + 0x30], 6
jne 0x414836
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004011a0
cmp dword [esp + 0x10], 1
jne 0x414843
fild dword [esp + 0x18]
jmp 0x414847
fld qword [esp + 0x18]
lea ecx, [esp + 0x10]
fstp qword [esp + esi*8 + 0x80]
call fcn.00423a50
inc esi
cmp esi, 4
jl 0x414820
lea ecx, [esp + 0x30]
call fcn.00423a50
lea ecx, [esp + 0x20]
push ecx
push 0x4718ac
mov ecx, edi
call fcn.00409ec0
cmp dword [esp + 0x20], 6
jne 0x4148bc
xor esi, esi
cmp dword [esp + 0x20], 6
jne 0x414896
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x10]
push edx
push esi
call fcn.004011a0
cmp dword [esp + 0x10], 1
jne 0x4148a3
fild dword [esp + 0x18]
jmp 0x4148a7
fld qword [esp + 0x18]
lea ecx, [esp + 0x10]
fstp qword [esp + esi*8 + 0x50]
call fcn.00423a50
inc esi
cmp esi, 6
jl 0x414880
jmp 0x4148f8
fld qword [0x470ac0]
fstp qword [esp + 0x50]
fld qword [0x46e5a8]
fstp qword [esp + 0x58]
fld qword [0x46e5a8]
fstp qword [esp + 0x60]
fld qword [0x470ac0]
fstp qword [esp + 0x68]
fld qword [0x46e5a8]
fstp qword [esp + 0x70]
fld qword [0x46e5a8]
fstp qword [esp + 0x78]
lea ecx, [esp + 0x20]
call fcn.00423a50
lea eax, [esp + 0x40]
push eax
push 0x4718a0
mov ecx, edi
call fcn.00409ec0
mov esi, dword [esp + 0x40]
mov ecx, dword [esp + 0x48]
xor eax, eax
cmp esi, 7
setne al
lea edx, [esp + 0x50]
dec eax
and eax, ecx
lea ecx, [esp + 0x80]
push ecx
push edx
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, ebx
call fcn.00413c30
lea ecx, [esp + 0x40]
call fcn.00423a50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41de00
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
mov esi, dword [esp + 8]
mov edx, dword [esi + 4]
mov esi, dword [esi]
xor eax, eax
test esi, esi
push edi
mov edi, ecx
jle 0x41de2e
push ebx
xor ecx, ecx
mov cl, byte [edx]
mov ebx, eax
shl ebx, 4
add ebx, eax
and ecx, 0xff
add ecx, ebx
inc edx
dec esi
mov eax, ecx
jne 0x41de14
pop ebx
xor edx, edx
div dword [edi + 4]
pop edi
pop esi
mov eax, edx
ret 4

Function at 0x41dec0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
push edi
mov edi, dword [esi + 4]
cmp eax, edi
jl 0x41df96
mov ebp, dword [esi + 0xc]
lea eax, [edi + edi + 1]
mov dword [esi + 4], eax
shl eax, 2
push eax
mov dword [esp + 0x1c], ebp
call fcn.00421140
mov ecx, dword [esi + 4]
mov dword [esi + 0xc], eax
add esp, 4
xor eax, eax
test ecx, ecx
jle 0x41df12
lea ecx, [ecx]
mov ecx, dword [esi + 0xc]
mov dword [ecx + eax*4], 0
mov ecx, dword [esi + 4]
inc eax
cmp eax, ecx
jl 0x41df00
test edi, edi
jle 0x41df8d
mov dword [esp + 0x14], edi
lea ebx, [ebx]
cmp dword [ebp], 0
je 0x41df7b
mov ecx, dword [ebp]
mov edx, dword [ecx + 8]
mov dword [ebp], edx
mov edx, dword [ecx]
mov edi, dword [edx + 4]
mov edx, dword [edx]
xor eax, eax
test edx, edx
jle 0x41df61
mov dword [esp + 0x10], edx
xor edx, edx
mov dl, byte [edi]
mov ebx, eax
shl ebx, 4
add ebx, eax
and edx, 0xff
add edx, ebx
mov eax, edx
mov edx, dword [esp + 0x10]
inc edi
dec edx
mov dword [esp + 0x10], edx
jne 0x41df40
xor edx, edx
div dword [esi + 4]
mov eax, dword [esi + 0xc]
mov eax, dword [eax + edx*4]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [eax + edx*4], ecx
cmp dword [ebp], 0
jne 0x41df26
mov eax, dword [esp + 0x14]
add ebp, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x41df20
mov ebp, dword [esp + 0x18]
push ebp
call fcn.004211d0
add esp, 4
push 0xc
call fcn.004588d2
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov ecx, dword [edx + 4]
mov edx, dword [edx]
add esp, 4
xor eax, eax
test edx, edx
jle 0x41dfd9
mov ebp, edx
lea esp, [esp]
xor edx, edx
mov dl, byte [ecx]
mov ebx, eax
shl ebx, 4
add ebx, eax
and edx, 0xff
add edx, ebx
inc ecx
dec ebp
mov eax, edx
jne 0x41dfc0
xor edx, edx
div dword [esi + 4]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + edx*4]
mov dword [edi + 8], ecx
mov eax, dword [esi + 0xc]
mov dword [eax + edx*4], edi
mov eax, dword [esi + 8]
pop edi
inc eax
mov dword [esi + 8], eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x41dec5
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
push edi
mov edi, dword [esi + 4]
cmp eax, edi
jl 0x41df96
mov ebp, dword [esi + 0xc]
lea eax, [edi + edi + 1]
mov dword [esi + 4], eax
shl eax, 2
push eax
mov dword [esp + 0x1c], ebp
call fcn.00421140
mov ecx, dword [esi + 4]
mov dword [esi + 0xc], eax
add esp, 4
xor eax, eax
test ecx, ecx
jle 0x41df12
lea ecx, [ecx]
mov ecx, dword [esi + 0xc]
mov dword [ecx + eax*4], 0
mov ecx, dword [esi + 4]
inc eax
cmp eax, ecx
jl 0x41df00
test edi, edi
jle 0x41df8d
mov dword [esp + 0x14], edi
lea ebx, [ebx]
cmp dword [ebp], 0
je 0x41df7b
mov ecx, dword [ebp]
mov edx, dword [ecx + 8]
mov dword [ebp], edx
mov edx, dword [ecx]
mov edi, dword [edx + 4]
mov edx, dword [edx]
xor eax, eax
test edx, edx
jle 0x41df61
mov dword [esp + 0x10], edx
xor edx, edx
mov dl, byte [edi]
mov ebx, eax
shl ebx, 4
add ebx, eax
and edx, 0xff
add edx, ebx
mov eax, edx
mov edx, dword [esp + 0x10]
inc edi
dec edx
mov dword [esp + 0x10], edx
jne 0x41df40
xor edx, edx
div dword [esi + 4]
mov eax, dword [esi + 0xc]
mov eax, dword [eax + edx*4]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [eax + edx*4], ecx
cmp dword [ebp], 0
jne 0x41df26
mov eax, dword [esp + 0x14]
add ebp, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x41df20
mov ebp, dword [esp + 0x18]
push ebp
call fcn.004211d0
add esp, 4
push 0xc
call fcn.004588d2
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov ecx, dword [edx + 4]
mov edx, dword [edx]
add esp, 4
xor eax, eax
test edx, edx
jle 0x41dfd9
mov ebp, edx
lea esp, [esp]
xor edx, edx
mov dl, byte [ecx]
mov ebx, eax
shl ebx, 4
add ebx, eax
and edx, 0xff
add edx, ebx
inc ecx
dec ebp
mov eax, edx
jne 0x41dfc0
xor edx, edx
div dword [esi + 4]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + edx*4]
mov dword [edi + 8], ecx
mov eax, dword [esi + 0xc]
mov dword [eax + edx*4], edi
mov eax, dword [esi + 8]
pop edi
inc eax
mov dword [esi + 8], eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8

Function at 0x421140
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x421149
ret
push eax
call fcn.004587d4
add esp, 4
test eax, eax
jne 0x421148
push 0x474b80
push 0x498080
call fcn.00458a04
add esp, 8
push 1
call fcn.0045a7a5
int3

Function at 0x421170
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
jne 0x42118c
mov eax, dword [esp + 4]
test eax, eax
je 0x421189
push eax
call fcn.004587e6
add esp, 4
xor eax, eax
ret
mov ecx, dword [esp + 4]
test ecx, ecx
push eax
je 0x4211a0
push ecx
call fcn.0045a7e5
add esp, 8
jmp 0x4211a8
call fcn.004587d4
add esp, 4
test eax, eax
jne 0x42118b
push 0x474b80
push 0x498080
call fcn.00458a04
add esp, 8
push 1
call fcn.0045a7a5
int3
Function at 0x4211f0
Capabilities:
Terminate process

Disassembly:
push edi
mov edi, dword [esp + 8]
mov eax, edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x421200
sub eax, edx
inc eax
jne 0x421222
xor eax, eax
push esi
mov esi, eax
mov ecx, edi
sub esi, edi
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x421215
pop esi
pop edi
ret
push eax
call fcn.004587d4
add esp, 4
test eax, eax
jne 0x42120e
push 0x474b80
push 0x498080
call fcn.00458a04
add esp, 8
push 1
call fcn.0045a7a5
int3

Function at 0x423670
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 4]
mov ecx, dword [edi + 8]
mov eax, esi
cdq
sub eax, edx
sar eax, 1
cmp ecx, eax
jl 0x42373d
mov ebp, dword [edi]
lea eax, [esi + esi + 1]
mov dword [edi + 4], eax
shl eax, 3
push eax
mov dword [esp + 0x14], ebp
call fcn.00421140
mov ecx, dword [edi + 4]
mov dword [edi], eax
add esp, 4
xor eax, eax
test ecx, ecx
jle 0x4236c1
mov ecx, dword [edi]
mov dword [ecx + eax*8], 0
mov ecx, dword [edi + 4]
inc eax
cmp eax, ecx
jl 0x4236b0
test esi, esi
jle 0x423734
mov edx, dword [ebp]
test edx, edx
je 0x42372a
xor ecx, ecx
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x4236f8
jmp 0x4236e0
mov ebx, eax
shl ebx, 4
and ecx, 0xff
add ebx, eax
add ecx, ebx
inc edx
mov eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x4236e0
mov ecx, dword [edi + 4]
xor edx, edx
div ecx
mov eax, dword [edi]
cmp dword [eax + edx*8], 0
je 0x42371d
mov ebx, eax
lea esp, [esp]
inc edx
cmp edx, ecx
jne 0x423717
xor edx, edx
cmp dword [ebx + edx*8], 0
jne 0x423710
mov ecx, dword [ebp]
mov dword [eax + edx*8], ecx
mov ecx, dword [ebp + 4]
mov dword [eax + edx*8 + 4], ecx
add ebp, 8
dec esi
jne 0x4236c5
mov ebp, dword [esp + 0x10]
push ebp
call fcn.004211d0
add esp, 4
mov esi, dword [esp + 0x18]
xor ecx, ecx
mov cl, byte [esi]
xor eax, eax
test cl, cl
mov edx, esi
je 0x423768
lea ecx, [ecx]
mov ebx, eax
shl ebx, 4
and ecx, 0xff
add ebx, eax
add ecx, ebx
inc edx
mov eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x423750
mov ecx, dword [edi + 4]
xor edx, edx
div ecx
mov ebp, edx
mov edx, dword [edi]
cmp dword [edx + ebp*8], 0
je 0x4237cc
jmp 0x423780
mov esi, dword [esp + 0x18]
nop
mov eax, dword [edx + ebp*8]
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x4237a7
test cl, cl
je 0x4237a3
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x4237a7
add eax, 2
add esi, 2
test cl, cl
jne 0x423783
xor eax, eax
jmp 0x4237ac
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4237c2
mov eax, dword [edi + 4]
inc ebp
cmp ebp, eax
jne 0x4237ba
xor ebp, ebp
mov eax, dword [edi]
cmp dword [eax + ebp*8], 0
jne 0x42377b
cmp dword [edx + ebp*8], 0
mov esi, dword [esp + 0x18]
jne 0x4237da
push esi
call fcn.004211f0
mov ecx, dword [edi]
add esp, 4
mov dword [ecx + ebp*8], eax
mov edx, dword [edi]
mov eax, dword [esp + 0x1c]
mov dword [edx + ebp*8 + 4], eax
inc dword [edi + 8]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x425cd0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x469c1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
push edi
call fcn.00401080
mov esi, eax
add esp, 4
test esi, esi
jne 0x425d15
push edi
push 0x475358
push 0x498080
call fcn.00458a04
add esp, 0xc
push 1
call fcn.0045a7a5
push ebx
push 0
push 1
push 0
push 1
push 1
push 0
push 0
push 0
push esi
call fcn.00401070
push 1
push 1
mov edi, eax
push 1
push edi
push esi
call fcn.00401070
push 0x11d8
mov ebx, eax
call fcn.004588d2
add esp, 0x3c
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x425d7f
mov ecx, dword [esp + 0x24]
push ecx
push 0
push edi
push ebx
push 0
push esi
mov ecx, eax
call fcn.00425070
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
pop ebx
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x427fa8
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x469cb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push esi
mov esi, ecx
mov dword [esi], 0x4756d4
mov ecx, dword [0x4994e4]
xor eax, eax
cmp ecx, eax
mov dword [esp + 4], esi
je 0x427fe0
push 0x23
push 0x47545c
lea ecx, [esp + 0x10]
call fcn.00454840
push 0x480dd4
lea eax, [esp + 0xc]
push eax
call fcn.0045867d
mov dword [0x4994e4], esi
mov dword [esi], 0x47582c
mov dword [esi + 4], eax
mov dword [esp + 0x40], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
fld qword [0x46e5a8]
fstp qword [esi + 0x18]
push 0x47584c
fld qword [0x46e5a8]
push 2
fstp qword [esi + 0x20]
mov byte [esp + 0x48], 1
fld qword [0x46e5a8]
fstp qword [esi + 0x28]
fld qword [0x46e5a8]
fstp qword [esi + 0x30]
fld qword [0x46e5a8]
fstp qword [esi + 0x38]
fld qword [0x46e5a8]
fstp qword [esi + 0x40]
call fcn.004549c0
mov ecx, dword [esp + 0x40]
add esp, 8
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x439340
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x46a3ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov eax, dword [edi + 0x34]
mov ecx, dword [eax]
lea esi, [edi + 0x30]
push eax
push ecx
lea eax, [esp + 0x18]
push eax
mov ecx, esi
mov dword [esp + 0x58], 2
call fcn.00438b60
mov eax, dword [esi + 4]
push eax
call fcn.004588cd
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [edi + 0x28]
mov ecx, dword [eax]
add esp, 4
lea esi, [edi + 0x24]
push eax
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
mov byte [esp + 0x58], 1
call fcn.00437ac0
mov eax, dword [esi + 4]
push eax
call fcn.004588cd
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [edi + 0x1c]
add esp, 4
cmp eax, 0x10
jb 0x4393d4
mov eax, dword [edi + 8]
push eax
call fcn.004588cd
add esp, 4
mov dword [edi + 0x1c], 0xf
mov dword [edi + 0x18], ebx
mov byte [edi + 8], bl
mov dword [edi], 0x476dbc
cmp dword [0x4997f8], ebx
mov dword [esp + 0x4c], 0xffffffff
jne 0x439416
push 0x2e
push 0x47545c
lea ecx, [esp + 0x1c]
call fcn.00454840
push 0x480dd4
lea edx, [esp + 0x18]
push edx
call fcn.0045867d
mov ecx, dword [esp + 0x44]
pop edi
pop esi
mov dword [0x4997f8], ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret

Function at 0x43a130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
mov al, bl
push ebp
shr al, 4
push esi
movzx eax, al
push edi
mov esi, ecx
mov ecx, dword [esi + 0x78]
mov byte [esp + 0x10], 0x30
mov byte [esp + 0x11], 0x31
mov byte [esp + 0x12], 0x32
mov byte [esp + 0x13], 0x33
mov byte [esp + 0x14], 0x34
mov byte [esp + 0x15], 0x35
mov byte [esp + 0x16], 0x36
mov byte [esp + 0x17], 0x37
mov byte [esp + 0x18], 0x38
mov byte [esp + 0x19], 0x39
mov byte [esp + 0x1a], 0x61
mov byte [esp + 0x1b], 0x62
mov byte [esp + 0x1c], 0x63
mov byte [esp + 0x1d], 0x64
mov byte [esp + 0x1e], 0x65
mov byte [esp + 0x1f], 0x66
movsx edi, byte [esp + eax + 0x10]
push ecx
push edi
call fcn.00458a62
mov dword [esp + 0x2c], eax
mov al, bl
and al, 0xf
movzx edx, al
movsx ebp, byte [esp + edx + 0x18]
mov eax, dword [esi + 0x78]
push eax
push ebp
call fcn.00458a62
mov ecx, dword [esp + 0x34]
add esp, 0x10
cmp ecx, edi
jne 0x43a1cf
cmp eax, ebp
jne 0x43a1cf
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x446a40
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x114
mov edx, dword [esp + 0x118]
push ebp
push esi
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
push edx
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [0x46e00c]
mov esi, eax
test esi, esi
jne 0x446b4a
lea ecx, [esp + 8]
call fcn.00446950
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
jne 0x446b4e
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push esi
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x34]
push ecx
push esi
mov esi, dword [0x46e018]
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x446b04
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
call fcn.00446a40
mov edi, eax
test edi, edi
jne 0x446b66
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push edi
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x446ac6
mov eax, dword [esp + 0xc]
test eax, eax
mov edi, dword [fcn.0046e010]
je 0x446b1d
push eax
call edi
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x124]
mov edx, dword [ebp]
push ecx
push edx
call dword [0x46e020]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x446b3c
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x114
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x446b59
push eax
call dword [fcn.0046e010]
mov eax, esi
pop esi
pop ebp
add esp, 0x114
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x446b75
push eax
call dword [fcn.0046e010]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x114
ret 4
Function at 0x447020
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [fcn.0046e1e4]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x447032
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [fcn.0046e014]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x453510
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x4998b4]
push eax
push 0x47aa28
push 0x498080
call fcn.00458a04
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
push 0x498080
call fcn.0045ae5b
push 0x498080
push 0xa
call fcn.00458a62
add esp, 0x20
push 1
call fcn.0045a7a5
int3

Function at 0x4537f0
Capabilities:
Terminate process

Disassembly:
dec eax
push ebp
mov ebp, dword [esp + 8]
push edi
mov edi, ecx
je 0x453845
sub eax, 2
je 0x45380f
pop edi
pop ebp
mov dword [esp + 4], 0x47ac20
jmp fcn.00453510
test edi, edi
jbe 0x453860
lea ecx, [ebp + 2]
lea eax, [edx + 8]
lea esp, [esp]
mov edx, dword [eax - 8]
mov dl, byte [esi + edx]
mov byte [ecx - 2], dl
mov edx, dword [eax - 4]
mov dl, byte [esi + edx]
mov byte [ecx - 1], dl
mov edx, dword [eax]
mov dl, byte [esi + edx]
mov byte [ecx], dl
add eax, 0xc
add ecx, 3
dec edi
jne 0x453820
pop edi
pop ebp
ret
xor eax, eax
test edi, edi
jbe 0x453860
lea ecx, [edx + 8]
mov edi, edi
mov edx, dword [ecx]
mov dl, byte [esi + edx]
mov byte [eax + ebp], dl
inc eax
add ecx, 0xc
cmp eax, edi
jb 0x453850
pop edi
pop ebp
ret

Function at 0x454bf0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi + 0x14]
inc eax
push eax
push 0x2002
call dword [0x46e1cc]
mov esi, eax
test esi, esi
je 0x454c76
push esi
call dword [0x46e1d0]
test eax, eax
je 0x454c6f
cmp dword [edi + 0x18], 0x10
jb 0x454c22
mov ecx, dword [edi + 4]
jmp 0x454c25
lea ecx, [edi + 4]
mov edx, eax
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x454c27
push esi
call dword [0x46e1d4]
push 0
call dword [0x46e348]
test eax, eax
je 0x454c59
call dword [0x46e344]
push esi
push 1
call dword [0x46e340]
call dword [0x46e33c]
call dword [fcn.0046e168]
push eax
push 0x47b00c
push 1
call fcn.004549c0
add esp, 0xc
push esi
call dword [0x46e1b8]
pop edi
pop esi
ret

Function at 0x455c40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x38
mov edx, dword [esp + 0x3c]
lea eax, [esp + 4]
push eax
push edx
mov edx, dword [esp + 0x48]
lea eax, [esp + 8]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 4
call dword [0x46e000]
test eax, eax
jne 0x455cc1
cmp dword [esp], 4
je 0x455c9b
push 0x67
push 0x47b248
lea ecx, [esp + 0x10]
call fcn.00454840
push 0x480dd4
lea ecx, [esp + 0xc]
push ecx
call fcn.0045867d
cmp dword [esp + 4], 4
je 0x455cc1
push 0x68
push 0x47b248
lea ecx, [esp + 0x10]
call fcn.00454840
push 0x480dd4
lea edx, [esp + 0xc]
push edx
call fcn.0045867d
add esp, 0x38
ret 8
Function at 0x455cd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x30
test eax, eax
jne 0x455cfa
push 0x6f
push 0x47b248
lea ecx, [esp + 8]
call fcn.00454840
push 0x480dd4
lea eax, [esp + 4]
push eax
call fcn.0045867d
mov edx, dword [esp + 0x34]
push eax
push edx
mov edx, dword [esp + 0x40]
lea eax, [esp + 0x44]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
mov dword [esp + 0x54], 0
call dword [0x46e000]
test eax, eax
jne 0x455d53
mov ecx, dword [esp + 0x3c]
cmp ecx, 1
je 0x455d53
cmp ecx, 7
je 0x455d53
cmp ecx, 2
je 0x455d53
push 0x75
push 0x47b248
lea ecx, [esp + 8]
call fcn.00454840
push 0x480dd4
lea ecx, [esp + 4]
push ecx
call fcn.0045867d
add esp, 0x30
ret 0xc

Function at 0x455d60
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx]
sub esp, 0x30
test eax, eax
jne 0x455d88
push 0x7b
push 0x47b248
lea ecx, [esp + 8]
call fcn.00454840
push 0x480dd4
lea eax, [esp + 4]
push eax
call fcn.0045867d
mov edx, dword [esp + 0x38]
push 4
lea ecx, [esp + 0x38]
push ecx
push 4
push 0
push edx
push eax
call dword [fcn.0046e014]
add esp, 0x30
ret 8

Function at 0x455db0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x30
push esi
push edi
mov edi, dword [esp + 0x3c]
test edi, edi
mov esi, ecx
jne 0x455de1
push 0x82
push 0x47b248
lea ecx, [esp + 0x10]
call fcn.00454840
push 0x480dd4
lea eax, [esp + 0xc]
push eax
call fcn.0045867d
cmp dword [esi], 0
jne 0x455e08
push 0x83
push 0x47b248
lea ecx, [esp + 0x10]
call fcn.00454840
push 0x480dd4
lea ecx, [esp + 0xc]
push ecx
call fcn.0045867d
push edi
call dword [fcn.0046e1e4]
mov edx, dword [esp + 0x40]
inc eax
push eax
mov eax, dword [esi]
push edi
push 1
push 0
push edx
push eax
call dword [fcn.0046e014]
pop edi
pop esi
add esp, 0x30
ret 8